docs(quick-261106-kt2): in-process deferred:purge, migrate and queue:clear reuse the published database

Run in-process on an app that already published its pool, queue:clear failed
with "backpack: duplicate provider for *sql.DB". It now goes through
withAppDB; the CLI path is unchanged.

.gitignore

@@ -1,6 +1,10 @@
 # Go
 /bin/
 /examples/hello/bin/
+
+# Application log files (diary daily channel)
+/storage/
+/examples/hello/storage/
 /dist/
 /site/
 *.test

.planning/G15OFFICE.md

@@ -0,0 +1,54 @@
+# g15office sync
+
+Todos and phases in `.planning/` are mirrored in g15office, project `summercms` (see `g15office.json`). Keep the two in sync.
+
+## Todos
+
+- Every todo in `todos/pending/` has a g15office task, and its frontmatter carries the task ID: `g15office: <id>`.
+- Capturing a todo creates its g15office task in the same session (type Bug, Feature, Improvement or Task; the description ends with `Local: .planning/todos/pending/<file>`). Write the ID back into the frontmatter.
+- Closing a todo (moving it to `todos/done/`) also moves its task to `Live`, or to `Rejected` if it was dropped, with a one-line comment saying where it was done.
+- A todo promoted to a phase closes into that phase's milestone task. For example, `backend-admin-api-tokens` became the Phase 16.3 task.
+
+## Phases
+
+Each roadmap phase has one milestone task titled `[Phase N] <name>`, type Task. Post a short comment on it whenever the phase advances (discussed, planned, a plan executed, verified, UAT, shipped), and keep its status in step:
+
+| Phase state | g15office status |
+|---|---|
+| Not discussed, or discussed but not planned | To do |
+| Planned or executing | In progress |
+| Executed, waiting on verification/UAT | Testing |
+| Complete | Live |
+
+A new phase, inserted or added, gets its task when it is added to `ROADMAP.md`. A todo that a phase will deliver becomes a subtask of that phase's task.
+
+| Phase | Task | Phase | Task |
+|---|---|---|---|
+| 1 | 1ar7xvcd | 14.2 | fdlwwsfh |
+| 2 | 7uqoumsi | 14.2.1 | bf2wsxhz |
+| 3 | 0tszvge7 | 14.3 | utmjarsp |
+| 4 | qbwhi5u9 | 15 | qqbp8xtm |
+| 5 | 5ahymkhp | 16 | n0nuhzca |
+| 6 | altu10qm | 16.1 | y7adhmsm |
+| 7 | jzdzafce | 16.2 | gwzqpjyi |
+| 8 | 9nwkuxzo | 16.3 | 5lcivllc |
+| 9 | hrjqlvb8 | 17 | ejoiuzy4 |
+| 10 | vgrmjuwl | 18 | 46vnjevj |
+| 10.1 | hwr4istb | 18.1 | 2vriy9pw |
+| 10.2 | 6nwcght4 | 19 | 6nojs2go |
+| 11 | sz63omvi | 19.1 | uakdpkc8 |
+| 11.1 | 9crhrf7k | 19.3 | lpybyjdh |
+| 11.2 | pvwvnvvi | 19.4 | l7t8dbyl |
+| 12 | odwb6onw | 19.5 | onunbz3l |
+| 12.1 | c5wcij0a | 19.6 | avoroeb4 |
+| 12.2 | hkoccgbx | 19.7 | dcnv4mha |
+| 13 | nkbr2ybg | 20 | xo463rwk |
+| 14 | cwlaryop | 30 | 0rkcboo0 |
+| 14.1 | v0j5lwvq | 31 | hgol7otp |
+|  |  | 19.4.1 | g02hcroj |
+|  |  | 19.6.1 | hioyvbxa |
+|  |  | 19.8 | t9k2efpy |
+|  |  | 32 | 8gldeain |
+|  |  | 33 | ebilbgte |
+
+Backlog phase 999.1 (newsletter) has no task until it is promoted into the roadmap.

.planning/PROJECT.md

@@ -55,6 +55,22 @@ Validated in Phase 8: OAuth2.1 authorization server
 - [x] Direct standard-library OAuth 2.1-style authorization server (`wristband`): RFC 8414 metadata, RFC 7591 dynamic registration, authorize with S256 PKCE and JWT-guarded consent, authorization_code and rotating refresh_token grants with replay lineage-kill, RFC 8707 resource handling, connected-app list/revoke, `fonoteka:oauth-client` operator command, and the `/me` bootstrap the unchanged fonoteka-mcp process uses
 - [x] Byte parity with recorded PHP across all nine OAuth routes and a 17-step MCP lifecycle; the real unmodified fonoteka-mcp completes discovery, DCR, PKCE, consent, token, tool call, refresh, replay rejection and revoke against the Go binary; `scripts/check-phase8.sh` is the sign-off gate (its Playwright UI matrix stage is a named carried-forward follow-up)
 
+Validated in Phase 19.1: Chat satellites
+
+- [x] Shared plugins sm-chatbots-plugin, sm-chatvideo-plugin (LiveKit), sm-forum-plugin (breakwater-sanitized markdown), sm-herald-plugin (web push, SSRF-guarded) and sm-userfriends-plugin run on SummerCMS behind JWT APIs, with GDPR cascades on `user.Deleting`; `scripts/check-phase19.1.sh` is the fail-closed gate (UAT and security 2026-10-18)
+
+Validated in Phase 19.4: OIDC provider on wristband
+
+- [x] `wristband` has an OpenID Connect flavour (discovery, JWKS with RS256/ES256 and key rotation, id_token with nonce and at_hash, userinfo, resumable authorize with consent and account switching, pairwise subjects, opt-in refresh), and the new sm-oauthserver-plugin hosts it with PHP-path routes, branded consent and error pages, Clients and Branding admin screens and a Winter import that keeps kids, tokens and secrets; `scripts/check-phase19.4.sh` is the fail-closed gate (UAT and security 2026-10-20). PHP parity recording deferred to the WavePath cutover (D-14 amended)
+
+Validated in Phase 19.5: Social login
+
+- [x] The new sm-sociallogin-plugin signs users in with Google, GitHub, Microsoft and Facebook through PHP's `/oauth/{provider}` paths, with a provider registry other plugins extend, the SPA one-time-code handoff, the pending-registration branch and linking through a one-time link ticket; a verified email auto-links only onto an account that proved its address (`users.email_verified_at` in sm-user-plugin, a deliberate divergence from PHP); `scripts/check-phase19.5.sh` is the fail-closed gate (UAT and security 2026-10-21). The email-proof fix (sm-user-plugin v0.1.5, sm-sociallogin-plugin v0.1.2) is released with the 19.8 release
+
+Validated in Phase 19.6.1: Backend Administrators screen
+
+- [x] Backend admin users and roles are managed in the admin SPA (Settings → System), WinterCMS-style, with `backend.manage_users` / `backend.manage_roles`, server-side privilege rules (superuser-only flag, ceilings, self-edit, outranking, last-superuser lock) and a generic record-action seam; `scripts/check-phase19.6.1.sh` is the fail-closed gate (UAT 26/26 and security 33/33 closed, 2026-10-22)
+
 ### Active
 
 Framework kernel
@@ -83,7 +99,7 @@ Background and integrations
 
 Admin
 
-- [ ] Backend admin users with roles, separate from frontend users, as in WinterCMS
+- (backend admin users and roles — moved to Validated in Phase 19.6.1)
 - [ ] `fields.yaml` and `columns.yaml` parsed (goccy/go-yaml) into a JSON form and list schema served per controller, with the field types Płytarium actually uses (text, textarea, checkbox, switch, dropdown with model-method options, relation with nameFrom/emptyOption) plus layout hints (span, tabs, context, attributes), and a first-class relation-manager schema replacing the one `partial` field
 - [ ] A minimal Vue 3 + TypeScript admin SPA that renders those schemas as lists and forms for the five Płytarium controllers (Albums, Artists, Collections, Genres, Styles), with types generated from the API's OpenAPI document
 
@@ -139,6 +155,11 @@ Quality
 - **Commits**: no co-author tags; one logical change per commit; planning docs and code in separate commits
 - **Core plugin contracts**: the PHP user, blog, pages and payment plugins are shared across many projects; the Go ports must preserve their contracts and the PHP originals are not changed as part of this project
 
+Validated in Phase 18.1: Payment Gateway Subscriptions
+
+- [x] Generic subscriptions core (`sm-paymentgatewaysubscriptions-plugin`, pgsub v0.1.1) and pgstripe's subscription gateway, signed webhook and claim-first River job (pgstripe v0.1.1) on framework v0.2.2; admin plans/subscriptions screens, headless customer API and the layer's Pg subscription components
+- [x] Live Stripe test-mode UAT 8/8 on a `summer build` demo app: checkout, single `activated` event, 409 on a second subscription, portal and site cancellation, admin sync and reorder; security audit 51 threats, 0 open (`18.1-SECURITY.md`)
+
 ## Key Decisions
 
 | Decision | Rationale | Outcome |
@@ -163,6 +184,15 @@ Quality
 | Framework and application in two repos from day one (`summercms.go`, `fonoteka.go`) | Retrofitting the split later is more disruptive; shared stack plugins can be extracted for keios.eu without touching the framework; the framework never imports an app | ✓ Good (Phase 3: fonoteka.go workspace, user + fonoteka plugins, app.Handler test seam) |
 | Shared core plugins live in their own `sm-<name>-plugin` repos, mounted into each application as git submodules (first: sm-user-plugin, module `git.golem15.com/golem15/sm-user-plugin`) | A second application (sm-summercmsio-app) exists and the Journal port is next; one copy per core plugin instead of forks; supersedes the Phase 1 keios.eu trigger (`.planning/notes/core-plugins-own-repos.md`) | ✓ Good (2026-10-02, quick 261002-esz) |
 | OAuth identities live in sm-user-plugin; Index/Destroy are host-mounted on the JWT group | Social-login rows are a user-plugin table (D-01); routes stay off `/_user` so the host owns Winter 404 and `throttle:10,1` | ✓ Good (Phase 14.1, 2026-10-05; corpus 175/175/0) |
+| The local dev stack is the Nuxt app proxied to the Go binary, guarded fail-closed (`fonoteka.go/scripts/dev-stack.sh`), with dev-only seed and marker route gated on `SUMMER_ENV=local` only | Proves the port in daily use before cutover without touching the production origin; `dev` is refused because shared servers often use that name (review WR-05) | ✓ Good (Phase 14.2, 2026-10-12; gate e2e 17/0/0/0, manual UAT 1-11) |
+| Framework serves public uploads itself (`storage.uploads.serve`, opt-in) with nosniff, a sandboxing CSP and attachment disposition for non-images | Local runs need WinterCMS upload URLs without nginx; the hardening keeps uploaded HTML or SVG from running on the app origin (review WR-03) | ✓ Good (Phase 14.2) |
+| The opt-in request log (`http.access_log`) records method, matched pattern, status and duration, never the URL path | Share and invitation tokens travel in paths (review WR-01); an unported route shows as a 404 with an empty pattern | ✓ Good (Phase 14.2) |
+| Subscription state comes from Stripe, not the event snapshot (Phase 18.1, D-21 amended) | Out-of-order webhooks regressed rows; the job re-retrieves the subscription under a per-subscription advisory lock, and a portal `cancel_at` counts as cancel at period end | ✓ Good (Phase 18.1 UAT, 2026-10-16) |
+| A soft (optional) plugin dependency still requires the provider module in `go.mod`; only `Requires()` omits it | A typed `Lookup` needs the package that declares the interface; optional means "skipped at Boot when absent", not "not compiled in" (`docs/plugins/extending.md`) | ✓ Good (Phase 19.1 UAT override, 2026-10-18) |
+| OIDC on wristband with golang-jwt v5, not zitadel/oidc (Phase 19.4, `notes/2026-10-19-oidc-on-wristband-golang-jwt.md`) | wristband already owned the OAuth flows and PHP-compatible encoding; zitadel's own storage and routing would fight both. go-oidc and x/oauth2 are test-only, for relying-party interop | ✓ Good (Phase 19.4 UAT, 2026-10-20) |
+| PHP OIDC parity is recorded at the WavePath cutover, not in Phase 19.4 (D-14 amended) | The harness ships and replays Go-side; recording needs the live PHP site, and WavePath's provider must not move until the replay is green | — Pending (todo `2026-10-19-record-php-oidc-parity-against-wavepath`) |
+| Administrators and Roles live in cabana as an internal pseudo-plugin; privilege rules run in the save transaction; contributed Administrators Runs are wrapped with `guardOutranked` | WinterCMS screens were missing and 19.7 needs the record-action seam; a delegated editor must not outrank the target or capture a code-declared role | ✓ Good (Phase 19.6.1 UAT 26/26, 2026-10-22) |
+| MCP OAuth advertises one scope list, puts the MCP subject on the request, and stores one consent row per user and client (Phase 32.1) | Declared member-token scopes join the wristband and pier lists; an empty wristband list stays the five fixed names. `Implies` expands only for OAuth MCP subjects. A decision replaces the stored scopes, revoke deletes that client's MCP codes, and the one-time backfill rolls back as a no-op | ✓ Good (framework v0.5.2, sm-oauthserver-plugin v0.1.4, sm-user-plugin v0.1.16; vue-oauth-layer v0.1.0 is local only, 2026-10-28) |
 
 ## Evolution
 
@@ -182,4 +212,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-10-05 after Phase 14.1 completion*
+*Last updated: 2026-10-28 after Phase 32.1 completion*

.planning/STATE.md

@@ -1,19 +1,19 @@
 ---
 msd_state_version: "1.0"
 milestone: v1.0
-current_phase: "16.2"
-current_phase_name: plugin-provided-field-types-and-the-blog-editor-formwidget
-status: executing
-stopped_at: Completed 16.1-03-PLAN.md
-last_updated: "2026-10-09T21:54:52.956Z"
-last_activity: 2026-10-09
-last_activity_desc: Phase 16.1 execution started
-state_head: cd25af08782e69da40515350c21a30aaa229e8c2
+current_phase: "19.7"
+current_phase_name: Generic MCP module (INSERTED)
+status: verifying
+stopped_at: Phase 32 context gathered
+last_updated: "2026-10-25T21:26:24.117Z"
+last_activity: 2026-10-23
+last_activity_desc: "Completed 19.7-08: plugin gap closure, E-1 logo, E-2 member token scopes; paused before 19.7-09"
+state_head: 9a76c7ec1c0c17e93e00086231af78648eb40c43
 progress:
-  total_phases: 34
-  completed_phases: 13
-  total_plans: 157
-  completed_plans: 147
+  total_phases: 47
+  completed_phases: 37
+  total_plans: 242
+  completed_plans: 238
 gsd_state_version: "1.0"
 milestone_name: milestone
 ---
@@ -22,25 +22,25 @@ milestone_name: milestone
 
 ## Project Reference
 
-See: .planning/PROJECT.md (updated 2026-09-16)
+See: .planning/PROJECT.md (updated 2026-10-22)
 
 **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
-**Current focus:** Phase 16.1 — Journal admin urgent fixes: relation search, list state, post form content and excerpt (INSERTED)
+**Current focus:** Phase 19.7 — Generic MCP module (INSERTED)
 
 ## Current Position
 
-Phase: 16.2 (plugin-provided-field-types-and-the-blog-editor-formwidget) — READY TO EXECUTE
-Plan: 3 of 3
-Status: Ready to execute
-Last activity: 2026-10-09 — Phase 16.1 execution started
+Phase: 19.7 (Generic MCP module (INSERTED)) — EXECUTING
+Plan: 5 of 5
+Status: Phase complete — ready for verification
+Last activity: 2026-10-23 — Phase 19.7 execution started
 
-Progress: [██████████] 100%
+Progress: [████████░░] 82%
 
 ## Performance Metrics
 
 **Velocity:**
 
-- Total plans completed: 65
+- Total plans completed: 115
 - Average duration: 21 min
 - Total execution time: 104 min
 
@@ -59,6 +59,15 @@ Progress: [██████████] 100%
 | 10 | 5 | - | - |
 | 10.2 | 2 | - | - |
 | 14.1 | 2 | - | - |
+| 16.2 | 7 | - | - |
+| 16.3 | 4 | - | - |
+| 14.2 | 4 | - | - |
+| 18.1 | 9 | - | - |
+| 19 | 7 | - | - |
+| 19.1 | 6 | - | - |
+| 19.4 | 4 | - | - |
+| 19.5 | 5 | - | - |
+| 19.6.1 | 5 | - | - |
 
 **Recent Trend:**
 
@@ -202,6 +211,73 @@ Progress: [██████████] 100%
 | Phase 16.1 P01 | 11 min | 4 tasks | 20 files |
 | Phase 16.1 P02 | 1h 26m | 3 tasks | 4 files |
 | Phase 16.1 P03 | 12 min | 3 tasks | 8 files |
+| Phase 16.2 P01 | 34min | 4 tasks | 51 files |
+| Phase 16.2 P02 | 25min | 3 tasks | 24 files |
+| Phase 16.2 P03 | 13min | 3 tasks | 21 files |
+| Phase 16.2 P04 | 50 min | 3 tasks | 15 files |
+| Phase 16.2 P05 | 25 min | 3 tasks | 7 files |
+| Phase 16.2 P06 | 43min | 3 tasks | - files |
+| Phase 16.3 P01 | 95 | 4 tasks | 43 files |
+| Phase 16.3 P02 | 9 min | 3 tasks | 17 files |
+| Phase 16.3 P03 | 658 min | 4 tasks | 12 files |
+| Phase 16.3 P04 | 30 min | 3 tasks | 16 files |
+| Phase 14.2 P01 | 16 min | 3 tasks | 18 files |
+| Phase 14.2 P02 | 27min | 4 tasks | 7 files |
+| Phase 14.2 P03 | about 4h | 4 tasks | 23 files |
+| Phase 14.2 P04 | 60min | 3 tasks | 11 files |
+| Phase 17 P01 | 41 min | 4 tasks | 55 files |
+| Phase 17 P02 | 50min | 6 tasks | 44 files |
+| Phase 17 P03 | 38 min | 4 tasks | 53 files |
+| Phase 17 P04 | 32min | 5 tasks | 70 files |
+| Phase 17 P05 | 93min | 5 tasks | 103 files |
+| Phase 17 P06 | 53 min | 4 tasks | 50 files |
+| Phase 18 P01 | 43min | 4 tasks | 59 files |
+| Phase 18 P02 | 75min | 4 tasks | 84 files |
+| Phase 18 P03 | 45min | 3 tasks | 75 files |
+| Phase 18 P04 | 40 min | 3 tasks | 78 files |
+| Phase 18 P05 | 20min | 3 tasks | 31 files |
+| Phase 18 P06 | 70min | 6 tasks | 52 files |
+| Phase 18 P07 | 75 min | 5 tasks | 62 files |
+| Phase 18 P08 | 20min | 4 tasks | 7 files |
+| Phase 18.1 P01 | 31min | 5 tasks | 37 files |
+| Phase 18.1 P02 | 45min | 5 tasks | 30 files |
+| Phase 18.1 P03 | 21 min | 4 tasks | 27 files |
+| Phase 18.1 P04 | 22 min | 5 tasks | 36 files |
+| Phase 18.1 P05 | 20 min | 3 tasks | 20 files |
+| Phase 18.1 P06 | 50min | 5 tasks | 39 files |
+| Phase 19.3 P01 | 14 min | 2 tasks | 20 files |
+| Phase 19.3 P02 | 15min | 4 tasks | 11 files |
+| Phase 19.3 P03 | 10 min | 3 tasks | 20 files |
+| Phase 19.3 P04 | 60min | 5 tasks | 14 files |
+| Phase 19.3 P05 | 49min | 7 tasks | 38 files |
+| Phase 19.3 P06 | 40min | 6 tasks | 24 files |
+| Phase 18.1 P07 | 20 min | 3 tasks | 18 files |
+| Phase 18.1 P08 | 24 min | 4 tasks | 30 files |
+| Phase 18.1 P09 | 60min | 5 tasks | 27 files |
+| Phase 19 P01 | 80min | 3 tasks | 34 files |
+| Phase 19.1 P01 | 12min | 3 tasks | 37 files |
+| Phase 19.1 P19.1-03 | 7 min | 3 tasks | 32 files |
+| Phase 19.1-chat-satellites P19.1-04 | 11 | 4 tasks | 35 files |
+| Phase 19.1-chat-satellites P19.1-05 | 10min | 4 tasks | 37 files |
+| Phase 19.1 P19.1-02 | 9 min | 4 tasks | 36 files |
+| Phase 19.1 P19.1-06 | 16 | 3 tasks | 46 files |
+| Phase 19.4 P01 | 28 min | 4 tasks | 34 files |
+| Phase 19.4 P02 | 50min | 5 tasks | 54 files |
+| Phase 19.4 P03 | 71 min | 7 tasks | 61 files |
+| Phase 19.4 P04 | 65 min | 5 tasks | 42 files |
+| Phase 19.4.1 P01 | 70min | 4 tasks | 24 files |
+| Phase 19.4.1 P02 | ~2h45m | 7 tasks | 43 files |
+| Phase 19.4.1 P03 | ~1h50m | 8 tasks | 58 files |
+| Phase 19.4.1 P04 | 2h25m | 7 tasks | 85 files |
+| Phase 19.4.1 P05 | 70min | 7 tasks | 46 files |
+| Phase 19.8 P01 | 30 min | 3 tasks | 86 files |
+| Phase 19.8 P02 | 28 min | 3 tasks | 38 files |
+| Phase 19.8 P03 | 3h 3m (segment B) | 8 tasks | 120 files |
+| Phase 19.8 P05 | 40min | 7 tasks | 33 files |
+| Phase 19.6.1 P04 | 18 min | 3 tasks | 10 files |
+| Phase 19.6.1 P05 | 4 min | 2 tasks | 7 files |
+| Phase 19.7 P01 | 52 min | 5 tasks | 64 files |
+| Phase 19.7 P02 | 38 min | 4 tasks | 36 files |
 
 ## Accumulated Context
 
@@ -227,6 +303,20 @@ Progress: [██████████] 100%
 - Phase 18.1 inserted after Phase 18: Payment Gateway Subscriptions (split from Phase 18 per 18-CONTEXT D-01)
 - Phase 16.1 inserted after Phase 16: Journal admin urgent fixes: relation search, list state, post form content and excerpt (found on UAT) (URGENT)
 - Phase 16.2 inserted after Phase 16.1: Plugin-provided field types and the Blog Editor formwidget
+- Phase 16.3 inserted after Phase 16: Backend admin personal API tokens with user-selected scopes (Journal agent writes as backend author); successor of Apparatus PersonalApiToken (URGENT)
+- Phase 19.2 inserted after Phase 19.1: Chat polish against WavePath clients (WavePath framework asks, 2026-10-11)
+- Phase 19.3 inserted after Phase 19.2: Framework transport and infrastructure for WavePath (WavePath framework asks, 2026-10-11)
+- Phase 19.4 inserted after Phase 19.3: OIDC provider on wristband (WavePath framework asks, 2026-10-11)
+- Phase 19.5 inserted after Phase 19.4: Social login in sm-user-plugin (WavePath framework asks, 2026-10-11)
+- Phase 19.6 inserted after Phase 19.5: Two-factor auth and device flow in sm-user-plugin (WavePath framework asks, 2026-10-11)
+- Phase 19.7 inserted after Phase 19.6: Generic MCP module: opt-in endpoint, plugin-declared tools, one connector per person (from /msd-explore 2026-10-17)
+- Phase 20 reordered: Roadmap reordered (/msd-explore 2026-10-18): new Phase 20 Demo instance with every shared plugin; Płytarium cutover moved 20 → 30; Chat polish against WavePath clients moved 19.2 → 31; 21–29 added as their goals firm up
+- Phase 19.4.1 inserted after Phase 19.4: Early public demo on demo.summercms.io: today's 16 shared plugins on rome, demo accounts, journal/presentations/quizzes/OIDC pages, backend by request; Phase 20 narrows to the chat family (URGENT)
+- Phase 32 added: Console commands overhaul: diary logging module, bonfire global flags and Artisan-grade help, sweep of all commands, tests
+- Phase 19.6.1 inserted after Phase 19.6: Backend Administrators screen: admins and roles CRUD in cabana (gap found while planning 19.7: no screen to manage backend users or set the frontend link) (URGENT)
+- Phase 32 added: SEO foundation: per-record and global SEO, structured data per page type, sitemap boost and HTML sitemap, pagination, redirects, robots.txt, canonical, meta robots, social tags, headings, hreflang, noindex policy, SSR for headless frontends
+- Phase 32 edited: narrowed to framework seams and sm-seo-plugin core (split decided 2026-10-25)
+- Phase 33 added: SEO output, audit and content; large phase, lean-planning exception
 
 ### Decisions
 
@@ -655,25 +745,250 @@ Recent decisions affecting current work:
 - [Phase 16.1]: 16.1-02: UAT Go log checks read /var/log/supervisor/grzybyfunkcjonalne-go.log directly; supervisorctl tail fails on ANSI escapes in GORM log lines and makes grep-count checks vacuous
 - [Phase 16.1]: 16.1-02: D-01/D-03 end-of-phase UAT checks are human-reported but not independently confirmed; queued for /msd-verify-work
 - [Phase 16.1]: FormatHTML refuse tests require an error and empty result for every unsafe input: with html.WithUnsafe the gate is the only XSS defence
+- [Phase 16.2]: pact.FormFieldType.ListValue is func(ctx context.Context, value any) string (human adjust at the 16.2-01 checkpoint); plans 03, 05 and 06 use the ctx form
+- [Phase 16.2]: Plugin field type registry is built per Activate by compileFieldTypes and passed down the compile functions; existing compile functions stay nil-registry wrappers
+- [Phase 16.2]: Only pact.FormFieldError from a plugin field type's Decode or Upload is a 422; every other plugin error, Load included, is the opaque 500
+- [Phase 16.2]: Untouched plugin field values are skipped on update by canonical encoding/json comparison with the served value (stored value through Load), per field and locale
+- [Phase 16.2]: TipTap 3.31.4 pinned exactly for all five editor packages after the human package check (packages approved)
+- [Phase 16.2]: Blog Editor bundle built through the Vite application pipeline (single ES entry, fixed names, exports kept) because library mode never minifies ES whitespace
+- [Phase 16.2]: Blog Editor link parsing, rendering and commands use isPolicyUrl (http, https, mailto, relative); on* attributes are never captured; external values load outside the undo history
+- [Phase 16.2]: Uncaptioned editor images are inline (<p><img></p>); captioned ones are figure with figureImage and figcaption
+- [Phase 16.2]: Plan 03: the Journal HTML policy needed exactly the four editor-output rules (figure data-embed/data-id, img alt, ol start); the corpus showed no fifth
+- [Phase 16.2]: Plan 03: editor uploads must sniff as a JPEG/PNG/GIF/WebP type matching the extension; uniqueMediaKey errors instead of overwriting when all numbered names are taken
+- [Phase 16.2]: Plan 03: admin saves of post content write the Decode output to content and content_html per written locale (FormBefore*/FormAfter* hooks), no goldmark; category 422 gate retired
+- [Phase 16.2]: 16.2-04: vue-journal-layer mirrors exactly the four Go editor-output rules; embeds expand only at the v-html sinks, after sanitizeJournalHtml
+- [Phase 16.2]: 16.2-04: vue-journal-layer v0.2.0 published (tag 042b65d0 -> 759e684e, human reply "push"); vue-grzybyfunkcjonalne-app main 465286a pins it; a defect gets v0.2.1
+- [Phase 16.2]: 16.2-05: summercms v0.1.18 released (human: release v0.1.18); a later defect gets v0.1.19
+- [Phase 16.2]: 16.2-05: UAT Nuxt rollback copy is nuxt/.output.prev; the site-ok log check reads /var/log/supervisor/grzybyfunkcjonalne-go.log from the restart River anchor (supervisorctl tail fails on UAT)
+- [Phase 16.3]: D-03 literal: one method-allowed scope must match every required code; ScopeLimit keeps per-scope pattern slices — Locked CONTEXT reading; multi-code lists are stricter than a union
+- [Phase 16.3]: CLI uses party.Activated at Run time; cabana.RuntimeCommands(app) signature unchanged (Option A) — User-confirmed Option A so host apps only bump versions
+- [Phase 16.3]: ResolveBackend is Bearer-only (cookie-less JWT guard) — Plugin write routes have no CSRF; cookie auth must not drive them
+- [Phase 16.3]: 16.3-02: ApiTokensPanel + ApiTokenCreateDialog on /account; plaintext dialog-local only; shared ConfirmDialog for revoke and close-without-copy — UI-SPEC component split
+- [Phase 16.3]: 16.3-02: expired from API drives Expired chip; dates use CellValue local YYYY-MM-DD / YYYY-MM-DD HH:mm — Plan decisions; no new date format
+- [Phase 16.3]: Released summercms v0.1.21 after human resume release v0.1.21; Journal requires it; grzybyfunkcjonalne journal gitlink bumped; summercmsio not bumped
+- [Phase 16.3]: Journal API uses cabana.ResolveBackend with cover golem15.journal.*; ErrTokenScope maps to PHP Insufficient permissions
+- [Phase 16.3]: 16.3-04: full unit coverage + scripts/check-phase16.3.sh; postgres PASS on Docker host; nyquist_compliant true — Lean rule 3 phase-ending plan
+- [Phase 16.3]: Public Journal Show under optional-auth needs published_at in the past, not only published:true — TestJournalTokens fixture
+- [Phase 14.2]: storage.uploads.serve mounts attach.StaticHandlerPublic from surf (owner summercms.surf), resolving bucket and DB per request, with nosniff; default off
+- [Phase 14.2]: http.access_log logs one 'http request' record (method, pattern, status, duration_ms; path only when unmatched); default off
+- [Phase 14.2]: fonoteka console commands use commandDatabase/commandBucket: published handle, else open+publish; closers close what they opened
+- [Phase 14.2]: fonoteka:dev-seed allowed only for SUMMER_ENV local or dev; prints lines after commit; secret shown only on mint
+- [Phase 14.2]: dev-stack.sh runs Go processes with TMPDIR=tmp/dev-stack/go-tmp because fileblob renames uploads in from os.TempDir() and fails across devices when /tmp is a tmpfs (deployment fix deferred to Phase 20)
+- [Phase 14.2]: dev-stack.sh parses the env file as KEY=value data instead of sourcing it; pnpm dev gets only the NUXT_* values, not the SUMMER_* secrets
+- [Phase 14.2]: dev-stack.sh e2e requires a running stack and the guard before Playwright; e2e-verdict refuses skips, flaky, unexpected and zero-expected reports
+- [Phase 14.2]: Album model rules see nullable text columns as strings, so an empty format passes like PHP (14.2-03)
+- [Phase 14.2]: A 5xx written after the client cancelled the request is logged as 499 by the surf access log (14.2-03)
+- [Phase 14.2]: dev-seed creates seeded albums with artist rows and backfills them on rerun (14.2-03)
+- [Phase 14.2]: Item 11 PHP cross-check passed by classification: GD-undecodable fixture and missing PHP Centrifugo config, no contract difference (14.2-03)
+- [Phase 14.2]: The surf uploads route owns storage.uploads.public_path_prefix: BuildRouter fails when a plugin route sits at or under it
+- [Phase 14.2]: check-phase14.2.sh --contracts blocks on the phase's own contract test and only reports the whole pnpm test:contracts suite (missing-catalog.test.mjs predates the phase)
+- [Phase 14.2]: check-phase14.2.sh leaves TMPDIR to the caller: a TMPDIR inside a go.work tree makes internal/build scaffold tests edit that go.work
+- [Phase 17]: 17-01: menu item type registry is modules/signpost (party activates it before Boot); host URL overrides at menu_items.patterns (YAML only); list types use PatternFrom (one level) so a record type's host override reaches list children
+- [Phase 17]: 17-01: framework sanitizer modules/seaglass on bluemonday v1.0.27 (Journal policy without Blog Editor rules, plus tel:); D-10 Journal clause dropped, category content stays blogeditor
+- [Phase 17]: 17-01: dependent dropdown options for a repeater row are addressed as {field}=repeater.nested; sibling values reach DependentOptions as strings (nil when empty) on the route and the save recheck
+- [Phase 17]: 17-01: reorder saves write parent and sort columns via UpdateColumns (no model hooks); the partition is a belongsTo relation field of the form; stale sets answer 409 reorder_stale
+- [Phase 17]: 17-02: framework released as v0.1.23 (annotated, ae75a92 on e2a9529); plan 05 bumps plugin and host requires to it
+- [Phase 17]: 17-02: read-only richeditor HTML goes through a client display allowlist because stored values are not sanitized on read
+- [Phase 17]: 17-02: repeater rows use a plain aria-expanded disclosure instead of Reka Collapsible so 422 focus reaches collapsed rows
+- [Phase 17]: 17-03: Sitemap definition theme key is the constant default; imports always write it and report the PHP theme
+- [Phase 17]: 17-03: Journal URL placeholders follow PHP getHeadlessUrlParams order (id, slug, category, year, month, day); translated slugs use PHP fallback via one batched attribute read
+- [Phase 17]: 17-03: journal-category nesting returns the subtree per the plan truth; frozen PHP returned every category (deferred item for plan 05 parity)
+- [Phase 17]: 17-03: Host tier override lives in config/golem15.yaml under sitemap.priority_tiers and replaces the default list
+- [Phase 17]: 17-04: D-16/D-17 API shapes approved verbatim ("approve"); /_menu/api/v1/menus/{code} and /_faq/api/v1/faqs/{slug} are now one-way
+- [Phase 17]: 17-04: menu list vs single registry type decided by the resolved item having no URL (pact.ResolvedMenuItem contract); generated children follow stored children
+- [Phase 17]: 17-04: public API path params validated in handlers (not route Where) so every miss is the JSON 404
+- [Phase 17]: 17-04: FAQ answers and description re-sanitized with seaglass on API output; menu URLs pass AllowedURL on save and on output
+- [Phase 17]: 17-05: grzybyfunkcjonalne menu code main-menu; Winter menu types map by the built-in link->url and blog_categories->all-journal-categories, no --map; six orphan link entries dropped
+- [Phase 17]: 17-05: sitemap:import-winter --page-url copies a Winter cms-page item as a url item (blog=/blog on grzybyfunkcjonalne); the PHP site had no sitemap settings, plugin defaults apply
+- [Phase 17]: 17-05: UAT remote checks run on the server through nginx with curl --resolve to loopback; production deploy and summercms.go push not approved
+- [Phase 17]: 17-06: cabana singleton route reruns its transaction once on a Postgres unique violation from SingletonRecord (first-open race); fix 6312929 needs the next framework tag
+- [Phase 17]: 17-06: scripts/check-phase17.sh is the Phase 17 gate; every Phase 17 test name sits in one stage list (go, plugins, admin, layers, postgres)
+- [Phase 17]: 17-06: protocol-relative menu URLs stay anchors (D-16 rule) in the server and layer; the plan's text-without-href wording is a deferred question
+- [Phase 18]: Phase 18 plan 01 release gate: framework tag v0.1.25 held until the phase gate after plan 07 (human reply: hold); nothing pushed or tagged, plans 02 to 06 build against the checkout through go.work replace — One tag for the whole phase with the unit tests of plan 07 included; the plugin plans use go.work replace and need no published version, so holding costs only a later bump
+- [Phase 18]: Money is a decimal string on the wire and in the SPA (never a float, never rounded or truncated); MoneyField emits the raw compact text for a malformed or too-precise draft so the server 422 stays the gate — D-07 and D-10 forbid rounding and truncation; emitting the last valid prefix on a bad draft would let Save write a truncated amount
+- [Phase 18]: Settings secrets are write-only: the GET omits the value and reports meta.secrets.<field> as stored, env or empty; on PUT an absent key or empty string keeps the stored value and JSON null clears it; meta is omitted when there is nothing to report so existing payloads stay byte-identical — The value must never leave the server (D-13, T-18-03); omitempty on meta and danger keeps the Phase 10 conformance fixtures and the PHP-shaped payloads unchanged
+- [Phase 18]: 18-02: cart/details v2 row format is v2-research (long keys, top-level v:2); legacy JMS rows decoded in place, never rewritten
+- [Phase 18]: 18-02: notification route verifies (VerifyNotification on the capped raw body) before any database lookup; operators.PaymentContext carries Tx for in-transaction transitions
+- [Phase 18]: 18-02: NBP uses Table A of the day before with a 5-day fallback (PHP semantics); Fixer keeps the PHP endpoint with optional fixer_access_key
+- [Phase 18]: Admin amounts use money.Stored (struct around Amount4) because cabana money fields/columns accept only string or struct Scanner/Valuer columns
+- [Phase 18]: Quote cart widget runs one cabana action (quote_cart) with payload operations; refusals answer 403 ForbiddenError so the admin toasts the localized reason
+- [Phase 18]: Paymentgateway admin copy is complete in lang/{en,pl}; plan 04 settings/mailer keys listed in 18-03-SUMMARY
+- [Phase 18]: 18-04: cabana settings forms serve method-backed dropdowns from the settings model (pact.DropdownOptionsProvider); framework tag still held to the phase gate
+- [Phase 18]: 18-04: default_currency validated as required|in:<ISO codes> plus a BeforeValidate 422 settings.default_currency_required (lagoon has no string/size rule)
+- [Phase 18]: 18-04: order mails only with orders on, payment mails (customer and staff) only with orders off, as PHP registerSubscribers; mails sent via lagoon.AfterCommit, events.MailSender seam for apps and tests
+- [Phase 18]: 18-05: Stripe operator defaults to hosted Checkout; the Details parameter stripe_checkout_mode overrides the checkout_mode setting per order
+- [Phase 18]: 18-05: PaymentIntent created without a payment method answers the requires_action bundle for requires_payment_method; only a confirmed payment method ending there is a decline
+- [Phase 18]: 18-05: Stripe webhooks are verified by signature only (webhook.ValidatePayload) with a minimal local event decode, so the endpoint API version is irrelevant
+- [Phase 18]: 18-05: Authentic notifications for no payment of this application answer 200 ignored via the new paymentgateway sentinel operators.ErrNotificationIgnored
+- [Phase 18]: 18-05: All four Stripe secrets fall back to golem15.pgstripe.<column> config keys (SUMMER_GOLEM15__PGSTRIPE__*) while their encrypted column is empty
+- [Phase 18]: 18-06: customer API contract api-research (one-way): twelve endpoints under /_paymentgateway/api/v1, money {amount, amount_minor, currency}, 404 for unknown and forbidden orders, 409 Order state changed
+- [Phase 18]: 18-06: customer cancel in AwaitingPayment uses the PHP Cancel transition after canceling open cash and bank transfer payments; process rolls back on an operator error so the order stays Placed
+- [Phase 18]: 18-06: GET /orders behind api.RequireJWT (jwt guard, Bearer only); layer auth hook is the Nuxt provide paymentGatewayAuth
+- [Phase 18]: 18-06: fixtures: none for shop-type legacy rows (human); three repos published, vue-paymentgateway-layer tagged v0.1.0
+- [Phase 18]: 18-07 push-all: four repositories pushed and the framework tagged v0.1.25 (held since 18-01)
+- [Phase 18]: 18-07 money fields accept trailing zeros beyond the scale (fix eb60c32), published in v0.1.25
+- [Phase 18]: 18-07 fixtures none: synthetic legacy rows stand in for D-11; TestLegacyFixtures picks up shop-export rows later
+- [Phase 18]: 18-07 the two pgstripe reliability tests are 18.1; replay_and_race is Phase 18 idempotency evidence
+- [Phase 18]: 18-08: payment_intent.payment_failed is not terminal: the Stripe operator logs one Warn line and leaves the payment Sent; only checkout.session.async_payment_failed rejects; checkout.session.expired and payment_intent.canceled stay 200 no-ops closed by pg:cancel-sent-payments — Stripe sends the event on every declined attempt and the customer may retry on the same Checkout page or client secret; Reject is final, and PHP never moved a payment from a notification except to Accept (gap 1 of 18-VERIFICATION, A-CR-01)
+- [Phase 18]: 18-08: a paid signal the payment machine refuses is logged at Error level (refuses Accept) for never-accepted payments; Accepted and Refunded are silent; no payment event, automatic refund or data write — The log line is the alert hook; a new event would be a public contract on a shared plugin with no listener, and a refund moves money (A-CR-02 logging half; session expiry on cancel stays open)
+- [Phase 18]: 18-08 push: sm-pgstripe-plugin main pushed to 0313820 after the human reply push; no tag, summercms.go not pushed — Task 4 checkpoint:decision; no application mounts the plugin yet, so no pointer bump
+- [Phase 18.1]: 18.1-01 release gate: human replied "hold"; framework tag v0.1.26 held until plan 06, nothing pushed (22 commits origin/master..master local)
+- [Phase 18.1]: 18.1-01: flat reorder inferred WinterCMS-Sortable style (no parentColumn key, no parent_id column); flat flag omitempty keeps tree payloads byte-identical
+- [Phase 18.1]: 18.1-01: required taglist is checked on its normalised tags; generic required rule skipped for taglist as for repeater
+- [Phase 18.1]: 18.1-02: baseline JSON columns (stripe_prices, currency_prices, features) are JSONB (human: baseline-jsonb); lagoon.Jsonable works unchanged
+- [Phase 18.1]: 18.1-02: pgsub gateways never write the DB; the service stores the customer id in its own short transaction and writes cancel_at_period_end after a successful cancel at period end
+- [Phase 18.1]: 18.1-02: sm-paymentgatewaysubscriptions-plugin created with tea and main pushed at aad4647 (human: create-and-push)
+- [Phase 18.1]: 18.1-03: subscription webhook answers keep PHP plain-text bodies (reply php-plain-text), text/plain without trailing newline
+- [Phase 18.1]: 18.1-03: Stripe plan sync looks prices up with Prices List (lookup_keys, active) instead of PHP Prices Search
+- [Phase 18.1]: 18.1-03: golem15.pgstripesubscriptions is its own plugin in sm-pgstripe-plugin/subscriptions; the root package never imports it (payments-only builds link no pgsub)
+- [Phase 18.1]: 18.1-03: pgstripe:import-winter --webhook-secret-target defaults to payments (Phase 18 mapping); ReadWinterSettingsFor is additive
+- [Phase 18.1]: Customer API contract confirmed as api-research (18.1-04 Task 4): money objects per currency, 404 Subscription not found when the user has none, latest subscription with has_access and in_grace_period
+- [Phase 18.1]: pgsub plan sync admin actions never fail after the first gateway call: per-plan failures are code: message lines in the result, so provider ids saved in the bulk transaction survive
+- [Phase 18.1]: Customer API redirect targets come only from api.success_url, api.cancel_url and api.portal_return_url, resolved at boot (absolute http(s), a path joined to app.url, or empty = app.url); malformed values fail boot naming the key
+- [Phase 18.1]: Layer release 18.1-05: human reply "hold"; vue-paymentgateway-layer main 3dea9cd unpushed, no v0.2.0 tag; plan 06 publishes
+- [Phase 18.1]: Layer subscription redirects follow only absolute http(s) checkout_url/portal_url from the API answer
+- [Phase 18.1]: PgPlans shows the chosen currency price or the plan first price; subscribe sends the currency of the price shown
+- [Phase 18.1]: Phase 18.1 published on push-all: summercms v0.1.26 (taglist, flat reorder, localized reorder.flat fix), vue-paymentgateway-layer v0.2.0, pgsub and pgstripe require summercms v0.1.26
+- [Phase 18.1]: scripts/check-phase18.1.sh is the phase gate; it never installs packages and fails loudly on a pnpm store mismatch; the layer check-git-install.sh stays open
+- [Phase 19.3]: 19.3-01: cooler memory cache driver is otter v2 (bounded); stdlib map rejected as unbounded
+- [Phase 19.3]: 19.3-01: unreachable Redis at start-up is a warning; missing/malformed redis.url with a Redis driver is a boot error naming the key
+- [Phase 19.3]: 19.3-01: cooler key prefix = cache.prefix or slug(app.name)+':' (default summer:); cache keys <prefix>cache:, limiter keys <prefix>rl:
+- [Phase 19.3]: 19.3-01: Remember degrades on cache errors; Redis Flush is SCAN MATCH <prefix>cache:* + UNLINK, never FLUSHDB
+- [Phase 19.3]: 19.3-02: bouncer cookie transport reads auth.cookie.* through CookieConfigSource (compass satisfies it, bouncer imports no framework module); TokenCookie Max-Age is the guard's refresh window
+- [Phase 19.3]: 19.3-02: credentialed CORS with a * origin, uncompilable or PHP-delimited origin patterns fail boot; dynamic CORS answers echo the exact origin with Vary: Origin; the non-credentialed * answer is unchanged
+- [Phase 19.3]: 19.3-02: route-group CORS uses cors:<profile> from http.cors_profiles.<name>; the router registers OPTIONS preflight routes (owner surf) and refuses overlap with http.cors.paths
+- [Phase 19.3]: 19.3-02: Turnstile open/closed follows PHP; with a secret, a transport error or timeout is 422 in both modes and a missing token fails without a siteverify call; a published *bouncer.Turnstile or bouncer.TurnstileWriter overrides the defaults
+- [Phase 19.3]: 19.3-02: /api-docs is opt-in (http.api_docs.enabled), spec from exactly one surf.APIDocsProvider converted at boot, swagger-ui-dist pinned to 5.33.1 with sha384 SRI and a nonce CSP
+- [Phase 19.3]: 19.3-03: S3 driver opt-in via summer.yaml build.tags summercms_s3 (attach.S3BuildTag); untagged binaries refuse s3:// at boot naming the tag
+- [Phase 19.3]: 19.3-03: attach.DiskExtension derives the stored extension from the sniffed type (fixed table, script-capable client extensions become txt/bin); file_name keeps the client name
+- [Phase 19.3]: 19.3-03: storage.uploads.public_url applies to every attach URL; start-up line and docs require a public-files-only bucket
+- [Phase 19.3]: Site-cache purge is a cooler service (site_cache.purge_url, site_cache.purge_token); failures never fail a save
+- [Phase 19.3]: pact.ReorderAfterSave runs inside cabana's reorder transaction; reorderPost uses lagoon.Transaction so AfterCommit fires
+- [Phase 19.3]: Journal golem15.journal.site_cache.* kept as deprecated aliases for one release; framework keys win
+- [Phase 19.3]: 19.3-04 Task 4 reply push-all: plugins, layers, summercms master pushed; layer tags vue-faq/menu v0.2.0, vue-journal v0.4.0; no framework tag
+- [Phase 19.3]: 19.3-05: phase gate scripts/check-phase19.3.sh requires every new test by name (go test -json / TAP detectors); --all green incl. Docker
+- [Phase 19.3]: 19.3-05: miniredis v2.40.0 test-only in modules/cooler (Task 4 reply: approved)
+- [Phase 19.3]: Phase 19.3 released as summercms v0.1.27 (Task 7 reply: release); sm-faq-plugin, sm-menu-plugin and sm-journal-plugin require v0.1.27 on origin; app plugin submodule pointers not bumped yet
+- [Phase 19.3]: Phase 19.3 gate scripts/check-phase19.3.sh is fail-closed: a skipped, missing or red required test fails the stage; miniredis is test-only
+- [Phase 19.3]: 19.3-06: release of v0.1.28 (tag, plugin require bumps, layer tags v0.3.0/v0.3.0/v0.5.0, pushes) handed off to the phase 19.3 main session with the whole-phase docs update; gap closure pushed and tagged nothing
+- [Phase 18.1]: 18.1-07: D-21 superseded for event ordering (user decision 2026-10-14): the Stripe webhook job applies the subscription Stripe holds (re-retrieved outside any transaction, serialised by a per-subscription pg_advisory_lock via classes.WithSessionLock/SubscriptionLockKey); a Stripe 404 falls back to the event snapshot
+- [Phase 18.1]: 18.1-07: ApplyDeleted on an unstored subscription returns classes.ErrSubscriptionNotStored so the job rolls its marker back and River retries the deletion
+- [Phase 18.1]: 18.1-07: plan resolution order is exact price id, then stripe_product_id, then plan_code (any plan, active or not); contracts.Update gains ProductID and PlanCode
+- [Phase 18.1]: 18.1-07: Service.SyncSubscription writes only gateway-owned columns of a FOR UPDATE re-read row (plus the plan via the optional contracts.SubscriptionRetriever), never the caller's whole row
+- [Phase 18.1]: 18.1-08: checkouts bill only the plan's own Stripe price per currency (SubscriptionPlan.CheckoutPriceID, no cross-currency fallback); the yen is unsupported
+- [Phase 18.1]: 18.1-08: customer checkouts go through Service.CheckoutGuarded (per-subscriber advisory lock, 409 for any open subscription) plus Stripe idempotency keys (10-minute window, parameter hash); users.stripe_customer_id is first-write-wins
+- [Phase 18.1]: 18.1-08: framework pact.AdminBulkAction.Detached (opt-in, json:"-") runs a bulk action outside the cabana transaction; plan sync uses it; needs framework tag v0.1.27 at plan 09
+- [Phase 18.1]: 18.1-09: framework release tag is v0.2.1 (v0.1.27 and v0.2.0 already on origin); first plugin tags pgsub v0.1.0 and pgstripe v0.1.0, pgstripe requires pgsub v0.1.0, replace lines kept
+- [Phase 19]: 19-01: Task 1 reply proceed-and-push; sm-chat-plugin created and main pushed at b93cae7
+- [Phase 19]: 19-01: D-01 names, D-04 baseline 202610160001_create_golem15_chat_baseline, D-12 rewrite-as-both locked
+- [Phase 19.1]: Task 1 reply verbatim: proceed-and-push
+- [Phase 19.1]: Locked D-01 names, D-02 baseline 202610180001_create_golem15_userfriends_baseline, D-05 prefix /_userfriends/api/v1
+- [Phase 19.1]: tea repos create --owner golem15 --name sm-userfriends-plugin succeeded; main pushed at 2480ff0 (never force). summercms.go was not pushed.
+- [Phase 19.1]: Task 1 reply verbatim: proceed. Locked D-02 baseline 202610180001_create_golem15_chatbots_baseline and D-05 prefix /_chatbots/api/v1; remote follows plan 01 proceed-and-push.
+- [Phase 19.1]: tea repos create --owner golem15 --name sm-chatbots-plugin succeeded; main pushed at c7d9108 (never force). summercms.go was not pushed.
+- [Phase 19.1-chat-satellites]: Task 2 reply verbatim: proceed
+- [Phase 19.1-chat-satellites]: Locked D-02 baseline id 202610180001_create_golem15_herald_baseline and D-05 prefix /_herald/api/v1; remote policy follows plan 01 proceed-and-push
+- [Phase 19.1-chat-satellites]: tea repos create --owner golem15 --name sm-herald-plugin succeeded; main pushed at 46af07a (never force). summercms.go was not pushed.
+- [Phase 19.1]: Task 2 reply verbatim: proceed — Human locked D-02 baseline id and D-05 prefix; Task 2 was not re-asked.
+- [Phase 19.1]: Locked D-02 baseline id 202610180001_create_golem15_chatvideo_baseline and D-05 prefix /_chatvideo/api/v1; remote policy follows plan 01 proceed-and-push — These names land in adopting apps and published clients.
+- [Phase 19.1]: tea repos create --owner golem15 --name sm-chatvideo-plugin succeeded; main pushed at 38179b5 (never force). summercms.go was not pushed. — Remote policy is proceed-and-push after Task 4 green.
+- [Phase 19.1]: After APIs exist, execute should run the security-review agent (CONTEXT). This execute did not spawn it. — CONTEXT discretion; planner and execute both refuse to spawn the reviewer.
+- [Phase 19.1]: Task 2 reply verbatim: proceed — Human locked D-02 baseline id 202610180001_create_golem15_forum_baseline and D-05 prefix /_forum/api/v1 before the sibling repo existed. Remote policy follows plan 01 proceed-and-push.
+- [Phase 19.1]: Locked D-02 baseline id 202610180001_create_golem15_forum_baseline and D-05 prefix /_forum/api/v1; remote policy follows plan 01 proceed-and-push — Continuation recorded the lock from the human proceed reply; Task 1 and Task 2 were not re-asked.
+- [Phase 19.1]: tea repos create --owner golem15 --name sm-forum-plugin succeeded; main pushed at 6a40030 (never force). summercms.go was not pushed. — Plan 01 remote policy proceed-and-push; tea-create only after Task 4 green.
+- [Phase 19.1]: Goldens from PHP fixtures; live capture NOT RUN — No live PHP Wavepath backend was reachable.
+- [Phase 19.1]: Execute should now run the security-review agent; this execute did not spawn it — Five APIs, push sender, token issuer, sanitizer boundary, and GDPR cascades now exist.
+- [Phase 19.1]: Gate named-short vs postgres split follows the skip detector — TestHTTPTracer and TestReconcileEmptyRoom skip under -short; a skip is refuse.
+- [Phase 19.4]: D-16: extend the hand-written wristband with an OIDC flavour; golang-jwt/jwt/v5 v5.3.1 signs id_tokens via MapClaims; stdlib JWKs; zitadel/oidc v3 rejected; go-oidc and x/oauth2 test-only in sm-oauthserver-plugin
+- [Phase 19.4]: 19.4-01: OIDC redirects send Cache-Control no-store, private (plan) while PHP sends no-cache, private; plan 03 tide replay settles it
+- [Phase 19.4]: 19.4-01: wristband DefaultOptions().Resource is empty; host applications set their MCP resource explicitly (fonoteka 687e25a)
+- [Phase 19.4]: 19.4-02: go-oidc v3.21.0 and x/oauth2 v0.37.0 approved as test-only requirements of sm-oauthserver-plugin (TestRelyingPartyInterop, RS256 and ES256)
+- [Phase 19.4]: 19.4-02: first signing key via INSERT ... ON CONFLICT (active) WHERE active DO NOTHING with a silent GORM logger so key ciphertext never reaches the log
+- [Phase 19.4]: 19.4-02: plugin-owned oauthserver.body.limit middleware on the token routes because surf ignores body.limit on GroupRaw routes
+- [Phase 19.4]: 19.4-02: SanitizeCustomCSS repeats tag-opener removal until stable (PHP single pass is bypassable)
+- [Phase 19.4]: 19.4-03: skip-parity at Task 5; per the user's D-14 amendment the PHP OIDC recording is a preliminary task of the WavePath cutover phase (todo 2026-10-19-record-php-oidc-parity-against-wavepath); the phase verdict is not held at human_needed
+- [Phase 19.4]: 19.4-03: admin redirect URIs are checked on save with wristband.RejectRedirectURI; http loopback only on development clients
+- [Phase 19.4]: 19.4-03: lagoon has no string/url/regex rules, so branding formats are checked in the branding controller and Rules() use only nullable|max:N
+- [Phase 19.4]: 19.4-03: security review pinned every T-19.4 mitigation with a test (summercms.go eaa545c, plugin b4223be, f8eaf70); T-19.4-36..39 accepted
+- [Phase 19.4]: Phase gate stages split by Docker need; the application's unrelated admin route test stays outside the gate (deferred-items)
+- [Phase 19.4]: PHP method map: 171 methods, 146 ported, 25 adapted with reasons, none not-applicable
+- [Phase 19.4]: Parity NOT RUN points to the WavePath cutover todo and does not hold the verdict (D-14 amended); PHASE194_REQUIRE_PARITY=1 fails
+- [Phase 19.4.1]: Roadmap decks use the new summer deck theme (summercms.io look: navy, sun yellow, Roboto), chosen at the deck review; fonts vendored from the summercms.io build in sm-bm-app, no new npm dependency
+- [Phase 19.4.1]: golem15.presentations gets summer as an additive theme option; plan 04 must port summer.css and accept summer in the demo deck API
+- [Phase 19.4.1]: Admin public at https://demo.summercms.io/smbackend, login required, /backend 404 (user, 2026-10-20). Replaces the phase goal's and D-04's 'admin backend stays private'. Plans 03-05 recheck: plan 03 CTA/contact form wording, CONTEXT deployment note, threat row T-19.4.1-06 (new mitigation: login required, credentials on request, 5/min login throttle per real IP via Cloudflare real-IP, then 429), seeded FAQ 'The admin is private on this demo' (seed.go and the live row). — The user asked for the admin at the Task 7 review of the first live release; the throttle was checked live behind Cloudflare.
+- [Phase 19.4.1]: The 'Want to see the backend? Contact Golem15' CTA stays a contact CTA and does not link to /smbackend (user, 2026-10-20). The admin URL is public, its credentials are not; Golem15 hands them out on request. Plan 03's contact form (D-04) still applies; only its wording and the threat model change. — Resolves the open question raised by the /smbackend decision.
+- [Phase 19.4.1]: Plugin release tags for the demo: paymentgateway v0.1.0; sitemap, menu, faq, oauthserver v0.1.0; pgsub v0.1.2 and pgstripe v0.1.2 re-tagged on paymentgateway v0.1.0; translate v0.1.2 and presentations v0.1.1. sm-demo-app go.mod requires tags only (summercms v0.3.0), no replace; release builds use GOWORK=off. — D-03; tags confirmed with git ls-remote after each push.
+- [Phase 19.4.1]: 19.4.1-03: tags sm-user-plugin v0.1.3 (7b9faa3) and sm-journal-plugin v0.2.1 (fe1bbc2); sm-demo-app requires both, other apps' pins untouched; Phase 19.5 takes the next free sm-user-plugin tag
+- [Phase 19.4.1]: 19.4.1-03: Turnstile is opt-in in the core user plugin (golem15.user.turnstile, empty default adds nothing, open|closed on /login and /register only, invalid value fails boot); the demo sets closed
+- [Phase 19.4.1]: 19.4.1-04: the demo runs its own Centrifugo v6.5.1 on rome (127.0.0.1:8010, /usr/local/bin/centrifugo, supervisor summercms-demo-centrifugo) with its own secrets; nothing shared with bm (D-17). Assumption A3 held: static_headers under channel.proxy.subscribe.http is accepted.
+- [Phase 19.4.1]: 19.4.1-04: logged in, the home page's Presentations card and a header link go to My presentations (/presentations); logged out the card goes straight to the deck of the language. SSR reads the session cookie, so server and hydrated links agree.
+- [Phase 19.4.1]: 19.4.1-04: on a computer the remote opens in a 390x844 named popup (speaker view Open remote, My presentations Remote); opened without noopener to detect blocking, opener cut at once; blocked popups fall back to a tab; phones open it in place. No QR code exists (would need an approved package).
+- [Phase 19.4.1]: 19.4.1-04: the demo deck API refuses edits to a published deck (403), keeping the seeded roadmap decks intact.
+- [Phase 19.4.1]: Phase 19.4.1 database tests boot the whole demo on a fresh database cloned from a migrated template per plugin list (internal/demotest, one postgres:15 container per test binary)
+- [Phase 19.4.1]: bm's frontend library tests run byte-identical in vue-demo-app under vitest 3.2.7; aliases map bm's @/api, @/deck and ../../deck/ layout
+- [Phase 19.4.1]: sm-demo-app scripts/check-all.sh is the phase gate: every suite, the release build, pin/deploy/smoke checks, local browser checks when the stack is up, and check-live
+- [Phase 19.8]: Charm v2 stack on charm.land paths (decision note 2026-10-21-console-charm-stack.md); plan 19.8-01 installed lipgloss v2.0.6 and colorprofile v0.4.3 only
+- [Phase 19.8]: diary owns the process logger: config/log.yaml channels (console, stderr, daily, stack, null), per-component levels, sunscreen on every leaf, daily files on by default (storage/logs, 14 days)
+- [Phase 19.8]: wristband and bouncer now import diary for their log lines, amending their dependency-free leaf status (confirmed by the user 2026-10-21: diary is the one allowed framework import, and wristband is required to use it)
+- [Phase 19.8]: 19.8-02: bonfire.NewRoot sends the error block to stderr when its output is os.Stdout; Output.Error keeps its stream, so no command output moves
+- [Phase 19.8]: 19.8-02: bonfire.Execute resets persistent flags per run and routes a call without a command word (globals, -h, --help) to the Artisan list; fang runs without version, man page and completions
+- [Phase 19.8]: 19.8-02: --no-ansi on an interactive terminal uses the plain line prompts (no huh, no selector); -n and -q return prompt defaults; ConfirmProceed never asks off an interactive terminal
+- [Phase 19.8]: 19.8-02: one live view at a time; output and diary log lines printed while it runs go above it via bonfire.PrintAbove (Program.Send, safe after the program ends)
+- [Phase 19.8]: 19.8-02: builtin list and help carry Long and Examples so the framework CheckDocs test in plan 3 covers them
+- [Phase 19.8]: 19.8-03: SummerCMS v0.4.0 tagged at 99b6df4 and pushed with its changelog post; commits other sessions made during the run stay local
+- [Phase 19.8]: 19.8-03: the ten plugins applications mount got patch tags (user v0.1.6, journal v0.2.2, pgstripe v0.1.3, the rest v0.1.1) because sm-demo-app refuses pseudo-version pins
+- [Phase 19.8]: 19.8-03: chat and forum require sm-user-plugin v0.1.2 (classes.DeletingEvent); plugins log through a package-level pluginLog = diary.For(code)
+- [Phase 19.8]: 19.8-05: CR-01 prints above live views by sending tea.Println messages straight to the program queue under liveMu; unregister/finish/wait as one locked, deferred step
+- [Phase 19.8]: 19.8-05: WR-01 handled inside runLive (relay SIGINT/SIGTERM while a view runs, Kill, re-raise); generated main unchanged
+- [Phase 19.8]: 19.8-05: CR-02 uses the additive bonfire.WithExitCode carrier; CR-03 delegates get os.Stdout/os.Stderr on a terminal, stderr kept apart otherwise
+- [Phase 19.8]: 19.8-05: dev.ShutdownGrace (15s) shared by summer dev and delegates; daily files retry after a minute or on a new date; replaced daily writers are retired
+- [Phase 19.8]: 19.8-05: bonfire.Sanitize (additive) replaces diary's sanitizer; Migrate iterates migrationSets
+- [Phase 19.6.1]: Roles create and update refuse any new code that rolePermissions attaches grants to, including when the editor is a superuser — D-16 stricter reading from the gap contract: a role never becomes a code-declared system role through the Roles screen
+- [Phase 19.6.1]: cabana wraps contributed Administrators Runs; guardOutranked stays unexported and contributors do not own the check — D-19 gap contract: wrap in cabana so a contribution to summercms.cabana.users cannot skip outranking
+- [Phase 19.6.1]: Persist picked relation labels on the form via FORM_REMEMBER_LABEL; keep the one-panel FormGrid (do not v-show inactive tabs) — UAT G-19.6.1-T2 is labeling only; v-show of inactive tabs would change trigger hide-tab, ML locale reset, and field mount cost
+- [Phase 19.6.1]: Administrators and Roles are cabana screens behind backend.manage_users / backend.manage_roles with no default role grant; privilege rules run in the save tx; last-superuser uses pg_advisory_xact_lock; contributed Administrators Runs are wrapped with guardOutranked.
+- [Phase 19.7]: 19.7-01: planner decisions P-01..P-04 implemented: bouncer.Dispatch context-only marker honoured by Registry.Middleware and cabana.ResolveBackend; account contributions as pact.HasAccountContributions; prompted record actions post payload as a JSON string; pact MCP types carry the principal as any and stay SDK-free
+- [Phase 19.7]: 19.7-01: wristband authorize allow-list is exactly Options.ScopesSupported (empty keeps the PHP default); surf stream routes recover with an opaque 500 only before the first byte; account contribution Run runs without a transaction only when no database is published
+- [Phase 19.7]: Framework release is v0.5.0 (19.7-02 Task 5), carrying 19.6.1, 19.7 plans 01-02 and a set of 7 msd-quick patches; tag only after all 7 are committed — User decision 2026-10-22: minor bump for the new pier module and pact capabilities; hold the tag until the quick patches land
+- [Phase 19.7]: v0.5.0 is tagged only when phase 19.7 is fully complete (plans 01-05 and phase verification); supersedes the earlier 19.7-02 Task 5 entry. Plan 02 closes without a tag; no intermediate framework tag for 19.7 work — User decision 2026-10-23: a minor version marks the finished MCP phase, not a partial one
+- [Phase 19.7]: Once the user confirms all in-flight msd-quick tasks are finished: release the framework as the next v0.4.x patch (carrying the quick patches and 19.7 work so far) and tag the held user-plugin fixes; plugins may be tagged mid-phase. Framework v0.5.0 stays reserved for full MCP usability at phase 19.7 completion — User decision 2026-10-23: plugins can be tagged now, framework 0.5 means the MCP phase is finished; wait for the user's word that the last quick agent is done
+- [Phase 19.7]: 19.7-02: pier serves 2025-11-25 clients through its own session router over StreamableServerTransport (Redis-shared sessions, D-25) and 2026-07-28 clients through the SDK stateless handler; plan 02 closed without a tag, pier ships opt-in in v0.4.4 (summercms_mcp tag plus mcp.enabled, default off)
+- [Phase 19.7]: Released framework v0.4.4 (e2759d6, changelog id 39) and sm-user-plugin v0.1.9 (3828a65; requires v0.4.3); sm-demo-app bumped to user v0.1.9 locally (a25444e, unpushed). Other apps not bumped yet — User go-ahead 2026-10-23 after all quick tasks finished; all release gates green at e2759d6
 
 ### Pending Todos
 
 - [2026-10-01] [docs] Benchmark Płytarium on WinterCMS vs SummerCMS and publish a measured table — [todo file](.planning/todos/pending/2026-10-01-benchmark-the-application-on-wintercms-vs-summercms.md)
 - [2026-10-07] [sm-translate-plugin] Translate Messages as a Nuxt i18n JSON editor — [todo file](.planning/todos/pending/2026-10-07-translate-messages-as-nuxt-i18n-json-editor.md)
-- [unknown] [summercms.go admin auth] Backend admin personal API tokens (deferred Apparatus PersonalApiToken) — [todo file](.planning/todos/pending/backend-admin-api-tokens.md)
-- [unknown] [summercms.go bonfire] Reject duplicate console command names in bonfire.NewRoot — [todo file](.planning/todos/pending/bonfire-duplicate-command-names.md)
+- [2026-10-10] [framework] Prompt open admin and site tabs to reload when a new version is deployed — [todo file](.planning/todos/pending/2026-10-11-reload-open-apps-when-a-new-version-is-deployed.md) — Needs TBD. Ideas:.
+- [2026-10-11] [lagoon/attach, fonoteka.go uploads] Uploads keep the client file extension, so a valid image can be served as HTML (stored XSS) — [todo file](.planning/todos/pending/2026-10-11-uploads-keep-client-extension-stored-xss.md)
+- [unknown] [sm-user-plugin / cabana] Verified link between a frontend user and a backend user — [todo file](.planning/todos/pending/2026-10-17-frontend-backend-account-link.md)
+- [unknown] [sm-user-plugin / pact] Plugins register their frontend permission codes in Go — [todo file](.planning/todos/pending/2026-10-17-plugin-registered-frontend-permissions.md)
+- [2026-10-19] [sm-oauthserver-plugin] Record PHP OIDC parity against WavePath before the OIDC cutover — [todo file](.planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md)
+- [2026-10-20] [consumers] Move grzybyfunkcjonalne to NUXT_CACHE_PURGE_TOKEN and the new layers before the NUXT_SITE_CACHE_* names are dropped — [todo file](.planning/todos/pending/2026-10-20-rename-site-cache-purge-env-in-consumers.md)
+- [2026-10-21] [framework] Quiet plugin boot logs on console commands like --help — [todo file](.planning/todos/pending/2026-10-21-quiet-plugin-boot-logs-on-console-commands.md) — Needs TBD. Options, possibly combined:.
+- [2026-10-22] [framework] Console review info findings (IN-01..IN-13) and the delegate signal exit code — [todo file](.planning/todos/pending/2026-10-22-console-review-info-findings.md)
+- [2026-10-22] [sm-user-plugin] User login ignores is_activated — [todo file](.planning/todos/pending/2026-10-22-user-login-ignores-is-activated.md)
+- [2026-10-22] [sm-user-plugin] User login lockout and same-second cutoff — [todo file](.planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md)
+- [2026-10-22] [sm-user-plugin] User login opt-in session cookie — [todo file](.planning/todos/pending/2026-10-22-user-login-opt-in-session-cookie.md)
+- [2026-10-22] [sm-user-plugin] User logout blacklist missing under serve — [todo file](.planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md)
+- [2026-10-22] [user-plugin] User plugin logout leaves the session cookie valid for up to 60 minutes — [todo file](.planning/todos/pending/2026-10-22-user-logout-cookie-stays-valid.md)
+- [2026-10-22] [sm-user-plugin] User password routes 404 switch — [todo file](.planning/todos/pending/2026-10-22-user-password-routes-404-switch.md)
+- [2026-10-22] [sm-user-plugin] User session routes ignore the cookie — [todo file](.planning/todos/pending/2026-10-22-user-session-routes-ignore-cookie.md)
+- [unknown] [cabana / admin] Audit-log admin action runs with the admin id (toolbar actions) — [todo file](.planning/todos/pending/admin-action-audit-log.md)
+- [unknown] [sm-faq-plugin] Port the FAQ plugin as sm-faq-plugin so FAQs become editable — [todo file](.planning/todos/pending/faq-plugin-port.md)
 - [unknown] [summercms.go lagoon] lagoon README registers an after-commit GORM callback that can sort after the flush — [todo file](.planning/todos/pending/lagoon-readme-after-commit-callback-order.md)
 - [unknown] [sm-user-plugin mail] Port MailBlocker and the block-mail checkbox with the mailing work — [todo file](.planning/todos/pending/mailblocker-with-mailing.md)
-- [unknown] [summercms.go] Nest framework packages under modules/ — same beach names — [todo file](.planning/todos/pending/nest-framework-packages-under-modules.md)
-- [unknown] [summercms.go/modules] Short README.md per modules/* after the nest — [todo file](.planning/todos/pending/per-module-readmes-after-nest.md)
+- [unknown] [sm-menu-plugin] Port the menu plugin as sm-menu-plugin so blog menus become editable — [todo file](.planning/todos/pending/menu-plugin-port.md)
+- [2026-10-21] [sm-user-plugin] Let password-less social accounts set a first password through change-password — [todo file](.planning/todos/pending/oauth-password-bootstrap-change-password.md)
 - [unknown] [summercms.go/modules/*/README.md, internal/docsite] Convert module README Go code blocks to compiled src= references — [todo file](.planning/todos/pending/readme-go-fences-src.md)
 - [unknown] [../fonoteka.go/README.md] Refresh fonoteka.go README — short status plus migrate/serve/login — [todo file](.planning/todos/pending/refresh-fonoteka-readme.md)
-- [unknown] [summercms.go/README.md] Rewrite summercms.go README — onboard, recreate login, honest cutover — [todo file](.planning/todos/pending/rewrite-summercms-readme.md)
+- [unknown] [cabana] Show the administrators holding a role on the Roles screen — [todo file](.planning/todos/pending/roles-screen-holders-list.md)
 - [unknown] [summercms.go internal/build] make:admin-controller output does not boot and names the model after the controller — [todo file](.planning/todos/pending/scaffold-admin-controller-incomplete.md)
 - [unknown] [summercms.go internal/build] Scaffolded files carry a DO NOT EDIT header, and make:command cannot reach the application — [todo file](.planning/todos/pending/scaffold-generated-header-and-command-deps.md)
 - [unknown] [summercms.go internal/build] make:model and make:migration in the same second produce migrations that run out of order — [todo file](.planning/todos/pending/scaffold-same-second-migration-order.md)
+- [2026-10-12] [framework] Purge the Nuxt site cache on menu and FAQ admin saves (framework-level purge service) — [todo file](.planning/todos/pending/site-cache-purge-for-menu-and-faq.md)
 - [unknown] [sm-sitemap-plugin] Port the sitemap plugin 1:1 as sm-sitemap-plugin for the next blog project — [todo file](.planning/todos/pending/sitemap-plugin-port.md)
-- [unknown] [summercms.go wristband] Neutral default resource URL in wristband.DefaultOptions — [todo file](.planning/todos/pending/wristband-neutral-resource-default.md)
+- [unknown] [sm-sitemap-plugin] Sitemap - replace the browser XSLT view before Chromium drops XSLT — [todo file](.planning/todos/pending/sitemap-xslt-browser-deprecation.md)
 
 ### Blockers/Concerns
 
@@ -682,7 +997,15 @@ Recent decisions affecting current work:
 - Phase 11 (River dual-driver split) is documented but unverified against a real build — plan with `--research-phase` and budget a timed-latency test.
 - Phase 8 UI gate: scripts/check-phase8-ui.mjs --final-gate's real Playwright browser matrix (32 UI-SPEC scenarios) is unimplemented (deliberate fatal() at check-phase8-ui.mjs:458, never authored by 08-05); stage_ui_harness must keep failing closed until a Playwright spec is authored. User approved Phase 8 closure on 2026-09-24 with this gap carried forward -- see 08-10-SUMMARY.md and .planning/phases/08-oauth2-1-authorization-server/deferred-items.md.
 - pending: push sm-user-plugin — 12.1-05 Task 3 condition (c) failed (`git ls-remote --tags origin v0.1.3` empty). Push summercms.go master and annotated tag v0.1.3 (local on df5cace) first, then the plugin, then fonoteka.go. Recorded in 12.1-05-SUMMARY.md.
+- 16.2-05 open UAT items: re-save HTML post 1 untouched (D-03 evidence vacuous), D-19 category edit check, root vhost install (frame-src), unpublish/delete test post 105
+- Phase 19.4: review warnings WR-01..06 are open (19.4-REVIEW-DISPOSITION.md); WR-01 (a replayed code does not revoke rotated refresh tokens) must be fixed before any client enables refresh. Release still pending: tag summercms, bump sm-oauthserver-plugin go.mod to sm-user-plugin v0.1.1 / summercms v0.2.4.
 
+| 261028-rqb | Admin SPA reload on deploy (todo .planning/todos/pending/2026-10-11-reload-open-apps-when-a-new-version-is-deployed.md, admin half only; site half already shipped in vue-demo-app): boardwalk exposes a build version derived from the embedded dist (header like X-Summer-Build on admin API responses and/or a version endpoint), the admin SPA records the version it booted with and shows a non-blocking reload banner when a newer build is seen (focus/visibility/interval check), plus a reload-once guard on Vite chunk-load errors (vite:preloadError + sessionStorage flag); unit tests; boardwalk README; rebuild admin and commit modules/boardwalk/dist (scripts/check-admin-dist.sh must pass) | 2026-10-28 | c8a22e3 | .planning/quick/261028-rqb-admin-spa-reload-on-deploy-todo-planning-todos-pending-2026 |
+| 261028-rqc | Quiet plugin boot logs on console commands like --help, framework side only (todo .planning/todos/pending/2026-10-21-quiet-plugin-boot-logs-on-console-commands.md): help/list/completion style commands must not print plugin Register/Boot Info logs (e.g. raise the default console log level for non-serve introspection commands or defer Boot for them), without hiding logs for serve/worker/migrate; no sm-* plugin edits (plugin-side Info->Debug changes are a separate follow-up); docs for the behaviour | 2026-10-28 | 6c606c6 | .planning/quick/261028-rqc-quiet-plugin-boot-logs-on-console-commands-like-help-framewo |
+| 261028-rqd | Console review info findings IN-01..IN-13 and the delegate signal exit code 128+n (todo .planning/todos/pending/2026-10-22-console-review-info-findings.md, review .planning/phases/19.8-console-commands-overhaul/19.8-REVIEW.md); all 14 verified still open on 2026-10-28 in modules/bonfire, modules/diary, cmd/summer, scripts/check-phase19.8.sh; fix each, keep behaviour backward compatible, update docs/console pages and TestDelegateExitCodePassthrough for 128+n | 2026-10-28 | 202d38b | .planning/quick/261028-rqd-console-review-info-findings-in-01-in-13-and-the-delegate-si |
+| 261028-rqe | attach.Store writes non-inline types with a non-rendering disposition (todo .planning/todos/pending/2026-10-28-attach-store-public-content-type.md): in modules/lagoon/attach/store.go pass Content-Disposition attachment (blob.WriterOptions) for anything not in an inline-safe raster allow-list (jpeg, png, gif, webp, avif), keep the DB ContentType unchanged, additive and non-breaking; tests; lagoon README and docs/services/storage.md deploy note updated | 2026-10-28 | 4957e5c | .planning/quick/261028-rqe-attach-store-writes-non-inline-types-with-a-non-rendering-di |
+| 261028-rqf | Audit-log successful admin action runs with the admin id (todo .planning/todos/pending/admin-action-audit-log.md): in modules/cabana/actions.go runAction log success with admin_id (bouncer.User(ctx).ID), controller, action and kind (toolbar/field), matching the existing bulk/record action log fields; tests | 2026-10-28 | 61d1043 | .planning/quick/261028-rqf-audit-log-successful-admin-action-runs-with-the-admin-id-tod |
+| 261028-rqg | Show the administrators holding a role on the Roles screen (todo .planning/todos/pending/roles-screen-holders-list.md, origin .planning/phases/19.6.1-backend-administrators-screen/19.6.1-UAT.md:44): read-only list of holders on the Roles form/preview in modules/cabana backend_roles_admin.go (and admin SPA if needed), superusers hidden from non-superuser editors (D-03), assignment stays on the Administrators form; tests; if admin/ changes, rebuild and commit modules/boardwalk/dist | 2026-10-28 | 653d95a | .planning/quick/261028-rqg-show-the-administrators-holding-a-role-on-the-roles-screen-t |
 ### Quick Tasks Completed
 
 | # | Description | Date | Commit | Directory |
@@ -713,6 +1036,43 @@ Recent decisions affecting current work:
 | 261009-i6e | add the anonymous author endpoint to sm-journal-plugin (D-20) | 2026-10-09 | sm-journal-plugin 908ade9, 57a347c | [261009-i6e-add-the-anonymous-author-endpoint-to-sm-](./quick/261009-i6e-add-the-anonymous-author-endpoint-to-sm-/) |
 | 261009-mgk | add the category content field to sm-journal-plugin (D-21) | 2026-10-09 | sm-journal-plugin 740dcd0, f22d089, 3d533d4 | [261009-mgk-add-the-category-content-field-to-sm-jou](./quick/261009-mgk-add-the-category-content-field-to-sm-jou/) |
 | 261009-mys | Add subtitle and avatar to backend users and a My account page (avatar menu, like WinterCMS) | 2026-10-09 | 143eca5, 64d21c8, 4f1cda3, 89611ea | [261009-mys-add-subtitle-and-avatar-to-backend-users](./quick/261009-mys-add-subtitle-and-avatar-to-backend-users/) |
+| 261010-iwu | Blog Editor live preview pane: toggleable, sandboxed iframe, embed thumbnail cards (16.2 follow-up) | 2026-10-10 | sm-journal-plugin df67939, c1f6a83, 2c78211 | [261010-iwu-blog-editor-live-preview-pane-toggleable](./quick/261010-iwu-blog-editor-live-preview-pane-toggleable/) |
+| 28 | Admin navbar View site link (admin origin root, new tab) | 2026-10-10 | 85fe541 | — |
+| 261011-joh | sieve: generic collection helpers module (Map, TryMap, Filter, Reduce, KeyBy, GroupBy, Uniq, UniqBy, Partition, Find, Set) | 2026-10-11 | 6933004, a0bf8ec | [261011-joh-sieve-generic-collection-helpers-module](./quick/261011-joh-sieve-generic-collection-helpers-module/) |
+| 30 | go test -short runs without Docker: TestMain flag parsing fix in 4 modules, cabana list fixture skip | 2026-10-11 | 7ef2e4f, c85cb64 | — |
+| 261011-kzi | Fix Phase 09 gaps: fonoteka phase09AdminRoutes inventory + per-guard cabana last_used_at throttle | 2026-10-11 | b45af8e | [261011-kzi-fix-phase-09-gaps-add-the-10-post-phase-](./quick/261011-kzi-fix-phase-09-gaps-add-the-10-post-phase-/) |
+| 261011-mag | fix check-phase10.sh hygiene gaps from 10-VERIFICATION.md | 2026-10-11 | 1541cd4 | [261011-mag-fix-check-phase10-sh-hygiene-gaps-from-1](./quick/261011-mag-fix-check-phase10-sh-hygiene-gaps-from-1/) |
+| 261012-s3g | Fix Phase 10 security blockers: DOMPurify richeditor display sanitizer (T-10-16), check-phase10 hygiene green (T-10-24/25), CSP form-action/frame-src; --all still red on fonoteka.go TestPhase09SecurityRoutes | 2026-10-12 | 708b3ec | [261012-s3g-fix-phase-10-security-blockers-t-10-16-d](./quick/261012-s3g-fix-phase-10-security-blockers-t-10-16-d/) |
+| 261013-0wa | Close T-17-15: validate sitemap frontend_url and escape it in Rewrite | 2026-10-12 | 6e5a8e7 | [261013-0wa-close-t-17-15-validate-sitemap-frontend-](./quick/261013-0wa-close-t-17-15-validate-sitemap-frontend-/) |
+| 261015-w7f | Framework docs since v0.1.14 + Upgrading to 0.2, release v0.2.0 (plugins, layers), deploy summercms.io | 2026-10-15 | a204d38 | [261015-w7f-update-framework-docs-for-phase-19-3-rel](./quick/261015-w7f-update-framework-docs-for-phase-19-3-rel/) |
+| 36 | summercms.io copy Alpha 0.1 → 0.2 (vue b5d6dbb, app 6a13a87), deployed | 2026-10-15 | 853ea1f | — |
+| 261016-0fm | Admin minors for v0.2.1: theme switch, language switch, settings nav on form pages | 2026-10-16 | 66fd4ae | [261016-0fm-admin-minors-for-v0-2-1-theme-switch-lan](./quick/261016-0fm-admin-minors-for-v0-2-1-theme-switch-lan/) |
+| 261016-s8x | PaymentGateway: banner bottom margin and hide disabled sections from admin navigation | 2026-10-16 | ab9f385 | [261016-s8x-paymentgateway-banner-bottom-margin-and-](./quick/261016-s8x-paymentgateway-banner-bottom-margin-and-/) |
+| 261018-k9s | add the D-17 module in summercms.go: modules/breakwater Render(markdown)/Purify(html) with the forum bluemonday policy | 2026-10-18 | 98bc6de | [261018-k9s-add-the-d-17-module-in-summercms-go](./quick/261018-k9s-add-the-d-17-module-in-summercms-go/) |
+| 40 | Goldens secret scan in check-phase19.1.sh (closes T-19.1-12) | 2026-10-18 | 8643195 | — |
+| 261018-qbs | Fix 19.1 review WR-04 (chatbots dispatch checks IsAvailable) and WR-05 (chatvideo user.Deleting heir + LiveKit cleanup); extending.md optional-dependency go.mod note | 2026-10-18 | 97daec5 | [261018-qbs-fix-19-1-review-findings-wr-04-chatbots-](./quick/261018-qbs-fix-19-1-review-findings-wr-04-chatbots-/) |
+| 261019-05g | Phase 17 verify-work unblock (COVERAGE.md reason, goal as user story, sm-sitemap-plugin requires v0.2.0) and console docs example of the application binary's --help | 2026-10-19 | 86c5a80 | [261019-05g-phase-17-verify-work-unblock-coverage-md](./quick/261019-05g-phase-17-verify-work-unblock-coverage-md/) |
+| 261019-hgw | Translate hook ValidationError phrase keys in the request locale | 2026-10-19 | ce8d7ef | [261019-hgw-translate-hook-validationerror-phrase-ke](./quick/261019-hgw-translate-hook-validationerror-phrase-ke/) |
+| 261020-13e | Admin image previews of public files fall back to the authenticated thumb route | 2026-10-19 | 1ab7db4 | [261020-13e-admin-file-upload-widget-image-preview-a](./quick/261020-13e-admin-file-upload-widget-image-preview-a/) |
+| 261020-42e | branded HTML error pages for browsers | 2026-10-20 | a34c251 | [261020-42e-branded-html-error-pages-for-browsers-un](./quick/261020-42e-branded-html-error-pages-for-browsers-un/) |
+| 261020-sdt | Rotate the site-cache purge token and rename the layer variable (demo + summercms.io) | 2026-10-20 | 4270d05 | [261020-sdt-rotate-the-purge-token-and-rename-the-la](./quick/261020-sdt-rotate-the-purge-token-and-rename-the-la/) |
+| 261022-4z8 | Fix the open 19.8 re-review findings (WR-09..WR-14, IN-14, IN-15) | 2026-10-22 | b1fba7e | [261022-4z8-fix-the-open-19-8-re-review-findings-wr-](./quick/261022-4z8-fix-the-open-19-8-re-review-findings-wr-/) |
+| 261022-k9k | Admin keyboard shortcuts: Ctrl+S, Ctrl+Enter, Ctrl+Shift+S (Create and new), / search, Esc, ? help | 2026-10-22 | 604fee7 | [261022-k9k-keyboard-shortcuts-in-the-admin-spa-ctrl](./quick/261022-k9k-keyboard-shortcuts-in-the-admin-spa-ctrl/) |
+| 261022-tb4 | Password /login refuses a not-activated account while require_activation is on (sm-user-plugin 15ff979, unreleased: hold until the escalation batch lands) | 2026-10-22 | 15ff979 (sm-user-plugin) | [261022-tb4-password-login-must-refuse-is-activated-](./quick/261022-tb4-password-login-must-refuse-is-activated-/) |
+| 261022-tto | User plugin /fetch, /refresh, /update, /change-password accept token/auth_token session cookies (sm-user-plugin 8e4b863, ships v0.5.0) | 2026-10-22 | 8e4b863 (sm-user-plugin) | [261022-tto-fetch-refresh-update-change-password-mus](./quick/261022-tto-fetch-refresh-update-change-password-mus/) |
+| 261022-usi | User plugin jwt blacklist and GORM hooks wired via lagoon.OnDatabase so logout revokes under serve; jwt guard uses SessionCookieNames (sm-user-plugin 4bf44fc, ships v0.5.0) | 2026-10-22 | 4bf44fc (sm-user-plugin) | [261022-usi-user-plugin-jwt-blacklist-and-hooks-wire](./quick/261022-usi-user-plugin-jwt-blacklist-and-hooks-wire/) |
+| 261022-vfz | User plugin /login throttle keyed on surf.ClientIP (trusted proxies); reset-password and admin password set stamp tokens_valid_after in whole seconds (sm-user-plugin b6f8055, a484d0e, ships v0.5.0; verified) | 2026-10-22 | b6f8055, a484d0e (sm-user-plugin) | [261022-vfz-user-plugin-login-throttle-via-surf-clie](./quick/261022-vfz-user-plugin-login-throttle-via-surf-clie/) |
+| 261022-wah | User plugin opt-in golem15.user.jwt.token_cookie (default off) sets the HttpOnly auth.cookie session cookie on /login, /register and /activate-by-code instead of the body token; a /refresh carried by the auth.cookie cookie rewrites it (sm-user-plugin 846087d, 8bdf2c7, ships v0.5.0; verified) | 2026-10-22 | 846087d, 8bdf2c7 (sm-user-plugin) | [261022-wah-opt-in-httponly-session-cookie-on-user-p](./quick/261022-wah-opt-in-httponly-session-cookie-on-user-p/) |
+| 261022-x7a | User plugin golem15.user.password.public_routes (default true): false leaves POST /login, /forgot-password and /reset-password unregistered so they 404 like unknown paths; /register and the rest unchanged (sm-user-plugin 3828a65, ships v0.5.0; verified) | 2026-10-22 | e5dd457 | [261022-x7a-user-plugin-golem15-user-password-public](./quick/261022-x7a-user-plugin-golem15-user-password-public/) |
+| 55 | fix(cabana): backend subject events reach pier as *pact.MCPSubjectChanged after commit | 2026-10-23 | 7c43820 | — |
+| 261028-pq8 | Fix the four internal/build scaffolder todos (make:plugin vendor path, make:admin-controller output, scaffold header and make:command deps, same-second migration order) | 2026-10-28 | 8bc18c9 | [261028-pq8-fix-the-four-internal-build-scaffolder-t](./quick/261028-pq8-fix-the-four-internal-build-scaffolder-t/) |
+| 261028-r16 | Fix the two lagoon todos: stored-upload extension from sniffed MIME (tests + deploy note) and the lagoon README after-commit callback order | 2026-10-28 | 36092f5 | [261028-r16-fix-the-two-lagoon-todos-derive-stored-u](./quick/261028-r16-fix-the-two-lagoon-todos-derive-stored-u/) |
+| fast | ensureToolchain keeps an existing toolchain line instead of adding a second one | 2026-10-28 | 6ea2cb7 | — |
+| 261106-dv0 | shared plugins log boot details at Debug: paymentgateway operators registered, paymentgatewaysubscriptions registries collected through diary.For (todo 2026-10-28-plugins-log-boot-details-at-debug.md) | 2026-11-06 | 8a88b86, 1df6a26 | [261106-dv0-plugin-boot-logs-at-debug](./quick/261106-dv0-plugin-boot-logs-at-debug/) |
+| 261106-e5v | purge token rename leftovers: grzybyfunkcjonalne check-deploy refuses NUXT_SITE_* keys, journal/menu/faq READMEs name NUXT_CACHE_PURGE_TOKEN (todo 2026-10-20-rename-site-cache-purge-env-in-consumers.md) | 2026-11-06 | 4e2cf0c, f61c90a, 128a33d, a53511b | [261106-e5v-purge-token-rename-leftovers](./quick/261106-e5v-purge-token-rename-leftovers/) |
+| 261106-jhk | wristband MCP authorize drops OIDC identity scopes (openid, profile, email) so the ChatGPT connector can connect | 2026-11-06 | aba678b | [261106-jhk-wristband-mcp-authorize-ignores-oidc-ide](./quick/261106-jhk-wristband-mcp-authorize-ignores-oidc-ide/) |
+| 261106-kt1 | pier MCP 401 challenge names only resource_metadata, so clients request the advertised scopes (write included) | 2026-11-06 | 609caa4 | [261106-kt1-pier-mcp-401-challenge-drops-the-fixed-r](./quick/261106-kt1-pier-mcp-401-challenge-drops-the-fixed-r/) |
+| 261106-kt2 | deferred:purge, migrate* and queue:clear reuse the app's published database, so the in-server scheduler no longer fails with duplicate provider for *sql.DB | 2026-11-06 | 99abe88 | [261106-kt2-lagoon-deferred-purge-fails-in-the-sched](./quick/261106-kt2-lagoon-deferred-purge-fails-in-the-sched/) |
 
 ## Deferred Items
 
@@ -724,6 +1084,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-09T20:52:41.534Z
-Stopped at: Completed 16.1-03-PLAN.md
-Resume file: None
+Last session: 2026-10-24T14:47:37.432Z
+Stopped at: Phase 32 context gathered
+Resume file: .planning/phases/32-seo-foundation/32-CONTEXT.md

.planning/WINDOWS.md

@@ -1,10 +1,10 @@
 ---
 schema_version: 1
-open_count: 6
+open_count: 26
 waived_count: 0
-fixed_count: 6
-total_count: 12
-last_updated: 2026-10-09T20:51:27.671Z
+fixed_count: 9
+total_count: 35
+last_updated: 2026-11-04T19:19:01.124Z
 ---
 
 # Broken Windows Ledger
@@ -27,6 +27,29 @@ last_updated: 2026-10-09T20:51:27.671Z
 | 10 | 12.1 | unmet-truth | .planning/phases/12.1-user-plugin-admin-screens/deferred-items.md |  | fonoteka.go: four application tests pin lists the user plugin's admin work changes (TestAdminMetadataFiltering nav list, TestHiddenNeverMarshals user model count, parity TestMigrateSeedsCanonicalGenres and TestRollbackLastIsolatesFonoteka migration ids); with the two from plan 12.1-02 they keep plan 12.1-03's application verify red until plan 12.1-04 updates them | fixed |  | 2026-10-05T11:31:36.781Z | 2026-10-05T12:07:04.853Z |
 | 11 | 16.1 | unrun-verify | modules/cabana/query_relation_test.go |  | TestListRelationSearchPostgres not run here (no Docker); run go test -count=1 ./modules/cabana on a Docker host before /msd-verify-work | open |  | 2026-10-09T20:51:22.934Z |  |
 | 12 | 16.1 | unrun-verify | .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md |  | sm-journal-plugin TestPostsAdminResaveKeepsHTML (posts_admin_smoke_test.go) not run here (no Docker); run go -C ../sm-journal-plugin test -count=1 ./... on a Docker host before /msd-verify-work | open |  | 2026-10-09T20:51:27.671Z |  |
+| 13 | 16.2 | deviation | tests/blogeditor/fixtures/imported-post.html |  | sm-journal-plugin: 16.2-02 imported-post fixture is synthetic (same structure as the export post) because reading the journal export was refused by the environment's PII classifier; swap in the real export content if wanted | open |  | 2026-10-10T09:54:57.288Z |  |
+| 14 | 16.2 | unrun-verify | plugin_test.go |  | sm-journal-plugin: TestJournalSVGEmbed now asserts AdminFS embeds assets/dist/blogeditor.js and .css; the root package TestMain needs Docker, so it was not run here; run go -C ../sm-journal-plugin test -count=1 . on a Docker host (plan 06) | open |  | 2026-10-10T09:54:57.583Z |  |
+| 15 | 16.2 | unrun-verify | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md |  | sm-journal-plugin posts_admin_smoke_test.go: TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML compile under go vet but need a Docker host (plan 06) | open |  | 2026-10-10T10:12:10.725Z |  |
+| 16 | 16.2 | unrun-verify | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md |  | sm-journal-plugin journal_api_categories_test.go TestCategoriesAdminContent (strip assertions) and journal_api_task3_test.go media upload route tests after the StoreMedia refactor need a Docker host (plan 06) | open |  | 2026-10-10T10:12:10.986Z |  |
+| 17 | 16.2 | unmet-truth | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md |  | 16.2-05 D-03 on an HTML post unproven on UAT: post 1 (HTML_POST) was not written after RESTART_TS (updated_at still 2026-10-09), so posts-unchanged passed vacuously for it; a human must re-save post 1 untouched and the SELECT be re-run | fixed |  | 2026-10-10T11:35:56.721Z | 2026-10-10T12:04:50.783Z |
+| 18 | 16.2 | unmet-truth | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md |  | 16.2-05 D-19 human check pending: a one-word category edit in the Blog Editor saves without a removal notice and shows on the site; post 1 source tab shows the stored HTML unchanged | open |  | 2026-10-10T11:35:56.955Z |  |
+| 19 | 16.2 | todo | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md |  | 16.2-05 UAT root step: install the staging vhost with frame-src https://www.youtube-nocookie.com, nginx -t and reload; unpublish or delete test post uat-16-2-blog-editor (id 105) | open |  | 2026-10-10T11:35:57.234Z |  |
+| 20 | 16.2 | unrun-verify | modules/cabana/field_type_postgres_test.go |  | 16.2-06 TestFieldTypeSavePostgres (real-database save, show, untouched and refused update, upload in and out of scope) compiles under go vet but needs a Docker host; run bash scripts/check-phase16.2.sh postgres | open |  | 2026-10-10T14:17:06.378Z |  |
+| 21 | 16.2 | unrun-verify | .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md |  | sm-journal-plugin: 16.2-06 TestCategoriesAdminBlogEditor (categories_admin_editor_test.go) and the rewritten three-stage TestPostsAdminResaveKeepsHTML compile under go vet but need a Docker host; run bash scripts/check-phase16.2.sh postgres | open |  | 2026-10-10T14:17:06.621Z |  |
+| 22 | 19.1 | deviation | sm-forum-plugin/go.mod |  | go.mod lists bluemonday and goldmark as // indirect via breakwater; no direct require | open |  | 2026-10-18T13:42:54.900Z |  |
+| 23 | 19.1 | deviation | classes/lifecycle.go |  | Task 4 methods besides DeleteContext live in classes/lifecycle.go | open |  | 2026-10-18T13:42:55.096Z |  |
+| 24 | 19.7 | deviation | modules/cabana |  | 19.7-01: capabilities_test field-count assertion updated 2->3 for AdminRecordActionInput.Value | open |  | 2026-10-22T14:44:56.001Z |  |
+| 25 | 19.7 | deviation | modules/cabana |  | 19.7-01: admin route inventories (phase09Routes, tokenRouteClasses, CSRF walk 35, phase10 want list, conformCases) extended for the two account contribution routes | open |  | 2026-10-22T14:44:56.218Z |  |
+| 26 | 19.7 | deviation | modules/cabana |  | 19.7-01: TestRecordActionPromptRun added on Postgres to prove Run receives the trimmed prompt value | open |  | 2026-10-22T14:44:56.449Z |  |
+| 27 | 19.7 | unrun-verify | scripts/check-phase19.6.1.sh |  | 19.7-01: check-phase19.6.1.sh --all stopped by the host (memory pressure) after the cabana and surf Postgres suites passed; re-run on the Docker host | open |  | 2026-10-22T14:44:56.679Z |  |
+| 28 | 33 | deviation | modules/lagoon/validate.go |  | 33-02: lagoon.Validate rejects the string and url rule tokens, so the Journal admin settings save answers 500 (pre-existing); the Headings and links switch is saved through the settings API/MCP until fixed | open |  | 2026-11-04T09:39:12.905Z |  |
+| 29 | 33 | stub | contract/contract.go |  | sm-sitemap-plugin: contract.ListingSettings HTMLEnabled, HTMLPaths, HTMLPageSize and KeyFile stay zero and golem15_sitemap_urls.images stays [] until 33-04 adds the HTML sitemap, IndexNow and image settings | fixed |  | 2026-11-04T10:26:56.754Z | 2026-11-04T11:41:58.774Z |
+| 30 | 33 | deviation | models/settings/fields.yaml |  | sm-sitemap-plugin: the Additional addresses lastmod is a text field read as YYYY-MM-DD (server-checked, errors.lastmod) because the framework repeater accepts no datepicker column; swap to a datepicker once cabana supports it in repeaters | open |  | 2026-11-04T10:26:56.940Z |  |
+| 31 | 33 | deviation | models/settings/fields.yaml |  | sm-sitemap-plugin: News sources is a taglist with custom tags and no options (values listed by the news_sources partial, server-checked) because cabana taglist options are a fixed YAML list and form extensions take no taglist; switch to options from the article types and categories once the framework offers per-request taglist options | open |  | 2026-11-04T11:42:13.158Z |  |
+| 32 | 33 | deviation | controllers/issues/config_filter.yaml |  | sm-seo-plugin: the Site audit status filter cannot default to Open (cabana list filters have no default value), so the list shows ignored issues too, badged Ignored; GET /_seo/api/v1/issues and seo_list_issues default to status open; set the default once cabana filters accept one | open |  | 2026-11-04T15:03:28.372Z |  |
+| 33 | 33 | deviation | controllers/issues/_issue_details.htm |  | sm-seo-plugin: P7 shows Open the page and the Rich Results Test as labelled addresses, not links, because the partial allowlist keeps only same-origin hrefs; make them links once partials may carry an external link (new tab) | open |  | 2026-11-04T15:03:28.619Z |  |
+| 34 | 33 | deviation | vue-demo-app/nuxt.config.ts |  | 33-12: the demo serves Polish by cookie at one address (no_prefix), but the CMS names /pl/... alternates and sitemap addresses, which answer 404; i18n strategy decision before 33-14 applies the demo patches | open |  | 2026-11-04T17:10:13.946Z |  |
+| 35 | 33 | todo | sm-sitemap-plugin/classes/rebuild.go |  | 33-12: additional addresses are not de-duplicated against content records (migrated /, /blog, /faq listed twice on rome-like data); the demo DEPLOY step works around it | fixed |  | 2026-11-04T17:10:14.144Z | 2026-11-04T19:19:01.124Z |
 
 ````json
 [
@@ -185,6 +208,305 @@ last_updated: 2026-10-09T20:51:27.671Z
     "recorded_at": "2026-10-09T20:51:27.671Z",
     "resolved_at": null,
     "milestone": "v1.0"
+  },
+  {
+    "id": 13,
+    "kind": "deviation",
+    "phase": "16.2",
+    "file": "tests/blogeditor/fixtures/imported-post.html",
+    "line": null,
+    "description": "sm-journal-plugin: 16.2-02 imported-post fixture is synthetic (same structure as the export post) because reading the journal export was refused by the environment's PII classifier; swap in the real export content if wanted",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T09:54:57.288Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 14,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": "plugin_test.go",
+    "line": null,
+    "description": "sm-journal-plugin: TestJournalSVGEmbed now asserts AdminFS embeds assets/dist/blogeditor.js and .css; the root package TestMain needs Docker, so it was not run here; run go -C ../sm-journal-plugin test -count=1 . on a Docker host (plan 06)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T09:54:57.583Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 15,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md",
+    "line": null,
+    "description": "sm-journal-plugin posts_admin_smoke_test.go: TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML compile under go vet but need a Docker host (plan 06)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T10:12:10.725Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 16,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md",
+    "line": null,
+    "description": "sm-journal-plugin journal_api_categories_test.go TestCategoriesAdminContent (strip assertions) and journal_api_task3_test.go media upload route tests after the StoreMedia refactor need a Docker host (plan 06)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T10:12:10.986Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 17,
+    "kind": "unmet-truth",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md",
+    "line": null,
+    "description": "16.2-05 D-03 on an HTML post unproven on UAT: post 1 (HTML_POST) was not written after RESTART_TS (updated_at still 2026-10-09), so posts-unchanged passed vacuously for it; a human must re-save post 1 untouched and the SELECT be re-run",
+    "status": "fixed",
+    "reason": "",
+    "recorded_at": "2026-10-10T11:35:56.721Z",
+    "resolved_at": "2026-10-10T12:04:50.783Z",
+    "milestone": "v1.0"
+  },
+  {
+    "id": 18,
+    "kind": "unmet-truth",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md",
+    "line": null,
+    "description": "16.2-05 D-19 human check pending: a one-word category edit in the Blog Editor saves without a removal notice and shows on the site; post 1 source tab shows the stored HTML unchanged",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T11:35:56.955Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 19,
+    "kind": "todo",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md",
+    "line": null,
+    "description": "16.2-05 UAT root step: install the staging vhost with frame-src https://www.youtube-nocookie.com, nginx -t and reload; unpublish or delete test post uat-16-2-blog-editor (id 105)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T11:35:57.234Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 20,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": "modules/cabana/field_type_postgres_test.go",
+    "line": null,
+    "description": "16.2-06 TestFieldTypeSavePostgres (real-database save, show, untouched and refused update, upload in and out of scope) compiles under go vet but needs a Docker host; run bash scripts/check-phase16.2.sh postgres",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T14:17:06.378Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 21,
+    "kind": "unrun-verify",
+    "phase": "16.2",
+    "file": ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md",
+    "line": null,
+    "description": "sm-journal-plugin: 16.2-06 TestCategoriesAdminBlogEditor (categories_admin_editor_test.go) and the rewritten three-stage TestPostsAdminResaveKeepsHTML compile under go vet but need a Docker host; run bash scripts/check-phase16.2.sh postgres",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-10T14:17:06.621Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 22,
+    "kind": "deviation",
+    "phase": "19.1",
+    "file": "sm-forum-plugin/go.mod",
+    "line": null,
+    "description": "go.mod lists bluemonday and goldmark as // indirect via breakwater; no direct require",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-18T13:42:54.900Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 23,
+    "kind": "deviation",
+    "phase": "19.1",
+    "file": "classes/lifecycle.go",
+    "line": null,
+    "description": "Task 4 methods besides DeleteContext live in classes/lifecycle.go",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-18T13:42:55.096Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 24,
+    "kind": "deviation",
+    "phase": "19.7",
+    "file": "modules/cabana",
+    "line": null,
+    "description": "19.7-01: capabilities_test field-count assertion updated 2->3 for AdminRecordActionInput.Value",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-22T14:44:56.001Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 25,
+    "kind": "deviation",
+    "phase": "19.7",
+    "file": "modules/cabana",
+    "line": null,
+    "description": "19.7-01: admin route inventories (phase09Routes, tokenRouteClasses, CSRF walk 35, phase10 want list, conformCases) extended for the two account contribution routes",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-22T14:44:56.218Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 26,
+    "kind": "deviation",
+    "phase": "19.7",
+    "file": "modules/cabana",
+    "line": null,
+    "description": "19.7-01: TestRecordActionPromptRun added on Postgres to prove Run receives the trimmed prompt value",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-22T14:44:56.449Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 27,
+    "kind": "unrun-verify",
+    "phase": "19.7",
+    "file": "scripts/check-phase19.6.1.sh",
+    "line": null,
+    "description": "19.7-01: check-phase19.6.1.sh --all stopped by the host (memory pressure) after the cabana and surf Postgres suites passed; re-run on the Docker host",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-10-22T14:44:56.679Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 28,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "modules/lagoon/validate.go",
+    "line": null,
+    "description": "33-02: lagoon.Validate rejects the string and url rule tokens, so the Journal admin settings save answers 500 (pre-existing); the Headings and links switch is saved through the settings API/MCP until fixed",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T09:39:12.905Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 29,
+    "kind": "stub",
+    "phase": "33",
+    "file": "contract/contract.go",
+    "line": null,
+    "description": "sm-sitemap-plugin: contract.ListingSettings HTMLEnabled, HTMLPaths, HTMLPageSize and KeyFile stay zero and golem15_sitemap_urls.images stays [] until 33-04 adds the HTML sitemap, IndexNow and image settings",
+    "status": "fixed",
+    "reason": "",
+    "recorded_at": "2026-11-04T10:26:56.754Z",
+    "resolved_at": "2026-11-04T11:41:58.774Z",
+    "milestone": "v1.0"
+  },
+  {
+    "id": 30,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "models/settings/fields.yaml",
+    "line": null,
+    "description": "sm-sitemap-plugin: the Additional addresses lastmod is a text field read as YYYY-MM-DD (server-checked, errors.lastmod) because the framework repeater accepts no datepicker column; swap to a datepicker once cabana supports it in repeaters",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T10:26:56.940Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 31,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "models/settings/fields.yaml",
+    "line": null,
+    "description": "sm-sitemap-plugin: News sources is a taglist with custom tags and no options (values listed by the news_sources partial, server-checked) because cabana taglist options are a fixed YAML list and form extensions take no taglist; switch to options from the article types and categories once the framework offers per-request taglist options",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T11:42:13.158Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 32,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "controllers/issues/config_filter.yaml",
+    "line": null,
+    "description": "sm-seo-plugin: the Site audit status filter cannot default to Open (cabana list filters have no default value), so the list shows ignored issues too, badged Ignored; GET /_seo/api/v1/issues and seo_list_issues default to status open; set the default once cabana filters accept one",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T15:03:28.372Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 33,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "controllers/issues/_issue_details.htm",
+    "line": null,
+    "description": "sm-seo-plugin: P7 shows Open the page and the Rich Results Test as labelled addresses, not links, because the partial allowlist keeps only same-origin hrefs; make them links once partials may carry an external link (new tab)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T15:03:28.619Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 34,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "vue-demo-app/nuxt.config.ts",
+    "line": null,
+    "description": "33-12: the demo serves Polish by cookie at one address (no_prefix), but the CMS names /pl/... alternates and sitemap addresses, which answer 404; i18n strategy decision before 33-14 applies the demo patches",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T17:10:13.946Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 35,
+    "kind": "todo",
+    "phase": "33",
+    "file": "sm-sitemap-plugin/classes/rebuild.go",
+    "line": null,
+    "description": "33-12: additional addresses are not de-duplicated against content records (migrated /, /blog, /faq listed twice on rome-like data); the demo DEPLOY step works around it",
+    "status": "fixed",
+    "reason": "",
+    "recorded_at": "2026-11-04T17:10:14.144Z",
+    "resolved_at": "2026-11-04T19:19:01.124Z",
+    "milestone": "v1.0"
   }
 ]
 ````

.planning/debug/resolved/category-content-not-on-site.md

@@ -0,0 +1,122 @@
+---
+status: resolved
+trigger: "UAT gap G-16.2-2: Updated content in https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/categories/2 (\"Te grzyby, szczególnie\" changed into \"Te grzyby, a szczególnie\") and i see the change in backend even after refresh but not on frontend"
+created: 2026-10-10T17:20:00+02:00
+updated: 2026-10-10T20:05:00+02:00
+goal: find_root_cause_only
+---
+
+## Current Focus
+
+hypothesis: CONFIRMED (H3) — the host Nuxt app's Nitro swr route cache (`routeRules '/**': { swr: 300 }`) served /cordyceps rendered at 14:59:08 UTC, before the first save; every check the user made (14:59:52–15:00:30) was inside the 300 s fresh window, so Nitro returned that entry without revalidating, and nothing purges it on admin save. The save, the DB and the API are correct.
+test: done — DB SELECTs, API GET, two Nuxt GETs straddling a lazy revalidation, nginx access log timeline, deployed nitro.mjs cache code
+expecting: n/a
+next_action: return ROOT CAUSE FOUND (goal: find_root_cause_only); the gap is a cache-window/UAT-procedure issue, plus a product decision whether editors need instant visibility (purge on save)
+bug_class: Bohrbug (deterministic: any page view within maxAge of the last render returns the cached entry; the first view after expiry returns it too)
+reasoning_checkpoint:
+  hypothesis: "The site showed the old text because Nitro's swr route cache for /** (maxAge 300 s, swr: true, in-memory) held a /cordyceps render from 14:59:08 UTC; all the user's post-save views (last at 15:00:30) were before that entry expired at 15:04:08, and Nitro only re-renders an entry when a request arrives after expiry (serving the stale copy to that request). No code path invalidates the entry when the admin saves."
+  confirming_evidence:
+    - "DB row 2 and GET /_journal/api/v1/categories return the new text with identical md5 4053158bd1a58eb7f9547c18cb5a1724"
+    - "127.0.0.1:3016/cordyceps at 15:24:01: last-modified 14:59:08, old text; at 15:25:00: last-modified 15:24:01, new text"
+    - "nginx access log: render 14:59:08, PUTs 14:59:48–15:00:27, user views 14:59:52–15:00:30 all 13269 bytes or 304, no further views until 15:23"
+    - "deployed nitro.mjs: /** cache { swr: true, maxAge: 300 }; get() returns the unexpired entry without resolving and the expired entry stale-first"
+  falsification_test: "If a /cordyceps GET more than 300 s after the save, followed by a second GET, still returned the old text, or the access log showed a user view after 15:04:08 that returned old content and a later one that also did, the hypothesis would be wrong. Observed: post-expiry GET pair returned old then new, exactly as predicted."
+  fix_rationale: "Not applicable (diagnose only). Any fix must either shorten/bypass the cache for editors or invalidate the Nitro cache entry on save; changing the 16.2 save path cannot help, because the save is already correct."
+  blind_spots: "I did not observe the user's browser directly (no client-side cache test), but the access log shows their requests reaching Nuxt and getting the cached body. The swr cache key for _payload.json follows the same rule and was not separately timed. I did not verify whether the 7 PUTs each changed content (only the final state matters)."
+  candidate_causes:
+    - "config: Nitro routeRules swr 300 s with no purge on save (CONFIRMED)"
+    - "code: save writes a different column/locale than the API reads (ELIMINATED — one column, no translation rows)"
+    - "code: Go API caches or returns a stale field (ELIMINATED — API md5 == DB md5)"
+    - "environment: nginx proxy_cache (ELIMINATED — none; reproduced on 127.0.0.1:3016)"
+    - "environment: broken swr revalidation (ELIMINATED — refresh observed at 15:24:01, no SWR errors logged)"
+    - "data: phrase rendered from elsewhere (ELIMINATED — grep of app/layer/build/posts)"
+    - "process: UAT step 'the site shows the change' omits the swr window (CONTRIBUTING)"
+  and_gate: "yes — the visible failure needed the swr cache with no invalidation AND the user viewing the page only within the 300 s window of a render made just before the edit (their own 14:59:08 view). With either one absent (no cache, or a second view after 15:04:08) the change would have shown."
+
+## Symptoms
+
+expected: changing one word in a Journal category body in the admin and saving shows no removal notice, and the public site shows the change (Phase 16.2 D-19)
+actual: the save persisted (admin shows "Te grzyby, a szczególnie" after reload), no error reported, but the public Nuxt site still shows "Te grzyby, szczególnie"
+errors: none reported
+reproduction: UAT Test 2 — edit category 2 body at https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/categories/2, save, view the public category page
+started: discovered during Phase 16.2 UAT, edit made ~2026-10-10 17:00 CEST
+
+## Eliminated
+
+- hypothesis: H1 — two columns or a translation row: the admin saves one column/locale and the site renders another that is not regenerated
+  evidence: golem15_journal_categories has a single `content` column (no content_html); row 2 updated_at 2026-10-10 15:00:27.94 UTC holds "Te grzyby, a szczególnie" at char 589 and no old phrase; golem15_translate_attributes/indexes have no category rows (only 4 Post rows); en locale is disabled
+  timestamp: 2026-10-10T15:22Z
+
+- hypothesis: H2 — the public Journal API returns old content (server-side cache in Go, or a different field)
+  evidence: GET http://127.0.0.1:8096/_journal/api/v1/categories?include_empty=1 on the UAT host at 15:24:13 UTC returns category 2 content with "Te grzyby, a szczeg" at 577, no old phrase, md5 4053158bd1a58eb7f9547c18cb5a1724 == DB md5(content); no cache headers
+  timestamp: 2026-10-10T15:24Z
+
+- hypothesis: H3 variant — the Nitro swr cache is broken (background revalidation errors or hangs, so the entry never refreshes)
+  evidence: the first GET after expiry (15:24:01) triggered a refresh; the next GET (15:25:00) carried last-modified 15:24:01 and the new text; no `[cache] SWR handler error` in /var/log/supervisor/grzybyfunkcjonalne-nuxt.log
+  timestamp: 2026-10-10T15:25Z
+
+- hypothesis: H3 variant — an nginx proxy cache serves stale pages
+  evidence: sites-enabled/uat.grzybyfunkcjonalne.pl has no proxy_cache; the stale page reproduced against 127.0.0.1:3016 directly (bypassing nginx)
+  timestamp: 2026-10-10T15:24Z
+
+- hypothesis: H4 — the old text is rendered from somewhere else (hardcoded, another category, a post excerpt)
+  evidence: no match for the old phrase in the app, the layer, the deployed .output or any post column; it was only in category 2 content, and the refreshed render shows the new phrase
+  timestamp: 2026-10-10T15:29Z
+
+## Evidence
+
+- timestamp: 2026-10-10T15:22Z
+  checked: UAT DB, SELECT on golem15_journal_categories (all rows) and golem15_translate_* for category model types
+  found: category 2 (cordyceps) content md5 4053158bd1a58eb7f9547c18cb5a1724, length 13903, updated_at 15:00:27.940875 UTC, new phrase present, old phrase absent; no translation rows for categories
+  implication: the save persisted the edit in the only column the API reads; the stale copy is downstream of the DB
+
+- timestamp: 2026-10-10T15:23Z
+  checked: nginx site uat.grzybyfunkcjonalne.pl (sites-enabled) and the host Nuxt app nuxt.config.ts
+  found: nginx has no proxy_cache; `/` proxies to Nuxt on 127.0.0.1:3016. nuxt.config.ts routeRules `'/**': { swr: 300 }, '/blog/**': { swr: 120 }` (Nitro route cache on the Node server); category pages are at `/:category` (so /cordyceps falls under `/**` swr 300)
+  implication: Nitro's swr route cache is the only HTTP cache between the API and the browser
+
+- timestamp: 2026-10-10T15:24Z
+  checked: curl -D - http://127.0.0.1:3016/cordyceps on the UAT host (bypasses nginx/basic auth)
+  found: 200, `last-modified: Sat, 10 Oct 2026 14:59:08 GMT`, `cache-control: s-maxage=300, stale-while-revalidate`, body contains the OLD "Te grzyby, szczególnie Cordyceps sine"
+  implication: Nuxt serves a page rendered 79 s BEFORE the save, 25 min after it — far past the 300 s swr TTL. The cache entry is not being refreshed (H3 territory), or a refresh re-renders from stale data
+
+- timestamp: 2026-10-10T15:24Z
+  checked: vue-journal-layer app/journal-pages/CategoryPage.vue, app/utils/client.ts, app/composables/useJournalApi.ts and the host override sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/app/composables/useJournalApi.ts
+  found: the category page resolves the slug via GET /categories?include_empty=1 and renders found.content through sanitizeJournalHtml; the server fetcher is a plain $fetch to runtimeConfig.journal.apiBase with no cachedFunction/useStorage/getCachedData
+  implication: no data-level cache in the layer or app; the only cache is the Nitro route (swr) cache around the page renderer
+
+- timestamp: 2026-10-10T15:25Z
+  checked: second curl of http://127.0.0.1:3016/cordyceps on the UAT host, 59 s after the 15:24:01 request (also /, /blog, /lions-mane)
+  found: /cordyceps now `last-modified: Sat, 10 Oct 2026 15:24:01 GMT` and the body contains the NEW "Te grzyby, a szczególnie"; /lions-mane last-modified 12:40:55, / 14:37:04, /blog 12:40:53 (entries only move when visited after expiry)
+  implication: revalidation works; it is lazy. My 15:24:01 GET (first request after expiry) was served the stale page and triggered the background re-render; the next request got the fresh page. Nothing was broken in the render/refresh path at 15:24
+
+- timestamp: 2026-10-10T15:26Z
+  checked: nginx access log /var/log/nginx/grzybyfunkcjonalne-uat-access.log, 14:00–15:25 UTC, requests to /cordyceps and the categories admin API
+  found: 14:59:08 GET /cordyceps 200 13320 (the user's pre-edit view; cache entry mtime = 14:59:08, fresh until 15:04:08). PUT /gfadmin/api/v1/golem15/journal/categories/2 x7 at 14:59:48, 14:59:57, 15:00:06, 15:00:13, 15:00:16, 15:00:23, 15:00:27 (all 200). GET /cordyceps at 14:59:52, 14:59:53 (304), 14:59:54 (304), 14:59:55 (304), 15:00:00 x2, 15:00:07–15:00:09 x6, 15:00:30 — every one 200 13269 or 304 (same etag). No /cordyceps request between 15:00:30 and my 15:23:42 one
+  implication: every page view the user made after saving fell inside the 300 s fresh window of the entry rendered at 14:59:08, so Nitro returned it without even scheduling a revalidation; identical 13269-byte bodies and 304s confirm one cached entry was served throughout
+
+- timestamp: 2026-10-10T15:27Z
+  checked: deployed /srv/grzybyfunkcjonalne/nuxt/.output/server/chunks/nitro/nitro.mjs (defineCachedFunction get(), routeRules, storage mounts)
+  found: routeRules `/**` → `cache: { swr: true, maxAge: 300 }`, `/blog/**` → maxAge 120. get(): `expired = ... ttl && Date.now() - entry.mtime > ttl`; not expired → returns the entry, no resolve; expired + swr → returns the stale entry and re-renders in the background (event.waitUntil). Cache storage is the root in-memory driver (only `data` is mounted to fsLite). Nuxt log has no `[cache] SWR handler error`
+  implication: the observed behaviour is exactly Nitro swr semantics: an edit becomes visible only after the TTL has expired AND one request has triggered the re-render, i.e. on the second visit after expiry; worst case is unbounded in wall time for a page nobody visits, best case is ~300 s + one throwaway load
+
+- timestamp: 2026-10-10T15:28Z
+  checked: grep for purge/revalidate/invalidate/swr in sm-journal-plugin, vue-journal-layer, sm-grzybyfunkcjonalne-app; planning docs (16-CONTEXT D-07, DEPLOY.md, host README, 16.2-VERIFICATION)
+  found: no cache purge or invalidation hook anywhere (Go save path does not notify Nuxt; Nuxt exposes no purge route). Phase 16 D-07 chose swr deliberately ("a newly published post shows up without a rebuild"), TTLs were Claude's discretion; host README: "a newly published post appears within the TTL"; DEPLOY.md: "The Nuxt page caches (swr) expire by themselves." 16.2-VERIFICATION human item (line 39/211) and the UAT step say "the site shows the change" with no mention of the cache window
+  implication: the staleness is designed behaviour of the Phase 16 host app, not a 16.2 regression; the UAT step omitted the wait, and there is no editor-facing way to see an edit immediately
+
+- timestamp: 2026-10-10T15:29Z
+  checked: grep for "Te grzyby, szczeg" in the host app (app/, i18n/), vue-journal-layer (app/, i18n/), the deployed Nuxt .output, and golem15_journal_posts content/content_html/excerpt
+  found: no matches anywhere; the phrase exists only in category 2 content (now edited)
+  implication: H4 eliminated — the old text on the site came from the category content in the cached render
+
+## Resolution
+
+root_cause: "Not a 16.2 save defect. The save, the DB row and the Journal API all carry the edit. The host app's Nitro swr route cache (vue-grzybyfunkcjonalne-app nuxt.config.ts routeRules '/**': { swr: 300 }, deployed as cache { swr: true, maxAge: 300 }, in-memory) served /cordyceps rendered at 14:59:08 UTC. That render came from the user's own pre-edit view, 40 s before the first PUT (14:59:48). Every post-save view (14:59:52 to 15:00:30) fell inside the entry's 300 s fresh window (to 15:04:08), and Nitro returns an unexpired entry without revalidating. Nothing invalidates the entry on admin save: there is no purge hook in sm-journal-plugin, vue-journal-layer or the host app. After expiry, the first view still gets the stale copy and triggers the re-render, so an edit shows only on the second view more than 300 s after the last render. Contributing: the 16.2 UAT/VERIFICATION step 'the site shows the change' does not account for the Phase 16 D-07 swr window."
+fix: (not applied — goal find_root_cause_only)
+verification: "Observed self-healing without any write: 127.0.0.1:3016/cordyceps returned the old text at 15:24:01 UTC (last-modified 14:59:08) and the new 'Te grzyby, a szczególnie' at 15:25:00 (last-modified 15:24:01)"
+files_changed: []
+
+## Resolution
+
+Fixed by plan 16.2-07 (released as summercms v0.1.20 and vue-journal-layer v0.3.0) and confirmed on UAT on 2026-10-10. See 16.2-07-SUMMARY.md.

.planning/debug/resolved/postgres-gate-field-types-conformance.md

@@ -0,0 +1,156 @@
+---
+status: resolved
+trigger: "UAT gap G-16.2-1: bash scripts/check-phase16.2.sh postgres fails in ./modules/cabana: TestPhase10OpenAPIConformance: openapi_conformance_test.go:418: admin route GET /field-types has no conformance case"
+created: 2026-10-10T17:10:00+02:00
+updated: 2026-10-10T20:05:00+02:00
+goal: find_root_cause_only
+---
+
+## Current Focus
+
+hypothesis: CONFIRMED — the postgres stage is red for two code defects, both written in 16.2 and both hidden because the checks only run in Docker-only test binaries that never ran before UAT: (1) two 16.2 admin routes have no conformCase in TestPhase10OpenAPIConformance; (2) sm-journal-plugin TestJournalSVGEmbed still asserts post content `type: mlmarkdown` after 16.2-03 changed it to `mlblogeditor`.
+test: done — static diff, 3x direct repro, full cabana and Journal postgres-stage runs on this Docker host
+expecting: n/a
+next_action: return ROOT CAUSE FOUND (goal: find_root_cause_only); plan-phase --gaps owns the fix
+bug_class: Bohrbug (deterministic; Go map iteration only changes WHICH of the two missing keys line 418 reports first)
+reasoning_checkpoint:
+  hypothesis: "TestPhase10OpenAPIConformance fails because cabana.AdminAPIRoutes() (phase09Routes non-spa keys) has 56 entries and the conformCase list 54: GET /field-types and POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload, both added to the inventory in 16.2-01, have no case; once fixed, the same stage fails next on TestJournalSVGEmbed because it asserts `type: mlmarkdown` in models/post/fields.yaml, which 16.2-03 replaced with `type: mlblogeditor`."
+  confirming_evidence:
+    - "static diff of security_coverage_test.go phase09Routes vs conformCase keys: uncovered = [GET /field-types, POST .../fields/{field}/upload]; not-inventoried = []"
+    - "go test -count=3 -run '^TestPhase10OpenAPIConformance$' ./modules/cabana: FAIL 3/3, line 418 reports upload, field-types, upload"
+    - "Journal `go test -json -count=1 ./...` on this Docker host: only failure is TestJournalSVGEmbed, plugin_test.go:123 'post fields.yaml content is not mlmarkdown'; fields.yaml line 19 is `type: mlblogeditor` since fbd1c85"
+    - "cabana with -skip TestPhase10OpenAPIConformance: package PASS, 291 top-level tests, TestFieldTypeSavePostgres and TestListRelationSearchPostgres PASS with real Postgres queries in the output"
+  falsification_test: "If adding conformCases for exactly those two keys (and fixing the mlmarkdown assertion) still left the postgres stage red, or if the inventory/case diff showed a third key, the hypothesis would be incomplete."
+  fix_rationale: "Adding the two cases satisfies the exhaustiveness invariant and checks the real responses against admin.json (FieldTypesResponse, Envelope-cabana_FieldUploadResponse); updating the stale Journal assertion aligns it with the intended 16.2 field type. Separating the static inventory check from the Docker setup closes the masking path."
+  blind_spots: "The conformance cases themselves have not been written, so it is unverified that the fixture-backed responses decode cleanly with DisallowUnknownFields (e.g. FieldTypesResponse meta is `{}` from WriteData, which decodes into SuccessMeta; the upload case needs a conform plugin field type with Upload). Admin/editor/layer/docs stages were not re-run in this session."
+  candidate_causes:
+    - "code: missing conformCase entries for the two 16.2 routes (CONFIRMED)"
+    - "code: stale TestJournalSVGEmbed assertion vs the intended mlblogeditor change (CONFIRMED)"
+    - "environment: no Docker on the 16.2 execution host, so every testcontainers binary failed on docker.sock and was waved through as 'Docker-only' (CONFIRMED contributing)"
+    - "config/process: gate go stage FRAMEWORK_RUN omits TestPhase10OpenAPIConformance; the static inventory check runs after newConformEnv -> adminGorm; 16.2-01 PLAN/PATTERNS name phase09Routes + admin_openapi.go but not openapi_conformance_test.go (CONFIRMED contributing)"
+    - "data/environment: container start failure or flaky Postgres (ELIMINATED — containers start, 291 cabana + 66 Journal top-level tests pass)"
+  and_gate: "yes — the UAT failure needed the code defects AND the masking (static checks reachable only through testcontainers, no Docker during execution, go stage regex omits the test). Either code defect alone turns the stage red; the masking is why neither was caught before UAT."
+
+## Symptoms
+
+expected: `bash scripts/check-phase16.2.sh postgres` passes on a Docker host (cabana testcontainers suites incl. TestFieldTypeSavePostgres; Journal admin harness in ../sm-journal-plugin incl. TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, TestCategoriesAdminBlogEditor)
+actual: run 2026-10-10 16:57 CEST on a Docker host, the stage fails in ./modules/cabana: `--- FAIL: TestPhase10OpenAPIConformance` — `openapi_conformance_test.go:418: admin route GET /field-types has no conformance case`. The script stops there; the Journal Postgres suites never ran.
+errors: openapi_conformance_test.go:418: admin route GET /field-types has no conformance case
+reproduction: bash scripts/check-phase16.2.sh postgres (UAT Test 1)
+started: Phase 16.2 (GET /field-types added in 16.2; discovered during UAT)
+
+## Eliminated
+
+- hypothesis: the postgres stage fails because of Docker/testcontainers environment problems (container start, timeouts)
+  evidence: in the UAT log the cabana package ran 90s and only TestPhase10OpenAPIConformance failed; in this session cabana (skip conformance) passed 291 top-level tests in 77s and the Journal run passed every package but root, with real SQL in the logs
+  timestamp: 2026-10-10T17:21:00+02:00
+
+- hypothesis: only GET /field-types is missing a conformance case
+  evidence: the inventory/case diff shows POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload is uncovered too; `go test -count=3` reported the upload key in runs 1 and 3 and field-types in run 2
+  timestamp: 2026-10-10T17:24:00+02:00
+
+- hypothesis: the gap in the Journal suites is limited to the cabana abort (they would pass once cabana is green)
+  evidence: running the Journal stage command directly fails on TestJournalSVGEmbed (stale mlmarkdown assertion), which is in PG_JOURNAL_REQUIRE
+  timestamp: 2026-10-10T17:20:00+02:00
+
+## Evidence
+
+- timestamp: 2026-10-10T17:12:00+02:00
+  checked: .planning/debug/knowledge-base.md (Phase 0)
+  found: no knowledge base file exists; no prior pattern to test
+  implication: open-ended investigation
+
+- timestamp: 2026-10-10T17:13:00+02:00
+  checked: scratchpad/pg.log (UAT run of the postgres stage)
+  found: detect_go reports failed only "modules/cabana TestPhase10OpenAPIConformance" plus the package; openapi_conformance_test.go:418 "admin route GET /field-types has no conformance case"; package took 90s (containers started fine)
+  implication: the only failing cabana test in that run was the conformance test; run_postgres aborts (set -e) before the Journal go_json call
+
+- timestamp: 2026-10-10T17:15:00+02:00
+  checked: modules/cabana/openapi_conformance_test.go:129-450
+  found: TestPhase10OpenAPIConformance calls newConformEnv(t) FIRST (line 130), then builds the conformCase list, then requires covered == inventory where inventory = cabana.AdminAPIRoutes() (export_test.go: every non-spa phase09Routes key). Missing key -> t.Fatalf at line 418 inside a `for key := range inventory` map loop (random order, so only the first missing key found is reported).
+  implication: the exhaustiveness check is purely static but cannot run without a Postgres container
+
+- timestamp: 2026-10-10T17:16:00+02:00
+  checked: modules/cabana/auth_test.go:321-365 adminGorm
+  found: testing.Short() -> t.Skip; otherwise testcontainers postgres:16-alpine; a container error -> t.Fatalf("postgres: %v")
+  implication: on a host without Docker the conformance test fails at setup with a docker.sock error, masking the inventory check
+
+- timestamp: 2026-10-10T17:17:00+02:00
+  checked: grep of conformCase keys vs modules/cabana/security_coverage_test.go phase09Routes
+  found: TWO inventoried non-spa routes have no conformCase: "GET /field-types" (inventory line 46) and "POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload" (inventory line 92). `grep 'fields/{field}/upload\|/field-types' openapi_conformance_test.go` -> no match.
+  implication: fixing only GET /field-types would leave the test failing on the upload route next
+
+- timestamp: 2026-10-10T17:18:00+02:00
+  checked: git log -S on security_coverage_test.go and git log of openapi_conformance_test.go
+  found: GET /field-types entered the inventory in 717d46e (feat(16.2-01) compile, decode and load plugin field types), the upload route in 8fa92db (feat(16.2-01) ... uploads). openapi_conformance_test.go was last touched by 64d21c8/143eca5 (My account), b492e79 (markdown preview) — earlier route additions did add a conformCase in the same change; 16.2 did not.
+  implication: a convention ("new admin route => conformCase") that held before 16.2 was missed in 16.2-01
+
+- timestamp: 2026-10-10T17:19:00+02:00
+  checked: .planning/phases/16.2-*/ SUMMARY and VERIFICATION docs
+  found: no 16.2 plan mentions TestPhase10OpenAPIConformance; 16.2-01/03/05/06 SUMMARYs record "No Docker on this host (docker.sock permission denied)" and "the only failures ... are the testcontainers suites failing on docker.sock" — cabana is in that list. VERIFICATION marks the postgres stage "? SKIP (human item 1)".
+  implication: the conformance failure was hidden inside the blanket "Docker-only failure" bucket; nobody ran cabana's testcontainers suites before UAT
+
+- timestamp: 2026-10-10T17:20:00+02:00
+  checked: scripts/check-phase16.2.sh go stage
+  found: FRAMEWORK_RUN regex lists TestPhase09ContractInventory and TestPhase09PermissionMatrix (static, both pass: they compare the mount with phase09Routes and admin.json paths) but NOT TestPhase10OpenAPIConformance; the go stage runs with -run "$FRAMEWORK_RUN" so the conformance test never runs there. The postgres stage runs the whole ./modules/cabana package and is the only stage that reaches it.
+  implication: no non-Docker gate covers the inventory-vs-conformance-case invariant
+
+- timestamp: 2026-10-10T17:21:00+02:00
+  checked: admin/openapi/admin.json for both routes; modules/cabana/admin_openapi.go:264-276; field_type.go:834-871; contracts.go:245
+  found: GET /field-types 200 documents $ref cabana.FieldTypesResponse ({data: []cabana.FieldTypeAssets, meta: cabana.SuccessMeta}, all of name/element/translatable/scripts/styles required); the handler writes WriteData(200, []FieldTypeAssets, nil) => {"data":[...],"meta":{}}. POST .../fields/{field}/upload 201 documents cabana.Envelope-cabana_FieldUploadResponse ({data:{url}, meta}); multipart part named "file". conformPlugin (openapi_conformance_test.go:818-843) does NOT implement pact.HasFormFieldTypes and the gadget fields.yaml has no plugin-typed field.
+  implication: a GET /field-types case can decode into cabana.FieldTypesResponse with ref "cabana.FieldTypesResponse" today (empty list); a meaningful case and any upload case need the conform fixture to register a plugin field type (with Upload, scripts) and a gadget field of that type
+
+- timestamp: 2026-10-10T17:19:00+02:00
+  checked: route registrations added since 16.1/16.2 started (git diff 1ef21b0~1..HEAD of non-test modules/**/*.go in summercms.go; c60abc6..HEAD of non-test *.go in sm-journal-plugin)
+  found: summercms.go adds exactly two routes: g.Get("/field-types") and g.Post("/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload"). sm-journal-plugin adds none (editor uploads go through the cabana route).
+  implication: the conformance gap is exactly those two routes; no other 16.2 route is missing a case
+
+- timestamp: 2026-10-10T17:19:30+02:00
+  checked: ran the Journal postgres-stage command exactly as run_postgres does (`go test -json -count=1 -timeout 20m ./...` in ../sm-journal-plugin, which go.work/replace points at ../summercms.go) on this Docker host
+  found: packages classes, controllers, controllers/api, models, updates PASS; root package FAIL. Required tests: TestPostsFormCompiles PASS, TestPostsAdminCreateSmoke PASS, TestPostsAdminResaveKeepsHTML PASS, TestPostsAdminSaveSanitizesHTML PASS, TestCategoriesAdminContent PASS, TestCategoriesAdminBlogEditor PASS, TestJournalSVGEmbed FAIL — plugin_test.go:123 "post fields.yaml content is not mlmarkdown". 66 top-level tests passed, no skips, no "no tests to run".
+  implication: a SECOND, independent failure is queued behind the cabana one; fixing only the conformance case still leaves the postgres stage red
+
+- timestamp: 2026-10-10T17:20:00+02:00
+  checked: sm-journal-plugin plugin_test.go:118-124, models/post/fields.yaml, git show fbd1c85 / 47f3032
+  found: TestJournalSVGEmbed asserts strings.Contains(fields.yaml, "type: mlmarkdown") (a Phase 15 assertion). 16.2-03 commit fbd1c85 "feat(admin): post content on the Blog Editor field type" changed post content from `type: mlmarkdown` to `type: mlblogeditor` (+ htmlColumn, uploadFolder); no other post field is mlmarkdown. 47f3032 (16.2-02) extended the same test with bundle checks but did not touch the mlmarkdown assertion. The root package TestMain needs testcontainers, so the test never ran on the no-Docker 16.2 execution host (16.2-02-SUMMARY line 263/278/293).
+  implication: stale assertion contradicting an intended 16.2 change; same masking mechanism (Docker-only suite never executed before UAT)
+
+- timestamp: 2026-10-10T17:22:00+02:00
+  checked: static diff (python over security_coverage_test.go phase09Routes and the conformCase literal keys)
+  found: inventory non-spa 56, cases 54; uncovered = ['GET /field-types', 'POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload']; not inventoried = []
+  implication: exactly two cases are missing
+
+- timestamp: 2026-10-10T17:23:00+02:00
+  checked: cabana run on this Docker host: `go test -json -count=1 -timeout 15m -skip '^TestPhase10OpenAPIConformance$' ./modules/cabana`
+  found: package PASS (77s), 291 top-level tests passed, no fails, no skips, no "no tests to run". TestFieldTypeSavePostgres PASS (real SELECT ... FOR UPDATE on ft_notes in its output), TestListRelationSearchPostgres PASS, TestMLOpenAPIConformance PASS.
+  implication: TestPhase10OpenAPIConformance is the only cabana failure in the postgres stage
+
+- timestamp: 2026-10-10T17:24:00+02:00
+  checked: `go test -count=3 -timeout 10m -run '^TestPhase10OpenAPIConformance$' ./modules/cabana`
+  found: FAIL 3/3: run1 "POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload has no conformance case", run2 "GET /field-types has no conformance case", run3 upload again
+  implication: deterministic failure; which key is named depends on map iteration order
+
+- timestamp: 2026-10-10T17:25:00+02:00
+  checked: 16.2-01-PLAN.md tasks 2/3 and 16.2-PATTERNS.md line 24/109
+  found: both name admin_openapi.go + phase09Routes (+ check-admin-openapi.sh) as the places to register a new admin route; neither names openapi_conformance_test.go. Task automated verifies run only TestPhase09ContractInventory/TestPhase09PermissionMatrix (static), which pass.
+  implication: the route-registration checklist given to the executor was incomplete — the third location of the invariant was not in it
+
+- timestamp: 2026-10-10T17:26:00+02:00
+  checked: compileFieldTypes (field_type.go ~160-190), conformPlugin, admin.json schemas
+  found: a registered type needs an element under the plugin's widget tag prefix and, for scripts/styles, pact.AdminAssets with the files in AdminFS (conformPlugin already has AdminFS with js/css assets). FieldTypesResponse decodes {"data":[...],"meta":{}} (SuccessMeta all-omitempty). Upload 201 is Envelope-cabana_FieldUploadResponse with multipart part "file".
+  implication: fix-direction constraints for the plan (see Resolution)
+
+## Resolution
+
+root_cause: "(1) Phase 16.2-01 added GET /field-types (717d46e) and POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload (8fa92db) to the admin route inventory (phase09Routes) and admin.json but added no conformCase to TestPhase10OpenAPIConformance (modules/cabana/openapi_conformance_test.go), whose exhaustiveness check (line 416-419) fails on whichever of the two it meets first; (2) sm-journal-plugin TestJournalSVGEmbed (plugin_test.go:122-123, in PG_JOURNAL_REQUIRE) still asserts `type: mlmarkdown` in models/post/fields.yaml after 16.2-03 (fbd1c85) changed post content to `type: mlblogeditor`; (3) contributing: both checks are static but live in testcontainers-only binaries (newConformEnv -> adminGorm runs before the inventory check; the Journal root TestMain starts Postgres), the 16.2 execution host had no Docker and the summaries filed every cabana/Journal-root failure as docker.sock noise, check-phase16.2.sh's go-stage FRAMEWORK_RUN omits TestPhase10OpenAPIConformance, and the 16.2-01 PLAN/PATTERNS route checklist omitted openapi_conformance_test.go."
+fix: ""
+verification: ""
+files_changed: []
+suggested_fix_direction: |
+  - Add two conformCases. GET /field-types: status 200, ref "cabana.FieldTypesResponse", decode into[cabana.FieldTypesResponse](); register a plugin field type on the conform fixture (conformPlugin implements pact.HasFormFieldTypes; element under its widget tag prefix; a script already in conformFS) so the list is non-empty and the ?v= asset URL can be checked with assertPluginAsset. POST .../fields/{field}/upload: status 201, ref "cabana.Envelope-cabana_FieldUploadResponse", decode into[cabana.Envelope[cabana.FieldUploadResponse]](); a gadget fields.yaml field of that alias whose type has Upload, multipart part named "file", sent with requireAjax headers. Mind that a plugin-typed field on the gadget form also runs Decode/Load in the existing create/update/show cases — make them benign or give conformGadget a column for it.
+  - Fix TestJournalSVGEmbed to assert the intended `type: mlblogeditor` (optionally htmlColumn: content_html) for post content.
+  - Recurrence guard: split the static inventory check out of the Docker setup (e.g. move `env := newConformEnv(t)` after the coverage loop, or a package-level conformCaseKeys + a Docker-free TestPhase10ConformanceInventory) and add it to FRAMEWORK_RUN in check-phase16.2.sh (and later gates); add openapi_conformance_test.go to the "new admin route" checklist next to phase09Routes and admin_openapi.go.
+
+## Resolution
+
+Fixed by plan 16.2-07 (released as summercms v0.1.20 and vue-journal-layer v0.3.0) and confirmed on UAT on 2026-10-10. See 16.2-07-SUMMARY.md.

.planning/debug/resolved/user-logout-session-stays-valid.md

@@ -0,0 +1,81 @@
+---
+status: resolved
+trigger: "User plugin logout: auth cookies not invalidated at once; requests keep authenticating ~60 min until token expiry (todo 2026-10-22-user-logout-cookie-stays-valid)"
+created: 2026-10-22T00:00:00Z
+updated: 2026-10-22T00:00:00Z
+---
+
+## Current Focus
+
+bug_class: Bohrbug (deterministic)
+reasoning_checkpoint:
+  hypothesis: "Logout reads only the bearer header (cookie sessions get 401, nothing revoked, cookie kept, jwt guard accepts the cookie until exp = 60 min), never writes a forget cookie, and blacklists the jti only until the access exp (so /refresh revives a logged-out token after exp + sweep)"
+  confirming_evidence:
+    - "probe: cookie-only logout 401, then GET /tokens with the cookie 200"
+    - "probe: jwt_blacklist.expires_at == exp; after the sweep, /refresh of the logged-out token 200"
+    - "bearer logout already refuses the bearer at once (guard checks blacklist) - so server-side check exists; the gap is what logout revokes and for how long"
+  falsification_test: "if cookie-only logout after the fix still leaves GET /tokens 200, or /refresh after the sweep still 200, hypothesis/fix wrong"
+  fix_rationale: "read the token exactly as the jwt guard does, revoke it (and any other session token the request carries) until the refresh window closes, accept an expired-but-refreshable token like cabana does, and expire the session cookies with auth.cookie attributes"
+  blind_spots: "demo frontend never calls /logout (app-side, not fixable here); auth_token cookie is frontend-owned, its real attributes unknown (forget uses auth.cookie path/domain)"
+  candidate_causes:
+    - "code: Logout bearer-only extraction + exp-only blacklist expiry"
+    - "config: blacklist store not published (no DB) -> no revocation; ruled out, Boot publishes PostgresBlacklist when *sql.DB/*gorm.DB exist and bearer logout works"
+    - "environment/frontend: demo frontend logout only clears its own cookie and never calls /logout"
+  and_gate: "no for the cookie case (extraction alone suffices); the refresh revival is an independent second defect"
+next_action: human verification in a real app (cookie-only logout, then a jwt.auth request with the old cookie must be 401); after confirmation archive to resolved/ and add the KB entry
+
+## Symptoms
+
+expected: after POST /_user/api/v1/logout the old token/cookie is refused (401) on the next request, and the cookies are cleared
+actual: requests keep authenticating for about 60 minutes, until the token expires
+errors: none
+reproduction: login, logout, repeat an authenticated request with the old cookie or token
+started: reported 2026-10-22
+
+## Eliminated
+
+## Evidence
+
+- timestamp: 2026-10-22
+  checked: bouncer jwtGuard.Authenticate (summercms.go modules/bouncer/jwt.go)
+  found: access JWTs are checked for HS256 signature, exp, audience, the subject user (GormUsers.FindByID), the jti blacklist (BlacklistStore) and users.tokens_valid_after; token taken from bearer first, then cookies "token", "auth_token" (plugin.go Boot)
+  implication: server-side revocation exists (jwt_blacklist); a blacklisted jti is refused on the next request
+- timestamp: 2026-10-22
+  checked: controllers.Logout (api_controller.go)
+  found: reads bearerToken(r) only (Authorization header); no cookie fallback; never writes a Set-Cookie; blacklists with Add(jti, exp, now) i.e. storage expiry = access exp
+  implication: cookie-only logout => 401, nothing revoked, cookie kept; blacklist row is dropped after exp although the refresh window (20160 min) is still open
+- timestamp: 2026-10-22
+  checked: sociallogin writeSession (token_cookie: true) and bouncer.CookieConfig.TokenCookie
+  found: sets httpOnly `token` cookie (auth.cookie.* name/path/domain/samesite, Max-Age = refresh_ttl) and leaves token out of the body, so the browser cannot send a bearer header
+  implication: such a frontend can only log out with the cookie => H1 path
+- timestamp: 2026-10-22
+  checked: bouncer.refreshAudience comment and blacklist storage expiry
+  found: Refresh stores the old jti until max(exp, iat+refreshTTL)+1min precisely so "a logged-out token cannot be refreshed again"; Logout does not
+  implication: H2 plausible
+- timestamp: 2026-10-22
+  checked: PHP ApiController::logout + AuthManager::logout(true)
+  found: token from Bearer or jwt_token param; JWTAuth::invalidate(forceForever=true) => blacklisted forever; body {"message":"Logged out"}
+  implication: Go logout should keep the jti blocked at least for the refresh window
+
+- timestamp: 2026-10-22
+  checked: cabana admin logout (summercms.go modules/cabana/auth.go logout)
+  found: framework reference: always expires the cookie, reads bearer then cookie, VerifyRefreshableClaimsAudience, blacklists until max(exp, iat+refreshTTL)+1min
+  implication: the plugin's logout lags the framework's own pattern
+- timestamp: 2026-10-22
+  checked: Docker probe through the assembled router (newAdminEnv), pre-fix
+  found: (A) cookie-only POST /logout -> 401 {"error":true,"message":"Unauthorized"}, no Set-Cookie; GET /tokens (jwt.auth) with the same cookie afterwards -> 200; token exp-iat = 1h0m0s. (B) bearer logout -> 200 and the bearer is refused at once (401), but jwt_blacklist.expires_at == token exp; the sweep after exp deletes the row and POST /refresh with the logged-out token -> 200 with a fresh token
+  implication: H1 and H2 CONFIRMED. New test logout_test.go fails 7/8 subtests pre-fix (bearer passes)
+
+## Resolution
+
+root_cause: "controllers.Logout read the token only from the Authorization bearer header, although the jwt guard (and RequestUser) also accept the token/auth_token cookies: a cookie-carried session (e.g. the httpOnly token cookie sociallogin token_cookie sets) got 401 at /logout, nothing was blacklisted and no cookie was cleared, so the cookie kept authenticating jwt.auth routes until exp (golem15.user.jwt.ttl, 60 min). Logout also never wrote a forget cookie; and it (and EndRequestSession) kept the jwt_blacklist row only until the access exp, so after the sweep /refresh revived a logged-out token for the rest of the 20160-min refresh window."
+fix: "classes.EndSession (new export): revokes every session JWT the request carries (bearer, token, auth_token) that verifies - unexpired, or user-audience within its refresh window - until max(exp, iat+refresh_ttl)+1m; always writes the auth.cookie forget cookie plus forgets for other carried session cookies with the same attributes; returns the guard-order subject. Logout uses it (responses unchanged: 200 Logged out / 401 Unauthorized / 500); EndRequestSession is now its best-effort wrapper."
+verification:
+  target_test: { result: pass, test: "logout_test.go TestLogoutEndsTheSession (10 subtests); TestEndRequestSession updated" }
+  mutation_check: { result: pass, reason_if_skipped: "no Stryker for Go - manual mutants", mutant_killed: "7/7 (expiry-at-exp, bearer-only, no-forget, no-refreshable-verify, primary-only revoke, config-cookie-only forget, no legacy fallback)" }
+  no_op_deletion: { result: pass, deletion_justified_by_rca: true }
+  adjacent_tests: { result: pass, suites_run: ["sm-user-plugin go test ./... (Docker, all ok)", "sm-demo-app workspace: oauthserver + sociallogin go test (only TestClientRegistry/verify_secret and TestPHPMethodMap fail: they read ../summercms.go and ../fonoteka.go paths that exist only in the plugins' own repo layout; unrelated to the change)"] }
+  revert_and_reconfirm: { result: pass, bug_returned_on_revert: true, fixed_on_reapply: true }
+  guardrail_verdict: accepted
+  commit: 358ee5d (sm-user-plugin, unpushed)
+files_changed: [classes/session_user.go, controllers/api_controller.go, session_user_test.go, logout_test.go, README.md]

.planning/notes/2026-10-11-framework-html-sanitizer-bluemonday.md

@@ -0,0 +1,32 @@
+# Decision: bluemonday sanitizes the framework richeditor field
+
+**Date:** 2026-10-11
+**Status:** Accepted (Phase 17 plan 01, D-10)
+**Relates to:** `.planning/notes/journal-html-sanitizing-bluemonday.md` (the Journal plugin's policy, which this one ports)
+
+## Decision
+
+The framework module `git.golem15.com/golem15/summercms` adds `github.com/microcosm-cc/bluemonday` **v1.0.27** to its `go.mod`. It is the same library and the same version `sm-journal-plugin` already uses (latest tag, 2024-07-04, confirmed with `go list -m -json github.com/microcosm-cc/bluemonday@latest`). `go.sum` is committed with it.
+
+A new framework module, `seaglass` (glass the sea has worn smooth), owns the policy:
+
+- `seaglass.Sanitize`, `seaglass.SanitizeReport` and `seaglass.Check` port Journal's `newHTMLPolicy` / `SanitizeHTMLReport` / `CheckHTML`: bluemonday's UGC policy with `RequireNoFollowOnLinks(false)`, the link scheme allowlist (http, https, mailto, tel and relative URLs) and Journal's extra attributes.
+- The four Blog Editor rules (`figure data-embed`, `figure data-id`, free-text `img alt`, `ol start`) are **not** ported: they describe one plugin's editor output, and the framework must not import or mirror a plugin. A plugin that needs more keeps its own policy, as Journal does.
+- The byte-stable comparison is kept: when the input and bluemonday's output tokenize (with `golang.org/x/net/html`, already a framework dependency) to the same tokens, the input is returned byte for byte and nothing is reported, so re-escaping alone never rewrites stored HTML. A repeated attribute always counts as a change.
+- `SanitizeReport` returns what was removed (element names, attribute names, comment count, a Changed flag), which cabana turns into `meta.notices` on the field.
+
+cabana's core `type: richeditor` field (FAQ descriptions, repeater answers) sanitizes every submitted value through `seaglass.SanitizeReport` on create and update, top level and inside repeater rows. Settings and relation forms refuse the type at boot, so no save path bypasses the gate.
+
+## Why not cabana's markdown gate
+
+`cabana.RenderMarkdown` checks goldmark output with three regexes (unsafe tags, `on*=` attributes, dangerous schemes). It only works there because goldmark renders without unsafe HTML, so raw HTML never reaches the check. A richeditor stores raw HTML. The Journal decision note lists real bypasses of exactly that regex style: `<img src="x"onerror=…>`, `<svg/onload=…>`, `javascript&#58;`, `javascript&colon;`, `&#106;avascript:`, MathML `xlink:href`, `<base>`, `<meta http-equiv=refresh>`, `<form>`. A tokenizing sanitizer checks attributes and URL values the way a browser parses them. The project prefers a maintained library for security code over a hand-built gate (the Journal note also rejected a hand-built allowlist on `golang.org/x/net/html`).
+
+## Deviation from D-10: Journal category content stays blogeditor
+
+D-10 also said "Journal's category `content` switches from `textarea` to `richeditor`". Phase 16.2 already shipped the Journal Blog Editor (`type: blogeditor`) for category content and closed the `cabana-richeditor-field-type` todo (RESEARCH A1, PATTERNS note). Switching it would regress that editor. This clause is recorded as a resolved deviation: Journal category content stays `blogeditor`; the framework richeditor serves the FAQ description and the repeater answer only.
+
+## Consequences
+
+- One sanitizer version across the workspace (framework and Journal both pin v1.0.27); a future bump changes both together.
+- Imported PHP HTML that the policy keeps whole round-trips byte for byte on its next admin save; HTML the policy changes is stored sanitized and the editor sees what was removed.
+- `modules/seaglass/README.md` names bluemonday under Dependencies; the root README lists the module.

.planning/notes/2026-10-12-admin-display-sanitizer-dompurify.md

@@ -0,0 +1,61 @@
+# Decision: DOMPurify sanitizes the admin richeditor read-only display
+
+**Date:** 2026-10-12
+**Status:** Accepted (quick task 261012-s3g, closes T-10-16 / T-17-10)
+**Relates to:** `.planning/notes/2026-10-11-framework-html-sanitizer-bluemonday.md` (the server-side gate on every richeditor save), `.planning/phases/10-admin-vue-spa/10-SECURITY.md`
+
+## Decision
+
+The admin SPA (`admin/package.json`) adds three npm packages, each with an exact pin and the committed `package-lock.json`:
+
+| Package | Version | Kind | Use |
+|---------|---------|------|-----|
+| `dompurify` | 3.4.16 | runtime dependency | sanitizes the richeditor read-only display (`displayHtml` in `admin/src/components/form/richeditor/html.ts`) |
+| `@vitest/browser` | 3.2.7 | devDependency | Vitest browser mode, matching the installed vitest 3.2.7 exactly (its peerDependency) |
+| `playwright` | 1.60.0 | devDependency | the browser-mode provider (Chromium) |
+
+The browser suite runs as `npm --prefix admin run test:browser` from `admin/vitest.browser.config.ts` and covers `admin/tests/browser/**/*.test.ts`. The happy-dom suite (`npm --prefix admin test`) excludes `tests/browser`.
+
+`displayHtml` uses a dedicated DOMPurify instance (`DOMPurify(window)`, so the hook is not global) with one frozen config:
+
+- `ALLOWED_TAGS`: the editor's elements, `EDITOR_TAGS` from `lossy.ts`;
+- `ALLOWED_ATTR`: `['href']`; `ALLOW_DATA_ATTR` and `ALLOW_ARIA_ATTR` false;
+- an `uponSanitizeAttribute` hook that keeps `href` only on `<a>` and only when `isAllowedLink` accepts it (http, https, mailto, tel or a relative URL);
+- `ADD_FORBID_CONTENTS`: the former `DROPPED` list (script, style, template, noscript, iframe, frame, frameset, object, embed, applet, svg, math, title, head, meta, link, base), so those elements go with their content;
+- `KEEP_CONTENT` true: any other element is unwrapped and keeps its text;
+- string input and string output (`RETURN_TRUSTED_TYPE` false); never `RETURN_DOM`, `RETURN_DOM_FRAGMENT` or `IN_PLACE`. DOMPurify parses the string with `DOMParser` into an inert document, so nothing is adopted into the live document and no image request starts while sanitizing.
+
+`displayHtml` fails closed: it returns the empty string unless DOMPurify reports `isSupported` and a fixed canary (`<p onclick="x"><b>a</b><script>b</script><a href="javascript:c">d</a></p>`) sanitizes to exactly `<p><b>a</b><a>d</a></p>`. The stored value is never bound.
+
+## Why
+
+- **The hand-rolled walker was bypassable.** `clean()` read `nodeType`, `localName`, `childNodes` and `attributes` from each element. A `<form>` holding `<input name="nodeType">` (or `name="localName"`, or an `img`/`button` named that way) clobbers those properties, so the walker skipped the form and everything inside it, including an `<img onerror>`, and the result was bound with a raw-HTML directive at `RichEditorField.vue:305`.
+- **Maintained library for security code.** The project prefers a maintained sanitizer over a hand-built one (bluemonday on the server, the Journal note's rejection of a hand-built allowlist). DOMPurify is the de-facto browser sanitizer, has explicit DOM-clobbering checks (`_isClobbered`, removal of clobbered forms before attributes are visited) and reads node properties through prototype getters captured at load, not through the element itself.
+- **happy-dom cannot test it.** happy-dom does not reproduce form-control clobbering, and under happy-dom 20.11.6 DOMPurify reports `isSupported` true yet visits only top-level nodes: `<section><p class="x">a</p></section><script>b</script>` comes back as `<p class="x">a</p><script>b</script>`. Hence the canary (fail closed where the walker is not faithful) and a regression suite in a real engine.
+
+## Scope vs Phase 10 D-23
+
+Playwright is used only as the Vitest browser-mode provider, for unit-level tests that need a real engine. It does not implement the deferred Playwright end-to-end follow-up recorded in `10-CONTEXT.md` (D-23); that stays deferred.
+
+## Legitimacy
+
+Re-checked on 2026-10-12 before install, matching the planning-time table:
+
+| Package | Version | Check | Result |
+|---------|---------|-------|--------|
+| dompurify | 3.4.16 | `npm view dompurify@3.4.16 dist.integrity maintainers repository.url` | integrity `sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==`; maintainer `cure53 <mario@cure53.de>` (sole maintainer since the start); repo `github.com/cure53/DOMPurify`; license `(MPL-2.0 OR Apache-2.0)`; one dependency `@types/trusted-types ^2.0.7`; released 2026-09-23 |
+| @vitest/browser | 3.2.7 | `npm view @vitest/browser@3.2.7 maintainers peerDependencies` | maintainers ariperkkio, antfu, hiogawa, oreanno, yyx990803 (vitest-dev); repo `github.com/vitest-dev/vitest`; peer `vitest: 3.2.7`, `playwright: *`; released 2026-07-06 |
+| playwright | 1.60.0 | `npm view playwright@1.60.0 maintainers dependencies` | maintainers pavelfeldman, yurys, dgozman-ms, playwright-bot (Microsoft); repo `github.com/microsoft/playwright`; one dependency `playwright-core 1.60.0`; released 2026-05-11 |
+
+The lockfile's dompurify integrity must equal the value above; `npm ci` installs from the committed lockfile.
+
+## Version choice
+
+3.4.17 is the latest release, but it was published on 2026-10-12, hours before this decision. Its release notes list `IN_PLACE` and hook fixes and edge-case hardening, with no security advisory. 3.4.16 is pinned under a 7-day release cooldown. Bump to 3.4.17 or later after 2026-10-19.
+
+## Consequences
+
+- The read-only display drops the content of DOMPurify's default content-forbidden elements (thead, colgroup, audio, video and others) on top of the `DROPPED` list. The editor itself never produces them.
+- happy-dom tests can no longer assert exact display output: `displayHtml` returns the empty string there. Exact assertions live in `admin/tests/browser/richeditor-display.test.ts`.
+- The browser suite needs the Playwright Chromium build on the machine (`npx --prefix admin playwright install chromium` once).
+- The committed admin dist grows by the DOMPurify bundle; the only URL literal it adds is `http://www.w3.org`, which the dist-origin rule already allows.

.planning/notes/2026-10-13-paymentgateway-hashids-go-hashids.md

@@ -0,0 +1,26 @@
+# Decision: go-hashids for the payment gateway hash ids
+
+**Date:** 2026-10-13
+**Status:** Accepted
+**Context:** Phase 18 plan 02 (`sm-paymentgateway-plugin`), 18-RESEARCH.md Standard Stack and assumption A3
+
+## Decision
+
+`sm-paymentgateway-plugin` depends on `github.com/speps/go-hashids/v2` at **v2.0.1** for the order `hash_id` (length 8) and `guest_code` (length 32, over `id * 118`) columns.
+
+- The PHP plugin generates both with `hashids/hashids` 5.0.2 over the alphabet `abcdefghijklmnopqrstuvwyzABCDEFGHIJKLMNOPQRSTUVWYZ1234567890`, the configured salt (`PG_HASHIDS_SALT`) and, decode-only, the legacy salt `KEIOS.PAYMENTGATEWAY`. Existing rows in every consuming application carry these values and the frontends look orders up by them, so the Go encoder has to be byte-identical.
+- The research probe ran go-hashids v2.0.1 against PHP hashids 5.0.2 on 24 vectors (custom alphabet, both salts, lengths 8 and 32): 24/24 match.
+- A hand-rolled encoder was rejected: Hashids has alphabet shuffles, separators and guards with many edge cases, and a mismatch would silently break every stored id.
+- The library is MIT, 1.4k stars, not archived; its last release (2021-05) predates nothing the plugin needs, the algorithm is frozen. It has no dependencies of its own.
+
+The salt is the config key `golem15.paymentgateway.hashids_salt` (`SUMMER_GOLEM15__PAYMENTGATEWAY__HASHIDS_SALT`); an empty salt fails boot (PG-005). Decoding tries the configured salt, then the legacy salt.
+
+## Related dependencies
+
+- `github.com/stripe/stripe-go/v87` v87.0.0 is already decided by D-12 (18-CONTEXT.md) for `sm-pgstripe-plugin`; this note does not add it to the payment gateway plugin.
+- `github.com/shopspring/decimal` is an indirect dependency of stripe-go. It appears in `go.sum` of `sm-pgstripe-plugin` and is **never used for money**: the payment gateway's `money` package is a hand-ported MoneyRight value type (int64 scaled by 10^4) covered by the PHP vectors.
+
+## Consequences
+
+- `sm-paymentgateway-plugin/go.mod` requires `github.com/speps/go-hashids/v2 v2.0.1`; `support/hashids.go` is the only importer.
+- A later change of the hashids library needs a new vector run against PHP before it ships.

.planning/notes/2026-10-15-cooler-go-redis-otter.md

@@ -0,0 +1,34 @@
+# Decision: go-redis v9 and otter v2 for cooler
+
+**Date:** 2026-10-15
+**Status:** Accepted
+**Context:** Phase 19.3 (`cooler` module, D-06..D-09, D-13), 19.3-RESEARCH.md Standard Stack and Package Legitimacy Audit
+
+## Decision
+
+The new `cooler` module (cache drivers, the Redis-backed rate-limit store, later the site-cache purge) depends on:
+
+- **`github.com/redis/go-redis/v9` at v9.23.0** as the Redis client (locked by D-07).
+  - The official Redis client for Go, MIT/BSD, maintained by Redis.
+  - `redis.ParseURL` reads `redis://`, `rediss://` (TLS) and `unix://` URLs, so the one config key `redis.url` covers local, managed and socket setups.
+  - `redis.NewScript` with `Script.Run` sends EVALSHA and falls back to EVAL on NOSCRIPT, which the atomic fixed-window rate-limit script needs.
+  - `redis.NewClient` does not dial; the first command does. `cooler.FromApp` relies on this to give jobs and console commands a cache without a connection at construction.
+  - cooler sets `DisableIdentity` and disables maintenance notifications, so the client sends no `CLIENT SETINFO` or `CLIENT MAINT_NOTIFICATIONS` handshake to servers that do not know them.
+- **`github.com/maypok86/otter/v2` at v2.3.0** as the in-process memory cache driver (D-07 discretion: otter or a stdlib map).
+  - Bounded size (`MaximumSize`), per-entry expiry (`ExpiryCalculator`), lock-scoped `Compute` for an atomic `Increment`, an injectable clock for tests. No runtime dependencies (its go.mod requires only testify, for its own tests).
+  - Already named for `cooler` in `.planning/research/ARCHITECTURE.md` and `.planning/research/go-ecosystem.md`.
+  - **A stdlib map was rejected:** a map with a mutex and a sweeper is about a hundred lines, but it is unbounded. Cache keys often derive from request data (`user:<id>`, a client IP), so the map grows without limit; bounding it means writing an LRU by hand, which is exactly what otter already does well.
+
+Both versions were checked on proxy.golang.org during research (existence, publish time, VCS origin `github.com/redis/go-redis` and `github.com/maypok86/otter`).
+
+## Related dependencies
+
+- **`github.com/alicebob/miniredis/v2` v2.40.0, test-only.** An in-process Redis for the `-short` unit tests of cooler (EVAL/EVALSHA, PTTL, INCRBY, SCAN, UNLINK, `FastForward` for TTLs). The package name came from training knowledge, so it is installed only in plan 05, after a blocking human check of the package. Production code never imports it.
+- **`gocloud.dev/blob/s3blob`**, from the already required `gocloud.dev` v0.46.0. Plan 03 imports it only from a file under the `summercms_s3` build tag, so binaries built without the tag carry no S3 code. The import adds the AWS SDK v2 modules to `go.mod` and `go.sum` as indirect requirements.
+- **Docker-backed Redis tests** use the generic `testcontainers.Run` with the `redis:7-alpine` image from the already required `github.com/testcontainers/testcontainers-go`. No testcontainers Redis sub-module is added.
+
+## Consequences
+
+- `go.mod` requires `github.com/redis/go-redis/v9 v9.23.0` and `github.com/maypok86/otter/v2 v2.3.0`; `modules/cooler` is the only importer of both. `surf` imports `cooler`, never go-redis directly.
+- Config keys introduced with them: `redis.url`, `cache.driver` (`memory`|`redis`), `cache.prefix`, `cache.memory.max_entries`, `http.rate_limit.store` (`memory`|`redis`). Apps and deploy docs depend on these once they ship.
+- Replacing the Redis client later means re-validating the rate-limit Lua script and the key layout (`<prefix>cache:`, `<prefix>rl:`) against the new client.

.planning/notes/2026-10-15-release-v0-2-0.md

@@ -0,0 +1,21 @@
+# Release the 19.3 gap closure as v0.2.0, not v0.1.28
+
+**Date:** 2026-10-15
+**Decision:** The next framework tag after v0.1.27 is **v0.2.0**.
+
+## Why
+
+The 19.3-06 review fixes include changes that can make an app that boots on v0.1.27 refuse to boot after the upgrade:
+
+- WR-05: in production, a token cookie whose `Secure` is inferred as false (http or empty `app.url`) is refused at boot.
+- WR-04: credentialed CORS refuses wildcard-host and unanchored origin patterns at boot.
+
+Smaller behaviour changes ride along: site-cache purges run queued after commit (WR-01), protected uploads into a `public_url` bucket are refused (WR-07), Journal's old purge keys are deprecated aliases.
+
+In a v0.x Go module the minor version is the signal for "check your config before upgrading". Consumers pin exact versions, so the bump costs nothing technically.
+
+## Consequences
+
+- Plugins and apps move with `go get git.golem15.com/golem15/summercms@v0.2.0`.
+- The docs and the release notes carry an "Upgrading to 0.2" section naming the two boot refusals and the config that fixes each.
+- From here, the minor version is bumped when an upgrade can refuse a previously valid config or changes a documented behaviour; patch versions stay safe to take without reading.

.planning/notes/2026-10-17-generic-mcp-module.md

@@ -0,0 +1,38 @@
+---
+title: Generic MCP module for SummerCMS applications
+date: 2026-10-17
+context: /msd-explore session. Agents already drive applications (for example a quiz/presentation app) through plugin management APIs with personal tokens; an MCP surface would be smoother. Records the shape agreed before Phase 19.7 is planned.
+---
+
+# Generic MCP module for SummerCMS applications
+
+## Starting point
+
+- Agents mostly call plugin-specific management routes (`user.api_token` + `user.scope:*` + `user.permission:<code>`), not cabana's generic admin CRUD. Generating tools from `fields.yaml` therefore does not cover the use case.
+- The route table (`pact.Router`) holds only method, path, handler and middleware names. From that alone the token-accepting routes, read or write (scope middleware or method), path parameters and the required permission code can be derived. Descriptions, request body shapes and response meaning cannot.
+- `surf.APIDocsProvider` (one OpenAPI document per application) does not fit applications assembled from plugins in several repositories.
+
+## Decisions
+
+1. **In-binary, opt-in module.** A new framework module (beach name to pick) mounts an MCP endpoint (for example `/mcp`) when enabled in config, in the same way `http.api_docs.enabled` mounts `/api-docs`. Disabled by default; an application without it is unaffected.
+2. **Plugins declare their tools.** A new optional `pact` capability, the counterpart of WinterCMS `registerMcpTools()` in `Plugin.php`: each tool has a name, a description, an input Go struct (its JSON schema is reflected) and the route it maps to. A plugin that declares nothing exposes nothing. A shared plugin carries its tools into every application that mounts it.
+3. **Each tool declares its guard** (`user` for sm-user-plugin principals, `backend` for cabana principals) and inherits the permission requirements of its route.
+4. **`tools/list` is computed per principal.** A tool is offered only when the principal passes the route's checks: `user.scope:*` and `user.permission:<code>` through `MergedPermissions` / `HasPermission` for frontend users, `cabana.Allows` with the token's scope limit for backend users. The user's own tri-state permissions (allow / inherit / deny, already supported by the `permissioneditor` radio mode) therefore shape the tool list with no new permission system.
+5. **One person, one connector.** The editor adds the site's MCP URL as a connector and signs in once through `wristband` OAuth as their frontend user. If that frontend user has a verified link to a `backend_users` row, the grant also carries that backend principal, and backend-guarded tools (Journal) run as it. `tools/list` is the union of what both identities allow; a person without a link sees no backend tools.
+6. **Journal stays on `backend_users`.** Authors remain backend users; moving them to frontend users would break a core plugin. The account link bridges the two instead.
+
+## The account link must prove ownership
+
+An admin picking any frontend user in My Profile would let that admin act through MCP as someone else. The link is therefore saved only after the frontend account signs in (My Profile → "Link frontend account" → site sign-in). A superuser can set or remove links on the Users screen behind a new backend permission, for onboarding editors. Revoking the link or the OAuth grant removes the backend tools. Never link by matching email.
+
+## Prerequisites (todos)
+
+- Plugins register their frontend permission codes in Go (`.planning/todos/pending/2026-10-17-plugin-registered-frontend-permissions.md`).
+- Verified frontend ↔ backend account link (`.planning/todos/pending/2026-10-17-frontend-backend-account-link.md`).
+
+## Open for Phase 19.7 discussion
+
+- Transport (streamable HTTP) and whether to take the MCP Go SDK as a dependency; it needs a decision note naming it and its version (CLAUDE.md dependency rule). Unresolved: not researched in this session.
+- How a tool call reaches its handler: an in-process request through the surf router with the resolved principal, so the route's own middleware (throttles, scope, permission) still runs, rather than calling the handler directly.
+- Whether plain personal tokens (user `user_api_tokens`, cabana `g15_…`) may also open an MCP session for single-identity agents, next to OAuth.
+- Tool naming across plugins (prefix by plugin code to avoid collisions) and how a tool describes its response.

.planning/notes/2026-10-18-bluemonday-forum-policy.md

@@ -0,0 +1,32 @@
+# Decision: named bluemonday forum policy (not richeditor UGC)
+
+**Date:** 2026-10-18
+**Status:** Accepted
+**Context:** Phase 19.1 plan 02 (D-16, D-17, D-18), 19.1-RESEARCH.md Pitfall 5 and Pitfall 6
+
+## Decision
+
+Forum sanitizing uses `github.com/microcosm-cc/bluemonday` **v1.0.27**, already required by the framework `go.mod` (seaglass / richeditor, `.planning/notes/2026-10-11-framework-html-sanitizer-bluemonday.md`). This note does **not** add the library again. `sm-forum-plugin` must not `require` bluemonday or goldmark.
+
+The policy is a **named forum policy**, not seaglass's richeditor UGC policy. It matches the PHP HTMLPurifier config 1:1 (`golem15/forum` `MarkdownRenderer`):
+
+- `AllowElements` of the PHP list: `p`, `br`, `strong`, `em`, `b`, `i`, `h1`–`h6`, `ul`, `ol`, `li`, `blockquote`, `pre`, `code`, `a` with `href`/`rel`/`target`, `table`, `thead`, `tbody`, `tr`, `th`, `td`, `hr`, `del`, `ins`, `sub`, `sup`. No `img`, no `figure`, no extra UGC tags.
+- `AllowURLSchemes("http", "https", "mailto")` only. Not `tel:`, and not the extra relative/tel allowances seaglass adds on top of `UGCPolicy`.
+- `RequireNoFollowOnLinks(true)` — PHP `HTML.Nofollow` true. seaglass sets this **false**.
+- `AddTargetBlankToFullyQualifiedLinks(true)` — PHP `HTML.TargetBlank` true.
+
+Markdown conversion uses `github.com/yuin/goldmark` **v1.8.6**, already a framework dependency, with GFM (`extension.GFM`: tables, strikethrough, autolinks). Analog of PHP `GithubFlavoredMarkdownConverter` with `html_input=strip` and `allow_unsafe_links=false`. Raw HTML in markdown input is stripped; unsafe schemes never become links.
+
+**D-17 owns `Render(markdown)` and `Purify(html)`.** A small `summercms.go` module (or an extension of cabana's markdown support; the `/msd-quick` task decides the package) exports those two funcs with this named policy. Forum, and later Wavepath `purify()` callers (trainings), import that module. Forum does not grow a local renderer, does not call `cabana.RenderMarkdown` (regex gate, no GFM tables, wrong policy), and does not import `seaglass` for post HTML.
+
+## Related dependencies
+
+- **seaglass / 2026-10-11 note:** bluemonday UGC for stored richeditor HTML (`RequireNoFollowOnLinks(false)`, `tel:`, images and extra attributes). Forum posts must not use that policy.
+- **`cabana.RenderMarkdown`:** goldmark without GFM plus three regexes. Pitfall 6: it is the wrong gate for forum; D-17 is the gate.
+- **goldmark GFM** is already used in-tree (`internal/docsite/render.go`). No new markdown library.
+
+## Consequences
+
+- Framework `go.mod` keeps the existing pins: `github.com/microcosm-cc/bluemonday v1.0.27` and `github.com/yuin/goldmark v1.8.6`. Forum's `go.mod` never requires either.
+- D-17 `Render` runs goldmark GFM then the named forum policy; `Purify` runs the policy on already-HTML. New and edited posts store `content_html` on write (D-18); adopted rows are served stored.
+- If D-17 has not landed (`func Render(` / `func Purify(` absent under `modules/`, excluding `cabana.RenderMarkdown`), forum execution **blocks**. It does not vendor the libraries and does not substitute seaglass or a local `forum/classes/markdown.go`.

.planning/notes/2026-10-18-livekit-server-sdk-go.md

@@ -0,0 +1,30 @@
+# Decision: livekit/server-sdk-go/v2 for Chat video RoomService
+
+**Date:** 2026-10-18
+**Status:** Accepted
+**Context:** Phase 19.1 plan 05 (`sm-chatvideo-plugin`), D-13 / D-14 / D-15, 19.1-RESEARCH.md Pitfall 9, 19.1-COVERAGE.md LiveKit RoomService table
+
+## Decision
+
+`sm-chatvideo-plugin` depends on `github.com/livekit/server-sdk-go/v2` at **v2.19.0** (2026-10-08, Apache-2.0) for LiveKit RoomService (create, delete, remove participant, participant count, list rooms) and as the official token-helper source. Confirmed this session: `go list -m -versions github.com/livekit/server-sdk-go/v2` lists v2.19.0 as current.
+
+- The official module path is **`github.com/livekit/server-sdk-go/v2`**. The v1 path `github.com/livekit/server-sdk-go` is frozen at v1.1.8 (2024-01-25) and is not used. Do not reopen the library choice.
+- The frozen PHP plugin (`golem15/chatvideo` @ 25135b4) talks to LiveKit through Agence104 RoomServiceClient and mints join JWTs with firebase/jwt (`LiveKitService.php` lines 80–99). The Go port needs the same Room API surface and the same HS256 claims, not a hand-rolled Twirp client.
+- The library is Apache-2.0. Transitive: `github.com/livekit/protocol`, twirp, protobuf. **Flag (Pitfall 9):** v2.19.0 also pulls `github.com/pion/webrtc/v4`, `github.com/livekit/media-sdk`, and `github.com/moby/buildkit`. Those are the realtime / media / container stack. Tests that import pion download buildkit.
+- Production talks to a narrow **`RoomAPI` interface** only: `CreateRoom`, `DeleteRoom` (missing-room is a no-op), `RemoveParticipant`, `ParticipantCount` (missing-room returns 0), `ActiveRoomNames`. The official client is constructed with `lksdk.NewRoomServiceClient`. Production and tests **must not construct `lksdk.Room`** (that is the realtime WebRTC client).
+- Tests ship an in-memory `RoomAPI` fake. Tests must not import pion, media-sdk, or buildkit, and must not construct `lksdk.Room`.
+- HTTP to the operator URL uses **`fetchguard.Policy{Mode: fetchguard.TrustedMode}`**. The URL is operator-configured (`livekit_admin_url`, else `livekit_url` with `wss://`/`ws://` rewritten to `https://`/`http://`) and may be loopback (`http://localhost:7880`). It is never user-supplied. TrustedMode is the only fetchguard mode allowed for this hop.
+- Token claims are golden against PHP `LiveKitService.php` lines 80–99: HS256; `iss` = API key; `sub` = user id string; `name`; `iat`/`nbf`/`exp` with `token_ttl` default 900; nested `video` grant `room` / `roomJoin` / `canPublish` / `canSubscribe`; optional `metadata` JSON string (avatar). Prefer `github.com/livekit/protocol/auth` `ToJWT` when it matches. **If `ToJWT` differs** (omits `name` / `nbf` / nested `video` keys, or grant JSON keys do not match PHP), mint with **`jwt/v5` `MapClaims`** copying the PHP payload, still inside the same LiveKit wrapper. `TestLiveKitTokenClaims` is the lock.
+
+## Related dependencies
+
+- `fetchguard` (in-tree) is the SSRF boundary for the operator RoomService URL: TrustedMode only. PublicOnly would refuse loopback and break a local SFU.
+- `github.com/golang-jwt/jwt/v5` is already a framework dependency (v5.3.1). The golden fallback uses the same module. Chatvideo does not add a second JWT library.
+- `github.com/livekit/protocol` (auth + Twirp types) arrives as a transitive of server-sdk-go/v2. Tokens actually live in `protocol/auth`; the plugin still requires the official `/v2` SDK for `NewRoomServiceClient`.
+
+## Consequences
+
+- `sm-chatvideo-plugin/go.mod` requires `github.com/livekit/server-sdk-go/v2 v2.19.0` only **after** this note exists. `go get github.com/livekit/server-sdk-go/v2@v2.19.0` must not run before this file is committed.
+- The only production importer of the SDK is the RoomAPI wrapper (`classes/livekit.go`). Tests inject a fake and never construct `lksdk.Room`.
+- Swapping the SDK later is a local wrapper change (D-13 reversibility). A later bump still needs a note confirming the RoomAPI surface, the pion/media-sdk/buildkit flag, TrustedMode for the operator URL, and the jwt/v5 MapClaims golden fallback.
+- Config keys carry over unchanged: `livekit_url`, `livekit_api_key`, `livekit_api_secret`, `max_duration`, `token_ttl`, `livekit_admin_url`, `max_participants`, `screen_share`.

.planning/notes/2026-10-18-roadmap-reorder-demo-release-wavepath.md

@@ -0,0 +1,32 @@
+---
+title: Roadmap reorder — demo at 20, Płytarium release at 30, WavePath from 31, Horoskopia from 36
+date: 2026-10-18
+context: /msd-explore after Phase 19.1 closed. Revises the phase numbers set in `wavepath-framework-asks-division.md` (2026-10-11) and the port order in `core-plugin-port-inventory.md` (2026-10-07).
+---
+
+# Roadmap reorder: demo at 20, Płytarium release at 30, WavePath from 31, Horoskopia from 36
+
+## Decisions
+
+- **The remaining 19.x phases come first** (19.3 verification, then 19.4 to 19.7). They polish the framework and the shared plugins before anything is shown or released.
+- **Phase 20 is a demo instance with every shared plugin.** It builds on the existing `sm-demo-app` (14 plugins, `demo:seed`, Nuxt site `vue-demo-app`, no deployment yet). The phase adds the chat family (`chat`, `chatchannels`, `chatvideo`, `chatbots`, `forum`, `herald`, `userfriends`), frontend pages that show chat, video calls, presentations, journal and the rest, and a public deployment.
+  - The frontend is public. The admin backend is not; the site carries a "want to see the backend? contact Golem15" call to action.
+- **Phases 21 to 29 are not on the roadmap.** Security phases, more plugin ports and backend fixes are expected over the next 2 to 3 weeks, and each is added when its goal is clear. `phase add` numbers a new phase as the highest number plus one, so these need an explicit id: `msd_run phase add "<description>" --id 21` (then move the section to sit between 20 and 30 in ROADMAP.md).
+- **Phase 30 is the Płytarium cutover** (was Phase 20; its CONTEXT and decisions D-01 to D-13 moved unchanged to `30-cutover/`). It closes milestone v1.0.
+- **Phase 31 opens the WavePath work** (was 19.2, chat polish against WavePath's clients). Recording the `tide` corpus right before the migration is worth more than recording now, because WavePath's PHP routes are not frozen.
+- **Phases 31 to 35: WavePath** off WinterCMS onto Go, and WavePath's community off Mattermost. Target: this winter. Expected to be a v1.1 milestone.
+- **Phases 36 to 40: Horoskopia-driven development.** Expected to be a v1.2 milestone. WavePath before Horoskopia matches the 2026-10-11 change to the seeds.
+
+## Milestones
+
+All phases currently sit in the v1.0 roadmap. When v1.0 closes at Phase 30, Phase 31 moves into the next milestone with `/msd-new-milestone`.
+
+## Pointers for later
+
+- **Mattermost exit (31 to 35):** WavePath's own roadmap has the PHP-side pattern, milestone v1.13 "Mattermost Import" (Phases 99 to 103 in `/media/nvme/dev/jz/wavepath.org/.planning/`). It is a generic `wn-mattermostimport-plugin`: a resumable, re-runnable import with delta runs and a ledger, which never writes to the Mattermost source. Host seams live in the app plugin. Not scoped here.
+- **WavePath `import:winter` stress cases** stay in `wavepath-framework-asks-division.md` and apply to the Phase 30 runner.
+
+## Open for the Phase 20 discussion
+
+- Can visitors sign up and use chat and video calls themselves, or do they browse seeded content through prepared demo accounts? This decides how much abuse protection is needed (Turnstile from 19.3, rate limits), whether LiveKit usage needs caps, and whether the demo data is reset on a schedule.
+- Where the demo is hosted and under which domain.

.planning/notes/2026-10-18-webpush-go.md

@@ -0,0 +1,30 @@
+# Decision: webpush-go for Herald Web Push
+
+**Date:** 2026-10-18
+**Status:** Accepted
+**Context:** Phase 19.1 plan 04 (`sm-herald-plugin`), D-09 / D-10 / D-12, 19.1-RESEARCH.md Pitfall 7 and Pitfall 8
+
+## Decision
+
+`sm-herald-plugin` depends on `github.com/SherClockHolmes/webpush-go` at **v1.4.0** (2025-01-02, MIT, Go 1.13) for VAPID (RFC 8292) and aes128gcm (RFC 8291) Web Push. Confirmed this session: `go list -m -versions github.com/SherClockHolmes/webpush-go` lists v1.4.0 as current.
+
+- The frozen PHP plugin (`golem15/herald` @ a749f83) sends through Minishlink WebPush. The Go port needs the same record encryption, VAPID JWT, TTL and urgency — not a hand-rolled AES-GCM / ES256 stack (HKDF, subscription-key decode, RFC 8291 padding).
+- The library is MIT, maintained, and already shares `github.com/golang-jwt/jwt/v5` with the framework (`go.mod` pins jwt/v5 v5.3.1). Transitive: jwt/v5 and `golang.org/x/crypto`.
+- `Options.HTTPClient` is the `Do(*http.Request) (*http.Response, error)` interface. `fetchguard.Client.Do` matches it (`modules/fetchguard/client.go`), so `*fetchguard.Client` is passed as `Options.HTTPClient` directly. Pitfall 8: no adapter type, no `http.Client{Transport: …}` wrapper.
+- Send uses `fetchguard.NewClient` with `PublicOnlyMode` (HTTPS only; private and reserved IPs refused at dial time). Subscribe validates the same policy. There is no `EndpointGuard` type.
+- PHP defaults carry over: TTL **2419200** (4 weeks) and urgency **normal**, both overridable per send. The worker prunes rows on HTTP **404** and **410**.
+- VAPID keys are config keys `golem15.herald.vapid.{subject,public_key,private_key}` (PHP env names `VAPID_SUBJECT` / `VAPID_PUBLIC_KEY` / `VAPID_PRIVATE_KEY`). This note does not generate keys.
+
+The in-tree Web Push module (`modules/flare`) is **not** used as the sender. It already implements RFC 8291/8292, but its config keys are `push.*`, its command is `websockets:generate-vapid-keys`, and it takes `*http.Client` rather than the `HTTPClient` Do interface. D-09 locks webpush-go so Herald keeps PHP's `golem15.herald.vapid.*` keys and `herald:vapid-generate` command name.
+
+## Related dependencies
+
+- `fetchguard` (in-tree) is the SSRF boundary: PublicOnly at subscribe and send. Tests inject `fetchguard.WithTransport` — no extra Doer type.
+- `github.com/golang-jwt/jwt/v5` is already a framework dependency; webpush-go's VAPID JWT uses the same module. Herald does not add a second JWT library.
+- `modules/flare` stays the framework Web Push package for other callers. Herald never imports it.
+
+## Consequences
+
+- `sm-herald-plugin/go.mod` requires `github.com/SherClockHolmes/webpush-go v1.4.0` only **after** this note exists. The importer is the plugin sender (`classes/sender.go`); `Options.HTTPClient` is the PublicOnly `*fetchguard.Client`.
+- `summer herald:vapid-generate` calls `webpush.GenerateVAPIDKeys` and prints `VAPID_PUBLIC_KEY=` / `VAPID_PRIVATE_KEY=` lines. The private key is never written to slog, payloads, or README examples.
+- Swapping the library later is a local sender change (D-09 reversibility). A later bump still needs a note confirming `HTTPClient` stays the Do interface so fetchguard continues to pass through without an adapter.

.planning/notes/2026-10-19-oidc-on-wristband-golang-jwt.md

@@ -0,0 +1,40 @@
+# Decision: OIDC provider on wristband, id_tokens signed with golang-jwt
+
+**Date:** 2026-10-19
+**Status:** Accepted
+**Context:** Phase 19.4 (OIDC provider on wristband, SC-1, D-06, D-09, D-14, D-16), 19.4-RESEARCH.md "D-16 decision", Standard Stack and Package Legitimacy Audit
+
+## Decision
+
+The OpenID Connect provider extends the hand-written `wristband` package with an OIDC flavour. It does not put zitadel/oidc behind wristband.
+
+- **One engine, two flavours (D-06).** `wristband.NewServer` keeps building the MCP authorization server exactly as before; a new `wristband.NewOIDCServer` builds a second `*wristband.Server` whose flavour selects the OIDC validation and response code. Both share the primitives that Phase 8 already reviewed: client lookup, redirect matching, PKCE S256, SHA-256 hex hashing, constant-time comparison, random identifiers, the redirect HTML writer and refresh lineage.
+- **Additive interfaces (D-09).** OIDC storage arrives through new interfaces (`OIDCBackend`, `OIDCTx`, `KeyStore`) and a host seam for HTML and the signed-in user (`OIDCHost`). `wristband.Backend`, `wristband.Tx` and every MCP signature stay source-compatible, so the existing MCP adapter in the first consuming application compiles unchanged.
+- **`github.com/golang-jwt/jwt/v5` at v5.3.1 signs id_tokens** (RS256 and ES256). It is already required in `go.mod` and already used by `bouncer` (HS256) and `flare` (ES256 VAPID tokens), so the framework keeps one JOSE/JWT library. Claims are built as `jwt.MapClaims`, so `aud` stays a JSON string as in the PHP provider; `jwt.RegisteredClaims` would marshal `aud` as an array while the package global `jwt.MarshalSingleStringAsArray` is true, and that global is never touched because `bouncer` shares it.
+- **JWKs are encoded with the standard library.** RSA keys publish the minimal big-endian bytes of the modulus and exponent; EC keys publish `x` and `y` from `ecdsa.PublicKey.Bytes()` (the fixed-length uncompressed point, so the left-padding bug cannot happen). About forty lines. `github.com/go-jose/go-jose/v4` was considered for this at runtime and rejected: it would be a second JOSE library next to golang-jwt (RESEARCH assumption A2). It still checks the encoder from the outside, because the test-only relying-party stack below verifies tokens through it.
+- **The interop oracle is test-only and lives in the plugin repo.** `github.com/coreos/go-oidc/v3` at v3.21.0 and `golang.org/x/oauth2` at v0.37.0 drive a stock relying party (discovery, authorize URL with PKCE, code exchange, id_token and `at_hash` verification against the served JWKS) in `sm-oauthserver-plugin`. This is the D-16 interop test, the equivalent of the PHP plugin's JumbojettInteropTest. Both modules are installed in plan 19.4-02 only after a blocking human package check, because the package-legitimacy seam cannot check Go modules. The framework keeps a golang-jwt plus standard-library tracer over in-memory fakes, so the framework `go.mod` gains nothing.
+
+**zitadel/oidc v3 was rejected.** v3.51.16 is a certified, maintained provider, and the comparison in 19.4-RESEARCH.md ("D-16 decision: recommendation") was made with that in favour. It fails three locked decisions at once:
+
+- **D-06, one engine.** zitadel's `op` package is its own authorize and token engine. MCP stays on wristband (Phase 8 rejected zitadel for MCP byte parity, `.planning/notes/oauth2-wristband-direct-port.md`), so adopting it would mean two engines side by side.
+- **D-09, additive interfaces.** An adapter would have to implement `op.Storage` (AuthStorage, OPStorage and Health, 25 methods) with zitadel-shaped types such as `*oidc.AuthRequest` and `jose.SignatureAlgorithm`, which cannot be added next to the existing adapter without reshaping it.
+- **D-14, relying-party-visible parity.** `CreateDiscoveryConfig` always emits introspection, revocation, end-session, check-session and device endpoints that the PHP discovery document does not have, and zitadel owns the error JSON, the redirect building and the login URL contract. The PHP relying parties expect PHP's bytes.
+
+It would also add chi v5, gorilla/securecookie, rs/cors, go-jose v4, a newer OpenTelemetry than the framework pins, golang/mock and more to the runtime module graph.
+
+The trade-off in plain words: the user's standing preference ("recommend the maintained library plus a decision note for protocol and security code") is honoured for the cryptography (golang-jwt signs, go-oidc and go-jose verify in tests). The protocol state machine stays the already-reviewed wristband code, because the certified library cannot meet D-06, D-09 and D-14 together.
+
+This note supersedes the zitadel/oidc row of `.planning/research/STACK.md` for OIDC, as `.planning/notes/oauth2-wristband-direct-port.md` already did for MCP.
+
+## Related dependencies
+
+- **`github.com/coreos/go-oidc/v3` v3.21.0, test-only**, in `sm-oauthserver-plugin` (requires go-jose v4 transitively). Installed after a blocking human package check in plan 19.4-02.
+- **`golang.org/x/oauth2` v0.37.0, test-only**, in `sm-oauthserver-plugin`, same check. Its client sends Basic credentials as `url.QueryEscape(id):url.QueryEscape(secret)`, which is why the OIDC token endpoint unescapes both halves (PHP does `urldecode`).
+- **Standard library only for the rest:** `crypto/rsa`, `crypto/ecdsa`, `crypto/elliptic`, `crypto/x509`, `encoding/pem`, `math/big` for keys and JWKs; `uuid` (Go 1.27, `uuid.NewV4`) for request identifiers and subjects; `log/slog` for the fixed-reason failure logs.
+
+## Consequences
+
+- The framework `go.mod` gains no module; `grep -E 'zitadel|go-jose|coreos' go.mod` stays empty.
+- `wristband` stays a protocol leaf: no ORM, no framework module except `diary`, no application package. Logging through `diary` is required (amended 2026-10-21, phase 19.8: every framework module logs through diary components). Storage, keys at rest, pages and routes belong to `sm-oauthserver-plugin` (D-01).
+- The OIDC flavour owns every byte a relying party sees (discovery field order, redirect encoding, error bodies, headers), so parity with the PHP provider is a matter of tests and `tide` recordings, not of fighting library defaults.
+- Replacing golang-jwt later means re-checking the id_token header (`alg`, `kid`) and the string `aud` against the go-oidc interop test.

.planning/notes/2026-10-20-sociallogin-goth.md

@@ -0,0 +1,54 @@
+# Decision: social sign-in uses goth without gothic
+
+**Date:** 2026-10-20
+**Status:** Accepted
+**Context:** Phase 19.5 (social login in a shared plugin, D-01, D-02, D-03, D-04), 19.5-RESEARCH.md Q1, Q2 and Package Legitimacy Audit
+
+## Decision
+
+Social sign-in (Google, Facebook, GitHub, Microsoft) lives in the new shared plugin `sm-sociallogin-plugin`, which requires `sm-user-plugin`. Its OAuth 2.0 client side uses goth's provider packages and drives them without goth's session layer.
+
+- **`github.com/markbates/goth` pinned at v1.82.0.** Published 2025-08-18, MIT, origin `github.com/markbates/goth` at tag `v1.82.0`, `go 1.23.0` in its go.mod. It is the newest tag.
+- **Only five packages are imported, and only by `sm-sociallogin-plugin`** (`classes/providers_goth.go`): the core package `github.com/markbates/goth` and `providers/google`, `providers/facebook`, `providers/github`, `providers/azureadv2`. No other repository imports goth.
+- **`gothic` and `goth.UseProviders` are never used.** `gothic` is the only goth package that imports `github.com/gorilla/sessions`, which would be a second session mechanism next to `bouncer`. `goth.UseProviders` fills a process-global map, which does not fit per-request provider configuration. The plugin builds providers itself and calls `BeginAuth`, `Marshal`, `UnmarshalSession`, `Authorize` and `FetchUser` directly.
+- **The goth session lives in the plugin's own sealed state cookie (D-07).** The marshalled goth session goes into an AES-GCM cookie keyed from the app key with a domain-separated HKDF label, together with the state, the provider and the action. No server-side session store.
+- **Imported non-stdlib packages are exactly these** (measured with `go list -deps` on a scratch module importing the five packages):
+  - `cloud.google.com/go/compute/metadata`
+  - `github.com/markbates/goth`, `.../providers/azureadv2`, `.../providers/facebook`, `.../providers/github`, `.../providers/google`
+  - `golang.org/x/oauth2`, `golang.org/x/oauth2/authhandler`, `golang.org/x/oauth2/google`, `golang.org/x/oauth2/google/externalaccount`, `golang.org/x/oauth2/google/internal/externalaccountauthorizeduser`, `golang.org/x/oauth2/google/internal/impersonate`, `golang.org/x/oauth2/google/internal/stsexchange`, `golang.org/x/oauth2/internal`, `golang.org/x/oauth2/jws`, `golang.org/x/oauth2/jwt`
+
+  The core package needs only the standard library and `golang.org/x/oauth2`. `providers/google` adds `golang.org/x/oauth2/google` (for `google.Endpoint`), which brings `cloud.google.com/go/compute/metadata`. `facebook`, `github` and `azureadv2` add nothing beyond core.
+- **`azureadv2` over `microsoftonline`.** Only `azureadv2` takes a tenant (`common`, `organizations`, `consumers` or a tenant ID) and it needs no extra module; `microsoftonline` hard-codes the `common` endpoints and pulls `github.com/markbates/going/defaults`. The wrapper names the provider `microsoft`, requests `offline_access` explicitly and ignores goth's auth-only Graph photo URL.
+
+## Measurements
+
+- **Binary size: +132 KiB** on a stripped build of the demo application (`-trimpath -ldflags="-s -w"`): 47,427,847 to 47,563,015 bytes, with the four providers driven through `BeginAuth`, `UnmarshalSession`, `Authorize` and `FetchUser`. The demo already links `google.golang.org/api` through gocloud, which keeps the delta small.
+- **No gorilla session module in the binary.** `go version -m` lists `github.com/markbates/goth v1.82.0`, `golang.org/x/oauth2` and `cloud.google.com/go/compute/metadata`; the only gorilla module is the pre-existing `github.com/gorilla/css`. No `gorilla/sessions`, `securecookie`, `mux` or `pat`.
+- **Module graph: 19 go.sum-only additions, no existing version changed.** A consuming module's `go list -m all` gains `github.com/decred/dcrd/dcrec/secp256k1/v4`, `github.com/go-chi/chi/v5`, `github.com/goccy/go-json`, `github.com/gorilla/context`, `github.com/gorilla/mux`, `github.com/gorilla/pat`, `github.com/gorilla/securecookie`, `github.com/gorilla/sessions`, `github.com/jarcoal/httpmock`, `github.com/lestrrat-go/backoff/v2`, `github.com/lestrrat-go/blackmagic`, `github.com/lestrrat-go/httpcc`, `github.com/lestrrat-go/iter`, `github.com/lestrrat-go/jwx`, `github.com/lestrrat-go/option`, `github.com/markbates/going`, `github.com/markbates/goth`, `github.com/mrjones/oauth` and `github.com/pkg/errors`. These come from goth's go.mod (gothic, other providers, tests); none of them is compiled into the binary.
+- **Vulnerabilities:** `govulncheck` v1.9.0 over a scratch module with goth v1.82.0 reported "No vulnerabilities found."
+
+## Maintenance risk
+
+goth has 6.6k stars and 825 commits, but its repository advertises a search for a new maintainer and the last tag is 14 months old. D-03 contains that risk: goth stays behind the plugin's own `Provider` interface and never appears in its public API, each provider package is under 300 lines, and a provider can be replaced by a hand-written one (or a fork) without touching routes, payloads or the plugin's exported types.
+
+## Rejected alternatives
+
+- **Hand-written `golang.org/x/oauth2` plus profile calls.** Fewer dependencies, but the user prefers a maintained library for protocol code, and goth already normalises the four profile APIs.
+- **`gorilla/securecookie` for the state cookie.** A new dependency for about 30 lines of standard-library AEAD (`crypto/hkdf`, `crypto/aes`, `crypto/cipher`).
+- **`gothic`.** It brings `gorilla/sessions` as a second session mechanism and keeps the state in its own store; the state-check it does (`validateState`) also skips an empty original state, which the plugin must reject.
+
+## Related dependencies
+
+- **`golang.org/x/oauth2`**, already in the workspace module graph (approved in 19.4); minimal version selection picks the application's version (goth needs v0.27.0 or newer).
+- **`cloud.google.com/go/compute/metadata`**, already present in the workspace graph.
+
+## Package legitimacy
+
+The package-legitimacy seam cannot check Go modules (as in 19.4), so goth is [ASSUMED] for legitimacy and is gated by a blocking human check (plan 19.5-01 Task 4) before any `go get`. Proxy signals gathered by hand: v1.82.0 on proxy.golang.org, origin URL and tag ref as above, MIT licence.
+
+## Consequences
+
+- The framework `go.mod` gains nothing; `grep markbates/goth go.mod` stays empty. goth is required only by `sm-sociallogin-plugin` and appears in the go.sum of applications that mount it.
+- `go list -deps` of any application binary must not list `github.com/gorilla/sessions`.
+- `gopkg.in/yaml.v3` appears in goth's module graph as an indirect module and is never imported (the project rule is `goccy/go-yaml`).
+- PKCE stays off, because goth's providers keep their `oauth2.Config` unexported and expose no hook. RFC 9700 allows a browser-bound one-time `state` for confidential clients, which the sealed state cookie provides. PKCE is on the deferred list.

.planning/notes/2026-10-21-console-charm-stack.md

@@ -0,0 +1,48 @@
+# Decision: the console runs on charm's v2 stack, logging stays on stdlib slog
+
+**Date:** 2026-10-21
+**Status:** Accepted
+**Context:** Phase 19.8 (console commands overhaul: D-01, D-02, D-05, D-08 and the CONTEXT discretion item on the console handler), 19.8-RESEARCH.md Standard Stack, Alternatives Considered, Package Legitimacy Audit and the probes quoted there
+
+## Decision
+
+The console layer (`modules/bonfire`) and the new logging module (`modules/diary`) adopt charm's v2 libraries on the `charm.land` vanity paths. Log routing itself stays on the standard library's `log/slog`.
+
+- **Modules and versions.** All six were checked with `go list -m -versions` on 2026-10-21; each is the newest tag, so the research pins stand:
+  - `charm.land/lipgloss/v2` v2.0.6: styles, layout and `lipgloss/v2/table` for list, help, errors, tables and log lines.
+  - `charm.land/bubbletea/v2` v2.1.0: program runtime for the live spinner, process and progress views.
+  - `charm.land/bubbles/v2` v2.2.1: `spinner` (MiniDot, the frames `bonfire` already draws), `progress` (the cyan-to-green bar), `key` and `help`.
+  - `charm.land/huh/v2` v2.0.3: Ask, Confirm, Choice and Secret on an interactive terminal, with accessible mode.
+  - `charm.land/fang/v2` v2.0.1: cobra error rendering hook and Windows VT enabling.
+  - `github.com/charmbracelet/colorprofile` v0.4.3: imported directly for `colorprofile.Writer` and `colorprofile.Detect` (already a transitive dependency of all of the above).
+- **v2, not SSU's v1 pins.** SSU (`/media/nvme/dev/pxpx/ssu`) pins `github.com/charmbracelet/lipgloss` v1.0.0, `bubbletea` v1.3.0 and `bubbles` v0.20.0. fang v1 already depends on a `charm.land/lipgloss/v2` beta, so v1 widgets plus any fang would compile two lipgloss majors into every binary, and the v1 line is maintenance-only. SSU's widgets are ported with the v2 renames: `View()` returns `tea.View`, key events are `tea.KeyPressMsg`, the progress gradient is `progress.WithColors` / `WithDefaultBlend`, and widths are set with `SetWidth`.
+- **Who imports them.** Only `modules/bonfire` (all five charm libraries plus colorprofile) and `modules/diary` (lipgloss and colorprofile) import charm modules. Plugins and other framework modules reach them through `bonfire.Output` and `diary.For`, never directly.
+- **fang is used narrowly.** `fang.Execute` runs with `fang.WithoutVersion()` (its `-v`/`--version` would collide with the verbosity flags), `fang.WithoutManpage()` (it would add a hidden `man` command to the list and to duplicate checks), `fang.WithoutCompletions()`, and `fang.WithErrorHandler` set to bonfire's own error renderer. The help and list layouts are bonfire's own Artisan layouts (D-14); fang's help func never reaches subcommands because bonfire sets a help func on every command.
+- **Color is applied at the writer.** lipgloss v2 `Render` always emits ANSI, so `--ansi`, `--no-ansi`, `NO_COLOR`, `TERM=dumb` and `FORCE_COLOR` are applied through `colorprofile.Writer` with a profile that bonfire detects.
+- **The diary console handler is our own** lipgloss-styled `slog.Handler`. charm's slog logger module (`charm.land/log/v2` v2.0.1) is rejected: it fails `testing/slogtest` (`WithGroup` treated as a prefix, empty attributes printed, attributes of empty-key groups not inlined), and it brings its own level and prefix model that duplicates diary's component levels. This settles the CONTEXT discretion item.
+- **Daily files use a stdlib writer** of about 120 lines (one file per day, `name-YYYY-MM-DD.log`, retention by days, mode 0640). `gopkg.in/natefinch/lumberjack.v2`, which SSU uses, is rejected: it rotates by size, has no per-day naming, and would need its own note.
+- **Fan-out and GORM.** The `stack` driver is the standard library's `slog.NewMultiHandler` (Go 1.26+), and GORM logs through gorm's own `logger.NewSlogLogger` (already in gorm v1.31.2). No logging library is added.
+- **Cost.** The probe measured about +2.1 MB on a stripped binary (`-trimpath -s -w`): 2,527,495 bytes for cobra and x/term alone, 4,649,223 bytes with lipgloss/table, bubbletea, the bubbles spinner and progress, huh and fang.
+- **Toolchain fit.** The module go directives are at most 1.26 (lipgloss 1.25.0, bubbletea 1.26.0, bubbles 1.25.0, huh 1.25.8, fang 1.25.0) and fit this module's `go 1.27.0`. Minimal version selection keeps `github.com/spf13/cobra` v1.10.2, `github.com/spf13/pflag` v1.0.9 and `golang.org/x/text` v0.42.0 (fang asks for older cobra and pflag).
+- **YAML rule.** `gopkg.in/yaml.v3` enters the module graph only as testify's indirect test dependency of fang and huh. Nothing in this repository imports it; YAML stays on `goccy/go-yaml`.
+- **Package legitimacy.** The MSD package-legitimacy seam rejects the Go ecosystem, so the six modules were checked by hand against proxy.golang.org (`@latest`, `.mod`, `@v/list`) and the `charm.land` go-import meta tags, whose origins are `github.com/charmbracelet/*`. Verdict: approved. fang is young (two v2 tags, repository first tagged 2025-06-18), which is acceptable because it is used only for the error hook.
+- **Install order.** Plan 19.8-01 installs `charm.land/lipgloss/v2` and `github.com/charmbracelet/colorprofile` with the code that imports them (the palette and the diary console handler); plan 19.8-02 installs bubbletea, bubbles, huh and fang with the widgets. `go mod tidy` drops requirements that no package imports, so each plan adds only what it uses.
+
+**Rejected alternatives.** SSU's v1 pins were rejected for the two-majors problem above. `charm.land/log/v2` was rejected for the slogtest failures and the duplicated level model. lumberjack was rejected because it rotates by size and names files differently. A hand-written fan-out handler (SSU's `MultiHandler`) was rejected in favour of `slog.NewMultiHandler`, which clones records, honours `Enabled` and joins errors.
+
+## Related dependencies
+
+- **Standard library only for logging:** `log/slog` (`NewMultiHandler`, `JSONHandler`, `TextHandler`, `DiscardHandler`, `LevelVar`), `testing/slogtest` for handler conformance tests, `os` and `path/filepath` for the daily writer.
+- **gorm.io/gorm** v1.31.2 (already required) for `logger.NewSlogLogger`.
+- **github.com/spf13/cobra** v1.10.2 (already required) stays the command parser under bonfire.
+
+## Consequences
+
+- Every application binary grows by about 2.1 MB once plan 19.8-02 lands the widgets.
+- Removing the stack later means rewriting bonfire's widgets and diary's console handler; D-01 and D-02 are rated costly for that reason.
+- Plugins never import charm modules directly, so a later change of styling library touches only `modules/bonfire` and `modules/diary`.
+- A check in the plan's acceptance criteria (`go list` over every package's imports) keeps the import boundary honest.
+
+## Addendum 2026-10-28: fang removed
+
+`charm.land/fang/v2` was removed in quick 261028-rqd (console review finding IN-06). `fang.Execute` installs its own help function on the root just before `root.ExecuteContext`, so after `bonfire.Execute` the root's help function was no longer bonfire's list renderer, and cobra offers no per-root hook in between to restore it. bonfire had already switched off every fang feature except the error handler, so `bonfire.Execute` now runs `root.ExecuteContext` itself and renders errors with `RenderError` on the root's error stream. The only other thing fang did, enabling VT processing on Windows consoles, is done through `lipgloss.EnableLegacyWindowsANSI` on the output and error streams when they are files (a no-op off Windows). `go mod tidy` dropped fang and its exclusive transitive modules (mango, mango-cobra, mango-pflag, roff, x/exp/charmtone); no module was added. The list, help and error output stayed byte-identical (the goldens pass unchanged). The stack is now five charm modules plus colorprofile.

.planning/notes/2026-10-21-mfa-otp-webauthn.md

@@ -0,0 +1,46 @@
+# Decision: second factors use pquerna/otp, go-webauthn and boombuler/barcode, in sm-mfa-plugin only
+
+**Date:** 2026-10-21
+**Status:** Accepted
+**Context:** Phase 19.6 (two-factor auth and device flow, D-01, D-04, D-06, D-08, D-14), 19.6-RESEARCH.md Q1, Q2, Q3 and Package Legitimacy Audit
+
+## Decision
+
+The second factors (TOTP, WebAuthn, email codes, recovery codes, trusted devices) live in the new shared plugin `sm-mfa-plugin`, which requires `sm-user-plugin` (D-01). Three third-party modules carry the protocol work; everything else is the standard library and the framework.
+
+- **`github.com/pquerna/otp` pinned at v1.5.0.** Published 2024-12-31, Apache-2.0. Packages `totp` and `hotp` only. Issuer is the application name, the account is the user's email, the validation window is plus or minus one step, SHA1, 6 digits, 30 s period (the Google Authenticator defaults PHP used). Replay protection is done per counter with `hotp` (RESEARCH Pitfall 5).
+- **`github.com/go-webauthn/webauthn` pinned at v0.18.2.** Published 2026-09-19, BSD-3-Clause. Packages `webauthn` and `protocol` only. Attestation `none`, timeout 60 s, user verification `preferred` for second-factor use and `required` for passkeys (D-14). Ceremony state stays server-side.
+- **`github.com/boombuler/barcode` pinned at v1.1.0 (package `qr` only) for the TOTP QR code.** MIT. It is already a requirement of pquerna/otp (for `Key.Image()`), so it adds no module and no maintainer. sm-mfa-plugin writes the SVG itself (a small serializer emitting one `<path>` for the dark modules, `width="200" height="200"` with a `viewBox`, as PHP's Bacon `RendererStyle(200)` did), so PHP's TOTP setup contract `{secret, qr_code_svg, qr_code_url}` stays. The round trip was proven during research: a TOTP URL encoded at level M was read back byte for byte by an independent decoder (RESEARCH Q2, Assumption A1).
+- **Slow hash for recovery and email codes: bcrypt** through `bouncer.HashPassword` / `bouncer.CheckPassword` at `golem15.user.password.bcrypt_cost`, exactly as the user plugin hashes passwords (D-06). No argon2: it would add `golang.org/x/crypto/argon2` usage the framework does not have. Ten compares at cost 10 measured 631 ms (RESEARCH Q3).
+
+## Measurements (RESEARCH Q1)
+
+- **Binary size: +2,269,184 bytes (+2.16 MiB)** on a stripped build of the demo application (`-trimpath -ldflags="-s -w"`): 51,802,375 to 54,071,559 bytes, with TOTP generate and validate, QR encode, and the WebAuthn registration, login and passkey-login paths driven by a probe.
+- **Nine newly linked modules** (`go version -m` diff): `github.com/boombuler/barcode` v1.1.0, `github.com/fxamacker/cbor/v2` v2.9.4, `github.com/go-webauthn/webauthn` v0.18.2, `github.com/go-webauthn/x` v0.3.1, `github.com/google/go-tpm` v0.9.8, `github.com/philhofer/fwd` v1.2.0, `github.com/pquerna/otp` v1.5.0, `github.com/tinylib/msgp` v1.6.4, `github.com/x448/float16` v0.8.4.
+- **One version bump in consuming graphs:** minimal version selection moves `github.com/go-viper/mapstructure/v2` from v2.4.0 to v2.5.0 in the module graph of applications that mount the plugin. `golang-jwt/jwt/v5` v5.3.1, `google/uuid` v1.6.0 and `golang.org/x/crypto` v0.57.0 are already at go-webauthn's versions.
+- **Vulnerabilities:** `govulncheck` v1.9.0 reports no reachable vulnerability. The only module-level advisory, GO-2026-5932 (`golang.org/x/crypto/openpgp`, unmaintained), sits in a package nothing imports.
+- go-webauthn's go.mod lists the archived YAML v3 module as an indirect, test-only requirement outside the import graph. Plugin code never imports it (CLAUDE.md: `goccy/go-yaml` only).
+
+## Deviation from PHP recorded here (D-08)
+
+WebAuthn requests and responses use go-webauthn's standard base64url shapes (`PublicKeyCredentialCreationOptions`, `PublicKeyCredentialRequestOptions` and the attestation and assertion JSON that `navigator.credentials` and `@simplewebauthn/browser` produce), not PHP's lbuchs plain-base64 layout. The paths and outer keys stay PHP's. This is acceptable because no client implements the PHP layout yet. PHP stored PEM public keys while go-webauthn verifies COSE keys, so the Phase 30 Winter import must convert or drop WebAuthn rows.
+
+## Rejected alternatives
+
+- **`github.com/piglig/go-qr` v1.1.0** (native `ToSVGBytes`). 67 stars, one maintainer, and a new module for what boombuler already provides through pquerna/otp's graph.
+- **argon2id for codes.** Not what the user plugin uses for passwords; D-06 asks to match it.
+- **A hand-written TOTP or WebAuthn implementation.** Protocol and security code goes to a maintained library with a decision note (project preference).
+
+## Related dependencies
+
+- `golang.org/x/crypto`, `github.com/golang-jwt/jwt/v5` and `github.com/google/uuid` are already in the framework and application graphs at the versions go-webauthn needs.
+
+## Package legitimacy
+
+The package-legitimacy seam cannot check Go modules (as in 19.4 and 19.5), so all three are [ASSUMED] for legitimacy and gated by a blocking human check (plan 19.6-01 Task 5) before any `go get`. Signals gathered by hand: pquerna/otp v1.5.0 on proxy.golang.org (2,963 stars, Apache-2.0); go-webauthn/webauthn v0.18.2 (1,351 stars, BSD-3-Clause, pushed 2026-10-20); boombuler/barcode v1.1.0 (published 2025-07-22, 1,563 stars, MIT).
+
+## Consequences
+
+- Only `sm-mfa-plugin`'s go.mod requires the three modules. `sm-user-plugin`, the framework and fonoteka.go require none, and applications without the plugin link none of the nine modules (D-01).
+- go-webauthn is pre-1.0 and the research is valid until 2026-11-20. After that date the executor re-checks the pin with `go list -m -json github.com/go-webauthn/webauthn@latest` before installing.
+- Installation, only after the human check: `go get github.com/pquerna/otp@v1.5.0 github.com/go-webauthn/webauthn@v0.18.2 github.com/boombuler/barcode@v1.1.0` inside `sm-mfa-plugin`, then `go mod tidy`.

.planning/notes/2026-10-22-external-user-plugin-escalations.md

@@ -0,0 +1,107 @@
+---
+title: External user-plugin escalations
+date: 2026-10-22
+context: /msd-explore of an external app's "escalate to summercms devs" list. Six /msd-quick tasks; send this reply when they are all done.
+g15office: bhoyg8z4
+---
+
+# External user-plugin escalations
+
+Reviewed 2026-10-22. The list is `golem15.user` (sm-user-plugin), not cabana admin auth. Phase 19.6 (2FA) is not mid-flight.
+
+**Released (2026-10-23):** sm-user-plugin **v0.1.9** carries all six quicks and still requires SummerCMS v0.4.3, so the external app needs no framework upgrade for these fixes. The earlier hold for a v0.5.0 wave is withdrawn: v0.5.0 is reserved for the finished MCP phase (19.7), and the framework's own next patch is v0.4.4, which is not needed for anything below. The reply is ready to send.
+
+**Do not run the six quicks in parallel on one working tree.** They share `sm-user-plugin` (`api_controller.go`, `plugin.go`, `routes.go`, README). Sequential fresh sessions.
+
+## Tracker
+
+| # | Their label | Verdict | Quick / todo | g15office | Status | Shipped |
+|---|---|---|---|---|---|---|
+| 1 | G2 login ignores `is_activated` | Fix | [261022-tb4](../quick/261022-tb4-password-login-must-refuse-is-activated-/) · [todo](../todos/done/2026-10-22-user-login-ignores-is-activated.md) | 3r4or1ex | released | `15ff979` → user v0.1.9 |
+| 2 | G3 cookie-only 401 | Fix remaining four; logout already done | [261022-tto](../quick/261022-tto-fetch-refresh-update-change-password-mus/) · [todo](../todos/done/2026-10-22-user-session-routes-ignore-cookie.md) | kkknstxl | released | `8e4b863` → user v0.1.9 |
+| 3 | G4 logout blacklist under `serve` | Fix | [261022-usi](../quick/261022-usi-user-plugin-jwt-blacklist-and-hooks-wire/) · [todo](../todos/done/2026-10-22-user-logout-blacklist-missing-under-serve.md) | ud0gficu | released | `4bf44fc` → user v0.1.9 |
+| 4 | G6 `/update` email without proof | Decline | — | — | declined | n/a |
+| 5 | G7 Users form has no role field | Decline | — | — | declined | n/a |
+| 6 | G8 API token guard ignores `tokens_valid_after` | Decline | — | — | declined | n/a |
+| 7 | Cookie option on `/login` | Feature | [261022-wah](../quick/261022-wah-opt-in-httponly-session-cookie-on-user-p/) · [todo](../todos/done/2026-10-22-user-login-opt-in-session-cookie.md) | strnsccy | released | `846087d`, `8bdf2c7` → user v0.1.9 |
+| 8 | Password-routes 404 switch | Feature | [261022-x7a](../quick/261022-x7a-user-plugin-golem15-user-password-public/) · [todo](../todos/done/2026-10-22-user-password-routes-404-switch.md) | h7yrafgd | released | `3828a65` → user v0.1.9 |
+| 9 | Lockout keyed on `RemoteAddr` | Fix | [261022-vfz](../quick/261022-vfz-user-plugin-login-throttle-via-surf-clie/) · [todo](../todos/done/2026-10-22-user-login-lockout-and-same-second-cutoff.md) | sniewiif | released | `b6f8055` → user v0.1.9 |
+| 10 | Same-second token refusal | Fix | [261022-vfz](../quick/261022-vfz-user-plugin-login-throttle-via-surf-clie/) · [todo](../todos/done/2026-10-22-user-login-lockout-and-same-second-cutoff.md) | sniewiif | released | `a484d0e` → user v0.1.9 |
+
+Status values: `open` · `done` · `declined`. Shipped: plugin commit → sm-user-plugin tag.
+
+## Six invocations (fresh session each, sequential)
+
+```
+/msd-quick --validate Password /login must refuse is_activated=false when golem15.user.activation.require_activation is true (default), same opaque invalid-login body as a bad password. Do not change deleted_at restore-on-login. See .planning/todos/pending/2026-10-22-user-login-ignores-is-activated.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
+
+/msd-quick --validate /fetch /refresh /update /change-password must accept the token/auth_token cookies the same way jwt.auth and EndSession already do. Logout is already fixed. See .planning/todos/pending/2026-10-22-user-session-routes-ignore-cookie.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
+
+/msd-quick --discuss --validate Under serve, user-plugin Boot runs before lagoon.Publish so the jwt blacklist is never wired and logout does not revoke. Wire BlacklistStore and RegisterHooks through lagoon.OnDatabase; test Activate-then-Publish. When re-registering the jwt guard, pass classes.SessionCookieNames() instead of the hardcoded token/auth_token names (G3 leftover). See .planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
+
+/msd-quick --validate User-plugin /login throttle must use surf.ClientIP (trusted proxies), not RemoteAddr. Leave exported RemoteIP as the RemoteAddr helper. Remaining tokens_valid_after writers (reset-password, admin password set) must Truncate(time.Second) like RevokeUserAccess; leave change-password and bouncer's comparison alone. See .planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
+
+/msd-quick --discuss --validate Opt-in HttpOnly session cookie on user-plugin POST /login: golem15.user.jwt.token_cookie (default off), attributes from auth.cookie via bouncer.LoadCookieConfig, omit body token when the cookie is set (sociallogin writeSession). Cookie-carried POST /refresh must rotate that cookie (G3 left body-only); bearer-only refresh stays body-only. SameSite=Lax, no CSRF. Base a484d0e. See .planning/todos/pending/2026-10-22-user-login-opt-in-session-cookie.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
+
+/msd-quick --validate User-plugin golem15.user.password.public_routes (default true). When false, do not register POST /login /forgot-password /reset-password so they 404 like unknown paths. Leave /register and the rest. No framework wrap, no custom 404. Base 8bdf2c7. See .planning/todos/pending/2026-10-22-user-password-routes-404-switch.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
+```
+
+Suggested order if you care about risk: G4 (serve blacklist), then G3, G2, 9+10, then the two features. All six are done locally; item 8 (password-routes 404) was the last. Do not overlap on the same plugin files. Released in sm-user-plugin v0.1.9.
+
+## Verdicts (kept for the sessions)
+
+- **G2.** `require_activation` is documented and `/register` honors it; `/login` does not. Deactivation (`deleted_at`) stays reversible.
+- **G3.** Done locally (`8e4b863`). Cookie extractors are `classes.SessionToken` / `SessionCookieNames`. Item 7 (`846087d`) made a `/refresh` carried by the `auth.cookie` cookie rewrite it; bearer- and `auth_token`-carried refreshes stay body-only. CSRF was not added (SameSite=Lax + current-password on change-password).
+- **G4.** Done locally (`4bf44fc`). Lazy `appBlacklist` + `lagoon.OnDatabase` for hooks, Postgres store and sweep. Guard uses `SessionCookieNames()`.
+- **G6.** D-27: email change clears `email_verified_at` and does not write a new proof. A confirm-the-new-inbox flow would be a later feature.
+- **G7.** Stock form omission was a 12.1 decision. Stale `organisation_role` is already cleared (`ClearOnChange`, v0.1.8). Apps extend the form.
+- **G8.** Personal tokens die via `revoked_at`. `RevokeUserAccess` already sets that on deactivate/ban. Do not teach the API-token guard a JWT cutoff. Password reset killing API tokens would be a separate, explicit revoke.
+- **7.** Done locally (`846087d`, `8bdf2c7`). `846087d`: a `/refresh` carried by the `auth.cookie` cookie (`token` by default, no bearer) rewrites it and answers `{}`, whatever `token_cookie` says; bearer and other-cookie refreshes stay body-only; refusals write no cookie. `8bdf2c7`: `golem15.user.jwt.token_cookie` (default off) makes /login, /register (auto sign-in) and /activate-by-code set the HttpOnly `auth.cookie` cookie via `bouncer.LoadCookieConfig` and omit body `token`; off keeps today's bodies. SameSite=Lax, no CSRF; API tokens untouched.
+- **8.** Done locally (`3828a65`). Plugin config; no framework wrap. `golem15.user.password.public_routes` (default true); false leaves `POST /login`, `/forgot-password` and `/reset-password` unregistered, so they get the router's own 404 like any unknown path (a `GET` too, no 405); no custom handler, no `pact`/`surf` change. `/register` stays (`allow_registration` gates it, `golem15.user.turnstile` still guards it), and so do `/activate*`, `/fetch`, `/refresh`, `/logout`, `/change-password` and `/tokens`. Read when the routes are built (a restart applies it); a value other than true or false fails boot.
+- **9.** Done locally (`b6f8055`). /login keys the throttle on surf.ClientIP with http.trusted_proxies (the /register expression); RemoteIP stays the RemoteAddr helper; without trusted proxies X-Forwarded-For is ignored.
+- **10.** Done locally (`a484d0e`). /reset-password and the admin password set truncate the cutoff to whole seconds like RevokeUserAccess; change-password and bouncer unchanged.
+
+## Reply to send
+
+Ready to send as-is (all items filled, released in sm-user-plugin v0.1.9).
+
+```
+Thanks for the escalation list. We reviewed the current golem15.user plugin (and the framework boot order). Here is what we shipped, what is already true, and what we are not changing. The fixes and the two new options are in sm-user-plugin v0.1.9, which still requires SummerCMS v0.4.3: bump the plugin, no framework upgrade is needed.
+
+G2 — login ignores is_activated
+Agreed. require_activation defaults to true and /register already withholds a token in admin mode; /login did not check is_activated. That is not the same as deactivation (deleted_at), which stays self-service: a later password login still restores the account.
+Ships in sm-user-plugin v0.1.9 (15ff979): with require_activation on (the default), /login answers an account that is not activated with the same opaque invalid-login response as a bad password (counted as a failed attempt); deactivation stays self-service. /activate still serves a not-activated session so the mailed-code flow works.
+
+G3 — some routes ignore the cookie
+Partly already fixed, rest agreed. POST /logout already accepts the token/auth_token cookies (and blacklists every JWT the request carries). GET /fetch, POST /refresh, POST /update and POST /change-password still required the Authorization header.
+Ships in sm-user-plugin v0.1.9 (8e4b863): GET /fetch, POST /refresh, POST /update and POST /change-password (and the other signed-in routes: /activate, /marketing-consent, /avatar, /avatar/remove) read the session token like jwt.auth: the Authorization header first, then the token and auth_token cookies. A /refresh carried by the session cookie named in auth.cookie (token by default) rewrites that cookie with the rotated token and answers {} (see "Cookie on /login" below). A /refresh carried by the Authorization header, or by the auth_token cookie, returns the rotated token in the body and writes no cookie; the previous token is revoked, so store the new one yourself.
+
+G4 — logout does not blacklist under serve
+Agreed. Plugin Boot runs before serve publishes the database, so the in-process blacklist store was never wired in production (the jwt_blacklist table exists; nothing wrote to it). Tests hid this because they publish the DB before Boot.
+Ships in sm-user-plugin v0.1.9 (4bf44fc): the plugin installs its jwt_blacklist store, the blacklist sweep and its GORM hooks when serve publishes the database, and the jwt guard reads that store on every request. Logout under serve now writes the jti to jwt_blacklist, and the next request with that token (jwt.auth routes, /fetch, /refresh) answers 401. A regression test boots in serve order (plugins first, database second). The jwt guard also takes its cookie names from the same list as the session routes (token, auth_token).
+
+G6 — /update changes email without proof
+As designed, not a bug. A new address clears email_verified_at and stays unproven until the owner completes an activation code or a reset-password. We are not adding a “confirm the new inbox before the change sticks” flow in this round. Say if you need that as a later feature.
+
+G7 — stock Users form has no role field
+As designed. organisation_role is intentionally off the stock form (an app extends the form). v0.1.8 already clears organisation_role when the organisation changes (members manager and the Users form). No further stock-form change.
+
+G8 — API token guard ignores tokens_valid_after
+As designed. Personal API tokens are revoked through revoked_at, not the JWT cutoff. Deactivate and ban already revoke those rows (RevokeUserAccess). A password reset is not supposed to kill API tokens; if you want that, say so and we will revoke the rows, not mix the two mechanisms.
+
+Cookie on /login
+Agreed as an opt-in. Sociallogin already has token_cookie for OAuth complete; password /login now has the same kind of flag (default off, so body-token clients stay unchanged).
+Ships in sm-user-plugin v0.1.9 (846087d and 8bdf2c7): set golem15.user.jwt.token_cookie: true (default false) and POST /login, POST /register (when it signs the new account in) and POST /activate-by-code set the HttpOnly session cookie with the auth.cookie attributes (bouncer.LoadCookieConfig: name token, path /, SameSite=Lax, Secure from app.url, Max-Age the refresh window) and leave token out of the body; user (and message) stay. A POST /refresh carried by that cookie rewrites it with the rotated token and answers {}; a bearer refresh is unchanged. With the key off, /login, /register and /activate-by-code return the body token as before; the /refresh cookie rewrite applies either way, because it follows the cookie the refresh arrived with, not this key. That is a change for a client that refreshes with only the token cookie and no Authorization header: it now gets {} and a rewritten cookie instead of the token in the body. SameSite stays Lax and there is no CSRF token. Keep auth.cookie.name at token or auth_token, the cookies the session routes read.
+
+Password-routes switch
+Agreed, in the user plugin, not as a framework “wrap another plugin’s routes” seam. A config key stops registering /login, /forgot-password and /reset-password so they 404.
+Ships in sm-user-plugin v0.1.9 (3828a65): set golem15.user.password.public_routes: false (default true; SUMMER_GOLEM15__USER__PASSWORD__PUBLIC_ROUTES=false in the environment) and POST /login, POST /forgot-password and POST /reset-password are not registered, so they answer the same 404 as any unknown path, whatever the method. POST /register stays (allow_registration still decides whether it takes accounts, and golem15.user.turnstile still guards it), as do /activate, /activate-by-code, /fetch, /refresh, /logout, /update, /change-password and /tokens. With the key true or unset nothing changes. The key is read when the routes are built, so a change needs a restart; a value other than true or false stops boot with an error naming the key.
+
+Login lockout keyed on RemoteAddr
+Agreed. /login used RemoteAddr; /register already uses the trusted-proxy client address. Behind a reverse proxy five failures locked everyone.
+Ships in sm-user-plugin v0.1.9 (b6f8055): /login counts failed logins per account and client address, and the client address is now the one /register and the user-api rate limit use: behind a proxy listed in http.trusted_proxies, the X-Forwarded-For client; otherwise the connection address. An X-Forwarded-For header from an address not in http.trusted_proxies is ignored, so it cannot dodge or move a lockout. List your nginx/Caddy address in http.trusted_proxies; without it every visitor still counts as the proxy.
+
+Same-second token refusal
+Agreed. JWT iat is whole seconds; some tokens_valid_after writers stamped sub-second time. RevokeUserAccess already truncates. Reset-password and the admin password set now do too.
+Ships in sm-user-plugin v0.1.9 (a484d0e): POST /reset-password and an administrator's password set on the Users form stamp tokens_valid_after with the current whole second, as deactivate and ban already do, so a token minted in the same second as the reset (the login right after it) is accepted and every token from an earlier second is still refused. As with deactivate and ban, a token issued earlier within that same second also stays valid, because iat has no finer resolution. /change-password and the guard's comparison are unchanged.
+```

.planning/notes/2026-10-22-mcp-go-sdk.md

@@ -0,0 +1,50 @@
+# Decision: the MCP endpoint uses the official Go SDK behind a build tag
+
+**Date:** 2026-10-22
+**Status:** Accepted
+**Context:** Phase 19.7 (generic MCP module, D-24, D-25, D-32, D-33), 19.7-RESEARCH.md § "Standard Stack", § "Package Legitimacy Audit", § "Architecture Patterns" (Pattern 8), plan 19.7-02 Task 1 (human legitimacy check, approved 2026-10-22)
+
+## Decision
+
+The framework module `pier` serves the MCP streamable HTTP endpoint on the official Go SDK and reflects tool schemas with the schema library the SDK itself uses.
+
+- **`github.com/modelcontextprotocol/go-sdk` pinned at v1.8.0.** Published 2026-09-04, the newest tag (`@latest` resolves to v1.8.0 on proxy.golang.org, 2026-10-22). Origin `https://github.com/modelcontextprotocol/go-sdk`, commit `3f3b699b2b67e1ed033a63d6651671dab53c2d32`, sum `h1:KIvahhYqwtbeniWVPs3TcXEA7b8jEtwfBpOTAI+Urx4=`. Licence: MIT transitioning to Apache-2.0 (new code Apache-2.0, older contributions MIT until relicensed; documentation CC-BY-4.0). `go 1.25.0` in its go.mod, so no toolchain change. Packages imported: `mcp` (server, sessions, streamable transport, test client), `auth` (bearer middleware, protected resource metadata handler), `oauthex` (the RFC 9728 metadata type), `jsonrpc` (error codes).
+- **`github.com/google/jsonschema-go` pinned at v0.4.3.** Published 2026-04-17, the newest tag. Origin `https://github.com/google/jsonschema-go`, commit `8c4ab4f02ef64dcea5502e47a6113e8292944087`, sum `h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0=`. Licence MIT. Package imported: `jsonschema` (`ForType` reflection of a tool's input struct, `Resolve` and `Validate` of every call's arguments).
+- **Only `modules/pier` imports either module**, plus the tagged `modules/surf/pier_on.go` that imports `pier`. `pact` stays free of both (its `TestPactStaysSDKFree` runs `go list -deps`), so a plugin declaring tools compiles with and without the module.
+- **Linked only with the `summercms_mcp` build tag (D-33).** `summer.yaml` `build.tags: [summercms_mcp]` passes it to `go build`, as `summercms_s3` does for the S3 driver. Without the tag `surf.mountPier` stays nil, `go version -m` of the binary lists no `modelcontextprotocol` module, and `mcp.enabled: true` fails boot naming the tag. With the tag the `mcp.enabled` flag still defaults to off (D-30).
+- **The SDK keeps stateful sessions only in process memory**, in `StreamableHTTPHandler.sessions`, with no pluggable store and a 404 for an unknown `Mcp-Session-Id`. D-25 (sessions shared across instances through Redis) is therefore built as pier's own session router over the exported `StreamableServerTransport{SessionID}` and `Server.Connect(ctx, t, &ServerSessionOptions{State})`: the JSON-serialisable `ServerSessionState` is stored in Redis and a session is rehydrated on whichever instance receives the next request. The SDK still owns JSON-RPC framing, SSE, protocol negotiation and `list_changed` debouncing; pier bypasses only the private session map. The 2026-07-28 protocol, which the SDK serves only through `StreamableHTTPOptions.Stateless`, gets the SDK's stateless handler next to the stateful router (D-32).
+
+## Measurements
+
+- **New modules in the graph** (measured with `go list -m all` on a scratch module importing `mcp`, `auth`, `oauthex` and `jsonschema`): `github.com/modelcontextprotocol/go-sdk v1.8.0`, `github.com/google/jsonschema-go v0.4.3`, `github.com/segmentio/asm v1.1.3`, `github.com/segmentio/encoding v0.5.4`, `github.com/yosida95/uritemplate/v3 v3.0.2`, `golang.org/x/oauth2 v0.35.0`, `golang.org/x/time v0.15.0`. `golang.org/x/sync` and `golang.org/x/sys` stay at the framework's newer v0.23.0 and v0.48.0 under minimal version selection. `github.com/golang-jwt/jwt/v5`, `golang.org/x/tools`, `github.com/google/go-cmp` and `cloud.google.com/go/compute/metadata` appear in the SDK's go.mod but are not linked by these packages; the framework already requires jwt/v5 and go-cmp at its own versions.
+- **Binary size: +2.9 MiB stripped** on a program importing `mcp`, `auth` and `jsonschema` next to a bare `net/http` program (8,835,335 vs 5,832,967 bytes, 19.7-RESEARCH.md). The scratch probe above with `oauthex` added builds to 7,782,663 bytes stripped. An application that already links `x/sys`, `x/oauth2` and `x/time` grows by less. The tag keeps every untagged binary at its current size.
+- **Vulnerabilities:** `govulncheck` v1.9.0 (`go run golang.org/x/vuln/cmd/govulncheck@latest ./...` over the scratch module, 2026-10-22): "No vulnerabilities found" in the code and in the imported packages. One module-level finding, GO-2026-5024 (`golang.org/x/sys/windows` `NewNTUnicodeString`, Windows only, fixed in x/sys v0.44.0), concerns the SDK's own minimum x/sys v0.41.0; the framework requires x/sys v0.48.0, above the fix, and no imported package calls the symbol. After the import lands, the same command runs as `go run golang.org/x/vuln/cmd/govulncheck@latest ./modules/pier/...` from the framework root.
+
+## Maintenance risk
+
+The SDK is maintained by the Model Context Protocol organisation together with the Go team, releases monthly, and tracks the specification closely (v1.8.0 supports 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05). The risk is churn, not abandonment: the `allowsessionsinstateless` compatibility knob is announced to go in v1.9.0, and the stateful `initialize` handshake is deprecated by the 2026-07-28 specification. pier contains both: plugins compile against `pact` only, the SDK types never appear in a plugin-facing signature, and the session router is about 300 lines over four exported SDK calls (`NewServer`, `Connect`, `StreamableServerTransport.ServeHTTP`, `NewStreamableHTTPHandler`). Re-check `@latest` before bumping; research's validity note dates the SDK audit at 2026-10-21.
+
+## Rejected alternatives
+
+- **`github.com/mark3labs/mcp-go`.** Not considered: D-24 locks the official SDK, which is the only one that follows the specification's monthly moves and ships the test client pier's smoke tests use.
+- **The SDK's `StreamableHTTPHandler` as the whole server.** Its session map is in-memory and unexported; two instances behind one load balancer would answer 404 for each other's sessions. The own router keeps D-25 and reuses every other SDK layer.
+- **A hand-written streamable HTTP transport.** JSON-RPC batching rules per protocol version, SSE priming events, `Last-Event-ID` resumption, header validation and version negotiation are specification edge cases the SDK already handles and tests.
+- **Always linking pier.** +2.9 MiB on every application for a feature most do not enable; the tag pattern already exists (`summercms_s3`).
+
+## Related dependencies
+
+- **`github.com/redis/go-redis/v9` v9.23.0** (already required, 19.3 `cooler`): session records, sliding TTL and pub/sub fan-out; `github.com/alicebob/miniredis/v2` v2.40.0 (already required) backs the Docker-free session tests.
+- **`golang.org/x/oauth2`**: new to the framework's graph through the SDK's `auth` package; already approved in 19.4 for the workspace (`sm-oauthserver-plugin` tests) and in 19.5 (`goth`).
+
+## Package legitimacy
+
+The package-legitimacy seam checks npm, PyPI and crates only, so both modules were [ASSUMED] in research and gated by a blocking human check (plan 19.7-02 Task 1) before any `go get`. The human approved exactly `github.com/modelcontextprotocol/go-sdk@v1.8.0` and `github.com/google/jsonschema-go@v0.4.3` on 2026-10-22, with the proxy origins, commits, sums and licences listed above gathered beforehand. The transitive modules listed under Measurements are covered by the same check.
+
+## Consequences
+
+- The framework `go.mod` gains `github.com/modelcontextprotocol/go-sdk v1.8.0` and `github.com/google/jsonschema-go v0.4.3` as direct requirements, added in the commit after this note (D-24: the note and the STACK.md row precede the import).
+- `grep -rl modelcontextprotocol/go-sdk modules --include=*.go` must list only `modules/pier/*` and `modules/surf/pier_on.go`; the phase gate (plan 05) asserts it, together with "only `modules/pier` calls `bouncer.WithDispatch` outside tests".
+- `examples/hello` and every application built without the tag carry no MCP code; `go version -m` of such a binary is the proof.
+- Applications that enable MCP add `summercms_mcp` to `summer.yaml` `build.tags` and set `mcp.enabled: true`; the `mcp.*` keys are documented in `modules/pier/README.md` and `docs/services/mcp.md`.
+
+Released in v0.4.4 (2026-10-23), opt-in behind the `summercms_mcp` build tag and `mcp.enabled`; the full MCP feature ships as v0.5.0 at phase 19.7 completion.

.planning/notes/2026-10-23-frontend-token-scopes.md

@@ -0,0 +1,51 @@
+# Decision: member token scopes use a separate pact capability
+
+**Date:** 2026-10-23
+**Status:** Accepted
+**Context:** Phase 19.7 gap closure, escalation E-2 (`19.7-GAP-INPUTS.md`), planner decision P-30 in plan 19.7-07 Task 2
+
+## Context
+
+sm-servers-app escalated E-2: member personal API tokens (`usr_`), which the user plugin issues, can only carry the fixed scopes `read`, `write` and `ai`. A plugin cannot declare its own, so a narrow agent token (`servers:read`, `servers:write`) falls back to the generic `write`, and every application sharing the token table gives the same scope a different meaning.
+
+What was asked:
+
+- the user plugin builds its allowed scope list from the built-ins plus plugin-declared scopes, validates names the way cabana does (pattern, no duplicates, no clash with the built-ins) and fails boot on a bad one;
+- minting, checking (`middleware.Scope`, `APIToken.HasScope`) and listing accept the declared scopes with no special casing;
+- a discovery endpoint or helper returns the scopes with name, translated label and description.
+
+What was not asked for:
+
+- a mint-time hook refusing a scope by the member's role;
+- any change to backend `g15_` tokens or the cabana token catalog;
+- any change to `tokens_valid_after` handling.
+
+The escalation left one design point open: reuse `pact.TokenScope`, or a twin for the frontend catalog.
+
+## Options
+
+1. **Reuse `pact.HasTokenScopes`.** The user plugin reads the same capability cabana reads.
+2. **An audience field on `pact.TokenScope`** (`Audience: "backend" | "frontend"`), with each catalog skipping the other audience's entries.
+3. **A separate capability**, `pact.FrontendTokenScope{Name, Label, Description}` and `pact.HasFrontendTokenScopes{ FrontendTokenScopes() []FrontendTokenScope }`, mirroring the existing `pact.Permission` / `pact.FrontendPermission` pair.
+
+## Decision and reasons
+
+Option 3, a separate capability. pact also gains `pact.ValidTokenScopeName(name string) bool`, carrying cabana's existing pattern `^[a-z][a-z0-9_-]*(:[a-z][a-z0-9_-]*)?$`, so both catalogs validate names identically.
+
+1. **The escalation asks for no change to the `g15_` catalog.** Reusing `HasTokenScopes` would show every member scope in the admin's token catalog and every admin scope in the member list. The two token kinds belong to different principals (an administrator against cabana permissions, a member against frontend routes); one list cannot describe both.
+2. **The admin type's fields do not apply to a member token.** `pact.TokenScope` carries `Permissions` (cabana permission patterns) and `Methods` (an HTTP method filter). A member route's `user.scope:<name>` middleware alone decides what a member scope allows. cabana's boot validation also requires both fields to be non-empty and the patterns to match registered permissions, so a member scope could not even be declared through it.
+3. **An audience field leaves fields meaningless for one audience.** `Permissions` and `Methods` would be dead for `frontend`, cabana would have to skip entries silently, and a typo in the audience would move a scope between catalogs without an error.
+
+## Consequences
+
+- The user plugin (sm-user-plugin, plan 19.7-08 Task 3) compiles `HasFrontendTokenScopes` from the active plugins, validates each name with `pact.ValidTokenScopeName`, refuses duplicates and clashes with `read`, `write` and `ai`, and fails boot on a bad scope. It owns minting, checking, listing and the discovery endpoint.
+- The framework never reads `HasFrontendTokenScopes`; cabana's `g15_` catalog is unchanged in behaviour and in every error message (it now calls `pact.ValidTokenScopeName` instead of its own copy of the pattern).
+- `pact.ValidTokenScopeName` is the single name rule; a future change to the pattern changes both catalogs together.
+- Reversibility is costly: `pact.FrontendTokenScope`, `pact.HasFrontendTokenScopes` and `pact.ValidTokenScopeName` are published framework API, so a reshape needs a deprecation cycle.
+
+## Related
+
+- `.planning/phases/19.7-generic-mcp-module/19.7-GAP-INPUTS.md`, section "E-2"
+- `.planning/phases/19.7-generic-mcp-module/19.7-07-PLAN.md`, P-30 and Task 2
+- `.planning/phases/19.7-generic-mcp-module/19.7-08-PLAN.md`, Task 3 (the user plugin side)
+- `modules/pact/capabilities.go`, `modules/cabana/token_scopes.go`

.planning/notes/2026-10-27-robots-txt-grobotstxt.md

@@ -0,0 +1,33 @@
+# Decision: the robots.txt tester uses grobotstxt
+
+**Date:** 2026-10-27
+**Status:** Accepted
+**Context:** Phase 32 (SEO foundation, D-22, D-24, D-99), 32-RESEARCH.md Standard Stack and Package Legitimacy Audit, plan 32-04 Task 4
+
+## Decision
+
+The robots.txt tester of `sm-seo-plugin` (element E5, widget action `robots_test`) and the check that warns when robots.txt blocks a noindex address (D-24) match URLs with `github.com/jimsmart/grobotstxt`.
+
+- **`github.com/jimsmart/grobotstxt` pinned at v1.0.3.** Published 2022-03-16 (proxy.golang.org), Apache-2.0, origin `github.com/jimsmart/grobotstxt` at tag `v1.0.3`. It is the newest tag.
+- **Why this library.** It is a function-for-function Go port of Google's C++ robots.txt parser and matcher (`google/robotstxt`), so the tester answers what Googlebot does:
+  - the longest matching rule wins, and `Allow` wins a tie with `Disallow`;
+  - `*` matches any run of characters and `$` anchors the end;
+  - user-agent groups are chosen as Google chooses them (the most specific group, else `*`);
+  - `RobotsMatcher.MatchingLine()` gives the line number of the deciding rule (0 when no rule matched), which E5 shows to the editor.
+- **What the plugin calls:** `NewRobotsMatcher()`, `(*RobotsMatcher).AgentAllowed(robotsBody, userAgent, uri)` and `MatchingLine()`. Nothing else, and only in `sm-seo-plugin/classes/robots.go`.
+- **Plugin-only.** Only `sm-seo-plugin` requires it. The framework `go.mod` does not, and `grep jimsmart/grobotstxt go.mod` in summercms.go stays empty.
+- **Imported packages:** the library imports the standard library only (`go list -deps` on a scratch module lists `github.com/jimsmart/grobotstxt` as its single non-stdlib package). Its go.mod requires ginkgo and gomega for its own tests; they reach a consumer's go.sum and are never compiled into a binary.
+
+## Rejected alternatives
+
+- **`github.com/temoto/robotstxt` v1.1.2** (2021, MIT). Older, with its own parser, no matching-line API, and no documented Google longest-match semantics.
+- **A hand-written RFC 9309 matcher** (about 200 lines). Standard library first and no stale dependency, but protocol code the project prefers to take from a maintained library, and Google's behaviour has edge cases the port already covers. RFC 9309 is frozen (2022), so a 2022 release of a faithful port is not a staleness risk in practice.
+
+## Package legitimacy
+
+The package-legitimacy seam cannot check Go modules, so grobotstxt was gated by a blocking human check (plan 32-03 Task 4) and approved by Jakub before any `go get`. The orchestrator verified that v1.0.3 resolves through proxy.golang.org; the licence file in the module is Apache-2.0.
+
+## Consequences
+
+- `sm-seo-plugin/go.mod` requires `github.com/jimsmart/grobotstxt v1.0.3`; applications that mount the plugin get it through the plugin.
+- If the library ever needs replacing, the tester's answer shape (allowed or blocked, the line and its text, blocked by a bot switch) is the plugin's own, so only `classes/robots.go` changes.

.planning/notes/2026-10-28-chromedp-rendered-crawl.md

@@ -0,0 +1,42 @@
+# Decision: the site audit's rendered comparison uses chromedp, optionally
+
+**Date:** 2026-10-28 (dependency approved 2026-11-04)
+**Status:** Accepted
+**Context:** Phase 33 (SEO output, audit and content, D-70), 33-CONTEXT.md "Rendered comparison (Jakub, 2026-10-28): optional chromedp", 33-RESEARCH.md Alternatives considered and Package Legitimacy Audit, plan 33-06 Task 4 (approval), plan 33-10 Task 4 (P33-55)
+
+## Decision
+
+The site audit's crawler (`sm-seo-plugin`, package `classes/crawl`) always checks the raw, server-rendered HTML. It compares a page's raw HTML with its JavaScript-rendered DOM only when an operator configures a Chrome or Chromium binary; without one every crawl records the comparison as skipped and says so (the crawl preview P6, `GET /_seo/api/v1/crawls/{id}` and the MCP tool `seo_get_crawl` answer `render {status: skipped}`).
+
+- **`github.com/chromedp/chromedp` pinned at exactly v0.21.0.** Published 2026-10-11 (proxy.golang.org, origin `github.com/chromedp/chromedp` at tag `v0.21.0`, commit `7862adfd`), MIT. Approved by Jakub on 2026-11-04 (33-06 Task 4). v0.21.1 and v0.22.0 exist but were under two weeks old at approval and are deliberately not used. Its go.mod requires `github.com/chromedp/cdproto` v0.157.8 and `github.com/go-json-experiment/json`; nothing else.
+- **Why this library.** A maintained pure-Go client of the Chrome DevTools Protocol: no cgo, no Node runtime, no bundled browser. It drives an operator-installed Chrome or Chromium binary (RESEARCH Alternatives considered: a raw-HTML-only crawl misses content that appears only after JavaScript; a Node headless browser would add a second runtime to a single-binary deployment).
+- **What is compared** (D-70, P33-55): same-host links, an H1, or a substantial amount of text (at least 50 words and 20 % more) that appear only after JavaScript are reported as `content_js` with `details.check: rendered`. The raw HTML against the CMS record stays `details.check: cms` and runs on every crawl.
+- **Chrome is optional and operator-installed.** Production servers have none by default. The executable path is the Go config key `golem15.seo.crawl_chrome_path` (environment-overridable like every key); `golem15.seo.crawl_render_max` (default 200) caps the pages rendered per crawl, in crawl order. An empty path skips the comparison; a relative path, or one that is not an executable regular file, records the comparison as failed with a note. The crawl itself never fails because of the renderer.
+- **The path comes from config only, never from an admin setting or MCP.** Any holder of `golem15.seo.manage` can write the SEO settings and call the SEO tools; a writable executable path would let them make the server run an arbitrary binary (T-33-69).
+- **Plugin-only.** Only `sm-seo-plugin` requires chromedp. The framework go.mod does not (D-90: the framework gets no SEO code), and `grep chromedp go.mod` in summercms.go stays empty.
+
+## The guard (P33-55)
+
+Headless Chrome executes untrusted page JavaScript on the server, so it is held to the crawler's `fetchguard` limits:
+
+- **Resolver pinning.** Before Chrome starts, the site host and its `www` twin are resolved and every address is checked with `fetchguard.IsPrivateAddr`; a private or reserved address refuses to start the renderer (render status failed, the note names the address) unless `golem15.seo.crawl_trusted` is true. The checked addresses go into `--host-resolver-rules` as `MAP <host> <address>` lines (one address per host, IPv4 first) followed by a final `MAP * ~NOTFOUND`, so every other host resolves to nothing and Chrome cannot re-resolve the site host to another address. Chrome applies the first rule that matches a host, so the catch-all must come last: with a leading `MAP * ~NOTFOUND` the site host itself fails with `ERR_NAME_NOT_RESOLVED` (checked against Chromium during 33-10; P33-55 had it leading).
+- **Request interception.** Every request is paused through the DevTools Fetch domain and continued only when it is `https` (`http` only in trusted mode) to the site host or its twin, or a `data:` or `blob:` URL; every other request fails with `BlockedByClient`. Third-party scripts, fonts, analytics and link-local metadata addresses are therefore never loaded.
+- **No state.** Each crawl uses a fresh temporary profile (`os.MkdirTemp`) removed when the renderer closes; no cookies, Authorization header, HTTP credentials or extensions; downloads denied. The crawler never signs in.
+- **Limits.** One tab renders at a time, 20 s per page, the DOM read with `OuterHTML` is capped at 5 MiB, and Chrome is closed when the crawl finishes, fails or is cancelled.
+- **Sandbox.** chromedp's default allocator flags are used without additions that weaken Chrome's sandbox (no `--no-sandbox`).
+
+## Rejected alternatives
+
+- **Raw HTML only.** No dependency and no browser on the server, but content and links that appear only after JavaScript go unreported, which D-70 asks the audit to find.
+- **`github.com/go-rod/rod`.** Also a pure-Go DevTools client, but it downloads a browser by itself by default and adds a larger API surface; chromedp's allocator takes an explicit executable path, which keeps the binary under operator control.
+- **A Node headless browser (Puppeteer, Playwright).** A second runtime next to the single binary.
+
+## Package legitimacy
+
+The package-legitimacy seam cannot check Go modules, so chromedp was gated by the blocking human check of plan 33-06 Task 4 and approved by Jakub (v0.21.0) before any `go get`. v0.21.0 resolves through proxy.golang.org with the origin above.
+
+## Consequences
+
+- `sm-seo-plugin/go.mod` requires `github.com/chromedp/chromedp v0.21.0` (and, through it, `github.com/chromedp/cdproto`); applications that mount the plugin get it through the plugin, and chromedp is compiled in whether or not a Chrome path is configured.
+- A site whose crawl should compare rendered pages installs Chrome or Chromium on the server and sets `golem15.seo.crawl_chrome_path`; nothing else changes.
+- If the library ever needs replacing, only `classes/crawl/render_chrome.go` changes: the crawler talks to the `crawl.Renderer` seam.

.planning/notes/2026-10-28-webp-gen2brain.md

@@ -0,0 +1,50 @@
+# Decision: WebP variants of attachment thumbnails through github.com/gen2brain/webp
+
+**Date:** 2026-10-28 (dependency approved 2026-11-04)
+**Status:** Accepted
+**Context:** Phase 33 (SEO output, audit and content, D-85), 33-CONTEXT.md "Image formats (Jakub, 2026-10-28): WebP now, in Go", 33-RESEARCH.md Open Question 3 and Package Legitimacy Audit, plan 33-06 Task 4 (approval), plan 33-11 (P33-42, P33-43)
+
+## Decision
+
+Sites serve their featured images as `<picture>` with a WebP source and the original format as the `srcset` fallback. The WebP files are encoded in Go, once per thumbnail size, in a background job, never in the upload request. AVIF is deferred.
+
+- **`github.com/gen2brain/webp` pinned at exactly v0.6.4.** Published 2026-07-01 (proxy.golang.org, origin `github.com/gen2brain/webp` at tag `v0.6.4`, commit `3dcf5268`), MIT (the bundled libwebp under its BSD licence, `lib/LICENSE.libwebp`). Approved by Jakub on 2026-11-04 (33-06 Task 4). Its go.mod requires `github.com/ebitengine/purego` v0.10.1 and nothing else.
+- **Why this library.** `golang.org/x/image/webp`, which `attach` already uses, decodes only; the standard library has no WebP encoder. cgo bindings to libwebp would break the cgo-free build of the single binary. gen2brain/webp encodes in Go without cgo.
+- **What is encoded.** Each thumbnail a caller asks for (`attach.File.ThumbKey` at a width, height and mode) gets one WebP variant next to it, at quality 80, under `attach.VariantKey(thumbKey, "webp")`. The original upload is never re-encoded, and images an editor inserts into a body keep their original file.
+- **Where it runs.** Journal's conga job `golem15.journal.image_variants` is dispatched after a featured image upload commits, and `journal:image-variants --all` backfills existing images. A slow or failing encode never fails the upload.
+
+## How it runs (checked in the v0.6.4 module source, 2026-11-04)
+
+- **First choice: the system libwebp through purego.** At init the package opens `libwebp.so` and `libwebpdemux.so` with `purego.Dlopen` (no cgo). On Linux this only works in a dynamically linked binary.
+- **Fallback: libwebp transpiled to Go.** When the libraries are missing (or with the build tag `nodynamic`), it uses libwebp compiled to WASM and then transpiled to plain Go source by wasm2go (`libwebp.go`, about 2.7 MB of generated Go). There is no WASM runtime at run time and no wazero; 33-CONTEXT's "WASM fallback" means this transpiled code. `webp.Dynamic()` reports which path is active.
+- **Linking consequence.** purego's no-cgo runtime support makes a binary that imports the package dynamically linked, even with `CGO_ENABLED=0`: the probe binary needed the ELF interpreter `/lib64/ld-linux-x86-64.so.2` and `libc.so.6`, `libdl.so.2` and `libpthread.so.0`. It runs on glibc hosts such as the Debian servers. It does not run in a `scratch` image, a distroless static image or on musl (Alpine). Building with `-tags nodynamic` keeps the binary statically linked and uses only the transpiled code (checked: `statically linked`, `Dynamic()` reports "dynamic disabled").
+- **Side effect.** The package registers a `webp` decoder with `image.RegisterFormat`, next to the one `golang.org/x/image/webp` registers. Both decode WebP, so `image.Decode` keeps working whichever one it picks.
+
+## Benchmark
+
+- **33-CONTEXT, 2026-10-28.** A 1200 px variant of a 2592×1754 photo: WebP 78 KB against JPEG q80 at 133 KB. Encoding took about 90 ms with the system libwebp and about 510 ms in the fallback. AVIF came out only about 6 % smaller than WebP, at 1.3× to 20× the CPU.
+- **Probe of v0.6.4 on 2026-11-04** (this workstation, a synthetic 1200×812 gradient, quality 80): about 17 ms through the system libwebp and about 90 ms in the transpiled fallback. WebP was 29.8 KB against 58.4 KB for JPEG q80. The two runs used different images and machines, so compare the paths with each other, not the numbers across runs.
+
+## Where the code lives (P33-42)
+
+- **Framework, generic media.** `modules/lagoon/attach/webp` (package `webp`): `Encode(w, img)` at quality 80 and `Variant(ctx, bucket, f, w, h, mode)`. `Variant` writes the variant next to the thumbnail, returns early when it exists, and deletes the key when an encode or close fails. In `attach` itself there is one generic helper, `attach.VariantKey(thumbKey, format)`.
+- **Why it is not SEO code.** A WebP variant of a thumbnail is a media format. It has nothing to do with SEO, and the framework gets no SEO wording (D-90). The addition is additive at patch level (D-106).
+- **Only binaries that import it link it.** `attach` does not import the sub-package, so a binary links gen2brain/webp, purego and the linking consequence above only when it imports `modules/lagoon/attach/webp`. In practice that means through sm-journal-plugin.
+- **The job lives in Journal.** Only plugins register conga jobs, and Journal owns the featured images and their variants table (`golem15_journal_image_variants`, P33-43).
+
+## Rejected alternatives
+
+- **AVIF through `github.com/gen2brain/avif`.** About 6 % smaller than WebP at 1.3× to 20× the CPU. Deferred.
+- **A Nuxt image pipeline (sharp).** New npm dependencies with a native module, and the encoding would move into the frontend server.
+- **cgo bindings to libwebp.** They break the cgo-free cross-compiled builds the applications use.
+- **Widths only, no new format.** This needs no dependency, but D-85 asks for a modern format.
+
+## Package legitimacy
+
+The package-legitimacy seam cannot check Go modules, so gen2brain/webp was gated by the blocking human check of plan 33-06 Task 4 and approved by Jakub at v0.6.4 before any `go get`. v0.6.4 resolves through proxy.golang.org with the origin above (`h1:SUDdmxADOAiPQ+5ylNmuHhuYf2dOi0KgKZHL5vpVCNU=`).
+
+## Consequences
+
+- The framework go.mod requires `github.com/gen2brain/webp v0.6.4` (and, through it, `github.com/ebitengine/purego v0.10.1`). Only packages under `modules/lagoon/attach/webp` import it.
+- An application that mounts sm-journal-plugin links the encoder. Its binary is dynamically linked against glibc unless it is built with `-tags nodynamic`. Installing libwebp on the server makes encoding about five times faster, and nothing else changes. The package opens the unversioned names `libwebp.so` and `libwebpdemux.so`, which Debian ships in `libwebp-dev`.
+- If the library ever needs replacing, only `modules/lagoon/attach/webp/webp.go` changes. Callers use `Encode` and `Variant`.

.planning/notes/2026-10-29-plugin-marketplace.md

@@ -0,0 +1,44 @@
+# Decision: Plugin marketplace on summercms.io and `summer plugin:install`
+
+**Date:** 2026-10-29  
+**Status:** Accepted (exploration)  
+**Context:** `/msd-explore` session on summercms.io/marketplace, modelled on octobercms.com/marketplace
+
+## Scope of v1
+
+- The marketplace lists the public Golem15 plugins (`sm-*-plugin` repos that stay public). No paid plugins and no developer registration: Golem15 publishes every listing.
+- Its job is browsing plugins and getting the install command, nothing more.
+
+## Decisions
+
+### Listing data: facts in the repo, presentation on summercms.io
+
+- Each plugin repo carries a `plugin.yaml` manifest next to `plugin.go`: plugin ID, module path, name, description, required framework version, required plugins. The README and git tags (`vX.Y.Z`) complete the facts.
+- summercms.io ingests the manifest, README and tags when a plugin is tagged. The hook is the existing `scripts/changelog-post.py publish … --repo ../sm-<name>-plugin` step or a webhook.
+- Presentation fields (category, featured flag, screenshots, icon, sort order) are edited in the summercms.io admin, in the `golem15.summercms` site plugin.
+- Reason: install-critical data (module path, versions, requirements) cannot drift from the repo, while marketing details change without a plugin release. A repo manifest also leaves room for third-party submissions later (submit a repo URL).
+
+### `summer plugin:install`
+
+The form of the argument decides where the plugin comes from:
+
+| Argument | Lookup | Default install mode | Override |
+|----------|--------|----------------------|----------|
+| Plugin ID, e.g. `golem15.journal` | summercms.io registry API: module path, versions, requirements | Go module (`require` in `go.mod`, `go mod download`) | `--source`: git submodule checkout at `plugins/<vendor>/<name>`, as `plugin:add` does today |
+| Git URL, e.g. `git@github.com:acme/sm-servers-plugin.git` | None. summercms.io is never contacted. ID and requirements come from the repo's `plugin.yaml`, module path from its `go.mod` | Git submodule checkout, which reuses the SSH access the user already has | `--module` (see the open research question on private modules) |
+
+- Git URLs cover closed or private plugins from repositories the user has access to.
+- Both modes end with the same registration that `plugin:add` does (`summer.yaml`, `go.mod`, `go.work` where applicable), then `summer build`.
+- Precondition: public plugin repos on git.golem15.com fetch anonymously (HTTPS clone and `?go-get=1` meta). Confirmed as the intent for public plugins on 2026-10-29.
+
+### Admin "Plugins" screen (read-only)
+
+- **Installed** tab: the activated plugins from `backpack.App`, with version and description, and updates available compared against the registry.
+- **Marketplace** tab: searches the summercms.io registry and shows `summer plugin:install <id>` with a copy button. There is no install button.
+- The running binary never installs plugins. Plugins are compiled in; runtime loading stays rejected (`why-go-not-scala.md`, `.planning/research/FEATURES.md` anti-features). Queued installs and dev-mode live installs were considered and dropped as unnecessary for v1.
+
+## Out of scope for v1
+
+- Paid plugins, licensing, developer accounts and submissions.
+- Themes in the marketplace.
+- Installing from the admin panel.

.planning/notes/core-plugin-port-inventory.md

@@ -56,6 +56,8 @@ Third-party plugins in many projects: `winter/location` is in 19, `winter/blocks
 5. **Phase 20, Płytarium cutover.**
 6. **After Phase 20:** the Horoskopia port comes first, then the Wavepath port. Neither is planned yet. This stretch is about preparing the shared plugins, not migrating apps, and a stabilization phase may come first. See the seeds for both ports.
 
+**Superseded 2026-10-18** (`.planning/notes/2026-10-18-roadmap-reorder-demo-release-wavepath.md`): Phase 20 is a demo instance with every shared plugin, Phases 21 to 29 are added as needed, the Płytarium cutover is Phase 30, the WavePath phases are 31 to 35 (from 2026-10-11 WavePath comes before Horoskopia), and Horoskopia-driven development is 36 to 40.
+
 ## Related
 
 - `core-plugins-own-repos.md`: each shared plugin gets an `sm-<name>-plugin` repo

.planning/notes/journal-html-sanitizing-bluemonday.md

@@ -29,6 +29,17 @@ Everything else that UGC refuses is refused: `script`, `style`, `iframe`, `objec
 - **Byte-stable when nothing is stripped.** `sanitizeHTML` returns the goldmark output unchanged when that output and bluemonday's output tokenize to the same tokens: the same type, tag name, decoded text and set of decoded attributes. Otherwise it returns bluemonday's output. bluemonday re-escapes `"` as `"` and `'` as `'`, so storing its output every time would rewrite every imported post on its next save. Returning the original bytes is safe only on that token-level equality. Any element, attribute or comment that the policy drops makes the tokens differ, and then the sanitized output is stored.
 - **Category content refuses.** `classes.CheckHTML` keeps its exported signature and its 422 contract. D-21 stores category content exactly as submitted, and `TestCategoriesAdminContent` asserts a 422 for unsafe content. CheckHTML now uses the same policy and comparison, and refuses whenever the policy would change the HTML.
 
+- **Amended 2026-10-10 (Phase 16.2 D-10): category content strips too, and admin saves report what was stripped.** The user chose one rule for both: post and category admin writes store the sanitized output and never fail. `CheckHTML`'s 422 contract for categories and the `TestCategoriesAdminContent` 422 assertion are retired in Phase 16.2. Winter stored category content unsanitized; that was a gap, not a contract. When the policy removes anything, the admin save response names what was removed. The policy (and the layer's sanitize-html mirror) is extended only for the Blog Editor's own output, such as the `figure data-embed`/`data-id` embed placeholder.
+
+  Phase 16.2 plan 03 implements this. The Blog Editor field types decode every locale's value with `classes.SanitizeHTMLReport`, store its output (the submitted bytes when nothing is removed) and return what was removed as admin notices; an admin save of post content writes the same HTML to `content` and `content_html` without goldmark. `newHTMLPolicy` gains exactly four rules for the editor's own output, and nothing else (no iframe, no other `data-*` attribute, no `target`, `rel`, style property or URL scheme). Plan 02's `tests/blogeditor/fixtures/editor-corpus.json` pins them: `TestEditorOutputPassesPolicy` requires every corpus entry to come back from `SanitizeHTML` byte for byte with an empty report, and checks that other providers, malformed ids and other attributes are still stripped. Plan 04 adds the same four rules to the layer's sanitize-html mirror and checks the same corpus. A fifth rule is added only to both policies together.
+
+  | Change (Phase 16.2) | Why |
+  |---|---|
+  | `data-embed` matching `^youtube$` on `figure` | The editor's embed placeholder `<figure data-embed="youtube" data-id="..."></figure>`; the layer expands it, no iframe is stored. |
+  | `data-id` matching `^[A-Za-z0-9_-]{11}$` on `figure` | The YouTube video id of the same placeholder. |
+  | `alt` with any text on `img` | The editor's alt field takes free text; UGC's `Paragraph` pattern drops `:`, `?`, `"` and more. The value is escaped on output and carries no URL. |
+  | `start` matching `^[0-9]+$` on `ol` | TipTap's ordered-list input rule writes it when a list does not start at 1. |
+
 - **Translations follow the same rule (2026-10-10, audit W-1).** `classes.FormatTranslation` runs on every locale of every API and import write: a non-blank `content` re-derives `content_html` with `FormatHTML` (a supplied `content_html` is replaced, as for the host column); a `content_html` sent alone goes through `classes.SanitizeHTML`, the same policy. A translation keyed on the default locale, which `translate.SetTranslated` writes straight into the host column, is covered too. PHP stored a client-supplied translated `content_html` as-is on the API and import paths; the port follows the PHP admin widget, which always derived it.
 - **Duplicate attributes count as a change (audit W-2).** `golang.org/x/net/html` drops a repeated attribute while tokenizing, so the byte-stable comparison could not see `href="https://x" href="javascript:..."`. `htmlTokens` compares the raw attribute names of each start tag (`rawAttrNames`) with the attributes the tokenizer kept; any difference stores the sanitized output and makes `CheckHTML` refuse.
 

.planning/notes/wavepath-framework-asks-division.md

@@ -0,0 +1,47 @@
+---
+title: How the WavePath framework asks divide between SummerCMS and WavePath
+date: 2026-10-11
+context: /msd-explore on the WavePath hand-off list `/media/nvme/dev/jz/wavepath.org/.planning/notes/summercms-framework-asks-for-wavepath.md`. Seed `SEED-261007-0tb`.
+---
+
+# How the WavePath framework asks divide between SummerCMS and WavePath
+
+WavePath's agent wrote a list of what it needs from SummerCMS (section A) and what it will do itself (section B). Section B stays on the WavePath side as its migration milestone. Section A lands here as the 19.x phases, all before the Płytarium cutover (Phase 20).
+
+## Decisions
+
+> **Updated 2026-10-18** (`.planning/notes/2026-10-18-roadmap-reorder-demo-release-wavepath.md`): the Płytarium cutover is now Phase 30, after a demo instance at Phase 20. Chat parity against WavePath's clients moved from 19.2 to Phase 31 and opens the WavePath phases (31 to 35). The other 19.x phases still land before the cutover. Phase numbers below are as of 2026-10-11.
+
+- **The 19.x block comes before the cutover.** Chat first, then chat polish, then the other framework and user-plugin asks. Phase 20 waits for 19 to 19.6. The WavePath migration milestone opens after Phase 20.
+- **Chat is ported from the WavePath copy**, with `root_id` threading and `thread_summaries`. This settles the open chat-source question for Phase 19.
+- **The seed's trigger is now "Phase 20 complete".** The WavePath milestone no longer waits for the Horoskopia port.
+
+## Where each ask lands
+
+| Ask | Where |
+|---|---|
+| A9: chat and chatchannels | Phase 19 |
+| A9: chatbots, chatvideo (LiveKit, reconcile job), forum, herald (web push), userfriends | Phase 19.1 |
+| Chat parity against WavePath's clients | Phase 19.2, now Phase 31 |
+| A3 cookie refresh and CORS, A6 cache and Redis `surf.Store`, A8 S3 option, `/api-docs`, Turnstile | Phase 19.3 (`summercms.go`) |
+| A1 OIDC provider | Phase 19.4 (`wristband`) |
+| A2 social login | Phase 19.5 (`sm-user-plugin`) |
+| A4 2FA, A5 device flow | Phase 19.6 (`sm-user-plugin`) |
+| A7 `summer import:winter` | Phase 20, now Phase 30 (D-02 runner), with the WavePath stress cases below |
+
+## Corrections to the hand-off list
+
+- **The user plugin is already shared.** `sm-user-plugin` (`git.golem15.com/golem15/sm-user-plugin`) is its own repo, checked out by both fonoteka.go and sm-bm-app. Phases 19.5 and 19.6 add to it directly. Both consuming apps must still build after each change.
+- **Plugin-registrable token scopes (A8) are dropped for now.** `sm-user-plugin` already mints scoped tokens (`MintAPIToken`, `HasScope`). Its allowed list (`read`, `write`, `ai`) is a static package variable. WavePath's `wave.scope.public:*` scopes belong to its own `wave_token` guard and `golem15_wavepath_api_tokens` table, which section B ports on the WavePath side. Add a `RegisterAPITokenScope` hook only if WavePath confirms that its user-plugin tokens carry custom scopes.
+
+## `import:winter` stress cases from WavePath (for Phase 30, formerly 20)
+
+- The source is MariaDB. That is the same MySQL wire protocol, but check type coercion.
+- About 90 tables, including large chat and channel message tables. Batching must handle them.
+- APP_KEY-encrypted columns go through the Laravel-decrypt hook.
+- Zero-knowledge encryption-key blobs are copied byte for byte and never decoded.
+- `system_files` across 16 attaching models, and 9 `system_settings` rows.
+
+## Scope reminder
+
+The WavePath backend is about 350 routes, about 90 tables and 164 migrations across `wavepath` and its shared plugins. The PHP routes are not frozen, so re-count when the milestone opens.

.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-SECURITY.md

@@ -0,0 +1,139 @@
+---
+phase: "06"
+slug: "http-routing-auth-groups-and-rate-limiting"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+threats_total: 38
+threats_closed: 38
+accepted_risks: 4
+asvs_level: 1
+block_on: high
+register_authored_at_plan_time: true
+created: "2026-10-12"
+---
+
+# Phase 06 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+Detailed per-threat findings, grep evidence and the reopen history (Plan 06-11's verdict superseded by 06-12 to 06-14) live in `06-SECURITY-REVIEW.md`. This file is the gate contract derived from all fourteen `<threat_model>` blocks. Framework paths are relative to `summercms.go/modules/`; app paths are relative to `fonoteka.go/`.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| client → Authorization header | untrusted JWT or `inv_` bearer parsed on every request | raw token, token hash, user id (high) |
+| guard registry → plugin Boot | plugin-declared guard names become live auth middleware | guard names, guard values |
+| inv_token guard → api_tokens table | hash-indexed lookup of an untrusted bearer | token_hash, scopes, expiry, revocation (high) |
+| client → X-Forwarded-For / limiter keys | untrusted IP, token id, route param feed the limiter store | RemoteAddr, XFF, `tok:<id>` |
+| request metadata → anonymous inline key | throttle text and Host inputs must not select a fresh budget | `inline:domainless`, trusted ClientIP |
+| public-share group → anonymous caller | zero-credential surface; errors must not leak internals | 429 body, cache/robots headers |
+| raw group → house middleware | RFC/OAuth surface must never inherit the house envelope | middleware names |
+| request body → middleware and handler | unbounded body is a resource-exhaustion vector | request body bytes |
+| handler/middleware → client response | partial output must not escape on panic | status, headers, body |
+| caller URL / DNS answer → outbound dial | SSRF to loopback, RFC1918, CGNAT, metadata, special-use, transition and zoned addresses | dial-time IP, host allow-list (high) |
+| personal-token context → denial serializer | 401/403 bytes are part of the PHP compatibility contract | exact JSON bytes |
+| test evidence → security sign-off | verdict must follow executed proof | review document, gate output |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-06-01 | Spoofing | bouncer.Registry.Register | high | mitigate | duplicate/unknown/neither-interface guards fail boot; `bouncer/registry_test.go:TestDuplicateGuardNameFailsWithPluginAndName`, `TestUnknownGuardNameFails`, `TestRegisterNeitherInterfaceNamesPluginAndName` | closed |
+| T-06-02 | Elevation of Privilege | jwt vs inv_token groups | high | mitigate | `plugins/golem15/fonoteka/routes_isolation_test.go:TestFullRouteTableAuthGroupMutualExclusivity`; `routes_group_test.go:TestGenresSharedHandler` | closed |
+| T-06-03 | Information Disclosure | ApiToken.TokenHash | medium | accept | hidden via `json:"-"`/Hidden(); `classes/hidden_marshal_test.go:TestHiddenNeverMarshals` | closed |
+| T-06-04 | Repudiation | last_used stamping | low | mitigate | single UpdateColumns, no bearer logging; `classes/auth/token_guard_test.go:TestTokenGuard` | closed |
+| T-06-05 | Tampering | SHA-256 hash lookup timing | low | accept | indexed equality lookup, not a secret byte compare | closed |
+| T-06-06 | Denial of Service | surf.ClientIP | medium | mitigate | XFF honored only from `http.trusted_proxies`; `surf/clientip_test.go:TestClientIPRejectsSpoofedXFF` | closed |
+| T-06-07 | Information Disclosure | public-share 429 | medium | mitigate | fixed JSON body + no-index/no-store; `middleware/public_share_headers_test.go:TestPublicShareHeadersRewrites429` | closed |
+| T-06-08 | Denial of Service | MemoryStore cardinality | medium | accept | sweep bounds growth (D-03); `surf/limiter_coverage_test.go:TestMemoryStoreSweepRemovesExpiredEntry` | closed |
+| T-06-09 | Repudiation | parity fixtures under APP_DEBUG | low | mitigate | `parity/php_debug_test.go:TestPHPParityPinsAppDebugFalse` | closed |
+| T-06-10 | Elevation of Privilege | full route-table exclusivity | high | mitigate | `routes_isolation_test.go:TestFullRouteTableAuthGroupMutualExclusivity` over real `Router.Routes()` | closed |
+| T-06-11 | Tampering | raw-group house-middleware refusal | medium | mitigate | `surf/routetable_test.go:TestRawGroupHouseMiddlewareRefusedAtBuild`; `routes_cors_test.go:TestRawGroupRefusesHouseMiddlewareOnRealPlugins`, `TestHouseMiddlewareCapabilityOnRealPlugins` | closed |
+| T-06-12 | Denial of Service | unbounded request body | high | mitigate | MaxBytesReader on non-raw routes; `surf/bodylimit_test.go:TestBodyLimitDefaultRejectsOversizedBody`, `TestBodyLimitRawExempt` (middleware gap closed by T-06-28) | closed |
+| T-06-13 | Information Disclosure | body limits shipped as a guess | low | mitigate | operator-confirmed 128M; `http_config_test.go:TestProductionBodyLimitsOperatorConfirmed` | closed |
+| T-06-14 | Elevation of Privilege | SSRF to internal/metadata | critical | mitigate | dial-time Control in both modes; `fetchguard/fetch_test.go:TestFetchPrivateIPBlockedInBothModes`; `fetchguard/ip_test.go:TestIsReservedOrPrivate` | closed |
+| T-06-15 | Tampering | DNS rebinding | high | mitigate | check runs on the connected address; `TestFetchPrivateIPBlockedInBothModes` | closed |
+| T-06-16 | Denial of Service | unbounded response body | medium | mitigate | streaming LimitReader + timeout; `fetchguard/fetch_test.go:TestFetchTooLargeIsStreaming` | closed |
+| T-06-17 | Elevation of Privilege | redirect to private address | high | mitigate | no automatic redirects; `fetchguard/fetch_test.go:TestFetchDoesNotFollowRedirect` | closed |
+| T-06-18 | Spoofing | dotted-suffix allow-list bypass | high | mitigate | `TestFetchAllowHostsRejectsDottedSuffixBypass`; `fetchguard/fetch_coverage_test.go:TestHostAllowedExactAndDottedSuffix` | closed |
+| T-06-19 | Repudiation | security review completeness | low | mitigate | `06-SECURITY-REVIEW.md` maps every implementation ID; this file maps all 38 | closed |
+| T-06-20 | Tampering | coverage gaps hiding defects | low | mitigate | 06-05 coverage tests (`*_coverage_test.go`); 06-14 regression tests | closed |
+| T-06-21 | Denial of Service | personal-token genres chain | high | mitigate | `inv_token` → `throttle` → `inv.scope`; `routes_isolation_test.go:TestPersonalTokenGenresUnauthenticatedRequestsAreRateLimited` | closed |
+| T-06-22 | Denial of Service | fonoteka-api-token key selection | medium | mitigate | credential resolved before key closure (`tok:<id>`); same test + route-order invariant | closed |
+| T-06-23 | Denial of Service | Store / FixedWindowLimiter | high | mitigate | atomic Attempt; `surf/limiter_test.go:TestMemoryStoreConcurrentAttempt`, `TestFixedWindowLimiterConcurrentMaxOne` | closed |
+| T-06-24 | Denial of Service | inline anonymous key | high | mitigate | `inline:domainless|<ClientIP>`; `surf/limiter_test.go:TestFixedWindowLimiterInlineThrottleKeys` | closed |
+| T-06-25 | Elevation of Privilege | IPv6 transition SSRF | critical | mitigate | NAT64/6to4 decode; `fetchguard/ip_test.go:TestIsReservedOrPrivateIPv6Transitions`; `fetch_test.go:TestDialControlRejectsUnsafeIPv6Transitions` | closed |
+| T-06-26 | Information Disclosure | panic recovery | medium | mitigate | buffered commit; `surf/router_test.go:TestRecoverDiscardsPartialResponse`, `TestBufferedResponseCommitsSuccessfulOutput` | closed |
+| T-06-27 | Tampering | InvScope 401/403 bytes | medium | mitigate | `wire.WriteJSON`; `middleware/token_scope_test.go:TestInvScope` | closed |
+| T-06-28 | Denial of Service | body limit vs named middleware | high | mitigate | bodyLimit outermost; `surf/bodylimit_test.go:TestBodyLimitBoundsBodyConsumingMiddleware`, `TestBodyLimitBoundsNamedMiddleware`, `TestBodyLimitInvalidParamFailsBoot` | closed |
+| T-06-29 | Denial of Service | limiter definitions | high | mitigate | fail closed; `surf/limiter_test.go:TestRegisterBucketRejectsInvalid`, `TestValidateThrottleRejectsOverflowAndNilStore`, `TestMiddlewareFailsClosed` | closed |
+| T-06-30 | Elevation of Privilege | IANA special-use ranges | critical | mitigate | `fetchguard/ip_test.go:TestIsReservedOrPrivateIANABoundaries`, `TestIsReservedOrPrivateSpecialUseSmoke` | closed |
+| T-06-31 | Elevation of Privilege | zoned IPv6 dial | high | mitigate | `ip_test.go:TestIsReservedOrPrivateIgnoresZone`; `fetch_test.go:TestDialControlRejectsZonedAndSpecialUse`, `TestFetchPublicOnlyMapsSpecialUseToPrivateIP` | closed |
+| T-06-32 | Denial of Service | typed-nil guard | medium | mitigate | `bouncer/registry_test.go:TestRegisterRejectsTypedNilGuard`, `TestRegisterRejectsTypedNilPointerFuncMapGuards`, `TestRegisterAcceptsValidGuards` | closed |
+| T-06-33 | Spoofing | JWT numeric subject | high | mitigate | `bouncer/jwt_test.go:TestVerifyRejectsFractionalSubject`, `TestVerifySubjectMatrix`, `TestSubjectJSONNumber` | closed |
+| T-06-34 | Denial of Service | ServeMux conflict panic | medium | mitigate | `surf/bodylimit_test.go:TestCompileRouteConflictReturnsError`; `surf/router_test.go:TestFactoriesBuiltOncePerName` | closed |
+| T-06-35 | Denial of Service | missing body_limits config | medium | mitigate | `surf/router_test.go:TestBuildRouterFailsOnMissingBodyConfig`; `surf/bodylimit_test.go:TestBodyLimitMissingConfigFailsBoot` | closed |
+| T-06-36 | Repudiation | 06-SECURITY-REVIEW.md verdict | low | mitigate | verdict follows 06-14 gate output; superseded 06-11 row retained; re-checked by this audit | closed |
+| T-06-37 | Tampering | test suite loosening checks | low | mitigate | 06-14 reported the factory-cache defect and fixed it (1d2e00c) instead of masking it | closed |
+| T-06-SC | Tampering | package supply chain | low | accept | swag/openapi-typescript passed 06-RESEARCH package audit; 06-06 to 06-14 add no dependencies | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+Severities were not recorded in the plans; they are assigned in this audit. No threat is open, so the assignment does not affect the gate.
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-06-01 | T-06-03 | Already hidden via json:"-" and Hidden() (Phase 5, verified by 05-06's hidden-marshal test); this plan adds no new serialization path for the hash | Plan 06-01 | 2026-09-19 |
+| AR-06-02 | T-06-05 | Indexed equality lookup (not a byte-for-byte secret compare) is not a timing side-channel per RESEARCH.md's V6 Cryptography note; crypto/subtle is reserved for a future raw-compare path (e.g. OAuth client secrets, Phase 8), not needed here | Plan 06-01 | 2026-09-19 |
+| AR-06-03 | T-06-08 | v1 ships an unbounded-until-swept map per CONTEXT D-03's explicit "no otter/cooler this phase" decision; the sweep goroutine bounds long-term growth to roughly one decay window's worth of distinct keys, acceptable for a single-instance v1 deployment | Plan 06-02 | 2026-09-19 |
+| AR-06-04 | T-06-SC | Both packages are STACK.md-named and pass 06-RESEARCH.md's Package Legitimacy Audit (Approved disposition, no [ASSUMED]/[SUS] verdicts); later gap plans add no dependencies | Plan 06-03 | 2026-09-19 |
+
+*Accepted risks do not resurface in future audit runs.*
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-09-19 | 19 | 19 | 0 | gsd-executor (06-05) |
+| 2026-09-20 | 21 | 21 | 0 | gsd-executor (06-06) |
+| 2026-09-21 | 26 | 26 | 0 | gsd-executor (06-11), superseded |
+| 2026-09-21 | 34 | 34 | 0 | gsd-executor (06-14) |
+| 2026-10-12 | 38 | 38 | 0 | msd-secure-phase (L1, auditor skipped by short-circuit) |
+
+### Security Audit 2026-10-12
+
+| Metric | Count |
+|--------|-------|
+| Threats found | 38 |
+| Closed | 38 |
+| Open | 0 |
+
+- Register built from all 14 PLAN `<threat_model>` blocks. It adds T-06-19, T-06-20, T-06-36 and T-06-37 (process threats from 06-05 and 06-14), which `06-SECURITY-REVIEW.md` did not list.
+- SUMMARY threat flags: only 06-10 has one ("None").
+- All 53 cited test functions were found by grep at their current paths (framework packages now live under `modules/`).
+- `go test -short -count=1` passed for `modules/bouncer`, `modules/surf` and `modules/fetchguard` in summercms.go, and for `./plugins/golem15/fonoteka/...`, `./parity` and the root package in fonoteka.go.
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-12

.planning/phases/08-oauth2-1-authorization-server/08-SECURITY.md

@@ -0,0 +1,96 @@
+---
+phase: "08"
+slug: "oauth2-1-authorization-server"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+threats_total: 11
+threats_closed: 11
+accepted_risks: 0
+asvs_level: 1
+block_on: high
+register_authored_at_plan_time: true
+created: "2026-10-12"
+---
+
+# Phase 08 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+Detailed per-threat findings and named test evidence live in `08-SECURITY-REVIEW.md` (2026-09-24, performed by the 08-10 executor, not an independent auditor; see its Reviewer Note). This file is the gate contract derived from all ten `<threat_model>` blocks. The plans carry no severity column; severities below are assigned at this audit. Framework paths are relative to `summercms.go/modules/`; app paths are relative to `fonoteka.go/plugins/golem15/fonoteka/`.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| connector → raw `/.well-known` and `/oauth/mcp/*` routes | untrusted discovery, authorize, register and token traffic on raw (unguarded) routes | client metadata, redirect URIs, PKCE challenge/verifier, client secret (high) |
+| validated redirect → `Location` | client-controlled redirect trusted only after exact allow-list match | code, state, error (high) |
+| wristband records → GORM | app-agnostic code/refresh/client state persisted with row locks | code hash, refresh hash, lineage (high) |
+| browser JWT principal → consent / connected-app API | authenticated user ids cross ownership, scope and collection boundaries | request handle, scopes, token ids (high) |
+| refresh credential → token endpoint | long-lived bearer-like credential requests a new grant branch | refresh token (high) |
+| transaction outcome → OAuth error | lineage revocation must commit although the response is `invalid_grant` | revocation state |
+| operator CLI → client store | trusted input creates a recoverable-once confidential client | client secret (high) |
+| bearer header → personal-token `/me` | untrusted bearer crosses existing token and scope guards | user profile fields (medium) |
+| PHP capture → committed fixtures; gate → child processes | live credentials must become placeholders before git; secrets cross shell/Node/Go | credentials (high) |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-08-PKCE | Spoofing/Elevation | authorize / token exchange | high | mitigate | `wristband/authorize.go:77` requires `code_challenge_method=S256`, rejects missing challenge (`:84`); verifier compared through `wristband/crypto.go:34` `subtle.ConstantTimeCompare` | closed |
+| T-08-CODE-REPLAY | Spoofing | auth-code store / exchange | high | mitigate | `classes/auth/oauth_store.go:130` `ByCodeHashForUpdate` (`clause.Locking UPDATE`) inside the single transaction at `:45`; concurrent one-winner tests per 08-SECURITY-REVIEW | closed |
+| T-08-REFRESH-REPLAY | Spoofing/Elevation | refresh state machine | high | mitigate | `oauth_store.go:199` `ByTokenHashForUpdate`, `:243` `RevokeLineage` (locked walk); lineage kill committed before `invalid_grant`; manual-token-delete cascade fixed in 08-10 (`controllers/api/token_api_controller.go` `Destroy`) | closed |
+| T-08-OPEN-REDIRECT | Spoofing/Disclosure | authorize | high | mitigate | `wristband/authorize.go:62` exact `stringSliceContains(client.RedirectURIs, …)` check precedes every `authorizeErrorRedirect` | closed |
+| T-08-SCOPE-CEILING | Elevation | authorize / consent / refresh / CLI | high | mitigate | requested ∩ `ScopeCeiling` (`wristband/stores.go:29`) before persistence; consent four-way intersection app-owned (`wristband/consent.go:8`, D-08); refresh copies stored scopes only | closed |
+| T-08-CROSS-USER | Elevation | consent / connected apps | high | mitigate | `controllers/api/connected_app_controller.go:28,75` scope reads/deletes to `user_id = ?`; missing/foreign/manual ids return identical 404 `Token not found` (`:70,:78`) | closed |
+| T-08-SURFACE | Elevation | route groups / MCP boundary | high | mitigate | raw OAuth routes vs JWT management routes proven by `routes_isolation_test.go:TestFullRouteTableAuthGroupMutualExclusivity`, `TestOAuthTokenSurfaceIsolationCoverage`, `TestOAuthMetadataRouteIsolation` | closed |
+| T-08-REQUEST-LEAK | Information Disclosure | metadata / logs / fixtures / output | high | mitigate | opaque pending-request handle (`wristband/authorize.go:29`); positive allow-list serializers (`TestOAuthConsentShowExactKeySet`); no `fmt.Print*`/`log.*`/`slog.*` on secrets; `check-phase8.sh` `redact_phase8` + `stage_secret_scan` | closed |
+| T-08-SECRET-TIMING | Information Disclosure | client auth / issued client | medium | mitigate | single hash/compare path through `wristband/crypto.go:34` `subtle.ConstantTimeCompare`; secret shown once by the client command | closed |
+| T-08-DCR-FLOOD | Denial of Service | register / client store | medium | mitigate | `wristband/register.go:67` `http.MaxBytesReader` at 65536 (`server.go:99`); `DCRClientCap` (`server.go:50`, `ErrClientCapReached`) under transactional cap/sweep/create; `throttle:fonoteka-oauth-register` 30/min per IP | closed |
+| T-08-SC | Tampering | dependencies | low | mitigate | no `go.mod`/`go.sum` change in any phase 08 commit; stdlib port, no zitadel/oidc (D-01); Playwright/Node reused from existing lockfile | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+No accepted risks.
+
+*Accepted risks do not resurface in future audit runs.*
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-09-24 | 11 | 11 | 0 | 08-10 executor (`08-SECURITY-REVIEW.md`, self-performed) |
+| 2026-10-12 | 11 | 11 | 0 | /msd-secure-phase orchestrator (L1 grep re-check; `go test -short` green for `modules/wristband`, fonoteka `classes/auth`, `controllers/api`) |
+
+## Security Audit 2026-10-12
+
+| Metric | Count |
+|--------|-------|
+| Threats found | 11 |
+| Closed | 11 |
+| Open | 0 |
+
+Short-circuited at L1 (threats_open 0, register authored at plan time, ASVS 1); no auditor subagent spawned. Every mitigation above was re-located in current source rather than inherited from the 2026-09-24 review.
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-12

.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-SECURITY.md

@@ -0,0 +1,105 @@
+---
+phase: "09"
+slug: "backend-admin-authentication-and-schema-pipeline"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+threats_total: 22
+threats_closed: 22
+accepted_risks: 0
+asvs_level: 1
+block_on: high
+register_authored_at_plan_time: true
+created: "2026-10-12"
+---
+
+# Phase 09 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+This file is the gate contract derived from the twelve `<threat_model>` blocks. `09-SECURITY-REVIEW.md` (2026-09-27, written by the 09-12 executor) has the per-threat findings and named test evidence. No SUMMARY carries a `## Threat Flags` section. T-09-SC appears in every plan and is counted once. Framework paths are relative to `summercms.go/modules/`. App paths are relative to `fonoteka.go/plugins/golem15/fonoteka/`.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| Client → raw admin API | Untrusted credentials, path segments, query input and JSON bodies enter the backend-only route family | credentials, identifiers, field values |
+| JWT → backend principal provider | Signed claims select a backend identity and must not cross the frontend/backend boundary | bearer tokens (high) |
+| Operator CLI → backend tables | Password and role inputs create or change privileged identities | passwords, role codes (high) |
+| Auth outcomes → logs | Security telemetry must keep the evidence without copying secrets | admin id, outcome |
+| Plugin embedded FS → schema compiler | Plugin-owned YAML becomes a server-side query, write and serialization contract | configuration |
+| Request locale → schema serializer | Per-request language must not mutate shared cached state | display text |
+| Schema/request → query planner → PostgreSQL | Compiled identifiers and untrusted bound values reach SQL | identifiers, filter values |
+| JSON body / route id → model lifecycle | Untrusted fields and ids drive Fill, hooks, bulk and pivot writes | record data |
+| Controller scope → global tables | Controller scope must constrain globally existing users, records and relation candidates | user emails, ids |
+| Backend principal → metadata | Authorization decides which controllers and settings are disclosed | navigation, settings |
+| Migrations / OpenAPI → consumers | Database and spec artifacts must match runtime behavior | schema, contract |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-09-01 | Spoofing / Elevation | bouncer audience + backend guard | high | mitigate | Separate secrets, required `user`/`backend` audience; `bouncer/backend_guard_test.go` `TestPhase09GuardIsolation` (re-run 2026-10-12: pass) | closed |
+| T-09-02 | Elevation | cabana protected-route wrapper | high | mitigate | `service.protect` checks guard, controller and permission before schema/query work; `cabana/security_coverage_test.go` `TestPhase09PermissionMatrix` (re-run: pass; covers the later reorder and singleton routes too) | closed |
+| T-09-03 | Information Disclosure | auth handlers + logging | high | mitigate | Opaque login errors, log-capture redaction; `TestPhase09SecurityCoverage` (re-run: pass) | closed |
+| T-09-04 | Elevation | admin:create / reset-password | medium | mitigate | Exact role codes, hash in transaction, token invalidation on reset; `cabana/commands_test.go` `TestAdminCreate*`, `TestAdminResetPasswordCommand` (re-run: pass) | closed |
+| T-09-05 | Tampering | strict form-schema compiler | high | mitigate | Unknown key/type/provider/partial rejection, embedded-FS paths; `cabana/form_schema_test.go` `TestFormSchemaCompile*`, `TestFormSchemaRejects*` (re-run: pass) | closed |
+| T-09-06 | Information Disclosure / Tampering | localized schema cache | medium | mitigate | Untranslated IR cached, locale per request; app `admin_phase09_e2e_test.go` `TestPhase09AssembledAcceptance` (re-run: pass) | closed |
+| T-09-07 | Tampering / Elevation | `cabana/query.go` identifiers and scopes | high | mitigate | Compiled finite allowlists, bound values, injection fixtures; `TestPhase09SecurityCoverage` (re-run: pass) | closed |
+| T-09-08 | Denial of Service | list pagination/search | medium | mitigate | perPage limited to compiled options, range validation; `TestPhase09AssembledAcceptance` (re-run: pass) | closed |
+| T-09-09 | Tampering / Elevation | `cabana.ProjectWritableFields` | high | mitigate | Writable projection drops protected, unknown, case-variant and nested keys; `TestPhase09SecurityCoverage` (re-run: pass) | closed |
+| T-09-10 | Tampering | CRUD/bulk lifecycle | high | mitigate | One transactional Fill/Validate/hooks service, locked bulk rows; `TestPhase09SecurityCoverage` (re-run: pass) | closed |
+| T-09-11 | Elevation / Tampering | Albums collection-scoped lookup | high | mitigate | Server-side collection scope; app `admin_albums_test.go` `TestAlbumsAdminCollectionMatch`, `TestAlbumsAdminCrossCollection` (re-run: pass) | closed |
+| T-09-12 | Tampering | normalized email association | high | mitigate | Exactly one active match or 422, no candidate disclosure; `TestAlbumsAdminAmbiguousEmail` (re-run: pass) | closed |
+| T-09-13 | Elevation | Artists operation permission map | high | mitigate | Explicit permission per operation, activation fails on omissions; app `admin_phase09_security_test.go` `TestPhase09SecurityMatrix` (re-run: pass) | closed |
+| T-09-14 | Spoofing / Elevation | controller registry duplicates | high | mitigate | Duplicate ids/routes/models fail activation; `party/registry_test.go` `TestActivateDuplicateIDRejected`, app `TestStylesAdminDuplicateRegistration` (re-run: pass) | closed |
+| T-09-15 | Tampering | Style option/filter provider values | medium | mitigate | YAML scalar kinds preserved, provider output validated at activation; `TestStylesAdminTypedOptions` (re-run: pass) | closed |
+| T-09-16 | Tampering / Elevation | relation pivot write | high | mitigate | Pivot columns/payload from the model contract, unknown pivot fields rejected; `TestPhase09SecurityCoverage`, `TestCollectionsAdminForgedPivot` (re-run: pass) | closed |
+| T-09-17 | Elevation / Information Disclosure | owner/target/candidate scope | high | mitigate | Relation permission before SQL, scoped owner/target queries; `TestCollectionsAdminRelationPermissions`, `TestCollectionsAdminCrossScope` (re-run: pass) | closed |
+| T-09-18 | Tampering / Elevation | settings PUT | high | mitigate | Permission first, fillable-only projection, singleton row lock; app `admin_settings_test.go` `TestAdminSettings*` (re-run: pass) | closed |
+| T-09-19 | Information Disclosure | navigation/settings metadata | medium | mitigate | Entries filtered before serialization; `TestPhase09PermissionMatrix` (re-run: pass) | closed |
+| T-09-20 | Repudiation / Elevation | Phase 9 security regression evidence | high | mitigate | Route-derived permission matrix, zero-test/skip detection in `scripts/check-phase9.sh`. See Audit Note: the app-side exact-route test is red on the current tree | closed |
+| T-09-21 | Tampering | migration + OpenAPI drift | high | mitigate | Fresh/rollback PostgreSQL tests, handler-derived route inventory; `cabana/phase09_contract_test.go` `TestPhase09ContractInventory` (re-run: pass), `scripts/check-phase9.sh --postgres/--openapi` (09-12) | closed |
+| T-09-SC | Tampering | Go module / generator tooling | high | mitigate | Phase 9 added no package. OpenAPI uses pinned swag v1.16.6 and openapi-typescript 7.13.0 (`scripts/check-phase9.sh --openapi`). Later go.mod changes belong to other phases | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+No accepted risks.
+
+---
+
+## Audit Note (2026-10-12)
+
+The current tree fails `TestPhase09SecurityRoutes` in `fonoteka.go` (`admin_phase09_security_test.go`). It reports three admin routes that are missing from its `phase09AdminRoutes` allowlist: `GET /{controller}/reorder`, `POST /{controller}/reorder` and `GET /{controller}/singleton`. Phase 17-01 (`23f33c3`) added these routes but did not update the app's allowlist. All three carry the `backend` middleware and enter through `service.protect` (`cabana/reorder.go`, `cabana/singleton.go`). The framework's `TestPhase09PermissionMatrix` lists them and passes. Phase 9's controls still hold. The failure is a stale route list in the consumer app, so it is recorded here as a follow-up and not as an open threat. Fix: add the three keys to `phase09AdminRoutes` in `fonoteka.go`.
+
+Browser rendering of these schemas belongs to Phase 10 (see `09-SECURITY-REVIEW.md`, Residual risk).
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-09-27 | 22 | 22 | 0 | 09-12 executor (`09-SECURITY-REVIEW.md`) |
+| 2026-10-12 | 22 | 22 | 0 | /msd-secure-phase (ASVS L1: test existence plus re-run of the named tests; short-circuit, no auditor) |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-12

.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-VERIFICATION.md

@@ -1,8 +1,8 @@
 ---
 phase: 09-backend-admin-authentication-and-schema-pipeline
-verified: 2026-10-05T15:08:52Z
+verified: 2026-10-11T13:38:34Z
 status: passed
-score: 5/5 roadmap success criteria verified (plan truths 54/54 verified, including 3 backstop truths with direct test evidence)
+score: 5/5 roadmap success criteria verified; plan truths 54/54
 covered_files:
   - ".planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-01-PLAN.md"
   - ".planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-01-SUMMARY.md"
@@ -42,6 +42,7 @@ covered_files:
   - "modules/bouncer/registry.go"
   - "modules/bouncer/registry_test.go"
   - "modules/cabana/admin_openapi.go"
+  - "modules/cabana/api_tokens.go"
   - "modules/cabana/auth.go"
   - "modules/cabana/auth_internal_test.go"
   - "modules/cabana/auth_test.go"
@@ -53,6 +54,7 @@ covered_files:
   - "modules/cabana/crud.go"
   - "modules/cabana/crud_lifecycle_test.go"
   - "modules/cabana/crud_test.go"
+  - "modules/cabana/field_type_upload.go"
   - "modules/cabana/filter_schema.go"
   - "modules/cabana/form_schema.go"
   - "modules/cabana/form_schema_test.go"
@@ -79,6 +81,9 @@ covered_files:
   - "modules/cabana/settings.go"
   - "modules/cabana/testdata/list/all_columns.yaml"
   - "modules/cabana/testdata/list/all_filters.yaml"
+  - "modules/cabana/token_guard.go"
+  - "modules/cabana/token_guard_test.go"
+  - "modules/cabana/token_scopes.go"
   - "modules/cabana/tx_context.go"
   - "modules/lagoon/backend_admin_migrations.go"
   - "modules/lagoon/backend_admin_migrations_test.go"
@@ -89,46 +94,75 @@ covered_files:
   - "modules/phrasebook/translator.go"
   - "modules/surf/router.go"
   - "scripts/check-phase9.sh"
-covered_digest: "v2:sha256:c2f48f6ce04a5eed4788d745da45b1c1555a769df4feebfe88b9bbf671b634fb"
-covered_files_note: "Fingerprint refreshed 2026-10-05 after later phases (12.1, 12.2, 13, 14) added to the same modules/cabana, lagoon, pact and surf files Phase 9 already covered. Paths remain modules/ (Phase 10.2). scripts/check-phase9.sh --all passed at summercms.go HEAD 104a1c9 and fonoteka.go HEAD 93b8b75. fonoteka.go files stay outside the digest and are listed under Required Artifacts."
+covered_digest: "v2:sha256:e044b747d6e6be8c322be33286dc912e1d99b9fad727b0227877682f75a28ba1"
+covered_files_note: "Regenerated 2026-10-11 at summercms.go HEAD be82bcc (code at b45af8e) and fonoteka.go HEAD e074028. Added modules/cabana/api_tokens.go (stampThrottle, on the composite guard's token path) and token_guard_test.go (TestTokenLastUsedThrottlePerGuard). fonoteka.go files stay outside the digest (separate repo) and are listed under Required Artifacts."
 behavior_unverified: 0
 overrides_applied: 0
-mvp_mode_note: "ROADMAP marks Phase 9 mode: mvp, but the ROADMAP goal is not a User Story. Every Phase 9 PLAN carries a valid User Story, used for User Flow Coverage. As in the Phase 1/3/5/8/10 reports, the five ROADMAP success criteria are the contract."
+mvp_mode_note: "ROADMAP marks Phase 9 mode: mvp, but the ROADMAP goal is not a User Story. Every Phase 9 PLAN carries a valid User Story, used for User Flow Coverage. The five ROADMAP success criteria are the contract."
 re_verification:
-  previous_status: stale
-  previous_score: 5/5
-  reason: "The 2026-10-01T21:17Z passed report went stale because Phases 12.1, 12.2, 13 and 14 edited 25 already-covered implementation files (+3294/-217) after HEAD ba1aaef. This is content-digest drift, not missing modules/ paths (those were fixed in 1a878b3). scripts/check-phase9.sh --all passed at HEAD 104a1c9; covered_digest recomputed to match current bytes."
-  gaps_closed: []
+  previous_status: gaps_found
+  previous_score: "5/5 roadmap success criteria; plan truths 53/54"
+  previous_verified: 2026-10-11T13:00:45Z
+  closed_by: "quick 261011-kzi: fonoteka.go e074028 (test-only inventory update), summercms.go b45af8e (per-guard stampThrottle)"
+  gaps_closed:
+    - "09-12: Phase 9 fail-closed acceptance gate green. fonoteka phase09AdminRoutes now lists the 10 post-phase routes as protected; TestPhase09SecurityRoutes and TestPhase09SecurityMatrix PASS; scripts/check-phase9.sh --security and --all exit 0 (re-run by the verifier)."
+  advisory_closed:
+    - "TestBackendTokenPostgres order dependence: the process-global lastStamp map is gone (grep: no hits in modules/cabana). The 11-test run from the previous report plus TestTokenLastUsedDebounce and TestTokenLastUsedThrottlePerGuard gives 13/13 PASS on PostgreSQL, and the full Docker-backed go test -count=1 ./modules/cabana is ok (84.8s)."
   gaps_remaining: []
   regressions: []
-  human_items_resolved:
-    - "Code-review triage: 09-REVIEW-DISPOSITION.md records CR-01 and WR-01..WR-19 as fixed (12 Info findings stay open, out of scope). Each fix is in the code at HEAD with a passing named test."
-    - "WR-11 decision (user, 2026-10-01): index added. Migration 202610010001_backend_users_email_ci_unique creates backend_users_email_lower_unique on lower(email), refuses to run on case-duplicate emails and names the logins; rollback drops the index. TestBackendAdminEmailCaseInsensitiveUnique and TestBackendAdminEmailIndexRefusesCaseDuplicates PASS."
-    - "WR-03 decision (user, 2026-10-01): single-record delete kept as Winter (allowed whenever a form exists). Code matches: operationDeclared 'delete' requires a form only; TestCRUDOperationsFollowDeclarations PASS."
-    - "WR-17 decision (user, 2026-10-01): exact-code deny does not remove a wildcard grant, as Winter's getMergedPermissions. Code matches applyUserPermissions; TestBackendUserPermissionsOverrideRole PASS."
-    - "Judgment-tier prohibitions (user, 2026-10-01): all 24 verdicts accepted; 09-03 #1 confirmed as superseded by Phase 10.1 D-09. 09-11 #1 (WR-02) and 09-12 #1 (WR-18) are not violated on code and test evidence."
-    - "09-UAT.md: status complete, 3/3 pass (ba1aaef)."
+human_verified:
+  - test: "Decide CR-01 (admin CRUD cannot save a writable number field; type mismatches return 500 instead of 422)"
+    uat_row: 1
+    recorded_at: "2026-10-01T21:13:02.000Z"
+  - test: "Triage the 19 open code-review warnings (priority: WR-01, WR-02, WR-14, WR-17 for AUTH-08 Winter permission semantics)"
+    uat_row: 2
+    recorded_at: "2026-10-01T21:13:02.000Z"
+  - test: "Review the 24 judgment-tier prohibitions in 09-VERIFICATION.md"
+    uat_row: 3
+    recorded_at: "2026-10-01T21:13:02.000Z"
 ---
 
 # Phase 9: Backend admin authentication and schema pipeline. Verification Report
 
 **Phase Goal:** Backend admin users with roles are separate from frontend users and gate navigation and controller access; `fields.yaml`/`columns.yaml` drive a JSON form/list schema, including a first-class relation-manager schema replacing the one `partial` field.
-**Verified:** 2026-10-05T15:08:52Z (summercms.go HEAD 104a1c9, fonoteka.go HEAD 93b8b75)
+**Verified:** 2026-10-11T13:38:34Z (summercms.go HEAD be82bcc, code at b45af8e; fonoteka.go HEAD e074028)
 **Status:** passed
-**Re-verification:** Yes. The 2026-10-01T21:17Z passed report went stale because later phases edited 25 already-covered implementation files. `scripts/check-phase9.sh --all` passed at HEAD 104a1c9; `covered_digest` was recomputed to match current bytes. Human items remain the 2026-10-01 decisions (09-UAT.md complete 3/3).
+**Re-verification:** Yes, after gap closure. The 13:00Z run today found `gaps_found` (stale fonoteka route inventory). Quick task 261011-kzi closed it. This run re-checked the gap and the code changes from that task, and ran regression checks on everything else.
 
 **MVP note:** ROADMAP marks this phase `mode: mvp`, but its goal is not a User Story. The PLAN files carry a valid one, which is used below. The five ROADMAP success criteria are the contract, and the plan `must_haves` are supporting evidence.
 
-**Changes since the previous report that bear on Phase 9 (verified in code, not taken from 09-REVIEW-FIX.md):**
+## Summary of this re-verification
 
-- **Permissions (WR-01, WR-17):** `cabana.Allows` (`contracts.go:130`) now passes when ANY required code is granted, and `granted` (line 147) matches wildcard requirements (`x.*`, `*x`) as Winter's `hasPermission` does. `BackendUsers.FindByID` overlays the user's own `backend_users.permissions` on the role grants (`applyUserPermissions`, `auth.go:77`): `1` grants, `-1`/`0` remove an exact code.
-- **Navigation (WR-02):** `Metadata` (`navigation.go:36`) drops a main item the principal may not open, whatever its children allow, and `openableTarget` (line 95) repoints an allowed parent to its first openable child. With Fonoteka's parent requirement `golem15.fonoteka.*`, a genres-only admin should now see the parent linked to `golem15.fonoteka.genres`, not albums (by code reading; the framework test pins this shape, no Fonoteka test asserts it).
-- **Writes (WR-03, WR-04, WR-05):** `operationDeclared` (`http.go:806`) refuses create/update/delete/bulk-delete the compiled YAML does not declare (403). Form `required` applies only in contexts that can supply it. `relationMutation` (line 469) refuses link/unlink missing from `view.toolbarButtons`.
-- **Auth (WR-10 to WR-14):** foreign `backend` guard fails boot (`bouncer.Registry.Owner`); ambiguous login identifiers answer the same opaque 401 (`findBackendLogin`, `auth.go:431`); dummy hash uses the configured bcrypt cost; `admin:*` read passwords from a prompt or stdin; logout runs outside the guard and revokes an expired-but-refreshable token via `bouncer.VerifyRefreshableClaimsAudience` (`refresh.go:60`).
-- **Schema/query (WR-06 to WR-09, WR-16):** relation default sort is the first sortable column; relation column order comes from an ordered decode, not indentation; list search uses `LOWER(CAST(col AS TEXT))` (`query.go:296`); the scaffold declares a required permission and a record source; reflection helpers see embedded structs and explicit `column:` tags (`model_fields.go`).
-- **Gate and transactions (WR-18, WR-19):** `check-phase9.sh` judges zero tests per package; hooks and scopes read the write transaction through `cabana.TxFromContext` (`tx_context.go:27`), used by Fonoteka's album and collection hooks.
-- **Fonoteka (WR-15):** an admin editor link leaves `granted_by` NULL.
-- **WR-11 index (2da8112, user decision):** migration `202610010001_backend_users_email_ci_unique` (`modules/lagoon/backend_admin_migrations.go`) checks for emails that differ only in case, fails naming the clashing logins, otherwise creates `backend_users_email_lower_unique ON backend_users (lower(email))`; rollback drops it. Registered through `BackendAdminMigrations` (`migrations.go:74`, plugin id `summercms.cabana`).
+The single blocker is closed, and I checked that by running the evidence, not by reading the quick-task SUMMARY:
+
+- `go test ./plugins/golem15/fonoteka -run '^TestPhase09Security' -count=1` (fonoteka.go): `TestPhase09SecurityRoutes` PASS, `TestPhase09SecurityMatrix` PASS.
+- `scripts/check-phase9.sh --security`: "phase9 security passed", exit 0.
+- `scripts/check-phase9.sh --all`: self-test, security, postgres, openapi and evidence all pass, exit 0 (log below).
+- Assembled Phase 9 suites in fonoteka.go: 79 PASS, 0 FAIL, 0 SKIP (previous run: 78 PASS, 1 FAIL).
+
+**Gap fix (fonoteka.go e074028).** The commit adds exactly 16 lines to `phase09AdminRoutes`: the 10 routes, each `public: false`, plus comments. The assertions in `TestPhase09SecurityRoutes` are unchanged. The test still fails on a missing route, a non-raw route, a protected route without `backend` middleware, a public route with it, and any unlisted admin route. I checked each of the 10 routes in `modules/cabana/http.go` `service.mount`. All are registered inside `r.GroupRaw(api, []string{"backend"}, …)`, which opens at line 264 and closes at line 387:
+
+| Route | http.go line | Extra gate |
+|---|---|---|
+| `PUT /account` | 268 | `interactiveOnly`, `requireAjax` |
+| `POST /account/avatar` | 269 | `interactiveOnly`, `requireAjax` |
+| `DELETE /account/avatar` | 270 | `interactiveOnly`, `requireAjax` |
+| `GET /account/tokens` | 271 | `interactiveOnly` |
+| `POST /account/tokens` | 272 | `interactiveOnly`, `requireAjax` |
+| `GET /account/tokens/scopes` | 273 | `interactiveOnly` |
+| `DELETE /account/tokens/{id}` | 274 | `interactiveOnly`, `requireAjax` |
+| `GET /field-types` | 278 | `tokenRouteGate` (handler) |
+| `POST /markdown/preview` | 280 | `requireAjax`, `tokenRouteGate` (handler) |
+| `POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload` | 386 | `requireAjax`; handler calls `protect` then `operationDeclared` (`field_type_upload.go:33,44`) |
+
+None of the 10 routes is in the public `/auth`, `/lang` or `adminPrefix` groups.
+
+**Throttle change (summercms.go b45af8e) does not weaken any Phase 9 must-have.** Since a3b502b (the HEAD of the previous report), the only code changes are `api_tokens.go`, `token_guard.go`, `http.go` and two test files (`git diff --stat a3b502b HEAD`).
+- `compositeGuard.AuthenticateCredential` (`token_guard.go:62-75`) is unchanged: a Bearer value with the `g15_` prefix goes to `authenticateToken`, and everything else goes to `g.jwt.Authenticate`. `g.jwt` is still `bouncer.NewBackendJWTGuard(secret, users, bl, writeUnauthenticated, AdminCookieName)` (`http.go:151,156`). The cookie-less resolver also uses `NewBackendJWTGuard` (`http.go:172-173`).
+- The only change on the token path is the debounce of the `last_used_at` write. It now happens after all authentication and scope decisions (`token_guard.go:120`) and does not affect the result. Token lookup, `subtle.ConstantTimeCompare`, `users.FindByID` (backend users only), `methodFilterScopes`, and `principal.Scope = limit` are unchanged.
+- Scope narrowing is untouched. `token_scopes.go` (`ownerHas`, line 237; `allowsUnderScope`, line 246) and `contracts.go` (`Allows`) have no diff. `TestAllowsScope`, `TestScopeCoversAll`, `TestScopeMatch`, `TestTokenRouteGates` and `TestInteractiveOnly` PASS.
+- Guard ownership (`guards.Owner("backend")`, `http.go:163-169`) is unchanged.
+- A nil `*stampThrottle` returns `due == true`, so a zero-value guard still stamps (the SQL UPDATE stays conditional) and cannot panic. The race run is clean.
 
 ## User Flow Coverage
 
@@ -136,12 +170,12 @@ User story (from every 09-*-PLAN.md): *As a backend administrator, I want to aut
 
 | Step | Expected | Evidence | Status |
 |---|---|---|---|
-| Provision an admin | `summer admin:create` creates a bcrypt admin with a role; no boot or web seed | `modules/cabana/commands.go`; `TestAdminCreateCommand`, `TestAdminResetPasswordCommand`, `TestAdminPasswordWithoutFlag`, `TestAdminCreateRejectsCrossFieldCollision`: PASS | VERIFIED |
-| Log in separately | Backend login by login or email returns a `backend`-audience JWT; frontend credentials fail; ambiguous identifiers fail opaquely | `modules/cabana/auth.go`, `bouncer.NewBackendJWTGuard`; `TestAdminAuthLifecycle`, `TestLoginAmbiguousIdentifier`, `TestAdminTracerGenreList`, `TestPhase09GuardIsolation`: PASS | VERIFIED |
-| See permitted navigation | `/navigation` lists only permitted items and never links to a 403 target | `modules/cabana/navigation.go` `Metadata`/`openableTarget`; `TestNavigationDropsDeniedParentAndRepointsTarget`, `TestAdminMetadataFiltering`: PASS | VERIFIED |
-| Open a controller | 403 without the controller permission, before any schema or SQL work | `modules/cabana/http.go` `protect` (line 780), then `operationDeclared` for writes; `TestPhase09PermissionMatrix`, `TestCRUDOperationsFollowDeclarations`, `TestAdminTracerPermissionBoundary`, `TestPhase09SecurityRoutes`: PASS | VERIFIED |
-| Work with schema-driven lists and forms | Form/list/relation schemas compiled from Winter YAML; CRUD, bulk delete, relation manager, settings | Sections below; `TestPhase09AssembledAcceptance`: PASS on real PostgreSQL | VERIFIED |
-| Outcome: permission-gated, reusable, decoupled | Framework has no app names; admin identity never touches frontend users | `grep -niE "fonoteka|collection_editors|granted_by|golem15_"` on non-test `modules/cabana/*.go`: no hits. `BackendUsers.FindByID` reads only `backend_users` | VERIFIED |
+| Provision an admin | `summer admin:create` creates a bcrypt admin with a role; no boot or web seed | `modules/cabana/commands.go`; `TestAdminCreateCommand`, `TestAdminResetPasswordCommand`, `TestAdminPasswordWithoutFlag`, `TestAdminCreateRejectsCrossFieldCollision`: PASS on PostgreSQL (re-run today) | VERIFIED |
+| Log in separately | Backend login returns a `backend`-audience JWT; frontend credentials fail; ambiguous identifiers fail opaquely | `auth.go` `findBackendLogin`, `bouncer.NewBackendJWTGuard`; `TestAdminAuthLifecycle`, `TestLoginAmbiguousIdentifier`, `TestPhase09GuardIsolation` (via `check-phase9.sh --security`), Fonoteka `TestAdminTracerAuthBoundary`, `TestAdminTracerGenreList`: PASS | VERIFIED |
+| See permitted navigation | `/navigation` lists only permitted items and never links to a 403 target | `navigation.go` `Metadata`/`openableTarget`/`canOpen`; Fonoteka `TestAdminMetadata*`: PASS | VERIFIED |
+| Open a controller | 403 without the controller permission, before any schema or SQL work | `http.go` `protect`, `operationDeclared`; `TestCRUDOperationsFollowDeclarations`, Fonoteka `TestPhase09SecurityMatrix`, `TestAdminTracerPermissionBoundary`: PASS | VERIFIED |
+| Work with schema-driven lists and forms | Form, list and relation schemas compiled from Winter YAML; CRUD, bulk delete, relation manager, settings | Sections below; Fonoteka `TestPhase09AssembledAcceptance` (via `check-phase9.sh --postgres`, run twice inside `--all`): PASS | VERIFIED |
+| Outcome: permission-gated, reusable, decoupled | No app names in the framework; admin identity never touches frontend users | No new non-test framework code beyond the throttle; token principals still resolve only through `BackendUsers.FindByID` | VERIFIED |
 
 ## Goal Achievement
 
@@ -149,167 +183,165 @@ User story (from every 09-*-PLAN.md): *As a backend administrator, I want to aut
 
 | # | Truth | Status | Evidence |
 |---|---|---|---|
-| 1 | A backend admin user with a role logs in separately from frontend users, and navigation/controller access is gated by the permissions registry. | ✓ VERIFIED | Separate Winter-shaped `backend_users`/`backend_user_roles` (`modules/lagoon/backend_admin_migrations.go`; `TestBackendAdmin*` PASS in the full run). Separate `backend` guard with its own secret and required audience; cross-audience tokens fail both ways (`TestPhase09GuardIsolation`, `TestAdminTracerAuthBoundary`: PASS); a foreign guard fails boot (`TestActivateRefusesAForeignBackendGuard`: PASS). Grants = role JSON + `HasPermissions` role assignments + user-level overlay (`auth.go:39-77`; `TestBackendUserPermissionsOverrideRole`: PASS on PostgreSQL). Every controller, relation and CRUD route goes through `protect` (`http.go:780`), settings through `protectSetting` (line 387). Permission matching follows Winter's `hasAnyAccess` (`TestAllowsFollowsWinterHasAnyAccess`, 17 cases: PASS). Navigation and settings filter by the same `Allows`; denied parents are dropped and targets repointed (`TestNavigationDropsDeniedParentAndRepointsTarget`: PASS). Also `TestPhase09PermissionMatrix`, `TestPhase09SecurityMatrix`, `TestAdminMetadataFiltering`, `TestAdminMetadataRejectsFrontendPrincipal`: PASS. The previous WR-01/WR-02/WR-17 caveats are closed in code; WR-17's wildcard-deny behaviour was kept as Winter by user decision. |
-| 2 | `fields.yaml` for a real controller parses (goccy/go-yaml) into a JSON form schema covering text, textarea, checkbox, switch, dropdown (model-method options) and relation (nameFrom, emptyOption), with span/tabs/context/attributes layout hints. | ✓ VERIFIED | `modules/cabana/form_schema.go` decodes with goccy/go-yaml and `yaml.DisallowUnknownField()` (line 286), walks the AST to keep order, rejects unknown keys and types. The real Fonoteka YAML covers every listed item. `required` now honours `context` (`TestCRUDRequiredFollowsContext`: PASS). Tests: `TestFormSchemaCompile`, `TestFormSchemaRejects`, `TestAlbumsAdminForm`, `TestAlbumsAdminDropdowns`, `TestStylesAdminForm`, `TestCollectionsAdminForm`: PASS. |
-| 3 | `columns.yaml` parses into a JSON list schema with searchable/sortable/relation columns and datetime/switch renderers. | ✓ VERIFIED | `modules/cabana/list_schema.go` column types `text`, `datetime`, `switch`; `ListColumn` carries `searchable`, `sortable`, `relation`, `select` (`schema_types.go:20-24`). Search/sort/filter resolve only through compiled allowlists with a PK tie-break; non-text searchable columns are cast to text (`query.go:296`; `TestListSearchNonTextColumns` on PostgreSQL: PASS). Tests: `TestListSchemaCompile`, `TestAlbumsAdminList`, `TestArtistsAdminList`, `TestCollectionsAdminListCRUD`, `TestGenresAdminEdges`: PASS. WR-08 caveat closed. |
-| 4 | The relation-manager schema supports search/link/unlink/manage-or-view lists for Collections' editors tab, replacing the `partial` field entirely. | ✓ VERIFIED | `fonoteka.go/.../models/collection/fields.yaml:19` `editors: type: relation-manager`; no `partial` in the Fonoteka model YAML. `config_relation.yaml` has view/manage list columns, `toolbarButtons: link\|unlink`, `showSearch`. `modules/cabana/relation.go` serves schema, linked, candidates (`RelationExtendManageQuery` at line 473), link and unlink (`RelationBeforeLink` at line 671); link/unlink now require the panel's `toolbarButtons` (`TestRelationMutationsFollowToolbarButtons`: PASS); column order is indentation-independent (`TestRelationColumnOrderIsIndependentOfIndentation`: PASS); default sort is the first sortable column (`TestRelationDefaultSort`: PASS). Fonoteka: `TestCollectionsAdminRelation*`, `TestCollectionsAdminRejectsPartial` (legacy path-less partial fails boot), `TestRelationCandidateExclusions`: PASS. **Note:** Phase 10.1 D-09 lifted Phase 9's blanket `type: partial` boot error for a bare-name sanitized html/template partial (`compilePartialPath`, `form_schema.go:508`); the Collections editors tab is still a relation manager. WR-05, WR-07, WR-15 caveats closed. |
-| 5 | Admin CRUD endpoints expose listExtendQuery/formExtendQuery/formBeforeCreate/formBeforeUpdate/relationExtendManageQuery hooks, bulk delete runs each record's lifecycle hooks, and the Settings model binds to a settings screen through the same schema pipeline. | ✓ VERIFIED | Hook interfaces in `modules/pact/capabilities.go:331-394`, type-asserted in `modules/cabana/query.go:109`, `crud.go:445,534,581,597`, `relation.go:473`. Hooks receive the write transaction through `TxFromContext` (`TestHooksReceiveTheWriteTransaction`: PASS; Fonoteka `TestAlbumsAdminHooksUseTheWriteTransaction` with a one-connection pool: PASS). `CRUDService.BulkDelete` (`crud.go:187`) locks scoped rows in one transaction and deletes per row via `deleteRecord`, so hooks fire per record; it now requires `delete` in `toolbar.buttons`. `TestBulkDeleteDuplicates`, `Idempotent`, `Rollback`, `TestCRUDHooks`: PASS. Settings use the same `Localize`, writable projection, `lagoon.Fill` (`settings.go:149`) and `lagoon.Validate`; `TestAdminSettings*` on PostgreSQL: PASS. CR-01 stays fixed (`TestCRUDFillTypeIsValidation`: PASS). |
+| 1 | A backend admin user with a role logs in separately from frontend users, and navigation/controller access is gated by the permissions registry. | ✓ VERIFIED | Separate `backend_users`/`backend_user_roles` (`modules/lagoon/backend_admin_migrations.go`; `TestBackendAdmin*` PASS on PostgreSQL today). Separate `backend` guard with its own secret and required audience, wrapped by the composite guard, which still hands every non-`g15_` request to `bouncer.NewBackendJWTGuard` (re-read after b45af8e). A frontend-audience token and a wrong-secret token get 401 on every Fonoteka admin path (`TestPhase09SecurityMatrix` PASS), and cross-audience fails both ways (`TestPhase09GuardIsolation` PASS in `--security`). A foreign `backend` guard still fails boot (ownership check unchanged). Grants = role + user overlay (`TestBackendUserPermissionsOverrideRole` PASS). Every controller route, including field upload, goes through `protect`. Personal API tokens narrow and never widen (`TestAllowsScope`, `TestBackendTokenGuard`, `TestTokenRouteGates`, `TestInteractiveOnly`, `TestResolveBackend`, `TestTokenTracerPostgres`, `TestBackendTokenPostgres`: PASS). |
+| 2 | `fields.yaml` for a real controller parses (goccy/go-yaml) into a JSON form schema covering text, textarea, checkbox, switch, dropdown (model-method options) and relation (nameFrom, emptyOption), with span/tabs/context/attributes layout hints. | ✓ VERIFIED | No change since the 13:00Z run (`form_schema.go` not in the a3b502b..HEAD diff). `TestCRUDRequiredFollowsContext` PASS today; full `./modules/cabana` package ok; Fonoteka `TestAlbumsAdmin*`, `TestStylesAdmin*`, `TestCollectionsAdmin*`: PASS. |
+| 3 | `columns.yaml` parses into a JSON list schema with searchable/sortable/relation columns and datetime/switch renderers. | ✓ VERIFIED | No change since the 13:00Z run. `TestListSearchNonTextColumns` (PostgreSQL) PASS today; Fonoteka `TestAlbumsAdminList`, `TestArtistsAdminList`, `TestGenresAdmin*`: PASS. |
+| 4 | The relation-manager schema supports search/link/unlink/manage-or-view lists for Collections' editors tab, replacing the `partial` field entirely. | ✓ VERIFIED | No change since the 13:00Z run. Fonoteka `TestCollectionsAdminRelation*`, `TestCollectionsAdminRejectsPartial`, `TestRelationCandidateExclusions`: PASS; full `./modules/cabana` package ok. |
+| 5 | Admin CRUD endpoints expose `listExtendQuery`/`formExtendQuery`/`formBeforeCreate`/`formBeforeUpdate`/`relationExtendManageQuery` hooks, bulk delete runs each record's lifecycle hooks, and the Settings model binds to a settings screen through the same schema pipeline. | ✓ VERIFIED | No change since the 13:00Z run. `TestBulkDelete*`, `TestCRUDHooks`, `TestHooksReceiveTheWriteTransaction`, `TestCRUDFillTypeIsValidation`: PASS on PostgreSQL today (27-test set). Fonoteka `TestAdminSettings*`, `TestAlbumsAdminHooksUseTheWriteTransaction`: PASS. |
 
 **Score:** 5/5 ROADMAP truths verified (0 present-but-behavior-unverified).
 
 ### Plan must-have truths (supporting evidence)
 
-There are 54 plan truths across 09-01 to 09-12, and each maps to a named test in its plan's `<verify>` block. I re-ran every named Fonoteka suite with `-v`: 79 top-level PASS, 0 SKIP, 0 FAIL. That equals the number of test functions with those prefixes in the package (79, now including `TestAlbumsAdminHooksUseTheWriteTransaction` from the WR-19 fix). The 20 tests added by the summercms.go fix commits were run by name and all pass.
+There are 54 plan truths across 09-01 to 09-12. Fonoteka's named Phase 9 suites at e074028 (`-run '^(TestPhase09.*|TestAdminSettings.*|TestAdminMetadata.*|TestCollectionsAdmin.*|TestAlbumsAdmin.*|TestGenresAdmin.*|TestArtistsAdmin.*|TestStylesAdmin.*|TestAdminTracer.*|TestAdminAuthLifecycleAssembled|TestRelationCandidateExclusions)$'`) gave 79 PASS, 0 FAIL, 0 SKIP.
 
-Truth 09-12 #4 names `../fonoteka.go/docs/openapi.json` as the admin OpenAPI home. Phase 10 D-15 moved the admin paths to the framework-owned `summercms.go/admin/openapi/admin.json`. The intent still holds: `scripts/check-admin-openapi.sh --check` and `scripts/check-phase9.sh --openapi` exit 0.
+| Truth | Status | Evidence |
+|---|---|---|
+| 09-12 #2: complete threat matrix executable, enforced by the fail-closed Phase 9 gate | ✓ VERIFIED (gap closed) | `check-phase9.sh --security` exit 0, `--all` exit 0. `TestPhase09SecurityRoutes` PASS with assertions unchanged; all 10 added routes carry `backend` middleware (checked in http.go, table above). |
+| All other 53 plan truths | ✓ VERIFIED | Named tests above and in the Spot-Checks table pass; `check-phase9.sh --all` (self-test, security, postgres, openapi, evidence) exit 0. |
+
+Truth 09-12 #4 names `../fonoteka.go/docs/openapi.json` as the admin OpenAPI home. Phase 10 D-15 moved the admin paths to `summercms.go/admin/openapi/admin.json`. `check-phase9.sh --openapi` passes inside `--all`.
 
 Backstop (non-inferable) truths:
 
 | Truth | Evidence | Status |
 |---|---|---|
-| 09-01: login accepts login or normalized email, one opaque failure, never falls back to a frontend user | `TestAdminAuthLifecycle`, `TestAdminTracerGenreList` (frontend user with the admin's email; frontend password rejected), `TestLoginAmbiguousIdentifier` (a cross-field collision now fails opaquely instead of taking the first match), `TestMissingUserHashUsesConfiguredCost`: PASS | VERIFIED (WR-11 closed; `lower(email)` unique index added, `TestBackendAdminEmailCaseInsensitiveUnique` PASS) |
-| 09-11: missing settings GET is side-effect-free with `exists: false`; first PUT creates; identical PUT is idempotent | `TestAdminSettingsMissingRead`, `TestAdminSettingsCreate`, `TestAdminSettingsIdempotentUpdate`: PASS | VERIFIED |
-| 09-12: AUTH-08 is the separate D-01/D-02 principal only; no shared role table or dual-purpose token | Separate tables, `Principal.Backend` flag, audience checks; `TestPhase09GuardIsolation`, `TestAdminMetadataRejectsFrontendPrincipal`, `TestVerifyRefreshableClaimsAudience` (refresh-window verification keeps the audience check): PASS | VERIFIED |
+| 09-01: login accepts login or normalized email, one opaque failure, never falls back to a frontend user | `TestAdminAuthLifecycle`, `TestLoginAmbiguousIdentifier` PASS today; Fonoteka `TestAdminTracerGenreList` (frontend user with the admin's email rejected) PASS | VERIFIED |
+| 09-11: missing settings GET is side-effect-free with `exists: false`; first PUT creates; identical PUT is idempotent | Fonoteka `TestAdminSettingsMissingRead`, `TestAdminSettingsCreate`, `TestAdminSettingsIdempotentUpdate` PASS | VERIFIED |
+| 09-12: AUTH-08 is the separate D-01/D-02 principal only; no shared role table or dual-purpose token | Separate tables. Personal API tokens live in `backend_api_tokens`, resolve only through `BackendUsers.FindByID`, and the non-`g15_` path is the backend JWT guard. `TestPhase09GuardIsolation`, `TestBackendTokenGuard`, `TestBackendTokenPostgres` PASS | VERIFIED |
 
 ### Prohibitions (judgment tier, non-authoritative verdicts)
 
-| Plan | Prohibition | Verdict |
+The 24 verdicts accepted in UAT row 3 still stand. b45af8e changes only when `last_used_at` is written, and e074028 is test-only, so neither touches a prohibition:
+
+| Plan | Prohibition | Verdict at HEAD |
 |---|---|---|
-| 01 | Backend identities must not share frontend user rows, the jwt guard, or a signing secret | not violated (foreign `backend` guard now fails boot) |
-| 01 | Hidden navigation must not replace server-side authorization | not violated (`protect`/`protectSetting`/`operationDeclared` on every route; logout is public by design, CSRF-checked, and only revokes the presented token) |
-| 01 | Tracer must not be mock-only | not violated (testcontainers PostgreSQL, assembled router) |
-| 02 | No boot, web-wizard or env-seeded first admin | not violated (migration seeds roles only; `admin:create` only) |
-| 02 | No cookie session store and no merge with the frontend user model | not violated |
-| 02 | Auth logs carry no password, JWT, secret or hash | not violated (`TestAdminAuthLogging`, `TestPhase09SecurityCoverage`; the `--password` deprecation warning never echoes the value) |
-| 03 | Form compiler must not accept `type: partial` | **superseded (accepted by the user 2026-10-01)**: Phase 10.1 D-09 lifted this for a supported partial contract (bare-name `path`, html/template, allowlisted node renderer, D-18 sanitizer). The legacy Winter path-less partial is still refused (`TestCollectionsAdminRejectsPartial`). |
-| 03 | Labels not deferred to the client or cached in the first request's locale | not violated (per-request `Localize`) |
-| 03 | Unknown keys, types or providers not silently ignored | not violated (`DisallowUnknownField`, `formFieldKeys`) |
-| 04 | YAML must not inject SQL or name an arbitrary method | not violated (`conditions:` rejected, finite `FilterScopes`; search cast is on an allowlisted, quoted column) |
-| 04 | Equal sort values must not make rows jump across pages | not violated (PK tie-break) |
-| 05 | No partially committed bulk operation | not violated (`TestBulkDeleteRollback`) |
-| 05 | Replay must not rerun destructive hooks | not violated (`TestBulkDeleteIdempotent`) |
-| 06 | No cross-collection or silently chosen duplicate user on albums | not violated (`TestAlbumsAdminAmbiguousEmail`, `CrossCollection`) |
-| 06 | Album form choices must not expose inactive or cross-collection users | not violated |
-| 07 | Artist parity not reached by silently omitting Winter keys | not violated |
-| 08 | No second Genre identity and no weakened permission | not violated (`TestGenresAdminTracerIdentity`, `DuplicateRegistration`) |
-| 09 | Style values not coerced between scalar types | not violated (`TestStylesAdminTypedOptions`) |
-| 10 | No PHP partial and no hardcoded Fonoteka pivot names in the framework | not violated (non-test `modules/cabana/*.go` grep: no hits) |
-| 10 | Owner, cross-collection or already-linked candidates not linkable by forgery | not violated (`ForgedPivot`, `CrossScope`, `Idempotent`; link now also requires the declared toolbar button) |
-| 11 | Navigation/settings metadata must not reveal existence, label or target of inaccessible entries | **not violated** (was qualified): a denied main item is dropped; an allowed parent never links to a controller the admin cannot open (`TestNavigationDropsDeniedParentAndRepointsTarget` pins the same parent `x.*` + genres-only shape; for Fonoteka this follows from code reading, since no Fonoteka test asserts a genres-only menu) |
-| 11 | Reading a missing singleton must not create a row | not violated (`TestAdminSettingsMissingRead`) |
-| 12 | Acceptance must not depend on skipped PostgreSQL tests or zero-test matches | **not violated** (was qualified): `phase9_detect` refuses any package without a passing test; `--self-test` re-run prints "refuse: zero tests in a/cabana" for the planted case and passes |
-| 12 | High threats marked mitigated only with a named failing-when-broken test | not violated (`09-SECURITY-REVIEW.md`; `check-phase9.sh --security` re-run: "phase9 security passed") |
+| 01 | Backend identities must not share frontend user rows, the jwt guard, or a signing secret | not violated (composite guard wraps the backend JWT guard with the backend secret; tokens resolve to `backend_users` only) |
+| 01 | Hidden navigation must not replace server-side authorization | not violated (`protect`/`protectSetting`/`operationDeclared` on every controller and settings route, including field upload) |
+| 02 | Auth logs carry no password, JWT, secret or hash | not violated (the throttle's failure log carries only `token_id` and the error; `logTokenAuth` unchanged) |
+| 03 | Form compiler must not accept `type: partial` | superseded (accepted 2026-10-01) by Phase 10.1 D-09; legacy path-less partial still refused |
+| 03 | Unknown keys, types or providers not silently ignored | not violated |
+| 11 | Navigation/settings metadata must not reveal inaccessible entries | not violated |
+| 12 | Acceptance must not depend on skipped PostgreSQL tests or zero-test matches | not violated (`--all` self-test refuses planted skip/zero-test cases; real stages green) |
+| others | (see 2026-10-05 report) | unchanged |
 
 ### Required Artifacts
 
 | Artifact | Expected | Status | Details |
 |---|---|---|---|
-| `modules/lagoon/backend_admin_migrations.go` | backend_users/roles, system-role seed, case-insensitive unique email | ✓ VERIFIED | Explicit SQL up/down; `TestBackendAdmin*` (6 incl. `EmailCaseInsensitiveUnique`, `EmailIndexRefusesCaseDuplicates`) PASS |
-| `modules/cabana/auth.go` | backend provider, login/refresh/logout/me, user-level permission overlay | ✓ VERIFIED | `BackendUsers` reads only `backend_users` |
-| `modules/cabana/commands.go` | admin:create, admin:reset-password | ✓ VERIFIED | prompt/stdin password, collision checks |
-| `modules/cabana/http.go` | route mounting, `protect`, `operationDeclared`, `relationMutation` | ✓ VERIFIED | Mounted from `modules/surf/router.go:522` via `cabana.Activate` |
-| `modules/cabana/form_schema.go`, `schema_types.go` | strict typed form compiler | ✓ VERIFIED | |
-| `modules/cabana/list_schema.go`, `filter_schema.go`, `query.go`, `model_fields.go` | list compiler, allowlisted query, column resolution | ✓ VERIFIED | |
-| `modules/cabana/crud.go`, `tx_context.go` | CRUD, projection, hooks, bulk delete, tx on context | ✓ VERIFIED | |
-| `modules/lagoon/fill.go` | allowlisted fill used by CRUD and settings | ✓ VERIFIED | |
-| `modules/cabana/relation.go`, `relation_field.go` | relation schema and link/unlink | ✓ VERIFIED | |
-| `modules/cabana/navigation.go`, `settings.go` | filtered metadata, singleton settings | ✓ VERIFIED | |
-| `modules/bouncer/refresh.go`, `registry.go` | refresh-window verification for logout; guard ownership | ✓ VERIFIED | |
-| `scripts/check-phase9.sh` | fail-closed gate, per-package zero-test check | ✓ VERIFIED | `--self-test`, `--openapi`, `--security`: exit 0 |
-| `fonoteka.go/.../controllers/{albums,artists,collections,genres,styles}_admin_controller.go`, `controllers/request_db.go` | five controllers with permissions; hooks read the write tx | ✓ VERIFIED | |
-| `fonoteka.go/.../models/*/fields.yaml`, `columns.yaml`, `controllers/*/config_*.yaml` | Winter-shaped YAML | ✓ VERIFIED | `partial` replaced by `relation-manager` |
-| `fonoteka.go/.../admin_permissions.go`, `admin_navigation.go`, `admin_settings.go` | registerPermissions/Navigation/Settings ports | ✓ VERIFIED | Parent requires `golem15.fonoteka.*` |
-| `fonoteka.go/.../admin_phase09_e2e_test.go`, `admin_phase09_security_test.go` | assembled acceptance and route inventory | ✓ VERIFIED | Logout listed as public with reason |
+| `modules/lagoon/backend_admin_migrations.go` | backend users/roles, seed, case-insensitive email, metadata + api tokens | ✓ VERIFIED | `TestBackendAdmin*` PASS |
+| `modules/cabana/auth.go` | backend provider, login/refresh/logout/me, user overlay | ✓ VERIFIED | unchanged since the 13:00Z run |
+| `modules/cabana/token_guard.go`, `token_scopes.go`, `api_tokens.go` | composite guard (16.3) on the Phase 9 gate path | ✓ VERIFIED | Routing and narrow-only scope unchanged; throttle now per guard (b45af8e); 13 token tests PASS together |
+| `modules/cabana/commands.go` | admin:create, admin:reset-password | ✓ VERIFIED | |
+| `modules/cabana/http.go` | route mounting, `protect`, `operationDeclared`, `relationMutation` | ✓ VERIFIED | b45af8e adds one line (`resolverGuard.stamps = guard.stamps`) |
+| `modules/cabana/form_schema.go`, `schema_types.go`, `list_schema.go`, `filter_schema.go`, `query.go`, `model_fields.go` | strict compilers, allowlisted query | ✓ VERIFIED | unchanged |
+| `modules/cabana/crud.go`, `tx_context.go`, `modules/lagoon/fill.go` | CRUD, hooks, bulk delete, tx on context | ✓ VERIFIED | unchanged |
+| `modules/cabana/relation.go`, `relation_field.go` | relation schema and link/unlink | ✓ VERIFIED | unchanged |
+| `modules/cabana/navigation.go`, `settings.go` | filtered metadata, singleton settings | ✓ VERIFIED | unchanged |
+| `modules/bouncer/jwt.go`, `refresh.go`, `registry.go` | audience guard, refresh-window verification, ownership | ✓ VERIFIED | unchanged since 104a1c9 |
+| `modules/cabana/security_coverage_test.go` | framework route inventory | ✓ VERIFIED | `TestPhase09SecurityCoverage` PASS |
+| `scripts/check-phase9.sh` | fail-closed gate | ✓ VERIFIED | `--security` exit 0; `--all` exit 0 |
+| `fonoteka.go/.../admin_phase09_security_test.go` | assembled route inventory | ✓ VERIFIED | e074028 lists the 10 routes; `TestPhase09SecurityRoutes` PASS |
+| `fonoteka.go/.../admin_phase09_e2e_test.go` | assembled acceptance | ✓ VERIFIED | `TestPhase09AssembledAcceptance` PASS (twice, inside `--all`) |
+| `fonoteka.go/.../controllers/*_admin_controller.go`, model YAML, `admin_permissions.go`, `admin_navigation.go`, `admin_settings.go` | five controllers and registries | ✓ VERIFIED | fonoteka diff 7fc790d..e074028 touches only the inventory test |
 
 ### Key Link Verification
 
 | From | To | Via | Status |
 |---|---|---|---|
-| `modules/surf/router.go` | `modules/cabana/http.go` | `cabana.Activate(app, plugins)` at line 522 | WIRED |
-| `modules/cabana/http.go` guard | `modules/bouncer/jwt.go` | `NewBackendJWTGuard` with backend audience; ownership via `Registry.Owner` | WIRED |
-| `modules/cabana/http.go` logout | `modules/bouncer/refresh.go` | `VerifyRefreshableClaimsAudience` then blacklist jti | WIRED |
-| `modules/cabana/http.go` handlers | compiled schemas | `s.reg.Get(id)`, `operationDeclared`, then list/form/relation | WIRED |
-| `modules/cabana/crud.go` | `lagoon.Fill`/`lagoon.Validate` | `save` transaction (line 290; Fill at 327, `FillTypeError` to 422) | WIRED |
-| `modules/cabana/crud.go` | plugin hooks | `TxFromContext` inside `lagoon.Transaction` | WIRED |
-| `modules/cabana/crud.go` bulk | model lifecycle hooks | per-row `deleteRecord` inside one transaction | WIRED |
-| `modules/cabana/settings.go` | form pipeline | `Localize`, `Fill` (line 149), `Validate` | WIRED |
+| `modules/surf/router.go` | `modules/cabana/http.go` | `cabana.Activate(app, plugins)` | WIRED |
+| `cabana` `backend` guard | `modules/bouncer/jwt.go` | `newCompositeGuard(NewBackendJWTGuard(secret, …))` (`http.go:151,156`); ownership via `Registry.Owner` | WIRED |
+| composite guard token path | `backend_users` | `users.FindByID(row.BackendUserID)` (`token_guard.go:101`) | WIRED |
+| composite guard token path | `backend_api_tokens.last_used_at` | `stampLastUsed(ctx, g.stamps, …)`; backend and resolver guards share one `stampThrottle` (`http.go:175`) | WIRED |
+| `modules/cabana/http.go` logout | `modules/bouncer/refresh.go` | `VerifyRefreshableClaimsAudience` | WIRED |
+| handlers | compiled schemas | `protect` then `s.reg.Get(id)`, `operationDeclared` | WIRED |
+| `crud.go` | `lagoon.Fill`/`Validate`, plugin hooks | `save` transaction, `TxFromContext` | WIRED |
+| `crud.go` bulk | lifecycle hooks | per-row `deleteRecord` | WIRED |
+| `settings.go` | form pipeline | `Localize`, `Fill`, `Validate` | WIRED |
 | `models/collection/fields.yaml` | `config_relation.yaml` | `relation: editors` compiled at activation | WIRED |
-| `internal/build/build.go` | `cabana.RuntimeCommands` | generated main | WIRED |
+| `scripts/check-phase9.sh` | framework + assembled security tests | named stages, zero-test detection | WIRED (all stages green) |
 
 ### Data-Flow Trace (Level 4)
 
 | Artifact | Data | Source | Real data | Status |
 |---|---|---|---|---|
-| List endpoint | `data` rows | GORM query on the registered model, scoped by `ListExtendQuery` | Yes (PostgreSQL rows in assembled tests) | ✓ FLOWING |
-| Navigation | entries | plugin `Navigation()` filtered by role + user-level grants from `backend_user_roles`/`backend_users` | Yes | ✓ FLOWING |
-| Settings GET | `data` | `golem15_fonoteka_settings` row or compiled defaults | Yes | ✓ FLOWING |
-| Relation linked/candidates | rows | pivot-joined user query with owner and linked users excluded | Yes | ✓ FLOWING |
+| List endpoint | `data` rows | GORM query scoped by `ListExtendQuery` | Yes (PostgreSQL rows in assembled tests) | ✓ FLOWING |
+| Navigation | entries | plugin `Navigation()` filtered by role + user grants (+ token scope) | Yes | ✓ FLOWING |
+| Settings GET | `data` | singleton row or compiled defaults | Yes | ✓ FLOWING |
+| Relation linked/candidates | rows | pivot-joined user query | Yes | ✓ FLOWING |
 
 ### Behavioral Spot-Checks
 
+All run by the verifier on 2026-10-11 at summercms.go b45af8e / fonoteka.go e074028.
+
 | Behavior | Command | Result | Status |
 |---|---|---|---|
-| Framework vet | `go vet ./...` (summercms.go) | exit 0, no output | ✓ PASS |
-| Framework regression (single full run) | `go test ./... -count=1` (summercms.go) | exit 0; 35 packages ok (plus packages with no test files), 0 FAIL | ✓ PASS |
-| App vet | `go vet $(go list -f '{{.Dir}}/...' -m)` (fonoteka.go, all workspace modules) | exit 0 | ✓ PASS |
-| App regression | `go test $(go list -f '{{.Dir}}/...' -m) -count=1` (fonoteka.go, root + user + fonoteka plugin modules) | exit 0; 13 packages ok, 0 FAIL | ✓ PASS |
-| Phase 9 framework tests, named | `go test ./modules/cabana -v -run '^(TestAllowsFollowsWinterHasAnyAccess\|TestNavigationDropsDeniedParentAndRepointsTarget\|TestRelationMutationsFollowToolbarButtons\|TestBulkDelete(Duplicates\|Idempotent\|Rollback)\|TestCRUDHooks\|TestCRUDFillTypeIsValidation\|TestFormSchema(Compile\|Rejects)\|TestListSchemaCompile\|TestRelationCandidateExclusions\|TestPhase09PermissionMatrix\|TestAdminAuthLifecycle\|TestAdminCreateCommand\|TestAdminResetPasswordCommand)$'` | 16 PASS | ✓ PASS |
-| Review-fix tests, named | `go test ./modules/cabana ./modules/bouncer -v -run '^(TestActivateRefusesAForeignBackendGuard\|TestAdminCreateRejectsCrossFieldCollision\|TestAdminLogoutRevokesExpiredRefreshableToken\|TestAdminPasswordWithoutFlag\|TestBackendUserPermissionsOverrideRole\|TestCRUDOperationsFollowDeclarations\|TestCRUDRequiredFollowsContext\|TestFieldByColumnTagBeatsGoName\|TestHooksReceiveTheWriteTransaction\|TestListSearchNonTextColumns\|TestLoginAmbiguousIdentifier\|TestMissingUserHashUsesConfiguredCost\|TestModelHelpersLookThroughEmbeddedStructs\|TestRegistryOwner\|TestRelationColumnOrderIsIndependentOfIndentation\|TestRelationDefaultSort\|TestVerifyRefreshableClaimsAudience)$'` | 17 PASS (WR-09 scaffold assertions run inside `TestScaffoldAllArtifacts`, full run PASS) | ✓ PASS |
-| Guard isolation | `go test ./modules/bouncer -run '^TestPhase09GuardIsolation$' -v` | PASS | ✓ PASS |
-| Backend admin migrations incl. WR-11 index | `go test ./modules/lagoon -count=1 -v -run '^(TestBackendAdmin.*)$'` | 6 PASS (`Migration`, `Seed`, `Rollback`, `WinterRow`, `EmailCaseInsensitiveUnique`, `EmailIndexRefusesCaseDuplicates`) | ✓ PASS |
-| Assembled Phase 9 acceptance and controllers | `go test ./plugins/golem15/fonoteka -count=1 -v -run '^(TestPhase09.*\|TestAdminSettings.*\|TestAdminMetadata.*\|TestCollectionsAdmin.*\|TestAlbumsAdmin.*\|TestGenresAdmin.*\|TestArtistsAdmin.*\|TestStylesAdmin.*\|TestAdminTracer.*\|TestAdminAuthLifecycleAssembled)$'` (fonoteka.go) | exit 0; 79 PASS, 0 SKIP, 0 FAIL | ✓ PASS |
+| Framework vet + short suite | `go vet ./...`; `go test -short -count=1 ./...` | vet clean; 38 packages ok, none failing | ✓ PASS |
+| Token guard under the race detector | `go test -short -count=1 -race ./modules/cabana -run 'Token\|ResolveBackend\|Phase09\|Allows'` | ok | ✓ PASS |
+| 16.3 guard on the Phase 9 path (previously order-dependent) | `go test -count=1 ./modules/cabana -run '^(TestAllowsScope\|TestBackendTokenGuard\|TestBackendTokenPostgres\|TestInteractiveOnly\|TestResolveBackend\|TestScopeCoversAll\|TestScopeMatch\|TestTokenRouteGates\|TestTokenTracerPostgres\|TestTokenGatesSmoke\|TestAccountTokens\|TestTokenLastUsedThrottlePerGuard\|TestTokenLastUsedDebounce)$'` | 13 PASS; `TestBackendTokenPostgres` PASS after `TestAccountTokens` and `TestTokenTracerPostgres` | ✓ PASS |
+| Full cabana package (Docker) | `go test -count=1 ./modules/cabana` | ok (84.8s) | ✓ PASS |
+| Phase 9 framework tests (PostgreSQL) | `go test -count=1 ./modules/cabana ./modules/lagoon -run '^(TestLoginAmbiguousIdentifier\|TestHooksReceiveTheWriteTransaction\|TestCRUDRequiredFollowsContext\|TestCRUDOperationsFollowDeclarations\|TestCRUDHooks\|TestCRUDFillTypeIsValidation\|TestBulkDelete.*\|TestAdminPasswordWithoutFlag\|TestAdminCreateRejectsCrossFieldCollision\|TestAdminAuthLifecycle\|TestAdminLogoutRevokesExpiredRefreshableToken\|TestBackendUserPermissionsOverrideRole\|TestListSearchNonTextColumns\|TestBackendAdmin.*\|TestAdminCreateCommand\|TestAdminResetPasswordCommand)$'` | 27 PASS | ✓ PASS |
+| Assembled route inventory + denial matrix | (fonoteka.go) `go test ./plugins/golem15/fonoteka -run '^TestPhase09Security' -count=1 -v` | `TestPhase09SecurityRoutes` PASS, `TestPhase09SecurityMatrix` PASS | ✓ PASS |
+| Assembled Phase 9 suites | (fonoteka.go) named suites (above) | 79 PASS, 0 FAIL, 0 SKIP | ✓ PASS |
 
 ### Probe Execution
 
-No `scripts/*/tests/probe-*.sh` exists and no plan declares a probe. The phase gate ran instead:
+No `scripts/*/tests/probe-*.sh` exists and no plan declares one. The phase gate ran instead:
 
 | Probe | Command | Result | Status |
 |---|---|---|---|
-| `scripts/check-phase9.sh` | `--self-test` | planted cases refused ("skipped TestPhase09MigrationsFreshRollback", "zero tests", "failed TestPhase09ContractInventory", "zero tests in a/cabana"), then "phase9 self-test passed", exit 0 | PASS |
-| `scripts/check-phase9.sh` | `--openapi` | "phase9 openapi passed", exit 0 | PASS |
 | `scripts/check-phase9.sh` | `--security` | "phase9 security passed", exit 0 | PASS |
-| `scripts/check-admin-openapi.sh` | `--check` | exit 0 | PASS |
+| `scripts/check-phase9.sh` | `--all` | self-test refuses its 4 planted cases then "phase9 self-test passed"; "phase9 security passed"; "phase9 postgres passed"; "phase9 openapi passed"; "phase9 evidence files passed"; security/postgres/openapi again; "phase9 evidence passed"; exit 0 | PASS |
+
+After `--all`, fonoteka.go's working tree showed only its three pre-existing submodule pointer changes. The openapi stage left no diff.
 
 ### Requirements Coverage
 
 | Requirement | Source Plans | Description | Status | Evidence |
 |---|---|---|---|---|
-| AUTH-08 | 09-01, 09-02, 09-11, 09-12 | Backend admins with roles and a permission registry, separate from frontend users, gating navigation and controllers | ✓ SATISFIED | Truth 1 |
+| AUTH-08 | 09-01, 09-02, 09-11, 09-12 | Backend admins with roles and a permission registry, separate from frontend users, gating navigation and controllers | ✓ SATISFIED | Truth 1; acceptance gate green |
 | ADMIN-01 | 09-03, 09-06..09-10, 09-12 | fields.yaml to JSON form schema | ✓ SATISFIED | Truth 2 |
 | ADMIN-02 | 09-01, 09-04, 09-06..09-10, 09-12 | columns.yaml to JSON list schema | ✓ SATISFIED | Truth 3 |
 | ADMIN-03 | 09-10, 09-12 | relation-manager replaces `partial` | ✓ SATISFIED | Truth 4 |
 | ADMIN-04 | 09-05..09-10, 09-12 | CRUD hooks and per-record bulk delete | ✓ SATISFIED | Truth 5 |
 | ADMIN-05 | 09-11, 09-12 | settings model bound through the same pipeline | ✓ SATISFIED | Truth 5 |
 
-REQUIREMENTS.md maps exactly these six IDs to Phase 9, so there are no orphaned requirements.
+REQUIREMENTS.md maps exactly these six IDs to Phase 9; no orphaned requirements.
 
 ### Anti-Patterns Found
 
 | File | Line | Pattern | Severity | Impact |
 |---|---|---|---|---|
-| `internal/build/stubs/artifacts.tmpl` | 106 | `// TODO: return a pointer to the plugin's model` in the generated controller | ℹ️ Info | Deliberate scaffold placeholder (WR-09); generated text, not a debt marker in phase code. Until filled in, the scaffold answers 500 and boot refuses the undeclared permission |
-| `modules/cabana/settings.go` | 149 | no test writes a numeric settings field | ℹ️ Info | The `json.Number` conversion lives in the shared `lagoon.Fill`; settings Fill failures already answer 422 |
+| `internal/build/stubs/artifacts.tmpl` | — | `// TODO: return a pointer to the plugin's model` in generated scaffold | ℹ️ Info | Deliberate scaffold placeholder (WR-09) |
+| `modules/cabana/{account_tokens,account_tokens_test,token_postgres_smoke_test,token_routes_test,token_scopes_test}.go` | — | not gofmt-formatted (predates b45af8e, per the quick SUMMARY) | ℹ️ Info (16.3 scope) | Cosmetic. Not in the Phase 9 covered set; I did not re-check it |
 
-No `TBD`/`FIXME`/`XXX` in any covered implementation file (grep: no hits). The 12 Info review findings (IN-01..IN-12) remain `open` in the ledger and are out of the fix run's scope; none defeats a success criterion.
+The previous blocker (stale `admin_phase09_security_test.go` inventory) and the info item (`lastStamp` process-global map) are resolved. The five files touched by b45af8e are gofmt-clean, and they and the fonoteka inventory test have no `TBD`/`FIXME`/`XXX`.
+
+### Advisory (New Scope, Unevidenced)
+
+None. The previous advisory (`TestBackendTokenPostgres` order dependence) is closed, see `re_verification.advisory_closed`.
 
 ### Human Verification Required
 
-None open. The previous items are resolved by the user's recorded decisions on 2026-10-01 (09-REVIEW-FIX.md "Decisions", 09-UAT.md status complete, 3/3 pass, commit ba1aaef), and the code at HEAD matches each decision:
+None. All three 09-UAT.md rows (recorded 2026-10-01T21:13:02Z) were decisions and triage, not runtime observations. The code changed since this morning's report is the token `last_used_at` debounce and one fonoteka test inventory, and neither touches what those decisions rest on:
 
-| Item | Decision | Code evidence |
+| UAT row | Rests on | Still holds at HEAD |
 |---|---|---|
-| WR-11 unique index on `lower(email)` | add it | migration `202610010001_backend_users_email_ci_unique`; `TestBackendAdminEmailCaseInsensitiveUnique`, `TestBackendAdminEmailIndexRefusesCaseDuplicates` PASS |
-| WR-03 single-record delete | keep as Winter (allowed whenever a form exists) | `operationDeclared` in `modules/cabana/http.go`; `TestCRUDOperationsFollowDeclarations` PASS |
-| WR-17 deny versus wildcard | keep as Winter (exact-code merge) | `applyUserPermissions` in `modules/cabana/auth.go`; `TestBackendUserPermissionsOverrideRole` PASS |
-| 24 judgment-tier prohibitions | verdicts accepted; 09-03 #1 superseded by Phase 10.1 D-09 | Prohibitions table above |
+| 1 CR-01 | Fill type errors answer 422 | `crud.go` unchanged; `TestCRUDFillTypeIsValidation` PASS today |
+| 2 WR-01..WR-19 triage (WR-03, WR-11, WR-17 decisions) | `operationDeclared` delete rule; `lower(email)` index; `applyUserPermissions` exact-code merge | `TestCRUDOperationsFollowDeclarations`, `TestBackendAdmin*`, `TestBackendUserPermissionsOverrideRole` PASS today; `auth.go`, `contracts.go` unchanged |
+| 3 24 prohibitions | see Prohibitions table | none newly violated |
+
+They are recorded under `human_verified` and are not re-requested.
 
 ### Gaps Summary
 
-No ROADMAP success criterion failed, so there are no gaps. Separate admin authentication, permission gating of controllers, settings and navigation, the strict goccy/go-yaml form and list pipeline, the relation manager that replaces the Collections editors `partial`, the CRUD hooks, per-record bulk delete and the settings binding all exist under `modules/`, are wired, and pass their tests on real PostgreSQL at HEAD in both repositories. CR-01 and all 19 review warnings are fixed in code, and each fix has a passing named test.
+None remaining. The one blocker from the 13:00Z run, the stale app-side route inventory, was fixed by a test-only fonoteka.go commit (e074028). The verifier re-ran it and it is green. Each of the 10 routes is confirmed inside cabana's `backend` group, and the field upload route also goes through `protect`/`operationDeclared`. `check-phase9.sh --security` and `--all` exit 0.
 
-The three policy choices from the fix run are decided (WR-11 index added and tested; WR-03 and WR-17 kept as Winter), the judgment-tier prohibition verdicts are accepted, and UAT is complete. No truth failed, no human item is open, so the phase is `passed`.
+The 16.3 advisory is also resolved. b45af8e replaces the process-global `lastStamp` map with a per-guard `stampThrottle`. It changes only when `last_used_at` is written, after authentication and scope decisions. The `g15_`/JWT routing, the backend JWT guard, guard ownership and narrow-only scopes are unchanged, and their tests pass, including on PostgreSQL and under `-race`.
+
+A process note carries over from the last report, still not acted on: framework commits that add an admin route should also update fonoteka's `phase09AdminRoutes`, or run `check-phase9.sh --security` first. The root `go test ./...` does not run fonoteka.go tests.
 
 ---
 
-_Verified: 2026-10-01T21:17:13Z_
-_Verifier: Claude (gsd-verifier)_
+_Verified: 2026-10-11T13:38:34Z_
+_Verifier: Claude (msd-verifier)_

.planning/phases/10-admin-vue-spa/10-SECURITY-REVIEW.md

@@ -1,12 +1,14 @@
 ---
 phase: "10"
-reviewed: "2026-09-27"
-threats_open: 0
+reviewed: "2026-10-12"
+threats_open: 1
 gate: "scripts/check-phase10.sh --all"
 ---
 
 # Phase 10 Security Review
 
+**2026-10-12 refresh (quick task 261012-s3g).** This refresh re-reviews the admin surface after Phases 12.1 to 17. Phase 17-02 added a second raw-HTML sink: the RichEditorField read-only view, which bound the output of a hand-built walker that DOM clobbering bypassed (T-10-16, T-17-10). The walker is replaced by DOMPurify 3.4.16 (decision note `.planning/notes/2026-10-12-admin-display-sanitizer-dompurify.md`) and proven in a real engine by a Vitest browser-mode suite (`tests/browser/richeditor-display.test.ts`, Playwright Chromium). The admin CSP adds `form-action 'self'` and `frame-src 'none'`. The `--hygiene` and `--self-test` stages, red since Phase 17, are green again, and `check-phase17.sh` runs the Phase 10 hygiene. One threat stays open: `--all` and `--evidence` still refuse on a failure in `../fonoteka.go` that predates this refresh (T-10-24 row).
+
 This is a fresh code-and-test review of every threat in the registers of Plans 10-01 to 10-05. A high threat counts as mitigated only when its named test fails with the protection removed. That was checked by mutating the production code and re-running the test, as recorded under "Removal check" below. Accepted and transferred threats keep their rationale from the originating plan.
 
 Commands run from `summercms.go`. `../fonoteka.go` tests run inside that repository. Gate stages are modes of `scripts/check-phase10.sh`.
@@ -16,7 +18,7 @@ Commands run from `summercms.go`. `../fonoteka.go` tests run inside that reposit
 | T-10-01 | Information Disclosure | cabana login/refresh cookie transport | high | mitigated | `cabana/auth.go`: an X-Requested-With login or cookie refresh writes the JWT only into the HttpOnly `summer_admin` cookie and returns `cookieLoginData` (token_type, expires_in). `admin/src/api/client.ts` never reads a token | `TestPhase10CookieAuth` (cabana), `TestPhase10TracerSPA` (fonoteka), `TestPhase10Coverage/cookie refresh…`; stages `--security`, `--postgres` | pass; removal check fails both tests | A script injected into the admin origin could still act with the session. The CSP `script-src 'self'` and the no-raw-HTML rule (T-10-16) limit that |
 | T-10-02 | Tampering | cookie-authenticated unsafe admin routes (CSRF) | high | mitigated | `cabana/csrf.go` `requireAjax` wraps every POST/PUT/DELETE except login and refuses a request with neither Bearer nor `X-Requested-With: XMLHttpRequest` before decoding. The cookie is SameSite=Strict | `TestPhase10CSRF` (walks every mounted handler with a body-read spy), `TestPhase10Coverage/every unsafe mounted route is CSRF-walked` (fails when an unsafe route is added without the walk), `TestPhase10TracerSPA` step 8; stage `--security` | pass; removal check fails TestPhase10CSRF and TestPhase10TracerSPA | Relies on browsers not sending custom headers cross-origin without a CORS preflight, and the admin API answers none |
 | T-10-03 | Information Disclosure | boardwalk static serving | medium | mitigated | `boardwalk/boardwalk.go` serves the embedded fs only, with `path.Clean`. It lists no directory, answers 404 for an extension miss and the JSON envelope for `api/` misses | `go test ./boardwalk` (TestTraversalIsCleaned, TestDirectoryIsNeverListed, TestMissingFileWithExtensionIs404, TestPhase10BoardwalkServing encoded traversal); stage `--security` | pass | None known |
-| T-10-04 | Tampering | admin HTML responses (clickjacking, sniffing, indexing) | medium | mitigated | `setSecurityHeaders`: X-Frame-Options DENY, CSP frame-ancestors none, script-src self, nosniff, Referrer-Policy same-origin, X-Robots-Tag noindex. The index has no inline script | `TestSecurityHeadersOnEveryResponse`, `TestNoInlineScript`, `TestPhase10BoardwalkServing/HEAD…`; stage `--security` | pass | None known |
+| T-10-04 | Tampering | admin HTML responses (clickjacking, sniffing, indexing, injected forms and frames) | medium | mitigated | `boardwalk.SetSecurityHeaders`: X-Frame-Options DENY, CSP `frame-ancestors 'none'; base-uri 'none'; object-src 'none'; script-src 'self'; form-action 'self'; frame-src 'none'`, nosniff, Referrer-Policy same-origin, X-Robots-Tag noindex. The index has no inline script. Injected markup can neither post a native form off-origin nor frame fetched content; a sandboxed srcdoc preview (Blog Editor) is not fetched and still renders (headless Chromium 1223 probe, 2026-10-12) | `TestSecurityHeadersOnEveryResponse`, `TestPhase101BoardwalkExports`, `TestNoInlineScript`, `TestPhase10BoardwalkServing/HEAD…`; stage `--security` | pass; removal check (drop `form-action 'self'`) fails both header tests | The CSP still allows inline styles and off-origin images in rendered content |
 | T-10-05 | Spoofing | admin session cookie attributes and logout | high | mitigated | `cabana/auth.go` `sessionCookie`: HttpOnly, Secure (opt-out refused in production), SameSite=Strict, Path=prefix, Max-Age=refresh TTL. `logout` blacklists the jti and expires the cookie. `refresh` loads the admin through the guard's provider and refuses a missing, deactivated or pre-cutoff subject via `bouncer.RefreshAudienceFor`, expiring the cookie on that refusal | `TestPhase10CookieAuth`, `TestPhase10Coverage/cookie refresh…` (attributes on refresh), `TestPhase10AdminAuth` (fonoteka), `TestPhase10AssembledAcceptance` (old cookie is 401 after logout), `TestPhase10Prefix` (cookie_secure false refused in production), `TestAdminRefreshRevocation` (cabana, Postgres), `TestRefreshAudienceForSubject` (bouncer); stages `--security`, `--postgres` | pass; removal checks (HttpOnly off, SameSite Lax, blacklist skipped) each fail | A stolen cookie or Bearer token stays usable until logout, `summer admin:reset-password` (tokens_valid_after), deactivation or deletion of the admin, or the end of its refresh window. Before quick task 260927-q23 (CR-01), refresh skipped the tokens_valid_after and is_activated checks, so a reset did not end a session the SPA kept refreshing. The refresh window slides on every refresh, so a session refreshed at least once per refresh_ttl has no absolute expiry (WR-07, open) |
 | T-10-06 | Elevation of Privilege | prefix and controller ID collisions | medium | mitigated | `cabana.AdminPrefix` validation, `checkReservedSegments`, and `surf.checkAdminPrefix` rejecting non-cabana routes at or under the prefix | `TestPhase10Prefix`, `TestPhase10AdminPrefixCollision` (exact, deeper, raw, default `/backend`, sibling allowed); stage `--security` | pass | None known |
 | T-10-07 | Denial of Service | concurrent cookie refresh from two tabs | low | mitigated | fonoteka `blacklist_grace: 30`. `client.ts` single-flights one refresh and replays once | `tests/app/client.test.ts` (single-flight, one replay), `tests/smoke/tracer.smoke.test.ts`; stage `--spa` | pass | Two tabs refreshing more than 30 s apart with the same old cookie: the second tab re-logs in |
@@ -28,17 +30,17 @@ Commands run from `summercms.go`. `../fonoteka.go` tests run inside that reposit
 | T-10-13 | Tampering | messages and toolbar YAML | low | mitigated | Strict decoding with unknown-key rejection, a custom toolbar unmarshal and boot-time key checks | `TestPhase10Messages`, `TestPhase10Toolbar`, `TestPhase10Coverage/relation messages default…`; stage `--go` | pass | None known |
 | T-10-14 | Tampering | OpenAPI document versus handler output | medium | mitigated | Handlers write the documented types. The converter emits exact unions | `TestPhase10OpenAPIConformance` (every route, unknown fields disallowed), `TestUnionRewrite`, `check-admin-openapi.sh --check`; stage `--openapi` | pass | None known |
 | T-10-15 | Elevation of Privilege | filters/{scope}/options | medium | mitigated | `protect()` before the provider. Scope names are allow-listed against the compiled filters; anything else is 404 | `TestPhase10FilterOptions`, `TestPhase10Coverage/filter option edges`; stage `--go` | pass | None known |
-| T-10-16 | Tampering | SPA rendering of plugin labels, messages and record values (XSS) | high | mitigated | Text interpolation only. `admin/src` has no `v-html`, `innerHTML` or `insertAdjacentHTML`. `interpolate` works on plain strings | `--hygiene` (raw-HTML rule, proven by `--self-test` plant), `tests/list/CellValue.test.ts`, `tests/ui/ui.test.ts` (toast and confirm text), `tests/form/fields.test.ts` (hostile type name); stages `--hygiene`, `--spa` | pass; removal check (CellValue via `v-html`) fails the CellValue suite and `--hygiene` | Vue's own escaping is trusted |
+| T-10-16 | Tampering | SPA rendering of plugin labels, messages and record values (XSS) | high | mitigated | Vue text interpolation everywhere except two reviewed sinks: MarkdownField binds only the server-rendered `POST /markdown/preview` answer (cabana.RenderMarkdown), and the RichEditorField read-only view binds only `displayHtml` output. `displayHtml` (`richeditor/html.ts`) uses a dedicated DOMPurify 3.4.16 instance: EDITOR_TAGS only, `href` only on `<a>` and only through `isAllowedLink` (uponSanitizeAttribute hook), the DROPPED elements with their content, string in and string out through DOMPurify's inert DOMParser document (nothing adopted into the live document, nothing loads). It fails closed (empty string) unless `isSupported` and a fixed canary hold. `lossy.ts` parses into an inert template for tag names only | `tests/browser/richeditor-display.test.ts` (Playwright Chromium: form/input, img and button named nodeType with img onerror, nested in a div, input named localName, off-origin form with a password input, iframe, meta refresh, javascript:/ftp:/sms: hrefs, href on a non-`a` element, inert parse with a resource-timing control, read-only RichEditorField mount), `tests/form/RichEditorField.test.ts` (happy-dom, never as stored), `tests/list/CellValue.test.ts`, `tests/ui/ui.test.ts`, `tests/form/fields.test.ts`; `--hygiene` (raw-HTML rule with line-exact T-17-10 exceptions) and its `--self-test` plants (the display line in another file, a template parse elsewhere); stages `--spa`, `--hygiene` | pass; removal checks: the pre-fix walker fails 4 browser tests, an always-usable sanitizer fails the happy-dom test, removing the hook fails the browser link test, `CellValue` via `v-html` fails its suite and `--hygiene` | Stored richeditor HTML is not sanitized on read server-side; the display relies on DOMPurify plus the CSP. The CSP still allows inline styles and off-origin images in rendered content. Vue's own escaping is trusted |
 | T-10-17 | Tampering | login redirect parameter (open redirect) | medium | mitigated | `safeRedirect` accepts only a path starting with exactly one slash (not `//` or `/\`) | `tests/app/router.test.ts`, `tests/views/LoginView.test.ts`; stage `--spa` | pass | None known |
 | T-10-18 | Elevation of Privilege | client-side hiding of actions and fields | low | accepted | The server enforces permissions, toolbar actions, writable fields and relation scope (Plans 10-01/10-02). The SPA renders only what it receives and never adds entries, so client manipulation gains nothing | Server enforcement evidence: `TestPhase10AssembledAcceptance` (limited admin gets 403 on Albums), `TestPhase09PermissionMatrix`; stage `--postgres` | pass | Accepted: UI hiding is cosmetic |
 | T-10-19 | Information Disclosure | list state (search terms, filters) in the URL | low | accepted | Admin-only, same-origin, Referrer-Policy same-origin and noindex from Plan 10-01. Search terms are not secrets | `TestSecurityHeadersOnEveryResponse`; stage `--security` | pass | Accepted: terms stay in browser history |
 | T-10-20 | Tampering | Winter redirect and recordUrl strings used for navigation | low | mitigated | `mapWinterUrl` produces only the current controller's list, create and record routes. Anything else falls back to the list | `tests/app/winterUrl.test.ts` (foreign, absolute, protocol-relative, javascript: inputs); stage `--spa` | pass | None known |
 | T-10-21 | Elevation of Privilege | relation link of candidates outside scope (owner, inactive users) | medium | transferred | Enforced server-side by Phase 9: RelationExtendManageQuery, ExcludedRelatedIDs, and TestCollectionsAdminForgedPivot/CrossScope. The SPA only posts ids chosen from the server's candidates and runs those suites as a regression in Task 1 | `TestCollectionsAdmin*` (fonoteka), `TestPhase10AssembledAcceptance` (owner not offered); stages `--go`, `--postgres` | pass | Transferred to the Phase 9 server contract |
-| T-10-22 | Information Disclosure | localStorage | low | mitigated | Only `useSidebar.ts` writes browser storage: the `summer-admin.sidebar` boolean | `--hygiene` storage rule (proven by the `--self-test` plant), `tests/state/useSidebar.test.ts` (only that key is ever written) | pass | None known |
+| T-10-22 | Information Disclosure | localStorage | low | mitigated | Browser storage holds only the `summer-admin.sidebar` boolean (`useSidebar.ts`) and the per-list query parameters (`listState.ts`, T-16.1-03), never a token | `--hygiene` storage rule (proven by the `--self-test` plant), `tests/state/useSidebar.test.ts` (only that key is ever written) | pass | None known |
 | T-10-23 | Spoofing | logout on a shared browser | medium | mitigated | `useAuth.logout` POSTs `/auth/logout` (the server blacklists and expires the cookie), then clears user, navigation and settings and routes to login, even on a failure | `tests/state/useAuth.test.ts` (success, 500, network failure), `tests/shell/UserMenu.test.ts`, `TestPhase10AssembledAcceptance` (old cookie is 401 after logout); stages `--spa`, `--postgres` | pass | None known |
-| T-10-24 | Repudiation | Phase 10 acceptance evidence | high | mitigated | `scripts/check-phase10.sh`: `phase10_detect` refuses failed, skipped, zero-test, non-JSON and build-failed runs, and named tests that did not pass. Only the two documented parity failures are allow-listed, and they refuse once they pass again. OpenAPI and dist drift, hygiene and evidence stages | `scripts/check-phase10.sh --self-test` (synthetic fail, skip, zero, non-JSON, build, package, required, allow-list cases; hygiene plants); stage `--all` | pass; every synthetic bad run is refused with its own exit code | The allow-list names two tests owned by a Phase 9 follow-up (deferred-items.md) |
-| T-10-25 | Tampering | framework/app boundary and hand-maintained API types | low | mitigated | The `--hygiene` stage refuses: app or Polish catalogue names in summercms.go admin, boardwalk, cabana and phrasebook; `types.ts` shapes that are not aliases onto the generated schema; direct fetch; raw HTML; foreign origins in dist; icon namespace imports; retired-prefix routes; untested SPA modules | `--hygiene`, `--self-test` | pass | None known |
-| T-10-SC | Tampering | npm/Go dependencies | high | mitigated | No package was added in Plans 10-02 to 10-05. `admin/` installs with `npm ci` against the lockfile approved at the 10-01 blocking-human gate (17 exact pins). swag stays pinned at v1.16.6 via `go run` | `scripts/check-phase10.sh --spa` (runs `npm ci` against the lockfile); removal check: a changed pin in a scratch copy makes `npm ci` exit 1 | pass | npm 12 blocks the esbuild and vue-demi postinstall scripts. Neither is needed |
+| T-10-24 | Repudiation | Phase 10 acceptance evidence | high | open | `scripts/check-phase10.sh`: `phase10_detect` refuses failed, skipped, zero-test, non-JSON and build-failed runs, and named tests that did not pass; OpenAPI and dist drift, hygiene (with the T-17-10 exceptions) and evidence stages; `--spa` also runs the Vitest browser suite fail-closed. `scripts/check-phase17.sh` docs stage runs `check-phase10.sh --hygiene`, so cross-phase admin drift fails Phase 17's gate (asserted by its `--self-test`) | `scripts/check-phase10.sh --self-test` (synthetic runs; hygiene plants including vhtml-elsewhere, template-parse, origin); stages `--hygiene`, `--spa`, `--postgres`, `--openapi`, `--dist` green on 2026-10-12; `check-phase17.sh --all` green | `--self-test`, `--hygiene`, `--spa`, `--postgres`, `--openapi`, `--dist` pass. `--all`, `--security` and `--evidence` exit 1 on `TestPhase09SecurityRoutes` in `../fonoteka.go` only: its `phase09AdminRoutes` allowlist lacks the Phase 17-01 reorder and singleton routes (recorded in 09-SECURITY.md; fails identically with the pre-refresh framework source) | Open until `fonoteka.go` adds the three route keys to `phase09AdminRoutes` and `--all` is re-run green (quick 261012-s3g deferred-items.md) |
+| T-10-25 | Tampering | framework/app boundary and hand-maintained API types | low | mitigated | The `--hygiene` stage refuses: app or Polish catalogue names in summercms.go admin, boardwalk, cabana and phrasebook; `types.ts` shapes that are not aliases onto the generated schema; direct fetch; raw HTML outside the line-exact reviewed sinks; foreign origins in dist (only never-requested literals are allowed: `https://prosemirror.net`, ProseMirror error text, and `https://admin.invalid`, the reserved-TLD parse base of `isAllowedLink`); icon namespace imports; retired-prefix routes; untested SPA modules (the reorder modules are imported by path in `tests/views/ReorderView.test.ts`) | `--hygiene`, `--self-test` (origin plant) | pass | None known |
+| T-10-SC | Tampering | npm/Go dependencies | high | mitigated | `admin/` installs with `npm ci` against the committed lockfile, all exact pins. Added 2026-10-12 under `.planning/notes/2026-10-12-admin-display-sanitizer-dompurify.md`: dompurify 3.4.16 (runtime; lockfile integrity checked against the registry), @vitest/browser 3.2.7 and playwright 1.60.0 (dev); maintainers, repositories and release dates verified, `npm audit signatures` clean (308 verified signatures). swag stays pinned at v1.16.6 via `go run` | `scripts/check-phase10.sh --spa` (runs `npm ci` against the lockfile); removal check: a changed pin in a scratch copy makes `npm ci` exit 1 | pass | npm 12 blocks the esbuild and vue-demi postinstall scripts. Neither is needed. dompurify 3.4.17 bump pending its 7-day cooldown (after 2026-10-19) |
 
 ## Removal check
 
@@ -57,10 +59,19 @@ The production code was changed, the named tests were run, and the file was rest
 | T-10-16 | `CellValue` renders text through `v-html` | `npx vitest run tests/list/CellValue.test.ts`; `scripts/check-phase10.sh --hygiene` | both exit 1 |
 | T-10-24 | synthetic fail, skip, zero, non-JSON, build, package, missing required and stale allow-list runs | `scripts/check-phase10.sh --self-test` | each refused with its exit code |
 | T-10-SC | `vue` pin changed in a scratch `package.json` | `npm ci --dry-run --offline` against the committed lockfile | exit 1 |
+| T-10-16 (a), 2026-10-12 | pre-fix `html.ts` (hand-built `clean()` walker) restored | `npm --prefix admin run test:browser` | exit 1: drops clobbered forms, localName, inert document and read-only RichEditorField tests fail |
+| T-10-16 (b), 2026-10-12 | `sanitizerUsable` returns true unconditionally | `npx --prefix admin vitest run tests/form/RichEditorField.test.ts` (happy-dom) | exit 1: DOMPurify keeps the script under happy-dom |
+| T-10-16 (c), 2026-10-12 | `uponSanitizeAttribute` hook removed | `npm --prefix admin run test:browser` | exit 1: href on `p`, ftp: and sms: hrefs survive |
+| T-10-04, 2026-10-12 | `form-action 'self'` dropped from the CSP | `go test ./modules/boardwalk -run 'TestSecurityHeadersOnEveryResponse\|TestPhase101BoardwalkExports' -count=1` | exit 1 (both fail) |
+| T-10-24, 2026-10-12 | planted RichEditorField display line in another file, template parse elsewhere, foreign origin in the dist JS | `scripts/check-phase10.sh --self-test` | each plant refused for its own rule; self-test exit 0 |
+| T-10-SC, 2026-10-12 | `dompurify` pin changed to 3.4.17 in a scratch `package.json` | `npm ci --dry-run --offline` against the committed lockfile | exit 1 (lock file's dompurify@3.4.16 does not satisfy 3.4.17) |
 
 Only one single-layer mutation left its named test green. Removing just the parse-time skip for T-10-10 did not fail `TestPhase10CollectionOwnerReadOnly`, because `assignBelongsTo` independently refuses protected keys. The review therefore names `TestPhase10Coverage`, which catches that layer, as well as the fonoteka test, which catches the full removal.
 
 ## Residual risk
 
 - Visual fidelity and the full browser flow are manual checks, not security controls (10-VALIDATION.md, manual-only rows).
+- Stored richeditor HTML is still not sanitized on read server-side (seaglass gates every save; legacy or imported values are not rewritten). The read-only display relies on DOMPurify plus the CSP.
+- dompurify 3.4.17 (published 2026-10-12, no advisory) is pending a 7-day cooldown; bump after 2026-10-19.
+- `check-phase10.sh --all` stays red until `../fonoteka.go` adds the Phase 17-01 reorder and singleton routes to `phase09AdminRoutes` (T-10-24).
 - The fonoteka.go `parity` package still fails `TestMigrateSeedsCanonicalGenres` and `TestSchemaMatchesPHPSnapshot`. Both predate Phase 10, are logged in deferred-items.md, and are the only failures the gate allows.

.planning/phases/10-admin-vue-spa/10-SECURITY.md

@@ -0,0 +1,149 @@
+---
+phase: "10"
+slug: "admin-vue-spa"
+status: draft
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 2
+asvs_level: 1
+created: "2026-10-12"
+---
+
+# Phase 10 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+The full evidence of the first review (tests, gate stages, removal checks) is in `10-SECURITY-REVIEW.md` (2026-09-27). This file records the threat state on master as of 2026-10-12, after Phases 12.1–17 changed the admin surface.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| Browser → `{backend.uri}/api/v1` | Untrusted requests carrying the admin cookie or a Bearer token and user-controlled headers | Session credentials, record writes |
+| Browser → `{backend.uri}/...` static | Untrusted paths resolved against the embedded dist tree | Request paths |
+| Plugin routes → admin prefix | Other compiled plugins could register paths that shadow the admin surface | Route ownership |
+| npm registry → admin/ build | Third-party packages become code in the committed dist | Build-time code |
+| SPA → options/filters endpoints | Untrusted search, paging and field/scope names select related rows | Related record labels |
+| SPA → record save | Untrusted relation ids and keys become foreign keys and pivot rows | Foreign keys, pivot rows |
+| Anonymous browser → /lang | Unauthenticated callers read the string bundle | Public UI strings |
+| Plugin YAML/override FS → boot | Plugin-supplied copy and toolbar declarations shape every schema | Configuration |
+| Admin API responses → DOM | Plugin labels, messages and record values (including stored HTML) render in the admin origin | Untrusted markup/text |
+| URL query → list requests | User-editable query parameters become list filters and sorting | Search terms |
+| Winter redirect strings → router | Plugin YAML strings choose navigation targets | URLs |
+| Browser storage | Anything persisted survives the session on a shared machine | Sidebar flag, list queries |
+| Test and gate results → phase acceptance | Gate completeness decides whether the admin surface counts as done | Acceptance evidence |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-10-01 | Information Disclosure | cabana login/refresh cookie transport | high | mitigate | `cabana/auth.go` `cookieLoginData` (token only in HttpOnly cookie); `TestPhase10CookieAuth` | closed |
+| T-10-02 | Tampering | cookie-authenticated unsafe admin routes (CSRF) | high | mitigate | `cabana/csrf.go` `requireAjax`, SameSite=Strict; `TestPhase10CSRF` | closed |
+| T-10-03 | Information Disclosure | boardwalk static serving | medium | mitigate | `boardwalk/boardwalk.go` embedded fs + `path.Clean`; `TestTraversalIsCleaned` | closed |
+| T-10-04 | Tampering | admin HTML responses (clickjacking, sniffing, indexing) | medium | mitigate | `boardwalk/boardwalk.go:171` security headers, CSP `frame-ancestors 'none'`, X-Robots-Tag | closed |
+| T-10-05 | Spoofing | admin session cookie attributes and logout | high | mitigate | `cabana/auth.go` `sessionCookie`, `adminCookieSecure` refuses opt-out in production, `bouncer.RefreshAudienceFor` | closed |
+| T-10-06 | Elevation of Privilege | prefix and controller ID collisions | medium | mitigate | `cabana` `checkReservedSegments`; `surf/router.go:581` `checkAdminPrefix` | closed |
+| T-10-07 | Denial of Service | concurrent cookie refresh from two tabs | low | mitigate | `admin/src/api/client.ts` single-flight refresh; `blacklist_grace` | closed |
+| T-10-08 | Tampering | committed dist and generated types drift | medium | mitigate | `scripts/check-admin-dist.sh`, `scripts/check-admin-openapi.sh --check` | closed |
+| T-10-09 | Elevation of Privilege | cabana relation save (IDOR via relation ids) | high | mitigate | `cabana/relation_field.go` `checkRelationScope`; `TestPhase10RelationForgedID` | closed |
+| T-10-10 | Tampering | belongs-to mapping of protected foreign keys | high | mitigate | `assignBelongsTo` / read-only protected FK. Since 12.1-02 a field may opt in via `WritableForeignKey`; the default stays read-only | closed |
+| T-10-11 | Information Disclosure | fields/{field}/options enumeration | medium | mitigate | `protect()` before SQL, per_page 1–100, 404 for non-relation/read-only | closed |
+| T-10-12 | Information Disclosure | public /lang bundle | low | mitigate | `cabana/lang.go` serves only `backend::lang.` | closed |
+| T-10-13 | Tampering | messages and toolbar YAML | low | mitigate | Strict decoding, unknown-key rejection | closed |
+| T-10-14 | Tampering | OpenAPI document versus handler output | medium | mitigate | `TestPhase10OpenAPIConformance`, `check-admin-openapi.sh --check` | closed |
+| T-10-15 | Elevation of Privilege | filters/{scope}/options | medium | mitigate | `protect()` + scope allow-list; `TestPhase10FilterOptions` | closed |
+| T-10-16 | Tampering | SPA rendering of plugin labels, messages and record values (XSS) | high | mitigate | Planned: no raw-HTML sink in admin/src. Phase 17-02 added `v-html="display"` (`RichEditorField.vue:305`) fed by `displayHtml` (`richeditor/html.ts`), whose `clean()` can be bypassed by DOM clobbering in Chromium (see audit 2026-10-12) | open |
+| T-10-17 | Tampering | login redirect parameter (open redirect) | medium | mitigate | `safeRedirect` (exactly one leading slash) | closed |
+| T-10-18 | Elevation of Privilege | client-side hiding of actions and fields | low | accept | Server enforces permissions; see Accepted Risks | closed |
+| T-10-19 | Information Disclosure | list state in the URL | low | accept | Admin-only, Referrer-Policy same-origin; see Accepted Risks | closed |
+| T-10-20 | Tampering | Winter redirect and recordUrl strings | low | mitigate | `mapWinterUrl` maps to current-controller routes only | closed |
+| T-10-21 | Elevation of Privilege | relation link of candidates outside scope | medium | transfer | Phase 9 server contract (RelationExtendManageQuery, ExcludedRelatedIDs) | closed |
+| T-10-22 | Information Disclosure | localStorage | low | mitigate | `useSidebar.ts` flag only; `listState.ts` per-admin list queries added under T-16.1-03 and allow-listed in hygiene | closed |
+| T-10-23 | Spoofing | logout on a shared browser | medium | mitigate | `useAuth.logout` POSTs `/auth/logout` and clears state even on failure | closed |
+| T-10-24 | Repudiation | Phase 10 acceptance evidence | high | mitigate | `scripts/check-phase10.sh`. On 2026-10-12 `--hygiene` and `--self-test` exit 1 (self-test rejects the clean scratch copy), so `--all` cannot pass and the 2026-09-27 review cannot be reproduced | open |
+| T-10-25 | Tampering | framework/app boundary and hand-maintained API types | low | mitigate | `--hygiene` boundary rules pass; the stage is red only on drift (literal origin strings in dist, reorder modules tested via the router but not imported by path, and the T-10-16 sink) | open — below high threshold (non-blocking) |
+| T-10-SC | Tampering | npm/Go dependencies | high | mitigate | Exact pins + committed lockfile + `npm ci`. TipTap (`@tiptap/*` 3.31.4) was added later in 17-02 under its own plan | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Open Threat Details (audit 2026-10-12)
+
+### T-10-16 — sanitizer bypass by DOM clobbering
+
+- **Sink:** `admin/src/components/form/fields/RichEditorField.vue:305` `v-html="display"`, `display = displayHtml(stored)` in read-only and preview mode (`PreviewField.vue` forces `readOnly`).
+- **Defect:** `clean()` (`admin/src/components/form/richeditor/html.ts:60-88`) reads `node.nodeType`, `element.localName`, `.childNodes` and `.attributes` and calls `.remove()`/`.replaceWith()` directly on untrusted nodes. A `<form>` with a control named `nodeType` overrides the property, the form is skipped and its subtree is kept unchanged.
+- **Reproduced:** headless Chromium (scratch probe) returns `<form><input name="nodeType"><img src=x onerror=…></form>` as-is, plus `<a href="javascript:…">`, `<iframe>`, `<meta http-equiv=refresh>`, `<style>` and an off-origin `<form action method=post>` with a password input. The same works with `<img name=nodeType>`, `<button name=nodeType>` and nested in `<div>`. `<input name="localName">` throws a TypeError and breaks the read-only view. `holder.append(fragment)` (html.ts:102) adopts nodes into the live document, so image loads start inside `displayHtml`.
+- **What limits it:** the admin CSP `script-src 'self'` (`boardwalk/boardwalk.go:32`) blocks inline handlers and `javascript:` URLs. It has no `form-action`, `frame-src` or `default-src`, so phishing forms, iframe overlays, meta-refresh redirects and CSS redress still work. The server sanitizer (seaglass) strips these on admin save, but stored values are not sanitized on read (17-02 deviation 1), and legacy or imported values are exactly the case this check exists for.
+- **Neutralised (36 vectors):** svg/math namespace confusion, noscript/xmp/noembed/noframes/plaintext/textarea/title, comment/CDATA, table foster-parenting, entity/whitespace/NUL/U+2028-obfuscated `javascript:`, `data:`, `vbscript:`, event handlers, style/id/name attributes.
+- **Test gap:** `admin/tests/form/RichEditorField.test.ts:154-168` fails if `displayHtml` is bypassed outright, but happy-dom does not implement form named properties, so no current test can catch the clobbering vector.
+- **Fix:**
+  1. Make `clean()` safe against clobbering. Either:
+     - switch to DOMPurify (`ALLOWED_TAGS` = `EDITOR_TAGS`, `ALLOWED_ATTR` = `['href']`, a hook calling `isAllowedLink`). This needs a decision note and the dependency checkpoint; or
+     - remove `HTMLFormElement` nodes first and read every property through `Node.prototype`/`Element.prototype` getters, never calling methods on the untrusted node.
+  2. Add a regression test with the clobbering vectors that runs in a real browser engine.
+  3. Optional: add `form-action 'self'; frame-src 'none'` to the admin CSP.
+  4. Re-check T-17-10, which shares this sanitizer.
+
+### T-10-24 — Phase 10 gate red since Phase 17
+
+- **`scripts/check-phase10.sh --hygiene`:** exit 1. It reports:
+  - raw-HTML hits at `RichEditorField.vue:305`, `richeditor/html.ts:103` and `richeditor/lossy.ts:33`;
+  - dist JS naming `https://admin.invalid` and `https://prosemirror.net`;
+  - `components/reorder/context.ts`, `ReorderBranch.vue` and `views/ReorderView.vue` as imported by no test.
+- **`--self-test`:** exit 1, "self-test hygiene rejected the clean scratch copy". It stops before any detector plant runs, and `--all` runs it first.
+- **Cause:** Phase 17 (cb2987c, 872fd65) added the sink, the TipTap literals and the reorder views. `check-phase17.sh` does not run `check-phase10.sh`. Earlier phases did reconcile with this gate (MarkdownField, `files.ts` XHR, `listState.ts`).
+- **Fix:**
+  1. Fix T-10-16.
+  2. Add line-exact, reviewed exceptions naming T-17-10 for the three raw-HTML lines.
+  3. Clear the T-10-25 drift.
+  4. Re-run `--self-test` and `--all` to green and refresh `10-SECURITY-REVIEW.md`.
+  5. Have later phase gates, or a standing check, run `check-phase10.sh --hygiene`.
+
+### T-10-25 — hygiene drift (non-blocking)
+
+- **Foreign origins:** both are literal strings with no network load. `https://prosemirror.net` is in a ProseMirror error message. `https://admin.invalid/` is the `new URL` base in `isAllowedLink` (html.ts:32).
+- **Reorder modules:** they are exercised by `admin/tests/views/ReorderView.test.ts` through the router (11 tests pass), but no test imports them by path.
+- **Fix:** allow-list the two strings in the dist-origin rule (or use `document.baseURI` as the parse base), and add direct path imports of the three reorder modules to a test.
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-10-01 | T-10-18 | UI hiding is cosmetic; the server enforces permissions, toolbar actions, writable fields and relation scope (`TestPhase10AssembledAcceptance`, `TestPhase09PermissionMatrix`) | Plan 10-03 | 2026-09-27 |
+| AR-10-02 | T-10-19 | Admin-only, same-origin, Referrer-Policy same-origin and noindex; search terms are not secrets and stay in browser history | Plan 10-03 | 2026-09-27 |
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-09-27 | 24 | 24 | 0 | Phase 10 security review (`10-SECURITY-REVIEW.md`) |
+| 2026-10-12 | 24 | 21 | 3 (2 blocking: T-10-16, T-10-24; 1 below threshold: T-10-25) | /msd-secure-phase 10: orchestrator L1 grep + msd-security-auditor (Chromium probe) |
+
+## Security Audit 2026-10-12
+| Metric | Count |
+|--------|-------|
+| Threats found | 24 |
+| Closed | 21 |
+| Open | 3 (2 blocking) |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [ ] `threats_open: 0` confirmed
+- [ ] `status: verified` set in frontmatter
+
+**Approval:** pending — blocked on T-10-16 and T-10-24

.planning/phases/10-admin-vue-spa/10-UAT.md

@@ -1,9 +1,9 @@
 ---
-status: complete
+status: testing
 phase: 10-admin-vue-spa
 source: [10-VERIFICATION.md]
 started: 2026-09-27T16:44:38Z
-updated: 2026-09-27T18:34:33Z
+updated: 2026-10-11T15:12:56.219Z
 ---
 
 ## Current Test
@@ -41,12 +41,32 @@ result: pass
 expected: Accept or reject the verifier's "not violated" verdicts.
 result: pass
 
+### 8. Re-walk the Phase 10 admin flows in a real browser on the current build: run the fonoteka binary, open /plytadmin as a superuser and as a genres-only admin, then use the list and form of each of the five controllers (search, sort, filter, paging, save, 422 field errors), link and unlink a Collection editor, open Ustawienia, and glance at light and dark mode.
+expected: Everything still behaves as approved in 10-UAT.md tests 2 to 5. The limited admin sees only fonoteka > Genres. Lists and forms render. The editor round trip works. The Albums form's later widgets, partials and field types do not break the Phase 10 form; list state persisted in the URL and storage does not confuse paging or filtering.
+result: [pending]
+
+### 9. Publish the sibling-repo test fixes the --go pass depends on: push sm-user-plugin 569768e, then commit the plugins/golem15/user pointer bump (cf5c6b9 -> 569768e) in fonoteka.go as a separate commit, and push fonoteka.go (03dad50, 7db5ef8 and the bump) when you choose.
+expected: A clean checkout of fonoteka.go at its committed pointer passes check-phase10.sh --go, as the working tree does now.
+result: [pending]
+
+### 10. Carried: decide CR-01 (refresh ignores tokens_valid_after / is_activated)
+expected: Fix now or accept with override
+result: [pending]
+
+### 11. Carried: Secure cookie on http://localhost (assumption A3)
+expected: Chrome and Firefox store summer_admin with default cookie_secure
+result: [pending]
+
+### 12. Carried: review the 17 judgment-tier prohibitions
+expected: Accept or reject the verifier's non-authoritative verdicts
+result: [pending]
+
 ## Summary
 
-total: 7
+total: 12
 passed: 7
 issues: 0
-pending: 0
+pending: 5
 skipped: 0
 blocked: 0
 

.planning/phases/10-admin-vue-spa/10-VERIFICATION.md

@@ -1,8 +1,8 @@
 ---
 phase: 10-admin-vue-spa
-verified: 2026-10-05T20:22:38Z
+verified: 2026-10-11T15:11:15Z
 status: human_needed
-score: 4/4 roadmap success criteria verified by automated evidence (plan truths 46/46; 1 browser re-check of changed views pending)
+score: "4/4 roadmap success criteria hold; plan truths 46/46 (the --go gap is closed: check-phase10.sh --go exit 0 in the verifier's own run)"
 covered_files:
   - ".gitignore"
   - ".planning/phases/10-admin-vue-spa/10-01-PLAN.md"
@@ -22,6 +22,7 @@ covered_files:
   - "admin/package.json"
   - "admin/src/App.vue"
   - "admin/src/api/client.ts"
+  - "admin/src/api/files.ts"
   - "admin/src/api/schema.d.ts"
   - "admin/src/api/types.ts"
   - "admin/src/app/controllerRoutes.ts"
@@ -32,6 +33,8 @@ covered_files:
   - "admin/src/app/runtime.ts"
   - "admin/src/app/theme.ts"
   - "admin/src/app/winterUrl.ts"
+  - "admin/src/components/account/ApiTokenCreateDialog.vue"
+  - "admin/src/components/account/ApiTokensPanel.vue"
   - "admin/src/components/form/FieldRenderer.vue"
   - "admin/src/components/form/FormErrorBanner.vue"
   - "admin/src/components/form/FormField.vue"
@@ -40,6 +43,8 @@ covered_files:
   - "admin/src/components/form/control.ts"
   - "admin/src/components/form/fields/CheckboxField.vue"
   - "admin/src/components/form/fields/DropdownField.vue"
+  - "admin/src/components/form/fields/FileCaptionModal.vue"
+  - "admin/src/components/form/fields/MLField.vue"
   - "admin/src/components/form/fields/NumberField.vue"
   - "admin/src/components/form/fields/RelationField.vue"
   - "admin/src/components/form/fields/SwitchField.vue"
@@ -47,6 +52,7 @@ covered_files:
   - "admin/src/components/form/fields/TextareaField.vue"
   - "admin/src/components/form/fields/UnsupportedField.vue"
   - "admin/src/components/form/formState.ts"
+  - "admin/src/components/form/mlLocale.ts"
   - "admin/src/components/form/registry.ts"
   - "admin/src/components/list/CellValue.vue"
   - "admin/src/components/list/DataTable.vue"
@@ -79,6 +85,8 @@ covered_files:
   - "admin/src/views/NotFoundView.vue"
   - "admin/src/views/SettingsFormView.vue"
   - "admin/src/views/SettingsIndexView.vue"
+  - "admin/tests/account/ApiTokenCreateDialog.test.ts"
+  - "admin/tests/account/ApiTokensPanel.test.ts"
   - "admin/tests/app/client.test.ts"
   - "admin/tests/app/controllerRoutes.test.ts"
   - "admin/tests/app/i18n.test.ts"
@@ -100,14 +108,17 @@ covered_files:
   - "admin/tests/fixtures/widgets.relation-candidates.json"
   - "admin/tests/fixtures/widgets.relation-linked.json"
   - "admin/tests/fixtures/widgets.relation-schema.json"
+  - "admin/tests/form/FileCaptionModal.test.ts"
   - "admin/tests/form/FormField.test.ts"
   - "admin/tests/form/FormGrid.test.ts"
   - "admin/tests/form/FormTabs.test.ts"
   - "admin/tests/form/FormView.test.ts"
+  - "admin/tests/form/MLField.test.ts"
   - "admin/tests/form/RelationField.test.ts"
   - "admin/tests/form/Settings.test.ts"
   - "admin/tests/form/fields.test.ts"
   - "admin/tests/form/formState.test.ts"
+  - "admin/tests/form/mlLocale.test.ts"
   - "admin/tests/form/registry.test.ts"
   - "admin/tests/helpers.ts"
   - "admin/tests/list/CellValue.test.ts"
@@ -151,8 +162,8 @@ covered_files:
   - "internal/tools/swagger2openapi/main_test.go"
   - "modules/boardwalk/boardwalk.go"
   - "modules/boardwalk/boardwalk_test.go"
-  - "modules/boardwalk/dist/assets/index-CqzF_Nki.css"
-  - "modules/boardwalk/dist/assets/index-z_LzMU8D.js"
+  - "modules/boardwalk/dist/assets/index-BeX-076N.css"
+  - "modules/boardwalk/dist/assets/index-CXQZEJp2.js"
   - "modules/boardwalk/dist/index.html"
   - "modules/bouncer/cookie_guard_test.go"
   - "modules/bouncer/jwt.go"
@@ -213,8 +224,7 @@ covered_files:
   - "scripts/check-admin-dist.sh"
   - "scripts/check-admin-openapi.sh"
   - "scripts/check-phase10.sh"
-covered_digest: "v2:sha256:778f7d89834605c7799f088401e3b1ef5edb4409f6899f322f67d165fa9e4847"
-covered_files_note: "Fingerprint refreshed 2026-10-05 at summercms.go HEAD e18885f. Content-hashed SPA bundles now modules/boardwalk/dist/assets/index-CqzF_Nki.css and index-z_LzMU8D.js. Later phases edited already-covered modules/ files (same digest-drift as Phase 9 Layer 2). Paths remain modules/. Status stays human_needed — this only clears the stale overlay so execute-phase is not re-invoked."
+covered_digest: "v2:sha256:dce85ba35408764f2ce0d7cc0f1297800a2a70d4c263b033a556c19bd3c6e604"
 behavior_unverified: 0
 overrides_applied: 0
 mvp_mode_note: "ROADMAP marks Phase 10 mode: mvp, but the goal is not a User Story. Following the Phase 1/3/5/8 precedent, the four ROADMAP success criteria are the contract and User Flow Coverage is derived from them."
@@ -223,63 +233,94 @@ decision_coverage:
   total: 28
   not_honored: []
 re_verification:
-  previous_status: passed
-  previous_score: "4/4 roadmap success criteria verified (plan truths 46/46 verified; A3 closed by human UAT)"
-  previous_head: c7487f6
-  reason: "The 2026-10-01T21:29Z report went stale because Vite rebuilt the two content-hashed SPA bundles (index-CfeX_snf.css / index-J-FCndLr.js → index-CqzF_Nki.css / index-z_LzMU8D.js) and later phases edited already-covered modules/ files. Paths were already under modules/. covered_digest recomputed at HEAD e18885f; status stays human_needed for the pending browser re-walk."
+  previous_status: gaps_found
+  previous_score: "4/4 roadmap success criteria hold; plan truths 45/46 (1 failed: the phase acceptance command check-phase10.sh --all is red at its --go stage, for causes outside Phase 10 code)"
+  previous_head: fc7cfaf
+  head: 77ca4b0
+  reason: "Narrow re-verification of the one --go gap. summercms.go 77ca4b0 adds -skip '^TestBootstrapEndToEnd$' to the framework go test run. In the sibling repos, sm-user-plugin 569768e (local commit, not pushed, fonoteka.go pointer not bumped) and fonoteka.go 03dad50 and 7db5ef8 (local commits, fonoteka.go is 13 ahead of origin) bring the migration-history and parity tests up to date. No file under admin/src, modules/ or modules/boardwalk/dist changed since fc7cfaf."
   gaps_closed:
-    - "Phase 10 review WR-01 (logout behind the guard did not expire a rejected cookie): logout is now mounted outside the guard and always clears the cookie (299d220). TestAdminLogoutRevokesExpiredRefreshableToken: PASS."
+    - "scripts/check-phase10.sh --all, the phase acceptance command, passes: --go exit 0 (verifier run, 4m50s, 'phase10 go passed'); the other stages were run by the orchestrator this session and all exit 0"
   gaps_remaining: []
   regressions: []
 human_verification:
   - test: "Re-walk the Phase 10 admin flows in a real browser on the current build: run the fonoteka binary, open /plytadmin as a superuser and as a genres-only admin, then use the list and form of each of the five controllers (search, sort, filter, paging, save, 422 field errors), link and unlink a Collection editor, open Ustawienia, and glance at light and dark mode."
-    expected: "Everything still behaves as approved in 10-UAT.md tests 2 to 5. The limited admin sees only fonoteka > Genres. Lists and forms render. The editor round trip works. The Albums form now also shows the Phase 10.1 widgets and partials, and they do not break the Phase 10 form."
-    why_human: "10-UAT.md was approved on 2026-09-27 against c7487f6. Since then Phase 10.1 changed ListView.vue, FormView.vue, ListToolbar.vue, FormField.vue, registry.ts, router.ts and main.css, and fonoteka's Albums controller now registers plugin widgets and partials. The Phase 9 review fixes changed server-side navigation (WR-01, WR-02, WR-17). Vitest and the Postgres acceptance test pass, but D-23 keeps the real browser out of the automated suite, and the browser checks for these views (10.1-UAT.md tests 1 and 4) are still pending. Closing 10.1-UAT tests 1 and 4 with Genres, Collections and Settings included also closes this item."
+    expected: "Everything still behaves as approved in 10-UAT.md tests 2 to 5. The limited admin sees only fonoteka > Genres. Lists and forms render. The editor round trip works. The Albums form's later widgets, partials and field types do not break the Phase 10 form; list state persisted in the URL and storage does not confuse paging or filtering."
+    why_human: "D-23 keeps the real browser out of the automated suite. Vitest (83 files, 1279 tests) and the Postgres acceptance test cover behavior, but not rendering in a browser."
+    retest_reason: "10-UAT.md tests 2 to 5 passed on 2026-09-27 against c7487f6. Since then phases 10.1, 12.2, 14.2.1, 16.1, 16.2 and 16.3 changed ListView.vue, FormView.vue, FormField.vue, formState.ts, registry.ts, AppShell.vue, PluginRail.vue, UserMenu.vue, useAuth.ts and main.css, so those rows no longer cover the current code. 10.1-UAT.md is status: testing with all six rows pending; its tests 1 and 4 (Albums, Genres, Settings in a real browser) overlap this walk but do not cover it yet."
+  - test: "Publish the sibling-repo test fixes the --go pass depends on: push sm-user-plugin 569768e, then commit the plugins/golem15/user pointer bump (cf5c6b9 -> 569768e) in fonoteka.go as a separate commit, and push fonoteka.go (03dad50, 7db5ef8 and the bump) when you choose."
+    expected: "A clean checkout of fonoteka.go at its committed pointer passes check-phase10.sh --go, as the working tree does now."
+    why_human: "Pushing needs the user's go-ahead (CLAUDE.md). The --go pass was proven against the go.work working tree. At fonoteka.go's committed pointer cf5c6b9, sm-user-plugin TestCreateOrganisationsMigration still fails as before, because the fix exists only in the local commit 569768e."
   - test: "Carried: decide CR-01 (refresh ignores tokens_valid_after / is_activated)"
     expected: "Fix now or accept with override"
     why_human: "Security-policy decision"
-    resolution: "Fixed (be4a923, a13a121). TestAdminRefreshRevocation re-run this session: PASS. Approved in 10-UAT.md test 1. Still applies, still resolved."
+    resolution: "Fixed (be4a923, a13a121), approved in 10-UAT.md test 1. No auth or refresh code changed since."
   - test: "Carried: Secure cookie on http://localhost (assumption A3)"
     expected: "Chrome and Firefox store summer_admin with default cookie_secure"
     why_human: "Browser cookie policy, non-inferable"
-    resolution: "Approved in 10-UAT.md test 6. The cookie attributes (cabana auth.go) are unchanged in substance since then. Still resolved."
+    resolution: "Approved in 10-UAT.md test 6. No auth.go or cookie change since."
   - test: "Carried: review the 17 judgment-tier prohibitions"
     expected: "Accept or reject the verifier's non-authoritative verdicts"
     why_human: "Judgment-tier prohibitions need human resolution"
-    resolution: "Accepted in 10-UAT.md test 7. Re-checked against HEAD in this report and all are still not violated, so the acceptance carries over."
+    resolution: "Accepted in 10-UAT.md test 7. The --hygiene stage, which enforces the mechanical ones, is still green."
+human_verified:
+  - item: "CR-01 decision"
+    uat: "10-UAT.md test 1 (pass)"
+  - item: "A3 Secure cookie on http://localhost"
+    uat: "10-UAT.md test 6 (pass)"
+  - item: "17 judgment-tier prohibitions"
+    uat: "10-UAT.md test 7 (pass)"
 ---
 
 # Phase 10: Admin Vue SPA Verification Report
 
 **Phase Goal:** A minimal Vue 3 + TypeScript admin SPA renders login, permission-gated navigation, lists, forms and the relation manager for Albums, Artists, Collections, Genres and Styles, typed from the generated OpenAPI document.
-**Verified:** 2026-10-01T21:29:59Z (summercms.go HEAD f2f2279, fonoteka.go HEAD e62f4fc)
+**Verified:** 2026-10-11T15:11:15Z (summercms.go HEAD 77ca4b0; fonoteka.go HEAD 7db5ef8 with plugins/golem15/user checked out at 569768e, which is not the recorded pointer cf5c6b9)
 **Status:** human_needed
-**Re-verification:** Yes. The previous report (c7487f6, passed) went stale. Phase 10.2 moved its 59 framework paths under `modules/`, and later phases changed covered code.
+**Re-verification:** Yes, narrow. It re-checks only the one gap left by the fc7cfaf report (`check-phase10.sh --all` red at `--go`) and carries the other truths forward, because no Phase 10 code changed.
 
-**MVP note:** ROADMAP marks this phase `mode: mvp`, but the goal is not a User Story. Following the precedent of Phases 1, 3, 5 and 8, the four ROADMAP success criteria are the contract and plan `must_haves` are supporting evidence.
+## What changed since fc7cfaf
 
-## What changed since the previous verification
-
-| Source | Change to covered code | Effect on this report |
-|---|---|---|
-| Phase 10.2 (5e50b16, 57e7b56) | Framework packages moved to `modules/<pkg>`. Moves only, plus retargeted fixtures. | 59 covered paths re-mapped. No behavior change. |
-| Phase 10.1 (f928194..5bbb0ad) | Runtime extension point. The SPA gains `WidgetField`, `PartialField`, `PartialHost` with an allowlisted node renderer, `pluginAssets.ts`, toolbar actions in `ListToolbar.vue`, and plugin CSS scoped per controller in `router.ts`. `ListView.vue`, `FormView.vue`, `FormField.vue` and `registry.ts` were extended. cabana gains action and asset routes. The OpenAPI document and `schema.d.ts` were regenerated (+516 / +325 lines, additive). The dist was rebuilt. | Phase 10 tests still pass, together with the new ones (Vitest went from 441 to 681). The drift gates are clean. The changed views need a browser re-check, so a human item is open. |
-| Phase 11 (f7b6b0c, 93c735b, 5382947, 61da4d1) | cabana writes are commit-safe, transaction gates fail closed, the jwt.auth 401 gets a cache header, and the Phase 10 gate accepts the Phase 12 pending goldens | `go test` and the gate stages pass |
-| Phase 9 review fixes (b4b8b5d..4ae272e, 2da8112) | WR-01 wildcard permissions, WR-02 drops a denied main menu item and repoints its target, WR-17 merges an admin's own permissions over the role's, WR-03 and WR-05 refuse writes and relation link/unlink that are not declared, WR-14 mounts logout outside the guard and always clears the cookie, WR-11 case-insensitive unique emails, WR-19 TxFromContext | Re-checked against the SPA's contract: the assembled acceptance test (exact nav sets, CRUD, link/unlink, logout) and the named cabana tests pass |
-
-## User Flow Coverage
-
-Derived user story: *As a Płytarium admin, I want to log in to /plytadmin, see only what my role permits, and manage Albums, Artists, Collections, Genres, Styles and Collection editors, so that the catalogue can be administered without the PHP backend.*
-
-| Step | Expected | Evidence (this session) | Status |
+| Repo | Commit | Files | Effect |
 |---|---|---|---|
-| Open /plytadmin | Embedded SPA served with base /plytadmin | `modules/boardwalk/boardwalk.go`, `TestPhase10TracerSPA` PASS, `check-admin-dist.sh` "matches a fresh build" | VERIFIED |
-| Log in | Cookie session, no token in body | `modules/cabana/auth.go` login, `useAuth.login`, `LoginView.test.ts` (Vitest PASS), `TestPhase10Coverage` PASS | VERIFIED |
-| See permitted navigation | Limited admin sees Genres only | `TestPhase10AssembledAcceptance` SC-1 PASS (exact nav sets) and `TestNavigationDropsDeniedParentAndRepointsTarget` PASS | VERIFIED (automated); browser re-check pending |
-| Use five lists and forms | Schema-driven list and form, create, update | `TestPhase10AssembledAcceptance` SC-2 and `TestPhase10Controllers` PASS, ListView/FormView Vitest PASS | VERIFIED (automated); browser re-check pending |
-| Link and unlink an editor | Search candidates, link, unlink | `TestPhase10AssembledAcceptance` SC-3 PASS, `relation.smoke.test.ts` PASS | VERIFIED (automated); browser re-check pending |
-| Stay signed in / be signed out | Refresh keeps an active session; reset, deactivation or deletion ends it | `TestAdminRefreshRevocation` PASS | VERIFIED |
-| Log out | Cookie expired, old cookie 401, works with an expired access token | Acceptance test (logout then /auth/me 401) and `TestAdminLogoutRevokesExpiredRefreshableToken` PASS | VERIFIED |
+| summercms.go | 77ca4b0 | `scripts/check-phase10.sh` (+2/-1) | `run_go` runs the framework suite with `-skip '^TestBootstrapEndToEnd$'` and a comment naming the opt-in guard (SUMMERCMS_BOOTSTRAP_CHECK=1, 14.3-02) |
+| sm-user-plugin (local only, ahead 1) | 569768e | `updates/organisations_test.go`, `user_groups_test.go`, `user_session_test.go` | `TestCreateOrganisationsMigration` expects `202610050001_create_oauth_identities`; five rollback loops count one more migration |
+| fonoteka.go (local, ahead 13) | 03dad50 | `parity/migrate_test.go`, `parity/schema_diff_test.go` | Expects 11 user migrations (was 10); allows the `backend_api_tokens` table in the schema diff |
+| fonoteka.go | 7db5ef8 | `parity/oauth_flow_test.go` | `TestOAuthFlows` writes `mcp-lifecycle.vars` under `$PARITY_ROOT` or `t.TempDir()` instead of a fixed `/tmp/summercms-parity/...` path |
+
+`git diff fc7cfaf HEAD` in summercms.go touches only `scripts/check-phase10.sh`. No file changed under `admin/src`, `modules/` or `modules/boardwalk/dist`.
+
+## Gap closure: `check-phase10.sh --all` at `--go`
+
+### Independent run
+
+`bash scripts/check-phase10.sh --go` (verifier's own process): `phase10 go passed`, **exit 0**, 4m50s. The orchestrator separately reports `--self-test`, `--security`, `--postgres`, `--openapi`, `--dist`, `--hygiene` and `--evidence` all exit 0 this session, plus typecheck and Vitest (83 files, 1279 tests). Only `npm ci` inside `--spa` was skipped, as before.
+
+### Do the fixes weaken the gate? No.
+
+**77ca4b0 (framework skip).**
+- The `-skip` pattern is anchored (`^...$`) and matches exactly one test in the repo: `modules/sunrise/sunrise_test.go:242`. Its body calls `t.Skip` unless `SUMMERCMS_BOOTSTRAP_CHECK=1`, so under this gate it never asserted anything.
+- That test still runs for real in `scripts/check-phase14.3.sh:484` (`SUMMERCMS_BOOTSTRAP_CHECK=1 go test ./modules/sunrise/ -run '^TestBootstrapEndToEnd$'`).
+- `phase10_detect` is unchanged. Any other skip in either repo is still refused, and `--self-test` exits 0.
+- `KNOWN_APP_FAILURES=""` and `APP_PENDING_SKIPS=""` are unchanged, so the app run allows no failures and no skips.
+- The fix takes the `-skip` option the previous report offered. It adds no self-test case because no skip event reaches the detector.
+- Residual (ℹ️): a future top-level test with the same name in another framework package would also be skipped silently.
+
+**569768e (sm-user-plugin).**
+- The plugin defines exactly 11 migration IDs. The new ID, `202610050001_create_oauth_identities`, is the 11th and the last in order.
+- The `want` list gains only that ID, and the five `RollbackLast` loops each go up by one to account for it.
+- No assertion was removed or loosened. The tests still require exact history equality and roll back to the same target migration.
+
+**03dad50 (fonoteka parity).**
+- The count change from 10 to 11 matches the plugin's real migration count.
+- `backend_api_tokens` is a real Go-only framework table from 16.3-01 (`modules/cabana`, `modules/lagoon/backend_admin_migrations_test.go`). The allowlist names it explicitly with a reason, the same way it handles `backend_jwt_blacklist`.
+
+**7db5ef8 (TestOAuthFlows vars path).**
+- Only where the vars store is written changed. The replay and every assertion are the same.
+- I found no reader of `mcp-lifecycle.vars` anywhere in fonoteka.go. The new comment says "php_parity.sh reads these vars from PARITY_ROOT", which overstates things (php_parity.sh only defines `PARITY_ROOT`), but it does not affect behavior. ℹ️ Info.
+
+### Caveat: the pass depends on uncommitted, unpushed sibling state
+
+The `--go` pass was proven against the go.work working tree, where `plugins/golem15/user` is checked out at 569768e. fonoteka.go's recorded pointer is still cf5c6b9. At that commit, `TestCreateOrganisationsMigration` fails exactly as in the previous report. Pushing 569768e and bumping the pointer needs the user's go-ahead, so this is an escalation item (human_verification #2), not a code gap. The previous report accepted the same arrangement, with an uncommitted pointer at 7a6fa0e.
 
 ## Goal Achievement
 
@@ -287,148 +328,109 @@ Derived user story: *As a Płytarium admin, I want to log in to /plytadmin, see
 
 | # | Truth | Status | Evidence |
 |---|---|---|---|
-| 1 | An admin logs in through the SPA and sees only the navigation items their permissions allow. | ✓ VERIFIED | Server: `TestPhase10AssembledAcceptance` (fonoteka, Postgres) asserts the limited admin's nav is exactly `fonoteka:[genres]`, the developer's is `albums,collections,genres,styles,artists`, the limited admin gets 403 on albums and an empty settings list. It passes at HEAD with the Phase 9 WR-01/WR-02/WR-17 permission changes in place. `TestNavigationDropsDeniedParentAndRepointsTarget`: PASS. SPA: `useNavigation.ts`, `PluginRail.vue` and `SectionPanel.vue` are unchanged since c7487f6. Their Vitest tests pass. |
-| 2 | Each of the five controllers renders a working list and form generated from its JSON schema. | ✓ VERIFIED | Server: the SC-2 loop and `TestPhase10Controllers` (fields and columns equal the tracked YAML) pass. `TestCRUDOperationsFollowDeclarations` (Phase 9 WR-03) passes, and SC-2's create and update still succeed under it. SPA: `ListView.vue` still loads `/schema/list` and the list, and `FormView.vue` still loads `/schema/form` and the record and then POSTs or PUTs. 10.1 adds toolbar actions, widgets, partials and plugin CSS on top. `ListView.test.ts` (+171 lines) and `FormView.test.ts` (+144) pass with the original Phase 10 cases intact. Vitest: 53 files, 681 passed. Browser confirmation of the changed views is the open human item. |
-| 3 | The Collections form's relation manager lets an admin search, link and unlink an editor. | ✓ VERIFIED | Server: the SC-3 block covers candidates with the owner excluded, link, list, the linked user dropping out of the candidates, unlink, and an empty list afterwards. It passes with Phase 9 WR-05 (undeclared link/unlink refused) in place. SPA: `RelationManager.vue` and `RelationPickerModal.vue` are unchanged since c7487f6, and their tests and `relation.smoke.test.ts` pass. |
-| 4 | API calls in the SPA use TypeScript types generated from the OpenAPI document, with no hand-maintained duplicate type. | ✓ VERIFIED | `client.ts` is `createClient<paths>` over the generated `schema.d.ts`. `admin/src` has no other `fetch(`, and `pluginAssets.ts` loads same-origin assets through elements, not a fetch. `types.ts` (+12 lines for the 10.1 types) still contains only aliases onto `components['schemas']` and `paths[...]`. `check-admin-openapi.sh --check`: exit 0. `check-phase10.sh --hygiene`: passed. |
+| 1 | An admin logs in through the SPA and sees only the navigation items their permissions allow. | ✓ VERIFIED | Carried from fc7cfaf (no admin/src or Go change). `--security`/`--postgres`/`--evidence` exit 0 this session (orchestrator); `--go` exit 0 (verifier). |
+| 2 | Each of the five controllers renders a working list and form generated from its JSON schema. | ✓ VERIFIED | Carried: `TestPhase10Controllers` and the assembled acceptance SC-2 block are in the green `--postgres` stage. The browser re-check stays open as human item #1. |
+| 3 | The Collections form's relation manager lets an admin search, link and unlink an editor. | ✓ VERIFIED | Carried: `TestPhase10AlbumRelations`, `TestPhase10RelationOptions`, `TestPhase10RelationSave` and the SC-3 block are in green stages. |
+| 4 | API calls in the SPA use TypeScript types generated from the OpenAPI document, with no hand-maintained duplicate type. | ✓ VERIFIED | Carried: `--hygiene` and `--openapi` exit 0; the files.ts exemption is unchanged since it was judged narrow in fc7cfaf. |
 
-**Score:** 4/4 ROADMAP truths verified (0 present-but-behavior-unverified).
+**Score:** 4/4 ROADMAP truths verified. Plan truths 46/46 (0 present, behavior-unverified).
 
-### Plan must-have truths (supporting evidence)
+### Plan must-have truths (re-checked rows)
 
-There are 46 plan truths across 10-01..10-05. The earlier runs verified all of them, with A3 human-observed. Their evidence is the named tests and gates, and all of those were re-run this session as part of `go test ./...` (summercms.go), the fonoteka Phase 10 acceptance tests, Vitest, the dist and OpenAPI drift gates, and the gate stages `--self-test`, `--hygiene`, `--security` and `--evidence`. All of them pass. The renamed packages carry the same tests: `modules/cabana/phase10_*_test.go`, `modules/phrasebook/phase10_test.go`, `modules/surf/admin_prefix_test.go` and the others in covered_files.
-
-Backstop (non-inferable) truths:
-
-| Truth | Evidence | Status |
+| Truth (10-05) | Status | Evidence |
 |---|---|---|
-| A1 default prefix /backend; fonoteka /plytadmin | `modules/cabana/prefix.go` `DefaultAdminPrefix`, `TestPhase10Prefix` in the passing cabana run | VERIFIED |
-| A3 Secure cookie accepted on http://localhost | 10-UAT.md test 6 (human-observed). The cookie attributes are unchanged in substance. | VERIFIED (human-observed) |
-| A10 30 s blacklist grace plus single-flight refresh | `modules/cabana/auth.go` reads `admin.jwt.blacklist_grace`, fonoteka `config/admin.yaml`, `client.test.ts` (Vitest PASS) | VERIFIED |
-| A8 pivot sort_order = array index | fonoteka `admin_phase10_relations_test.go` (package passes) | VERIFIED |
-| Required relation is a schema hint only | `TestPhase10RelationSave` PASS | VERIFIED |
-| A6 dark mode follows the system only | `theme.ts`, `theme.test.ts` PASS | VERIFIED |
-| SC-4 mechanical enforcement | `check-phase10.sh --hygiene` PASS | VERIFIED |
+| Every Phase 10 Go change has named tests, and both repositories pass go vet ./... and go test ./... | ✓ VERIFIED (was ✗ FAILED) | `check-phase10.sh --go` exit 0 in the verifier's run. The framework excludes only the opt-in sunrise test, which `check-phase14.3.sh` runs for real; the app run has no allowances. Working-tree caveat above. |
+| `--all` exits non-zero on any failing stage, zero-test run, skip, drift, hygiene violation or evidence gap; `--self-test` proves each detector fails closed | ✓ VERIFIED | `--self-test` exit 0 (orchestrator). `phase10_detect` and the allowance variables are unchanged. |
+| `scripts/check-phase10.sh --all` passes at HEAD | ✓ VERIFIED | Every stage exits 0 this session: `--go` in the verifier's run, the rest in the orchestrator's. `--spa` used its typecheck and Vitest equivalent without `npm ci`. |
+
+The other 43 plan truths are carried from fc7cfaf. Their code is unchanged, and the stages that cover them passed this session.
 
 ### Prohibitions (judgment tier)
 
-All 17 verdicts were accepted in 10-UAT.md test 7. I re-checked them against the code that changed since:
-
-- No Płytarium or fonoteka names appear in `admin/src`, `admin/tests`, `admin/openapi` or `modules/boardwalk/dist`. A grep came back empty, and the hygiene gate passes.
-- `admin/src` has no `v-html` or `innerHTML`. The 10.1 partials are built from an allowlisted node tree with `h()`, and text is always text (`partialNodes.ts`). Plugin labels and comments are still rendered as text.
-- Plugin JS and CSS come from cabana's same-origin asset route, so nothing loads from a foreign origin.
-- The cookie login and refresh paths still never return the JWT in a body.
-- Phase 9 WR-03 and WR-05 tighten "relation save never writes a protected FK or an out-of-scope id". They do not weaken it.
-
-All 17 remain not violated, and the human acceptance carries over.
+Unchanged. All 17 were accepted in 10-UAT.md test 7, and the mechanical subset is still enforced by the green `--hygiene` stage. None is violated.
 
 ### Required Artifacts
 
 | Artifact | Status | Details |
 |---|---|---|
-| `admin/` SPA (views, components, state, api, app) | ✓ VERIFIED | It exists, has substance and is wired, and it is embedded via `modules/boardwalk/dist`, which matches a fresh build |
-| `admin/openapi/admin.json`, `admin/src/api/schema.d.ts`, `admin/src/api/types.ts` | ✓ VERIFIED | No drift from generation |
-| `modules/boardwalk/boardwalk.go` + `dist/` | ✓ VERIFIED | `TestPhase10TracerSPA` PASS |
-| `modules/cabana/{auth,http,crud,relation,relation_field,form_schema,list_schema,filter_schema,schema_types,registry,contracts,csrf,lang,messages,prefix,admin_openapi}.go` | ✓ VERIFIED | Moved under modules/ and changed by 10.1, 11 and the Phase 9 fixes. The cabana package passes. |
-| `modules/bouncer/{jwt,refresh}.go` | ✓ VERIFIED | `RefreshAudienceFor` still wired from `modules/cabana/auth.go`. The new WR-14 logout helper is additive. |
-| `modules/pact/capabilities.go`, `modules/phrasebook/*`, `modules/surf/router.go` | ✓ VERIFIED | Packages pass |
-| `scripts/check-phase10.sh`, `check-admin-dist.sh`, `check-admin-openapi.sh` | ✓ VERIFIED | Retargeted to `modules/` paths, and every stage run passes |
-| `../fonoteka.go/plugins/golem15/fonoteka/admin_phase10_*_test.go` | ✓ VERIFIED | At e62f4fc: Acceptance, Tracer and Controllers PASS |
+| `admin/` SPA, `admin/openapi`, generated types | ✓ VERIFIED | Unchanged since fc7cfaf; `--dist`, `--openapi`, `--hygiene` exit 0 |
+| `modules/cabana`, `bouncer`, `surf`, `boardwalk`, `phrasebook` Phase 10 code | ✓ VERIFIED | Unchanged; `--security`, `--postgres`, `--go` exit 0 |
+| `scripts/check-phase10.sh` | ✓ VERIFIED (was ⚠️ PARTIAL) | All stages exit 0; the 77ca4b0 change is narrow (see above) |
+| fonoteka `admin_phase10_*_test.go` | ✓ VERIFIED | Pass within the `--go` app run and `--postgres` |
 
 ### Key Link Verification
 
 | From | To | Via | Status |
 |---|---|---|---|
-| `admin/src/api/client.ts` | generated `schema.d.ts` | `createClient<paths>`, the only `fetch(` in `admin/src` | WIRED |
-| `admin/src/state/useAuth.ts` logout | `POST /auth/logout` | `modules/cabana/http.go:205`, now mounted outside the guard with `requireAjax`. The client sets `X-Requested-With` on every request (`client.ts:71`). | WIRED |
-| `modules/cabana/auth.go` refresh | `bouncer.RefreshAudienceFor` → the guard's `UserProvider` | `s.users` (`lazyBackendUsers`) | WIRED |
-| `admin/src/views/ListView.vue` / `FormView.vue` | `/schema/list`, `/schema/form`, records | client calls (10.1 additions on top) | WIRED |
-| `RelationManager.vue` | `/relations/{name}`, `/candidates` | client calls | WIRED |
-| `modules/boardwalk` | `admin` build | `go:embed dist`, drift gate | WIRED |
+| `scripts/check-phase10.sh` run_go | `go test -json` in both repos | `phase10_detect`, with no app allowances and one anchored framework `-skip` | WIRED |
+| `check-phase10.sh` `-skip '^TestBootstrapEndToEnd$'` | `check-phase14.3.sh --bootstrap` | the skipped test runs for real in its own phase gate | WIRED |
+| All other links (client.ts to schema.d.ts, files.ts to aliases and client, views to endpoints, boardwalk to dist) | | | WIRED (unchanged) |
 
 ### Data-Flow Trace (Level 4)
 
-These are unchanged in structure. Every flow is ✓ FLOWING:
+Unchanged. Every flow is FLOWING.
 
-- navigation comes from `GET /navigation`, filtered on the server
-- list rows and columns come from the list endpoint and `/schema/list`
-- form fields and the record come from `/schema/form` and `GET /{id}`
-- the relation manager's linked rows and candidates come from `/relations/{name}` and `/candidates`
-- strings come from `GET /lang`
-
-### Behavioral Spot-Checks (run this session)
+### Behavioral Spot-Checks
 
 | Behavior | Command | Result | Status |
 |---|---|---|---|
-| Vet | `go vet ./...` (summercms.go) | exit 0 | ✓ PASS |
-| Full Go suite | `go test -count=1 ./...` (summercms.go), run once | Most packages ok. Eight packages failed only because testcontainers Postgres did not start within the timeout (`context deadline exceeded`, and one `internal/dev` watch timeout) while Vitest and other suites shared the machine: docs/examples/blog, internal/dev, beachcomber, bouncer, cabana, conga, lagoon/attach, lighthouse. | see re-run |
-| Re-run of those 8 packages serially | `go test -count=1 -p 1 <8 pkgs>` | all 8 ok, exit 0 | ✓ PASS |
-| Logout, nav, refresh, CRUD gating, Phase 10 coverage | `go test -count=1 -run '^(TestAdminLogoutRevokesExpiredRefreshableToken\|TestNavigationDropsDeniedParentAndRepointsTarget\|TestAdminRefreshRevocation\|TestPhase10Coverage\|TestCRUDOperationsFollowDeclarations)$' ./modules/cabana/` | all PASS | ✓ PASS |
-| SC-1..SC-3 assembled on Postgres plus tracer and controllers | `go test -count=1 -run '^(TestPhase10AssembledAcceptance\|TestPhase10TracerSPA\|TestPhase10Controllers)$' ./plugins/golem15/fonoteka/` (fonoteka.go) | 3 PASS, ok 6.6s | ✓ PASS |
-| SPA unit/component suite | `npx vitest run` (admin) | 53 files, 681 passed | ✓ PASS |
-| Embedded dist drift (incl. vue-tsc) | `scripts/check-admin-dist.sh` | "modules/boardwalk/dist matches a fresh build" | ✓ PASS |
-| OpenAPI and types drift | `scripts/check-admin-openapi.sh --check` | exit 0 | ✓ PASS |
-| Phase gate stages | `scripts/check-phase10.sh --self-test / --hygiene / --security / --evidence` | each exit 0 | ✓ PASS |
+| Go stage | `bash scripts/check-phase10.sh --go` (verifier) | `phase10 go passed`, exit 0, 4m50s | ✓ PASS |
+| `-skip` target is unique | `grep -rn "func TestBootstrapEndToEnd"` | one hit, `modules/sunrise/sunrise_test.go:242` (env-gated `t.Skip`) | ✓ PASS |
+| Skipped test still runs elsewhere | `grep` in `scripts/check-phase14.3.sh` | line 484 runs it with `SUMMERCMS_BOOTSTRAP_CHECK=1` | ✓ PASS |
+| App allowances empty | `grep` for `KNOWN_APP_FAILURES` and `APP_PENDING_SKIPS` | both `""` | ✓ PASS |
+| User plugin migration count | migration ID grep in `plugins/golem15/user/updates` | 11 unique IDs, `202610050001_create_oauth_identities` last | ✓ PASS |
+| Other stages | orchestrator run: `--self-test`, `--security`, `--postgres`, `--openapi`, `--dist`, `--hygiene`, `--evidence`, typecheck, Vitest | all exit 0; 83 files, 1279 tests | ✓ PASS (reported) |
 
 ### Probe Execution
 
-No `probe-*.sh` scripts are declared or present. `check-phase10.sh` is the phase gate. Its stages were run as listed above. Its `--go`, `--postgres`, `--spa`, `--openapi` and `--dist` stages were covered directly by the full Go run with the serial re-run, the fonoteka tests, Vitest and the two drift scripts.
+No `probe-*.sh` is declared or present. `check-phase10.sh` is the phase gate.
 
 ### Requirements Coverage
 
 | Requirement | Source Plan | Description | Status | Evidence |
 |---|---|---|---|---|
-| ADMIN-06 | 10-01..10-05 | Minimal Vue 3 + TS SPA renders login, permission-gated navigation, lists, forms and the relation manager for the five controllers using generated types | ✓ SATISFIED (automated); browser re-check pending | Truths 1-4 |
+| ADMIN-06 | 10-01..10-05 | Minimal Vue 3 + TS SPA renders login, permission-gated navigation, lists, forms and the relation manager for the five controllers using generated types | ✓ SATISFIED; browser re-walk pending | Truths 1-4; acceptance command green |
 
 Orphaned requirements: none.
 
-### Decision Coverage
-
-All 28 trackable CONTEXT.md decisions are honored (no decision was reverted by the later phases).
-
 ### Anti-Patterns Found
 
 | File | Pattern | Severity | Impact |
 |---|---|---|---|
-| `modules/cabana/auth.go`, `http.go` | Phase 10 review WR-01: logout behind the guard | resolved | Fixed by Phase 9 WR-14 (299d220) |
-| `modules/bouncer/refresh.go`, fonoteka `golem15/user` | WR-08: the site-user refresh ignores tokens_valid_after | ⚠️ Warning | Outside the Phase 10 contract. Core user plugin contract kept. |
-| `modules/cabana/relation_field.go`, `crud.go` | WR-02 and WR-03 (Phase 10 review) | ⚠️ Warning | Phase 9 WR-03 and WR-05 now refuse undeclared writes and link/unlink. Not re-triaged here. |
-| `modules/pact/capabilities.go` | WR-04: `FilterOptions(scope)` has no ctx or db | ⚠️ Warning | Open |
-| `admin/src/views/*.vue` | WR-05: loaders without try/catch | ⚠️ Warning | Open |
-| `ListView.vue`, `RelationManager.vue` | WR-06: no page clamp after delete or unlink | ⚠️ Warning | Open |
-| `modules/bouncer/refresh.go` | WR-07: the refresh window slides with no absolute cap | ⚠️ Warning | Residual risk in T-10-05 |
+| fonoteka.go `plugins/golem15/user` pointer | The fix lives in an unpushed local commit; the recorded pointer cf5c6b9 still fails `TestCreateOrganisationsMigration` | ⚠️ Warning | A clean checkout of fonoteka.go fails `--go` until 569768e is pushed and the pointer is bumped (human item #2) |
+| `scripts/check-phase10.sh:293` | `-skip` matches by test name across all framework packages | ℹ️ Info | A future same-named test elsewhere would be skipped silently; today the name is unique |
+| fonoteka.go `parity/oauth_flow_test.go:288` | Comment says php_parity.sh reads the vars; nothing reads `mcp-lifecycle.vars` | ℹ️ Info | Misleading comment only |
+| Phase 10 review WR-04..WR-08 | carried | ⚠️ Warning | Unchanged |
 
-None of the non-planning covered files contains an unreferenced `TBD`, `FIXME` or `XXX` marker (grep came back empty).
-
-### Other observations (Info)
-
-- Phase 10.1's own UAT (10.1-UAT.md) is still `status: testing` with 6 items pending. Its tests 1 and 4 overlap the open Phase 10 human item.
-- The summercms.go working tree has an uncommitted change to `.planning/phases/10.2-.../10.2-VERIFICATION.md` that this verifier did not make (another run in progress), plus the untracked `SummerCMS landing page.zip`. Neither is Phase 10 code.
-- The first full `go test` run was disturbed by machine load: Postgres containers timed out at startup. A fail-closed reading needs the serial re-run. If the gate is run in CI, run it on an otherwise idle machine.
+There are no `TBD`, `FIXME` or `XXX` markers in the changed lines.
 
 ### Human Verification Required
 
 ### 1. Browser re-walk of the Phase 10 flows on the current build
 
-**Test:** Run the fonoteka binary and open /plytadmin. Log in as a superuser and then as a genres-only admin. For each of the five controllers, use the list and form (search, sort, filter, paging, save, 422 field errors). Link and unlink a Collection editor. Open Ustawienia. Glance at light and dark mode.
-**Expected:** Everything still behaves as approved in 10-UAT.md tests 2 to 5. The Albums form's new 10.1 widgets and partials do not break the Phase 10 form.
-**Why human:** Phase 10.1 changed the very views the 2026-09-27 approval covered, and D-23 keeps browser e2e out of the automated suite. Closing 10.1-UAT tests 1 and 4 with Genres, Collections and Settings included also closes this item.
+**Test:** Run the fonoteka binary and open /plytadmin. Log in as a superuser, then as a genres-only admin. Use the list and form of each of the five controllers (search, sort, filter, paging, save, 422 field errors). Link and unlink a Collection editor. Open Ustawienia. Glance at light and dark mode.
+**Expected:** Everything behaves as approved in 10-UAT.md tests 2 to 5. Later widgets, field types and persisted list state do not break the Phase 10 views.
+**Why human:** D-23 keeps the browser out of the suite.
+**UAT coverage:** Not covered by an existing passing row. 10-UAT.md is complete with all 7 rows pass, but rows 2 to 5 were recorded against c7487f6 (2026-09-27), and later phases have since changed the views they cover (retest_reason in the frontmatter). 10.1-UAT.md is status: testing with 0 of 6 rows passed. Its tests 1 and 4 overlap this walk; passing them with Genres, Collections and Settings included would also close this item.
 
-The carried items (CR-01, A3, the 17 prohibitions) remain resolved, with evidence re-run this session.
+### 2. Publish the sibling-repo test fixes
+
+**Test:** Push sm-user-plugin 569768e. Commit the `plugins/golem15/user` pointer bump (cf5c6b9 to 569768e) in fonoteka.go as a separate commit, then push fonoteka.go when you choose.
+**Expected:** A clean fonoteka.go checkout passes `check-phase10.sh --go`.
+**Why human:** Pushing needs the user's go-ahead. The verified pass relies on the working-tree submodule state.
+
+Carried items CR-01, A3 and the 17 prohibitions stay resolved by 10-UAT.md tests 1, 6 and 7 (code unchanged).
 
 ### Gaps Summary
 
-There are no gaps. All four ROADMAP success criteria hold at HEAD on automated evidence re-run this session:
+The one remaining gap from fc7cfaf is closed. `check-phase10.sh --go` passes in the verifier's own run, and every other stage passed this session. None of the four fixes weakens the gate:
+- The framework `-skip` is anchored to a single opt-in test that `check-phase14.3.sh` runs for real.
+- The app run still allows no failures and no skips.
+- The migration-history and parity tests were updated to match the real 11 migrations and a real 16.3 table, with no assertion loosened.
 
-- `go vet` is clean
-- every Go package passes, with eight container-startup timeouts cleared by a serial re-run
-- the fonoteka Postgres acceptance test passes
-- Vitest passes, 681 of 681
-- the dist and OpenAPI drift gates and four gate stages pass
-
-The status is human_needed, not passed, because the human browser approvals predate the Phase 10.1 changes to ListView, FormView, the toolbar, the router and the styles. Those approvals cannot be carried over to the changed views.
+No code gaps remain. Status is human_needed for two items: the browser re-walk, which no passing UAT row covers for the current code, and publishing the sibling-repo fixes so a clean checkout matches the verified working tree.
 
 ---
 
-_Verified: 2026-10-01T21:29:59Z_
-_Verifier: Claude (gsd-verifier)_
+_Verified: 2026-10-11T15:11:15Z_
+_Verifier: Claude (msd-verifier)_

.planning/phases/11.2-ready-to-share-summercms-io-website-and-newsletter-plugin/11.2-SECURITY.md

@@ -0,0 +1,100 @@
+---
+phase: "11.2"
+slug: "ready-to-share-summercms-io-website-and-newsletter-plugin"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+asvs_level: 1
+created: "2026-11-05"
+---
+
+# Phase 11.2 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail. The newsletter plugin was not built in this phase (moved to backlog 999.1); no threat in the register concerns it. Evidence roots: FW = `summercms.go`, APP = `../sm-summercmsio-app`, PLUG = `APP/plugins/golem15/summercms`, SITE = `APP/vue-summercmsio-app`. Verified against the current tree; later phases (changelog, marketplace, VPN admin) changed the app, and replaced prongs are noted. T-11.2-SC is declared in all three plans (19 rows, 17 IDs).
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| npm registry → build machine | third-party packages run during install and generate | tarballs, git deps, install scripts (high) |
+| en.json / terminal.json → rendered HTML | repository copy becomes public HTML | i18n strings, terminal commands (medium) |
+| page → visitor clipboard | the Copy button writes text visitors paste into a shell | six shell commands (low) |
+| page → third-party origins | any runtime request elsewhere leaks visitor data | IP, Referer (medium) |
+| internet → nginx (rome) | untrusted HTTP; TLS terminates here | all public requests (high) |
+| nginx → summercms-io on 127.0.0.1:8095 | proxied requests filtered by path and method | path, method, X-Forwarded-For (medium) |
+| request path → embedded file map | an untrusted path selects a file and may redirect | URL path, Location (high) |
+| site.yaml / CLI flags → docs header HTML | configured URL written into every docs page | site_url, site_label (medium) |
+| operator machine → rome | binary and config upload; secrets stay on the server | binary, config (medium) |
+| summercms.go → module proxy | a pushed tag becomes immutable public state | release tag (medium) |
+| test results → phase sign-off / env gates → integration tests | a gate misreading skips passes untested behaviour | test events, gate variables (medium) |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-11.2-01 | Tampering (XSS) | components rendering en.json | medium | mitigate | no v-html/innerHTML under SITE/app/; inline code via `<i18n-t>` | closed |
+| T-11.2-02 | Information disclosure (privacy) | font loading | medium | mitigate | `@nuxt/fonts` build-time download (SITE/nuxt.config.ts:40,64-71); SITE/tests/output.test.ts:218-231 asserts no Google font hosts; built output clean | closed |
+| T-11.2-03 | Tampering | Copy button payload | low | accept | AR-11.2-01 | closed |
+| T-11.2-04 | Information disclosure | PLUG static.go path resolution | high | mitigate | `path.Clean` + dot-segment 404 + preloaded map only, dotfiles never loaded (static.go:131-183); smoke.sh:230 and static_test.go:155-156 assert `/docs/.summer-docs` 404 | closed |
+| T-11.2-05 | Spoofing (open redirect) | /docs and extension-less redirects | medium | mitigate | constant `/docs/` redirect (plugin.go:86); redirect only to an existing mapped name (static.go:178-182); TestStaticRedirectLocations covers `//evil`, `../`, backslash | closed |
+| T-11.2-06 | Tampering (MIME sniffing) | static.go headers | low | mitigate | own content-type table first (static.go:30-60); `nosniff` on every file incl. 404s and scripts | closed |
+| T-11.2-07 | Elevation of privilege | admin exposure | high | mitigate | public nginx `/backend` → 404 (summercms.io.conf:74-76), binary on loopback, check-deploy.sh:129-130 guards the block; admin only on the VPN vhost (10.8.3.0/24). Replaced since: plugin now has admin controllers (Phase 34) and smoke.sh:225 expects 200 on the binary; the internet-facing control holds | closed |
+| T-11.2-08 | Information disclosure | DB password and app key | high | mitigate | empty secrets in committed config; `.env` gitignored, only `*.example` tracked; `.env` root:summercms 0640, never rsynced (DEPLOY.md:195,289) | closed |
+| T-11.2-09 | Tampering (XSS) | docs header site_url | medium | mitigate | `checkSiteURL` on yaml key and flag (internal/docsite/load.go:125,145-161,289); `html/template` with plain string; load_test.go rejects `javascript:` and `//` | closed |
+| T-11.2-10 | Tampering (clickjacking) | public pages | low | accept | AR-11.2-02 | closed |
+| T-11.2-11 | Information disclosure (transport) | nginx | high | mitigate | 80→443 301 except ACME, www→apex, certbot certs, HSTS (summercms.io.conf:20-63); binary binds 127.0.0.1:8095 | closed |
+| T-11.2-12 | Denial of service | nginx and binary | medium | mitigate | `limit_except GET HEAD` on `/` (:176-179); site routes GET-only (routes_test.go, smoke POST → 405); preloaded static files; supervisor restart | closed |
+| T-11.2-13 | Tampering / Repudiation | v0.1.0 tag | medium | mitigate | blocking-human checkpoint (11.2-02-PLAN.md:318) resolved as defer-tag; no v0.1.0 exists; all tags annotated; CLAUDE.md requires go-ahead | closed |
+| T-11.2-14 | Elevation of privilege | runtime account | medium | mitigate | nologin system user, dedicated Postgres role and DB, root-owned install root with only `storage/` writable (DEPLOY.md:173-182); supervisor `user=summercms` | closed |
+| T-11.2-15 | Repudiation (false green) | scripts/check-phase11.2.sh | medium | mitigate | detector refuses build failure, no-tests, skip, fail, zero tests, missing named tests (:58-120); unknown flag exits 2 | closed |
+| T-11.2-16 | Tampering (silent skip) | build-gated tests and terminal check | medium | mitigate | gate sets `SUMMERCMS_REQUIRE_BUILD=1` and `SUMMERCMS_TERMINAL_CHECK=1`; links_test.go `requireBuild` fails instead of skipping | closed |
+| T-11.2-SC (01) | Tampering | pnpm installs | high | mitigate | exact pins, committed lockfile (git deps locked to commits), build allow-list of three packages, `--frozen-lockfile` (APP/scripts/build.sh:121) | closed |
+| T-11.2-SC (02) | Tampering | dependency installs | high | mitigate | APP go.mod first-party only; PLUG direct requires (Phase 34) all already in FW go.mod at the same versions; go.sum committed; dirty-tree builds refused (build.sh:80-90) | closed |
+| T-11.2-SC (03) | Tampering | dependency installs | low | accept | AR-11.2-03 | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-11.2-01 | T-11.2-03 | Payload is the bundled terminal.json, identical to the visible lines; the page only writes to the clipboard and never reads it. | 11.2-01 PLAN | 2026-11-05 |
+| AR-11.2-02 | T-11.2-10 | Static marketing and docs pages with no state-changing actions; the admin CSP is deliberately not reused because it blocks Nuxt's inline scripts (D-07). | 11.2-02 PLAN | 2026-11-05 |
+| AR-11.2-03 | T-11.2-SC (03) | Tests use the stdlib and the existing node:test runner; no package is added; `pnpm install --frozen-lockfile` reuses 11.2-01's lockfile. | 11.2-03 PLAN | 2026-11-05 |
+
+*Accepted risks do not resurface in future audit runs.*
+
+---
+
+## Notes (non-blocking)
+
+- **Attack surface added after 11.2** (covered by later phases' registers): admin controllers on the binary behind the VPN vhost; `APP/DEPLOY.md:190` ("nginx refuses /backend, so nothing writes runtime config overrides") is stale now that the admin is reachable over the VPN — writes would still fail on the root-owned `config/`. New write routes: `/_journal/api/v1/` (token + throttle) and POST `/api/registry/v1/ingest` (T-34-15/16). Marketplace readme `v-html` is covered by T-34-13.
+- **Open review info items:** IN-01..IN-08 (11.2-REVIEW-DISPOSITION.md), none security-relevant beyond IN-07 (links_test.go follows redirects).
+- **UAT:** 11.2-UAT.md is still `testing` with tests 1-3 pending; the cutover test expects v0.1.0, which was never created (releases started at v0.1.1). Superseded rather than failed.
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-11-05 | 19 rows (17 IDs) | 19 | 0 | msd-security-auditor (ASVS L1, block_on high; repo contents only, no live-host checks) |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-11-05

.planning/phases/12-p-ytarium-api-collections-and-albums/12-SECURITY.md

@@ -0,0 +1,117 @@
+---
+phase: "12"
+slug: "p-ytarium-api-collections-and-albums"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+asvs_level: 1
+created: "2026-10-12"
+---
+
+# Phase 12 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+The threat register was written at plan time in the `<threat_model>` blocks of Plans 12-01 to 12-05. The evidence for each threat, including the 25 removal checks that prove each high mitigation is load-bearing, is in `12-SECURITY-REVIEW.md` (2026-10-02, gate `scripts/check-phase12.sh --all`). No SUMMARY.md carries a `## Threat Flags` section.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| HTTP request body → request validator | Untrusted JSON and multipart input reaches rule evaluation, regex matching and DB `exists` lookups | Request fields (untrusted) |
+| Uploaded bytes → image decoders and blob storage | Untrusted image bytes are written to disk, sniffed, decoded and thumbnailed | Photo and cover files (untrusted) |
+| JWT or personal-token caller → collection and album routes | The caller names collection, album and file ids; the server decides tenancy | Household collection data (private) |
+| Personal token (MCP, agents) → tenant resolution | A token is pinned to one collection and narrower scopes | Token pin, collection scope |
+| Share token → anonymous viewers | The token is the bearer secret of public views | Share token (secret) |
+| Invitee mailbox → accept route | The raw token in the mail is the only bearer of the invitation | Invitation token (secret) |
+| Write transaction → River → mail | The invitation token leaves the DB for the job queue and the mail driver | Encrypted token in job args |
+| User-supplied URLs → outbound fetch | cover_urls and cover_url make the server fetch remote content | Remote image bytes (untrusted) |
+| Search engine → SQL | Engine ids and found counts are candidates only, never authorization | Album ids, counts |
+| Write transaction → Centrifugo and notifications | Album data and notifications leave for subscribers | Album metadata (household-private) |
+| Parity fixtures and fuzz seeds (git) → tests | Committed fixtures and seeds must never carry a usable secret | Test data |
+| Module proxy → go.mod | A dependency bump enters the build | `golang.org/x/image` |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-12-01 | Information Disclosure | collections/{id}, photos/{fileId}, image | high | mitigate | `findAccessibleCollection` scopes with `classes.AccessibleBy`; file lookups scoped to the collection's attachments; one 404 body. `TestPhase12Threats/T-12-01`, RC-01 | closed |
+| T-12-02 | Information Disclosure | albums/search items and meta.total | high | mitigate | `album_search.go` re-gates every engine id with `ScopedAlbums`; SQL fallback on engine error. `TestSearchLeak`, RC-02, RC-04 | closed |
+| T-12-03 | Elevation of Privilege | personal token pin | high | mitigate | `AccessibleBy` narrows to `tokenCollectionPin`; `Resolve` needs exactly one pinned id; `SwitchTo` refuses tokens. `TestPhase12Threats/T-12-03`, RC-05 | closed |
+| T-12-04 | Elevation of Privilege | owner-only interactive routes on the token group | high | mitigate | switch, share, me/context, realtime/channels, sync, missing on the JWT group only; in-handler token refusal. `TestRouteTablePhase12`, RC-07 | closed |
+| T-12-05 | Elevation of Privilege | editor acting as owner | high | mitigate | `c.OwnerID != user.ID` checks on destroy, image upload/delete, share. `TestPhase12Threats/T-12-05`, RC-10 | closed |
+| T-12-06 | Spoofing | invitation accept | high | mitigate | sha256 lookup `FOR UPDATE`; pending, unexpired, unrevoked, exact e-mail match else 410; resend rotates. `TestPhase12Threats/T-12-06`, RC-12, RC-13 | closed |
+| T-12-07 | Information Disclosure | raw token in river_job.args, summer_jobs and logs | high | mitigate | `lagoon.Encrypted` ciphertext in job args via `Enqueue`; nothing logs args, token or URL. `TestPhase12Threats/T-12-07`, RC-14 | closed |
+| T-12-08 | Spoofing | share token | high | mitigate | `crypto/rand`, 62-symbol alphabet, rejection at 248, unique retry, `FOR UPDATE`. `TestPhase12Threats/T-12-08`, RC-15 | closed |
+| T-12-09 | Tampering / Information Disclosure | cover_urls and cover_url fetches (SSRF) | high | mitigate | fetchguard `PublicOnly` (manual) and `AllowHosts` `.discogs.com` (import): https only, dial-time private refusal, no redirects, byte cap, timeout, after commit. `TestPhase12Threats/T-12-09`, RC-16 | closed |
+| T-12-10 | Tampering / Denial of Service | photo upload | high | mitigate | Body cap, `max:10240`, `IsAllowedImage` sniff plus `DecodeConfig`, `throttle:20,1`. `TestPhase12Threats/T-12-10`, RC-17 | closed |
+| T-12-11 | Tampering | mass assignment on albums and bulk | high | mitigate | `AlbumFillFields` plus per-field setter; server-set `collection_id`. `FuzzWriteEndpoints`, RC-18 | closed |
+| T-12-12 | Tampering | concurrent resolve provisioning | medium | mitigate | `users` row `FOR UPDATE` before the context row; unique `user_id`. `TestPhase12Threats/T-12-12`, `TestResolveProvisionsOnce` | closed |
+| T-12-13 | Elevation of Privilege | realtime/channels raw id | low | accept | See Accepted Risks Log AR-12-01 | closed |
+| T-12-14 | Tampering | lagoon `exists:` and regex rules | high | mitigate | `ParseRules` checks `identName` at registration; bound values; code-only RE2 regexes. `TestValidateRequestParseRules`, RC-20 | closed |
+| T-12-15 | Denial of Service | wildcard expansion and size rules | medium | mitigate | Expansion bounded by the surf-capped body; linear size counts; RE2. `TestPhase12Threats/T-12-15` | closed |
+| T-12-16 | Denial of Service | webp/png/jpeg decode in Thumb and DecodeConfig | medium | mitigate | `attach.File.Thumb` caps decode at 4096x4096 and serves `BrokenImagePNG` for an unusable original (fixed in 12-05, `1307060`). `TestThumbBrokenSourceServesPlaceholder`, `TestPhase12Threats/T-12-16` | closed |
+| T-12-17 | Information Disclosure | tide multipart part files | medium | mitigate | Part files are sha256-pinned test images; `check_corpus --check-secrets`. `TestPhase12Threats/T-12-17` | closed |
+| T-12-18 | Elevation of Privilege | user groups table | medium | mitigate | No route writes `users_groups`; `User.Groups` is `json:"-"`; site-admin predicate server-side. `TestPhase12Threats/T-12-18` | closed |
+| T-12-19 | Information Disclosure | Winter error pages | low | mitigate | Embedded `APP_DEBUG=false` bytes, only the stylesheet origin templated. `TestPhase12Threats/T-12-19` | closed |
+| T-12-20 | Information Disclosure | committed flow fixtures | high | mitigate | Tokens only as `{{secret:invite}}`; `check_corpus --check-secrets` fails on 64-hex. `TestCheckCorpusInvitationToken`, RC-21 | closed |
+| T-12-21 | Denial of Service | invite and resend mail flooding | medium | mitigate | `throttle:10,1` on store and resend; one pending row per (collection, e-mail). `TestPhase12Threats/T-12-21` | closed |
+| T-12-22 | Tampering | accept joining the inviter's organisation | medium | mitigate | Only an org-less invitee joins, as member, inside the accept tx. `TestPhase12Threats/T-12-22` | closed |
+| T-12-23 | Information Disclosure | album_added notifications and broadcasts | medium | mitigate | Recipients are owner and editors minus the actor; kind=collection channel only; after commit. `TestPhase12Threats/T-12-23` | closed |
+| T-12-24 | Denial of Service | search recount and bulk size | medium | mitigate | Recount capped at 1000 ids in pages of 250; body cap; `max_covers`. `TestSearchLeak/cap`, `TestPhase12Threats/T-12-24` | closed |
+| T-12-25 | Tampering | gate --removal leaving mutated source | medium | mitigate | Dirty-file refusal, anchor-exact mutation, `cmp` restore. `check-phase12.sh --self-test` | closed |
+| T-12-26 | Repudiation | security review claims without evidence | medium | mitigate | `check-phase12.sh --evidence` refuses unbacked claims. `--evidence`, `--self-test` | closed |
+| T-12-27 | Information Disclosure | fuzz seed corpus | low | mitigate | Synthetic seeds; gate scans `testdata/fuzz` for secrets. `--parity`, `--self-test`, RC-25 | closed |
+| T-12-28 | Information Disclosure | beachcomber SearchPage found count | high | mitigate | `found` only sizes the SQL recount (D-19). `TestSearchLeak`, RC-03 | closed |
+| T-12-29 | Denial of Service | collection photo/image upload | medium | mitigate | Body cap, `max:10240`, image and mimes sniff before the blob write. `TestPhase12Threats/T-12-29` | closed |
+| T-12-30 | Tampering | mass assignment on collections | high | mitigate | `CollectionFillFields` = name, description; `owner_id`, `kind`, share columns server-set. `FuzzWriteEndpoints`, RC-19 | closed |
+| T-12-31 | Elevation of Privilege | household routes under a personal token | high | mitigate | JWT group only; `assertInvitationOwner` refuses a token. `TestRouteTablePhase12`, `TestPhase12Threats/T-12-31`, RC-08, RC-09 | closed |
+| T-12-32 | Elevation of Privilege | editor managing members or invitations | high | mitigate | `ownerCollection` owner check before every household action. `TestPhase12Threats/T-12-32`, RC-11 | closed |
+| T-12-33 | Information Disclosure | albums/{id}, photos/{fileId}, rating | high | mitigate | `FindAccessibleAlbum` via `ScopedAlbums`; photo lookups on the album's attachments; one 404 body. `TestPhase12Threats/T-12-33`, RC-22, RC-23 | closed |
+| T-12-34 | Elevation of Privilege | token pin on albums, stats, value, search, lookups | high | mitigate | `Resolve` answers a token with its pin; `AlbumsAccessibleBy` narrows; sync and missing JWT only. `TestPhase12Threats/T-12-34`, RC-06 | closed |
+| T-12-SC | Tampering | Go module installs (golang.org/x/image v0.46.0) | high | mitigate | Official sub-repo, go.sum pinned, authorized by D-24; no other dependency in Phase 12 (Plans 12-02 to 12-05 accept: none added). `check-phase12.sh --go`, RC-24 | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-12-01 | T-12-13 | realtime/channels returns the raw collection id, matching PHP. The id is the caller's own resolved collection, is never accepted as a tenant selector on any write, and the collection authorizer re-validates membership on every subscribe. Residual: the channel name reveals the caller's own collection id. | Plan 12-02 threat model | 2026-10-02 |
+
+*Accepted risks do not resurface in future audit runs.*
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-10-02 | 35 | 35 | 0 | msd-executor, plan 12-05 (`12-SECURITY-REVIEW.md`, 25 removal checks) |
+| 2026-10-12 | 35 | 35 | 0 | /msd-secure-phase 12 (L1: plan-time register, review evidence, every cited mitigation anchor re-grepped in the current tree of both repositories) |
+
+## Security Audit 2026-10-12
+| Metric | Count |
+|--------|-------|
+| Threats found | 35 |
+| Closed | 35 |
+| Open | 0 |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-12

.planning/phases/12.1-user-plugin-admin-screens/12.1-SECURITY.md

@@ -0,0 +1,138 @@
+---
+phase: "12.1"
+slug: "user-plugin-admin-screens"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+asvs_level: 1
+block_on: high
+register_authored_at_plan_time: true
+created: "2026-10-12"
+---
+
+# Phase 12.1 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+The detailed evidence (production code, named tests, 27 removal checks, the T-12-18 write-path review, the D-30 boundary and five findings for decision) is in `12.1-SECURITY-REVIEW.md` (2026-10-05). This file is the contract summary; its register was re-checked against the tree on 2026-10-12, after phases 13 to 17 had landed.
+
+Repositories: `summercms.go` (framework: `modules/cabana`, `admin/src`) and sm-user-plugin (mounted at `fonoteka.go/plugins/golem15/user`).
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| Admin browser → admin API (bulk and record action routes, save bodies) | Untrusted ids, action names, field values, virtual values, permission maps and relation ids; cookie auth needs the CSRF header | admin input, privileged writes |
+| cabana → plugin hooks, actions and providers | The framework hands over only records loaded through the controller's scope and only validated values | records, virtual values |
+| Plugin code and partials → admin browser | Action labels, confirm texts, messages, row states and the status hint are rendered in the SPA | display text |
+| Admin with the users permission → frontend accounts, including privileged-group members | Activate, ban, password, email, delete; membership of a privileged group makes a site admin | credentials, privilege |
+| Backend admin → users_groups and user_groups codes | The user form's groups field and group codes decide who is a site admin | privilege |
+| User plugin → user API payloads | New model fields must not reach the Nuxt contract | PII, permissions, groups |
+| Plugin → mail transport | An admin-triggered invitation leaves the system | email |
+| Repositories → consumers (tag v0.1.3, shared plugin push) | A tag or push publishes the contract, migrations and permission codes | release |
+| Test evidence → release decision | The gate's result is what the phase is verified against | — |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-12.1-01 | Elevation of Privilege | bulk action ids (IDOR) | high | mitigate | `CRUDService.BulkAction` resolves ids with `lockScoped`, `partialSelection` 409 (`modules/cabana/crud.go`); RC-01, RC-02 | closed |
+| T-12.1-02 | Elevation of Privilege | undeclared action or action without its permission | high | mitigate | `bulkActionOf`, `recordActionOf`, `allowAction` (`modules/cabana/actions.go`); per-principal schema filtering; RC-03 | closed |
+| T-12.1-03 | Tampering | CSRF on the two new POST routes | high | mitigate | `requireAjax` on `bulk/{action}` and `{id}/actions/{action}` (`modules/cabana/http.go`); RC-04, RC-05 | closed |
+| T-12.1-04 | Elevation of Privilege | record action outside form scope or wrong state | high | mitigate | `RecordAction` uses `loadRecord` (form scope, row lock), `Applies` re-checked in the transaction; RC-06, RC-07 | closed |
+| T-12.1-05 | Tampering | half-applied bulk mutation | medium | mitigate | one transaction per bulk action; `TestBulkActionRollback` | closed |
+| T-12.1-06 | Information Disclosure | internal error text in 403/500 bodies | medium | mitigate | `actionFailure`, `lifecycleFailure` opaque 500; only `ForbiddenError`/`ValidationError` carry text | closed |
+| T-12.1-07 | Tampering | row state or label as markup/CSS class | low | mitigate | fixed state set on server (`ListMeta.RowStates`) and in the SPA; text interpolation | closed |
+| T-12.1-08 | Repudiation | actions leave no trace | low | mitigate | one `slog.Info` line per run | closed |
+| T-12.1-09 | Tampering | mass assignment through virtual or password fields | high | mitigate | `BindWritableFields` skips `FormVirtualFields`; `liftVirtualValues` honours context; RC-08, RC-09 | closed |
+| T-12.1-10 | Information Disclosure | password value in response, log or URL | high | mitigate | password field must be virtual (`checkVirtualFields`, `extension.go`); never projected; RC-10 | closed |
+| T-12.1-11 | Elevation of Privilege | protected FK written through a relation field | high | mitigate | `WritableForeignKey` opt-in plus scoped options query (`relation_field.go`); RC-11 | closed |
+| T-12.1-12 | Elevation of Privilege | locked relation ids changed by a crafted request | high | mitigate | `checkRelationLocks` before any row write on create and update; RC-12 | closed |
+| T-12.1-13 | Tampering | permission code injection or out-of-range value | high | mitigate | offered-code, mode-set and locked-code checks (`field_permission.go`); RC-13, RC-14 | closed |
+| T-12.1-14 | Tampering | preview-only field written by a crafted body | medium | mitigate | `contextAllows` excludes it from create/update binding; `TestPreviewFieldNeverWritten` | closed |
+| T-12.1-15 | Elevation of Privilege | script/markup through status hint or callout classes | medium | mitigate | partials served as an allowlisted node tree (`partial_render.go`); SPA builds elements from nodes | closed |
+| T-12.1-16 | Tampering | open redirect through `preview/:id` | medium | mitigate | `mapWinterUrl` (`admin/src/app/winterUrl.ts`): current controller only, digits only | closed |
+| T-12.1-17 | Tampering | unreviewed contract published by the tag | high | mitigate | blocking decision checkpoint (plan 02 Task 5); tag cut on a green head; NR-01 (process control) | closed |
+| T-12.1-18 | Elevation of Privilege | Users screens/actions without the users permission | high | mitigate | `RequiredPermissions` on the three controllers and every action; RC-15 | closed |
+| T-12.1-19 | Information Disclosure | hash, plain password or reset codes in admin responses | high | mitigate | virtual password fields; no secret column in YAML; response bodies scanned; RC-16 | closed |
+| T-12.1-20 | Tampering | mass assignment of is_activated, permissions, organisation_id | high | mitigate | protected fill keys; dedicated validated paths; `FormBeforeCreate` forces `is_activated` false; RC-17 | closed |
+| T-12.1-21 | Spoofing | tokens valid after admin password reset | medium | mitigate | `FormBeforeUpdate` stamps `tokens_valid_after`; `TestAdminUserPassword` | closed |
+| T-12.1-22 | Denial of Service | invitation mail abuse | low | mitigate | one mail per create, after commit, no bulk invite | closed |
+| T-12.1-23 | Tampering | permanent delete leaves orphans | medium | mitigate | `ForceDeleteCleanup` in the delete transaction; blobs after commit | closed |
+| T-12.1-24 | Information Disclosure | last_seen, permissions, timestamps, groups in user API | high | mitigate | `json:"-"` on `LastSeen`, `Permissions`, `Groups` (`models/user.go`); field-by-field payloads; RC-18, RC-27 | closed |
+| T-12.1-25 | Denial of Service | last_seen write on the auth path | low | mitigate | `classes.TouchLastSeen` at most once per five minutes, errors logged and ignored | closed |
+| T-12.1-26 | Elevation of Privilege | deactivated site admin re-enabled by restore/activate | medium | accept | see AR-01 | closed |
+| T-12.1-27 | Elevation of Privilege | wrong port of the permission merge | medium | mitigate | `classes.MergedPermissions`, `HasPermission`; `TestMergedPermissions` table | closed |
+| T-12.1-28 | Elevation of Privilege | privileged group added/removed via the groups field (T-12-18) | critical | mitigate | `AdminRelationLocks` plus framework `checkRelationLocks`; RC-19 | closed |
+| T-12.1-29 | Elevation of Privilege | create, re-code or delete a privileged group code | high | mitigate | `requirePrivilegedPermission` in the groups controller hooks; RC-20 | closed |
+| T-12.1-30 | Elevation of Privilege | second unguarded writer of users_groups | high | mitigate | no groups relation manager; actions pinned not to write the table; RC-21 | closed |
+| T-12.1-31 | Tampering | privileged list cached, mis-compared or NULL-bypassed | medium | mitigate | `classes/privileged.go`: read per call, case-sensitive, NULL never privileged | closed |
+| T-12.1-32 | Tampering | organisation members manager moves users | low | accept | see AR-02 | closed |
+| T-12.1-33 | Tampering | app pointer / plugin / framework published out of order | low | mitigate | no push in plans 03–05; ordering governed by T-12.1-40 | closed |
+| T-12.1-34 | Information Disclosure | group membership in user API payload | high | mitigate | `User.Groups` `json:"-"`; payload writes `groups` as an empty list; RC-22 | closed |
+| T-12.1-35 | Repudiation | gate passes without measuring | medium | mitigate | `detect` refuses failures, skips, zero tests, missing names; `--self-test` | closed |
+| T-12.1-36 | Information Disclosure | consuming-application name in framework files | low | mitigate | `check-phase12.1.sh --hygiene` name scan | closed |
+| T-12.1-37 | Tampering | mitigation silently removed later | medium | mitigate | `TestPhase121Threats` in both repos (present 2026-10-12), `--security`, removal harness | closed |
+| T-12.1-38 | Elevation of Privilege | takeover of a privileged-group member (email/password change) | critical | mitigate | `guardCredentials` at the top of `FormBeforeUpdate`, `classes.IsPrivilegedMember` in the write transaction (D-30); RC-23, RC-25 | closed |
+| T-12.1-39 | Tampering | permanent delete of a privileged-group member | high | mitigate | `guardPrivilegedMember` in `FormBeforeDelete`, per record in the bulk transaction; RC-24 | closed |
+| T-12.1-40 | Tampering | shared plugin published before review or before its framework tag | medium | mitigate | single push point after gate and review, only with v0.1.3 on origin; v0.1.3 is now on origin | closed |
+| T-12.1-SC | Tampering | npm/pip/cargo installs | high | mitigate | no manifest changed within the phase (diff against v0.1.3 at phase close); NR-02 | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-01 | T-12.1-26 | PHP behaves the same (the membership survives a soft delete); restore and activate need `golem15.users.access_users`. Deactivate and ban of a privileged member also stay at that permission (D-30 boundary); whether to guard them is open as FD-5 in `12.1-SECURITY-REVIEW.md`. | Owner, at plan 12.1-03 (RESEARCH T-12-18 path 8) | 2026-10-05 |
+| AR-02 | T-12.1-32 | PHP's add and remove behave the same; the routes need `golem15.users.access_users`, write only `organisation_id` and are scoped by the relation contract. `organisation_role` outliving the membership is FD-1. | Owner, at plan 12.1-04 (RESEARCH T-12-18 path 6) | 2026-10-05 |
+
+*Accepted risks do not resurface in future audit runs.*
+
+---
+
+## Observations (non-blocking)
+
+- **Gate drift, `scripts/check-phase12.1.sh --hygiene`.** On 2026-10-12 the stage refuses, for reasons that come from later phases, not from regressions of this register:
+  - raw-HTML sinks added by phase 17 (`RichEditorField.vue` `v-html="display"`, `richeditor/html.ts` and `richeditor/lossy.ts` `innerHTML`). The stage allowlists only `MarkdownField.vue`. These sinks are covered by phase 17's register (T-17-10, T-17-32: server-sanitized HTML). T-12.1-15's own surface (partials as an allowlisted node tree) is unchanged.
+  - `go.mod`, `go.sum`, `admin/package.json` and `admin/package-lock.json` changed since v0.1.3. These are later phases' dependency decisions; within phase 12.1 the manifests stayed the same (T-12.1-SC).
+  - committed files in `modules/cabana` (`account_tokens.go`, `account_tokens_test.go`, `token_*_test.go`) are not gofmt-clean. They come from later token work, not this phase; the problem is formatting only.
+  
+  Suggested follow-up: scope the 12.1 hygiene stage to the phase's own files and the tag window, or retire it in favour of later phase gates, and run `gofmt -w` on the token files.
+- **Findings for decision FD-1 to FD-5** in `12.1-SECURITY-REVIEW.md` remain the owner's to decide. None is an open threat of this register.
+- **sm-user-plugin** at `fonoteka.go/plugins/golem15/user` is one commit ahead of its origin (later phase work). It doesn't affect T-12.1-40, whose precondition (v0.1.3 on origin) now holds.
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-10-05 | 41 | 41 | 0 | gsd-executor, plan 12.1-05 (`12.1-SECURITY-REVIEW.md`, 27 removal checks) |
+| 2026-10-12 | 41 | 41 | 0 | /msd-secure-phase 12.1 (orchestrator, L1 grep re-check of every mitigation anchor in both repos; short-circuit: register authored at plan time, ASVS 1) |
+
+## Security Audit 2026-10-12
+| Metric | Count |
+|--------|-------|
+| Threats found | 41 |
+| Closed | 41 |
+| Open | 0 |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-12

.planning/phases/13-p-ytarium-api-wishlist-notifications-csv-credentials-public/13-SECURITY.md

@@ -0,0 +1,133 @@
+---
+phase: "13"
+slug: "p-ytarium-api-wishlist-notifications-csv-credentials-public"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+threats_total: 37
+threats_closed: 37
+accepted_risks: 2
+asvs_level: 1
+block_on: high
+register_authored_at_plan_time: true
+created: "2026-10-12"
+---
+
+# Phase 13 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+This file is the gate contract built from the six `<threat_model>` blocks and the SUMMARY `## Threat Flags` sections. No SUMMARY flags a threat outside its plan's register. `13-SECURITY-REVIEW.md` (2026-10-03, written by the 13-06 executor) has the per-threat findings, the named test evidence and the 31 removal checks (RC-01 to RC-31). T-13-SC appears in every plan and is counted once, with its strictest entry (13-04, medium, mitigate: the direct `golang.org/x/text` requirement). Framework paths are relative to `summercms.go/`. App paths are relative to `fonoteka.go/plugins/golem15/fonoteka/`.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| HTTP request path → surf dispatch | Untrusted path segments select the handler and its middleware chain of an overlapping route family | path segments |
+| Request write transaction → River queue | Queued jobs wait for Phase 14 workers; they must neither fail the write nor be lost | job args |
+| Recorded fixtures and goldens → tide comparison | Masks decide what the parity diff may ignore | dates, publication ids |
+| Isolated PHP SQLite → row goldens | The parity `rows` subcommand reads the parity database | test rows, share tokens |
+| Anonymous client → onboarding, invitation inspection and public share routes | Unauthenticated input creates the first owner, probes invitation tokens and resolves share tokens | e-mails, passwords (high), share and invitation tokens |
+| JWT client → notifications, credentials, wishlists, CSV imports | A user reaches only their own rows and peers' rows through visibility scopes; org writes need owner/admin | identifiers, field values |
+| Personal token → token-group wishlist routes | MCP clients reach only list/create/update/delete of the token owner's wishlist | wishlist album data |
+| Credential at rest → DB, responses and logs | API keys and Discogs tokens exist only as ciphertext | secrets (high) |
+| User plugin event → fonoteka listener | Register input crosses a plugin boundary | registration payload |
+| Reservation data → wishlist owner | The giver's identity stays hidden until reveal | reserver identity |
+| Uploaded CSV → parser and private storage | Up to 5 MiB of untrusted bytes are decoded, parsed and kept unserved | file contents |
+| Album data → exported CSV | Cells are opened in spreadsheets | formula-shaped strings |
+| Shared collection → public serializer | Private album fields must not reach the anonymous response | album fields |
+| Gate script and fuzz corpus → tracked source and git | `--removal` edits tracked files temporarily; seeds are committed | source, synthetic inputs |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-13-01 | Information Disclosure | token guessing / enumeration | high | mitigate | `classes/public_share.go` `PubfailCounter.Begin` (10 failures per address per 60 s), 16-symbol shape check, inline and per-token/per-IP buckets. `TestPhase13Threats/T-13-01`, `TestPubfailCounter`; RC-08, RC-09 | closed |
+| T-13-02 | Information Disclosure | public serializer and facets | high | mitigate | `classes/serialize_public_album.go` `PublicAlbumDTO`, rating filter 422, collection re-gate. `TestPhase13Threats/T-13-02`, `TestPublicAlbumFieldSet`; RC-20 | closed |
+| T-13-03 | Spoofing | disabled or regenerated share | high | mitigate | `classes/share_service.go` `ResolvePublic` requires `public_enabled = ?`, the route's kind and the current token. `TestPhase13Threats/T-13-03`, `TestPublicResolve`; RC-06. Residual: see Audit Note (WR-04) | closed |
+| T-13-04 | Elevation of Privilege | reserve, cancel, reveal | high | mitigate | `classes/reservations.go` owner refused, cancel `WHERE album_id = ? AND user_id = ?`, reveal through own wishlist. `TestPhase13Threats/T-13-04`, `TestReserveConcurrent`; RC-23 | closed |
+| T-13-05 | Information Disclosure | reservation mask in every serializer path | high | mitigate | `ReservationStateForViewer` masks the reserver for the owner before reveal. `TestPhase13Threats/T-13-05`, `TestReservationMask`; RC-05 | closed |
+| T-13-06 | Information Disclosure / Tampering | peer wishlists, subscriptions, wishlist album ids | high | mitigate | `ReservableWishlistIDs`, `WishlistsVisibleTo`, `ActiveWishlist`; identical Winter 404 for foreign and missing. `TestPhase13Threats/T-13-06`, `TestWishlistSubscriptions`; RC-24. Residual: see Audit Note (WR-04) | closed |
+| T-13-07 | Elevation of Privilege | token group | high | mitigate | `routes.go` mounts only wishlist CRUD and export on `/api/v1/fonoteka`, one `inv.scope` each. `TestRouteTablePhase13`, `TestPhase13Threats/T-13-07`; RC-22 | closed |
+| T-13-08 | Information Disclosure | credential responses, logs, marshal | high | mitigate | `lagoon.Encrypted` columns, `json:"-"` models, show selects provider/model/base_url only. `TestPhase13Threats/T-13-08`, `TestCredentialSecretsNeverSerialized`; RC-21 | closed |
+| T-13-09 | Elevation of Privilege | org credential store/destroy, Discogs shared | high | mitigate | `controllers/api/credentials_controller.go` `mayManageOrg` → 403 or `shared_forbidden`, nothing written. `TestPhase13Threats/T-13-09`, `TestCredentialsCRUD`; RC-25 | closed |
+| T-13-10 | Tampering | credential owner FK mass assignment | high | mitigate | `classes/credential_write_service.go` `CredentialFillFields`; owner keys from the session. `FuzzWriteEndpoints`, `TestPhase13Threats/T-13-10`; RC-15, RC-16 | closed |
+| T-13-11 | Tampering | base_url as SSRF target | medium | accept | Stored only (`nullable\|url`); Phase 14 owns the guarded outbound client (INTG-02). See Accepted Risks Log | closed |
+| T-13-12 | Elevation of Privilege | import routes by id | high | mitigate | `classes/csv_import_service.go` `CsvImportFor` (creator plus accessible collection). `TestPhase13Threats/T-13-12`, `TestCsvImportScope`; RC-13 | closed |
+| T-13-13 | Information Disclosure | CSV upload storage | high | mitigate | `controllers/api/csv_import_controller.go` `csvBucket(app)`: private bucket, server keys `fonoteka-csv/<uid>/<uuid>.csv`. `TestPhase13Threats/T-13-13`, `TestCsvStoreAndShow`; RC-26 | closed |
+| T-13-14 | Tampering | exported cells | medium | mitigate | `classes/csv` `FormulaSafe` on every exported cell; mid-stream failure logged since 13-06. `TestPhase13Threats/T-13-14`, `TestCsvExport`, `TestPHPFputcsv` | closed |
+| T-13-15 | Denial of Service | CSV parse | medium | mitigate | 5 MiB cap, `MaxRows` 5000, NUL rejection, `throttle:10,1`. `TestPhase13Threats/T-13-15`, `TestPhase13Boundaries` | closed |
+| T-13-16 | Tampering | row edit Discogs pick | high | mitigate | Candidate allow-list; Phase 13 `ReleaseFetcher` returns `ErrDiscogsUnavailable`. `TestPhase13Threats/T-13-16`, `TestCsvRowPickSeam`; RC-18 | closed |
+| T-13-17 | Tampering | double commit / double writer | high | mitigate | Commit compare-and-swap `WHERE id = ? AND status = ?`; since `ce4dd3a` (14-02, WR-02) mapping, row edits and cancel lock the import row (`clause.Locking{Strength: "UPDATE"}`) before writing. `TestPhase13Threats/T-13-17`, `TestCsvCommitCAS`; RC-14 | closed |
+| T-13-18 | Elevation of Privilege | onboarding bootstrap | high | mitigate | `classes/onboarding.go` `BootstrapOwner`: 409 when a user exists, advisory lock plus recount, unique e-mail. `TestPhase13Threats/T-13-18`, `TestBootstrapConcurrent`; RC-12 | closed |
+| T-13-19 | Spoofing | register listener invitation match | high | mitigate | `HandleRegisterEvent`: pending, unexpired, unrevoked, `LOWER(email) = ?`. `TestPhase13Threats/T-13-19`, `TestRegisterInvitationListener`; RC-27 | closed |
+| T-13-20 | Information Disclosure | RegisterEvent.Payload | high | mitigate | sm-user-plugin `FireRegisterEvent` deletes `password` and `password_confirmation`. `TestRegisterEventPayload`, `TestPhase13Threats/T-13-20`; RC-10, RC-11 | closed |
+| T-13-21 | Information Disclosure / Tampering | notifications read and mark-read | medium | mitigate | `classes/notifications.go` `WHERE user_id = ? AND id = ?`; zero rows → Winter 404. `TestPhase13Threats/T-13-21`, `TestNotificationsRoutes`; RC-17 | closed |
+| T-13-22 | Denial of Service / Repudiation | conga unregistered kinds | high | mitigate | `modules/conga` insert-only client for unregistered kinds, `ErrUnregisteredKindQueue` for served queues. `TestUnregisteredKindWithWorker`, `TestJobContractDispatchWhileWorkerRuns`; RC-04 | closed |
+| T-13-23 | Elevation of Privilege | surf overlap dispatch | high | mitigate | `modules/surf/overlap.go` `familyDispatch`: literals and constraints before dispatch, per-member chains, 404 on no match. `TestOverlappingConstrainedRoutes`, `TestOverlapConstraintFallsThrough`, `TestRouteTablePhase13`; RC-01 to RC-03 | closed |
+| T-13-24 | Repudiation | tide date and publication masks | medium | mitigate | Each mask checks the masked value's shape. `TestNormalizeContentDispositionDate`, `TestNormalizeNotificationPublication`, `TestNormalizePhase13Edges` | closed |
+| T-13-25 | Tampering | lagoon prohibited rule | medium | mitigate | Laravel 9 `prohibited` semantics. `TestValidateRequestProhibited`, `TestValidateRequestProhibitedNested`, `FuzzWriteEndpoints` | closed |
+| T-13-26 | Information Disclosure | php_parity.sh rows and share capture | medium | mitigate | `fonoteka.go/parity/php_parity.sh` `rows` runs `sqlite3 -readonly -safe`; share tokens captured as `{{share:wishlist}}`; `check_corpus --check-secrets` | closed |
+| T-13-27 | Information Disclosure | invitation inspection | medium | mitigate | `InspectInvitation` reveals the collection name only for a sha256-matched pending token; shared `throttle:10,1`. `TestPhase13Threats/T-13-27`, `TestInspectInvitation` | closed |
+| T-13-28 | Tampering / Repudiation | item-added and purchase side effects | medium | mitigate | Bell rows, digest upsert (dispatch on insert only) and enqueues on the write transaction; publications after commit. `TestPhase13Threats/T-13-28`, `TestDigestCoalescing`, `TestPurchaseMailAfterCommit`; RC-19 | closed |
+| T-13-29 | Information Disclosure | subscribe by token | medium | mitigate | `ResolvePublic` kind wishlist plus `subtle.ConstantTimeCompare` of the exact token. `TestPhase13Threats/T-13-29`; RC-07 | closed |
+| T-13-30 | Information Disclosure | purchase mail job args and logs | medium | mitigate | `WishlistPurchasedMailArgs`: subscriber id and two names only; worker logs the id. `TestPhase13Threats/T-13-30` | closed |
+| T-13-31 | Repudiation | queued jobs without workers | medium | mitigate | Unserved queues from the 13-01 contract; cancel stops summer_jobs and River rows. `TestPhase13Threats/T-13-31`, `TestCsvJobRows`, `TestCsvCancel` | closed |
+| T-13-32 | Denial of Service | shared anonymous inline budget | low | accept | PHP parity: one `throttle:10,1` guest key across onboarding, inspection and public resolves. See Accepted Risks Log | closed |
+| T-13-33 | Elevation of Privilege | public route kind confusion | medium | mitigate | Every public handler passes its route's kind to `ResolvePublic`. `TestPhase13Threats/T-13-33`, `TestPublicResolve` | closed |
+| T-13-34 | Tampering | gate --removal leaving mutated source | medium | mitigate | `scripts/check-phase13.sh --removal`: dirty-file refusal, anchor-exact mutation, trap restore, `cmp` check; outside `--all`. `--self-test`; RC-31 | closed |
+| T-13-35 | Repudiation | security review claims without evidence | medium | mitigate | `scripts/check-phase13.sh` `evidence_check`. `--self-test`; RC-30 | closed |
+| T-13-36 | Information Disclosure | fuzz seed corpus | low | mitigate | Synthetic seeds; `corpus_scan` over `testdata/fuzz`. `--self-test`; RC-29 | closed |
+| T-13-SC | Tampering | package installs (`golang.org/x/text` v0.42.0) | medium | mitigate | Go-team module already in the graph, pinned by go.sum, approved at the plan-count checkpoint; no other plan adds a dependency. `check-phase13.sh --go`; RC-28 | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-13-01 | T-13-11 | Phase 13 only stores `base_url`; no outbound call exists until Phase 14, which owns the guarded AI client (INTG-02, fetchguard) | 13-02 plan threat model | 2026-10-03 |
+| AR-13-02 | T-13-32 | PHP shares one `throttle:10,1` guest key across onboarding, inspection and public resolves; Go mirrors it (`inline:domainless\|ClientIP`) for parity, documented in `parity/README.md` | 13-05 plan threat model | 2026-10-03 |
+
+*Accepted risks do not resurface in future audit runs.*
+
+---
+
+## Audit Note (2026-10-12)
+
+The 13 findings of `13-REVIEW.md` are all still `open` in `13-REVIEW-DISPOSITION.md`. Two of them touch registered threats:
+
+- **WR-02 (T-13-17).** Mapping, row-edit and cancel writes bypassed the commit compare-and-swap, which could queue a second import job. The fix landed in Phase 14 (`fonoteka.go` `ce4dd3a`, "fix(14-02): mapping, row edits and cancel lock the CSV import before writing (WR-02)"). The tree now locks the row in `classes/csv_import_service.go`. T-13-17 is closed. The disposition row is stale and can be set to `fixed`.
+- **WR-04 (T-13-03, T-13-06).** A logged-in user who subscribed with a share token keeps peer read, reserve and notification access after the owner disables or regenerates the share. `ReservableWishlistIDs` does not check the share state. This matches PHP (`AlbumReservationService::reservableWishlistIds`), so it is not a porting defect. Both controls work as planned: anonymous public routes are revoked (T-13-03), and non-subscribers cannot reach the peer routes (T-13-06). The gap is recorded as a residual risk, not an open threat. Closing it would change PHP behaviour and needs a product decision note: either gate the subscription branch on `public_enabled` or add an owner-side "remove subscriber" route.
+
+The other review findings (WR-01, WR-03, IN-01 to IN-09) are about correctness, robustness and the gate. None of them removes a registered mitigation.
+
+The per-instance pubfail counter (T-13-01 residual in `13-SECURITY-REVIEW.md`) still applies: N instances allow N × 10 guesses per minute against a token of about 95 bits.
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-10-03 | 37 | 37 | 0 | 13-06 executor (`13-SECURITY-REVIEW.md`, removal checks RC-01 to RC-31) |
+| 2026-10-12 | 37 | 37 | 0 | /msd-secure-phase (ASVS L1: mitigation grep at HEAD plus re-run of `TestPhase13Threats` (27 subtests), `TestRouteTablePhase13`, `FuzzWriteEndpoints` and the surf/conga/tide/lagoon threat tests, all passing, no skips; short-circuit, no auditor) |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-12

.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-SECURITY.md

@@ -0,0 +1,81 @@
+---
+phase: "14.1"
+slug: "oauth-identities-and-fonoteka-me-routes"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+asvs_level: 1
+created: "2026-10-12"
+---
+
+# Phase 14.1 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+Implementation lives in the sibling repositories: `fonoteka.go` (host routes, MeToken, parity) and the sm-user-plugin submodule at `fonoteka.go/plugins/golem15/user`. Paths below are relative to `fonoteka.go`.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| JWT client → `/_fonoteka/api/v1/oauth-identities` | Untrusted Bearer and `{provider}` path | Provider list with `linked_at`; must never carry Encrypted tokens or profile_data |
+| Personal-token client → `/api/v1/fonoteka/me` | Already-matched `inv_` credential | Collection binding and scopes (authorization data) |
+| Host plugin → sm-user-plugin constructors | Host injects the Winter 404 writer; the plugin does not import the application `api` package | Handler wiring |
+| Postgres `golem15_user_oauth_identities` | At-rest Encrypted tokens, cascade delete with users | OAuth access/refresh tokens, provider profile JSON (secret) |
+| Test process → handlers / corpus replay | Tests must not leak secrets; pending must never count as passing | Fixture secrets, parity verdicts |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-14.1-01 | Information Disclosure | OAuthIdentitiesIndex | high | mitigate | Index builds an explicit `{provider, linked_at}` map (`plugins/golem15/user/controllers/oauth_identities.go`); `AccessToken`, `RefreshToken`, `ProfileData` are `json:"-"` and in `Hidden()` (`models/oauth_identity.go`, WR-01 fix cf5c6b9) | closed |
+| T-14.1-02 | Elevation of Privilege | OAuthIdentitiesDestroy | high | mitigate | Lookup `user_id = ? AND provider = ?` with the caller's principal; `ErrRecordNotFound` goes to the injected WriteNotFound (Winter 404, not 403) | closed |
+| T-14.1-03 | Elevation of Privilege | OAuthIdentitiesDestroy last-method | high | mitigate | Count of the caller's identities; `n == 1` returns 409 `last_method_blocked`; tested EN/PL and with a password set (`oauth_identities_test.go:101,131`). Residual: count-then-delete is not transactional (review WR-02, open) | closed |
+| T-14.1-04 | Tampering | OAuthIdentity Fillable | medium | mitigate | `Fillable()` returns `[]string{}`; no `lagoon.Fill` call on this model | closed |
+| T-14.1-05 | Information Disclosure | Destroy provider allow-list | medium | mitigate | Unknown provider (`!slices.Contains(providers, provider)`) calls the same `writeOAuthIdentityNotFound` as a missing row | closed |
+| T-14.1-06 | Elevation of Privilege | fonoteka routes.go | high | mitigate | GET/DELETE `/oauth-identities` registered inside the `jwt.auth` group (`plugins/golem15/fonoteka/routes.go:240-246`); token group `/api/v1/fonoteka` unchanged | closed |
+| T-14.1-07 | Denial of Service | DELETE registration | medium | mitigate | `"throttle:10,1"` on DELETE only (`routes.go:246`), asserted in `phase08_coverage_test.go:655` | closed |
+| T-14.1-08 | Tampering | Encrypted columns | medium | mitigate | Seed uses `lagoon.NewEncrypted` under the app key (`parity/fonoteka_seed_test.go:705-718`); no Laravel ciphertext imported | closed |
+| T-14.1-09 | Information Disclosure | oauth_identities_test.go GET | high | mitigate | Index test fails on plaintext, `access_token`, `refresh_token`, `profile_data`, `[redacted]` (`oauth_identities_test.go:221`) | closed |
+| T-14.1-10 | Information Disclosure | Destroy 404 tests | high | mitigate | `TestOAuthIdentitiesDestroyWinter404BodiesAreByteIdentical`: foreign, missing, unknown bodies byte-equal to the Winter HTML 404 | closed |
+| T-14.1-11 | Tampering | TestParityCorpus | high | mitigate | `expectedPortedRoutes = 175`, pending checked against `expectedPHPRoutes-expectedPortedRoutes`; `assertPortedMismatch` requires `tide.MismatchError` (`parity/parity_test.go`) | closed |
+| T-14.1-12 | Elevation of Privilege | phase08 TokenSurfaceIsolation | high | mitigate | `assertRouteSurfaces(..., "/oauth-identities", true, false)` for GET and DELETE (`phase08_coverage_test.go:652-653`) | closed |
+| T-14.1-SC | Tampering | package installs | high | mitigate | No `go.mod` change in either repository during the phase (summaries: `tech-stack.added: []`) | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+### Residual notes (non-blocking)
+
+- **T-14.1-03 / WR-02:** two concurrent DELETEs for different providers by a user with exactly two identities can both read `n == 2` and both delete, leaving zero OAuth identities. Exposure is narrow (same user, near-simultaneous requests, throttled 10/min) and matches the PHP controller's behaviour, but the review finding stays open in `14.1-REVIEW-DISPOSITION.md` until triaged.
+- **IN-03:** Index `Find` decrypts token columns it never returns; no disclosure, only unnecessary plaintext in memory.
+
+---
+
+## Accepted Risks Log
+
+No accepted risks.
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-10-12 | 13 | 13 | 0 | /msd-secure-phase (orchestrator, ASVS L1 grep-depth; auditor short-circuited) |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-12

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-SUMMARY.md

@@ -0,0 +1,229 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 01
+subsystem: infra
+tags: [dev-seed, surf, uploads, access-log, slog, console, fonoteka]
+
+requires:
+  - phase: 14.1
+    provides: fonoteka plugin console commands, classes write services, parity corpus 175/175
+provides:
+  - fonoteka:dev-seed (local/dev only), idempotent D-02 seed shape with generated PNG covers
+  - console.DevEnvironment and console.DevSeedCommand
+  - fonoteka plugin commands open and publish their own database (G1)
+  - GET /_fonoteka/api/v1/_dev/backend marker, local/dev only, outside the parity manifest
+  - framework config key storage.uploads.serve (uploads route on attach.StaticHandlerPublic, nosniff)
+  - framework config key http.access_log (one redacted "http request" record per request)
+affects: [14.2-02 start script, 14.2-03 e2e specs, 14.2-04 unit tests, phase 20 cutover]
+
+actuals:
+  tokens: 15212
+  tasks: 3
+  commits: 3
+plan_head_before: 3408742fb0e64a57ac3dcaad5a4b31001cffc849
+plan_head_after: 2d68eab3c0f82b55bf4c7e6f56c46f98b9c124f6
+fonoteka_head_before: df7876bfa9933fa68d28a2ff3f80b1c33453398c
+fonoteka_head_after: 464ba475eff0f5282e4c68da53b9eab4b3b688e7
+fonoteka_commits: 2
+
+tech-stack:
+  added: []
+  patterns:
+    - "Console command database: published handle, else lagoon.OpenFromApp + lagoon.Publish (OnDatabase hooks run) with a closer"
+    - "Framework opt-in routes resolve published services per request so route:list and boot need no database"
+    - "Request-scoped pointer slot in the context carries the matched route pattern to an outer middleware"
+
+key-files:
+  created:
+    - modules/surf/uploads.go
+    - modules/surf/accesslog.go
+    - modules/surf/accesslog_test.go
+    - .planning/todos/pending/user-plugin-commands-open-database.md
+    - ../fonoteka.go/plugins/golem15/fonoteka/console/database.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go
+  modified:
+    - modules/surf/router.go
+    - modules/surf/README.md
+    - docs/services/storage.md
+    - docs/services/logging.md
+    - docs/setup/configuration.md
+    - ../fonoteka.go/plugins/golem15/fonoteka/plugin.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/routes.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/console/prune_notifications.go
+
+key-decisions:
+  - "commandDatabase/commandBucket closers close the handles they opened, so a later command in the same process must not reuse that app; TestDevStackSmoke models seed and serve as separate fresh processes, like the start script"
+  - "The uploads route is owned by plugin id summercms.surf, prefix falls back to /storage/uploads (attach default); a plugin route with the same pattern fails boot as a duplicate"
+  - "Seed output is printed only after the transaction commits, so a failed run prints no created lines"
+  - "With DEV_SEED_API_TOKEN set the seed never prints a secret; an existing row with that hash is reassigned to the seed user and name and un-revoked (api token: updated)"
+  - "An existing rating on the first album is left as it is (keyed by album_id, user_id), even when its value differs from 4"
+  - "Seeded albums are created with name, artist_display, year and format LP only (fields the PHP create form accepts)"
+
+patterns-established:
+  - "Seed lines: '<entity>: created|updated|unchanged', cover lines append the public URL, token line shows a minted secret only on creation"
+
+requirements-completed: [QA-05]
+
+coverage:
+  - id: D1
+    description: "fonoteka:dev-seed seeds user, owned collection as context, three albums with PNG covers, wishlist entry, rating, API token and flips search_use_typesense last, in a fresh process with no published database"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go#TestDevStackSmoke"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Seed is idempotent (rerun prints unchanged, adds no row in users, collections, albums, system_files, ratings, user_api_tokens) and refuses production, development and staging before opening the database"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go#TestDevStackSmoke"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "storage.uploads.serve serves a seeded cover from the assembled router: 200 image/png with X-Content-Type-Options: nosniff"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go#TestDevStackSmoke"
+        status: pass
+      - kind: other
+        ref: "go run ./cmd/summer docs:build --check"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Marker GET /_fonoteka/api/v1/_dev/backend answers 200 with exactly backend/app/env and Cache-Control: no-store in local; parity corpus unchanged"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go#TestDevStackSmoke"
+        status: pass
+      - kind: integration
+        ref: "go -C ../fonoteka.go test ./parity -run TestParityCorpus"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "fonoteka:reindex, fonoteka:oauth-client and fonoteka:prune-notifications use commandDatabase; existing console tests unchanged and passing"
+    requirement: QA-05
+    verification:
+      - kind: unit
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/console#TestReindexCommand,TestPruneNotifications,TestOAuthClientCommandListPrintsClientIDAndURIsNeverTheSecret"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "http.access_log logs one 'http request' record with method, pattern, status, duration_ms; path without query only for unmatched requests; nothing when off"
+    requirement: QA-05
+    verification:
+      - kind: unit
+        ref: "modules/surf/accesslog_test.go#TestAccessLogSmoke"
+        status: pass
+    human_judgment: false
+
+duration: 16min
+completed: 2026-10-11
+status: complete
+---
+
+# Phase 14.2 Plan 01: Go-side local stack glue Summary
+
+**A fresh fonoteka process can now seed itself with `fonoteka:dev-seed` (local/dev only, idempotent, PNG covers through StoreAlbumPhoto). The framework serves those covers under the WinterCMS upload URL through the opt-in `storage.uploads.serve` route, the plugin answers a local-only backend marker, the fonoteka commands open their own database, and surf has an opt-in redacted request log (`http.access_log`).**
+
+## Performance
+
+- **Duration:** 16 min
+- **Started:** 2026-10-11T15:31:28Z
+- **Completed:** 2026-10-11T15:47:12Z
+- **Tasks:** 3
+- **Files modified:** 18 (8 created, 10 modified) across summercms.go and fonoteka.go
+
+## Accomplishments
+
+- `fonoteka:dev-seed`: refuses outside `SUMMER_ENV` local/dev before opening anything, then seeds in one `lagoon.Transaction` inside `lighthouse.WithoutBroadcasting[models.Album]`: the user (E2E_EMAIL/E2E_PASSWORD, default demo@example.com/changeme), the owned collection as context, Kind of Blue, Blue Train and Mingus Ah Um with 64x64 PNG covers, the wishlist with A Love Supreme, a rating of 4, the `dev-seed-mcp` token, and `search_use_typesense` flipped last.
+- `console.commandDatabase` / `commandBucket` (G1): reuse the published handle, else open and publish it. Used by the seed, `fonoteka:reindex`, `fonoteka:oauth-client` and `fonoteka:prune-notifications`.
+- `GET /_fonoteka/api/v1/_dev/backend` (D-09/D-10): `{"backend":"summercms","app":"fonoteka","env":"local"}`, `Cache-Control: no-store`, `throttle:60,1`, registered only in local/dev, not in the manifest.
+- Framework `storage.uploads.serve` (D-19): `GET {public_path_prefix}/{path...}` on `attach.StaticHandlerPublic` with nosniff, documented in the surf README, docs/services/storage.md and docs/setup/configuration.md.
+- Framework `http.access_log` (D-12): one Info `http request` record per request, documented in the surf README, docs/services/logging.md (new "Request log" section) and docs/setup/configuration.md.
+- Planning todo for the same database gap in the shared sm-user-plugin (not modified).
+
+## Seed output (TestDevStackSmoke)
+
+First run:
+
+```
+user: created
+collection: created
+album Kind of Blue: created
+cover Kind of Blue: created /storage/app/uploads/public/25d/b37/451/25db37451a4705c659ecfb.png
+album Blue Train: created
+cover Blue Train: created /storage/app/uploads/public/16f/a0b/4b0/16fa0b4b09666aeca51b6c.png
+album Mingus Ah Um: created
+cover Mingus Ah Um: created /storage/app/uploads/public/940/b2b/d6a/940b2bd6a1cb2b3d7d4ba4.png
+wishlist: created
+wishlist album A Love Supreme: created
+rating Kind of Blue: created
+api token: created inv_<secret> (shown once)
+search: created
+```
+
+The second run prints the same 13 lines with `unchanged`; the cover lines keep the same URLs and the token line reads `api token: unchanged (secret not shown)`. A third run with a different `E2E_PASSWORD` prints `user: updated` and 12 `unchanged` lines.
+
+Parity: `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`.
+
+## Task Commits
+
+1. **Task 1 (tracer): seeded cover served end to end**
+   - summercms.go `0b6d757` feat(14.2-01): opt-in storage.uploads.serve route for public uploads
+   - fonoteka.go `89b703a` feat(14.2-01): fonoteka:dev-seed with a served cover in a fresh process
+   - Tracer gate: verify re-run passed (automated only, end-of-phase mode), then expanded.
+2. **Task 2: full seed shape, marker, commands open their database**
+   - fonoteka.go `464ba47` feat(14.2-01): full dev-seed shape, local backend marker, commands open their database
+   - summercms.go `ad1fa5a` docs(14.2-01): todo for sm-user-plugin commands that need a published database
+3. **Task 3: opt-in request log**
+   - summercms.go `2d68eab` feat(14.2-01): opt-in http.access_log request log in surf
+
+## Files Created/Modified
+
+- `modules/surf/uploads.go`: `mountUploads`, per-request bucket/DB lookup, nosniff
+- `modules/surf/accesslog.go`: `accessLog`, `recordPattern`, `statusRecorder` (Flush/Unwrap kept)
+- `modules/surf/accesslog_test.go`: `TestAccessLogSmoke` (acme.blog fixture)
+- `modules/surf/router.go`: `mountUploads` after the plugin route loop; access log wrap in `compile`; `recordPattern` outermost in `wrap`
+- `modules/surf/README.md`, `docs/services/storage.md`, `docs/services/logging.md`, `docs/setup/configuration.md`: both keys documented
+- `fonoteka.go/plugins/golem15/fonoteka/console/{database,dev_seed}.go`: helpers and the seed
+- `fonoteka.go/plugins/golem15/fonoteka/console/{reindex,oauth_client,prune_notifications}.go`: `commandDatabase`
+- `fonoteka.go/plugins/golem15/fonoteka/{dev_marker,routes,plugin}.go`: marker and command registration
+- `fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go`: `TestDevStackSmoke`
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter. The main one is that the command closers close what they opened. A process that ran the seed therefore must not serve from the same app, so the smoke test models migrate, seed and serve as three fresh processes, which is what the plan 02 start script does.
+
+## Deviations from Plan
+
+1. **[Rule 2 - Missing coverage] Refusal and password-change checks added to TestDevStackSmoke.** The plan put the production-refusal test in plan 04, but threat T-14.2-01 cites TestDevStackSmoke for this plan. The smoke test now checks that an unset SUMMER_ENV, `development` and `staging` are refused and that no database gets published. It also checks that a changed `E2E_PASSWORD` prints `user: updated`. Files: dev_stack_smoke_test.go. Commit: 464ba47.
+2. **[Rule 1 - Test isolation] The smoke test restores `search_use_typesense`.** The seed flips the shared container's settings row, so `keepSearchSetting` makes sure row 1 exists with the flag off and restores its earlier state when the test ends. Without it, later tests in the package would run with search on. Commit: 464ba47.
+3. **Mid-plan in-progress SUMMARY skipped.** The context was well under half after Task 2, so Task 3 ran in the same executor and only this final SUMMARY was written. No committed artifact is affected.
+
+**Total deviations:** 2 auto-fixed (1 missing coverage, 1 test isolation), 1 procedural. **Impact:** no scope change. The production code follows the plan.
+
+## Issues Encountered
+
+None. Pre-existing gofmt drift in `fonoteka.go/plugins/golem15/fonoteka/household_smoke_test.go` was left alone (out of scope).
+
+## Verification
+
+- summercms.go: `go vet ./...` clean, `go test -short ./...` and full `go test ./...` (Docker) green (38 packages), `TestDocsTree` and `docs:build --check` print no problems.
+- fonoteka.go: `go vet ./...` clean, `go test ./plugins/golem15/fonoteka/... -count=1` green (10 packages), `TestParityCorpus` 175/175/0.
+- `git -C ../fonoteka.go status --porcelain` shows only the existing submodule pointer drift (feedback, golem, user), with nothing staged. `plugins/golem15/user` has a clean worktree. `_dev/backend` does not appear in `parity/manifest.yaml`.
+
+## Next Phase Readiness
+
+Plan 02's start script can run `migrate`, `fonoteka:dev-seed`, `fonoteka:reindex` and `serve --addr 127.0.0.1:8423` with `SUMMER_ENV=local`, `SUMMER_STORAGE__UPLOADS__SERVE=true` and `SUMMER_HTTP__ACCESS_LOG=true`, and can probe the marker. `/storage/app/uploads/public/` should be added to `fonoteka.go/.gitignore` (G11, plan 02 scope) before seeding with the real config.
+
+## Self-Check: PASSED
+
+All 8 created files are present. Commits 0b6d757, ad1fa5a and 2d68eab exist in summercms.go, and 89b703a and 464ba47 exist in fonoteka.go.

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-SUMMARY.md

@@ -0,0 +1,189 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 02
+subsystem: infra
+tags: [dev-stack, bash, nuxt, playwright, centrifugo, typesense, fonoteka]
+
+requires:
+  - phase: 14.2-01
+    provides: fonoteka:dev-seed, the local backend marker, storage.uploads.serve, http.access_log
+provides:
+  - fonoteka.go/scripts/dev-stack.sh with up [--detach], down, status, check, guard, exec, e2e [--report-only], e2e-verdict, help
+  - fonoteka.go/.env.dev.example (placeholders only) and .gitignore entries for /.env.dev and /storage/app/uploads/public/
+  - app config defaults storage.uploads.serve false and access_log false
+  - README section "Running locally with the Nuxt app"
+affects: [14.2-03 e2e specs via dev-stack.sh e2e, 14.2-04 gate (--guard, --self-test, --e2e), phase 20 cutover (fileblob TMPDIR)]
+
+actuals:
+  tokens: 10960
+  tasks: 4
+  commits: 3
+plan_head_before: 5c75b316a71ec876cd64c46a5205a163ca4f39dc
+plan_head_after: 5c75b316a71ec876cd64c46a5205a163ca4f39dc
+fonoteka_head_before: 464ba475eff0f5282e4c68da53b9eab4b3b688e7
+fonoteka_head_after: b5363ea99e12b50dc6238438dd3aa60288f08c1e
+fonoteka_commits: 3
+
+tech-stack:
+  added: []
+  patterns:
+    - "Env file parsed as KEY=value data (no source), values never printed; missing keys named only"
+    - "Each child runs under setsid as its own process group, recorded in tmp/dev-stack/pids; EXIT trap stops what this run started"
+    - "Centrifugo API key on curl's stdin (-H @-), never argv; probes are read-only (info, history)"
+    - "flock on tmp/dev-stack/up.lock serialises up; launched children close the lock fd"
+
+key-files:
+  created:
+    - ../fonoteka.go/scripts/dev-stack.sh
+    - ../fonoteka.go/.env.dev.example
+    - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/deferred-items.md
+  modified:
+    - ../fonoteka.go/.gitignore
+    - ../fonoteka.go/config/storage.yaml
+    - ../fonoteka.go/config/http.yaml
+    - ../fonoteka.go/README.md
+
+key-decisions:
+  - "The Go processes run with TMPDIR=tmp/dev-stack/go-tmp: gocloud fileblob renames uploads in from os.TempDir(), which fails across devices when /tmp is a tmpfs (deferred to Phase 20 for deployments)"
+  - "The env file is parsed as data instead of sourced, so nothing in it runs as shell code"
+  - "pnpm dev gets the NUXT_* values on its process only; SUMMER_* secrets and DEV_SEED_API_TOKEN are removed from its environment"
+  - "up refuses up front when the Nuxt checkout's .nuxt, node_modules/.cache or node_modules/.vite are not writable by the current user"
+  - "e2e requires a running stack (marker through :3119) and passes the guard before Playwright; it never lets Playwright start its own Nuxt"
+  - "e2e-verdict also refuses a report it cannot parse or that is missing"
+
+requirements-completed: [QA-05]
+
+coverage:
+  - id: D1
+    description: "up --detach on the real machine: preflight, build, migrate, dev-seed, reindex, Go on 127.0.0.1:8423, guard, Nuxt on :3119, probe (marker, 401, seeded cover image/png through Nuxt); down stops both"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "Task 2 automated verify (up --detach; marker jq through :3119; albums 401; down)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "guard refuses :8422, plytarium.com, unset internal origin, mismatched origins, an origin other than the Go address, a non-loopback DEV_STACK_GO_ADDR, no marker, and a fake PHP answering X-Powered-By: PHP"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "Task 3 automated verify 1 plus manual planted cases (fake PHP on 127.0.0.1:8431)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "e2e-verdict refuses skipped, zero-expected, unparsable and missing reports and accepts a clean one"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "Task 3 automated verify 1 plus planted reports"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "check exits 0 with warn lines only: dev_stack_absent_ns reported missing, user not reported; on the real config collection and wishlist reported missing and the origin warning printed"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "Task 3 automated verify 2"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Lifecycle: second up --detach prints already up; status 0 when up; a port held by another process is refused; a concurrent up is refused; foreground up stops both groups and removes pids on TERM; down twice is a no-op the second time"
+    requirement: QA-05
+    verification:
+      - kind: other
+        ref: "manual runs during Task 3"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "README section documents run, Centrifugo operator step with the exact namespace entries, subcommands, logs and MCP"
+    requirement: QA-05
+    verification:
+      - kind: other
+        ref: "Task 4 automated verify and acceptance greps"
+        status: pass
+    human_judgment: false
+
+duration: 27min
+completed: 2026-10-11
+status: complete
+---
+
+# Phase 14.2 Plan 02: Local stack start script Summary
+
+**`fonoteka.go/scripts/dev-stack.sh up` takes a configured machine to Go on 127.0.0.1:8423 and the unchanged Nuxt app on :3119 on host services. Before Nuxt starts, it refuses any backend origin that is not this Go binary. It proves the Nuxt proxy reaches Go with the marker, a 401 and a seeded cover. It also offers `guard`, `check`, `status`, `exec`, `e2e` and `e2e-verdict` for plans 03 and 04.**
+
+## Performance
+
+- **Duration:** 27 min of execution, after the Task 1 env checkpoint and the Nuxt write-access checkpoint
+- **Completed:** 2026-10-11T17:07Z
+- **Tasks:** 4 (1 human-action, 3 automated)
+- **Files:** 6 in fonoteka.go (2 created, 4 modified), 1 planning note in summercms.go
+
+## Accomplishments
+
+- **`up [--detach]`:** runs the steps in the D-05 order and only on host services. It never uses docker compose and never starts a second Centrifugo. Output goes to `tmp/dev-stack/{go,nuxt}.log` with `[go] ` and `[nuxt] ` prefixes. In the foreground, Ctrl-C, TERM or any failure stops both process groups.
+- **`guard` (D-09):** applies the origin rules before any network call, then checks the marker and refuses an `X-Powered-By: PHP` header.
+- **`check` (D-06, D-18, D-23):**
+  - Postgres (loopback only), Typesense and Centrifugo `info` must answer, and Centrifugo must accept the key.
+  - The WebSocket origin probe and the read-only `history` namespace probe print only `warn:` lines.
+  - On this machine it reports the 3119 origin and the `collection` and `wishlist` namespaces as missing. That is the plan 03 operator step.
+- **`exec` and `e2e`:** `exec` exports the E2E and NUXT values with `CI` unset. `e2e` writes a JSON report to `tmp/dev-stack/e2e-<ts>.json`, and `e2e-verdict` fails the run on any skip, flaky, unexpected or zero-expected result.
+- **Template, ignores and config:** `.env.dev.example` holds placeholders only. `.gitignore` ignores `/.env.dev` and `/storage/app/uploads/public/`. The app config now has `serve: false` and `access_log: false` defaults.
+- **README:** a "Running locally with the Nuxt app" section.
+
+## Task Commits
+
+1. **Task 1:** the developer created the env file and database and started Typesense (checkpoint, no commit).
+2. **Task 2 (tracer):** fonoteka.go `f74b00c` feat(14.2-02): dev-stack.sh up brings Go and Nuxt up on host services. Tracer gate: I re-ran the full verify end to end, it passed, then I expanded.
+3. **Task 3:** fonoteka.go `3029a4c` feat(14.2-02): dev-stack.sh guard, status, check, exec and e2e fail closed
+4. **Task 4:** fonoteka.go `b5363ea` docs(14.2-02): running fonoteka locally with the Nuxt app
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+1. **[Rule 3 - Blocking] Cover writes failed across devices.** `fonoteka:dev-seed` failed with `rename /tmp/... storage/app/uploads/public/...: invalid cross-device link`. The cause: `/tmp` is a tmpfs, and gocloud fileblob stages each write in `os.TempDir()`. Fix: every Go process the script starts runs with `TMPDIR=$APP/tmp/dev-stack/go-tmp`. The deployment side is logged in `deferred-items.md` for Phase 20. Commit f74b00c.
+2. **[Rule 1 - Bug] The WebSocket origin probe got no answer.** My first `Sec-WebSocket-Key` did not decode to 16 bytes, so Centrifugo closed every request without a response. With a valid key it answers 101 for an allowed origin and 403 for a rejected one. Commit f74b00c.
+3. **[Rule 1 - Bug] Foreground `up` stopped right after starting.** A bare `wait -n` also returned for earlier process substitutions. It now waits on the launched process groups only. Commit 3029a4c.
+4. **[Rule 2 - Security] The env file is parsed, not sourced.** `set -a; source` would run shell code from the file. The plan named it, but a data parser has the same effect without that risk. `pg_isready` gets host and port only, so the DSN password never reaches argv. The `pnpm dev` process does not inherit the SUMMER_* secrets. Commit f74b00c.
+5. **[Rule 2 - Correctness] `up` checks first that it can write to the Nuxt checkout.** It refuses with the directory names instead of failing inside `pnpm dev`. Commit f74b00c.
+6. **[Rule 2 - Concurrency] `up` takes a `flock`.** The plan relied on the port checks to refuse a second concurrent `up`. Ports are bound only after build and seed, so a second run could have wiped the first run's pid file. The lock refuses it at once. Commit 3029a4c.
+
+### Checkpoints
+
+- **Nuxt checkout write access (human action).** The checkout was owned by `jin` and not writable by `golem`, so `pnpm dev` could not write `.nuxt`. The user fixed the access, and the orchestrator confirmed it ("nuxt writable"). Writability is now documented as a README prerequisite.
+
+**Total deviations:** 6 auto-fixed (2 bugs, 1 blocking, 3 missing critical). **Impact:** no scope change. All interfaces are as planned.
+
+## Issues Encountered
+
+- **Playwright has no browsers for user `golem`.** Chromium headless shell 1223 is missing from `~/.cache/ms-playwright`. `dev-stack.sh e2e --report-only smoke.spec.ts` ran the whole path: the report was written and the counts printed. Every test failed at browser launch. Plan 03 needs `pnpm exec playwright install chromium`, which downloads the browser, so a person should approve it at plan 03's checkpoint. It is in the README prerequisites.
+- **`fonoteka:reindex` prints `collection_id:=0 document count is zero`.** This is an info line from the existing command, and the reindex itself succeeds. Plan 03's search spec will show whether seeded albums are indexed.
+- **GORM `record not found` noise.** The seed's first collection lookup logs it in color on stderr. It is cosmetic and logged in `deferred-items.md`.
+
+## Verification
+
+- `bash -n` and `shellcheck` are clean. All acceptance greps of Tasks 2-4 pass.
+- The Task 2 verify passes against the real services: `up --detach`, then the marker JSON and the albums 401 through :3119, then `down`.
+- Both Task 3 verifies pass.
+- The Task 4 verify passes.
+- `go -C ../fonoteka.go vet ./...` is clean. `go test ./plugins/golem15/fonoteka/... -count=1` passes, and so does `go test .` for the app root, which covers the config files.
+- `git -C ../fonoteka.go status --porcelain` shows only the existing submodule pointer drift (feedback, golem, user). The seeded covers, `tmp/` and `.env.dev` are ignored.
+- The vue-fonoteka-app working tree is clean (`git status`). The only things written there are Nuxt and Playwright build and test outputs, which are git-ignored.
+
+## Left running
+
+Nothing. Go and Nuxt are stopped, and ports 8423 and 3119 are free. Seed data stays in `fonoteka_go_dev` and the covers stay under the git-ignored `storage/app/uploads/public/`.
+
+## Next Phase Readiness
+
+- **Plan 03:** run specs with `scripts/dev-stack.sh up --detach`, then `scripts/dev-stack.sh e2e <specs>`. Before that, the operator step for Centrifugo origins and namespaces and the Playwright browser install are needed.
+- **Plan 04:** `--guard` can feed planted env files through `DEV_STACK_ENV_FILE`, and `--self-test` can feed planted reports to `e2e-verdict`.
+
+## Self-Check: PASSED
+
+scripts/dev-stack.sh, .env.dev.example and deferred-items.md are present; commits f74b00c, 3029a4c and b5363ea exist in fonoteka.go (3 commits since 464ba47).

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-03-SUMMARY.md

@@ -0,0 +1,242 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 03
+subsystem: testing
+tags: [playwright, e2e, nuxt, centrifugo, dev-seed, surf, access-log, fonoteka, uat]
+
+requires:
+  - phase: 14.2-01
+    provides: fonoteka:dev-seed, storage.uploads.serve, http.access_log, the local backend marker
+  - phase: 14.2-02
+    provides: dev-stack.sh up/down/check/e2e/e2e-verdict
+provides:
+  - vue-fonoteka-app E2E_BACKEND=go seed switch (runTinker.ts goMode/goDir, auth.setup.ts Go seed)
+  - backend-agnostic specs album-edit-rate-cover, album-search, wishlist and the rewritten realtime spec
+  - repaired smoke, login and album-create specs; tests/e2e/helpers/fonotekaApi.ts
+  - Go fixes found by the specs and the manual session (empty album format, seeded artist rows, cancelled request logged as 499)
+  - 14.2-UAT.md with the D-13 session and the D-11 PHP cross-check
+affects: [14.2-04 unit tests and gate, phase 20 cutover]
+
+actuals:
+  tokens: 11639
+  tasks: 4
+  commits: 4  # summercms.go: rev-list plan_head_before..plan_head_after = 5, minus 48286b6 docs(17) from another session
+plan_head_before: 05442174b67f1687d07530ef90b4ac6998bf7a50
+plan_head_after: a2d19360d290d81339f0c0f519585bcb337472b4
+fonoteka_head_before: b5363ea99e12b50dc6238438dd3aa60288f08c1e
+fonoteka_commits: 3
+vue_fonoteka_app_head_before: 984031f646784f640930a25eb7f25b3d268ac4d5
+vue_fonoteka_app_commits: 3
+
+tech-stack:
+  added: []
+  patterns:
+    - "Specs self-seed through page.request on the Nuxt origin with the Bearer from the auth_token cookie, Date.now() names, cleanup in finally"
+    - "Realtime is asserted on Centrifugo JSON protocol frames (connect reply, subscribe reply by id, push), the same for both backends"
+    - "Go-mode switches read process.env at call time so contract tests can toggle them"
+
+key-files:
+  created:
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/wishlist.spec.ts
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/fonotekaApi.ts
+    - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md
+  modified:
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/auth.setup.ts
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/.env.example
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/smoke.spec.ts
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/login.spec.ts
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/fonoteka-item.spec.ts
+    - ../fonoteka.go/plugins/golem15/fonoteka/classes/album_write_service.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/classes/album_write_service_db_test.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go
+    - ../fonoteka.go/scripts/dev-stack.sh
+    - modules/surf/accesslog.go
+    - modules/surf/accesslog_test.go
+    - modules/surf/README.md
+    - docs/services/logging.md
+    - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/deferred-items.md
+
+key-decisions:
+  - "The album model rules see nullable text columns as strings, so an empty format passes like PHP, which skips non-implicit rules for an empty string"
+  - "A 5xx written after the client cancelled the request is logged as 499 by the surf access log (framework), not remapped per plugin"
+  - "dev-seed creates albums with their artist rows and backfills seeded albums that have none (album: updated)"
+  - "dev-stack.sh e2e exports TMPDIR=tmp/dev-stack/go-tmp so the Playwright seed can write covers on a tmpfs /tmp machine"
+  - "Item 11 (PHP cross-check) passes by classification: the two PHP failures are a GD-undecodable test fixture and a missing PHP Centrifugo config, with no contract difference"
+
+patterns-established:
+  - "UAT findings that match PHP are recorded with the PHP source reference instead of being changed in Go"
+
+requirements-completed: [QA-05]
+
+coverage:
+  - id: D1
+    description: "E2E_BACKEND=go seed switch: Go mode runs fonoteka:dev-seed and fails closed, runTinker throws, the PHP path is byte-identical (additions only)"
+    requirement: QA-05
+    verification:
+      - kind: e2e
+        ref: "dev-stack.sh e2e auth.setup.ts login.spec.ts smoke.spec.ts fonoteka-item.spec.ts i18n.spec.ts public-share.spec.ts"
+        status: pass
+      - kind: other
+        ref: "git diff HEAD~1 -- tests/e2e/helpers/runTinker.ts | grep -c '^-[^-]' = 0 at 87d6939"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "D-15 Go gate subset (10 spec files) green with zero skips"
+    requirement: QA-05
+    verification:
+      - kind: e2e
+        ref: "dev-stack.sh e2e (10 files): expected=17 unexpected=0 skipped=0 flaky=0, rerun after the session fixes"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Edit, rate, cover upload (cover served from /storage/app/uploads/public/ with naturalWidth > 0), search and wishlist add/remove specs, self-seeding"
+    requirement: QA-05
+    verification:
+      - kind: e2e
+        ref: "album-edit-rate-cover.spec.ts, album-search.spec.ts, wishlist.spec.ts on Go"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Realtime spec on Centrifugo frames: connect reply, error-free collection: subscribe, push within 15 s"
+    requirement: QA-05
+    verification:
+      - kind: e2e
+        ref: "realtime.spec.ts on Go with E2E_CENTRIFUGO=1"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Go fixes: empty wishlist format 201, seeded artist rows, cancelled request logged as 499"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "classes#TestSaveAlbumEmptyFormatPassesModelRules, fonoteka#TestDevStackSmoke (artist backfill), surf#TestAccessLogClientClosedRequest"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Manual D-13 session on the Go stack and D-11 PHP cross-check recorded in 14.2-UAT.md"
+    requirement: QA-05
+    verification:
+      - kind: manual_procedural
+        ref: ".planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md"
+        status: pass
+    human_judgment: true
+
+duration: about 4h including the manual session
+completed: 2026-10-11
+status: complete
+---
+
+# Phase 14.2 Plan 03: vue-fonoteka-app proven on the Go backend Summary
+
+**The vue-fonoteka-app Playwright suite now seeds the Go stack through `fonoteka:dev-seed` (`E2E_BACKEND=go`). Every core flow has a self-seeding spec: edit, rate, cover upload, search, wishlist and realtime over Centrifugo frames. The D-15 subset passes on Go with zero skips. The developer's manual session and the PHP cross-check are on record in 14.2-UAT.md, and the four Go defects they and the specs surfaced are fixed.**
+
+## Performance
+
+- **Duration:** about 4 hours of wall time, including the operator step, the manual session and the PHP run.
+- **Completed:** 2026-10-11
+- **Tasks:** 4 (2 automated, 1 operator checkpoint, 1 manual checkpoint)
+- **Repos:** vue-fonoteka-app (3 commits), fonoteka.go (3), summercms.go (4 before this summary)
+
+## Accomplishments
+
+- **D-14 seed switch.**
+  - `runTinker.ts` gains `goMode()` and `goDir()`. In Go mode, `backendAvailable()` checks `E2E_GO_BIN`, `runTinker()` throws, and `seedE2EFixtures()` runs `$E2E_GO_BIN fonoteka:dev-seed` and throws on any failure.
+  - `auth.setup.ts` seeds before login only when `E2E_BACKEND=go`. The PHP lines are unchanged: the change only adds lines.
+- **D-16 and D-21 specs.**
+  - `album-edit-rate-cover`, `album-search` and `wishlist` are new, and `realtime` is a full rewrite without the removed `realtime-*` test IDs.
+  - The four specs share `helpers/fonotekaApi.ts`.
+- **Go fixes:**
+  - The wishlist form's `"format":""` now gets a 201, as on PHP.
+  - `dev-seed` attaches artist rows, and a rerun backfills them on albums seeded earlier.
+  - A cancelled request is logged as 499 instead of 500 (surf access log).
+  - `dev-stack.sh e2e` keeps the seed's temporary files on the app's device.
+- **Records:**
+  - 14.2-UAT.md has all 11 D-13 items. Items 7, 9 and 10 carry analysed findings, and item 11 is the PHP cross-check.
+  - `deferred-items.md` lists the follow-ups.
+
+## Task Commits
+
+1. **Task 1 (tracer): seed switch, existing core specs green on Go**
+   - vue-fonoteka-app `e4f2a9c`: fix(14.2-03): repair stale smoke, login and album-create e2e specs
+   - vue-fonoteka-app `87d6939`: feat(14.2-03): E2E_BACKEND=go seeds through fonoteka:dev-seed
+   - Tracer gate: the verify ran green end to end (12/0/0/0) before expanding.
+2. **Task 2: Centrifugo origins and namespaces (operator)**
+   - The operator did it before resume. `dev-stack.sh check` exits 0 and prints no origin or namespace warning.
+3. **Task 3: specs for edit, rate, cover, search, wishlist and realtime**
+   - vue-fonoteka-app `c1f323a`: test(14.2-03): backend-agnostic specs for edit, rate, cover, search, wishlist and realtime
+   - fonoteka.go `7675d64`: fix(14.2-03): an empty album format passes the model rules like PHP
+   - summercms.go `66dbd5a`: docs(14.2-03): UAT record with the deferred PHP cross-check
+   - The PHP cross-check was deferred to Task 4 item 11. Executor runs on 2026-10-11 had no PHP E2E credentials, and the run was never reported as passed.
+4. **Task 4: manual session, follow-up fixes and PHP cross-check**
+   - fonoteka.go `d31e00a`: fix(14.2-03): dev-seed attaches artist rows to the seeded albums
+   - fonoteka.go `807dfdb`: fix(14.2-03): dev-stack.sh e2e keeps the seed's temporary files on the app device
+   - summercms.go `4660f95`: fix(14.2-03): access log records a cancelled request's 5xx as 499
+   - summercms.go `b9de061`: docs(14.2-03): record the manual session, its findings and fixes in UAT
+   - summercms.go `a2d1936`: docs(14.2-03): PHP cross-check and re-verification recorded in UAT
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+1. **[Rule 3 - Blocking] Three existing gate specs were stale against the current app, on any backend.**
+   - `smoke` ran with the logged-in storage state, which shows the dashboard on `/`, and expected "Plytarium" where the page says "Płytarium".
+   - `login` used `/login`, which now serves Polish labels, and clicked before hydration.
+   - `fonoteka-item` did not fill the now-required artist and format, and its toast race could not succeed.
+   - Fixed in the specs only; nothing under `app/` changed. Commit `e4f2a9c`.
+2. **[Rule 2 - Missing helper] `tests/e2e/helpers/fonotekaApi.ts` added.** It holds the Bearer, create and delete helpers shared by the specs. The file was not in the plan's file list. Commit `e4f2a9c`.
+3. **[Rule 1 - Bug, D-11 Go fix] Wishlist create with `"format":""` answered the 500 page.**
+   - Cause: the model-rule check saw a `*string` pointing to "", not an empty value, so the `in:` rule failed. PHP skips non-implicit rules for an empty string.
+   - Fixed in fonoteka.go `7675d64`, with a DB test. The framework-level gap is logged in `deferred-items.md`.
+4. **[Rule 1 - Bug, session finding A] The artist field in the edit form was empty for seeded albums.** The seed set only `artist_display`. Fixed in fonoteka.go `d31e00a`, and the developer re-verified it.
+5. **[Rule 1 - Bug, session finding D] A cancelled request was logged as a 500.**
+   - Fixed in the framework (summercms.go `4660f95`), with docs.
+   - The fix belongs in the framework because the status is visible only in the access log, so a per-plugin remap would not reach it.
+6. **[Rule 3 - Blocking] The Playwright-run seed failed with `invalid cross-device link`.** A renamed seeded album made the seed write a new cover with the default `/tmp`. Fixed in fonoteka.go `807dfdb`.
+7. **[Procedural] The PHP cross-check was not a clean run.**
+   - Item 11 on PHP gave `expected=4 unexpected=2`. The failures were a GD-undecodable `PNG_1PX` fixture and the PHP env missing a Centrifugo config.
+   - The developer accepted it as a pass by classification: no contract difference was found. Both issues are in `deferred-items.md`.
+
+### Findings recorded as matching PHP (no change)
+
+- **Item 7:** a new photo is appended and the first photo stays the main cover. Winter's `Sortable` sets `sort_order` to the id, and Go does the same.
+- **Item 9:** a same-user edit in a second tab does not refresh the UI, because the frontend's self-echo guard skips it. The Go push payload has the same shape as PHP's.
+- **Item 3:** `artist_display` is not rewritten after an artist change. PHP fills it only when it is empty.
+
+**Total deviations:** 6 auto-fixed (3 bugs, 2 blocking, 1 missing helper), 1 procedural. **Impact:** no `app/` change. The Go and framework fixes are parity corrections.
+
+## Issues Encountered
+
+- `pnpm test:contracts` fails 1 of 279 on vue-fonoteka-app HEAD from before this plan: `missing-catalog.test.mjs` finds the word "any" in an `app/` type comment from `984031f`. It is outside D-20 scope and logged.
+- `go.log` is appended across `up` runs. The pre-session and session logs are kept as `go.log.pre-uat-20261011` and `go.log.uat-session-20261011`.
+
+## Verification
+
+- **Go gate subset (D-15):** `expected=17 unexpected=0 skipped=0 flaky=0`, `e2e-verdict: passed` after all fixes. go.log shows 0 5xx afterwards.
+- **Go tests:**
+  - fonoteka.go: `go vet ./...` is clean; the fonoteka plugin, classes, console, parity and app-root tests pass.
+  - summercms.go: `go vet ./...` is clean, `go test -short ./...` passes, and so do `TestDocsTree` and `docs:build --check`.
+- **vue-fonoteka-app:** `git diff --name-only 984031f..HEAD -- app` is empty.
+
+## Left running
+
+The Go and Nuxt dev stack (`dev-stack.sh up --detach`) was left running for the developer at the last executor step. The PHP run stopped it and started it again as the coordinator described.
+
+## Next Phase Readiness
+
+Plan 04 can pin the Go seed switch with a contract test (the switch is read at call time) and use `dev-stack.sh` `--guard`, `--self-test` and `--e2e`.
+
+## Self-Check: PASSED
+
+The created spec files, the helper and 14.2-UAT.md exist. Commits:
+- vue-fonoteka-app: e4f2a9c, 87d6939, c1f323a
+- fonoteka.go: 7675d64, d31e00a, 807dfdb
+- summercms.go: 66dbd5a, 4660f95, b9de061, a2d1936

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-04-SUMMARY.md

@@ -0,0 +1,239 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 04
+subsystem: testing
+tags: [unit-tests, gate, dev-seed, surf, uploads, access-log, playwright, contracts, fonoteka]
+
+requires:
+  - phase: 14.2-01
+    provides: fonoteka:dev-seed, commandDatabase, the local marker, storage.uploads.serve, http.access_log
+  - phase: 14.2-02
+    provides: dev-stack.sh guard, e2e, e2e-verdict, status, up --detach
+  - phase: 14.2-03
+    provides: the E2E_BACKEND=go switch in runTinker.ts and the Go-gate spec set
+provides:
+  - scripts/check-phase14.2.sh (--self-test --go --docs --parity --contracts --guard --e2e --all)
+  - console tests TestDevSeedRefusesProduction, TestDevSeedShape, TestDevSeedIdempotent
+  - plugin tests TestDevSeedOpensDatabase, TestReindexOpensDatabase, TestCommandsOpenDatabase, TestDevMarkerRoute
+  - surf tests TestUploadsMount, TestAccessLog
+  - vue-fonoteka-app tests/contracts/e2e-backend-switch.test.mjs
+  - surf: the uploads route owns its prefix (a plugin route at or under it fails BuildRouter)
+affects: [/msd-verify-work 14.2, /msd-validate-phase 14.2, phase 20 cutover]
+
+actuals:
+  tokens: 20256
+  tasks: 3
+  commits: 3
+plan_head_before: dbdf15da76098beb315a61fa4719e05ab1ca13f2
+plan_head_after: 78d72418cb731263572b75294846841a23a853d3
+fonoteka_head_before: 807dfdbfcc6e323d327c29295d23c76887e4dc89
+fonoteka_head_after: 49af991a8f3a9b5c75af29a0734d2d583b83449a
+fonoteka_commits: 2
+vue_fonoteka_app_head_before: c1f323a0ff3a51e1ca6f5db80581a0db0d644d6a
+vue_fonoteka_app_head_after: 6d60e42022e4252cbe0d73b7fb5196eb000d093b
+vue_fonoteka_app_commits: 1
+
+tech-stack:
+  added: []
+  patterns:
+    - "Fresh-process command tests: party.Activate on an app with only database.dsn, run the plugin's own Command, assert the published handle carries the OnDatabase GORM callback"
+    - "Gate guard cases run dev-stack.sh in env -i with planted guard-*.conf files, require a case-specific refusal reason, and keep a passing SummerCMS control case"
+    - "Report-only suites are printed with their counts next to a blocking, phase-scoped run"
+
+key-files:
+  created:
+    - scripts/check-phase14.2.sh
+    - modules/surf/uploads_test.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/dev_marker_test.go
+    - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs
+  modified:
+    - modules/surf/uploads.go
+    - modules/surf/accesslog_test.go
+    - modules/surf/README.md
+    - docs/services/storage.md
+    - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/deferred-items.md
+
+key-decisions:
+  - "The uploads route owns storage.uploads.public_path_prefix: BuildRouter fails when a plugin route sits at or under it (the plan's truth; before, only an identical pattern failed, and only at Assemble)"
+  - "--contracts blocks on the phase's own contract test and reports the whole pnpm test:contracts suite, because missing-catalog.test.mjs fails on vue-fonoteka-app HEAD from before this phase"
+  - "The gate leaves TMPDIR to the caller: a TMPDIR inside fonoteka.go made internal/build scaffold tests edit fonoteka.go/go.work and made go test ./... there pick up build directories"
+  - "--go also runs go test ./... in the fonoteka plugin module, because ./... at the fonoteka.go root covers only the root module"
+  - "The go.log scan reads the whole log, not only lines from this run, so a 5xx left from an earlier session also fails the gate until the log is read and rotated"
+
+requirements-completed: [QA-05]
+
+coverage:
+  - id: D1
+    description: "Seed refusal: unset SUMMER_ENV, production, development, testing and staging refused before anything is opened; local and dev pass the gate; DevEnvironment agrees"
+    requirement: QA-05
+    verification:
+      - kind: unit
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go#TestDevSeedRefusesProduction"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Seed shape, demo@example.com/changeme fallback, DEV_SEED_API_TOKEN prefix refusal and hash storage; idempotent rerun and password-only update"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go#TestDevSeedShape,TestDevSeedIdempotent"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "dev-seed, fonoteka:reindex, fonoteka:oauth-client and fonoteka:prune-notifications open and publish their own database with the OnDatabase hooks"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go#TestDevSeedOpensDatabase,TestReindexOpensDatabase,TestCommandsOpenDatabase"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Marker route only in local/dev, no auth middleware, exact body and no-store; absent and 404 in production, development and testing; not in parity/manifest.yaml"
+    requirement: QA-05
+    verification:
+      - kind: unit
+        ref: "../fonoteka.go/plugins/golem15/fonoteka/dev_marker_test.go#TestDevMarkerRoute"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Uploads mount (off, on, nosniff, HEAD, private/missing/traversal 404, unpublished bucket or database, custom prefix, prefix ownership) and access log (pattern/status, unmatched path, locale prefix, integer duration, no secrets, flush)"
+    requirement: QA-05
+    verification:
+      - kind: integration
+        ref: "modules/surf/uploads_test.go#TestUploadsMount"
+        status: pass
+      - kind: unit
+        ref: "modules/surf/accesslog_test.go#TestAccessLog"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "E2E_BACKEND=go switch contract: argv, cwd, fail-closed exits, runTinker throws, PHP path unchanged, auth.setup.ts seeds only in Go mode"
+    requirement: QA-05
+    verification:
+      - kind: unit
+        ref: "/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "check-phase14.2.sh --all: self-test, go, docs, parity 175/175, contracts, guard refusals, Go-gate Playwright 17/0/0/0 and go.log scan; last line Phase 14.2 gate passed"
+    requirement: QA-05
+    verification:
+      - kind: other
+        ref: "bash scripts/check-phase14.2.sh --all"
+        status: pass
+    human_judgment: false
+
+duration: 60min
+completed: 2026-10-11
+status: complete
+---
+
+# Phase 14.2 Plan 04: Unit tests and the fail-closed phase gate Summary
+
+**Every Go piece the phase added now fails a named test when it regresses: the seed's environment gate, shape and idempotency, the commands' own database, the local marker, the uploads mount and the access log. A Nuxt contract pins the `E2E_BACKEND=go` switch. `scripts/check-phase14.2.sh --all` runs all of it plus parity, the guard refusals and the Go-gate Playwright subset, and ends with `Phase 14.2 gate passed`.**
+
+## Performance
+
+- **Duration:** about 60 min (2026-10-11T21:06Z to 22:06Z)
+- **Tasks:** 3 (tracer, auto TDD, auto)
+- **Repos:** summercms.go (3 code commits), fonoteka.go (2), vue-fonoteka-app (1)
+
+## Accomplishments
+
+- **Seed tests (console package, shared testcontainer):**
+  - `TestDevSeedRefusesProduction` needs no database: the refused environments return `refused in environment`, print nothing and publish no handle. `local` and `dev` get past the gate and fail on a closed port.
+  - `TestDevSeedShape` checks the user flags and bcrypt hash, the context collection, three albums with one public PNG cover each whose blob is in the mem bucket, the wishlist, the rating, the token hash against the printed `inv_` secret and `search_use_typesense`. It also covers the `demo@example.com` / `changeme` fallback and `DEV_SEED_API_TOKEN` values without the prefix (`tok_…`, bare `inv_`, `INV_…`): each is refused with no row in any of nine tables. A value with the prefix is stored by its hash and never printed.
+  - `TestDevSeedIdempotent`: the rerun prints the same entities, all `unchanged`, with no secret and no new row. A new `E2E_PASSWORD` prints only `user: updated`.
+- **Own-database tests (plugin root):** the four commands are taken from the plugin's own `Commands()` and run in fresh processes. Each publishes a `*gorm.DB` carrying the `fonoteka:album_artist_resolver` callback, which proves the `OnDatabase` hooks ran. None prints `database is not configured`. `TestDevMarkerRoute` covers local, dev, unset, production, development and testing, and reads `parity/manifest.yaml`.
+- **Framework tests (surf):**
+  - `TestUploadsMount` uses its own Postgres container with `system_files` and a mem bucket.
+  - `TestAccessLog` runs next to `TestAccessLogSmoke` with the `acme.blog` fixture and the in-package path locale resolver.
+- **Gate script:** every stage named in the plan. Self-test plants detector events, Playwright reports, Go logs and TAP summaries. The guard stage plants six refusal cases plus a passing control case.
+
+## Gate result
+
+```
+PASS self-test
+PASS go
+PASS docs
+PASS parity          (recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0)
+PASS contracts       (blocking: e2e-backend-switch 9/9; report only: pnpm test:contracts 287/288)
+PASS guard           (php-port, internal-unset, mismatch, production, fake-php, other-marker refused; control passed)
+PASS e2e             (Go gate expected=17 unexpected=0 skipped=0 flaky=0; D-15 report only expected=19 unexpected=22)
+Phase 14.2 gate passed
+```
+
+## Task Commits
+
+1. **Task 1 (tracer): the gate runs the seed refusal through the detector**
+   - fonoteka.go `916d9cf` test(14.2-04): dev-seed refuses every environment but local and dev before opening anything
+   - summercms.go `46eee17` test(14.2-04): check-phase14.2.sh runs the seed refusal through the skip-intolerant detector
+   - Tracer gate: the verify passed, a re-run of `--all` passed (end-of-phase mode, automated verify), then I expanded.
+2. **Task 2: unit tests for the seed, the commands, the marker, uploads and the access log**
+   - fonoteka.go `49af991` test(14.2-04): dev-seed shape and idempotency, own-database commands, local marker
+   - summercms.go `2c5c058` test(14.2-04): uploads mount and access log unit tests; the uploads route owns its prefix
+3. **Task 3: Nuxt contract and the remaining gate stages**
+   - vue-fonoteka-app `6d60e42` test(14.2-04): contract for the E2E_BACKEND=go seed switch
+   - summercms.go `78d7241` test(14.2-04): check-phase14.2.sh docs, parity, contracts, guard and e2e stages
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+1. **[Rule 1 - Bug] A plugin route under the uploads prefix did not fail BuildRouter.**
+   - **Found during:** Task 2, by `TestUploadsMount` (written first, failing).
+   - **Issue:** only an identical `GET {prefix}/{path...}` pattern failed, and only later at `Assemble` (duplicate route). A plugin route like `/storage/uploads/avatars/{id}` was accepted and took over part of the uploads URL space.
+   - **Fix:** `mountUploads` refuses any route at or under the prefix, so `BuildRouter` returns the error, as `checkAdminPrefix` does for the admin prefix. A sibling path (`/storage/uploadsx/…`) and the key off are unaffected. The surf README and docs/services/storage.md now say this. The real fonoteka binary still boots with the key on (`dev-stack.sh up` after the change).
+   - **Files:** modules/surf/uploads.go, modules/surf/README.md, docs/services/storage.md. **Commit:** 2c5c058.
+2. **[Rule 3 - Blocking] `--contracts` scoped to the phase's own contract test.** The whole `pnpm test:contracts` suite fails 1 of 288 on `missing-catalog.test.mjs`, which predates this phase (deferred-items.md, plan 03). Following the coordinator's instruction, the blocking run is `node --test tests/contracts/e2e-backend-switch.test.mjs` with a strict TAP check: tests > 0, all pass, and no fail, skip, todo or cancel. The whole suite still runs, and its counts and the failing test name are printed, but it does not block. **Commit:** 78d7241.
+3. **[Rule 3 - Blocking] TMPDIR not forced into the fonoteka.go tree.**
+   - **Issue:** with `TMPDIR=fonoteka.go/tmp/dev-stack/go-tmp` (the coordinator's instruction), the framework's `internal/build` scaffold tests and `TestWatchHelloWorkspaceRebuildLatency` failed. One scaffold test added a `use ./tmp/dev-stack/go-tmp/TestScaffoldCoreArtifacts…` line to `fonoteka.go/go.work`; I reverted it with `git checkout -- go.work` before any commit. A concurrent `go test ./...` in fonoteka.go also listed the build directories as packages.
+   - **Fix:** the gate leaves TMPDIR to the caller (`PHASE142_TMPDIR` overrides). The Go tests do not need the on-device TMPDIR: their buckets live in `t.TempDir()`. `dev-stack.sh` already sets its own TMPDIR for the Go processes and for Playwright. Logged in deferred-items.md.
+4. **[Rule 2 - Missing coverage] `--go` tests the fonoteka plugin module too.** `go -C fonoteka.go test ./...` covers only the root module (`app`, `parity`, `scripts`). The plugin is a separate workspace module, so the stage also runs `go vet` and `go test ./...` in `plugins/golem15/fonoteka`.
+5. **[Rule 2 - Stronger evidence] Guard cases check the refusal reason, and a control case must pass.** Each planted case must exit non-zero and print a `refuse:` line naming its own reason (port 8422, unset, differ, not loopback, X-Powered-By: PHP, the summercms marker). A fake SummerCMS marker must pass the same guard. All cases run in `env -i`, so the developer's shell cannot change them.
+6. **[Plan text vs. behaviour] Raw `..` traversal is a ServeMux redirect, not a 404.** ServeMux answers a raw dot-dot path with a 307 to the cleaned path before any handler runs. The test therefore follows the redirect, requires a `Location` without `..`, and requires that the cleaned path is refused (404) with no blob bytes. Encoded traversal (`%2f`, `%2e%2e`, `%5c`) reaches the handler and gets a 404 with nosniff.
+
+### Acceptance criterion not met as written
+
+- **`grep -c 't.Skip' modules/surf/uploads_test.go` prints 1, not 0.**
+  - The Postgres helper `uploadsGorm` calls `t.Skip` only under `-short`. The project's CLAUDE.md requires Docker-backed tests to skip under `-short`, and CLAUDE.md overrides the plan.
+  - An unavailable Docker daemon is still a `t.Fatalf`, never a skip.
+  - The gate never runs `-short`, and its detector refuses any skipped test or subtest (planted case `subtest-skip`).
+  - `dev_stack_test.go` and `dev_marker_test.go` contain no `t.Skip`. They reach the existing `bootDB` helper, which skips under `-short` only.
+
+**Total deviations:** 5 auto-fixed (1 bug, 2 blocking, 2 coverage), 1 plan-text clarification, 1 acceptance grep deviation driven by CLAUDE.md. **Impact:** one framework behaviour change (uploads prefix ownership), documented. No other production code changed.
+
+## Issues Encountered
+
+- **Vite cold start after a fresh `up`.** The first `--all` run came right after I restarted the stack, so the binary would include this plan's code. Its `--e2e` stage failed: `auth.setup.ts` got Nuxt's 500 page "Failed to fetch dynamically imported module …/layouts/public.vue", so 16 tests were skipped and `e2e-verdict` refused the run, as designed. go.log showed no 5xx. On the warm server the same specs passed 17/0/0/0, and the final `--all` run passed. The gate does not retry. Logged in deferred-items.md with options.
+- **D-15 report-only specs:** expected=19 unexpected=22 on Go. They are reported, not gated, per D-15. go.log had no 5xx and no `album search engine failed` after them.
+- **Pre-existing:** gofmt drift in `fonoteka.go/plugins/golem15/fonoteka/household_smoke_test.go`, out of scope.
+
+## Verification
+
+- `bash scripts/check-phase14.2.sh --all`: exit 0. Last line: `Phase 14.2 gate passed`.
+- `--go` covers `go vet ./...` and `go test ./... -count=1` in summercms.go (Docker), in the fonoteka.go root module and in the fonoteka plugin module. The named tests passed through the detector: console (4), plugin (5) and surf (3).
+- `shellcheck scripts/check-phase14.2.sh` is clean, and `bash -n` passes on it and on dev-stack.sh.
+- Plan acceptance greps pass, except the `t.Skip` grep noted above.
+- `git status` after the run:
+  - fonoteka.go: only the other sessions' submodule pointers (feedback, golem, user). `go.work` is unchanged.
+  - vue-fonoteka-app: clean.
+  - summercms.go: only `.planning/state.json` and `.msd/` (other sessions), plus this plan's planning docs.
+
+## Left running
+
+The Go and Nuxt dev stack is up (`dev-stack.sh status`: Go on 127.0.0.1:8423, Nuxt on :3119). I restarted it once with `down` + `up --detach` so the binary includes this plan's framework change, and left it running.
+
+## Next Phase Readiness
+
+`/msd-verify-work 14.2` can use `bash scripts/check-phase14.2.sh --all`. The services must be up and the Nuxt server warm (load one page, or run `--e2e` twice after a fresh `up`). `14.2-VALIDATION.md` statuses are left for `/msd-validate-phase 14.2`, as the plan says.
+
+## Self-Check: PASSED
+
+All created files exist. Commits: summercms.go 46eee17, 2c5c058, 78d7241. fonoteka.go 916d9cf, 49af991. vue-fonoteka-app 6d60e42.

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md

@@ -18,6 +18,7 @@ Repos: `fonoteka.go` (seed command, start script, dev env template, any Go fixes
 ### Local data
 - **D-01:** Local data comes from `fonoteka migrate` followed by a new seed command. The Phase 20 `import:winter` runner is not pulled forward, and PHP data is not imported in this phase.
 - **D-02:** The seed is an application command, `fonoteka dev:seed` (final name at the planner's discretion), in the fonoteka plugin, not a framework seeder hook. It refuses to run unless the app environment is local/dev, and it is idempotent: a second run changes nothing. It creates:
+  - *Amended 2026-10-12 (code review WR-05, accepted by the developer):* the seed, the backend marker route and `dev-stack.sh` accept `SUMMER_ENV=local` only; `dev` is refused because it is a common name for shared servers. The seed also refuses to modify an existing user it did not create (opt-in `DEV_SEED_RESET_EXISTING=1`) and a token row owned by another user.
   - a verified user;
   - an owned collection;
   - a few albums;
@@ -46,6 +47,7 @@ Repos: `fonoteka.go` (seed command, start script, dev env template, any Go fixes
 - **D-10:** The marker is a route only the Go binary serves (an existing framework health/readiness route, or the smallest new one) that stays **outside the parity manifest**. No manifest route's response changes, and no new header is added to API responses.
 - **D-11:** `vue-fonoteka-app` may receive **small non-breaking changes** (user's decision). The constraint: the app must still run without issues against the PHP backend. Gaps found during the session are fixed in Go first, with a parity case added where a recorded PHP response exists. An app change is acceptable only when it leaves PHP behavior unchanged (for example an env-switched test helper, a new backend-agnostic spec, or docs and `.env.example` notes). Commits in `vue-fonoteka-app` go to its own repo, which is a submodule of the PHP `fonoteka` repo.
 - **D-12:** Failures show up through the Go request log, which is redacted by sunscreen and records each request's path and status, and through Nuxt's normal behavior. The script tees both processes into labeled log files, and the run docs say to watch them for 4xx/5xx and 404 responses. No 404 tally or dev-only error UI is added.
+  - *Amended 2026-10-12 (code review WR-01, accepted by the developer):* the Go request log never records the URL path, not even for unmatched requests, because share and invitation tokens travel in paths. It records method, matched pattern, status and duration. An unported route shows as `status=404 pattern=""`; take the path from the browser network tab.
 
 ### Flow proof
 - **D-13:** The flows are proven twice:

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW-DISPOSITION.md

@@ -0,0 +1,118 @@
+---
+phase: 14.2
+review: 14.2-REVIEW.md
+titles: json
+findings:
+  - id: WR-01
+    severity: warning
+    disposition: fixed
+    title: "Access log writes share and invitation tokens for 405 and 404 responses on token routes"
+  - id: WR-02
+    severity: warning
+    disposition: fixed
+    title: "499 remap hides real server errors whenever the client has gone away"
+  - id: WR-03
+    severity: warning
+    disposition: fixed
+    title: "Uploads route serves the stored content type verbatim on the app origin (stored XSS via text/html)"
+  - id: WR-04
+    severity: warning
+    disposition: fixed
+    title: "`storage.uploads.public_path_prefix` is not validated: a non-path prefix either fails boot or silently 404s every upload"
+  - id: WR-05
+    severity: warning
+    disposition: fixed
+    title: "`fonoteka:dev-seed` takes over existing accounts and tokens behind a single environment-name gate"
+  - id: WR-06
+    severity: warning
+    disposition: fixed
+    title: "Minted API token secret persisted to a group/world-readable file and echoed into Playwright output"
+  - id: WR-07
+    severity: warning
+    disposition: fixed
+    title: "Phase gate `--e2e` can verify a stale binary"
+  - id: WR-08
+    severity: warning
+    disposition: fixed
+    title: "go.log 5xx scan passes when the access log is off"
+  - id: WR-09
+    severity: warning
+    disposition: fixed
+    title: "Realtime spec accepts any publication on the channel, including another spec's"
+  - id: IN-01
+    severity: info
+    disposition: open
+    title: "Env file parser exports arbitrary keys, so \"never executed\" is not quite true"
+  - id: IN-02
+    severity: info
+    disposition: open
+    title: "Postgres loopback check can be bypassed by `hostaddr` or a query `host`"
+  - id: IN-03
+    severity: info
+    disposition: open
+    title: "`down` signals recorded process groups without checking they are still this stack's"
+  - id: IN-04
+    severity: info
+    disposition: open
+    title: "Seed validates `DEV_SEED_API_TOKEN` only after writing cover blobs, leaving orphans on refusal"
+  - id: IN-05
+    severity: info
+    disposition: open
+    title: "Seed's token \"unchanged\" check ignores expiry and scopes"
+  - id: IN-06
+    severity: info
+    disposition: open
+    title: "`marker_ok` does not check the app name"
+  - id: IN-07
+    severity: info
+    disposition: open
+    title: "statusRecorder records a 1xx informational status as the final status"
+  - id: IN-08
+    severity: info
+    disposition: open
+    title: "Gate header overstates what the whole-suite Go runs check"
+  - id: IN-09
+    severity: info
+    disposition: open
+    title: "Hard-coded absolute developer path in a framework script"
+  - id: IN-10
+    severity: info
+    disposition: open
+    title: "Search spec relies on the \"other\" album appearing on the first page after clearing"
+  - id: IN-11
+    severity: info
+    disposition: open
+    title: "Test cleanups ignore errors; `goDir` mis-resolves a relative `E2E_GO_BIN`"
+open: 11
+total: 20
+recorded: 2026-10-12T10:23:19.844Z
+---
+
+# Phase 14.2: Code Review Disposition
+
+| Finding | Severity | Disposition | Source |
+|---------|----------|-------------|--------|
+| WR-01 | warning | fixed | 14.2-REVIEW-FIX.md |
+| WR-02 | warning | fixed | 14.2-REVIEW-FIX.md |
+| WR-03 | warning | fixed | 14.2-REVIEW-FIX.md |
+| WR-04 | warning | fixed | 14.2-REVIEW-FIX.md |
+| WR-05 | warning | fixed | 14.2-REVIEW-FIX.md |
+| WR-06 | warning | fixed | 14.2-REVIEW-FIX.md |
+| WR-07 | warning | fixed | 14.2-REVIEW-FIX.md |
+| WR-08 | warning | fixed | 14.2-REVIEW-FIX.md |
+| WR-09 | warning | fixed | 14.2-REVIEW-FIX.md |
+| IN-01 | info | open | - |
+| IN-02 | info | open | - |
+| IN-03 | info | open | - |
+| IN-04 | info | open | - |
+| IN-05 | info | open | - |
+| IN-06 | info | open | - |
+| IN-07 | info | open | - |
+| IN-08 | info | open | - |
+| IN-09 | info | open | - |
+| IN-10 | info | open | - |
+| IN-11 | info | open | - |
+
+Dispositions: `open` (recorded, not yet triaged), `fixed`, `skipped`, `deferred`.
+Set `deferred` by hand and put the reason in the Source cell; both are preserved. A `|` in the reason is kept as prose and escaped on the next run.
+Re-running the gate keeps every row it can. A row the current review no longer reports is kept and its Source cell flagged, so a finding does not leave this record silently. ONE exception: when a finding id is REUSED by a different finding, the earlier decision cannot keep a row — the id is taken — and it is dropped. A RECORDED decision (anything but `open`) is named on the console when that happens; a row still at `open` is replaced silently, because `open` records no decision to lose.

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW-FIX.md

@@ -0,0 +1,150 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+fixed_at: 2026-10-12T10:20:00Z
+review_path: .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW.md
+iteration: 1
+findings_in_scope: 9
+fixed: 9
+skipped: 0
+status: all_fixed
+---
+
+# Phase 14.2: Code Review Fix Report
+
+**Fixed at:** 2026-10-12T10:20:00Z
+**Source review:** .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW.md
+**Iteration:** 1
+
+**Summary:**
+- Findings in scope: 9 (WR-01 to WR-09; Info findings were out of scope)
+- Fixed: 9
+- Skipped: 0
+
+Commits went to the repository that owns each file. Repositories: `summercms.go` (framework), `fonoteka.go` (app), `vue-fonoteka-app`. `workflow.use_worktrees` is `false`, so every edit and commit was made in the main checkouts.
+
+## Fixed Issues
+
+### WR-01: Access log writes share and invitation tokens for 405 and 404 responses on token routes
+
+**Files modified:** `modules/surf/accesslog.go`, `modules/surf/accesslog_test.go`, `modules/surf/README.md`, `docs/services/logging.md`; fonoteka.go `README.md`
+**Commits:** summercms.go `fbcfaaf`; fonoteka.go `560bb3e`
+**Applied fix:** The request log no longer logs the URL path, not even for an unmatched request. It records `method`, `pattern` (empty when unmatched), `status` and `duration_ms`. New test cases: `POST /blog/posts/<secret>` (405) and `/blog/posts/<secret>/` (404). Both assert that the secret and the path are absent. The docs and the fonoteka README say that the Go log never shows a path.
+
+### WR-02: 499 remap hides real server errors whenever the client has gone away
+
+**Files modified:** `modules/surf/accesslog.go`, `modules/surf/router.go`, `modules/surf/accesslog_test.go`, `modules/surf/README.md`, `docs/services/logging.md`, `scripts/check-phase14.2.sh`
+**Commit:** summercms.go `c30145e`
+**Status:** fixed: requires human verification (logic change)
+**Applied fix:** A 5xx is logged as 499 only when both of these hold:
+- The request context had already ended with `context.Canceled` when the status was written. `statusRecorder` checks this at the first `WriteHeader`/`Write`.
+- The handler did not panic. `recoverJSON` and `recoverBare` now mark the access entry through `markPanicked`.
+
+A 5xx written before the client went away keeps its real status. A recovered panic is always 500. Every record of a request whose client went away carries `client_gone=true`. The handler's own error is not visible to the log. The heuristic "cancelled before the status was written" therefore stands in for "the error is the cancellation". A real error that happens after cancellation and does not panic would still log 499. That case needs a cancelled context, so it is narrow.
+
+Tests cover seven cases:
+- cancel, then 5xx
+- live 5xx
+- 5xx, then cancel
+- 200, then cancel
+- `recoverJSON` 5xx after cancel
+- panic after cancel, through `recoverJSON`
+- panic after cancel, through `recoverBare`
+
+A gate self-test plants `status=500 ... client_gone=true` and checks that `scan_go_log` refuses it.
+
+### WR-03: Uploads route serves the stored content type verbatim on the app origin (stored XSS via text/html)
+
+**Files modified:** `modules/surf/uploads.go`, `modules/surf/uploads_test.go`, `modules/surf/README.md`, `docs/services/storage.md`, `docs/setup/configuration.md`
+**Commit:** summercms.go `41a03b9`
+**Applied fix:** Every uploads response now carries `X-Content-Type-Options: nosniff` and `Content-Security-Policy: default-src 'none'; img-src 'self'; media-src 'self'; sandbox`. A successful response whose type is not a raster image (jpeg, png, gif, webp, avif) gets `Content-Disposition: attachment`, on GET and HEAD. That covers HTML, SVG, PDF, text and a missing type. Error responses get no disposition. The disposition is decided when the status is written, after `attach.StaticHandlerPublic` set the type.
+
+Tests:
+- `TestUploadsResponseHeaders` (no Docker) runs a type matrix on GET and HEAD.
+- `TestUploadsMount` (Docker) now stores a public `text/html` blob and asserts it is served as an attachment, while the png stays inline.
+
+Checked live: a seeded `.jpg` cover is served through Nuxt as `200 image/jpeg` with the CSP and no disposition. The docs' "nosniff prevents HTML" claim is corrected.
+
+### WR-04: `storage.uploads.public_path_prefix` is not validated: a non-path prefix either fails boot or silently 404s every upload
+
+**Files modified:** `modules/surf/uploads.go`, `modules/surf/uploads_test.go`, `modules/surf/README.md`, `docs/services/storage.md`
+**Commit:** summercms.go `01d2548`
+**Applied fix:** A new function, `uploadsPrefix`, validates the prefix when `storage.uploads.serve` is on. It refuses:
+- a missing leading slash
+- a scheme or host
+- `//`
+- `{` or `}`
+- `?` or `#`
+- whitespace or a backslash
+- an empty, `.` or `..` segment
+- a bare `/`
+
+The error names `storage.uploads.public_path_prefix` and says "absolute URL path". Test cases include `storage/uploads`, `storage/app/uploads/public`, `https://cdn.example.com/uploads` and `//cdn...`. Valid prefixes with a trailing slash or surrounding spaces pass. A CDN prefix also passes while `serve` is off.
+
+### WR-05: `fonoteka:dev-seed` takes over existing accounts and tokens behind a single environment-name gate
+
+**Files modified:** fonoteka.go `plugins/golem15/fonoteka/console/dev_seed.go`, `console/dev_seed_test.go`, `dev_marker.go`, `dev_marker_test.go`, `plugin.go`, `scripts/dev-stack.sh`, `.env.dev.example`, `README.md`; summercms.go `scripts/check-phase14.2.sh`
+**Commits:** fonoteka.go `389a059`; summercms.go `8b835f3`
+**Status:** fixed: requires human verification (behaviour change: `dev` is no longer accepted)
+**Applied fix:**
+- **Existing user:** a user with `E2E_EMAIL` and no `dev-seed-mcp` API token row (live or revoked) is one the seed did not create. The seed now refuses it before writing anything, unless `DEV_SEED_RESET_EXISTING=1`. The seed creates the user and the token in one transaction, so the token reliably marks seeded users. dev-stack.sh does not set the opt-in. The local demo user already carries the marker, so `up` reported `user: unchanged`.
+- **Fixed token:** a `DEV_SEED_API_TOKEN` row owned by another user is refused and never reassigned. The error names the token id, never the secret. The update path no longer writes `user_id`.
+- **Environment:** `console.DevEnvironment` accepts `local` only. The seed, the marker route (which shares it) and dev-stack.sh `load_env` all refuse `dev`. It is documented as a common name for a shared server. The running stack was already `env: local`.
+- **Tests:** the new `TestDevSeedRefusesForeignRows` covers a foreign user (opt-in values "", 0, yes, true are refused; password and must_change_password are untouched; the counts do not change; `=1` takes the user over and later runs need no opt-in) and a token row owned by another user. `TestDevSeedRefusesProduction` and `TestDevMarkerRoute` now expect `dev` to be refused. The gate's `CONSOLE_REQUIRE` lists the new test.
+
+The reviewer also suggested a seed-side check that the DSN host is loopback. It was not added: dev-stack.sh already enforces it, and the guidance for this fix did not require it.
+
+### WR-06: Minted API token secret persisted to a group/world-readable file and echoed into Playwright output
+
+**Files modified:** fonoteka.go `scripts/dev-stack.sh`, `README.md`; vue-fonoteka-app `tests/e2e/helpers/runTinker.ts`, `tests/contracts/e2e-backend-switch.test.mjs`; summercms.go `scripts/check-phase14.2.sh`
+**Commits:** fonoteka.go `a5527e9`; vue-fonoteka-app `70eba9e`; summercms.go `bb5c2d3`
+**Applied fix:**
+- **dev-stack.sh:** `seed()` removes `seed.out`, then writes the seed output to it under `umask 077` (mode 600; the old file was 664 and `tee` would have kept that mode). The terminal gets the output through `redact_seed`, which replaces `created <secret> (shown once)`. A new `redact-seed` subcommand exposes the filter.
+- **runTinker.ts:** the seed runs with `stdio: ['ignore', 'pipe', 'inherit']`, and stdout is echoed through the exported `redactSeedOutput`. The secret is also scrubbed from the thrown error's stdout and message.
+- **Tests:** the contract test plants a secret in a fake seed and asserts it never reaches stdout or stderr (it failed before the fix). The gate self-test pipes a planted token line through `redact-seed`, and `--e2e` refuses unless `seed.out` has mode 600. After the restart it was 600.
+
+### WR-07: Phase gate `--e2e` can verify a stale binary
+
+**Files modified:** fonoteka.go `scripts/dev-stack.sh`, `README.md`; summercms.go `scripts/check-phase14.2.sh`
+**Commits:** fonoteka.go `45ee468`; summercms.go `3159bc1`
+**Applied fix:**
+- **Build stamp:** `up` creates `build.stamp.pending` before `summer build`. Once Go answers, it moves the file to `tmp/dev-stack/build.stamp`, so the stamp's mtime is the moment the build started. `down` removes the stamp.
+- **`fresh` subcommand:** refuses a missing stamp, or any file of the app or framework checkout newer than the stamp. It ignores .git, node_modules, testdata, .planning, .claude, .msd, tmp, storage, bin, parity, the framework's admin, docs and scripts, `*.md`, `*_test.go` and `*.golden`.
+- **Already-up stack:** `up` on a stack that is already running warns when it is stale.
+- **Gate:** `--e2e` restarts a running stack that `fresh` refuses (`down`, then `up --detach`, left running) and requires `fresh` to pass after `up`. The self-test plants an app and framework tree with five cases: clean, ignored files, a stale framework source, a stale app source and no stamp.
+
+### WR-08: go.log 5xx scan passes when the access log is off
+
+**Files modified:** summercms.go `scripts/check-phase14.2.sh`; fonoteka.go `scripts/dev-stack.sh`, `README.md`
+**Commits:** summercms.go `1fb3fb9`, `f70a0a5`, `a082a05`; fonoteka.go `261d9bc`
+**Applied fix:**
+- **Scan:** `scan_go_log FILE OFFSET` still refuses a 5xx or a search-failure line anywhere in the file. It now also refuses unless the part written during this run has an `http request` record. `--e2e` takes the offset after `up`/`fresh`.
+- **dev-stack.sh:** `check_keys` defaults `SUMMER_HTTP__ACCESS_LOG` and `SUMMER_STORAGE__UPLOADS__SERVE` to `true` when they are unset, and refuses any other value.
+- **Self-tests:** no records, an empty log, records only before the offset, records after the offset, a long log, and planted env files with the request log or the uploads route off.
+- **Follow-up `a082a05`:** the first version (`tail | grep -q` under `pipefail`) wrongly refused a long go.log that did have records: grep stopped at the first match and tail died of SIGPIPE. The gate run found it. The check now counts matches, and a 20000-line self-test case covers it.
+
+### WR-09: Realtime spec accepts any publication on the channel, including another spec's
+
+**Files modified:** vue-fonoteka-app `tests/e2e/realtime.spec.ts`
+**Commit:** vue-fonoteka-app `4d8d525`
+**Status:** fixed: requires human verification (test logic)
+**Applied fix:** The spec takes a snapshot of `received.length` before `createAlbum`. The assertion then accepts only later frames on the channel whose `push.pub.data.payload.id` equals the created album's id. Both backends publish the `{event, payload, timestamp}` envelope (UAT Finding C; Go `AlbumBroadcastPayload`). It passed in the gate run. It was not shown failing before the fix, because the false pass depends on timing across parallel specs.
+
+## Verification
+
+Gates ran in the main checkouts of all three repositories (no worktree), with Go on 127.0.0.1:8423 and Nuxt on :3119.
+
+- After the Go changes, the stack was restarted with `scripts/dev-stack.sh down` and then `up --detach` in fonoteka.go. The seed showed every entity `unchanged` and the token line `unchanged (secret not shown)`. The new `build.stamp` was written and `fresh` passed. Nuxt was warmed up with requests to /en, /en/albums, /en/login and /pl.
+- **First `--all`:** every stage up to guard passed, then e2e failed. `auth.setup` timed out waiting to leave /login: the backend answered `POST /login` 200 and the post-login API calls 200, so this was Nuxt compiling the first post-login page cold, not a code failure. `--e2e` alone then passed with 17 expected and nothing unexpected, skipped or flaky.
+- **Second `--all`:** e2e failed on the WR-08 SIGPIPE bug described above. It was fixed in `a082a05`.
+- **Final `bash scripts/check-phase14.2.sh --all`:** every stage passed, from self-test, go (vet and full `go test ./...` with Docker in summercms.go, the fonoteka.go root and the fonoteka plugin) and docs, through parity (175/175), contracts (10/10 blocking) and guard, to e2e (17/0/0/0).
+- **Report-only results:** specs 19 expected and 22 unexpected; `pnpm test:contracts` fails 1 of 289. Both are the same as before the fixes (earlier reports `e2e-20261011T213918Z`/`T215650Z`; `missing-catalog` is in deferred-items).
+
+Last gate line: `Phase 14.2 gate passed`
+
+The stack is still running (`dev-stack.sh status`: marker on Go and through :3119).
+
+---
+
+_Fixed: 2026-10-12T10:20:00Z_
+_Fixer: Claude (msd-code-fixer)_
+_Iteration: 1_

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW.md

@@ -0,0 +1,274 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+reviewed: 2026-10-11T22:16:58Z
+depth: standard
+files_reviewed: 43
+files_reviewed_list:
+  - modules/surf/uploads.go
+  - modules/surf/uploads_test.go
+  - modules/surf/accesslog.go
+  - modules/surf/accesslog_test.go
+  - modules/surf/router.go
+  - modules/surf/README.md
+  - docs/services/storage.md
+  - docs/services/logging.md
+  - docs/setup/configuration.md
+  - scripts/check-phase14.2.sh
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/database.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/reindex.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/oauth_client.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/console/prune_notifications.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/dev_marker.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/dev_marker_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_smoke_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/plugin.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/routes.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/classes/album_write_service.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/classes/album_write_service_db_test.go
+  - ../fonoteka.go/scripts/dev-stack.sh
+  - ../fonoteka.go/.env.dev.example
+  - ../fonoteka.go/.gitignore
+  - ../fonoteka.go/config/storage.yaml
+  - ../fonoteka.go/config/http.yaml
+  - ../fonoteka.go/README.md
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-edit-rate-cover.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/wishlist.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/fonotekaApi.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/auth.setup.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/.env.example
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/smoke.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/login.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/fonoteka-item.spec.ts
+  - /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs
+findings:
+  critical: 0
+  warning: 9
+  info: 11
+  total: 20
+status: issues_found
+---
+
+# Phase 14.2: Code Review Report
+
+**Reviewed:** 2026-10-11T22:16:58Z
+**Depth:** standard
+**Files Reviewed:** 43 (three repositories)
+**Status:** issues_found
+
+## Narrative Findings (AI reviewer)
+
+## Summary
+
+Reviewed the framework additions in summercms.go (the `storage.uploads.serve` route, the `http.access_log` request log, the router wiring, docs and the phase gate script), the fonoteka.go glue (`fonoteka:dev-seed`, `commandDatabase`/`commandBucket`, the local-only marker route, `dev-stack.sh`, env template, config and README) and the vue-fonoteka-app e2e changes (Go seed switch, new and repaired specs, contract test).
+
+The four security properties the phase cares about hold in their main form:
+- The marker route and the seed both depend on `console.DevEnvironment`. That function accepts only `local`/`dev`, and an unset `SUMMER_ENV` resolves to `production`. Tests cover the refusal cases.
+- `attach.parsePublicBlobPath` and the `is_public` lookup block path traversal and private files on the uploads route. I checked this against `lagoon/attach/static.go` and `file.go`.
+- A matched route never logs its query string, headers or raw path.
+
+I found no BLOCKER. I did find nine WARNINGs:
+- The access log's "no tokens in paths" promise breaks for 405 and 404 responses.
+- The 499 remap can hide real 5xx responses from the gate.
+- The uploads route serves a stored `text/html` content type on the app origin.
+- `public_path_prefix` is not validated: a prefix that is not a path fails to mount, either loudly at boot or silently as 404s.
+- The seed can take over existing accounts and tokens.
+- The minted API token secret is written to a group/world-readable file.
+- The gate can test a stale binary, and its 5xx log scan passes when the access log is off.
+- The realtime spec can pass on another spec's publication.
+
+## Warnings
+
+### WR-01: Access log writes share and invitation tokens for 405 and 404 responses on token routes
+
+**File:** `modules/surf/accesslog.go:70-72` (docs: `docs/services/logging.md` "Request log", `modules/surf/README.md`)
+**Issue:** `path` is added whenever `entry.pattern == ""`. For a path that a token route matches but with another method, ServeMux answers 405 before any route handler runs, so `recordPattern` never fires. I verified this: `POST /public/secret-token` against `GET /public/{token}` returns 405. The same happens for a trailing-slash variant (`/public/<token>/`, 404) and for an OPTIONS request to a non-CORS path. fonoteka has bearer-secret paths of exactly this kind:
+- `GET /_fonoteka/api/v1/public/{token}` and `public-wishlist/{token}`
+- `GET /_fonoteka/api/v1/invitations/{token}`
+- `POST /invitations/{token}/accept`, where a GET answers 405
+
+So `POST /_fonoteka/api/v1/public/<share-token>` puts the share token into the log. The docs say the opposite: "the raw path of a matched route [is never logged] because tokens often travel in paths". Sunscreen redacts by key and pattern, not by a `path` value.
+**Fix:** Log a path only when it cannot carry a route parameter, or redact the path segments. For example, log `path` only for a ServeMux 404 where no registered pattern matches any method, or replace every segment longer than N characters or matching a token shape with `{redacted}`:
+```go
+if entry.pattern == "" {
+	attrs = append(attrs, slog.String("path", redactPathSegments(req.URL.Path)))
+}
+// redactPathSegments replaces segments that look like identifiers/tokens
+// (len >= 16, or [A-Za-z0-9_-]{8,} with a digit) with "{redacted}".
+```
+Add a test case with `POST /blog/posts/<secret>` (405) asserting the secret is absent. Fix the docs sentence in the same commit.
+
+### WR-02: 499 remap hides real server errors whenever the client has gone away
+
+**File:** `modules/surf/accesslog.go:61-63`
+**Issue:** Every status >= 500 becomes 499 once the request context is cancelled, whatever caused the 5xx. A handler that panics, or that fails on a real DB or engine error, after the browser navigated away or Playwright closed the page, is logged as 499. That happens often: Nuxt aborts in-flight fetches on route change, and Playwright closes pages at the end of each test. `scripts/check-phase14.2.sh` `scan_go_log` (line 195) explicitly treats 499 as clean, so these real failures pass the gate. The comment's premise ("the error came from the cancellation") is assumed, not checked.
+**Fix:** Keep the real status and add a separate attribute, so a grep for 5xx still finds every error and cancelled ones can be filtered on purpose:
+```go
+attrs = append(attrs, slog.Int("status", status))
+if errors.Is(req.Context().Err(), context.Canceled) {
+	attrs = append(attrs, slog.Bool("client_gone", true))
+}
+```
+If 499 is kept for nginx parity, apply it only when nothing was written, or record the original status as `upstream_status`, and have `scan_go_log` refuse `status=499` records that carry an upstream 5xx.
+
+### WR-03: Uploads route serves the stored content type verbatim on the app origin (stored XSS via text/html)
+
+**File:** `modules/surf/uploads.go:57-71` (behaviour in `modules/lagoon/attach/static.go:72-76`); docs claim in `docs/services/storage.md` "Serving files"
+**Issue:** The route answers with the blob's stored `Content-Type`. `attach.Store` stores `http.DetectContentType` of the bytes, so a `.txt` upload (in `DefaultFileExtensions`) whose body starts with `<html>` is stored as `text/html`. A cabana file field in non-image mode on a public relation therefore yields a public blob served as `text/html` on the application origin. `X-Content-Type-Options: nosniff` does not help when the declared type is already `text/html`, so the docs sentence "a browser does not sniff a stored file into HTML or script" overstates the protection. The Nuxt app keeps `auth_token` in a JS-readable cookie on that origin. nginx in the PHP setup served by extension (`.txt` as `text/plain`), so this is also a behaviour difference. D-19 says Phase 20 reuses this route.
+**Fix:** In `uploadsHandler`, add a sandboxing CSP and force download for anything outside an inline-safe allowlist:
+```go
+w.Header().Set("X-Content-Type-Options", "nosniff")
+w.Header().Set("Content-Security-Policy", "default-src 'none'; img-src 'self'; media-src 'self'; sandbox")
+// after the type is known (wrap the ResponseWriter or move into attach):
+// if !inlineSafe(ct) { w.Header().Set("Content-Disposition", "attachment") }
+```
+`inlineSafe` should cover image/jpeg, png, gif, webp, audio/*, video/* and application/pdf. Correct the docs sentence.
+
+### WR-04: `storage.uploads.public_path_prefix` is not validated: a non-path prefix either fails boot or silently 404s every upload
+
+**File:** `modules/surf/uploads.go:38-51`
+**Issue:** The prefix is only trimmed. `joinPath` does not add a leading slash, so ServeMux treats whatever comes before the first `/` as a host pattern. I checked both cases:
+- `storage/app/uploads/public` (no leading slash, a plausible WinterCMS-style value) registers `GET storage/app/uploads/public/{path...}` with host `storage`. It never matches, so every cover silently 404s.
+- An absolute CDN URL (`https://cdn.example.com/uploads`) panics in ServeMux. `handleRoute` reports this as a misleading "route conflict" error.
+
+A prefix containing `{` or `}` would also be parsed as a wildcard. The ownership check at line 43 compares against the same unnormalized prefix.
+**Fix:** Validate when mounting and fail boot with a clear error:
+```go
+if !strings.HasPrefix(prefix, "/") || strings.ContainsAny(prefix, "{}") || strings.Contains(prefix, "//") {
+	return fmt.Errorf("surf: storage.uploads.serve needs storage.uploads.public_path_prefix to be an absolute path such as /storage/uploads, got %q", prefix)
+}
+```
+Add test cases for `storage/uploads` and `https://cdn/x`.
+
+### WR-05: `fonoteka:dev-seed` takes over existing accounts and tokens behind a single environment-name gate
+
+**File:** `../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go:72-78, 329-386, 258-280`
+**Issue:** The only safeguard is `SUMMER_ENV` (`local` or `dev`), which can also come from a `.env` file next to the config. Inside that gate the seed changes existing accounts without saying so:
+- **Existing user:** any user whose email equals `E2E_EMAIL` gets their password reset to `E2E_PASSWORD`, with the default `changeme`. The seed also activates them and clears `must_change_password`.
+- **Existing token:** with `DEV_SEED_API_TOKEN` set, an existing `user_api_tokens` row with that hash, owned by any user, is reassigned to the seed user and un-revoked. The `unchanged` check ignores `scopes`.
+- **The `dev` environment:** `dev` is a common name for shared, network-reachable servers. On such a server the seed creates `demo@example.com` / `changeme` with a `read write ai` API token.
+
+Phase 20 imports production data, and a local copy of it plus this seed is the likely way a real account gets overwritten.
+**Fix:** Add a second, data-based guard before opening the transaction. Refuse when the DSN host is not loopback (the same rule dev-stack.sh applies), and refuse to modify an existing user that the seed did not create unless `--force` is passed. One way is to mark seeded users, for example by checking for the `dev-seed-mcp` token. Never reassign a token row owned by another user: refuse instead. Consider dropping `dev` from the allowed set or documenting it as local-only.
+
+### WR-06: Minted API token secret persisted to a group/world-readable file and echoed into Playwright output
+
+**File:** `../fonoteka.go/scripts/dev-stack.sh:334`; `../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go:309`; `/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts:129-133`
+**Issue:** On creation the seed prints `api token: created inv_<secret> (shown once)`. `seed()` tees all seed output to `tmp/dev-stack/seed.out`, which is mode 664 in a 775 directory on this machine. This host has several users (`jin` owns the Nuxt checkout, `golem` runs the stack), so any local user can read a `read write ai` token and use it against `127.0.0.1:8423`. With the `ai` scope that spends the developer's configured AI keys. `seedE2EFixtures` runs the seed with `stdio: 'inherit'`, so a first-run secret also lands in Playwright and CI output. The README says the script "never prints a value".
+**Fix:** Create the file with a restrictive umask, and filter the secret before writing it:
+```bash
+( umask 077; cd "$APP" && TMPDIR="$GO_TMP" bin/fonoteka fonoteka:dev-seed 2>&1 | tee "$RUN/seed.out" )
+```
+In runTinker.ts, use `stdio: ['ignore', 'pipe', 'inherit']` and drop lines matching `/api token: created/` before echoing. Alternatively, have the seed write the secret only to the terminal, for example behind a `--show-token` flag.
+
+### WR-07: Phase gate `--e2e` can verify a stale binary
+
+**File:** `scripts/check-phase14.2.sh:513-534` (with `../fonoteka.go/scripts/dev-stack.sh:538-546`)
+**Issue:** When `dev-stack.sh status` succeeds, the gate reuses the running stack. `up --detach` then prints `already up` and returns without `summer build`, migrate or seed. The Playwright and go.log stages then exercise whatever binary was started earlier, possibly before the commits under review. Plan 04's SUMMARY admits the stack had to be restarted by hand so the binary would include the plan's framework change. A gate that can pass on old code does not fail closed.
+**Fix:** Pick one of these:
+- Always `down` and `up --detach` in `--e2e`.
+- Record the git HEADs of summercms.go and fonoteka.go (and `bin/fonoteka` mtime or `go version -m`) in `tmp/dev-stack/build.id` at `up` time, and have `--e2e` refuse when they differ from the current HEADs.
+
+### WR-08: go.log 5xx scan passes when the access log is off
+
+**File:** `scripts/check-phase14.2.sh:189-201`
+**Issue:** `scan_go_log` refuses only when it finds `status=5xx` or the search-failure line. If the developer's `.env.dev` lacks `SUMMER_HTTP__ACCESS_LOG=true`, there are no `http request` records at all, and the scan passes on an empty signal. `config/http.yaml` defaults the key to `false`, and dev-stack.sh does not require it (it is not in `REQUIRED_KEYS`).
+**Fix:** Require evidence that the log was produced by this run:
+```bash
+grep -q 'msg="http request"' "$file" || { echo "refuse: $file has no http request records; set SUMMER_HTTP__ACCESS_LOG=true" >&2; return 1; }
+```
+Also add `SUMMER_HTTP__ACCESS_LOG` (and `SUMMER_STORAGE__UPLOADS__SERVE`) to `REQUIRED_KEYS`, or export them in `start_go`.
+
+### WR-09: Realtime spec accepts any publication on the channel, including another spec's
+
+**File:** `/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/realtime.spec.ts:114-119`
+**Issue:** The live assertion is `received.some(m => m.push?.channel === channel && m.push.pub !== undefined)`. It is evaluated over all frames received since the socket opened, before and after `createAlbum`. Other gate specs create albums in the same user's collection (`album-search` creates two, `album-edit-rate-cover` and `fonoteka-item` one each). If they run in parallel workers, or a previous push is still buffered, the test passes even when the album this spec created publishes nothing. The test can therefore pass without proving that this spec's write published anything.
+**Fix:** Snapshot the frame count before the write and match the created album:
+```ts
+const before = received.length
+const id = await createAlbum(page, `E2E Realtime ${Date.now()}`)
+await expect.poll(() => received.slice(before).some(m =>
+  m.push?.channel === channel && JSON.stringify(m.push.pub ?? {}).includes(`"id":${id}`)), ...).toBe(true)
+```
+
+## Info
+
+### IN-01: Env file parser exports arbitrary keys, so "never executed" is not quite true
+
+**File:** `../fonoteka.go/scripts/dev-stack.sh:129-150`
+**Issue:** Any `KEY=value` is exported, including `BASH_ENV`, `LD_PRELOAD`, `PATH` and `NODE_OPTIONS`. The `setsid bash -c` children source `$BASH_ENV`, so an env file line can still run code, which contradicts the comment and the README.
+**Fix:** Export only keys matching `^(SUMMER_|NUXT_|E2E_|DEV_STACK_|DEV_SEED_)` and refuse others by name.
+
+### IN-02: Postgres loopback check can be bypassed by `hostaddr` or a query `host`
+
+**File:** `../fonoteka.go/scripts/dev-stack.sh:215-241`
+**Issue:** For URI DSNs, a query `host=` is used only when the netloc host is empty, but pgx lets query parameters override the netloc. `postgres://u:p@localhost/db?host=prod.example` therefore passes the check and connects remotely. `hostaddr=` is ignored in both URI and key=value forms.
+**Fix:** Let the query `host` override, check `hostaddr` as well, and refuse multi-host values.
+
+### IN-03: `down` signals recorded process groups without checking they are still this stack's
+
+**File:** `../fonoteka.go/scripts/dev-stack.sh:582-592`
+**Issue:** After a crash or reboot, a recycled pgid in `tmp/dev-stack/pids` makes `down` send TERM and then KILL to an unrelated process group.
+**Fix:** Record the start time or command line with the pgid (`ps -o lstart= -p`), and compare it before killing.
+
+### IN-04: Seed validates `DEV_SEED_API_TOKEN` only after writing cover blobs, leaving orphans on refusal
+
+**File:** `../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go:168-197, 258-261`
+**Issue:** `StoreAlbumPhoto` writes blobs before rows (see `attach.Store`'s contract). A bad `DEV_SEED_API_TOKEN` rolls back the transaction after three covers are written, and the files stay under `storage/app/uploads/public`. The same happens for any later failure.
+**Fix:** Validate `DEV_SEED_API_TOKEN` and the token prefix before `lagoon.Transaction`. On rollback, delete the keys the run stored.
+
+### IN-05: Seed's token "unchanged" check ignores expiry and scopes
+
+**File:** `../fonoteka.go/plugins/golem15/fonoteka/console/dev_seed.go:292-300`
+**Issue:** An expired or narrowed `dev-seed-mcp` token counts as present, so no usable token is minted and no secret is shown.
+**Fix:** Add `(expires_at IS NULL OR expires_at > now())` to the query, and compare scopes.
+
+### IN-06: `marker_ok` does not check the app name
+
+**File:** `../fonoteka.go/scripts/dev-stack.sh:369`
+**Issue:** Any SummerCMS app (for example another `sm-*-app` on the same port) passes `marker_ok` and `guard_marker` (`.backend == "summercms"` only).
+**Fix:** Check `.backend == "summercms" and .app == "fonoteka"`.
+
+### IN-07: statusRecorder records a 1xx informational status as the final status
+
+**File:** `modules/surf/accesslog.go:106-111`
+**Issue:** A handler that sends `103 Early Hints` and then 200 is logged with status 103.
+**Fix:** Record only when `status >= 200` (or overwrite while `w.status < 200`).
+
+### IN-08: Gate header overstates what the whole-suite Go runs check
+
+**File:** `scripts/check-phase14.2.sh:3-5, 331-348`
+**Issue:** The header says every stage fails on a go test run that "skips". The `go test ./...` runs in all three modules do not go through `detect`; only the named tests do.
+**Fix:** Reword the header, or run the whole suites through `go_json` with an allowlist for intended skips.
+
+### IN-09: Hard-coded absolute developer path in a framework script
+
+**File:** `scripts/check-phase14.2.sh:51`
+**Issue:** `PHASE142_NUXT` defaults to `/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app`, which ties the framework repo to one machine layout. dev-stack.sh already requires `DEV_STACK_NUXT_DIR` from the env file.
+**Fix:** Default to `$DEV_STACK_NUXT_DIR`, or refuse when `PHASE142_NUXT` is unset.
+
+### IN-10: Search spec relies on the "other" album appearing on the first page after clearing
+
+**File:** `/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/album-search.spec.ts:46-47`
+**Issue:** On a collection that has grown (left-over albums from failed runs, real data in the seeded user's collection), the freshly created `other` album may fall off the first page, depending on the list's sort and page size. The spec then becomes order-dependent.
+**Fix:** Assert that the list is unfiltered another way (for example, the result count grows back), or search for `E2E Other ${stamp}` in a second step.
+
+### IN-11: Test cleanups ignore errors; `goDir` mis-resolves a relative `E2E_GO_BIN`
+
+**File:** `../fonoteka.go/plugins/golem15/fonoteka/dev_stack_test.go:106-111`; `/media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/tests/e2e/helpers/runTinker.ts:48-51`
+**Issue:**
+- **Test cleanup:** `TestDevSeedOpensDatabase` deletes `users` with the errors ignored. A foreign-key refusal leaves the seeded collections, albums and tokens in the shared container.
+- **`goDir`:** `path.resolve(path.dirname(bin), '..')` resolves a relative `E2E_GO_BIN` against the Nuxt checkout's working directory, not the app's.
+
+**Fix:** Check the cleanup `Exec(...).Error` with `t.Errorf`, and delete dependents first. Resolve `E2E_GO_BIN` to an absolute path, or refuse a relative one.
+
+---
+
+_Reviewed: 2026-10-11T22:16:58Z_
+_Reviewer: Claude (msd-code-reviewer)_
+_Depth: standard_

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-UAT.md

@@ -0,0 +1,138 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+plan: 03
+status: complete
+---
+
+# Phase 14.2 UAT: vue-fonoteka-app on the local Go backend
+
+This file records the D-13 manual session (plan 03, Task 4) and the D-11 PHP cross-check of the plan 03 specs.
+
+## Automated evidence (plan 03, Tasks 1 and 3)
+
+- Go gate subset (D-15) through `fonoteka.go/scripts/dev-stack.sh e2e`. Specs: `auth.setup.ts`, `login.spec.ts`, `smoke.spec.ts`, `fonoteka-item.spec.ts`, `public-share.spec.ts`, `realtime.spec.ts`, `i18n.spec.ts`, `album-edit-rate-cover.spec.ts`, `album-search.spec.ts`, `wishlist.spec.ts`. Result: `expected=17 unexpected=0 skipped=0 flaky=0`, `e2e-verdict: passed`.
+- The realtime live test passed against the shared Centrifugo after the D-18/D-23 operator step: a connect reply, an error-free `collection:` subscribe and a push on that channel after an API album create.
+- Commits tested: vue-fonoteka-app `c1f323a`; fonoteka.go `7675d64`.
+- Re-run after the session fixes (2026-10-11): the same 10 spec files give `expected=17 unexpected=0 skipped=0 flaky=0`, `e2e-verdict: passed`. Tested with fonoteka.go `807dfdb`, summercms.go `4660f95`, vue-fonoteka-app `c1f323a`. Afterwards `grep -cE 'status=5[0-9]{2}' tmp/dev-stack/go.log` printed 0.
+
+## PHP cross-check (Task 3): deferred
+
+The plan 03 specs could not be checked against PHP automatically on 2026-10-11.
+
+- **What PHP did:** PHP started. `php artisan serve --host=127.0.0.1 --port=8422` in `/media/nvme/dev/golem15/fonoteka` answered the probe `GET http://127.0.0.1:8422/_fonoteka/api/v1/albums` with `HTTP/1.1 401 Unauthorized` and `X-Powered-By: PHP/8.5.10`, so the verify took branch A.
+- **Why the run did not count:** no PHP E2E credentials are available to the executor. `E2E_EMAIL` and `E2E_PASSWORD` were still unset after Playwright loaded `tests/e2e/.env.local` and `tests/e2e/.env`. `auth.setup.ts` therefore wrote an empty storage state, and the five specs skipped.
+  - Report: `expected=1 unexpected=0 skipped=5 flaky=0`.
+  - `e2e-verdict` refused it. It is **not** a PHP pass.
+- **Why the executor did not seed:** the Go seed user `demo@example.com` / `changeme` does not exist on PHP (`POST /_user/api/v1/login` answered 401). The executor did not create a user in the developer's PHP database. Seeding with `seedE2EFixtures()` in PHP mode runs `firstOrNew` on the e-mail, so it can reset the password of an existing user.
+
+**Manual PHP check (Task 4, item 11).** Run it with the credentials of a PHP user whose collection may receive temporary `E2E …` albums. Every spec deletes what it creates.
+
+```sh
+# Go stack stopped first: bash ../fonoteka.go/scripts/dev-stack.sh down
+cd /media/nvme/dev/golem15/fonoteka && php artisan serve --host=127.0.0.1 --port=8422 &
+cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go
+R=/tmp/php-e2e-14.2.json; rm -f "$R"
+env -u CI -u E2E_BACKEND E2E_EMAIL='<php user>' E2E_PASSWORD='<password>' \
+  E2E_FRONTEND_URL=http://localhost:3119 E2E_BACKEND_URL=http://localhost:8422 E2E_CENTRIFUGO=1 \
+  PLAYWRIGHT_JSON_OUTPUT_NAME="$R" pnpm --dir /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app exec playwright test \
+  auth.setup.ts realtime.spec.ts album-edit-rate-cover.spec.ts album-search.spec.ts wishlist.spec.ts \
+  --project=chromium --reporter=json > /dev/null
+bash ../fonoteka.go/scripts/dev-stack.sh e2e-verdict "$R"   # must print e2e-verdict: passed
+```
+
+Item 11 passes only on a run with no skipped, unexpected or flaky test. Until then the plan stays open (D-11). The run was done at Task 4; see below.
+
+## Manual session (Task 4, D-13)
+
+Session by the developer on 2026-10-11 (about 20:10 to 20:20 local time) against the Go stack. Commits tested: fonoteka.go `7675d64`, summercms.go `66dbd5a` (framework), vue-fonoteka-app `c1f323a`. The session's Go log is kept as `fonoteka.go/tmp/dev-stack/go.log.uat-session-20261011`.
+
+| # | Item | Result | Notes |
+|---|------|--------|-------|
+| 1 | Login lands outside /login | pass | |
+| 2 | Collections: "Moja kolekcja" lists Kind of Blue, Blue Train, Mingus Ah Um with covers | pass | |
+| 3 | Album detail page opens | pass | After an artist change the detail page keeps the old `artist_display`. Same as PHP: `Album.php` (around line 397) fills `artist_display` only when it is empty. See finding E. |
+| 4 | Search "Mingus" finds the album; no `album search engine failed` in go.log | pass | search_fail = 0 |
+| 5 | Edit name persists after reload | pass | Finding A below (empty artist field): fixed in fonoteka.go `d31e00a`. The developer re-verified it: Blue Train shows John Coltrane. |
+| 6 | Rating persists after reload | pass | |
+| 7 | Cover upload shows on the page | pass (re-verified) | Finding B: a new photo is appended and the first photo stays the main cover, as on PHP. The developer re-verified it. |
+| 8 | Wishlist add on /wishlist/new, then remove | pass | Also marked an existing entry purchased. |
+| 9 | Realtime: `collection:` subscribe without error; push frame after an edit in a second tab | pass (matches PHP) | See finding C. The subscribe reply had no error and the push arrived. |
+| 10 | No 5xx in go.log; no `X-Powered-By: PHP` through :3119 | pass after fix | The session failed it; see finding D. After the fix, go.log had 0 5xx lines. No PHP header; search_fail = 0. |
+| 11 | PHP cross-check | pass (by classification) | PHP: `expected=4 unexpected=2 skipped=0 flaky=0`; Go: all passed on the same specs. Both PHP failures come from the environment or the test fixture, not from a contract difference. See "PHP cross-check (Task 4, item 11)" below. |
+
+### Finding A: the artist field in the edit form was empty (fixed in Go)
+
+- **Symptom:** the collection view showed "John Coltrane" for Blue Train, but the Artist field of the edit form was empty.
+- **Cause:** `fonoteka:dev-seed` set only `artist_display` and attached no artist rows, so `GET /albums/3` answered `"artists":[]`. The edit form fills the field from `album.artists` (`utils/album-draft.ts`).
+- **Fix:** fonoteka.go `d31e00a`. The seed creates albums with `artists: [<name>]` through `classes.CreateAlbum`, the album form's path. A rerun attaches the artist to a seeded album that has no artist rows and reports `album …: updated`. `TestDevStackSmoke` covers both cases.
+- **After the fix:** the restart printed `album Kind of Blue: updated`, `album Blue Train: updated` and `wishlist album A Love Supreme: updated`. `GET /albums/3` now answers `artists: ["John Coltrane"]`. Mingus Ah Um already had the artist set during the session.
+- **Other write paths:** every non-seed album create goes through `classes.CreateAlbum`, the port of `AlbumWriteService::create`. That covers the album form, the wishlist form, bulk and CSV import. The create rules require `artists` (`required|array|min:1`, also per bulk row), as in PHP. The seed was the only path without artist rows.
+
+### Finding B: a new cover does not become the main cover (matches PHP, not a Go defect)
+
+- **Frontend:** both the edit gallery (`PhotoUploader.vue` `editHeroSrc`) and the detail page (`AlbumCoverGallery.vue` `hero`) show `photos[0]` as the main cover.
+- **PHP:** `Album::$attachMany['photos']` is ordered by `sort_order`, and Winter's `Sortable` trait sets `sort_order` to the new file id on create (`vendor/winter/storm/src/Database/Traits/Sortable.php`). A new photo is therefore appended, and the oldest photo stays the main cover.
+- **Go:** `classes.AttachAlbumPhoto` sets `sort_order = id`, and the DTO orders by `sort_order, id`.
+- **Reproduction on Go** (album with photo A, then photo B uploaded through the edit form):
+  - API order is `[A, B]`.
+  - In the edit page right after the upload, the hero is A and the strip is `[A, B]`.
+  - After F5, the hero is still A.
+  - The upload answer has the PHP shape: `201 {"data":{"id","url","thumb_url"}}`.
+- **The developer's session:** the log has two photo POSTs at 20:15:10 and 20:15:16, then `DELETE /albums/{id}/photos/{fileId}` at 20:15:23. The access log does not record the album id. The main cover changes only when `photos[0]` changes, for example when the older photo is deleted. That fits a new photo that showed as the main cover only later.
+- **Re-verify:** item 7 means "the uploaded photo shows on the page", and the photo appears in the strip at once. A new photo replacing the main cover is not PHP behaviour.
+
+### Finding C: realtime push arrives, no UI refresh for the same user (frontend design, same on PHP)
+
+- **The Go push frame on `collection:2`:** `{"event":"updated.fonoteka.album","payload":{"id","collection_id","action","actor":{"user_id":2,"name":"Demo"},"timestamp","album"},"timestamp"}`.
+- **The PHP publication:** the same keys at both levels. `CentrifugoClient::publish` sends `data: {event, payload, timestamp}`, and the payload comes from `Album::getBroadcastPayload` (`id`, `collection_id`, `action`, `actor`, `timestamp`, `album`).
+- **The frontend's self-echo guard:** `useRealtimeSync.ts` skips the refresh when `payload.actor.user_id === auth.user.id`. Both tabs were logged in as the same user, so the second tab's edit is the first tab's own echo, and it is suppressed on purpose. Against PHP it behaves the same.
+- **Re-verify:** for a UI refresh, edit from a different user who shares the collection (a household member).
+
+### Finding D: a cancelled request was logged as a 500 (fixed in the framework)
+
+- **What was logged:** `GET /_fonoteka/api/v1/genres status=500` at 20:18:34. The client cancelled the request, `classes/active_collection.go:204` failed with `context canceled`, and the handler wrote a 500 that no client received. PHP keeps running after a client disconnect and does not log a server error.
+- **Fix:** summercms.go `4660f95`. The surf access log records a 5xx written after the request context ended with `context.Canceled` as 499 (client closed request). A real 5xx on a live request keeps its status.
+- **Tests and docs:** `TestAccessLogClientClosedRequest` covers both cases. The surf README and `docs/services/logging.md` are updated.
+- **Left as is:** the GORM logger still prints the `context canceled` line in colour; that is the known GORM log noise in `deferred-items.md`.
+
+### Also fixed during the session follow-up
+
+- fonoteka.go `807dfdb`: `dev-stack.sh e2e` exports `TMPDIR=tmp/dev-stack/go-tmp`. The session renamed the seeded "Kind of Blue" to "Kind of Blue!", so the next `fonoteka:dev-seed` run in `auth.setup.ts` created a new "Kind of Blue" album and had to write a new cover. It and failed with `invalid cross-device link`. This is the deferred file-bucket issue, now covered on the e2e path too.
+
+### For the developer to re-verify
+
+- **Artist field:** open Edit on Blue Train; the field shows John Coltrane.
+- **Item 7:** upload a photo to an album that has a cover. It appears in the photo strip right away, and the main cover stays the first photo. To make it the main cover, delete the old one.
+- **Item 9 (optional):** an edit by another household member refreshes the open page.
+- **Item 11:** the PHP run described in the deferred section.
+
+### Finding E: `artist_display` stays the same after an artist change (same as PHP)
+
+- **What happens:** changing an album's artists does not rewrite `artist_display`.
+- **PHP:** the same. `Album.php` (around line 397) fills `artist_display` only when it is empty.
+- **Go:** the same. `syncAlbumArtistsFromInput` keeps a non-empty `artist_display` that the request sends; the edit form sends it. It derives the value only when the request omits it or leaves it empty.
+- No change; the item passes.
+
+## PHP cross-check (Task 4, item 11)
+
+The developer ran it on 2026-10-11, together with the coordinator.
+
+- **Setup:**
+  - Go stack stopped during the run.
+  - PHP through `php artisan serve` on :8422; Nuxt on :3119 pointed at it.
+  - A throwaway PHP user `e2e-go-check@example.com`, created for the run and deleted afterwards (`deleted=1 remaining=0`).
+- **Specs:** `auth.setup.ts`, `realtime.spec.ts`, `album-edit-rate-cover.spec.ts`, `album-search.spec.ts`, `wishlist.spec.ts`.
+- **PHP result:** `expected=4 unexpected=2 skipped=0 flaky=0`.
+- **Go result on the same specs:** all passed.
+
+The two PHP failures:
+
+1. **`album-edit-rate-cover`: a fixture artefact on PHP.**
+   - PHP answered `POST /albums/{id}/photos` with a 500. `system.log` shows `TypeError: imagealphablending(): Argument #1 must be of type GdImage, false given` at winter/storm `Database/Attach/Resizer.php:139`.
+   - GD cannot decode the spec's hand-built 1x1 PNG fixture (`PNG_1PX`). GD itself supports PNG, JPEG, WebP and AVIF, and a real photo uploaded through PHP works (manual item 7).
+   - Go accepts the fixture. This is not a Go divergence.
+2. **`realtime` live: an environment gap on PHP.**
+   - No Centrifugo socket opened within 15 s. The PHP log says `Centrifugo: Skipping publish (not configured)`: the local PHP env has no Centrifugo config.
+   - The realtime baseline test passed on PHP. This is not a Go divergence.
+
+**Verdict:** item 11 passes. No contract difference between PHP and Go was found. The strict D-11 bar (a clean PHP run) was not met, because the two failures above come from the fixture and from the PHP environment. The developer accepted the classification, and both issues are in `deferred-items.md`.

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-VERIFICATION.md

@@ -0,0 +1,253 @@
+---
+phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
+verified: 2026-10-12T10:41:00Z
+status: passed
+score: 54/54 must-haves verified (5 by override or human verification)
+covered_files:
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-PLAN.md
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-SUMMARY.md
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-PLAN.md
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-SUMMARY.md
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-03-PLAN.md
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-03-SUMMARY.md
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-04-PLAN.md
+  - .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-04-SUMMARY.md
+  - docs/services/logging.md
+  - docs/services/storage.md
+  - docs/setup/configuration.md
+  - modules/surf/README.md
+  - modules/surf/accesslog.go
+  - modules/surf/accesslog_test.go
+  - modules/surf/router.go
+  - modules/surf/uploads.go
+  - modules/surf/uploads_test.go
+  - scripts/check-phase14.2.sh
+covered_digest: "v2:sha256:458b8aba274a449e0c7fec7aa5776f833f9e2dc54b4b2686e64b625d0e59960c"
+behavior_unverified: 0
+overrides_applied: 3
+overrides:
+  - must_have: "Per D-11, D-16 and D-21, the new and rewritten specs also pass against the PHP backend on :8422 with the app's own PHP-targeted .env"
+    reason: "The PHP run (UAT item 11) gave expected=4 unexpected=2. Both failures were classified as non-contract: the PNG_1PX fixture cannot be decoded by PHP GD (Resizer.php:139), and the local PHP env has no Centrifugo config. Go passed the same specs. Both follow-ups are in deferred-items.md."
+    accepted_by: "developer (14.2-UAT.md item 11, 'The developer accepted the classification')"
+    accepted_at: "2026-10-11T21:04:28Z"
+  - must_have: "TestDevSeedRefusesProduction proves local and dev pass the gate; TestDevMarkerRoute answers 200 for local and dev (D-02; 14.2-01 truths 3 and 7, 14.2-04 truths 2 and 5)"
+    reason: "WR-05: dev is a common name for a shared server; seed, marker and dev-stack.sh accept local only. D-02 amended in 14.2-CONTEXT.md."
+    accepted_by: "developer (orchestrator question after verification)"
+    accepted_at: "2026-10-12T11:01:43Z"
+  - must_have: "http.access_log adds path without its query string only for unmatched requests (D-12; 14.2-01 truth 9, 14.2-04 truth 7)"
+    reason: "WR-01: share and invitation tokens travel in paths; the log records method, pattern, status and duration only. D-12 amended in 14.2-CONTEXT.md."
+    accepted_by: "developer (orchestrator question after verification)"
+    accepted_at: "2026-10-12T11:01:43Z"
+behavior_unverified_items: []
+human_verified:
+  - test: "Foreground `dev-stack.sh up`: SIGINT stops Go and Nuxt and removes the pid file"
+    result: "pass: ran by the orchestrator at the developer's request; exit=130, tmp/dev-stack/pids removed, ports 8423 and 3119 free, no fonoteka serve or nuxt dev process left; stack restarted with up --detach"
+    recorded_at: "2026-10-12T11:01:43Z"
+  - test: "Four test-tier prohibitions, checked with commands"
+    result: "pass: (1) `git log df7876b..HEAD -- plugins/golem15/user` in fonoteka.go is empty; (2) vue-fonoteka-app `git status --short` is clean; (3) dev-stack.sh mentions /etc/centrifugo/config.json only in warn text and has no systemctl or publish call; (4) all 54 'E2E ...' albums in fonoteka_go_dev have deleted_at set, i.e. every spec's DELETE ran; soft delete matches PHP (Album.php uses Winter SoftDelete)"
+    recorded_at: "2026-10-12T11:01:43Z"
+  - test: "UAT items 1-11 (login, browse collections/albums, album detail, search, edit, rate, cover upload, wishlist add/remove, realtime, no 5xx/no PHP header, PHP cross-check)"
+    uat_row: "1-11"
+    recorded_at: "2026-10-11T21:04:28Z"
+    note: "Files changed after the UAT (review fixes WR-01..09: accesslog.go, uploads.go, router.go, dev_seed.go, dev-stack.sh, runTinker.ts, realtime.spec.ts) were re-exercised by the gate's Go e2e run e2e-20261012T101126Z (17/0/0/0, started 10:11:27Z, after the last Go commit 261d9bc and the build stamp 09:28:54Z): login with the seed, cover decode through the Nuxt /storage proxy, search, wishlist, realtime subscribe and push. go.log has 0 5xx records. No re-test requested."
+human_verification: []
+---
+
+# Phase 14.2: Local Fonoteka frontend on local SummerCMS backend: Verification Report
+
+**Phase goal:** A developer runs the existing `vue-fonoteka-app` locally against the local `fonoteka.go` SummerCMS backend (not PHP), logs in, and uses the real Nuxt flows so the port is proven in daily use before production cutover.
+**Verified:** 2026-10-12T10:41:00Z
+**Status:** passed (after human verification on 2026-10-12T11:01:43Z: D-02 and D-12 overrides accepted, foreground Ctrl-C cleanup and the four prohibitions checked)
+**Re-verification:** No (initial verification; no previous VERIFICATION.md)
+
+The phase goal is achieved in the codebase. All four roadmap success criteria are verified with fresh or post-fix evidence. Nothing blocks. Four items need a human decision: two deliberate contract narrowings from the review fixes (WR-05, WR-01), one cleanup invariant that no test exercises, and four test-tier prohibitions enforced only statically.
+
+## MVP mode note (warning)
+
+ROADMAP sets `**Mode:** mvp`, but the goal is not in user-story form. `user-story.validate` returned `valid: false` (no "As a …, I want to …, so that …"). The verifier contract says to refuse in that case. I did not refuse, because the orchestrator asked for goal-backward verification of a phase that was already planned, executed and UAT'd. Instead I read the goal as the implicit story "As a developer, I want to run the Nuxt app against local Go and use its flows, so that the port is proven before cutover". If the MVP framing should stay, run `/msd mvp-phase 14.2` to reformat the goal.
+
+## User Flow Coverage
+
+| Step | Expected | Evidence | Status |
+|------|----------|----------|--------|
+| Start the stack | One command starts Go and Nuxt, wired to each other | `fonoteka.go/scripts/dev-stack.sh` `up()` (lines 587-650): env, services, build, migrate, seed, reindex, serve, guard, pnpm dev, probe | ✓ |
+| Log in | The seeded user logs in through the Nuxt proxy to Go | `auth.setup.ts` seeds through `fonoteka:dev-seed` when `E2E_BACKEND=go`; gate e2e 17/0/0/0; UAT item 1 | ✓ |
+| Browse collections and albums | The collection lists albums with covers; album detail opens | UAT items 2-3 (human); `public-share`, `smoke` and `album-search` specs in the gate; covers served by the framework `/storage` mount | ✓ |
+| Search | A unique album is found | `album-search.spec.ts` (gate); UAT item 4; go.log 0 `album search engine failed` | ✓ |
+| Edit, rate, cover | Edit persists, rating persists, cover decodes | `album-edit-rate-cover.spec.ts` (`rating-stars`, `naturalWidth > 0` via `/storage/app/uploads/public/`); UAT items 5-7 | ✓ |
+| Wishlist add/remove | An entry is added on /wishlist/new and removed | `wishlist.spec.ts` (`wishlist-item-remove`); UAT item 8 | ✓ |
+| Outcome: port proven, not PHP | Every request reaches Go; failures are visible | guard (`--guard` refusals rerun), pinned `NUXT_INTERNAL_API_ORIGIN`, post-start probe through :3119; go.log 3081 `http request` records, 0 5xx | ✓ |
+
+## Goal Achievement
+
+### Roadmap success criteria
+
+| # | Success criterion | Status | Evidence |
+|---|-------------------|--------|----------|
+| SC1 | Documented local run: Nuxt and Go start together; API base URL, cookies and CORS match how the SPA talks to Winter | ✓ VERIFIED | `fonoteka.go/README.md` § "Running locally with the Nuxt app" (ports, prerequisites, Centrifugo operator step, env table, commands, logs, MCP). The SPA keeps its unchanged `nuxt.config.ts` proxy: `NUXT_DEV_BACKEND_ORIGIN` / `NUXT_INTERNAL_API_ORIGIN` = `http://127.0.0.1:8423`, the same mechanism it uses for Winter, so the browser stays same-origin on :3119 (no CORS). The JWT lives in the app's own `auth_token` cookie and the backend sets none (RESEARCH line 110/200). Info: the README never states "cookies and CORS unchanged" in so many words. |
+| SC2 | A signed-in Go session covers browse collections/albums, search, edit, rate, cover upload, wishlist add/remove | ✓ VERIFIED | Gate report `fonoteka.go/tmp/dev-stack/e2e-20261012T101126Z.json`: expected 17, unexpected 0, skipped 0, flaky 0, over all 10 D-15 gate specs, after the review fixes. Plus human UAT items 1-10, all passed (2026-10-11). |
+| SC3 | Failures against Go are visible (no silent fall-through to PHP); the local stack does not require the production origin | ✓ VERIFIED | `dev-stack.sh` `guard_origins` / `guard_marker` / `probe`. I reran `check-phase14.2.sh --guard`: php-port, internal-unset, mismatch, production, fake-php and other-marker were all refused, and the control passed. Hosts are loopback only (Go addr, backend origin, Postgres DSN). The marker route is only on Go. The opt-in access log logs method/pattern/status (see the WR-01 human item about the path). |
+| SC4 | The new glue has tests or a fail-closed check script, delivered in the last plan | ✓ VERIFIED | `summercms.go/scripts/check-phase14.2.sh` (673 lines, plan 04). I reran self-test, go, docs, parity, contracts and guard, and all passed. `--e2e` was last run by the orchestrator after the fixes (the report above). Named tests: console 5, plugin 5, surf 5, all passing. |
+
+### Plan must-have truths (50) and status
+
+| Plan | Truths | Verified | Notes |
+|------|--------|----------|-------|
+| 14.2-01 | 13 | 12 | ? #9 (access log adds `path` for unmatched requests) superseded by WR-01: path never logged. #3 and #7 ("only when local or dev") still hold literally after the WR-05 narrowing to local only. Backstop #12 (orphan blob never served) and #13 (integer `duration_ms`) have explicit evidence: `TestUploadsMount` targets `uploadsOrphanDisk` and gets a 404, and `TestAccessLog` parses `duration_ms` as a non-negative integer. |
+| 14.2-02 | 14 | 13 | ⚠️ #12 foreground Ctrl-C/TERM cleanup is PRESENT_BEHAVIOR_UNVERIFIED (traps and `cleanup()` wired; no test). The others are verified by code (`up` order, `check_services`, namespace `history` probe, loopback/8422 rules in `load_env` lines 196-197, env stripping in `start_nuxt`) and by the rerun guard stage. |
+| 14.2-03 | 10 | 10 (1 by override) | #7 PHP cross-check: PASSED (override); the developer accepted the classification. #8 no `app/` change: `git diff --name-only 984031f..HEAD -- app` is empty, and only `tests/` changed (12 files). #9 operator step: proven by behaviour, since the realtime spec (subscribe on `collection:` without 102, push received) passed with 0 skips. |
+| 14.2-04 | 13 | 10 | ? #2 and #5 ("local and dev pass the gate", marker 200 for dev) superseded by WR-05. ? #7 ("raw path without query only for an unmatched request") superseded by WR-01. The rest is verified by the reruns. |
+
+**Score:** 54/54 truths verified after human verification (previously 49/54 (4 roadmap SC plus 50 plan truths; 1 by override). 4 are UNCERTAIN (deliberate contract changes awaiting human acceptance) and 1 is present but behaviour-unverified.)
+
+### Prohibitions (must-NOT)
+
+| Prohibition | Tier | Enforcement | Disposition |
+|-------------|------|-------------|-------------|
+| Seed opens no DB / writes nothing outside local | test | `TestDevSeedRefusesProduction` (passes; now also refuses `dev`) | ✓ |
+| No manifest route response change; marker/uploads outside manifest | test | `TestParityCorpus` 175/175/0; `TestDevMarkerRoute` reads `parity/manifest.yaml` | ✓ |
+| sm-user-plugin not modified | test | none (git evidence only) | ⚠️ flagged: unverified-prohibition |
+| dev-stack.sh writes nothing in the Nuxt checkout | test | none (code plus clean `git status`) | ⚠️ flagged |
+| No fall-through to PHP/production; Nuxt only after the guard | test | `--guard` stage (rerun, passed); `up()` runs `guard` before `start_nuxt` | ✓ |
+| No read/edit/restart of the shared Centrifugo config | test | none (grep: the path appears only in warning text) | ⚠️ flagged |
+| App keeps working on PHP; no `app/` change; specs run on PHP | test | git diff (no app/), UAT item 11 accepted by the developer | ✓ (human-accepted) |
+| Specs touch only data they created | test | none (`finally` deletes, Date.now() names) | ⚠️ flagged |
+| PHP tinker path unchanged when `E2E_BACKEND` is unset | test | `e2e-backend-switch.test.mjs` 10/10; the diff of runTinker.ts/auth.setup.ts is add-only | ✓ |
+| Gate never passes on a skip | test | `--self-test` (planted skip cases), rerun, passed | ✓ |
+| Gate never downgrades a missing service or Docker to a pass | test | `--self-test` plus `set -euo pipefail`; services refused in `check_services` | ✓ |
+
+### Required Artifacts
+
+| Artifact | Status | Details |
+|----------|--------|---------|
+| `summercms.go/modules/surf/uploads.go` | ✓ VERIFIED | 171 lines; `mountUploads` is called in `BuildRouter` after the plugin route loop and before `cabana.Activate` (router.go:554); prefix validation, nosniff, CSP, attachment for non-raster types |
+| `summercms.go/modules/surf/accesslog.go` | ✓ VERIFIED | 155 lines; wraps the final handler in `compile` (router.go:382-383); `recordPattern` in `wrap` (router.go:453); `markPanicked` in the recoverers |
+| `fonoteka.go/.../console/dev_seed.go` | ✓ VERIFIED | 559 lines; env gate before any DB open; one `lagoon.Transaction` in `lighthouse.WithoutBroadcasting`; `seedSearch` last |
+| `fonoteka.go/.../console/database.go` | ✓ VERIFIED | `commandDatabase`/`commandBucket`; used by dev-seed, reindex, oauth-client, prune-notifications |
+| `fonoteka.go/.../dev_marker.go` | ✓ VERIFIED | `devMarkerRoutes`, called from routes.go:386; registered only when `DevEnvironment` is local; not in the manifest |
+| `fonoteka.go/scripts/dev-stack.sh` | ✓ VERIFIED | 845 lines; subcommands up/down/status/check/guard/exec/e2e/e2e-verdict/fresh/redact-seed |
+| `fonoteka.go/.env.dev.example` | ✓ VERIFIED | placeholders only (checked); `.gitignore` has `/.env.dev` and `/storage/app/uploads/public/` |
+| `fonoteka.go/README.md` run docs | ✓ VERIFIED | § Running locally with the Nuxt app |
+| `vue-fonoteka-app/tests/e2e/helpers/runTinker.ts` | ✓ VERIFIED | `E2E_BACKEND=go` branch; PHP path add-only |
+| `vue-fonoteka-app/tests/e2e/{album-edit-rate-cover,album-search,wishlist,realtime}.spec.ts` | ✓ VERIFIED | contain the planned test IDs; conditional `test.skip` guards turn into gate failures through `e2e-verdict` (skipped must be 0) |
+| `vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs` | ✓ VERIFIED | 10/10 (rerun) |
+| `summercms.go/scripts/check-phase14.2.sh` | ✓ VERIFIED | all stages present; 6 of 7 rerun green here |
+| Phase unit tests (dev_seed_test, dev_stack_test, dev_marker_test, uploads_test, accesslog_test) | ✓ VERIFIED | all named tests pass (rerun) |
+
+### Key Link Verification
+
+| From | To | Via | Status |
+|------|----|-----|--------|
+| surf/router.go | uploads.go | `mountUploads(r, app)` after the routes, before cabana | WIRED |
+| surf/router.go | accesslog.go | `accessLog` in `compile`, `recordPattern` in `wrap` | WIRED |
+| fonoteka plugin.go | console/dev_seed.go | `console.DevSeedCommand(p.app)` (plugin.go:298) | WIRED |
+| dev_seed.go | classes StoreAlbumPhoto / CreateAlbum | inside the seed transaction | WIRED |
+| reindex/oauth_client/prune_notifications | console/database.go | `commandDatabase` | WIRED |
+| routes.go | dev_marker.go | `p.devMarkerRoutes(r)` | WIRED |
+| dev-stack.sh | marker | `MARKER_PATH`, used in guard, `wait_for_marker`, probe | WIRED |
+| dev-stack.sh | dev-seed | `bin/fonoteka fonoteka:dev-seed` → `seed.out` (mode 600) → probe cover URL | WIRED |
+| dev-stack.sh | nuxt.config.ts | `NUXT_DEV_BACKEND_ORIGIN` / `NUXT_INTERNAL_API_ORIGIN` env on `pnpm dev` | WIRED |
+| runTinker.ts | dev-seed | `execFileSync(E2E_GO_BIN, ['fonoteka:dev-seed'])` (contract test) | WIRED |
+| check-phase14.2.sh | dev-stack.sh | guard/up/fresh/e2e/e2e-verdict | WIRED |
+
+### Data-Flow Trace (Level 4)
+
+| Artifact | Data | Source | Real data | Status |
+|----------|------|--------|-----------|--------|
+| Uploads route | cover bytes | published `*blob.Bucket` + `system_files` row via `attach.StaticHandlerPublic` | yes (cover decodes in the e2e run; the probe requires image/png) | ✓ FLOWING |
+| Marker | `{backend,app,env}` | marshalled at registration from `DevEnvironment` | static by design (a marker, not data) | ✓ (intended) |
+| Access log | method/pattern/status/duration | request plus `statusRecorder` | yes (go.log 3081 records) | ✓ FLOWING |
+
+### Behavioral Spot-Checks (run by the verifier)
+
+| Behavior | Command | Result | Status |
+|----------|---------|--------|--------|
+| Gate self-test | `bash scripts/check-phase14.2.sh --self-test` | `phase14.2 self-test passed` | ✓ PASS |
+| Guard refusals | `bash scripts/check-phase14.2.sh --guard` | 6 refusals with the correct reasons, control passed | ✓ PASS |
+| vet + full Go suites + named tests | `bash scripts/check-phase14.2.sh --go` | `phase14.2 go passed`, exit 0, 0 FAIL lines | ✓ PASS |
+| Docs | `--docs` | `phase14.2 docs passed` | ✓ PASS |
+| Parity | `--parity` | `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0` | ✓ PASS |
+| Contracts | `--contracts` | blocking 10/10; report-only 288/289 (pre-existing `missing-catalog`) | ✓ PASS |
+| Surf named tests | `go test ./modules/surf -run 'TestUploadsMount\|TestUploadsResponseHeaders\|TestAccessLog'` | 5 PASS | ✓ PASS |
+| Seed/command/marker tests | `go test ./console -run 'TestDevSeed\|TestReindexCommand'`; `go test . -run 'TestDevStackSmoke\|…\|TestDevMarkerRoute'` | 10 PASS | ✓ PASS |
+| Go-gate Playwright subset | `--e2e` | not rerun: the auto-mode classifier denied any interaction with the running stack (status/curl). The latest gate report `e2e-20261012T101126Z.json` is 17/0/0/0, newer than the last Go commit and the build stamp; go.log 0 5xx, 0 search failures; `seed.out` mode 600 | ? recorded evidence |
+
+### Probe Execution
+
+No `scripts/*/tests/probe-*.sh` are declared or present for this phase. The phase gate script stands in for a probe and was run as above.
+
+### Requirements Coverage
+
+| Requirement | Source Plan | Description | Status | Evidence |
+|-------------|-------------|-------------|--------|----------|
+| QA-05 | 14.2-01..04 | Cutover: parity green and vue-fonoteka-app / fonoteka-mcp run unchanged against Go | ✓ SATISFIED (this phase's share) | vue-fonoteka-app runs against Go with no `app/` change; parity 175/175. The fonoteka-mcp leg is documented (token minted, README § MCP) but not exercised here. Full cutover is Phase 20. |
+
+Info: REQUIREMENTS.md traceability maps QA-05 to "Phase 15 / Complete", while ROADMAP maps it to 14.2 and 20. The traceability row is stale.
+
+### Decision Coverage
+
+`check.decision-coverage-verify`: 23/23 CONTEXT decisions honored by the substring heuristic. Two decisions were drifted by the review fixes and are not caught by the heuristic: D-02 ("local/dev") is now local only (WR-05), and D-12 ("records each request's path and status") now records the pattern only, never the path (WR-01). Both are raised as human items.
+
+### Anti-Patterns Found
+
+| File | Line | Pattern | Severity | Impact |
+|------|------|---------|----------|--------|
+| (phase files) | none | TBD/FIXME/XXX/TODO | none | no debt markers in any phase file |
+| `modules/surf/uploads_test.go` | helper | `t.Skip` under `-short` only | ℹ️ Info | CLAUDE.md requires it; the gate never runs `-short` and the detector refuses skips |
+| e2e specs | `test.skip(...)` guards | conditional skips | ℹ️ Info | turned into failures by `e2e-verdict` (skipped must be 0) |
+| `fonoteka.go/scripts/dev-stack.sh` | 369 | marker check ignores `.app` (IN-06) | ℹ️ Info | any SummerCMS app on the port passes the guard; this is not a PHP fall-through |
+| `fonoteka.go/scripts/dev-stack.sh` | 215-241 | Postgres loopback check bypassable via `hostaddr`/query `host` (IN-02) | ℹ️ Info | weakens the "local DB only" refusal; open advisory |
+| `summercms.go/scripts/check-phase14.2.sh` | 51 | hard-coded developer path default (IN-09) | ℹ️ Info | open advisory |
+
+The 11 open review Info findings (IN-01..IN-11) are advisory. None is a blocker.
+
+### Human Verification Required
+
+#### 1. Accept the WR-05 narrowing (`dev` refused)
+**Test:** Decide whether `SUMMER_ENV=dev` should stay refused by `fonoteka:dev-seed`, the `_dev/backend` marker and `dev-stack.sh`.
+**Expected:** Override recorded, or D-02 updated to "local only".
+**Why human:** This changes a locked decision. Plan-04 truths 2 and 5 as written are now false; the tests assert the new rule.
+
+#### 2. Accept the WR-01 narrowing (no path in the request log)
+**Test:** Decide whether the Go request log may omit the path of unmatched requests.
+**Expected:** Override recorded, or D-12 updated. An unported route shows as `status=404 pattern=""`, and the path comes from the browser devtools.
+**Why human:** This trades away the D-12 diagnostic for token privacy. Plan-01 truth 9 and plan-04 truth 7 as written are now false.
+
+#### 3. Foreground `up` cleanup
+**Test:** `scripts/dev-stack.sh up` (foreground), then Ctrl-C; repeat with TERM.
+**Expected:** Both process groups stop, `tmp/dev-stack/pids` is removed, and the exit code is 130/143.
+**Why human:** This cleanup invariant is wired but not exercised by any test.
+
+#### 4. Four statically enforced test-tier prohibitions
+**Test:** Review the evidence listed in the frontmatter (sm-user-plugin untouched, no writes to the Nuxt checkout, no Centrifugo config access, specs delete only their own data).
+**Expected:** The developer confirms each, or asks for a gate check.
+**Why human:** Declared `verification: test` but no test enforces them, so they cannot be green on code reading alone.
+
+### Suggested overrides (if items 1 and 2 are accepted)
+
+```yaml
+overrides:
+  - must_have: "TestDevSeedRefusesProduction proves local and dev pass the gate; TestDevMarkerRoute answers 200 for local and dev"
+    reason: "WR-05: dev is a common name for a shared server; seed, marker and dev-stack.sh accept local only"
+    accepted_by: "<developer>"
+    accepted_at: "<ISO timestamp>"
+  - must_have: "http.access_log adds path without its query string only for unmatched requests"
+    reason: "WR-01: share and invitation tokens travel in paths; the log records method, pattern, status and duration only"
+    accepted_by: "<developer>"
+    accepted_at: "<ISO timestamp>"
+```
+
+### Gaps Summary
+
+No blocking gaps. The local stack, the fail-closed guard, the seed, the framework uploads mount and request log, the Nuxt seed switch, the self-seeding specs and the phase gate all exist, are substantive and wired. Each is backed by passing tests that I reran (except `--e2e`, which is backed by the post-fix gate report), plus an approved manual UAT. The status is `human_needed` rather than `passed` because two review fixes changed locked decisions (D-02, D-12) without a recorded acceptance, one cleanup invariant has no test, and four test-tier prohibitions have only static evidence.
+
+Further notes, none of them gaps:
+- `covered_files` lists only summercms.go-root files; the fonoteka.go and vue-fonoteka-app files escape the project root and cannot be fingerprinted.
+- `14.2-VALIDATION.md` is still `draft` / `nyquist_compliant: false`, left for `/msd-validate-phase 14.2`.
+- The PHP repo's `vue-fonoteka-app` submodule pointer is not bumped (`M vue-fonoteka-app` in `/media/nvme/dev/golem15/fonoteka`); that is the user's call.
+- Deferred to Phase 20 or follow-ups (deferred-items.md): fileblob cross-device TMPDIR, Vite cold start before the first e2e, the `PNG_1PX` fixture for PHP GD, the local PHP Centrifugo config, and the framework `lagoon.Validate` empty-pointer gap.
+
+---
+
+_Verified: 2026-10-12T10:41:00Z_
+_Verifier: Claude (msd-verifier)_

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/deferred-items.md

@@ -0,0 +1,22 @@
+# Phase 14.2 deferred items
+
+## From plan 14.2-02
+
+- **File bucket fails across devices (affects Phase 20 cutover).** With the real `config/storage.yaml` (`file://./storage/app/uploads/public`), gocloud `fileblob` writes each upload to a temporary file in `os.TempDir()` and renames it into the bucket. When `/tmp` is a tmpfs (this machine) the rename fails with `invalid cross-device link`, so `fonoteka:dev-seed` (and any cover upload) fails. `dev-stack.sh` works around it by running the Go processes with `TMPDIR=tmp/dev-stack/go-tmp`. A deployment fix belongs to the framework or the app config (fileblob `no_tmp_dir` URL option, or a TMPDIR on the storage device) and should be decided before cutover. TestDevStackSmoke did not catch it because its bucket lives in the test's temp directory.
+- **GORM "record not found" log noise in `fonoteka:dev-seed`.** `classes/active_collection.go:243` logs the first, expected lookup miss through GORM's default logger in colour on stderr. Cosmetic; out of scope.
+
+## From plan 14.2-03
+
+- **vue-fonoteka-app contract test fails on HEAD before this plan.** `tests/contracts/missing-catalog.test.mjs` ("Album DTO carries label, catalog_number and country without any") matches `\bany\b` against the Album type and trips on the comment "the cheapest current listing in any condition" added by vue-fonoteka-app `984031f` (feat(e5o)). `pnpm test:contracts`: 278 pass, 1 fail. It is an `app/` type comment, which this phase must not change (D-20).
+- **lagoon.Validate treats a pointer to "" as a value.** `isEmptyValue` returns false for a non-nil `*string` holding "", so a `nullable|in:` model rule fails where Laravel skips every non-implicit rule for an empty string. fonoteka works around it in `albumRuleValues` (fonoteka.go `7675d64`). A framework fix (dereference pointers, or apply Laravel's empty-string skip) would cover other models; it changes `required` semantics for `*string` too, so it needs its own change.
+- **`tmp/dev-stack/go.log` is appended across `up` runs.** A `grep -c 'status=5..'` over the whole file counts requests from earlier runs. The four 500s from before the empty-format fix were in it until the log was rotated before the Task 4 session; the session log is kept as `go.log.uat-session-20261011`. `up` could truncate or rotate the log.
+- **Orphan artist rows in the Go dev database.** The specs delete the albums they create, but the artists created with them (`E2E Artist`) stay in `fonoteka_go_dev`. Whether PHP removes orphan artists on album delete was not checked.
+- **Realtime self-echo guard hides same-user cross-tab edits.** `useRealtimeSync.ts` skips the refresh when `payload.actor.user_id` is the session user, so an edit in a second tab of the same user never refreshes the first tab (PHP and Go alike, UAT finding C). This is frontend design (`app/`, out of scope for D-20); worth a product decision if same-user multi-tab sync is wanted.
+- **`PNG_1PX` fixture is not decodable by PHP GD.** `album-edit-rate-cover.spec.ts` uploads a hand-built 1x1 PNG. PHP's Winter resizer fails on it (`imagealphablending(): Argument #1 must be of type GdImage, false given`, `Resizer.php:139`) and answers 500, while Go accepts it. Real photos work on PHP. Follow-up: use a GD-decodable fixture (for example an 8x8 PNG encoded with a standard encoder) so the spec passes on both backends.
+- **Local PHP env has no Centrifugo config.** On PHP, the live `realtime.spec.ts` test opens no socket (`Centrifugo: Skipping publish (not configured)`). The PHP side of that test needs the Centrifugo settings in the PHP app's local env.
+
+## From plan 14.2-04
+
+- **The first Playwright run after a fresh `dev-stack.sh up` can fail on Vite's cold start.** Right after `up` restarted Nuxt, `auth.setup.ts` got Nuxt's 500 page "Failed to fetch dynamically imported module: http://localhost:3119/_nuxt/layouts/public.vue" (Vite re-optimising dependencies on the first browser load), so the 16 dependent tests were skipped and `e2e-verdict` refused the run, as it should. The same specs passed 17/0/0/0 on the next run against the warm server. `up`'s probe fetches the marker, a 401 and a cover through Nuxt, never a page, so it does not warm the client bundle. Options: let `up` load one page in a headless browser, or pin Vite's `optimizeDeps` in the Nuxt dev config. The gate does not retry (a retry would hide real flakiness).
+- **TMPDIR inside a go.work tree breaks the framework tests.** With `TMPDIR=fonoteka.go/tmp/dev-stack/go-tmp`, the scaffold tests in `summercms.go/internal/build` ran `go work` inside fonoteka.go's workspace and added a `use` line to `fonoteka.go/go.work` (reverted), and `go test ./...` in fonoteka.go picked up the build directories as packages. `check-phase14.2.sh` leaves TMPDIR to the caller; `dev-stack.sh` already gives its Go processes and Playwright the on-device TMPDIR they need. Tests that scaffold could set `GOWORK=off` or check that their temp directory is outside any workspace.
+- **`go test ./...` at the fonoteka.go root covers only the root module.** The workspace's plugin modules (fonoteka, user, golem, feedback) are separate modules; `./...` from the root does not reach them. The gate runs the fonoteka plugin module separately (`go -C plugins/golem15/fonoteka test ./...`); the user, golem and feedback submodules are not part of this phase's gate.

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md

@@ -0,0 +1,54 @@
+---
+status: complete
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+source: [16.1-VERIFICATION.md]
+started: 2026-10-10T00:00:00Z
+updated: 2026-10-10T01:00:00Z
+---
+
+## Current Test
+
+[testing complete]
+
+## Tests
+
+### 1. Install the hardened staging vhost on UAT (root)
+expected: Security headers present exactly once on public pages, /gfadmin unchanged in access, `nginx -t` passes
+result: pass
+evidence: |
+  2026-10-09 23:05 UTC via debian@ sudo. Backup /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl.bak-20261009T230555Z;
+  installed sha256 bce4d7f9…bd7c; `nginx -t` ok; reloaded. curl: /, a post, /_journal, a /storage 404 and /gfadmin each carry
+  HSTS, nosniff, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy and CSP-Report-Only exactly once; /gfadmin keeps its
+  enforced CSP and Referrer-Policy same-origin, answers 200 without basic auth, locale cookie Secure; public paths still 401
+  off-server. On-server smoke (loopback): smoke: ok (98 urls); 200 pages show all six headers. Winter vhost untouched.
+
+### 2. Posts list search on UAT
+expected: Searching "cordyceps" at https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts returns rows (no "The list could not be loaded")
+result: pass
+evidence: user confirmed on UAT 2026-10-10 ("Confirmed")
+
+### 3. List state round trip on UAT (D-01, v0.1.17 build)
+expected: Sort plus a category filter survive opening a post and back, "Zapisz i zamknij", and leaving via the plugin rail; the URL carries them; a pasted URL in a new tab shows the same list; after logout and login the list opens unfiltered; signing in as a different admin on the same browser shows no earlier admin's search
+result: pass
+evidence: user confirmed all three sub-checks on UAT 2026-10-10 (sort/filter survive navigation; URL round trip; cleared after logout)
+
+### 4. Post form locales and fields on UAT (D-03)
+expected: An imported post's form shows pl first with title, slug, content and excerpt filled
+result: pass
+evidence: user confirmed on UAT 2026-10-10
+
+### 5. Review the prohibition verdicts
+expected: The nine prohibition verdicts in 16.1-VERIFICATION.md (all "not violated") are acceptable
+result: pass
+evidence: user reviewed the nine verdicts and replied "approved" 2026-10-10 (notes: #6 UAT vhost installed, Winter vhost untouched; #3 translated content_html derived from content when both are sent, shapes unchanged)
+
+## Summary
+
+total: 5
+passed: 5
+issues: 0
+pending: 0
+skipped: 0
+blocked: 0
+
+## Gaps

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VALIDATION.md

@@ -53,8 +53,8 @@ Pre-existing red, not caused by this phase: `scripts/check-phase10.sh --hygiene`
 | 16.1-02-02 | 02 | 2 | D-04 | T-16.1-07, T-16.1-08 | Uploaded binary sha256 equals the local build; previous binary kept as `.prev`; no `.env` rsynced | e2e (server) | on-server `scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl` via loopback resolve | ✅ | ✅ green (plan 02: smoke: ok (98 urls), sha256 match) |
 | 16.1-02-03 | 02 | 2 | D-02, D-03 | T-16.1-09, T-16.1-10 | Read-only SQL and log checks; only posts 53 and 64 are re-saved, by a human | integration (server, read-only) | `ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc ..."` (raw-HTML marker count 0, post 64 footer present) | ✅ | ✅ green (plan 02: SQL check 0:1, no SQLSTATE 42703 since restart) |
 | 16.1-03-01 | 03 | 3 | D-01 | T-16.1-11 | Storage helpers survive disabled storage; logout clears list keys only | unit (vitest) | `npm --prefix admin test -- tests/state/listState.test.ts tests/state/useAuth.test.ts tests/list/ListView.test.ts tests/form/FormView.test.ts` | ✅ created (plan 03) | ✅ green |
-| 16.1-03-02 | 03 | 3 | D-02, D-03 | T-16.1-11, T-16.1-12 | Polymorphic relations and unknown columns refused (422); search value never inlined into SQL | unit (DryRun) + Postgres (Docker host) | `go test -count=1 -run '^(TestListRelationSQL\|TestEnabledLocalesDefaultFirst)$' -v ./modules/cabana` | ✅ extend files from plan 01 | ✅ green (pure); Postgres test on a Docker host: manual |
-| 16.1-03-03 | 03 | 3 | D-03 | T-16.1-02, T-16.1-11 | Every unsafe case is sanitized (bluemonday, post-review CR-01 fix), scheme-like text and raw HTML survive, CheckHTML refuses unsafe category HTML | unit + journal harness (Docker host) | `go -C ../sm-journal-plugin test -count=1 -run '^(TestFormatHTMLSanitizesUnsafeHTML\|TestFormatHTMLKeepsSchemeLikeText\|TestFormatHTMLKeepsRawHTML\|TestCheckHTML)$' -v ./classes/` (four top-level PASS lines) | ✅ extend | ✅ green (pure); harness re-save test on a Docker host: manual |
+| 16.1-03-02 | 03 | 3 | D-02, D-03 | T-16.1-11, T-16.1-12 | Polymorphic relations and unknown columns refused (422); search value never inlined into SQL | unit (DryRun) + Postgres (Docker host) | `go test -count=1 -run '^(TestListRelationSQL\|TestEnabledLocalesDefaultFirst)$' -v ./modules/cabana` | ✅ extend files from plan 01 | ✅ green (pure); ✅ Postgres green on Docker 2026-10-09/10 |
+| 16.1-03-03 | 03 | 3 | D-03 | T-16.1-02, T-16.1-11 | Every unsafe case is sanitized (bluemonday, post-review CR-01 fix), scheme-like text and raw HTML survive, CheckHTML refuses unsafe category HTML | unit + journal harness (Docker host) | `go -C ../sm-journal-plugin test -count=1 -run '^(TestFormatHTMLSanitizesUnsafeHTML\|TestFormatHTMLKeepsSchemeLikeText\|TestFormatHTMLKeepsRawHTML\|TestCheckHTML)$' -v ./classes/` (four top-level PASS lines) | ✅ extend | ✅ green (pure); ✅ harness re-save green on Docker 2026-10-09/10 |
 
 *Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
 
@@ -94,7 +94,7 @@ Pre-existing red, not caused by this phase: `scripts/check-phase10.sh --hygiene`
 
 - Quick Go commands: four top-level `--- PASS` lines for `TestListRelationSearchSmoke`, `TestListRelationSQL`, `TestEnabledLocalesDefaultFirst` and `TestEnabledLocalesDefaultFirstSmoke`; `go -C ../sm-journal-plugin test -count=1 ./classes/` ok, with four top-level `--- PASS` lines for `TestFormatHTMLSanitizesUnsafeHTML`, `TestFormatHTMLKeepsSchemeLikeText`, `TestFormatHTMLKeepsRawHTML` and `TestCheckHTML` (updated 2026-10-10 after the CR-01 fix replaced `TestFormatHTMLRejectsUnsafeHTML`).
 - Full local suite: `go vet ./...`, `go -C ../sm-journal-plugin vet ./...`, `TestDocsTree`, `npm --prefix admin run typecheck`, `npm --prefix admin test` (76 files, 1144 tests) and `scripts/check-admin-dist.sh` ("dist matches a fresh build") printed `phase-16.1-local-gate-ok`.
-- Docker-host suites: still pending (manual row above). `TestListRelationSearchPostgres` and `TestPostsAdminResaveKeepsHTML` fail here with "failed to create Docker provider", as designed (fail, not skip).
+- Docker-host suites: still pending at plan 03 time (`TestListRelationSearchPostgres` and `TestPostsAdminResaveKeepsHTML` failed with "failed to create Docker provider", as designed). **Update 2026-10-10:** after the golem user joined the docker group, the full `go test -count=1 ./...` passed with Docker in summercms.go (37 packages, before and after cd25af0, and again for the v0.1.17 release) and in sm-journal-plugin, including `TestListQueryContract`, `TestListRelationSearchPostgres`, `TestPostsAdminResaveKeepsHTML` and the translation harness tests; the verifier re-ran them.
 - Manual UAT rows: the plan 02 executor confirmed posts 53 and 64 by read-only SQL. The list-state, form-locale and search checks were reported by the human before the re-saves reached UAT, so they stay open for `/msd-verify-work`.
 
-**Approval:** pending (Docker-host suites and the manual UAT rows)
+**Approval:** pending (manual UAT rows only; Docker-host suites green 2026-10-10)

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-VERIFICATION.md

@@ -0,0 +1,274 @@
+---
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+verified: 2026-10-09T23:05:00Z
+status: passed
+score: 32/33 must-haves verified
+covered_files:
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-PLAN.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-01-SUMMARY.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-PLAN.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-02-SUMMARY.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-03-PLAN.md
+  - .planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-03-SUMMARY.md
+  - admin/src/main.ts
+  - admin/src/state/listState.ts
+  - admin/src/state/useAuth.ts
+  - admin/src/state/useSidebar.ts
+  - admin/src/views/ListView.vue
+  - admin/tests/form/FormView.test.ts
+  - admin/tests/list/ListView.test.ts
+  - admin/tests/smoke/list.smoke.test.ts
+  - admin/tests/state/listState.test.ts
+  - admin/tests/state/useAuth.test.ts
+  - docs/backend/forms.md
+  - docs/backend/lists-and-filters.md
+  - modules/cabana/README.md
+  - modules/cabana/http.go
+  - modules/cabana/locale_order_test.go
+  - modules/cabana/query.go
+  - modules/cabana/query_relation_test.go
+  - modules/phrasebook/backend/lang/en/lang.yaml
+  - modules/phrasebook/backend/lang/pl/lang.yaml
+  - scripts/check-phase10.sh
+covered_digest: "v2:sha256:7e043180d992853a3d04039e3304ee81d631fc8574eeec0e96264b3b6ad7873d"
+behavior_unverified: 0
+overrides_applied: 0
+human_verification:
+  - test: "Install the hardened staging vhost as root: copy /srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf (host commits fc10094, 387d0f4) over /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl, run sudo nginx -t, reload nginx, and compare sha256 of the installed and uploaded copies"
+    expected: "nginx -t passes; curl -sI https://uat.grzybyfunkcjonalne.pl/ (on the server, resolved to loopback) shows Content-Security-Policy-Report-Only, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy; /gfadmin keeps its auth_basic exemption; smoke.sh --url still ends 'smoke: ok ('"
+    why_human: "Needs root on the UAT server. Read-only check on 2026-10-09 23:00 UTC: the uploaded file has the CSP Report-Only header (count 1), the enabled vhost does not (count 0)"
+  - test: "UAT posts list search: in /gfadmin/golem15/journal/posts search 'cordyceps' (a category name)"
+    expected: "Rows appear; no 'The list could not be loaded.'; the Go log shows no SQLSTATE 42703 after 2026/10/09 22:47:29"
+    why_human: "Needs UAT basic auth and an admin login. Automated proof covers the SQL on real Postgres (TestListRelationSearchPostgres) and a clean log since the restart, but the Go log does not record successful searches, so it cannot show that a search ran on the real categories pivot"
+  - test: "UAT list state (D-01): set a sort and a category filter, open a post, press back; repeat with save-and-close; leave through the navigation rail and return; paste the URL in a new tab; log out and in"
+    expected: "Sort and filter survive every return and are in the URL; the pasted URL shows the same list; after logout and login the list opens unfiltered"
+    why_human: "Interactive flow behind UAT basic auth; the human report ('all works') predates the re-saves and the v0.1.17 deploy (which changed the storage key to be per admin), so it is not independent confirmation of the deployed build"
+  - test: "UAT post form (D-03): open any imported post"
+    expected: "The locale selector shows pl first; title, slug, content and excerpt are filled with the stored values"
+    why_human: "Visual check on real data. Supporting evidence: the UAT locales table has en at sort_order 1 and the default pl at sort_order 2, the exact order the fix reorders, and enabledContentLocales is covered by 12 unit cases"
+  - test: "Review the nine judgment-tier prohibitions in the Prohibitions section below"
+    expected: "Each LLM-judge verdict (all 'not violated') is accepted or overturned"
+    why_human: "unverified-prohibition: judgment tier, the verifier's verdict is non-authoritative"
+---
+
+# Phase 16.1: Journal admin urgent fixes Verification Report
+
+**Phase Goal:** The Journal posts list and post form in the admin work on real imported data found on UAT. The fixes are released as a summercms tag, the host is bumped, UAT is redeployed and the staging smoke re-runs.
+**Verified:** 2026-10-09T23:05:00Z
+**Status:** human_needed
+**Re-verification:** No, initial verification
+
+All code, tests, tags, pushes and the deployed binary were checked against the repositories and the UAT server (read-only). Every automated must-have holds. What remains: the nginx vhost install, which needs root, and the browser checks on UAT that only a human can run.
+
+## Goal Achievement
+
+### Observable Truths
+
+**Roadmap contract (success criteria derived from the goal)**
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 1 | List search no longer fails with "Server error" on a belongsToMany relation | ✓ VERIFIED | `modules/cabana/query.go:369-449` builds `EXISTS (SELECT 1 FROM pivot AS cabana_p0 JOIN related AS cabana_r0 ...)` from `stmt.Schema.Relationships.Relations[field]`. `TestListRelationSearchPostgres` passed against real Postgres (run here through the Docker sudo path). The UAT Go log has 0 `SQLSTATE 42703` lines in the 32 lines since the 22:47:29 restart. |
+| 2 | List sort and filters are remembered after opening a record and going back | ✓ VERIFIED | `ListView.vue:200-221` restores the stored query before the first request. `FormView.test.ts` "returning to the list keeps its query (D-01)" covers back, cancel, save-and-close and delete. 4 files / 144 tests pass; the full suite has 76 files / 1171 tests. |
+| 3 | The post form shows the stored content | ✓ VERIFIED (code) | `http.go:986-993` moves `DefaultLocale` to index 0. `TestEnabledLocalesDefaultFirst` (12 cases) passes. The UAT `golem15_translate_locales` table has `en` at sort 1 and the default `pl` at sort 2, which confirms the root cause the fix targets. The on-UAT visual check is a human item. |
+| 4 | The post form shows the stored excerpt | ✓ VERIFIED (code) | Same mechanism as #3: the excerpt lives in the host column, under the default locale. |
+| 5 | Released as a summercms tag | ✓ VERIFIED | `git ls-remote`: v0.1.16 is d8e3536 on d77393b; v0.1.17 is c37de45 on c21fe36. v0.1.17 contains 06d75cb, bd8626e, 9cac45c, a8bce9c, 837922c and cd25af0. |
+| 6 | Host is bumped | ✓ VERIFIED | Host HEAD 0b93ac2 equals origin/master. The journal gitlink is c60abc6, equal to sm-journal-plugin origin/main. The translate gitlink is 54cf93b, the vue app gitlink is ada03b2, and go.mod requires summercms v0.1.17. |
+| 7 | UAT is redeployed | ✓ VERIFIED | Server sha256 is `e5b0ad28…3af232` and `.prev` is `e1ba3587…148ceb` (the CR-01 hotfix). The Go and Nuxt processes started at 22:47:28 and 22:47:32 UTC. |
+| 8 | The staging smoke re-runs | ✓ VERIFIED | I re-ran it on the server myself (loopback resolve, GETs only): `smoke: ok (98 urls)` |
+
+**16.1-01 must_haves**
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 9 | belongsToMany search goes through EXISTS, with names taken from GORM's parsed relationship | ✓ VERIFIED | `relationSubquery` uses `gorm.Statement.Parse` and `Relationships.Relations`. TestListRelationSQL covers custom `joinForeignKey`/`joinReferences` pivot names. |
+| 10 | hasMany, hasOne and belongsTo searches are correlated EXISTS; there is no outer JOIN, so a record is counted once | ✓ VERIFIED | `applyListSearch` (query.go:476-490). TestListRelationSQL checks there is no JOIN outside the subqueries next to `user_id = 7` and `id IN (3)`. The Postgres test gives total 1 for a post matching through 2 tags. |
+| 11 | A to-many sort uses `string_agg` plus the PK tiebreak; a to-one sort keeps the join | ✓ VERIFIED | query.go:313-336; TestListRelationSQL covers both directions; the Postgres test gives [2 1] and [1 2] |
+| 12 | Polymorphic relations and unknown columns give 422, never 500 | ✓ VERIFIED | query.go:378-390 refuses via `rel.Polymorphic` and `PrimaryValue`; TestListRelationSQL has 5 refusal cases |
+| 13 | meta.enabledLocales lists the default locale first | ✓ VERIFIED | http.go:986-993, TestEnabledLocalesDefaultFirst(Smoke) |
+| 14 | FormatHTML keeps imported raw HTML and dangerous markup is not stored on any write path | ✓ VERIFIED (superseded mechanism) | The plan's "refuses" became "strips" under the accepted decision note `notes/journal-html-sanitizing-bluemonday.md`, the CR-01 fix in a3551f2, which is stronger than the planned regex gate. All three write paths call FormatHTML: posts.go:213, import_posts.go:185, posts_helpers.go:511/567. Translations go through FormatTranslation (0d00ec8). Duplicate attributes are handled in 5f47083. TestFormatHTMLKeepsRawHTML and TestFormatHTMLSanitizesUnsafeHTML pass. |
+| 15 | List params stay in the URL; stored per list; an empty query is never stored | ✓ VERIFIED | `listState.ts`. The key is now `summer-admin.list:<adminId>:<controller>` (the WR-03 fix in cd25af0 is stricter than the plan's key). `writeListState` removes the key on an empty query. |
+| 16 | Entry without params restores before the first request; URL params win; logout removes every stored query | ✓ VERIFIED | ListView.vue watch; `clearUser()` calls `setListStateOwner(null)`, which removes all list keys. `main.ts:27` sends `onUnauthorized` to `expireSession`. Covered by vitest. |
+| 17 | Commits staged by path, holding only this plan's files; the journal commit in its own repo | ✓ VERIFIED | `git show --name-only` for 06d75cb, bd8626e and 9cac45c matches the plan. The one extra file in 9cac45c (`list.smoke.test.ts`) is a documented deviation. 528d2d8 is in sm-journal-plugin. |
+| 18 | go vet clean; smoke tests, vitest, TestDocsTree and the dist check green | ✓ VERIFIED | Re-run here: `go vet ./...` ok, both repos' vet ok, TestDocsTree ok, `check-admin-dist.sh` printed "matches a fresh build", vitest 1171/1171 |
+
+**16.1-02 must_haves**
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 19 | An annotated tag containing every 16.1-01 commit is on origin | ✓ VERIFIED | v0.1.16 and v0.1.17 are both on origin (see #5) |
+| 20 | sm-journal-plugin main with the require is on origin; the host gitlink points at it; README and DEPLOY.md lost the re-save warning | ✓ VERIFIED | c60abc6 equals origin/main and requires v0.1.17. Host gitlink c60abc6. `grep -ci 'omitted\|re-sav'` gives 0 in both README.md and DEPLOY.md. |
+| 21 | UAT runs the build; sha256 matches; both programs run; `.prev` kept; smoke ok | ✓ VERIFIED | See #7 and #8. I could not compare against the local build byte for byte; the server hash matches the release record. |
+| 22 | After the restart, no SQLSTATE 42703 (and search returns rows) | ✓ VERIFIED (log + Postgres test) | 0 in 32 lines since 22:47:29. The human search on UAT is a human item. |
+| 23 | Posts 53 and 64 repaired: no placeholder, post 64 has its footer | ✓ VERIFIED | Read-only psql now prints `0:1`. The public page `/blog/ekstrakt-z-turkey-tail` renders `<footer class="author-footer" itemscope="" ...>`, and the footer CSS is in `entry.Djv1o0WC.css`. |
+| 24 | D-01 and D-03 checked on UAT by a human (end-of-phase check) | ? UNCERTAIN (human) | The human's report predates the re-saves and the v0.1.17 deploy, so it does not count as confirmation. Routed to Human Verification. |
+
+**16.1-03 must_haves**
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 25 | Every piece of 16.1 code has unit tests | ✓ VERIFIED | listState.test.ts, ListView/FormView/useAuth tests, TestListRelationSQL, TestEnabledLocalesDefaultFirst, FormatHTML tests, all passing |
+| 26 | Form back, cancel, save-and-close and delete land with the stored query, and the first request carries it | ✓ VERIFIED | FormView.test.ts D-01 block passes |
+| 27 | ListView entry logic: restore, URL wins, cleared controls, same-list navigation, 422, page clamp | ✓ VERIFIED | ListView.test.ts "list state entry logic (D-01)" passes. cd25af0 adds recovery from any failed restore (WR-02). |
+| 28 | listState helpers: prefix, malformed values dropped, empty query not stored, throwing storage, clear keeps the sidebar key | ✓ VERIFIED | listState.test.ts passes |
+| 29 | DryRun SQL matrix (custom pivot keys, self-reference, soft delete, polymorphic, bound and LIKE-escaped values, no outer JOIN, sorts) | ✓ VERIFIED | `--- PASS: TestListRelationSQL` |
+| 30 | enabledContentLocales cases | ✓ VERIFIED | `--- PASS: TestEnabledLocalesDefaultFirst` |
+| 31 | FormatHTML tests: imported HTML round-trips; no unsafe case survives | ✓ VERIFIED (superseded mechanism) | "Every unsafe case returns an error" became "every unsafe case is stripped" per the bluemonday decision. TestFormatHTMLSanitizesUnsafeHTML, TestFormatHTMLDuplicateAttributes, TestCheckHTML and TestFormatTranslation pass. |
+| 32 | Postgres tests exist and pass on a Docker host | ✓ VERIFIED | Re-run here: TestListRelationSearchPostgres, TestListQueryContract, TestPostsAdminResaveKeepsHTML, TestJournalAPITranslatedContentHTML and TestJournalImportTranslatedContentHTML all PASS |
+| 33 | vet, vitest, TestDocsTree and dist green | ✓ VERIFIED | See #18 |
+
+**Score:** 32/33 truths verified (0 present-but-behavior-unverified; 1 uncertain, routed to a human)
+
+### CONTEXT decisions accounted for
+
+| Decision | Status | Where |
+|----------|--------|-------|
+| D-01 list state in the URL and localStorage, no server storage | ✓ | #2, #15, #16, #26-28; no migration, route or OpenAPI diff in 3ca6a0d..cd25af0 |
+| D-02 framework-level relation-search fix in cabana | ✓ | #1, #9-12, #17 |
+| D-03 content and excerpt shown without loss; re-save keeps HTML | ✓ code / ? UAT visual | #3, #4, #13, #14, #23; UAT visual is a human item |
+| D-04 tag, host bump, redeploy, smoke | ✓ (except the nginx vhost install) | #5-8, #19-21 |
+| D-05 three plans | ✓ | 01, 02 and 03 are all summarized |
+
+### Post-review remediation (16.1-REVIEW.md)
+
+| Finding | Status | Evidence |
+|---------|--------|----------|
+| CR-01 stored XSS | Fixed and deployed | sm-journal-plugin a3551f2 (bluemonday); the public layer uses sanitize-html (vue-journal-layer 5beb1c5, tag v0.1.1, pinned by vue app 27b3827) |
+| WR-01 "Data:" false refusal | Fixed | The regex gate is gone; TestFormatHTMLKeepsSchemeLikeText passes |
+| WR-02 restored query locks the list | Fixed | cd25af0: `loadList(restored)` forgets the query and loads the plain list once; there is a reset button |
+| WR-03 list state crosses admins | Fixed | cd25af0: per-admin keys; `clearUser` and `expireSession` clear them |
+| Audit W-1 / W-2 | Fixed | 0d00ec8 (FormatTranslation), 5f47083 (duplicate attributes); harness tests pass |
+| WR-04 relation SQL only DryRun-tested | Resolved in substance | TestListRelationSearchPostgres runs the EXISTS and string_agg SQL on real Postgres and passes |
+| WR-05 to-many sort order differs from display order | Open (warning) | `relatedSelectMany` still joins in Preload order (query.go:142, no ORDER BY). `docs/backend/lists-and-filters.md:62` still says the sort uses "the text the list shows". |
+| IN-01..03 | Open (info) | Not addressed |
+| Translate Secure cookie, app header hardening | Verified on UAT | `set-cookie: golem15.translate.locale=...; HttpOnly; Secure`; Nuxt at :3016 sends no X-Powered-By and no set-cookie |
+
+### Required Artifacts
+
+| Artifact | Expected | Status | Details |
+|----------|----------|--------|---------|
+| `modules/cabana/query.go` | EXISTS search and to-many sort from the parsed relationship | ✓ VERIFIED | Contains `Relationships.Relations`, `string_agg`, `EXISTS (SELECT 1 FROM`; called from ExecuteList (lines 121, 133) |
+| `modules/cabana/query_relation_test.go` | DryRun harness, smoke, matrix, Postgres test | ✓ VERIFIED | Its tests pass |
+| `modules/cabana/locale_order_test.go` | default-first tests | ✓ VERIFIED | Passes |
+| `../sm-journal-plugin/classes/format_html.go` | goldmark WithUnsafe behind a safety gate | ✓ VERIFIED | `WithUnsafe` plus the bluemonday `htmlPolicy` (supersedes the regex gate) |
+| `admin/src/state/listState.ts` | per-list browser storage | ✓ VERIFIED | Contains `summer-admin.list:`; imported by ListView.vue and useAuth.ts |
+| `../sm-grzybyfunkcjonalne-app/DEPLOY.md` | release and rollback procedure without the re-save warning | ✓ VERIFIED | Has `## Release`; the warning is removed |
+| `../sm-journal-plugin/go.mod` | require of the release tag | ✓ VERIFIED | `summercms v0.1.17`, with the replace to `../summercms.go` kept |
+| `admin/tests/state/listState.test.ts` | helper tests | ✓ VERIFIED | Passes |
+| `../sm-journal-plugin/posts_admin_smoke_test.go` | TestPostsAdminResaveKeepsHTML | ✓ VERIFIED | PASS on the Docker host |
+| `modules/boardwalk/dist/` | rebuilt SPA | ✓ VERIFIED | check-admin-dist.sh: matches a fresh build |
+
+### Key Link Verification
+
+| From | To | Via | Status |
+|------|----|-----|--------|
+| query.go applyListSearch/applyListOrder | GORM schema.Relationship | `stmt.Parse` + `Relationships.Relations[field]` | ✓ WIRED |
+| http.go enabledContentLocales | TranslationWriter.DefaultLocale | default moved to index 0 | ✓ WIRED |
+| ListView.vue watch | listState.ts read/writeListState | restore before the first request | ✓ WIRED |
+| sm-journal-plugin controllers/posts.go | classes.FormatHTML | content to content_html on admin save (line 213) | ✓ WIRED |
+| useAuth.ts clearUser / main.ts onUnauthorized | setListStateOwner(null) | logout and session expiry clear list keys | ✓ WIRED |
+| host plugins/golem15/journal gitlink | sm-journal-plugin origin/main | c60abc6 | ✓ WIRED |
+| host go.mod | ../summercms.go at the release tag | replace + require v0.1.17 | ✓ WIRED |
+| FormView.test.ts | ListView entry restore | `writeListState` then back navigation | ✓ WIRED |
+
+### Data-Flow Trace (Level 4)
+
+| Artifact | Data | Source | Real data | Status |
+|----------|------|--------|-----------|--------|
+| Posts list (search) | rows/meta | ExecuteList → GORM with EXISTS on the real pivot | Yes (Postgres test; UAT log clean) | ✓ FLOWING |
+| Post form ML fields | content/excerpt (pl) | hydrateMLRecord host columns under DefaultLocale; enabledLocales[0] = pl | Yes (UAT locales: pl default, en sort 1) | ✓ FLOWING (visual check is a human item) |
+| Public post 64 | content_html footer | UAT DB → Journal API → sanitize-html → v-html | Yes (footer rendered on the SSR page) | ✓ FLOWING |
+
+### Behavioral Spot-Checks
+
+| Behavior | Command | Result | Status |
+|----------|---------|--------|--------|
+| Relation SQL and locale order (pure) | `go test -run '^(TestListRelationSearchSmoke\|TestListRelationSQL\|TestEnabledLocalesDefaultFirst\|TestEnabledLocalesDefaultFirstSmoke)$' ./modules/cabana` | 4 PASS lines | ✓ PASS |
+| Journal classes | `go -C ../sm-journal-plugin test -v ./classes/` | 9 PASS, ok | ✓ PASS |
+| Relation search on real Postgres | Docker sudo path, `-run TestListRelationSearchPostgres\|TestListQueryContract` | PASS, PASS | ✓ PASS |
+| Admin re-save and translations keep or sanitize HTML | Docker sudo path, sm-journal-plugin named tests | 3 PASS | ✓ PASS |
+| List state vitest | `npm --prefix admin test` | 76 files, 1171 tests passed | ✓ PASS |
+| Dist drift | `bash scripts/check-admin-dist.sh` | matches a fresh build | ✓ PASS |
+| Docs | `go test ./cmd/summer -run TestDocsTree` | ok | ✓ PASS |
+| Browser storage confined | grep in admin/src outside useSidebar.ts and listState.ts | empty | ✓ PASS |
+
+### Probe Execution
+
+| Probe | Command | Result | Status |
+|-------|---------|--------|--------|
+| UAT on-server smoke | `CURL_HOME=$C scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl` (via ssh, loopback resolve) | `smoke: ok (98 urls)` | PASS |
+| UAT data repair | read-only psql: placeholder count : post-64 footer | `0:1` | PASS |
+| UAT log | 42703 count since 2026/10/09 22:47:29 | 0 (32 lines) | PASS |
+| UAT binary | sha256sum bin/grzybyfunkcjonalne | e5b0ad28…3af232 | PASS |
+| Hardened vhost installed | grep CSP-Report-Only in /etc/nginx/sites-enabled/uat.grzybyfunkcjonalne.pl | 0 (uploaded copy: 1) | NOT INSTALLED (human item, needs root) |
+
+### Requirements Coverage
+
+The phase has no REQUIREMENTS.md IDs (Requirements: TBD), and REQUIREMENTS.md maps nothing to Phase 16.1, so no requirement is orphaned. The plans' `requirements:` fields name CONTEXT decisions D-01..D-04, which are covered above.
+
+### Prohibitions (judgment tier, verdicts not authoritative; flagged as unverified-prohibition, human review recommended)
+
+| # | Prohibition | LLM-judge verdict | Basis |
+|---|-------------|-------------------|-------|
+| 1 | Relation fix not Journal-specific; no consuming-application names in framework code or docs | not violated | The builder is generic over GORM relationships; grep for app names in the touched framework files is empty; TestDocsTree ok |
+| 2 | No server-side list state (table, migration, route) | not violated | No migration, route or API diff in summercms.go 3ca6a0d..cd25af0 |
+| 3 | Journal API content/content_html shapes unchanged | not violated | Only stored values change (sanitized); README says shapes and codes are unchanged |
+| 4 | cabana.RenderMarkdown stays safe-mode | not violated | `modules/cabana/field_markdown.go` has no WithUnsafe |
+| 5 | No write SQL on UAT; only human re-saves of 53/64 | not violated (from records) | Records show read-only psql only; cannot be proven after the fact |
+| 6 | Live Winter site, vhost, php-fpm and PHP DB untouched | not violated (from records) | The vhost was not installed; there is no evidence of live-site edits |
+| 7 | No credentials requested, printed or committed | not violated (from records) | SUMMARYs hold no secrets |
+| 8 | Tests touch no UAT, network or shared DB | not violated | DryRun on DSN port 1; testcontainers for Postgres |
+| 9 | Tests not weakened | not violated | Refuse cases became strip cases under the accepted bluemonday decision, and the payload set grew to 35 |
+
+### Anti-Patterns Found
+
+| File | Line | Pattern | Severity | Impact |
+|------|------|---------|----------|--------|
+| (phase files) | - | TBD/FIXME/XXX/TODO/HACK | none found | - |
+| `docs/backend/lists-and-filters.md` | 62 | Docs claim a to-many sort uses "the text the list shows" but the display order is Preload order (WR-05) | ⚠️ Warning | A list sorted by categories can look out of order; docs inaccurate |
+| `../sm-grzybyfunkcjonalne-app/sm-grzybyfunkcjonalne-app` | - | 46 MB untracked, not-ignored binary in the host repo root (built 2026-10-10 00:50 local) | ℹ️ Info | Could be committed by accident; not part of any commit |
+| `.planning/phases/16.2-.../16.2-05-PLAN.md` (via ROADMAP line 1014) | - | Plans to cut "summercms tag v0.1.17", which 16.1 already used | ℹ️ Info | 16.2's release must pick the next free tag (v0.1.18) |
+| UAT Journal API | - | With no locale given (and with Accept-Language pl-PL), the API sets `golem15.translate.locale=en` although the default is pl and en has sort_order 1 | ℹ️ Info | Outside 16.1 scope; may be pre-existing translate behavior; worth a look |
+| `16.1-VALIDATION.md`, `16.1-SECURITY.md` | - | Still say "Docker-host suites pending" / sign-off unchecked | ℹ️ Info | Stale bookkeeping: the Docker-host suites have now passed |
+
+### Human Verification Required
+
+#### 1. Install the hardened staging vhost (root)
+**Test:** Install `/srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf` (host fc10094, 387d0f4) as the uat vhost, then run `nginx -t` and reload.
+**Expected:** The security headers and CSP Report-Only appear on UAT responses, the `/gfadmin` auth_basic exemption still holds, and the smoke still passes.
+**Why human:** It needs root on the server. Today the enabled vhost does not have CSP-RO.
+
+#### 2. UAT posts list search
+**Test:** Search "cordyceps" in `/gfadmin/golem15/journal/posts`.
+**Expected:** Rows appear and no SQLSTATE 42703 shows up in the log.
+**Why human:** It needs basic auth and an admin login. The Go log does not record successful queries.
+
+#### 3. UAT list state round trip (D-01)
+**Test:** Set a sort and a category filter. Go open post → back, then save-and-close, then rail navigation. Paste the URL in a new tab. Log out and back in.
+**Expected:** State is kept and visible in the URL. After logout and login the list opens unfiltered.
+**Why human:** It is an interactive flow. The earlier human report predates the v0.1.17 deploy.
+
+#### 4. UAT post form locales and fields (D-03)
+**Test:** Open an imported post.
+**Expected:** `pl` is first, and title, slug, content and excerpt are filled.
+**Why human:** It is a visual check on real data.
+
+#### 5. Judgment-tier prohibitions
+**Test:** Review the nine verdicts above.
+**Expected:** Accept or overturn each one.
+**Why human:** The verifier's verdicts are not authoritative.
+
+### Gaps Summary
+
+There are no blocking gaps. Every roadmap criterion and plan must-have I could check automatically holds in the code, the tests (including the Docker-backed Postgres suites, which I re-ran), the tags and pushes, and the deployed UAT server (binary hash, smoke, log, SQL, public headers, post-64 footer). Two plan wordings were superseded by stricter post-review fixes, and both are recorded in an accepted decision note or a commit:
+- FormatHTML now strips unsafe markup with bluemonday instead of refusing it with a regex.
+- List-state keys are now scoped per admin.
+
+Still open:
+- **Human items:** the root-only nginx vhost install, and the three UAT browser checks.
+- **WR-05:** a non-blocking warning. The docs sentence on to-many sort order is inaccurate.
+
+---
+
+_Verified: 2026-10-09T23:05:00Z_
+_Verifier: Claude (msd-verifier)_

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-PLAN.md

@@ -21,6 +21,7 @@ files_modified:
   - modules/cabana/settings.go
   - modules/cabana/relation_form.go
   - modules/cabana/extension.go
+  - modules/cabana/relation_field.go
   - modules/cabana/admin_openapi.go
   - modules/cabana/security_coverage_test.go
   - modules/cabana/README.md
@@ -37,6 +38,7 @@ files_modified:
   - admin/src/components/form/FieldRenderer.vue
   - admin/src/components/form/PreviewField.vue
   - admin/src/components/form/FormField.vue
+  - admin/src/components/form/FormGrid.vue
   - admin/src/components/form/formState.ts
   - admin/src/components/form/mlLocale.ts
   - admin/src/components/form/formContext.ts
@@ -44,21 +46,24 @@ files_modified:
   - admin/src/components/form/fields/MLPluginField.vue
   - admin/src/components/relation/RelationChildModal.vue
   - admin/tests/form/PluginField.test.ts
+  - admin/tests/form/FormField.test.ts
+  - admin/tests/form/formState.test.ts
   - modules/boardwalk/dist
   - docs/backend/field-types.md
   - docs/backend/forms.md
 autonomous: false
 requirements: [D-03, D-06, D-10, D-11, D-12, D-13, D-14, D-15, D-18]
 estimate:
-  tokens: 130000
-  raw_tokens: 130000
+  tokens: 140000
+  raw_tokens: 140000
   tasks: 4
   confidence: low
 must_haves:
   truths:
     - "D-11: a plugin registers a value-bearing admin field type under a short alias (pact.HasFormFieldTypes); boot fails with a message naming both owners when two plugins claim one alias, and fails when an alias equals a cabana core type (text, markdown, mlmarkdown, widget, partial and the rest of formFieldTypes)."
     - "D-12.1: a plugin-typed field accepts the general field keys plus the type's own Options keys; any other key, and any CheckOptions error, fails boot naming the field and the type."
-    - "D-12.2 and D-10: a save runs the type's Decode inside the save transaction after the record is loaded, for the host value and for every non-default locale value of a translatable type; a pact.FormFieldError is a 422 validation_failed on that field and nothing is written; any other plugin error is an opaque 500 without the plugin's text."
+    - "D-12.2 and D-10: a save runs the type's Decode inside the save transaction after the record is loaded, for the host value and for every non-default locale value of a translatable type, and stores the returned pact.FormFieldDecoded Value; a pact.FormFieldError is a 422 validation_failed on that field and nothing is written; any other plugin error is an opaque 500 without the plugin's text."
+    - "D-10 (framework half, amended 2026-10-10): a Decode may return pact.FormFieldNotice values next to the value it stores (for example what a sanitizer removed); cabana localizes them in the request locale and answers the create or update with meta.notices [{field, locale, message}]; a save whose Decode calls returned no notice answers exactly today's JSON (no notices key); the admin SPA shows each notice under its field and in the saved toast, and reloads the stored value from the response into the form and the element."
     - "D-12.3: Show and the save response serve each plugin field through the type's Load (per locale for a translatable type)."
     - "D-12.4: a list column typed with a plugin alias shows the type's ListValue string."
     - "D-03 (server half): on update, a submitted value equal to the value the form was served for that field and locale is not decoded and not written, neither to the host column nor as a translation."
@@ -69,8 +74,11 @@ must_haves:
     - "D-15: the form schema carries plugin fields generically (element, translatable, typeOptions); admin/openapi/admin.json and admin/src/api/schema.d.ts are regenerated, modules/boardwalk/dist is rebuilt, and the pact and cabana READMEs plus docs/backend/field-types.md describe the API with neutral names."
   artifacts:
     - path: "modules/pact/capabilities.go"
-      provides: "FormFieldType, FormFieldValue, FormFieldUpload, FormFieldUploadResult, FormFieldError, HasFormFieldTypes"
+      provides: "FormFieldType, FormFieldValue, FormFieldDecoded, FormFieldNotice, FormFieldUpload, FormFieldUploadResult, FormFieldError, HasFormFieldTypes"
       contains: "HasFormFieldTypes"
+    - path: "modules/cabana/relation_field.go"
+      provides: "RecordMeta.Notices and FieldNotice (the save response's meta.notices)"
+      contains: "notices,omitempty"
     - path: "modules/cabana/field_type.go"
       provides: "per-boot field type registry, compile checks, decode/skip/load/list runner"
       contains: "compileFieldTypes"
@@ -98,6 +106,14 @@ must_haves:
       to: "pact.FormFieldType Decode and Load"
       via: "decodePluginFields between loadRecord and lagoon.Fill inside the save transaction"
       pattern: "decodePluginFields"
+    - from: "modules/cabana/crud.go save"
+      to: "RecordResult.Meta.Notices (JSON meta.notices)"
+      via: "localizeNotices over the FormFieldDecoded notices, after the transaction commits"
+      pattern: "localizeNotices"
+    - from: "admin/src/views/FormView.vue save"
+      to: "FormField notice line and the saved toast"
+      via: "noticeLines(result.data.meta.notices) passed through FormGrid like errors"
+      pattern: "noticeLines"
     - from: "admin/src/main.ts and admin/src/views/LoginView.vue"
       to: "GET {api}/field-types"
       via: "loadFieldTypes next to loadNavigation"
@@ -127,6 +143,12 @@ ROADMAP Goal (not in user-story format): plugins can register their own admin fo
 
 This plan's slice (user decision 1, plan 01): the framework half in summercms.go. A plugin registers a value-bearing field type through `pact`; cabana compiles, decodes, loads, lists, uploads and stores it (ML included); the admin SPA hosts its element globally. Framework first: plans 02 and 03 build the Journal editor on this API.
 
+## Revision 2026-10-10 (CONTEXT D-10 amended)
+
+D-10 now strips instead of refusing, and an admin save must tell the admin what was removed. That report is a generic field-type capability, not Journal code in cabana: `Decode` returns `pact.FormFieldDecoded{Value, Notices}`, cabana localizes the notices and answers the save with `meta.notices`, and the SPA shows them and reloads the stored value. `pact.FormFieldError` (422) stays for values a type cannot accept at all, such as a non-string. The release tag named in Task 1 is now v0.1.18 or the next free v0.1.x, because 16.1 already tagged v0.1.17. Everything else in this plan is unchanged.
+
+RESEARCH and PATTERNS were written before 16.1 replaced the Journal regex gate with bluemonday and before D-10 was amended. Where they say "CheckHTML refuses" or "no sanitizer", this plan's text wins.
+
 ## Spec-less probe fallback
 
 Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". No SPEC and no edge-probe predicates were generated this run. CONTEXT D-01 to D-19, the three folded todos and RESEARCH Patterns 1-9 are the source of truth. Prohibitions above were recalled in-prompt and are descriptor-less (flagged-unverified).
@@ -149,15 +171,15 @@ The locked plan count (6) puts the whole framework half in this plan. It has fou
 | GOAL | — | Plugins register field types; Journal Blog Editor edits imported HTML losslessly | 01-06 | COVERED |
 | REQ | — | none mapped (ROADMAP "Requirements: TBD") | — | n/a |
 | CONTEXT | D-01 | WYSIWYG + source toggle on TipTap | 02 | COVERED |
-| CONTEXT | D-02 | HTML in content and content_html on admin save | 03 | COVERED |
+| CONTEXT | D-02 | HTML in content and content_html on admin save, both sanitized | 03 | COVERED |
 | CONTEXT | D-03 | Byte-preserving unless edited | 01 (server skip), 02 (element), 03, 05 (UAT), 06 | COVERED |
-| CONTEXT | D-04 | Text, images, tables, embeds, raw HTML block | 02 | COVERED |
-| CONTEXT | D-05 | Embed placeholder, CheckHTML not relaxed | 02, 03, 04 | COVERED |
+| CONTEXT | D-04 | Text, images, tables, embeds, raw HTML block (raw block goes through the sanitizer) | 02, 03 | COVERED |
+| CONTEXT | D-05 | Embed placeholder; both policies extended only for the editor's own output, pinned by a corpus test; iframes still refused | 02 (corpus), 03 (Go policy), 04 (layer mirror), 06 | COVERED |
 | CONTEXT | D-06 | Translatable like mlmarkdown | 01, 03 | COVERED |
 | CONTEXT | D-07 | Markdown post opens with content_html | 03 | COVERED |
 | CONTEXT | D-08 | mlblogeditor replaces mlmarkdown for post content | 03 | COVERED |
 | CONTEXT | D-09 | Public write API unchanged | 03 | COVERED |
-| CONTEXT | D-10 | CheckHTML refuses on every locale, no goldmark on admin path | 01, 03 | COVERED |
+| CONTEXT | D-10 | Strip, never refuse, on every locale for posts and categories; the save names what was removed; no goldmark on the admin path | 01 (notices), 03 (Journal strip), 05 (UAT), 06 | COVERED |
 | CONTEXT | D-11 | Short global alias, collision fails boot | 01 | COVERED |
 | CONTEXT | D-12 | pact interface: options, decode, load, list | 01 | COVERED |
 | CONTEXT | D-13 | Element loads globally, value contract, --c-* only | 01, 02 | COVERED |
@@ -166,7 +188,7 @@ The locked plan count (6) puts the whole framework half in this plan. It has fou
 | CONTEXT | D-16 | TipTap in a custom element, plugin JS build, committed dist | 02 | COVERED |
 | CONTEXT | D-17 | Layer expands embeds, new tag pinned in the app | 04, 05 | COVERED |
 | CONTEXT | D-18 | Image upload with alt and caption | 01 (route), 02 (UI), 03 (storage) | COVERED |
-| CONTEXT | D-19 | Category content uses blogeditor | 03 | COVERED |
+| CONTEXT | D-19 | Category content uses blogeditor and is stripped like posts (the 422 gate is retired) | 03, 06 | COVERED |
 | TODO | — | cabana-plugin-registered-field-types | 01 | COVERED |
 | TODO | — | cabana-richeditor-field-type | 03 | COVERED |
 | TODO | — | journal-imported-html-admin-resave (and its test) | 03, 05, 06 | COVERED |
@@ -176,30 +198,31 @@ The locked plan count (6) puts the whole framework half in this plan. It has fou
 | RESEARCH | P4 | Preservation-first schema and serializer | 02 | COVERED |
 | RESEARCH | P5 | Element contract, global CSS owner (Pitfall 8) | 01, 02 | COVERED |
 | RESEARCH | P6 | Journal integration, category not translatable | 03 | COVERED |
-| RESEARCH | P7 | Embed expansion after the gate | 04 | COVERED |
+| RESEARCH | P7 | Embed expansion after the sanitizer (last step at the v-html sink) | 04 | COVERED |
 | RESEARCH | P8 | Plugin JS build, no eval, injectCSS false, check-dist | 02 | COVERED |
 | RESEARCH | P9 | Collision-free upload route, OpenAPI + phase09Routes | 01 | COVERED |
 | RESEARCH | Pitfall 7 | Non-default content_html companion write | 01 (accessor), 03 | COVERED |
 | RESEARCH | Pitfall 11 | No Docker: DryRun/unit smoke + human Docker-host gate | 05, 06 | COVERED |
 | RESEARCH | Security | Magic-byte image check on the editor upload | 03 | COVERED |
 | RESEARCH | OQ3 | Release scope (tags, bumps, UAT) | 04, 05 | COVERED |
+| DRIFT | 16.1 | bluemonday policy (`SanitizeHTML`, `FormatTranslation`, the `CheckHTML` predicate (reports any change)), layer sanitize-html mirror, v0.1.17 and layer v0.1.1 already tagged, post 64 re-saved without its style block | 01-06 (revision 2026-10-10) | COVERED |
 
 ## Artifacts this phase produces (this plan)
 
-- `pact.FormFieldType`, `pact.FormFieldValue`, `pact.FormFieldUpload`, `pact.FormFieldUploadResult`, `pact.FormFieldError` (with `Error() string`), `pact.HasFormFieldTypes`.
-- `cabana.FieldWrite`, `cabana.FieldWritesFromContext`, `cabana.WithFieldWrites`, `cabana.CompileFormWithTypes`, `cabana.FieldTypeAssets`, `cabana.FieldTypesResponse`, `cabana.FieldUploadResponse`.
+- `pact.FormFieldType`, `pact.FormFieldValue`, `pact.FormFieldDecoded`, `pact.FormFieldNotice`, `pact.FormFieldUpload`, `pact.FormFieldUploadResult`, `pact.FormFieldError` (with `Error() string`), `pact.HasFormFieldTypes`.
+- `cabana.FieldWrite`, `cabana.FieldWritesFromContext`, `cabana.WithFieldWrites`, `cabana.CompileFormWithTypes`, `cabana.FieldTypeAssets`, `cabana.FieldTypesResponse`, `cabana.FieldUploadResponse`, `cabana.FieldNotice`, and the `RecordMeta.Notices` field (JSON `meta.notices`, omitted when empty).
 - `cabana.FormField` JSON keys `element`, `translatable`, `typeOptions` (Go fields `Element`, `Translatable`, `TypeOptions`).
-- Unexported: `fieldTypeRegistry`, `compileFieldTypes`, `readClientAssets`, `liftPluginValues`, `decodePluginFields`, `hydratePluginFields`, `servedFieldValue`, `isMLField`, `fieldUpload`, `fieldTypesList`, `withFieldWrites`.
+- Unexported: `fieldTypeRegistry`, `compileFieldTypes`, `readClientAssets`, `liftPluginValues`, `decodePluginFields`, `hydratePluginFields`, `servedFieldValue`, `isMLField`, `fieldUpload`, `fieldTypesList`, `withFieldWrites`, `localizeNotices`.
 - Routes: `GET {api}/field-types`, `POST {api}/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload`.
 - New files: `modules/cabana/field_type.go`, `modules/cabana/field_type_upload.go`, `modules/cabana/field_type_smoke_test.go`, `admin/src/app/fieldTypes.ts`, `admin/src/components/form/fields/PluginField.vue`, `admin/src/components/form/fields/MLPluginField.vue`, `admin/tests/form/PluginField.test.ts`, `docs/backend/field-types.md`.
-- SPA exports: `loadFieldTypes`, `loadGlobalStyles`, `GLOBAL_STYLE_OWNER`, `rendererForField`, `isRegisteredField`, `isMLField`, `FIELD_CHANGE_EVENT`, `FIELD_UPLOAD_EVENT`, `FIELD_UPLOAD_RESULT_EVENT`.
+- SPA exports: `loadFieldTypes`, `loadGlobalStyles`, `GLOBAL_STYLE_OWNER`, `rendererForField`, `isRegisteredField`, `isMLField`, `noticeLines`, `FIELD_CHANGE_EVENT`, `FIELD_UPLOAD_EVENT`, `FIELD_UPLOAD_RESULT_EVENT`; FormField and FormGrid gain a `notices` prop.
 - Smoke tests: `TestFieldTypeTracerSmoke`, `TestFieldTypeExpansionSmoke`.
 
 <objective>
-Add the plugin field type API to pact and cabana and host plugin field elements in the admin SPA (D-11 to D-15, D-03 server half, D-06/D-14 storage path, D-10 refusal mapping, D-18 upload route).
+Add the plugin field type API to pact and cabana and host plugin field elements in the admin SPA (D-11 to D-15, D-03 server half, D-06/D-14 storage path, D-10 notices and refusal mapping, D-18 upload route).
 
-Purpose: Journal (plans 02 and 03) and later plugins ship their own value-bearing field types without a framework release per type.
-Output: the pact types, the cabana registry, compile, save, show, list and upload paths, the two routes, regenerated OpenAPI and TS types, PluginField/MLPluginField and the global loader, rebuilt dist, READMEs and docs.
+Purpose: Journal (plans 02 and 03) and later plugins ship their own value-bearing field types without a framework release per type, and a type that changes a value on save (Journal strips unsafe HTML per D-10) can tell the admin what it changed.
+Output: the pact types, the cabana registry, compile, save (with notices), show, list and upload paths, the two routes, regenerated OpenAPI and TS types, PluginField/MLPluginField, the global loader and the notice display, rebuilt dist, READMEs and docs.
 </objective>
 
 <execution_context>
@@ -230,7 +253,7 @@ type FormFieldType struct {
 	Styles       []string // AdminFS paths under assets/ (.css), enabled on every admin page
 	Options      []string // the type's own fields.yaml keys
 	CheckOptions func(options map[string]any) error                                       `json:"-"` // optional
-	Decode       func(ctx context.Context, in FormFieldValue) (any, error)                `json:"-"` // required
+	Decode       func(ctx context.Context, in FormFieldValue) (FormFieldDecoded, error)   `json:"-"` // required
 	Load         func(ctx context.Context, in FormFieldValue) (any, error)                `json:"-"` // optional
 	ListValue    func(value any) string                                                   `json:"-"` // optional
 	Upload       func(ctx context.Context, in FormFieldUpload) (FormFieldUploadResult, error) `json:"-"` // optional
@@ -245,6 +268,21 @@ type FormFieldValue struct {
 	Value      any            // submitted (Decode) or stored (Load); a string for a translatable type
 	Translated func(attribute string) (string, bool, error) // exact read of another attribute of Record in Locale; nil when not translatable or no writer
 }
+// FormFieldDecoded is Decode's answer: Value is stored (a string for a
+// translatable type); Notices are non-blocking messages about it, such as what
+// a sanitizer removed. No notices means the save answers exactly as before.
+type FormFieldDecoded struct {
+	Value   any
+	Notices []FormFieldNotice
+}
+// FormFieldNotice is one message for the admin. cabana localizes Message
+// (phrase key or text) in the request locale with Params; Count > 0 selects
+// the plural form (phrasebook Choice, :count set).
+type FormFieldNotice struct {
+	Message string
+	Params  map[string]string
+	Count   int
+}
 type FormFieldUpload struct {
 	DB       *gorm.DB
 	Record   any // nil on the create form ({id} 0)
@@ -271,8 +309,16 @@ func WithFieldWrites(ctx context.Context, writes map[string][]FieldWrite) contex
 func CompileFormWithTypes(pluginID string, ctl pact.AdminController, fsys fs.FS, types []pact.FormFieldType) (*FormSchema, error)
 // FormField gains: Element string `json:"element,omitempty"`, Translatable bool `json:"translatable,omitempty"`,
 // TypeOptions map[string]any `json:"typeOptions,omitempty"`, fieldType *compiledFieldType `json:"-"`
+type FieldNotice struct {
+	Field   string `json:"field"`
+	Locale  string `json:"locale,omitempty"` // set for a translatable type's value
+	Message string `json:"message"`          // already localized
+}
+// RecordMeta (relation_field.go) gains: Notices []FieldNotice `json:"notices,omitempty"`
 ```
 
+Save responses: `POST /{vendor}/{plugin}/{controller}` and `PUT .../{id}` keep `{"data":...,"meta":{"labels":...}}`; when a Decode returned notices, `meta` also carries `"notices":[{"field":"content","locale":"pl","message":"2 elements were removed: style, iframe"}]`. Without notices the JSON is byte-for-byte today's.
+
 Routes (relative to `<prefix>/api/v1`):
 - `GET /field-types` → `{"data":[{"name","element","translatable","scripts":["<prefix>/assets/vendor/plugin/...js?v=<12 hex>"],"styles":[...]}]}`, sorted by name.
 - `POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload` (multipart, one `file` part; `{id}` 0 = create form) → 201 `{"data":{"url":"..."}}`; 422 `validation_failed` on the field for a FormFieldError; 404 for an unknown field, a field without a plugin type or without Upload, or a record outside the FormExtendQuery scope; 413 over the cap.
@@ -291,6 +337,8 @@ Existing code the executor builds on (read, do not re-derive):
 - `modules/cabana/field_ml.go`: `mlFieldType`, `liftMLValues`, `applyMLTranslations`, `hydrateMLRecord`, `TranslationWriter`.
 - `modules/cabana/extension.go`: `widgetTagPrefix`, `checkWidgetTag`, `compileClientAssets` (253-300, the `read` closure to extract), `checkAssetPath`, `bootErr`, `pluginAsset`.
 - `modules/cabana/tx_context.go`: `withVirtualFields`/`VirtualFieldsFromContext` (36-60), the pattern for the writes accessor.
+- `modules/cabana/relation_field.go`: `RecordMeta` (91), `RecordEnvelope`, `RecordResult`; `modules/cabana/crud.go`: `localizeForbidden` (the pattern for `localizeNotices`: request locale via `schemaLocale`, `translateKey`), `CRUDService.tr`; `modules/phrasebook/translator.go`: `Get(ctx, key, params)` and `Choice(ctx, key, count, params)`.
+- `admin/src/views/FormView.vue`: `adopt` (173, reloads the saved record into the form), `save` (315), the saved toast (337); `admin/src/components/form/FormGrid.vue` (47, `:errors` per field) and `FormField.vue` (the `errors` prop and error line): the path notices follow.
 - `admin/src/components/form/fields/WidgetField.vue`: element creation, `defined()` with `WIDGET_TIMEOUT`, `api.POST` with `params.path` from the control props, ExtensionFailure.
 - `admin/src/app/pluginAssets.ts`: `assetAllowed`, `loadScript`, `loadStyles`, `activateStyles` (disables links whose owner is not active: Pitfall 8).
 </interfaces>
@@ -303,9 +351,9 @@ Existing code the executor builds on (read, do not re-derive):
   <read_first>modules/pact/capabilities.go (AdminAction, AdminActionInput, HasAdminActions, AdminClientAssets: the style to copy), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-CONTEXT.md (D-11 to D-15, Claude's Discretion), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md (Patterns 1, 2, 5, 9; Code Example 1), this plan's interfaces block</read_first>
   <action>Do the automatable part, then stop. Run the verify command (baseline: the contract and schema tests this plan must keep green pass before any change) and confirm `git status --porcelain -- modules admin docs scripts` prints nothing; if it prints anything, report the in-flight files (concurrent session, 16.1 D-02) and stop without editing.
 
-Then print the proposal sheet: the pact types and func signatures exactly as in the interfaces block; which funcs are optional (CheckOptions, Load, ListValue, Upload) and which is required (Decode); the cabana additions (FieldWrite, FieldWritesFromContext, WithFieldWrites, CompileFormWithTypes, the FormField keys element, translatable and typeOptions); the two routes and their answers; the element contract (value property, attributes, summer-change, summer-upload, summer-upload-result), labelled "fixed: shared with plan 02, not open at this checkpoint"; the alias rule (^[a-z][a-z0-9]*$, no core type, no duplicate) and the option-key rule (^[A-Za-z][A-Za-z0-9]*$, no core field key); and the assumptions section of this plan (A5 refusal in settings and relation forms, field-types route, string values for translatable types). Stop for the human.</action>
+Then print the proposal sheet: the pact types and func signatures exactly as in the interfaces block, including Decode's FormFieldDecoded answer and FormFieldNotice (the D-10 amendment: a type reports what it changed instead of refusing); which funcs are optional (CheckOptions, Load, ListValue, Upload) and which is required (Decode); the cabana additions (FieldWrite, FieldWritesFromContext, WithFieldWrites, CompileFormWithTypes, FieldNotice, RecordMeta.Notices as meta.notices omitted when empty, the FormField keys element, translatable and typeOptions); the two routes and their answers; the element contract (value property, attributes, summer-change, summer-upload, summer-upload-result), labelled "fixed: shared with plan 02, not open at this checkpoint"; the alias rule (^[a-z][a-z0-9]*$, no core type, no duplicate) and the option-key rule (^[A-Za-z][A-Za-z0-9]*$, no core field key); and the assumptions section of this plan (A5 refusal in settings and relation forms, field-types route, string values for translatable types). Stop for the human.</action>
   <decision>Adopt this pact and cabana field-type API as proposed, or adjust named Go identifiers before they are written?</decision>
-  <context>D-12 rates the pact interface one-way: once summercms is tagged (plan 05, v0.1.17) other repositories compile against these names, and the todo cabana-plugin-registered-field-types expects payment and other plugins to build on it. Before the tag, a rename costs one search-and-replace in this phase; after it, every consuming plugin changes. Journal's Go integration (plan 03) is the first consumer and is written against these exact names. Scope of this checkpoint: pact and cabana Go identifiers and the GET /field-types answer only. The element contract (tag prefix rule, value property, the attributes, summer-change, summer-upload, summer-upload-result) is fixed by this plan per D-13 and is being implemented by plan 02 in parallel, so it is not adjustable here; a human who wants it changed replies "stop" here and at plan 02's package checkpoint, and plans 01 and 02 are re-planned together.</context>
+  <context>D-12 rates the pact interface one-way: once summercms is tagged (plan 05: v0.1.18, or the next free v0.1.x; v0.1.17 is already the 16.1 security release) other repositories compile against these names, and the todo cabana-plugin-registered-field-types expects payment and other plugins to build on it. Before the tag, a rename costs one search-and-replace in this phase; after it, every consuming plugin changes. Journal's Go integration (plan 03) is the first consumer and is written against these exact names. Scope of this checkpoint: pact and cabana Go identifiers and the GET /field-types answer only. The element contract (tag prefix rule, value property, the attributes, summer-change, summer-upload, summer-upload-result) is fixed by this plan per D-13 and is being implemented by plan 02 in parallel, so it is not adjustable here; a human who wants it changed replies "stop" here and at plan 02's package checkpoint, and plans 01 and 02 are re-planned together.</context>
   <options>
     <option id="approve">
       <name>Approve as proposed</name>
@@ -334,25 +382,27 @@ Then print the proposal sheet: the pact types and func signatures exactly as in
   <name>Task 2: Tracer: one non-translatable plugin field type end to end (pact, boot, schema, save Decode, Show Load, field-types route, SPA PluginField)</name>
   <reversibility rating="one-way">Published pact API: after the plan 05 tag, other plugins' go.mod require these names; renaming means editing every consumer (D-12).</reversibility>
   <precondition>Task 1 was answered "approve" or "adjust" and the SUMMARY lists the identifiers to use.</precondition>
-  <files>modules/pact/capabilities.go, modules/pact/README.md, modules/cabana/field_type.go, modules/cabana/form_schema.go, modules/cabana/schema_types.go, modules/cabana/registry.go, modules/cabana/http.go, modules/cabana/crud.go, modules/cabana/extension.go, modules/cabana/settings.go, modules/cabana/relation_form.go, modules/cabana/admin_openapi.go, modules/cabana/security_coverage_test.go, modules/cabana/field_type_smoke_test.go, modules/cabana/README.md, admin/openapi/admin.json, admin/src/api/schema.d.ts, admin/src/api/types.ts, admin/src/app/fieldTypes.ts, admin/src/app/pluginAssets.ts, admin/src/main.ts, admin/src/views/LoginView.vue, admin/src/components/form/registry.ts, admin/src/components/form/FieldRenderer.vue, admin/src/components/form/PreviewField.vue, admin/src/components/form/FormField.vue, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/components/form/fields/PluginField.vue, admin/tests/form/PluginField.test.ts, modules/boardwalk/dist, docs/backend/field-types.md, docs/backend/forms.md</files>
-  <read_first>modules/pact/capabilities.go, modules/pact/README.md, modules/cabana/form_schema.go, modules/cabana/schema_types.go (FormField, ListColumn), modules/cabana/registry.go, modules/cabana/http.go (Activate, mount, protect, navigation handler), modules/cabana/crud.go (save, ShowRecord, lifecycleFailure, scalarFormField and its callers), modules/cabana/extension.go, modules/cabana/settings.go (decodeFields caller at 74), modules/cabana/relation_form.go (decodeFields callers at 145 and 246), modules/cabana/admin_openapi.go (the /navigation and FormField annotations), modules/cabana/security_coverage_test.go (phase09Routes), modules/cabana/query_relation_test.go (openDryRunDB, newDryRunListService: test style), modules/cabana/README.md (Admin API routes table, API reference), scripts/check-admin-openapi.sh, scripts/check-admin-dist.sh, admin/src/app/pluginAssets.ts, admin/src/main.ts, admin/src/views/LoginView.vue, admin/src/state/useNavigation.ts, admin/src/components/form/registry.ts, admin/src/components/form/control.ts, admin/src/components/form/FieldRenderer.vue, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/components/form/fields/WidgetField.vue, admin/tests/form/WidgetField.test.ts, docs/backend/partials-and-widgets.md (Form widgets, Widget element contract), docs/backend/forms.md, docs/site.yaml</read_first>
+  <files>modules/pact/capabilities.go, modules/pact/README.md, modules/cabana/field_type.go, modules/cabana/form_schema.go, modules/cabana/schema_types.go, modules/cabana/registry.go, modules/cabana/http.go, modules/cabana/crud.go, modules/cabana/relation_field.go, modules/cabana/extension.go, modules/cabana/settings.go, modules/cabana/relation_form.go, modules/cabana/admin_openapi.go, modules/cabana/security_coverage_test.go, modules/cabana/field_type_smoke_test.go, modules/cabana/README.md, admin/openapi/admin.json, admin/src/api/schema.d.ts, admin/src/api/types.ts, admin/src/app/fieldTypes.ts, admin/src/app/pluginAssets.ts, admin/src/main.ts, admin/src/views/LoginView.vue, admin/src/components/form/registry.ts, admin/src/components/form/FieldRenderer.vue, admin/src/components/form/PreviewField.vue, admin/src/components/form/FormField.vue, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/components/form/fields/PluginField.vue, admin/tests/form/PluginField.test.ts, modules/boardwalk/dist, docs/backend/field-types.md, docs/backend/forms.md</files>
+  <read_first>modules/pact/capabilities.go, modules/pact/README.md, modules/cabana/form_schema.go, modules/cabana/schema_types.go (FormField, ListColumn), modules/cabana/registry.go, modules/cabana/http.go (Activate, mount, protect, navigation handler), modules/cabana/crud.go (save, ShowRecord, lifecycleFailure, localizeForbidden, scalarFormField and its callers), modules/cabana/relation_field.go (RecordMeta, RecordResult), modules/phrasebook/translator.go (Get, Choice), modules/phrasebook/backend/lang/pl/lang.yaml (lines 40-44: plural map format), modules/cabana/extension.go, modules/cabana/settings.go (decodeFields caller at 74), modules/cabana/relation_form.go (decodeFields callers at 145 and 246), modules/cabana/admin_openapi.go (the /navigation and FormField annotations), modules/cabana/security_coverage_test.go (phase09Routes), modules/cabana/query_relation_test.go (openDryRunDB, newDryRunListService: test style), modules/cabana/README.md (Admin API routes table, API reference), scripts/check-admin-openapi.sh, scripts/check-admin-dist.sh, admin/src/app/pluginAssets.ts, admin/src/main.ts, admin/src/views/LoginView.vue, admin/src/state/useNavigation.ts, admin/src/components/form/registry.ts, admin/src/components/form/control.ts, admin/src/components/form/FieldRenderer.vue, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/components/form/fields/WidgetField.vue, admin/tests/form/WidgetField.test.ts, docs/backend/partials-and-widgets.md (Form widgets, Widget element contract), docs/backend/forms.md, docs/site.yaml</read_first>
   <action>Build the thinnest complete path for a plain plugin type (per D-11, D-12, D-13, D-15), using the identifiers recorded by Task 1.
 
-pact (D-12): add FormFieldType, FormFieldValue, FormFieldUpload, FormFieldUploadResult, FormFieldError (Error joins Messages with "; ") and HasFormFieldTypes to modules/pact/capabilities.go with doc comments in the AdminAction style: cabana owns routes, CSRF, authentication, permissions, record scope, locale storage and the untouched-value skip; Decode returns the value to store, Load returns what the element receives, ListValue returns list text, Upload stores a file and returns its URL. The HasFormFieldTypes doc comment says it is implemented by the plugin (not a controller), like HasAdminControllers.
+pact (D-12, D-10): add FormFieldType, FormFieldValue, FormFieldDecoded, FormFieldNotice, FormFieldUpload, FormFieldUploadResult, FormFieldError (Error joins Messages with "; ") and HasFormFieldTypes to modules/pact/capabilities.go with doc comments in the AdminAction style: cabana owns routes, CSRF, authentication, permissions, record scope, locale storage, notice localization and the untouched-value skip; Decode returns FormFieldDecoded (the value to store plus optional notices; a notice reports a change the type made to an accepted value, a FormFieldError refuses a value the type cannot accept), Load returns what the element receives, ListValue returns list text, Upload stores a file and returns its URL. The HasFormFieldTypes doc comment says it is implemented by the plugin (not a controller), like HasAdminControllers.
 
 Registry (D-11, RESEARCH Pattern 1): new modules/cabana/field_type.go with compileFieldTypes(plugins []party.Plugin) (*fieldTypeRegistry, error), called in Activate before compileRegistry and passed down as a parameter; no package-level registry. Rules, each a boot error of the form "cabana: plugin <id> field type <name>: <reason>": the alias matches ^[a-z][a-z0-9]*$; it is not a key of formFieldTypes; it is not claimed by another plugin (the message names both plugin IDs); Element passes checkWidgetTag with widgetTagPrefix(pluginID); Decode is non-nil; each Options key matches ^[A-Za-z][A-Za-z0-9]*$, is not a key of formFieldKeys and is not repeated; a plugin declaring Scripts or Styles implements pact.AdminAssets. Extract the read-and-hash closure of compileClientAssets into readClientAssets(pluginID, owner string, fsys fs.FS, files []string, exts ...string) ([]*pluginAsset, error) and use it for both controller assets and field-type Scripts (.js, .mjs) and Styles (.css); field-type assets join Registry.assets so the existing GET {prefix}/assets/{vendor}/{plugin}/{file...} route serves them with ETag and ?v=.
 
 Compile (D-12.1): compileRegistry and compileList/compileFormIfPresent take the registry; decodeFields(raw, types) passes it through fieldMap to compileFieldNode, which now reads the type first: for a plugin alias the accepted keys are label, comment, span, type, required, tab, context, attributes, size, default plus the type's Options; any other key is "unknown field <key>"; option values decode from the YAML nodes into JSON-compatible values (string, bool, int or float64, []any, map[string]any) in FormField.TypeOptions; CheckOptions (when non-nil) errors fail boot naming field and type. Core types keep today's path byte for byte. FormField gains Element, Translatable, TypeOptions (JSON element, translatable, typeOptions, omitempty) and an unexported fieldType pointer (json "-"). CompileForm keeps its signature and core-only behaviour (a plugin alias stays "unsupported type"); add CompileFormWithTypes(pluginID, ctl, fsys, types) that runs the alias and option checks (element prefix and assets are checked by Activate). settings.go and relation_form.go use a refusing registry: a plugin alias there fails boot with "plugin field type <name> is supported in controller forms only" (assumption A5).
 
-Save and show (D-12.2, D-12.3, D-10 mapping): the scalarFormField checks at crud.go BindWritableFields and mergedRules also accept a field with a plugin type, so it binds to its column and `required` works. New liftPluginValues(cc, body, op), called next to liftMLValues before the transaction, removes the values of non-translatable plugin fields present in the body whose context allows op and keeps them as raw JSON values (projection would drop nested ones). New decodePluginFields, called inside the transaction after projectOperation and before lagoon.Fill, runs Decode with FormFieldValue{DB: tx, Record: target, Field, Options, Default: true, Value} and sets projected[field] to the result; a *pact.FormFieldError becomes &ValidationError{Details: {field: Messages}} (422 validation_failed); any other error goes through lifecycleFailure (opaque 500, no plugin text). New hydratePluginFields runs after hydrateMLRecord in ShowRecord and at the end of save: data[field] = Load(...) with Value = the projected stored value; nil Load keeps the value; a Load error is an opaque 500.
+Save and show (D-12.2, D-12.3, D-10 mapping): the scalarFormField checks at crud.go BindWritableFields and mergedRules also accept a field with a plugin type, so it binds to its column and `required` works. New liftPluginValues(cc, body, op), called next to liftMLValues before the transaction, removes the values of non-translatable plugin fields present in the body whose context allows op and keeps them as raw JSON values (projection would drop nested ones). New decodePluginFields, called inside the transaction after projectOperation and before lagoon.Fill, runs Decode with FormFieldValue{DB: tx, Record: target, Field, Options, Default: true, Value}, sets projected[field] to the result's Value and keeps the result's Notices with the field name; a *pact.FormFieldError becomes &ValidationError{Details: {field: Messages}} (422 validation_failed) and discards every collected notice; any other error goes through lifecycleFailure (opaque 500, no plugin text). New hydratePluginFields runs after hydrateMLRecord in ShowRecord and at the end of save: data[field] = Load(...) with Value = the projected stored value; nil Load keeps the value; a Load error is an opaque 500. So the save response always carries the stored value, which the SPA adopts into the form (the reload D-10 asks for).
 
-Route (D-13): GET {api}/field-types behind the backend guard (handler fieldTypesList) answers the FieldTypesResponse shape in the interfaces block, [] when no plugin registers a type. Annotate it in admin_openapi.go (FieldTypeAssets, FieldTypesResponse) and document the FormField keys; add "GET /field-types" to phase09Routes; run bash scripts/check-admin-openapi.sh (writes admin/openapi/admin.json and admin/src/api/schema.d.ts) and add the FieldTypeAssets alias to admin/src/api/types.ts.
+Notices (D-10, framework half): after the transaction commits, new localizeNotices(ctx, s.tr, collected) turns each notice into a FieldNotice{Field, Locale, Message} in the request locale, the way localizeForbidden localizes a refusal: Message is a phrase key or text, resolved with tr.Choice(ctx, key, Count, Params) when Count > 0 and tr.Get(ctx, key, Params) otherwise; a nil translator keeps the text. At most 10 notices per field and locale are kept and each localized message is cut to 500 runes with an ellipsis. RecordMeta (relation_field.go) gains Notices []FieldNotice with json "notices,omitempty", set on the RecordResult that create and update write; with no notice the encoded response is byte-for-byte today's.
+
+Route (D-13): GET {api}/field-types behind the backend guard (handler fieldTypesList) answers the FieldTypesResponse shape in the interfaces block, [] when no plugin registers a type. Annotate it in admin_openapi.go (FieldTypeAssets, FieldTypesResponse), document the FormField keys and the optional RecordMeta notices (FieldNotice); add "GET /field-types" to phase09Routes; run bash scripts/check-admin-openapi.sh (writes admin/openapi/admin.json and admin/src/api/schema.d.ts) and add the FieldTypeAssets alias to admin/src/api/types.ts.
 
 SPA (D-13, D-15): pluginAssets.ts gains GLOBAL_STYLE_OWNER = '*' and loadGlobalStyles(urls), whose links activateStyles never disables (Pitfall 8). New admin/src/app/fieldTypes.ts: loadFieldTypes() GETs /field-types, loads each script once through loadScript, adds styles through loadGlobalStyles and resolves to the list; it never rejects (a failed script surfaces later as that field's failure state). main.ts calls it with loadNavigation when signed in; LoginView calls it after login. formContext.ts adds FIELD_CHANGE_EVENT = 'summer-change'. New PluginField.vue modelled on WidgetField.vue (same header rule: never a token, cookie, function or Vue instance; imperative element in a mount point; status loading, ready or failed with WIDGET_TIMEOUT; ExtensionFailure): it sets the element's value property from modelValue only when it differs from element.value, sets the attributes of the element contract (field-name, record-id, locale empty for a plain type, ui-locale from FORM_LOCALE, options as JSON of typeOptions, disabled, invalid), and emits update:modelValue with detail.value on summer-change. registry.ts adds rendererForField(field) and isRegisteredField(field): a field with an element renders PluginField and counts as a value field; FieldRenderer, PreviewField and formState's editable check switch to them; FormField's group label treats a plugin field as a group. Rebuild dist with npm --prefix admin run build.
 
-Smoke tests: modules/cabana/field_type_smoke_test.go TestFieldTypeTracerSmoke (no database): a fake plugin "acme.demo" whose AdminFS (fstest.MapFS) holds assets/js/notes.js registers type "notes" with element "acme-demo-notes", option key "rows", a Decode that refuses the string "bad" with a FormFieldError and otherwise returns the value, and a Load that prefixes "served:"; subtests: alias collision with a second plugin and with "markdown" fail boot; an unknown key and a CheckOptions error fail boot; GET /field-types through httptest lists notes with a ?v= script URL; GET schema/form carries element and typeOptions; decodePluginFields on a stub record sets projected["notes"] and maps "bad" to a ValidationError on "notes"; hydratePluginFields serves the "served:" value. admin/tests/form/PluginField.test.ts: a stub custom element; mounting PluginField sets the value property and the attributes; a summer-change event emits update:modelValue; an echo of the same value does not set the property again; an undefined tag ends in the failure state.
+Smoke tests: modules/cabana/field_type_smoke_test.go TestFieldTypeTracerSmoke (no database): a fake plugin "acme.demo" whose AdminFS (fstest.MapFS) holds assets/js/notes.js registers type "notes" with element "acme-demo-notes", option key "rows", a Decode that refuses the string "bad" with a FormFieldError, trims surrounding spaces and reports that with the notice Message "acme.demo::lang.trimmed" (Count 1), and otherwise returns the value with no notice, and a Load that prefixes "served:"; subtests: alias collision with a second plugin and with "markdown" fail boot; an unknown key and a CheckOptions error fail boot; GET /field-types through httptest lists notes with a ?v= script URL; GET schema/form carries element and typeOptions; decodePluginFields on a stub record sets projected["notes"] and maps "bad" to a ValidationError on "notes"; a value " x " is stored as "x" and localizeNotices yields one FieldNotice for "notes" (a nil translator keeps the key text); the JSON encoding of a RecordMeta without notices has no "notices" key; hydratePluginFields serves the "served:" value. admin/tests/form/PluginField.test.ts: a stub custom element; mounting PluginField sets the value property and the attributes; a summer-change event emits update:modelValue; an echo of the same value does not set the property again; an undefined tag ends in the failure state.
 
-Docs (CLAUDE.md documentation rules, neutral names only): pact README (Features and API reference rows for each new pact identifier); cabana README (the GET /field-types row in Admin API routes, CompileFormWithTypes and the FormField keys in API reference); new docs/backend/field-types.md (front matter title "Plugin field types", section backend, order 25) covering registration, aliases, options, Decode and Load and the element contract; a link from docs/backend/forms.md where the supported field types are listed. Commit as feat(pact), feat(cabana) and feat(admin) commits, each with its README, docs, OpenAPI or dist changes, staged by explicit path.</action>
+Docs (CLAUDE.md documentation rules, neutral names only): pact README (Features and API reference rows for each new pact identifier, FormFieldDecoded and FormFieldNotice included); cabana README (the GET /field-types row in Admin API routes, CompileFormWithTypes, FieldNotice, the meta.notices key of the create and update responses and the FormField keys in API reference); new docs/backend/field-types.md (front matter title "Plugin field types", section backend, order 25) covering registration, aliases, options, Decode (value, notices, refusal) and Load and the element contract; a link from docs/backend/forms.md where the supported field types are listed. Commit as feat(pact), feat(cabana) and feat(admin) commits, each with its README, docs, OpenAPI or dist changes, staged by explicit path.</action>
   <verify>
     <automated>go vet ./modules/pact ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestFieldTypeTracerSmoke|TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestFormSchemaCompile|TestFormSchemaRejects)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 5</automated>
     <fails_when>Non-zero exit: vet fails, or fewer than five top-level "--- PASS: Test" lines (the tracer smoke is missing or failing, or the route inventory, permission matrix or schema tests regressed).</fails_when>
@@ -360,14 +410,15 @@ Docs (CLAUDE.md documentation rules, neutral names only): pact README (Features
     <fails_when>Non-zero exit: vue-tsc reports a type error, a vitest file fails or is not found, check-admin-openapi prints "committed admin OpenAPI output is stale", check-admin-dist prints "modules/boardwalk/dist is stale", or TestDocsTree reports an identifier, link or anchor the docs name that does not exist.</fails_when>
   </verify>
   <acceptance_criteria>
-    - `grep -n "type HasFormFieldTypes interface" modules/pact/capabilities.go` prints one line, and `grep -n "func compileFieldTypes" modules/cabana/field_type.go` prints one line.
-    - `grep -n '"GET /field-types"' modules/cabana/security_coverage_test.go` prints one line and admin/openapi/admin.json contains the path "/field-types".
-    - TestFieldTypeTracerSmoke passes with subtests for: collision between two plugins, collision with markdown, unknown key, CheckOptions error, the field-types route, schema keys element and typeOptions, Decode success and FormFieldError mapping, Load on show.
+    - `grep -n "type HasFormFieldTypes interface" modules/pact/capabilities.go`, `grep -n "type FormFieldDecoded struct" modules/pact/capabilities.go` and `grep -n "func compileFieldTypes" modules/cabana/field_type.go` each print one line.
+    - `grep -n 'json:"notices,omitempty"' modules/cabana/relation_field.go` prints one line and `grep -n "func localizeNotices" modules/cabana/*.go` prints one line.
+    - `grep -n '"GET /field-types"' modules/cabana/security_coverage_test.go` prints one line and admin/openapi/admin.json contains the path "/field-types" and the property "notices".
+    - TestFieldTypeTracerSmoke passes with subtests for: collision between two plugins, collision with markdown, unknown key, CheckOptions error, the field-types route, schema keys element and typeOptions, Decode success, Decode notice to FieldNotice, no notices key without notices, FormFieldError mapping, Load on show.
     - PluginField.test.ts passes, including the echo case (no second property write for an equal value).
     - check-admin-openapi --check, check-admin-dist and TestDocsTree pass; docs/backend/field-types.md has front matter section backend.
     - `grep -rniE 'journal|grzyby' modules/pact/README.md modules/cabana/README.md docs/backend/field-types.md` prints nothing (neutral names).
   </acceptance_criteria>
-  <done>A fake plugin's non-translatable type compiles at boot, appears in the form schema and the field-types list, is decoded on save and loaded on show, and the SPA renders its element with a two-way value binding.</done>
+  <done>A fake plugin's non-translatable type compiles at boot, appears in the form schema and the field-types list, is decoded on save (its notices reach meta.notices, and a save without notices answers as before) and loaded on show, and the SPA renders its element with a two-way value binding.</done>
 </task>
 
 <task type="auto" tdd="true">
@@ -376,14 +427,15 @@ Docs (CLAUDE.md documentation rules, neutral names only): pact README (Features
   <read_first>modules/cabana/field_type.go (Task 2 state), modules/cabana/field_ml.go, modules/cabana/crud.go (save, ShowRecord, BindWritableFields column binding helpers modelFields and gormColumn), modules/cabana/tx_context.go, modules/cabana/list_schema.go (listColumnTypes at 22, compileColumns at 200), modules/cabana/http.go (projectRow at 1067, the fileupload routes at 335-347, protect at 1030), modules/cabana/field_file.go (fileUpload and fileUploadOn at 684-760: MaxBytesReader, multipart, transaction, scope), modules/cabana/csrf.go (requireAjax), modules/cabana/locale_order_test.go (recordingWriter: fake TranslationWriter style), modules/cabana/admin_openapi.go (file upload annotations near line 1156), modules/cabana/README.md, docs/backend/field-types.md, docs/backend/admin-controllers.md (VirtualFieldsFromContext section: style for the writes accessor)</read_first>
   <behavior>
     - Translatable type: a body map {en, pl} with pl default runs Decode once per locale; pl lands on the host column, en goes through TranslationWriter.WriteTranslated; a FormFieldError on en is a 422 on the field and nothing is written.
-    - Untouched (D-03): on update, a submitted per-locale value equal to the served value (Load of the stored value) is neither decoded nor written; on create nothing is skipped.
+    - Notices per locale (D-10): a notice returned for en becomes a FieldNotice with field and locale "en", one for the default locale carries locale "pl"; a non-translatable type's notices carry no locale; a FormFieldError on any locale answers 422 with no notices.
+    - Untouched (D-03): on update, a submitted per-locale value equal to the served value (Load of the stored value) is neither decoded nor written and yields no notice; on create nothing is skipped.
     - FieldWritesFromContext inside FormBeforeUpdate and FormAfterUpdate lists exactly the written (field, locale) values with Default set for the host value; it returns false outside a save.
     - A list column typed "notes" shows ListValue(value); without ListValue the raw value is kept.
     - Upload route: 201 {data:{url}} from Upload; 404 for a core-typed field or a type without Upload; 403 without the controller permission; missing X-Requested-With refused by requireAjax; over the cap 413; FormFieldError 422 on the field; id 0 passes Record nil.
   </behavior>
   <action>Extend Task 2's runner (per D-03, D-06, D-10, D-12.4, D-14, D-18).
 
-Translatable types (D-14, D-06): add isMLField(field FormField) bool = mlFieldType(field.Type) or a plugin type with Translatable; switch the field loops in liftMLValues and hydrateMLRecord to it, so a translatable plugin field is lifted (locale to string map, default required, enabled locales only) and hydrated exactly like mlmarkdown. decodePluginFields then handles translatable fields per locale: the default-locale value is decoded into projected[field]; non-default values are decoded and replace the matching entries of the translations list that applyMLTranslations writes. A translatable Decode must return a string; any other result type is an opaque 500. FormFieldValue.Translated is a closure over TranslationWriter.TranslatedExact(ctx, tx, record, attribute, locale) for the same record and locale (nil without a writer). hydratePluginFields applies Load per locale to the hydrated map.
+Translatable types (D-14, D-06): add isMLField(field FormField) bool = mlFieldType(field.Type) or a plugin type with Translatable; switch the field loops in liftMLValues and hydrateMLRecord to it, so a translatable plugin field is lifted (locale to string map, default required, enabled locales only) and hydrated exactly like mlmarkdown. decodePluginFields then handles translatable fields per locale: the default-locale value is decoded into projected[field]; non-default values are decoded and replace the matching entries of the translations list that applyMLTranslations writes. Every locale's notices are kept with that locale (FieldNotice.Locale), the default locale included. A translatable Decode's FormFieldDecoded.Value must be a string; any other result type is an opaque 500. FormFieldValue.Translated is a closure over TranslationWriter.TranslatedExact(ctx, tx, record, attribute, locale) for the same record and locale (nil without a writer). hydratePluginFields applies Load per locale to the hydrated map.
 
 Untouched skip (D-03 server half, RESEARCH Pattern 3): new servedFieldValue computes what Show serves for a field and locale on the loaded target (host value read through the same column binding BindWritableFields uses, pointers dereferenced; non-default from TranslatedExact, missing = ""), then Load. On update, decodePluginFields compares the submitted value with the served value by canonical encoding/json bytes and skips equal ones entirely (not in projected, not in translations). On create nothing is skipped.
 
@@ -395,7 +447,7 @@ Upload route (D-18, RESEARCH Pattern 9): new modules/cabana/field_type_upload.go
 
 Tests: TestFieldTypeExpansionSmoke in field_type_smoke_test.go (no database; a recording TranslationWriter in the locale_order_test.go style; a translatable fake type "notesml"; the upload route through httptest with id 0 and a principal context as the existing route tests build it) covering every behavior bullet above.
 
-Docs: cabana README rows for FieldWrite, FieldWritesFromContext, WithFieldWrites and the upload route, and a note that settings and relation forms refuse plugin field types; docs/backend/field-types.md sections "Translatable types", "Untouched values", "Companion columns in Form hooks" (with FieldWritesFromContext) and "Uploads"; neutral names only. Commit as feat(cabana) with the README, docs and OpenAPI files, staged by explicit path.</action>
+Docs: cabana README rows for FieldWrite, FieldWritesFromContext, WithFieldWrites and the upload route, and a note that settings and relation forms refuse plugin field types; docs/backend/field-types.md sections "Translatable types", "Untouched values", "Notices" (FormFieldDecoded notices, per-locale FieldNotice, localization, the 10-per-field and 500-rune caps, no key without notices), "Companion columns in Form hooks" (with FieldWritesFromContext) and "Uploads"; neutral names only. Commit as feat(cabana) with the README, docs and OpenAPI files, staged by explicit path.</action>
   <verify>
     <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke|TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestListRelationSearchSmoke|TestEnabledLocalesDefaultFirstSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 6</automated>
     <fails_when>Non-zero exit: vet fails, or fewer than six top-level "--- PASS: Test" lines (the expansion smoke fails or is missing, or an existing route, permission, relation-search or locale-order smoke regressed).</fails_when>
@@ -405,23 +457,25 @@ Docs: cabana README rows for FieldWrite, FieldWritesFromContext, WithFieldWrites
   <acceptance_criteria>
     - `grep -n "func FieldWritesFromContext" modules/cabana/tx_context.go` and `grep -n "func WithFieldWrites" modules/cabana/tx_context.go` each print one line.
     - `grep -n 'fields/{field}/upload' modules/cabana/http.go modules/cabana/security_coverage_test.go modules/cabana/admin_openapi.go` prints at least one line per file.
-    - TestFieldTypeExpansionSmoke has passing subtests for: per-locale Decode with default on the host and non-default through the writer, a non-default FormFieldError 422 with no write, untouched skip on update for host and translation, no skip on create, the writes accessor in Before and After hooks, ListValue in projectRow, and the upload route answers 201, 404 (core field), 403 (no permission), 413 (over the cap) and 422 (FormFieldError).
+    - TestFieldTypeExpansionSmoke has passing subtests for: per-locale Decode with default on the host and non-default through the writer, per-locale notices with their locale, a non-default FormFieldError 422 with no write and no notices, untouched skip on update for host and translation (no notice), no skip on create, the writes accessor in Before and After hooks, ListValue in projectRow, and the upload route answers 201, 404 (core field), 403 (no permission), 413 (over the cap) and 422 (FormFieldError).
     - The OpenAPI check, typecheck and TestDocsTree pass.
   </acceptance_criteria>
-  <done>Translatable plugin types store through the existing ML path, untouched values are never written, hooks can see what was written, list columns format through the type, and the upload route is mounted, documented and permissioned.</done>
+  <done>Translatable plugin types store through the existing ML path with per-locale notices, untouched values are never written, hooks can see what was written, list columns format through the type, and the upload route is mounted, documented and permissioned.</done>
 </task>
 
 <task type="auto" tdd="true">
-  <name>Task 4: Expansion (SPA): MLPluginField, element uploads through the SPA, plugin list columns, docs and dist</name>
-  <files>admin/src/components/form/fields/MLPluginField.vue, admin/src/components/form/fields/PluginField.vue, admin/src/components/form/registry.ts, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/views/FormView.vue, admin/src/views/ListView.vue, admin/src/components/relation/RelationChildModal.vue, admin/tests/form/PluginField.test.ts, modules/boardwalk/dist, docs/backend/field-types.md</files>
-  <read_first>admin/src/components/form/fields/PluginField.vue (Task 2 state), admin/src/components/form/fields/MLField.vue, admin/src/components/form/fields/MLMarkdownField.vue, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts (isMLFieldType callers at 68, 139, 187, 228-233), admin/src/views/FormView.vue (isMLFieldType at 180 and 252), admin/src/components/relation/RelationChildModal.vue (isMLFieldType at 221), admin/src/views/ListView.vue (column cell rendering), admin/src/api/files.ts (multipart upload with X-Requested-With and failure kinds), admin/src/api/client.ts, admin/tests/form/MLFields.test.ts, admin/tests/form/PluginField.test.ts, docs/backend/field-types.md</read_first>
+  <name>Task 4: Expansion (SPA): MLPluginField, element uploads through the SPA, plugin list columns, save notices, docs and dist</name>
+  <files>admin/src/components/form/fields/MLPluginField.vue, admin/src/components/form/fields/PluginField.vue, admin/src/components/form/registry.ts, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts, admin/src/components/form/formContext.ts, admin/src/components/form/FormGrid.vue, admin/src/components/form/FormField.vue, admin/src/views/FormView.vue, admin/src/views/ListView.vue, admin/src/components/relation/RelationChildModal.vue, admin/tests/form/PluginField.test.ts, admin/tests/form/FormField.test.ts, admin/tests/form/formState.test.ts, modules/boardwalk/dist, docs/backend/field-types.md</files>
+  <read_first>admin/src/components/form/fields/PluginField.vue (Task 2 state), admin/src/components/form/fields/MLField.vue, admin/src/components/form/fields/MLMarkdownField.vue, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts (isMLFieldType callers at 68, 139, 187, 228-233), admin/src/views/FormView.vue (isMLFieldType at 180 and 252, adopt at 173, save at 315, the saved toast at 337), admin/src/components/form/FormGrid.vue (errors per field at 47), admin/src/components/form/FormField.vue (errors prop, error line, aria-describedby), admin/src/main.css (.summer-callout--warning near line 400), admin/src/components/relation/RelationChildModal.vue (isMLFieldType at 221), admin/src/views/ListView.vue (column cell rendering), admin/src/api/files.ts (multipart upload with X-Requested-With and failure kinds), admin/src/api/client.ts, admin/tests/form/MLFields.test.ts, admin/tests/form/PluginField.test.ts, admin/tests/form/FormField.test.ts, docs/backend/field-types.md</read_first>
   <behavior>
     - A field with element and translatable renders MLPluginField: the locale switcher of MLField around PluginField; the element gets the active content locale in its locale attribute and that locale's string as value; summer-change updates only that locale in the map.
     - isMLField(field) is true for mltext, mltextarea, mlmarkdown and for a field with element and translatable; formState initial values, editable payload, adopt and record display name treat such a field as a locale map.
     - summer-upload {id, file} posts multipart to the field upload route with the form's vendor, plugin, controller, record id (0 on create) and field name, then dispatches summer-upload-result {id, url} on success and {id, error} with the server message on 422, 413 or a network failure.
     - A list column whose type is not built in renders its value as plain text.
+    - Notices (D-10): a save answer with meta.notices shows each message under its field (prefixed with the upper-case locale for a translatable field) as a warning status line, and the saved toast appends the messages; the lines clear on the next save attempt; a save answer without notices shows none and the toast text is unchanged; a notice that looks like HTML renders as literal text.
+    - After a save whose stored value differs from what the element holds (a type stripped something), the form value equals the response's value and PluginField sets the element's value property once to it.
   </behavior>
-  <action>Finish the SPA half (per D-06, D-13, D-14, D-18).
+  <action>Finish the SPA half (per D-06, D-10, D-13, D-14, D-18).
 
 ML (D-14): new MLPluginField.vue in the MLMarkdownField.vue shape: MLField with :inner="PluginField", inner-type = field.type and ml-type = field.type; PluginField accepts an optional content-locale prop that MLField's inner rendering supplies and writes it to the locale attribute. mlLocale.ts gains isMLField(field) (keep isMLFieldType exported unchanged); switch the callers in formState.ts, FormView.vue and RelationChildModal.vue to the field-based check. rendererForField returns MLPluginField for a translatable plugin field; groupLabelled is true for it.
 
@@ -429,20 +483,23 @@ Uploads (D-18): formContext.ts adds FIELD_UPLOAD_EVENT = 'summer-upload' and FIE
 
 Lists (D-12.4): make ListView render a column whose type has no built-in renderer as plain text of the row value (the server already sent the ListValue string), if it does not already.
 
-Tests: extend admin/tests/form/PluginField.test.ts with the ML wrapper (two locales, locale attribute, per-locale change), the upload round trip (mocked fetch: success, 422 message, network failure) and isMLField on the formState helpers.
+Notices (D-10, generic for any field type): formState.ts exports noticeLines(notices) returning a field name to message list map, where a notice with a locale reads "<LOCALE>: message". FormView keeps a notices ref, clears it when a save starts, and after a successful create or update sets it from result.data.meta.notices (absent means none); it passes it through FormGrid to FormField the same way it passes errors. FormField gains an optional notices prop rendered under the control as a status line in the existing warning callout tone (summer-callout--warning, role="status", referenced by aria-describedby), with text interpolation only, never as raw HTML. The saved toast appends the joined notice messages, so "Zapisz i zamknij", which navigates away, still tells the admin. adopt(result.data) already reloads the stored values; keep PluginField's echo rule, so the element gets the stored value exactly when it differs from element.value.
 
-Docs and dist: docs/backend/field-types.md gains the full element contract (value, attributes, summer-change, summer-upload, summer-upload-result, the echo rule, --c-* only, no credentials) and the translatable variant; rebuild with npm --prefix admin run build and commit modules/boardwalk/dist with the SPA change as feat(admin), staged by explicit path.</action>
+Tests: extend admin/tests/form/PluginField.test.ts with the ML wrapper (two locales, locale attribute, per-locale change), the upload round trip (mocked fetch: success, 422 message, network failure), the reload of a changed stored value, and isMLField on the formState helpers; FormField.test.ts with the notice line (literal text for an HTML-looking message, aria-describedby, none without notices); formState.test.ts with noticeLines (locale prefix, no locale, empty).
+
+Docs and dist: docs/backend/field-types.md gains the full element contract (value, attributes, summer-change, summer-upload, summer-upload-result, the echo rule, --c-* only, no credentials), the translatable variant and how the admin shows notices; rebuild with npm --prefix admin run build and commit modules/boardwalk/dist with the SPA change as feat(admin), staged by explicit path.</action>
   <verify>
     <automated>npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree</automated>
     <fails_when>Non-zero exit: a type error, any vitest file failing (including MLFields, FormView, ListView and the extended PluginField tests), check-admin-dist printing "modules/boardwalk/dist is stale", or TestDocsTree reporting a missing identifier or anchor.</fails_when>
   </verify>
   <acceptance_criteria>
     - `grep -n "export function isMLField" admin/src/components/form/mlLocale.ts` prints one line, and FormView.vue, formState.ts and RelationChildModal.vue call isMLField.
-    - PluginField.test.ts passes its ML, upload (success, 422, network) and isMLField cases; the full vitest suite passes.
-    - docs/backend/field-types.md documents summer-change, summer-upload and summer-upload-result.
+    - `grep -n "export function noticeLines" admin/src/components/form/formState.ts` prints one line, `grep -n "meta.notices\|meta?.notices" admin/src/views/FormView.vue` prints at least one line, and `grep -n "v-html" admin/src/components/form/FormField.vue` prints nothing.
+    - PluginField.test.ts passes its ML, upload (success, 422, network), stored-value reload and isMLField cases; FormField.test.ts and formState.test.ts pass their notice cases; the full vitest suite passes.
+    - docs/backend/field-types.md documents summer-change, summer-upload, summer-upload-result and notices.
     - check-admin-dist passes with the rebuilt dist committed.
   </acceptance_criteria>
-  <done>Translatable plugin fields switch locales like mlmarkdown, elements upload through the SPA without credentials, plugin list columns render, and the docs describe the full contract.</done>
+  <done>Translatable plugin fields switch locales like mlmarkdown, elements upload through the SPA without credentials, plugin list columns render, save notices show under the field and in the toast, and the docs describe the full contract.</done>
 </task>
 
 </tasks>
@@ -466,8 +523,9 @@ Docs and dist: docs/backend/field-types.md gains the full element contract (valu
 | T-16.2-04 | Denial of Service | fieldUpload body | medium | mitigate | http.MaxBytesReader with http.body_limits.upload_bytes (413), exactly one multipart part |
 | T-16.2-05 | Information Disclosure | PluginField / element | high | mitigate | The element receives only the value property and plain attributes; uploads are performed by the SPA; no token, cookie, function or Vue instance is ever passed (test asserts attributes only) |
 | T-16.2-06 | Tampering | typeOptions to element | low | mitigate | Options reach the element only as a JSON attribute string; the SPA never renders them as HTML |
-| T-16.2-07 | Information Disclosure | plugin errors | medium | mitigate | Only pact.FormFieldError messages reach the client (422); any other Decode, Load or Upload error is an opaque 500 through lifecycleFailure |
+| T-16.2-07 | Information Disclosure | plugin errors | medium | mitigate | Only pact.FormFieldError messages (422) and FormFieldNotice messages (meta.notices) reach the client; any other Decode, Load or Upload error is an opaque 500 through lifecycleFailure |
 | T-16.2-08 | Tampering | untouched skip | low | accept | An attacker who submits the served value only causes no write; the skip cannot store anything that Decode did not already accept |
+| T-16.2-33 | Tampering (admin XSS) / Denial of Service | save notices (localizeNotices, FormField notice line) | medium | mitigate | A notice can quote attacker-written markup (for example a removed tag name); the SPA renders notices with text interpolation only, never v-html (acceptance grep and an HTML-looking-message test); cabana keeps at most 10 notices per field and locale and cuts each localized message to 500 runes, so a value with thousands of removed parts cannot inflate the response |
 | T-16.2-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package is installed by this plan: Go has no new dependency and the admin SPA builds from its committed lockfile |
 </threat_model>
 
@@ -481,7 +539,7 @@ Docs and dist: docs/backend/field-types.md gains the full element contract (valu
 
 <success_criteria>
 - D-11 to D-15 implemented in pact, cabana and the SPA with fail-loud boot checks.
-- D-03 server skip, D-10 refusal mapping, D-06/D-14 storage through the existing ML path, D-18 upload route in place.
+- D-03 server skip, D-10 notices (meta.notices only when a Decode reported something, shown under the field and in the toast, stored value reloaded) and refusal mapping, D-06/D-14 storage through the existing ML path, D-18 upload route in place.
 - OpenAPI, TS types, dist, READMEs and docs updated in the same changes; no framework doc names a consuming application.
 </success_criteria>
 

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md

@@ -0,0 +1,264 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 01
+subsystem: admin
+tags: [pact, cabana, admin-spa, field-types, custom-elements, i18n, uploads, openapi]
+
+requires:
+  - phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+    provides: bluemonday-era Journal plugin and the v0.1.17 framework release this API builds on
+provides:
+  - pact plugin field type API (HasFormFieldTypes, FormFieldType, FormFieldValue, FormFieldDecoded, FormFieldNotice, FormFieldUpload, FormFieldUploadResult, FormFieldError)
+  - cabana per-boot field type registry, compile checks, Decode/Load/ListValue runner, translatable storage through the ML path, untouched skip, meta.notices
+  - cabana FieldWrite, FieldWritesFromContext, WithFieldWrites, CompileFormWithTypes, FieldTypeAssets, FieldTypesResponse, FieldUploadResponse, FieldNotice, RecordMeta.Notices
+  - routes GET {api}/field-types and POST {api}/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload
+  - admin SPA global field type loader, PluginField and MLPluginField element hosts, element uploads, save notices
+affects: [16.2-02, 16.2-03, 16.2-05, 16.2-06, journal, payment]
+
+actuals:
+  tokens: 62800
+  tasks: 4
+  commits: 5
+plan_head_before: 0754a6e5ab88b1a4ad3b6fc3599a338490220077
+plan_head_after: 4adb48a76e5bd81f589385d22fc82a5c55dcb3e7
+
+tech-stack:
+  added: []
+  patterns:
+    - "Plugin capability registry built per Activate (compileFieldTypes) and passed down the compile functions; no package-level registry"
+    - "Untouched-value skip by canonical encoding/json comparison against the served value (Load of the stored value)"
+    - "Global plugin stylesheets owned by GLOBAL_STYLE_OWNER, never disabled by activateStyles"
+
+key-files:
+  created:
+    - modules/cabana/field_type.go
+    - modules/cabana/field_type_upload.go
+    - modules/cabana/field_type_smoke_test.go
+    - modules/cabana/example_field_type_test.go
+    - admin/src/app/fieldTypes.ts
+    - admin/src/components/form/fields/PluginField.vue
+    - admin/src/components/form/fields/MLPluginField.vue
+    - admin/tests/form/PluginField.test.ts
+    - docs/backend/field-types.md
+  modified:
+    - modules/pact/capabilities.go
+    - modules/pact/README.md
+    - modules/cabana/form_schema.go
+    - modules/cabana/schema_types.go
+    - modules/cabana/registry.go
+    - modules/cabana/contracts.go
+    - modules/cabana/http.go
+    - modules/cabana/crud.go
+    - modules/cabana/field_ml.go
+    - modules/cabana/tx_context.go
+    - modules/cabana/list_schema.go
+    - modules/cabana/query.go
+    - modules/cabana/settings.go
+    - modules/cabana/relation.go
+    - modules/cabana/relation_form.go
+    - modules/cabana/relation_field.go
+    - modules/cabana/extension.go
+    - modules/cabana/admin_openapi.go
+    - modules/cabana/security_coverage_test.go
+    - modules/cabana/phase10_coverage_test.go
+    - modules/cabana/phase10_csrf_test.go
+    - modules/cabana/README.md
+    - admin/openapi/admin.json
+    - admin/src/api/schema.d.ts
+    - admin/src/api/types.ts
+    - admin/src/app/pluginAssets.ts
+    - admin/src/main.ts
+    - admin/src/views/LoginView.vue
+    - admin/src/views/FormView.vue
+    - admin/src/components/form/registry.ts
+    - admin/src/components/form/FieldRenderer.vue
+    - admin/src/components/form/PreviewField.vue
+    - admin/src/components/form/FormField.vue
+    - admin/src/components/form/FormGrid.vue
+    - admin/src/components/form/formState.ts
+    - admin/src/components/form/formContext.ts
+    - admin/src/components/form/mlLocale.ts
+    - admin/src/components/form/fields/MLField.vue
+    - admin/src/components/relation/RelationChildModal.vue
+    - admin/tests/form/FormField.test.ts
+    - admin/tests/form/formState.test.ts
+    - admin/tests/list/CellValue.test.ts
+    - modules/boardwalk/dist
+    - docs/backend/forms.md
+    - docs/backend/lists-and-filters.md
+
+key-decisions:
+  - "pact.FormFieldType.ListValue is func(ctx context.Context, value any) string (human adjust at the Task 1 checkpoint); plans 03, 05 and 06 must use the ctx form"
+  - "The plugin field type registry is built per Activate by compileFieldTypes and passed down; CompileForm, compileRegistry, compileList, compileRelations and compileSetting keep their signatures as nil-registry wrappers"
+  - "Only a pact.FormFieldError from Decode or Upload is a 422 (messages localized); every other plugin error, Load errors included, is the opaque lifecycle 500"
+  - "Untouched values (D-03 server half) are skipped on update when the canonical encoding/json of the submitted value equals the served value (stored host value or exact translation, then Load)"
+  - "FieldTypesResponse is the GET /field-types envelope {data, meta}; FieldUploadResponse is the upload data object {url}, served as Envelope[FieldUploadResponse]"
+
+patterns-established:
+  - "Plugin field type: alias + element + assets + options + Go funcs; cabana owns routes, permissions, scope, locale storage, notices and the untouched skip"
+  - "Element contract: value property, plain attributes, summer-change, summer-upload/summer-upload-result; no credentials, --c-* only"
+
+requirements-completed: [D-03, D-06, D-10, D-11, D-12, D-13, D-14, D-15, D-18]
+
+coverage:
+  - id: D1
+    description: "pact field type API and cabana boot checks: alias collisions (two plugins, core type), element prefix, unknown keys, CheckOptions errors, settings/relation refusal"
+    requirement: D-11
+    verification:
+      - kind: unit
+        ref: "modules/cabana/field_type_smoke_test.go#TestFieldTypeTracerSmoke"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Save decodes plugin values (FormFieldError 422, opaque 500 otherwise), meta.notices only when a type reported something, Show/save serve through Load, GET /field-types and form schema keys"
+    requirement: D-12
+    verification:
+      - kind: unit
+        ref: "modules/cabana/field_type_smoke_test.go#TestFieldTypeTracerSmoke"
+        status: pass
+      - kind: unit
+        ref: "modules/cabana/example_field_type_test.go#ExampleCompileFormWithTypes"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Translatable types per locale through the ML path, per-locale notices, untouched skip on update, FieldWritesFromContext in Form hooks, ListValue list columns, upload route (201, 404, 403, CSRF, 413, 422)"
+    requirement: D-14
+    verification:
+      - kind: unit
+        ref: "modules/cabana/field_type_smoke_test.go#TestFieldTypeExpansionSmoke"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Admin SPA: global field type loader, PluginField/MLPluginField, element uploads, save notices under fields and in the toast, stored value reload, plugin list columns as text"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "admin/tests/form/PluginField.test.ts"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/form/FormField.test.ts#save notices"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/form/formState.test.ts#noticeLines"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/list/CellValue.test.ts#plugin field type columns (16.2)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "OpenAPI, schema.d.ts, dist, READMEs and docs/backend/field-types.md describe the API with neutral names"
+    requirement: D-15
+    verification:
+      - kind: other
+        ref: "bash scripts/check-admin-openapi.sh --check && bash scripts/check-admin-dist.sh && go test ./cmd/summer -run TestDocsTree"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Postgres-backed save, show and upload with a real record (id != 0 upload path, real transaction, real translation writer)"
+    verification: []
+    human_judgment: true
+    rationale: "No Docker on this host (RESEARCH Pitfall 11); plan 06 runs these on a Docker host"
+
+duration: 34min
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 01: Plugin field type framework Summary
+
+**Plugins register value-bearing admin field types through pact.HasFormFieldTypes; cabana compiles, decodes (with localized meta.notices), loads, lists, uploads and stores them (translatable ones through the ML path, untouched values skipped), and the admin SPA hosts their custom elements globally with uploads and save notices.**
+
+## Performance
+
+- **Duration:** 34 min
+- **Started:** 2026-10-10T08:53:13Z
+- **Completed:** 2026-10-10T09:27:00Z
+- **Tasks:** 4 (Task 1 checkpoint resolved by the orchestrator, Tasks 2-4 executed)
+- **Files modified:** 51 (excluding the rebuilt dist assets)
+
+## Task 1 checkpoint (resolved)
+
+Baseline verify was run by the orchestrator (vet passed, 4 PASS lines, clean `git status --porcelain -- modules admin docs scripts`). Human reply, verbatim:
+
+> adjust: ListValue(ctx context.Context, value any) string
+
+Final identifier list used by Tasks 2-4: every pact and cabana identifier exactly as in the plan's `<interfaces>` block, except `pact.FormFieldType.ListValue` is `func(ctx context.Context, value any) string` (was `func(value any) string`). The element contract is unchanged (value property; attributes field-name, record-id, locale, ui-locale, options, disabled, invalid; events summer-change, summer-upload, summer-upload-result).
+
+**Note for plans 03, 05 and 06:** they refer to `ListValue` and must use the ctx form; plan 03's Journal `ListValue` implementation receives `ctx`.
+
+## Accomplishments
+
+- pact: `FormFieldType` (Name, Element, Translatable, Scripts, Styles, Options, CheckOptions, Decode, Load, ListValue with ctx, Upload), `FormFieldValue`, `FormFieldDecoded`, `FormFieldNotice`, `FormFieldUpload`, `FormFieldUploadResult`, `FormFieldError`, `HasFormFieldTypes`.
+- cabana boot: `compileFieldTypes` (alias shape, core-type and cross-plugin collisions naming both plugins, element prefix via `checkWidgetTag`, Decode required, option keys, assets through the extracted `readClientAssets`), passed to `compileRegistryWithTypes`; fields.yaml accepts a plugin alias with the general keys plus its options (`typeOptions`, `element`, `translatable` in the schema); `CheckOptions` at boot; settings and relation forms refuse plugin aliases; `CompileFormWithTypes`.
+- cabana save/show: `liftPluginValues`, `decodePluginFields` inside the transaction (per locale for translatable types, untouched skip on update via `servedFieldValue`), `localizeNotices` into `RecordMeta.Notices` (`meta.notices`, max 10 per field and locale, 500 runes), `hydratePluginFields` (per locale), `FieldWritesFromContext` for Form hooks, `isMLField` routing translatable types through `liftMLValues`/`applyMLTranslations`/`hydrateMLRecord`.
+- cabana list and routes: plugin aliases as column types with `ListValue` in `projectRowCtx`; `GET /field-types`; `POST .../{id}/fields/{field}/upload` (`fieldUpload`), annotated, in `phase09Routes`, CSRF inventories updated.
+- SPA: `loadFieldTypes` after boot and login, `loadGlobalStyles`/`GLOBAL_STYLE_OWNER`, `PluginField` (value/attributes/summer-change/echo rule/uploads), `MLPluginField`, `rendererForField`/`isRegisteredField`/`isMLField`, `noticeLines` with the notice status line in `FormField` and the saved toast, rebuilt `modules/boardwalk/dist`.
+- Docs: pact and cabana READMEs, new `docs/backend/field-types.md` (registration, aliases, options, Decode/notices/refusal, Load, notices, translatable types, untouched values, companion columns, list columns, uploads, full element contract), links from forms.md and lists-and-filters.md.
+
+## Task Commits
+
+1. **Task 1: Confirm the pact API** - resolved by the orchestrator (no commit)
+2. **Task 2: Tracer** - `1e20ace` (feat, pact), `717d46e` (feat, cabana + docs + OpenAPI), `83fa2f7` (feat, admin SPA + dist)
+3. **Task 3: Go expansion** - `8fa92db` (feat)
+4. **Task 4: SPA expansion** - `4adb48a` (feat)
+
+## Smoke test results
+
+- `go vet ./...` clean; `TestFieldTypeTracerSmoke` (15 subtests), `TestFieldTypeExpansionSmoke` (14 subtests), `TestPhase09ContractInventory`, `TestPhase09PermissionMatrix`, `TestFormSchemaCompile`, `TestFormSchemaRejects`, `TestListRelationSearchSmoke`, `TestEnabledLocalesDefaultFirstSmoke`, `TestPhase10CSRF`, `ExampleCompileFormWithTypes` pass.
+- `go test ./...`: the only failures are the testcontainers suites that need Docker (permission denied on /var/run/docker.sock), the same set as before this plan; no non-Docker failure message.
+- Admin: `npm run typecheck` clean, full vitest suite 77 files / 1190 tests pass, `check-admin-openapi.sh --check`, `check-admin-dist.sh`, `TestDocsTree` and `summer docs:build --check` pass.
+- Neutral names: `grep -rniE 'journal|grzyby' modules/pact/README.md modules/cabana/README.md docs/backend/field-types.md` prints nothing.
+
+## Decisions Made
+
+See key-decisions in the frontmatter. In short: ListValue takes ctx (human), the registry is passed down per boot with nil-registry wrappers for existing callers, only `pact.FormFieldError` is a 422, untouched detection compares canonical JSON with the served value, and the two response types are an envelope (`FieldTypesResponse`) and a data object (`FieldUploadResponse`).
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Route inventories outside the plan's file list**
+- **Found during:** Task 3
+- **Issue:** `TestPhase10CSRF` (counts 29 state-changing routes) and `TestPhase10Coverage/every unsafe mounted route is CSRF-walked` failed once the upload route was mounted.
+- **Fix:** Added the route to both inventories (29 -> 30).
+- **Files modified:** modules/cabana/phase10_csrf_test.go, modules/cabana/phase10_coverage_test.go
+- **Commit:** 8fa92db
+
+**2. [Rule 3 - Blocking] Docs Go snippets need src= references**
+- **Found during:** Task 2
+- **Issue:** TestDocsTree refuses a Go code block without `src=`.
+- **Fix:** Added `modules/cabana/example_field_type_test.go` (`NotesPlugin.FormFieldTypes`, `ExampleCompileFormWithTypes` with output) and referenced it from docs/backend/field-types.md (synced with `summer docs:sync`).
+- **Commit:** 717d46e
+
+**3. [Rule 2 - Correctness] Strict error mapping for plugin code**
+- **Found during:** Task 2
+- **Issue:** `lifecycleFailure` passes a plugin-returned `ValidationError` or `ForbiddenError` through; the plan allows only `pact.FormFieldError` to reach the client.
+- **Fix:** `fieldTypeFailure` maps only `*pact.FormFieldError` (messages localized) to 422; every other Decode/Upload error and every Load error is logged and becomes the opaque lifecycle 500.
+- **Commit:** 717d46e
+
+**4. Additional files touched for threading the registry and list values**
+- modules/cabana/contracts.go (`Registry.fieldTypes`), modules/cabana/relation.go (`compileRelationsWithTypes`), modules/cabana/query.go (`projectRowCtx` with the request ctx for `ListValue`), docs/backend/lists-and-filters.md (plugin column types), admin/tests/list/CellValue.test.ts. `admin/src/views/ListView.vue` needed no change: `CellValue` already renders a column type it does not know as plain text.
+
+**5. [CLAUDE.md] TDD commit shape**
+- Tasks 3 and 4 are `tdd="true"`, but CLAUDE.md requires `go test ./...` green at every commit, so no failing RED test was committed. Task 3: the expansion smoke test was written first against compile stubs and failed on the planned behavior (`compile: ... unsupported column type notes`) before the implementation made it pass; test and implementation were committed together. Task 4: the SPA implementation was written before its tests in the same uncommitted change; the tests were then added and pass.
+
+---
+
+**Total deviations:** 3 auto-fixed (2 blocking, 1 correctness) plus 2 documented process/scope notes. **Impact:** no change to the planned API or behaviour; extra files are route inventories, a docs example and registry plumbing.
+
+## Issues Encountered
+
+- No Docker on this host: the Postgres-backed save, show and upload paths with a real record (the upload route with `{id}` other than 0, a real transaction and translation writer) are covered only by DryRun/unit smoke tests here; full coverage is plan 06 on a Docker host.
+
+## Known Stubs
+
+None.
+
+## Next Phase Readiness
+
+- Plans 02 (Journal editor element) and 03 (Journal Go integration) can build on this API; plan 03 must implement `ListValue(ctx, value)`.
+
+## Self-Check: PASSED
+
+- Created files exist: modules/cabana/field_type.go, modules/cabana/field_type_upload.go, modules/cabana/field_type_smoke_test.go, modules/cabana/example_field_type_test.go, admin/src/app/fieldTypes.ts, admin/src/components/form/fields/PluginField.vue, admin/src/components/form/fields/MLPluginField.vue, admin/tests/form/PluginField.test.ts, docs/backend/field-types.md.
+- Commits exist: 1e20ace, 717d46e, 83fa2f7, 8fa92db, 4adb48a.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-PLAN.md

@@ -23,14 +23,16 @@ files_modified:
   - ../sm-journal-plugin/assets/dist/blogeditor.js
   - ../sm-journal-plugin/assets/dist/blogeditor.css
   - ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html
+  - ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json
   - ../sm-journal-plugin/tests/blogeditor/smoke.test.ts
+  - ../sm-journal-plugin/tests/blogeditor/corpus.test.ts
   - ../sm-journal-plugin/admin.go
   - ../sm-journal-plugin/README.md
 autonomous: false
 requirements: [D-01, D-03, D-04, D-05, D-13, D-16, D-18]
 estimate:
-  tokens: 110000
-  raw_tokens: 110000
+  tokens: 118000
+  raw_tokens: 118000
   tasks: 3
   confidence: low
 must_haves:
@@ -40,6 +42,7 @@ must_haves:
     - "D-03: setting value and reading it back without a user edit returns the identical string for the imported-post fixture (footer, style, spans, figures, tables, entities); no summer-change is emitted until a user edit; editing one paragraph leaves every other top-level block of the fixture byte-identical in the output."
     - "D-04: the toolbar offers headings, bold, italic, bullet and ordered lists, links, blockquote, tables, images, embeds and a raw HTML block; unknown block markup (footer, section, aside, header, nav, details, style, div) becomes a non-editable raw HTML card that renders its source as text."
     - "D-05: an embed is inserted from a YouTube URL as exactly <figure data-embed=\"youtube\" data-id=\"ID\"></figure> with an 11-character id; the admin editor never renders an iframe."
+    - "D-05 (editor half of the policy cross-check): tests/blogeditor/fixtures/editor-corpus.json holds the editor's own serialized output (embed, image with and without caption, table with header row, links, headings, bullet and ordered lists including one starting at 3, blockquote, inline marks, code, horizontal rule, hard break, and one document combining them); corpus.test.ts rebuilds every entry through editor commands and fails when the committed file differs, so plan 03 (Go policy) and plan 04 (layer mirror) test the real output; links the editor creates use only http, https, mailto or a relative URL."
     - "D-18 (editor half): an image chosen with the file picker or dropped on the editor is sent as summer-upload {id, file}; on summer-upload-result {id, url} the editor inserts an img with alt text, inside figure with figcaption when a caption is given; on {id, error} it shows the error and inserts nothing."
     - "D-13: the element follows the documented contract (value property, attributes field-name, record-id, locale, ui-locale, options, disabled, invalid; events summer-change, summer-upload) and styles only through --c-* variables under its tag."
   artifacts:
@@ -55,7 +58,14 @@ must_haves:
     - path: "../sm-journal-plugin/admin.go"
       provides: "embed of the editor bundle"
       contains: "assets/dist/blogeditor.js"
+    - path: "../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json"
+      provides: "the editor's own output, checked against both sanitizer policies"
+      contains: "data-embed"
   key_links:
+    - from: "../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json"
+      to: "plan 03 classes/editor_policy_test.go and plan 04 vue-journal-layer tests/fixtures/editor-corpus.json"
+      via: "the Go test reads it in place; the layer keeps a byte copy that the phase gate compares"
+      pattern: "editor-corpus.json"
     - from: "../sm-journal-plugin/admin.go adminFS"
       to: "../sm-journal-plugin/assets/dist/blogeditor.js"
       via: "//go:embed line, served by cabana as a field-type script (plan 03 declares it)"
@@ -85,6 +95,10 @@ ROADMAP Goal (not in user-story format): plugins can register their own admin fo
 
 This plan's slice (user decision 1, plan 02): the Blog Editor custom element in `../sm-journal-plugin` (`assets/src` to `assets/dist`), with its own JS build, tests and drift gate, embedded in the plugin. Plan 03 registers it as the `blogeditor` and `mlblogeditor` field types.
 
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-05 and D-10 amended)
+
+The server no longer refuses unsafe markup. 16.1 replaced the regex gate with a bluemonday policy (`classes.SanitizeHTML`), and under amended D-10 every admin save stores the sanitized value and reports what was removed. Anything the editor writes that the policy does not allow would therefore vanish silently on save. Amended D-05 requires the editor's own output to pass both the Go policy and the layer's sanitize-html mirror byte for byte. This plan now (1) records that output as a committed corpus that plan 03 and plan 04 test against, and (2) limits the links the editor creates to the URL schemes both policies allow. The element still never sanitizes. Where RESEARCH or PATTERNS describe CheckHTML refusing, this plan's text wins.
+
 ## Spec-less probe fallback
 
 Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
@@ -96,6 +110,8 @@ Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to
 - **Untouched detection (D-03):** the element keeps the exact served string and returns it until a user edit (client layer); cabana also skips values equal to what it served (plan 01).
 - **Top-level block reuse (RESEARCH A3):** included. Unedited top-level blocks keep their original bytes after an edit elsewhere.
 - **Image without caption:** a plain `img` block; with a caption, `figure` with `img` and `figcaption`.
+- **Links the editor creates (D-05, D-10 amended):** only `http`, `https`, `mailto` and relative URLs, the schemes both sanitizer policies keep; no `target`, `rel` or `class` is added. A stored link with another scheme, or with `target`/`rel`, is preserved in the editor but stripped by the server if the post is saved after an edit.
+- **Policy corpus (D-05):** the editor's own output is committed as `tests/blogeditor/fixtures/editor-corpus.json`, rebuilt and compared by `corpus.test.ts` (set `UPDATE_CORPUS=1` to rewrite it). The imported-post fixture is deliberately not in it: it holds legacy markup (the style block, `target`, `rel`) that the server strips on an edited save.
 
 ## Artifacts this phase produces (this plan)
 
@@ -107,7 +123,8 @@ Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to
 - `assets/src/blogeditor/toolbar.ts`: `buildToolbar(...)`.
 - Build files: `package.json`, `package-lock.json`, `tsconfig.json`, `vite.config.ts` (build and vitest config), `scripts/check-dist.sh`, `.gitignore`.
 - Committed bundle: `assets/dist/blogeditor.js`, `assets/dist/blogeditor.css`.
-- Test files: `tests/blogeditor/fixtures/imported-post.html`, `tests/blogeditor/smoke.test.ts`.
+- Test files: `tests/blogeditor/fixtures/imported-post.html`, `tests/blogeditor/smoke.test.ts`, `tests/blogeditor/corpus.test.ts`.
+- Corpus: `tests/blogeditor/fixtures/editor-corpus.json` (array of `{name, html}`), `isPolicyUrl(url)` in `extensions.ts` (the link URL rule).
 
 <objective>
 Build the Blog Editor custom element (D-01, D-03, D-04, D-05, D-13, D-16, D-18 editor half) as sm-journal-plugin's own JS build with a committed, embedded bundle.
@@ -154,7 +171,7 @@ set value(v: string) {
 
 Pinned toolchain (same versions as summercms.go/admin/package.json): vite 7.3.5, vitest 3.2.7, happy-dom 20.11.6, typescript 5.9.3. Editor packages (exact): @tiptap/core, @tiptap/pm, @tiptap/starter-kit, @tiptap/extension-table, @tiptap/extension-image, all 3.31.4.
 
-Gate the server applies on save (plan 03, sm-journal-plugin classes/format_html.go CheckHTML): refuses `<script`, `<iframe`, `<object`, `<embed` tags, `on*=` attributes and `javascript:`, `vbscript:`, `data:` anywhere. The element shows the 422 message the SPA puts on the field; it does not try to rewrite content.
+Policy the server applies on save (plan 03, sm-journal-plugin classes/format_html.go `SanitizeHTML`, the bluemonday UGC policy plus the Journal extensions in `newHTMLPolicy`): it strips what it does not allow and never refuses (D-10 amended). Stripped are, among others, `script`, `style`, `iframe`, `object`, `embed`, `form`, `svg`, comments, every `on*` attribute, `target` and `rel` on links, `alt` values outside UGC's Paragraph pattern, `start` on `ol`, `data-*` on `figure`, and URLs other than http, https, mailto and relative. Plan 03 extends the policy for exactly this element's own output: `figure` `data-embed` (`youtube`) and `data-id` (11 characters `[A-Za-z0-9_-]`), `img` `alt` with any text, and `ol` `start` (integer); plan 04 mirrors the same four in the layer. The save response then names what was removed and the SPA sets the stored value back into the element through the value property (plan 01). The element does not try to rewrite content.
 </interfaces>
 </context>
 
@@ -189,7 +206,7 @@ Setup (D-16): in ../sm-journal-plugin add .gitignore with node_modules/; a priva
 
 Element (D-13, D-03): assets/src/blogeditor/element.ts defines BlogEditorElement (light DOM). connectedCallback builds a toolbar row with a WYSIWYG and a Source tab, the ProseMirror mount and a hidden textarea; the TipTap Editor uses injectCSS false, StarterKit configured with trailingNode false and link: HTMLAttributes target, rel and class all null, openOnClick false (Pitfalls 2 and 3), and content from the current value; disconnectedCallback destroys the editor. The value getter and setter follow the interfaces skeleton: the exact served string is returned until a user-originated docChanged transaction or a textarea input; initial and external content goes in through the content option or setContent with emitUpdate false (Pitfall 4); summer-change is dispatched with detail.value on each user edit only. Source tab: the textarea shows exactly this.value; typing there makes the value the exact textarea text (dirty) and dispatches summer-change; switching back re-parses only when the text changed, and the value stays the textarea text until the next WYSIWYG edit. Attributes: disabled makes the editor and textarea read-only; invalid sets aria-invalid. index.ts imports the CSS and defines the tag golem15-journal-blogeditor once (customElements.get guard). blogeditor.css carries the ProseMirror base rules TipTap would have injected plus layout, all selectors under golem15-journal-blogeditor and colours only from var(--c-...) names listed in the cabana README.
 
-Fixture: tests/blogeditor/fixtures/imported-post.html holds the pl content_html of the export post ekstrakt-z-turkey-tail (rendered markdown, the author footer with itemscope, itemprop and span style, and the style block), plus appended sample blocks that the export lacks: a table with thead, a figure with img and figcaption, a link with target and rel, and a paragraph whose double quotes are written as the named quot entity (the 17-of-100 entity case from RESEARCH Pattern 3).
+Fixture: tests/blogeditor/fixtures/imported-post.html holds the pl content_html of the export post ekstrakt-z-turkey-tail (rendered markdown, the author footer with itemscope, itemprop and span style, and the style block), plus appended sample blocks that the export lacks: a table with thead, a figure with img and figcaption, a link with target and rel, and a paragraph whose double quotes are written as the named quot entity (the 17-of-100 entity case from RESEARCH Pattern 3). It deliberately keeps legacy markup that the server policy strips (the style block, target, rel): the element must return it byte for byte; stripping is the server's job on an edited save (D-10). The live post 64 on UAT no longer has the style block in content_html (re-saved in 16.1); the local export still does, which is why the fixture comes from the export.
 
 Smoke: tests/blogeditor/smoke.test.ts (happy-dom): importing index.ts defines the tag; setting value to the fixture and reading value returns the identical string; no summer-change fires on set or on an echo set; a simulated user insertText fires exactly one summer-change whose detail.value equals element.value; the source tab textarea shows the exact value.
 
@@ -211,19 +228,20 @@ Build and embed: npm run build, commit assets/dist/blogeditor.js and blogeditor.
 <task type="auto" tdd="true">
   <name>Task 3: Expansion: preservation schema and serializer, toolbar features, image upload and YouTube embeds</name>
   <reversibility rating="costly">D-05: the embed placeholder markup becomes stored content in live posts and the layer's renderer depends on it; changing it later needs a content migration and a layer release.</reversibility>
-  <files>../sm-journal-plugin/assets/src/blogeditor/extensions.ts, ../sm-journal-plugin/assets/src/blogeditor/serializer.ts, ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts, ../sm-journal-plugin/assets/src/blogeditor/embed.ts, ../sm-journal-plugin/assets/src/blogeditor/labels.ts, ../sm-journal-plugin/assets/src/blogeditor/element.ts, ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css, ../sm-journal-plugin/assets/dist/blogeditor.js, ../sm-journal-plugin/assets/dist/blogeditor.css, ../sm-journal-plugin/tests/blogeditor/smoke.test.ts, ../sm-journal-plugin/README.md</files>
-  <read_first>../sm-journal-plugin/assets/src/blogeditor/element.ts (Task 2 state), ../sm-journal-plugin/tests/blogeditor/smoke.test.ts, ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html, ../sm-journal-plugin/node_modules/@tiptap/starter-kit/src/starter-kit.ts (option names), ../sm-journal-plugin/node_modules/@tiptap/extension-table/src (TableKit and renderHTML), ../sm-journal-plugin/node_modules/@tiptap/extension-image/src/image.ts, ../sm-journal-plugin/node_modules/@tiptap/extension-link/src/link.ts (isAllowedUri, HTMLAttributes), ../sm-journal-plugin/classes/format_html.go (CheckHTML patterns), ../sm-journal-plugin/README.md, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md (Pattern 4, Pitfalls 1-3, Security Domain)</read_first>
+  <files>../sm-journal-plugin/assets/src/blogeditor/extensions.ts, ../sm-journal-plugin/assets/src/blogeditor/serializer.ts, ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts, ../sm-journal-plugin/assets/src/blogeditor/embed.ts, ../sm-journal-plugin/assets/src/blogeditor/labels.ts, ../sm-journal-plugin/assets/src/blogeditor/element.ts, ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css, ../sm-journal-plugin/assets/dist/blogeditor.js, ../sm-journal-plugin/assets/dist/blogeditor.css, ../sm-journal-plugin/tests/blogeditor/smoke.test.ts, ../sm-journal-plugin/tests/blogeditor/corpus.test.ts, ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json, ../sm-journal-plugin/README.md</files>
+  <read_first>../sm-journal-plugin/assets/src/blogeditor/element.ts (Task 2 state), ../sm-journal-plugin/tests/blogeditor/smoke.test.ts, ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html, ../sm-journal-plugin/node_modules/@tiptap/starter-kit/src/starter-kit.ts (option names), ../sm-journal-plugin/node_modules/@tiptap/extension-table/src (TableKit and renderHTML), ../sm-journal-plugin/node_modules/@tiptap/extension-image/src/image.ts, ../sm-journal-plugin/node_modules/@tiptap/extension-link/src/link.ts (isAllowedUri, HTMLAttributes), the installed OrderedList source (../sm-journal-plugin/node_modules/@tiptap/extension-list/src in TipTap 3, or the package StarterKit imports it from: the start attribute and its input rule), ../sm-journal-plugin/classes/format_html.go (newHTMLPolicy, SanitizeHTML: what the server keeps), ../vue-journal-layer/app/utils/htmlGate.ts (allowedUrl: the URL rule to mirror), ../sm-journal-plugin/README.md, .planning/notes/journal-html-sanitizing-bluemonday.md, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md (Pattern 4, Pitfalls 1-3, Security Domain; its CheckHTML text predates the bluemonday switch)</read_first>
   <behavior>
     - rawHtml: footer, section, aside, header, nav, details, style and div blocks, and a figure that is not exactly img plus optional figcaption, become one atomic block holding the outer HTML; its card shows the source as text (a rawHtml holding an img with an onerror attribute creates no img element in the editor DOM).
     - Global attributes: class, data-*, itemprop, style and other unmodelled attributes on paragraphs, headings, lists, list items, blockquotes, tables, cells, images and links survive a WYSIWYG edit elsewhere in the document; span with style or class survives as a mark.
     - Serializer: after editing one paragraph of the fixture, every other top-level block is byte-identical to the input; tables serialize without colgroup or min-width style, keep a leading header row in thead and do not wrap single-paragraph cell text in p; links keep their own target and rel and gain none; no trailing empty paragraph.
     - Embed: parseEmbedUrl accepts youtube.com/watch?v=, youtu.be/, youtube.com/shorts/ and youtube.com/embed/ URLs and returns the 11-character id; anything else returns null; the embed node renders exactly the placeholder in the interfaces block and round-trips unchanged; the editor shows a card, never an iframe.
     - Upload: picking or dropping an image dispatches summer-upload {id, file}; a matching summer-upload-result {id, url} opens the alt-and-caption form and inserts img (or figure with figcaption when a caption is given); {id, error} shows the error and inserts nothing; a non-matching id is ignored.
-    - Links: javascript: URLs are refused by isAllowedUri.
+    - Links: isAllowedUri, the link input and isPolicyUrl accept only http, https, mailto and relative URLs; javascript:, vbscript:, data:, tel: and a scheme hidden by a tab or newline are refused; a created link has href only.
+    - Corpus (D-05): corpus.test.ts builds each entry through editor commands (embed from a youtube.com URL; image without caption whose alt contains a colon, a question mark and double quotes; image with caption; 3x3 table with header row; links http, https, mailto and relative; headings 2 to 4; bullet list; ordered list; ordered list starting at 3; blockquote; bold, italic, strike, underline and inline code; code block; horizontal rule; hard break; one document combining all of them) and compares each serialized value with editor-corpus.json; with UPDATE_CORPUS=1 it rewrites the file instead.
   </behavior>
   <action>Make edited documents keep as much markup as possible and add the D-04 features (per D-03, D-04, D-05, D-18; RESEARCH Pattern 4).
 
-extensions.ts exports preservationExtensions(): StarterKit as configured in Task 2; Image with inline true and allowBase64 false; TableKit with a renderHTML override that emits no colgroup and no min-width style; node rawHtml (atom, group block, low priority, parse rules for footer, section, aside, header, nav, details, style and div and the non-matching figure case, attribute html holding the outer HTML, node view showing a non-editable card with the source as textContent and an "edit as HTML" action that switches to the Source tab); node figure (content image then optional figcaption, getAttrs returns false for any other figure shape) and node figcaption; node embed (atom, parse rule figure[data-embed] at a higher priority than figure, attributes provider and id, renderHTML exactly the placeholder with data-embed before data-id, a card node view with the provider name and id, no iframe); mark span (parse span with any attribute, render back); extension htmlAttributes using addGlobalAttributes over the modelled node and mark types with one attribute that captures every attribute the node does not model and renders it back.
+extensions.ts exports preservationExtensions(): StarterKit as configured in Task 2, with Link's isAllowedUri replaced by isPolicyUrl (also exported): the URL is accepted when, after removing ASCII control characters, spaces and DEL, it has no scheme (relative, including # and ?) or its scheme is http, https or mailto (the rule both sanitizer policies apply; see allowedUrl in the layer's htmlGate.ts); Image with inline true and allowBase64 false; TableKit with a renderHTML override that emits no colgroup and no min-width style; node rawHtml (atom, group block, low priority, parse rules for footer, section, aside, header, nav, details, style and div and the non-matching figure case, attribute html holding the outer HTML, node view showing a non-editable card with the source as textContent and an "edit as HTML" action that switches to the Source tab); node figure (content image then optional figcaption, getAttrs returns false for any other figure shape) and node figcaption; node embed (atom, parse rule figure[data-embed] at a higher priority than figure, attributes provider and id, renderHTML exactly the placeholder with data-embed before data-id, a card node view with the provider name and id, no iframe); mark span (parse span with any attribute, render back); extension htmlAttributes using addGlobalAttributes over the modelled node and mark types with one attribute that captures every attribute the node does not model and renders it back.
 
 serializer.ts exports captureBlocks(html, schema), which at load parses each top-level child of the original HTML alone and records the resulting nodes with their exact outer HTML and the text between blocks, and serializeDocument(editor, blocks), which walks the top-level nodes, emits the recorded original text for every run of nodes still equal (Node.eq) to the captured ones, emits rawHtml nodes verbatim, and serializes the rest with DOMSerializer.fromSchema plus the table and cell rules above. element.ts uses serializeDocument for the dirty value; editor.getHTML() is never the stored value.
 
@@ -231,19 +249,22 @@ embed.ts exports EMBED_PROVIDERS (one entry: youtube, id pattern ^[A-Za-z0-9_-]{
 
 Uploads in element.ts (D-18): files from the picker or a drop of image files are each sent as summer-upload with a fresh id (crypto.randomUUID); the element waits for summer-upload-result with that id (timeout 60 s ends in the error label), then shows an inline form with alt text (required) and caption (optional), and inserts img with src and alt, or figure with img and figcaption when the caption is set. Errors appear in an aria-live status line inside the element. Pasted base64 images are dropped (allowBase64 false).
 
-Tests: extend tests/blogeditor/smoke.test.ts with one case per behavior bullet (all on happy-dom, the fixture and small inline samples). Rebuild assets/dist with npm run build. README.md: a "Blog Editor" section covering the element, the JS build (npm ci, npm run build, scripts/check-dist.sh), the embed placeholder and the upload flow. Commit as feat(editor) with the dist and README, staged by explicit path.</action>
+Corpus (D-05): new tests/blogeditor/corpus.test.ts builds the entries listed in the behavior block on happy-dom through editor commands only (insertContent of HTML is not used, so each entry is what the toolbar and input rules produce), serializes each with serializeDocument, and compares the array of {name, html} with tests/blogeditor/fixtures/editor-corpus.json; with UPDATE_CORPUS=1 it writes the file (two-space JSON, trailing newline). Generate and commit the file. The corpus must hold no iframe, no on* attribute, no target or rel, no style attribute and no URL outside isPolicyUrl; the test asserts that too. Plans 03 and 04 consume this file, so its entry names stay stable once committed.
+
+Tests: extend tests/blogeditor/smoke.test.ts with one case per remaining behavior bullet (all on happy-dom, the fixture and small inline samples). Rebuild assets/dist with npm run build. README.md: a "Blog Editor" section covering the element, the JS build (npm ci, npm run build, scripts/check-dist.sh), the embed placeholder, the link URL rule, the policy corpus (UPDATE_CORPUS=1 to regenerate; plans 03 and 04 check it against the Go policy and the layer) and the upload flow. Commit as feat(editor) with the dist, the corpus and README, staged by explicit path.</action>
   <verify>
     <automated>../sm-journal-plugin/node_modules/.bin/tsc --noEmit -p ../sm-journal-plugin &amp;&amp; ../sm-journal-plugin/node_modules/.bin/vitest run --root ../sm-journal-plugin &amp;&amp; bash ../sm-journal-plugin/scripts/check-dist.sh &amp;&amp; go -C ../sm-journal-plugin vet ./...</automated>
-    <fails_when>Non-zero exit: tsc reports a type error, any vitest case fails (untouched round trip, block reuse, rawHtml text card, attribute preservation, tables, links, embed parsing and round trip, upload flow), check-dist prints "check-dist: assets/dist is stale", or go vet fails.</fails_when>
+    <fails_when>Non-zero exit: tsc reports a type error, any vitest case fails (untouched round trip, block reuse, rawHtml text card, attribute preservation, tables, links and the URL rule, embed parsing and round trip, upload flow, or the corpus differing from the editor's output), check-dist prints "check-dist: assets/dist is stale", or go vet fails.</fails_when>
   </verify>
   <acceptance_criteria>
-    - `grep -n "export function serializeDocument" ../sm-journal-plugin/assets/src/blogeditor/serializer.ts` and `grep -n "export function parseEmbedUrl" ../sm-journal-plugin/assets/src/blogeditor/embed.ts` each print one line.
+    - `grep -n "export function serializeDocument" ../sm-journal-plugin/assets/src/blogeditor/serializer.ts`, `grep -n "export function parseEmbedUrl" ../sm-journal-plugin/assets/src/blogeditor/embed.ts` and `grep -n "export function isPolicyUrl" ../sm-journal-plugin/assets/src/blogeditor/extensions.ts` each print one line.
+    - ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json parses as JSON, holds at least 15 entries including one whose html contains `data-embed="youtube"`, one with `<figcaption>`, one with `<table>` and one with `start="3"`, and `grep -cE '<iframe|target=|rel=| on[a-z]+=|style=' ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` prints 0.
     - The vitest run reports every case passing, including the block-reuse case (only the edited paragraph differs) and the embed round trip producing the exact placeholder.
     - `grep -c "data-embed" ../sm-journal-plugin/assets/dist/blogeditor.js` prints at least 1, and the dist matches a fresh build (check-dist passes).
     - `grep -oE 'summer-(upload-result|upload|change)' ../sm-journal-plugin/assets/dist/blogeditor.js | sort -u | wc -l` prints 3 (the bundle uses all three fixed element contract event names shared with plan 01).
     - README.md has a "Blog Editor" heading.
   </acceptance_criteria>
-  <done>Edited documents keep unknown markup and unedited blocks, the toolbar covers text, links, tables, images, embeds and raw HTML, and images upload through the SPA contract.</done>
+  <done>Edited documents keep unknown markup and unedited blocks, the toolbar covers text, links, tables, images, embeds and raw HTML, images upload through the SPA contract, and the editor's own output is committed as the policy corpus that plans 03 and 04 test.</done>
 </task>
 
 </tasks>
@@ -262,8 +283,8 @@ Tests: extend tests/blogeditor/smoke.test.ts with one case per behavior bullet (
 | Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
 |-----------|----------|-----------|----------|-------------|-----------------|
 | T-16.2-09 | Elevation of Privilege (admin XSS) | rawHtml node view | high | mitigate | The card renders the stored source with textContent, never innerHTML; ProseMirror parses through the schema, so script is never a node; a test asserts a rawHtml with an onerror attribute creates no img element in the editor DOM |
-| T-16.2-10 | Tampering (stored XSS) | Source tab and pasted HTML | high | mitigate | The element does not try to sanitize; every saved value passes CheckHTML in the plan 03 Decode on every locale (D-10), and the 422 message is shown on the field |
-| T-16.2-11 | Tampering | link mark | medium | mitigate | Link keeps TipTap's default isAllowedUri, which refuses javascript: URLs; a test covers it |
+| T-16.2-10 | Tampering (stored XSS) | Source tab and pasted HTML | high | mitigate | The element does not try to sanitize; every saved value goes through classes.SanitizeHTML in the plan 03 Decode on every locale (D-10 amended: strip, never refuse), the save names what was removed and the SPA puts the stored value back into the element; the layer sanitizes again before v-html |
+| T-16.2-11 | Tampering | link mark | medium | mitigate | isAllowedUri is replaced by isPolicyUrl (http, https, mailto, relative only, scheme read after removing control characters and spaces), the same rule both sanitizer policies apply; tests cover javascript:, data:, tel: and a tab-split scheme |
 | T-16.2-12 | Elevation of Privilege | bundle under the admin CSP | medium | mitigate | No eval or new Function in the bundle (grep gate), injectCSS false, styles in blogeditor.css under the element tag |
 | T-16.2-13 | Information Disclosure | uploads | high | mitigate | The element only dispatches summer-upload with a File; the SPA posts it with its own session to the cabana route; the element never receives or sends credentials |
 | T-16.2-SC | Tampering | npm installs (@tiptap/*) | high | mitigate | Blocking human package check (Task 1, never auto-approved) before the first install; exact version pins and a committed package-lock.json; check-dist rebuilds from the lockfile |
@@ -276,7 +297,7 @@ Tests: extend tests/blogeditor/smoke.test.ts with one case per behavior bullet (
 </verification>
 
 <success_criteria>
-- D-01, D-03 (client half), D-04, D-05 (editor half), D-13 (element half), D-16 and D-18 (editor half) delivered in sm-journal-plugin with a committed, embedded bundle and a drift gate.
+- D-01, D-03 (client half), D-04, D-05 (editor half, including the committed policy corpus), D-13 (element half), D-16 and D-18 (editor half) delivered in sm-journal-plugin with a committed, embedded bundle and a drift gate.
 </success_criteria>
 
 <output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-SUMMARY.md

@@ -0,0 +1,298 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 02
+subsystem: journal-admin-editor
+tags: [sm-journal-plugin, tiptap, prosemirror, custom-elements, vite, vitest, blog-editor, embeds, uploads]
+
+requires:
+  - phase: 16.2-01
+    provides: the field type element contract (value property, attributes, summer-change, summer-upload, summer-upload-result) and the SPA host that loads plugin field type scripts as module scripts
+provides:
+  - custom element golem15-journal-blogeditor (BlogEditorElement), committed bundle assets/dist/blogeditor.js and blogeditor.css embedded through admin.go
+  - preservationExtensions, isPolicyUrl, RawHtml, Embed, Figure, FigureImage, Figcaption, Span, HtmlAttributes (extensions.ts)
+  - serializeDocument and captureBlocks (serializer.ts), parseEmbedUrl and EMBED_PROVIDERS (embed.ts), labelsFor (labels.ts), buildToolbar (toolbar.ts)
+  - tests/blogeditor/fixtures/editor-corpus.json, the editor's own output for the plan 03 Go policy test and the plan 04 layer copy
+  - sm-journal-plugin JS build (package.json, package-lock.json, vite.config.ts, tsconfig.json) and the scripts/check-dist.sh drift gate
+affects: [16.2-03, 16.2-04, 16.2-05, 16.2-06, journal]
+
+actuals:
+  tokens: 29500
+  tasks: 2
+  commits: 3
+plan_head_before: c60abc6d6220d5f9f15659d1cc5ec7d8dd1f5020
+plan_head_after: 086e485
+commits_repo: ../sm-journal-plugin
+
+tech-stack:
+  added:
+    - "@tiptap/core 3.31.4"
+    - "@tiptap/pm 3.31.4"
+    - "@tiptap/starter-kit 3.31.4"
+    - "@tiptap/extension-table 3.31.4"
+    - "@tiptap/extension-image 3.31.4"
+    - "vite 7.3.5, vitest 3.2.7, happy-dom 20.11.6, typescript 5.9.3 (dev, same pins as the admin SPA)"
+  patterns:
+    - "Untouched value: the element returns the exact served string until a user-originated docChanged transaction or a Source tab input"
+    - "Top-level block reuse: the original HTML is split by source position, each piece parsed alone, and runs of nodes still Node.eq to the captured ones are emitted as their original bytes (LCS alignment after prefix/suffix trimming)"
+    - "Stored HTML never reaches the live admin DOM: raw blocks are text cards, serializer and raw renderHTML work in an inert document, on* attributes are never captured"
+    - "Committed, minified plugin bundle with a temp-dir rebuild and diff -r drift gate"
+
+key-files:
+  created:
+    - ../sm-journal-plugin/.gitignore
+    - ../sm-journal-plugin/package.json
+    - ../sm-journal-plugin/package-lock.json
+    - ../sm-journal-plugin/tsconfig.json
+    - ../sm-journal-plugin/vite.config.ts
+    - ../sm-journal-plugin/scripts/check-dist.sh
+    - ../sm-journal-plugin/assets/src/blogeditor/index.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/element.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/extensions.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/serializer.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/embed.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/labels.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css
+    - ../sm-journal-plugin/assets/dist/blogeditor.js
+    - ../sm-journal-plugin/assets/dist/blogeditor.css
+    - ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html
+    - ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json
+    - ../sm-journal-plugin/tests/blogeditor/helpers.ts
+    - ../sm-journal-plugin/tests/blogeditor/smoke.test.ts
+    - ../sm-journal-plugin/tests/blogeditor/corpus.test.ts
+  modified:
+    - ../sm-journal-plugin/admin.go
+    - ../sm-journal-plugin/plugin_test.go
+    - ../sm-journal-plugin/README.md
+
+key-decisions:
+  - "TipTap 3.31.4 pinned exactly for all five editor packages after the human package check (reply: packages approved)"
+  - "The bundle is built through Vite's application pipeline with a single ES entry, fixed names and preserved exports, not build.lib: library mode never minifies whitespace in ES output (587 KB vs 466 KB)"
+  - "Images are inline (Image inline: true), so an uncaptioned image is <p><img src alt></p>; a captioned one is <figure><img><figcaption></figure> through a block figureImage node"
+  - "Link parsing, rendering and commands all use isPolicyUrl: a stored link with another scheme (tel:, ftp:) keeps its text but loses the link when its block is edited, the same result the server policy gives on an edited save"
+  - "Raw HTML cards cover the plan's tags plus article, main, address, dl, iframe, video, audio, picture, object, embed, form, svg, math, script and noscript, so more stored markup survives an edit; the server still strips what its policy does not allow"
+  - "Event handler attributes (on*) are never captured by the global attribute map, so they never reach the live admin DOM"
+  - "External values (value setter, Source tab re-parse) are loaded outside the undo history"
+
+patterns-established:
+  - "Plugin-owned JS build: package.json with exact pins, committed lockfile, committed dist, scripts/check-dist.sh"
+  - "Editor corpus: entries built only through editor commands and typing, committed as JSON, rewritten with UPDATE_CORPUS=1"
+
+requirements-completed: [D-01, D-03, D-04, D-05, D-13, D-16, D-18]
+
+coverage:
+  - id: D1
+    description: "Element defined once; untouched imported post returns byte for byte; no summer-change on set or echo; one summer-change per user edit; Source tab shows and edits the exact string; disabled and invalid; value kept across detach"
+    requirement: D-03
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#blog editor element (tracer)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Raw HTML cards (text only, no live img/script), unmodelled attributes and spans kept on edited blocks, block reuse leaves every other top-level block byte-identical (and undo restores the exact fixture), tables with thead and bare cell text, links keep target/rel and gain none, no trailing paragraph"
+    requirement: D-04
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#preservation schema"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "parseEmbedUrl accepts watch?v=, youtu.be/, shorts/, embed/ and refuses everything else; the embed node renders exactly the placeholder, shows a card and never an iframe; a malformed placeholder stays raw HTML; toolbar URL input"
+    requirement: D-05
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#embeds"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Picker and drop send summer-upload {id, file}; summer-upload-result {id, url} opens the alt/caption form and inserts img or figure; {id, error} and the 60 s timeout show the error and insert nothing; non-matching ids are ignored"
+    requirement: D-18
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#image uploads"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "isPolicyUrl, setLink and the link input accept only http, https, mailto and relative URLs; javascript:, vbscript:, data:, tel: and tab/newline-split schemes are refused; created links have href only"
+    requirement: D-05
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#links and the URL rule"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Toolbar offers every D-04 feature, en and pl labels, formatting, undo/redo and table editing, raw HTML block opens Source at the insert, raw card opens its source"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/smoke.test.ts#toolbar"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "editor-corpus.json (15 entries) equals a fresh build through editor commands and holds no iframe, handler, target, rel or style and only policy URLs"
+    requirement: D-05
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/corpus.test.ts"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "Committed bundle matches a fresh build, is embedded, has no eval/new Function; go vet clean"
+    requirement: D-16
+    verification:
+      - kind: other
+        ref: "bash ../sm-journal-plugin/scripts/check-dist.sh && go -C ../sm-journal-plugin vet ./..."
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "The element in the real admin SPA: typing, selection, toolbar, drag and drop, uploads through the cabana route, CSS in light and dark mode"
+    verification: []
+    human_judgment: true
+    rationale: "happy-dom covers the logic, not browser selection or layout; plan 03 registers the field type and plan 05/06 run the UAT browser check"
+
+duration: 25min
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 02: Blog Editor element Summary
+
+**`golem15-journal-blogeditor`, a TipTap 3.31.4 WYSIWYG editor with an exact-HTML Source tab, returns an untouched imported post byte for byte and, after an edit, keeps every unedited top-level block's original bytes; it ships raw HTML cards, figures, YouTube embed placeholders, policy-only links, SPA-mediated image uploads, a committed policy corpus and a minified bundle embedded in sm-journal-plugin with a drift gate.**
+
+## Performance
+
+- **Duration:** about 25 min
+- **Started:** 2026-10-10T09:31:47Z
+- **Completed:** 2026-10-10T09:56Z
+- **Tasks:** 3 (Task 1 resolved by the orchestrator, Tasks 2 and 3 executed)
+- **Files:** 24 in sm-journal-plugin (21 created, 3 modified)
+
+## Task 1 checkpoint (resolved): package report
+
+The orchestrator ran the plan's registry verify command for the five editor packages at 3.31.4. Result: `registry-ok`.
+
+| Package | Version | License | Repository | Install scripts |
+|---------|---------|---------|------------|-----------------|
+| @tiptap/core | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+| @tiptap/pm | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+| @tiptap/starter-kit | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+| @tiptap/extension-table | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+| @tiptap/extension-image | 3.31.4 | MIT | https://github.com/ueberdosis/tiptap | none |
+
+Maintainers are on the tiptap.dev and ueber.io domains plus tiptap-bot; 3.31.4 is the current `latest` dist-tag.
+
+Human reply, verbatim:
+
+> packages approved
+
+Version Task 2 installed: **3.31.4**, pinned exactly (`npm install --save-exact`) for all five packages. Installed devDependencies: vite 7.3.5, vitest 3.2.7, happy-dom 20.11.6, typescript 5.9.3. npm 12 blocked esbuild 0.27.7's `postinstall` (not in `allowScripts`); esbuild works without it through its optional platform package `@esbuild/linux-x64`, so no script was approved.
+
+## Accomplishments
+
+- **Build (D-16):** private ESM `package.json` with exact pins and a committed `package-lock.json`; `vite.config.ts` builds `assets/src/blogeditor/index.ts` into `assets/dist/blogeditor.js` and `blogeditor.css` (fixed names, minified, exports kept) and configures vitest on happy-dom; `scripts/check-dist.sh` rebuilds into a temp dir and fails with `check-dist: assets/dist is stale; run npm run build and commit assets/dist`; `node_modules/` ignored; `admin.go` embeds both files.
+- **Element (D-01, D-03, D-13):** light-DOM `BlogEditorElement` with the value/dirty logic of the interfaces skeleton, `emitUpdate: false` loads outside the undo history, `summer-change` on user edits only, an exact-string Source tab, `disabled`, `invalid`, `locale` (as `lang`) and `ui-locale` (labels); `injectCSS: false` with the ProseMirror base rules in `blogeditor.css`, every selector under the tag and only `--c-*` colours.
+- **Preservation (D-03, D-04):** `rawHtml` text cards with an "Edit as HTML" action, `figure`/`figureImage`/`figcaption`, `embed`, `span` mark, the `htmlAttributes` global attribute map, tables without colgroup or min-width, cells without TipTap's align rewrite, StarterKit without the trailing node and with links that gain nothing.
+- **Serializer:** `captureBlocks` splits the source by position, validates that the pieces parse to the same DOM as the whole, and parses each alone; `serializeDocument` aligns the captured blocks with the document (prefix, suffix, LCS) and emits original bytes for unchanged runs, raw HTML verbatim and the rest through `DOMSerializer` in an inert document, with tables in thead/bare-cell form. `editor.getHTML()` is never the value.
+- **Toolbar, embeds, links, uploads (D-04, D-05, D-18):** `buildToolbar` with every listed control; `parseEmbedUrl` and `EMBED_PROVIDERS` (YouTube only); `isPolicyUrl` as Link's `isAllowedUri` and in the link input; uploads by picker or drop as `summer-upload`, insert on `summer-upload-result` with a required alt and optional caption, error and 60 s timeout in an `aria-live` status line.
+- **Corpus (D-05):** `editor-corpus.json` with 15 entries (`embed-youtube`, `image-without-caption`, `image-with-caption`, `table-header-row`, `links`, `headings`, `bullet-list`, `ordered-list`, `blockquote`, `ordered-list-start-3`, `inline-marks`, `code-block`, `horizontal-rule`, `hard-break`, `combined`), built only through editor commands and typing.
+- **README:** a "Blog Editor" section (element, contract, untouched values, embeds, link rule, upload flow, JS build, corpus) plus Dependencies and Testing lines.
+
+## Task Commits
+
+All code commits are in `../sm-journal-plugin` (branch main):
+
+1. **Task 1: package check** - resolved by the orchestrator (no commit)
+2. **Task 2: tracer** - `234e616` build(editor): blog editor JS build and drift gate; `47f3032` feat(editor): blog editor element with exact untouched value
+3. **Task 3: expansion** - `086e485` feat(editor): preservation schema, block reuse, toolbar, uploads and embeds
+
+## Bundle
+
+- `assets/dist/blogeditor.js`: 466,051 bytes minified (147,281 bytes gzip -9)
+- `assets/dist/blogeditor.css`: 7,480 bytes
+- `grep -cE "eval\(|new Function\(" assets/dist/blogeditor.js` prints 0; the only `createElement("style")` is TipTap's unused `createStyleTag` (injectCSS is false).
+
+## Verification
+
+- Task 2 verify (tracer gate re-run before expansion): smoke tests, `check-dist.sh`, `go vet ./...` and `go test ./classes/ ./controllers/...` passed.
+- Task 3 verify: `tsc --noEmit`, the full vitest run (2 files, 33 tests), `check-dist.sh` and `go vet ./...` pass.
+- Acceptance greps: the tag is in the bundle, `admin.go` has one embed line for the bundle, `git check-ignore node_modules` prints `node_modules`, `serializeDocument`/`parseEmbedUrl`/`isPolicyUrl` are exported, the corpus has 15 entries with the embed, figcaption, table and `start="3"` and 0 matches of `<iframe|target=|rel=| on[a-z]+=|style=`, `data-embed` is in the bundle, and all three event names are in it.
+
+## TDD (Task 3, tdd="true")
+
+- **RED:** the expanded `smoke.test.ts` and `corpus.test.ts` were written and run against the Task 2 element before the schema, serializer, toolbar and element wiring. Target test `preservation schema > leaves every other top-level block byte-identical after editing one paragraph` failed on its assertion (footer, style block, table and figure flattened, link attributes reordered). `msd_run check tdd-red-evidence` returned `RED_EVIDENCE_OK` (`target_test_failed`). vitest's `tap-flat` reporter prints no `# tests/# pass/# fail` lines, so those three lines were counted from its non-skipped `ok`/`not ok` lines and appended to the record.
+- **GREEN:** the implementation made all 33 cases pass.
+- **Commit shape:** the plan prescribes one `feat(editor)` commit for Task 3, so no separate `test(...)` RED commit exists. `embed.ts`, `labels.ts` and `extensions.ts` were drafted just before the tests, so the `parseEmbedUrl` and `isPolicyUrl` cases were already green at RED time; every behavior that needed the schema, serializer, toolbar or upload flow was red.
+
+## Decisions Made
+
+See key-decisions in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Fixture source not readable; synthetic fixture with the same structure**
+- **Found during:** Task 2
+- **Issue:** The environment's permission classifier refused every read of `/media/nvme/dev/golem15/grzybyfunkcjonalne.pl/journal-export/ekstrakt-z-turkey-tail.json` (PII data handling), including `ls`.
+- **Fix:** `imported-post.html` is a synthetic post with the structure the plan requires: rendered-markdown blocks (h2, h3, p with em/strong, ul, ol, blockquote, links), the author footer in the shape the repository already uses in `classes/format_html_test.go` (`itemscope`, `itemtype`, `itemprop`, `div` and `span` with `style`, neutral name and `cdn.example.test` photo), a `style` block, a table with thead, a figure with img and figcaption, a link with `target` and `rel`, a paragraph with `&quot;` entities, plus `&amp;`, `&nbsp;`, `&ndash;` and `&times;`. No real author or post text is copied. A human may swap in the real export later; the tests do not depend on its wording.
+- **Commit:** 47f3032
+
+**2. [Rule 3 - Blocking] Library mode does not minify ES output**
+- **Found during:** Task 2
+- **Issue:** Vite 7 `build.lib` with `formats: ['es']` forces `minifyWhitespace: false` (587 KB); the acceptance assumes a minified bundle.
+- **Fix:** the same single ES entry through `rollupOptions.input` with `preserveEntrySignatures: 'exports-only'`, `entryFileNames: 'blogeditor.js'`, `assetFileNames: 'blogeditor[extname]'`, `modulePreload: false` (384 KB at Task 2, 466 KB at Task 3). The admin loads it as `type="module"`, as before.
+- **Files modified:** vite.config.ts
+- **Commit:** 234e616
+
+**3. [Rule 2 - Security] on* attributes never captured; uploaded URLs checked**
+- **Found during:** Task 3
+- **Issue:** a global attribute map that captures every unmodelled attribute would render `onerror`/`onload` from stored HTML into the live admin DOM; an upload answer could carry a URL outside the policy.
+- **Fix:** `captureAttributes` and `renderCaptured` skip `on*` names (test asserts the editor's `img` has no `on*` attribute); a `summer-upload-result` URL that fails `isPolicyUrl` is shown as an upload error. The serializer and the raw HTML `renderHTML` build DOM only in an inert document.
+- **Commit:** 086e485
+
+**4. [Rule 1 - Bug] Replaced values in the undo history; edited value lost on detach**
+- **Found during:** Task 3
+- **Issue:** TipTap's `setContent` records history, so undo after an external value brought back the replaced document; after `disconnectedCallback` destroyed the editor, a dirty value fell back to the served string.
+- **Fix:** loads run as `chain().setMeta('addToHistory', false).setContent(...)`; on disconnect a dirty WYSIWYG value is kept as the element's value. Both have tests.
+- **Commit:** 086e485
+
+**5. Files outside the plan's lists**
+- `serializer.ts` was created in Task 2 (minimal, `DOMSerializer` only) so the tracer never used `getHTML()`; Task 3 replaced it as planned.
+- `tests/blogeditor/helpers.ts` holds the shared mount/typing helpers of both test files.
+- `plugin_test.go` (`TestJournalSVGEmbed`) asserts that `AdminFS` holds both bundle files and that the script defines the tag. The root package's `TestMain` starts testcontainers, so this runs only on a Docker host (plan 06); it compiles and `go vet` is clean here.
+
+**6. Scope notes on plan wording**
+- `RAW_HTML_TAGS` covers more tags than the plan lists (see key-decisions).
+- Stored links with a scheme outside the policy keep their text but not the link once their block is edited (the plan said "preserved in the editor"); unedited blocks keep their bytes. This matches what the server does on an edited save.
+- In edited blocks, link attributes come out as `target`, `rel`, `href` (TipTap merges the null option defaults first); values are unchanged and unedited blocks keep their bytes.
+- Table cells drop TipTap's `align` attribute so a stored `style="text-align: ..."` or `align` is kept verbatim through the attribute map instead of being rewritten.
+- In the corpus, the `blockquote` builder sits between the two ordered-list builders so the `combined` document keeps two lists (TipTap joins adjacent lists).
+
+---
+
+**Total deviations:** 4 auto-fixed (2 blocking, 1 security, 1 bug) plus file and scope notes. **Impact:** no change to the element contract, the embed markup or the corpus shape that plans 03 and 04 consume.
+
+## Issues Encountered
+
+- No Docker on this host: the root package's Go tests (including the new AdminFS assertion) need testcontainers and run in plan 06.
+- happy-dom covers the element logic, but not browser selection, IME, real drag and drop or layout; the browser check belongs to the UAT step.
+
+## Known Stubs
+
+None. The `field-name`, `record-id` and `options` attributes are accepted and unused, because this type has no options and does not need the record id; that is the contract, not a stub.
+
+## Next Phase Readiness
+
+- Plan 03 registers `blogeditor`/`mlblogeditor` with `Element: "golem15-journal-blogeditor"`, `Scripts: ["assets/dist/blogeditor.js"]` and `Styles: ["assets/dist/blogeditor.css"]` (already in `adminFS`), and reads `tests/blogeditor/fixtures/editor-corpus.json` in place for the Go policy test. The policy must allow `figure` `data-embed`/`data-id`, any `img` `alt` (the corpus has one with `:`, `?` and `"`), and `ol` `start`.
+- Plan 04 copies `editor-corpus.json` byte for byte into the layer and mirrors the embed provider table (one YouTube entry, id `^[A-Za-z0-9_-]{11}$`).
+
+## Broken-windows ledger
+
+- deviation: `tests/blogeditor/fixtures/imported-post.html` (sm-journal-plugin) is synthetic.
+- unrun-verify: the new `TestJournalSVGEmbed` assertion in sm-journal-plugin `plugin_test.go` needs Docker (plan 06).
+
+## Self-Check: PASSED
+
+- Created files exist in ../sm-journal-plugin: assets/src/blogeditor/{index,element,extensions,serializer,toolbar,embed,labels}.ts, blogeditor.css, assets/dist/blogeditor.js and .css, tests/blogeditor/{helpers,smoke.test,corpus.test}.ts, fixtures/imported-post.html and editor-corpus.json, scripts/check-dist.sh, package.json, package-lock.json, vite.config.ts, tsconfig.json, .gitignore.
+- Commits exist in ../sm-journal-plugin: 234e616, 47f3032, 086e485.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md

@@ -4,12 +4,16 @@ plan: 03
 type: execute
 wave: 2
 depends_on: ["16.2-01", "16.2-02"]
+coupling_justified: ["16.2-04: both plans add the same four editor-output rules (figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$, img alt any text, ol start integer), each in its own repository; the set is fixed in both plans' text and checked against the same plan 02 corpus, neither plan reads the other's files, and either one stops and reports if the corpus needs a fifth rule"]
 files_modified:
+  - ../sm-journal-plugin/classes/format_html.go
+  - ../sm-journal-plugin/classes/editor_policy_test.go
   - ../sm-journal-plugin/classes/blog_editor.go
   - ../sm-journal-plugin/classes/media_store.go
   - ../sm-journal-plugin/classes/media_store_test.go
   - ../sm-journal-plugin/field_types.go
   - ../sm-journal-plugin/controllers/posts.go
+  - ../sm-journal-plugin/controllers/categories.go
   - ../sm-journal-plugin/controllers/posts_editor_smoke_test.go
   - ../sm-journal-plugin/controllers/api/media.go
   - ../sm-journal-plugin/controllers/api/media_test.go
@@ -18,29 +22,37 @@ files_modified:
   - ../sm-journal-plugin/lang/en/lang.yaml
   - ../sm-journal-plugin/lang/pl/lang.yaml
   - ../sm-journal-plugin/posts_admin_smoke_test.go
+  - ../sm-journal-plugin/journal_api_categories_test.go
   - ../sm-journal-plugin/README.md
+  - .planning/notes/journal-html-sanitizing-bluemonday.md
 autonomous: true
-requirements: [D-02, D-03, D-05, D-06, D-07, D-08, D-09, D-10, D-14, D-18, D-19]
+requirements: [D-02, D-03, D-04, D-05, D-06, D-07, D-08, D-09, D-10, D-14, D-18, D-19]
 estimate:
-  tokens: 80000
-  raw_tokens: 80000
-  tasks: 2
+  tokens: 110000
+  raw_tokens: 110000
+  tasks: 3
   confidence: low
 must_haves:
   truths:
     - "D-08 and D-14: Journal registers the field types blogeditor and mlblogeditor (element golem15-journal-blogeditor, script assets/dist/blogeditor.js, style assets/dist/blogeditor.css) on the plugin; post content in models/post/fields.yaml is type mlblogeditor; excerpt keeps mltextarea."
-    - "D-10: Decode accepts only a string, runs classes.CheckHTML on it for every locale cabana hands it, and refuses with a pact.FormFieldError (422 on content) without rewriting anything; no sanitizer dependency is added."
-    - "D-02: an admin save that writes content stores the same HTML in content_html for that locale: the host column through FormBeforeCreate/FormBeforeUpdate, a non-default locale through FormAfterCreate/FormAfterUpdate and the translation writer; the admin path no longer runs goldmark (FormatHTML) on content."
+    - "D-10 (amended 2026-10-10) and D-04: Decode accepts a string (nil decodes to the empty string) and stores classes.SanitizeHTMLReport's output for every locale cabana hands it, post and category content alike, the raw HTML block and source-tab edits included: the exact submitted bytes and no notice when the policy keeps everything, otherwise the stripped HTML plus pact.FormFieldNotice values naming the removed elements, attributes and comments (lang keys with en and pl plural forms); a save never fails because of unsafe markup; any other value type is a FormFieldError (422 on content)."
+    - "D-02: an admin save that writes content stores the same sanitized HTML in content and content_html for that locale: the host column through FormBeforeCreate/FormBeforeUpdate, a non-default locale through FormAfterCreate/FormAfterUpdate and the translation writer; the admin path no longer runs goldmark (FormatHTML) on content."
     - "D-03 (Journal half) and todo journal-imported-html-admin-resave: a save that does not write content (cabana skipped it as untouched) leaves content and content_html byte-identical."
     - "D-07 (assumption A1): Load serves content when its first non-whitespace character is '<'; otherwise (a markdown post) it serves that locale's content_html, and FormatHTML(content) when content_html is empty; there is no format flag and no new column."
     - "D-09: POST and PUT /_journal/api/v1/posts keep markdown content with FormatHTML-rendered content_html, and POST /_journal/api/v1/media/upload keeps its response shape and validation messages."
-    - "D-19: category content uses blogeditor (not translatable, matching the Go model and the frozen PHP tree); the CheckHTML gate in the Categories controller's FormBeforeCreate/FormBeforeUpdate stays."
+    - "D-19 (amended): category content uses blogeditor (not translatable, matching the Go model and the frozen PHP tree) and is stripped and reported like post content; the 422 CheckHTML gate in the Categories controller's FormBeforeCreate/FormBeforeUpdate is retired (blank content still becomes NULL) and TestCategoriesAdminContent asserts the strip; no public category write path exists (routes.go mounts GET /_journal/api/v1/categories only), so no public contract changes."
     - "D-18 (Journal half): the blogeditor and mlblogeditor Upload stores an image through the media storage extracted from the public upload route (same key layout /journal/<folder>/<name>, same unique suffix, same public URL), accepts only jpg, jpeg, png, gif and webp whose first bytes sniff as that image type, at most 10240 KiB."
-    - "D-05: the embed placeholder from plan 02 passes CheckHTML unchanged."
+    - "D-05 (amended): htmlPolicy is extended for exactly the Blog Editor's own output, and nothing else: figure data-embed matching ^youtube$ and data-id matching ^[A-Za-z0-9_-]{11}$, img alt with any text, ol start matching ^[0-9]+$; every entry of plan 02's editor-corpus.json passes SanitizeHTML byte for byte with an empty removal report (TestEditorOutputPassesPolicy), while iframe, other data-* attributes, other providers and malformed ids are still stripped."
   artifacts:
     - path: "../sm-journal-plugin/classes/blog_editor.go"
       provides: "BlogEditorTypes, LooksLikeHTML and the Decode/Load/ListValue/Upload funcs"
       contains: "func BlogEditorTypes"
+    - path: "../sm-journal-plugin/classes/format_html.go"
+      provides: "SanitizeHTMLReport, HTMLRemovals and the editor-output policy extension"
+      contains: "func SanitizeHTMLReport"
+    - path: "../sm-journal-plugin/classes/editor_policy_test.go"
+      provides: "the Go half of the editor-output policy cross-check"
+      contains: "TestEditorOutputPassesPolicy"
     - path: "../sm-journal-plugin/classes/media_store.go"
       provides: "StoreMedia shared by the public upload route and the editor Upload"
       contains: "func StoreMedia"
@@ -51,6 +63,14 @@ must_haves:
       provides: "post content on the Blog Editor"
       contains: "mlblogeditor"
   key_links:
+    - from: "../sm-journal-plugin/classes/blog_editor.go decodeBlogHTML"
+      to: "../sm-journal-plugin/classes/format_html.go SanitizeHTMLReport"
+      via: "FormFieldDecoded{Value: sanitized, Notices: removalNotices(report)} per locale"
+      pattern: "SanitizeHTMLReport"
+    - from: "../sm-journal-plugin/classes/editor_policy_test.go"
+      to: "../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json (plan 02)"
+      via: "every corpus entry must come back from SanitizeHTML unchanged"
+      pattern: "editor-corpus.json"
     - from: "../sm-journal-plugin/controllers/posts.go preparePostWrite"
       to: "cabana.FieldWritesFromContext"
       via: "content_html := the written default-locale content"
@@ -64,7 +84,10 @@ must_haves:
       via: "extracted storage, response unchanged"
       pattern: "StoreMedia"
   prohibitions:
-    - statement: "classes.CheckHTML is never relaxed (no iframe or host allowlist) and nothing on the admin path sanitizes or rewrites content."
+    - statement: "htmlPolicy is never relaxed for iframe, object, embed, script, style, event attributes, target, rel, other data-* attributes or URL schemes; its only 16.2 additions are the four editor-output attributes, and the layer mirror (plan 04) adds the same four."
+      status: unresolved
+      verification: judgment
+    - statement: "The admin path never stores submitted bytes the policy would change: every written content value is SanitizeHTMLReport output, and no admin save fails because of unsafe markup."
       status: unresolved
       verification: judgment
     - statement: "The public Journal write API and the public media upload route keep the PHP contract: request fields, response shapes and messages do not change."
@@ -79,7 +102,17 @@ must_haves:
 
 ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
 
-This plan's slice (user decision 1, plan 03): Journal's Go integration in `../sm-journal-plugin`. The element from plan 02 becomes the `blogeditor`/`mlblogeditor` field types on the framework API from plan 01; post content and category content switch to it; the admin save path stores HTML in both columns without goldmark; editor uploads reuse the existing media storage.
+This plan's slice (user decision 1, plan 03): Journal's Go integration in `../sm-journal-plugin`. The element from plan 02 becomes the `blogeditor`/`mlblogeditor` field types on the framework API from plan 01; post content and category content switch to it; the admin save path stores sanitized HTML in both columns without goldmark and reports what it stripped; the shared policy admits the editor's own output; editor uploads reuse the existing media storage.
+
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-02, D-04, D-05, D-10 and D-19 amended)
+
+16.1 replaced the regex gate with bluemonday v1.0.27 (sm-journal-plugin a3551f2, 0d00ec8, 5f47083): `rejectUnsafe` is gone; `FormatHTML` renders with goldmark and then strips through `SanitizeHTML`; `FormatTranslation` sanitizes per-locale `content_html` on API and import writes; `CheckHTML` refuses whenever the policy would change the HTML. Under the amended D-10, every admin write of post and category content stores the policy's output, never fails because of unsafe markup, and reports what was removed. This plan therefore:
+
+- decodes with `classes.SanitizeHTMLReport` (new) instead of `CheckHTML`, and returns the removals as plan 01's `pact.FormFieldNotice` values;
+- retires the Categories controller's 422 gate (`TestCategoriesAdminContent` now asserts the strip);
+- extends the policy for exactly the editor's own output (amended D-05) and pins it with plan 02's corpus (new Task 3).
+
+Where RESEARCH (Pattern 6, Pitfall 10, Code Example 2, Security Domain) or PATTERNS describe CheckHTML refusing or "no sanitizer", this plan's text wins. The pre-phase sm-journal-plugin head is now c60abc6 (requires summercms v0.1.17).
 
 ## Spec-less probe fallback
 
@@ -91,23 +124,30 @@ Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to
 - **Load fallback:** a markdown value whose `content_html` is empty for that locale is served as `FormatHTML(content)` (a format error serves the content unchanged), so the editor never opens empty on a post that has a body.
 - **Options:** `mlblogeditor` takes `htmlColumn` (the translatable attribute holding the rendered HTML, `content_html` for posts) and `uploadFolder`; `blogeditor` takes `uploadFolder` only. `uploadFolder` follows the public route's folder rule (at most 100 characters, `^[A-Za-z0-9_\-/]*$`, no `..`). Posts use `posts`, categories use `categories`.
 - **Editor upload filenames:** the base name is lowercased and every character outside `[a-z0-9._-]` becomes `-` (runs collapsed, extension kept, empty name becomes `image`), so the inserted `src` needs no escaping. The public route keeps its own naming (D-09).
-- **The posts import action** (`runImportPosts`, `console/import_posts.go`) keeps calling `FormatHTML` on PHP exports; it is not a form save and stays gated by FormatHTML's rejectUnsafe.
+- **The posts import action** (`runImportPosts`, `console/import_posts.go`) keeps calling `FormatHTML` (goldmark, then `SanitizeHTML`) and `FormatTranslation` on PHP exports; it is not a form save and reports nothing.
+- **Public API category writes (API parity check, done at planning time):** `routes.go` mounts only `GET /_journal/api/v1/categories`; there is no public category write path, so retiring the admin 422 changes no public contract. The public posts routes keep `FormatHTML` and `FormatTranslation` (D-09); their responses do not change shape.
+- **`classes.CheckHTML` stays exported** (sm-journal-plugin is a tagged module; removing an exported function would be a breaking change for no gain). After this plan no admin or API write path calls it; it remains the predicate counterpart of the layer's `isSafeJournalHtml` and is used by the policy cross-check test. Its doc comment and README row say exactly that.
+- **Removal report:** `SanitizeHTMLReport` aligns the start tags of the input with those of bluemonday's output in order (bluemonday only removes, never adds or reorders). An unmatched input tag is a removed element; a raw attribute name missing from, or with a changed decoded value in, the matched output tag is a removed attribute (a `style` that lost a property counts under `style`); comments count separately; anything else that changed sets `Other`. Its report is empty exactly when the returned string equals the input. Names are distinct, first-seen order, at most 10 per list (counts stay exact).
+- **Policy extension (amended D-05), fixed set shared with plan 04's layer mirror:** `figure` `data-embed` `^youtube$` and `data-id` `^[A-Za-z0-9_-]{11}$` (the embed placeholder); `img` `alt` with any value (the editor's alt field takes free text; UGC's Paragraph pattern drops `:`, `?`, `"` and more; an attribute value is escaped on output and carries no URL); `ol` `start` `^[0-9]+$` (TipTap's ordered-list input rule writes it when a list does not start at 1). If plan 02's corpus shows any other attribute the policy strips, stop and report: plans 03 and 04 must add it together, and only if it is not a URL, style, event or iframe attribute.
 - **ListValue:** strips tags, collapses whitespace and truncates to 120 runes with an ellipsis. No Journal list uses it today; it exists for any list column a host declares with the alias.
 
 ## Artifacts this phase produces (this plan)
 
-- `classes.BlogEditorTypes(app func() *backpack.App) []pact.FormFieldType`, `classes.LooksLikeHTML(s string) bool`, `classes.BlogEditorElement` (const `golem15-journal-blogeditor`), unexported `decodeBlogHTML`, `loadBlogHTML`, `blogListValue`, `uploadBlogImage`, `safeUploadName`, `checkBlogOptions`.
+- `classes.BlogEditorTypes(app func() *backpack.App) []pact.FormFieldType`, `classes.LooksLikeHTML(s string) bool`, `classes.BlogEditorElement` (const `golem15-journal-blogeditor`), unexported `decodeBlogHTML`, `loadBlogHTML`, `blogListValue`, `uploadBlogImage`, `safeUploadName`, `checkBlogOptions`, `removalNotices`.
+- `classes.SanitizeHTMLReport(doc string) (string, classes.HTMLRemovals)`, `classes.HTMLRemovals{Elements, ElementCount, Attributes, AttributeCount, Comments, Other}` with `Empty() bool`; `SanitizeHTML` becomes the string half of it; `CheckHTML` kept (doc comment updated); `newHTMLPolicy` gains the four editor-output attributes.
 - `classes.StoreMedia(ctx, bucket *blob.Bucket, folder, filename string, body io.Reader) (classes.StoredMedia, error)`, `classes.StoredMedia{URL, Path}`, `classes.MediaError{Field, Message}`, `classes.MediaMaxBytes`, `classes.MediaFolderPattern`, moved `mediaObjectPath` and `uniqueMediaKey`.
 - `(*journal.Plugin).FormFieldTypes()` in the new `field_types.go`; `postsAdminController.FormAfterCreate`, `postsAdminController.FormAfterUpdate`, unexported `writeContentHTMLTranslations`.
-- Lang keys `golem15.journal::lang.editor.content_invalid`, `golem15.journal::lang.editor.image_invalid`, `golem15.journal::lang.editor.upload_failed` (en and pl).
+- Lang keys `golem15.journal::lang.editor.content_invalid`, `golem15.journal::lang.editor.image_invalid`, `golem15.journal::lang.editor.upload_failed`, and the plural notices `golem15.journal::lang.editor.removed_elements`, `removed_attributes`, `removed_comments` and the plain `markup_changed` (en and pl).
 - Field type aliases `blogeditor`, `mlblogeditor`; fields.yaml keys `htmlColumn`, `uploadFolder`.
-- Smoke test `TestBlogEditorTracerSmoke`, `TestBlogEditorUploadSmoke`; moved tests in `classes/media_store_test.go`.
+- Smoke test `TestBlogEditorTracerSmoke`, `TestBlogEditorUploadSmoke`; moved tests in `classes/media_store_test.go`; `TestEditorOutputPassesPolicy` and `TestSanitizeHTMLReport` in `classes/editor_policy_test.go`.
+- Updated Postgres tests (compiled by vet, run on a Docker host): `TestPostsFormCompiles`, `TestPostsAdminCreateSmoke`, `TestPostsAdminResaveKeepsHTML`, `TestPostsAdminSaveSanitizesHTML`, `TestCategoriesAdminContent`.
+- Decision note amendment in `.planning/notes/journal-html-sanitizing-bluemonday.md` (summercms.go, docs commit).
 
 <objective>
-Wire the Blog Editor into Journal: field types, Decode/Load, post and category fields, admin save hooks and editor uploads (D-02, D-03, D-05 to D-10, D-14, D-18, D-19).
+Wire the Blog Editor into Journal: field types, strip-and-report Decode, Load, post and category fields, admin save hooks, the policy extension for the editor's own output and editor uploads (D-02 to D-10, D-14, D-18, D-19).
 
-Purpose: Journal post and category content are edited with the Blog Editor, and an admin save keeps imported HTML intact.
-Output: classes/blog_editor.go, classes/media_store.go, field_types.go, hook changes, fields.yaml switches, lang keys, updated Docker tests, smoke tests, README.
+Purpose: Journal post and category content are edited with the Blog Editor; an admin save keeps imported HTML intact when nothing is unsafe, strips what is and tells the admin what it removed.
+Output: classes/blog_editor.go, SanitizeHTMLReport and the policy extension in classes/format_html.go, classes/media_store.go, field_types.go, hook changes (posts and categories), fields.yaml switches, lang keys, the policy cross-check test, updated Docker tests, smoke tests, README, decision note amendment.
 </objective>
 
 <execution_context>
@@ -123,7 +163,7 @@ Output: classes/blog_editor.go, classes/media_store.go, field_types.go, hook cha
 @.planning/todos/pending/journal-imported-html-admin-resave.md
 @.planning/todos/pending/cabana-richeditor-field-type.md
 
-Repository: `../sm-journal-plugin` (branch main), building against the `../summercms.go` working tree through `go.work` (so plan 01's API is available without a tag). Commits: no co-author tags, stage by explicit path. The identifier list in 16.2-01-SUMMARY applies if Task 1 of plan 01 renamed anything (read it first). The pre-phase sm-journal-plugin head is 03907ee; acceptance checks below diff against it.
+Repository: `../sm-journal-plugin` (branch main), building against the `../summercms.go` working tree through its go.mod `replace` and `go.work` (so plan 01's API is available without a tag). Commits: no co-author tags, stage by explicit path. The identifier list in 16.2-01-SUMMARY applies if Task 1 of plan 01 renamed anything (read it first). The pre-phase sm-journal-plugin head is c60abc6 (16.1 shipped a3551f2, 0d00ec8, 5f47083 and c60abc6 after this phase was first planned); acceptance checks below diff against it. The decision note lives in this repository (summercms.go `.planning/notes/`) and is committed there as a separate docs commit.
 
 No Docker here: the root package (TestMain starts Postgres) and `./models` cannot run. Smoke tests live in `./controllers` and `./classes`; the root-package Postgres tests are updated for correctness (go vet compiles them) and run on a Docker host (plan 05 gate, plan 06).
 
@@ -132,8 +172,11 @@ From plan 01 (pact and cabana, see 16.2-01-SUMMARY for the final names):
 
 ```go
 type FormFieldType struct { Name, Element string; Translatable bool; Scripts, Styles, Options []string
-	CheckOptions func(map[string]any) error; Decode, Load func(context.Context, FormFieldValue) (any, error)
+	CheckOptions func(map[string]any) error; Decode func(context.Context, FormFieldValue) (FormFieldDecoded, error)
+	Load func(context.Context, FormFieldValue) (any, error)
 	ListValue func(any) string; Upload func(context.Context, FormFieldUpload) (FormFieldUploadResult, error) }
+type FormFieldDecoded struct { Value any; Notices []FormFieldNotice }
+type FormFieldNotice struct { Message string; Params map[string]string; Count int } // cabana localizes; Count > 0 = plural
 type FormFieldValue struct { DB *gorm.DB; Record any; Field string; Options map[string]any; Locale string
 	Default bool; Value any; Translated func(attribute string) (string, bool, error) }
 type FormFieldUpload struct { DB *gorm.DB; Record any; Field string; Options map[string]any; Filename string; Body io.Reader }
@@ -149,24 +192,30 @@ type TranslationWriter interface { /* DefaultLocale, EnabledLocales, WriteTransl
 
 Journal code to change (read before editing):
 - `controllers/posts.go` `preparePostWrite` (204-221) runs `classes.FormatHTML(post.Content)` and sets `post.ContentHTML`: this is the admin-path goldmark call to replace.
-- `controllers/categories.go` `prepareCategoryWrite` (65-82): blank to NULL plus CheckHTML 422; stays as is (D-19).
+- `controllers/categories.go` `prepareCategoryWrite` (65-82): blank to NULL plus the CheckHTML 422. The 422 is retired in Task 2 (D-19 amended); blank to NULL stays.
+- `journal_api_categories_test.go` `TestCategoriesAdminContent` (138): subtests "unsafe create refused" and "unsafe update refused" with `assertContentRefused`; they become strip assertions in Task 2.
+- `posts_admin_smoke_test.go` `TestPostsAdminSaveSanitizesHTML` (159): asserts content stored as submitted and content_html sanitized; under D-02 both columns hold the sanitized HTML (Task 1).
 - `controllers/api/media.go` `UploadMedia` (22-91): auth, folder check, extension allowlist, 10240 KiB cap, `mediaObjectPath`, `uniqueMediaKey`, bucket write, 201 `{data:{url,path}}`.
 - `models/post.go`: `Content string`, `ContentHTML string`, `Translatable()` includes content and content_html. `models/category.go`: `Content *string`, not translatable.
-- `classes/format_html.go`: `FormatHTML(src string) (string, error)`, `CheckHTML(doc string) error`.
+- `classes/format_html.go`: `newHTMLPolicy` (UGC plus footer, class, microdata, four styles, footnote roles, dir, two chat data attributes), `FormatHTML(src string) (string, error)` (goldmark then SanitizeHTML), `SanitizeHTML(doc string) string`, `FormatTranslation(attrs map[string]any) error`, `CheckHTML(doc string) error` (error when the policy would change doc), unexported `sanitizeHTML` (returns doc unchanged when `sameTokens` holds), `sameTokens`, `htmlTokens`, `rawAttrNames` (duplicate attributes count as a change).
+- `classes/format_html_test.go` `unsafePayloads` (the 35 stored-XSS payloads), `classes/check_html_test.go`, `classes/format_translation_test.go`: existing tests that must keep passing.
+- `routes.go`: the public routes (no category write).
 </interfaces>
 </context>
 
 <tasks>
 
 <task type="tracer">
-  <name>Task 1: Tracer: post content on mlblogeditor end to end (types on the plugin, fields.yaml, Decode with CheckHTML, Load with D-07, both columns written by the hooks)</name>
+  <name>Task 1: Tracer: post content on mlblogeditor end to end (types on the plugin, fields.yaml, strip-and-report Decode, Load with D-07, both columns written by the hooks)</name>
   <reversibility rating="costly">D-02 and D-11: every post saved from the admin becomes HTML content (moving back needs an HTML-to-markdown migration), and the aliases blogeditor and mlblogeditor end up in fields.yaml files that a rename must edit.</reversibility>
   <precondition>16.2-01-SUMMARY.md and 16.2-02-SUMMARY.md exist; `go -C ../sm-journal-plugin build ./...` succeeds against the current ../summercms.go working tree and ../sm-journal-plugin/assets/dist/blogeditor.js exists.</precondition>
-  <files>../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/field_types.go, ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/models/post/fields.yaml, ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/lang/pl/lang.yaml, ../sm-journal-plugin/posts_admin_smoke_test.go</files>
-  <read_first>.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md (final identifiers), ../summercms.go/modules/pact/capabilities.go (FormFieldType and friends), ../summercms.go/modules/cabana/tx_context.go (FieldWritesFromContext, WithFieldWrites, TxFromContext), ../summercms.go/modules/cabana/field_ml.go (TranslationWriter), ../summercms.go/docs/backend/field-types.md, ../sm-journal-plugin/classes/format_html.go, ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/admin_registry.go, ../sm-journal-plugin/admin.go, ../sm-journal-plugin/plugin.go, ../sm-journal-plugin/models/post.go, ../sm-journal-plugin/models/post/fields.yaml, ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/posts_admin_smoke_test.go, ../summercms.go/modules/cabana/locale_order_test.go (recording TranslationWriter style), ../summercms.go/modules/bouncer/context.go (WithUser)</read_first>
-  <action>Make one post-content save path work end to end on the new types (per D-02, D-03, D-07, D-08, D-10, D-14).
+  <files>../sm-journal-plugin/classes/format_html.go, ../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/field_types.go, ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/models/post/fields.yaml, ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/lang/pl/lang.yaml, ../sm-journal-plugin/posts_admin_smoke_test.go</files>
+  <read_first>.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md (final identifiers), ../summercms.go/modules/pact/capabilities.go (FormFieldType and friends), ../summercms.go/modules/cabana/tx_context.go (FieldWritesFromContext, WithFieldWrites, TxFromContext), ../summercms.go/modules/cabana/field_ml.go (TranslationWriter), ../summercms.go/docs/backend/field-types.md, ../sm-journal-plugin/classes/format_html.go (sanitizeHTML, sameTokens, htmlTokens, rawAttrNames), ../sm-journal-plugin/classes/format_html_test.go (unsafePayloads), ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/admin_registry.go, ../sm-journal-plugin/admin.go, ../sm-journal-plugin/plugin.go, ../sm-journal-plugin/models/post.go, ../sm-journal-plugin/models/post/fields.yaml, ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/posts_admin_smoke_test.go (TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML), ../summercms.go/modules/phrasebook/backend/lang/pl/lang.yaml (lines 40-44: plural map format), ../summercms.go/modules/cabana/locale_order_test.go (recording TranslationWriter style), ../summercms.go/modules/bouncer/context.go (WithUser)</read_first>
+  <action>Make one post-content save path work end to end on the new types (per D-02, D-03, D-04, D-07, D-08, D-10, D-14).
 
-classes/blog_editor.go: const BlogEditorElement = "golem15-journal-blogeditor"; BlogEditorTypes(app func() *backpack.App) returns two pact.FormFieldType values: blogeditor (Translatable false, Options ["uploadFolder"]) and mlblogeditor (Translatable true, Options ["htmlColumn", "uploadFolder"]), both with Element BlogEditorElement, Scripts ["assets/dist/blogeditor.js"], Styles ["assets/dist/blogeditor.css"], CheckOptions checkBlogOptions (htmlColumn must be an identifier; uploadFolder as in the assumptions), Decode decodeBlogHTML, Load loadBlogHTML, ListValue blogListValue (Upload is added in Task 2). decodeBlogHTML (D-10): a non-string value is a FormFieldError with "golem15.journal::lang.editor.content_invalid"; CheckHTML(text) failing is a FormFieldError with the error text (the message category content shows today); otherwise it returns the string unchanged. LooksLikeHTML(s) reports whether the first non-whitespace character is '<' (assumption A1). loadBlogHTML (D-07): Value as string (string, *string, nil become the text, nil and a nil pointer become ""); if LooksLikeHTML or the htmlColumn option is unset, serve the text; otherwise read in.Translated(htmlColumn) and serve it when found and non-empty, else serve FormatHTML(text) (on error the text). blogListValue strips tags, collapses whitespace, truncates to 120 runes plus an ellipsis.
+Removal report (D-10 amended), in classes/format_html.go: add HTMLRemovals and SanitizeHTMLReport(doc) as described in the assumptions (in-order start-tag alignment; elements, attributes via rawAttrNames so a repeated name counts, comments, Other; at most 10 distinct names per list with exact counts; Empty() is false exactly when the returned string differs from doc). SanitizeHTML returns SanitizeHTMLReport's string, so both share one implementation; FormatHTML, FormatTranslation and CheckHTML keep their behaviour and tests.
+
+classes/blog_editor.go: const BlogEditorElement = "golem15-journal-blogeditor"; BlogEditorTypes(app func() *backpack.App) returns two pact.FormFieldType values: blogeditor (Translatable false, Options ["uploadFolder"]) and mlblogeditor (Translatable true, Options ["htmlColumn", "uploadFolder"]), both with Element BlogEditorElement, Scripts ["assets/dist/blogeditor.js"], Styles ["assets/dist/blogeditor.css"], CheckOptions checkBlogOptions (htmlColumn must be an identifier; uploadFolder as in the assumptions), Decode decodeBlogHTML, Load loadBlogHTML, ListValue blogListValue (Upload is added in Task 2). decodeBlogHTML (D-10 amended, D-04): nil decodes to ""; any other non-string value is a FormFieldError with "golem15.journal::lang.editor.content_invalid"; a string goes through SanitizeHTMLReport and the result is pact.FormFieldDecoded{Value: the sanitized string, Notices: removalNotices(report)}, so a value the policy keeps whole is returned byte for byte with no notice. removalNotices emits, in this order and only when non-zero: golem15.journal::lang.editor.removed_elements (Count ElementCount, Params names = the element names joined with ", ", plus "…" when more than 10 were cut), removed_attributes (the same for attributes), removed_comments (Count Comments), markup_changed (Other, no count). Decode never refuses because of markup. LooksLikeHTML(s) reports whether the first non-whitespace character is '<' (assumption A1). loadBlogHTML (D-07): Value as string (string, *string, nil become the text, nil and a nil pointer become ""); if LooksLikeHTML or the htmlColumn option is unset, serve the text; otherwise read in.Translated(htmlColumn) and serve it when found and non-empty, else serve FormatHTML(text) (on error the text). blogListValue strips tags, collapses whitespace, truncates to 120 runes plus an ellipsis.
 
 field_types.go (root package): (p *Plugin) FormFieldTypes() []pact.FormFieldType returns classes.BlogEditorTypes with a lazy accessor of p.app, plus the compile-time assertion that *Plugin implements pact.HasFormFieldTypes.
 
@@ -174,38 +223,40 @@ models/post/fields.yaml: content becomes type mlblogeditor with htmlColumn: cont
 
 controllers/posts.go (D-02, D-03, D-10): preparePostWrite stops calling FormatHTML; it keeps refuseUnpublishedWrite and the published_at check, then sets post.ContentHTML to the Default write of "content" from cabana.FieldWritesFromContext when there is one and leaves ContentHTML untouched otherwise. New FormAfterCreate and FormAfterUpdate on postsAdminController call writeContentHTMLTranslations, which for every non-default write of "content" calls the app's cabana.TranslationWriter WriteTranslated(ctx, tx, post, "content_html", locale, value), with tx from cabana.TxFromContext (falling back to c.db(ctx)); no writer means nothing to write. Add the pact.FormAfterCreate and pact.FormAfterUpdate compile-time assertions. The public API helpers (controllers/api/posts_helpers.go) are not touched (D-09).
 
-Lang: add editor.content_invalid ("The content must be HTML text." / "Treść musi być tekstem HTML."), editor.image_invalid and editor.upload_failed to lang/en and lang/pl.
+Lang: add editor.content_invalid ("The content must be HTML text." / "Treść musi być tekstem HTML."), editor.image_invalid and editor.upload_failed to lang/en and lang/pl, and the notices in the phrasebook plural map format: en removed_elements one ":count element was removed: :names", other ":count elements were removed: :names"; removed_attributes one ":count attribute was removed: :names", other ":count attributes were removed: :names"; removed_comments one ":count HTML comment was removed", other ":count HTML comments were removed"; markup_changed "The HTML filter changed some markup."; pl with one, few, many and other ("Usunięto :count element: :names" / "Usunięto :count elementy: :names" / "Usunięto :count elementów: :names" / "Usunięto :count elementu: :names", likewise atrybut/atrybuty/atrybutów/atrybutu and komentarz HTML/komentarze HTML/komentarzy HTML/komentarza HTML; markup_changed "Filtr HTML zmienił część znaczników.").
 
-Docker tests (correctness, compiled by vet, run on a Docker host): in posts_admin_smoke_test.go TestPostsFormCompiles expects "mlblogeditor" instead of "mlmarkdown" for content (keep the mltext, mltextarea and preset checks); TestPostsAdminCreateSmoke posts HTML content ("<p>Hello <strong>world</strong></p>" and the pl equivalent) and asserts stored.ContentHTML equals stored.Content exactly; TestPostsAdminResaveKeepsHTML compares content_html with the exact content bytes (no TrimSpace).
+Docker tests (correctness, compiled by vet, run on a Docker host): in posts_admin_smoke_test.go TestPostsFormCompiles expects "mlblogeditor" instead of "mlmarkdown" for content (keep the mltext, mltextarea and preset checks); TestPostsAdminCreateSmoke posts HTML content ("<p>Hello <strong>world</strong></p>" and the pl equivalent) and asserts stored.ContentHTML equals stored.Content exactly and that the create response has no meta.notices key; TestPostsAdminResaveKeepsHTML compares content_html with the exact content bytes (no TrimSpace); TestPostsAdminSaveSanitizesHTML (D-02, D-10 amended) keeps its unsafe input but now asserts that the save succeeds, that content and content_html are both the sanitized HTML and equal to each other for pl (host) and en (translation), that the "Data:" text is kept, and that the response's meta.notices names content for pl and en (removed elements a and base, removed attribute onerror).
 
-Smoke: controllers/posts_editor_smoke_test.go TestBlogEditorTracerSmoke (package controllers, no database): CompileFormWithTypes("golem15.journal", postsAdminController{}, os.DirFS(".."), classes.BlogEditorTypes(nil)) gives content type mlblogeditor, element golem15-journal-blogeditor, translatable, typeOptions htmlColumn content_html; Decode passes an HTML string and the placeholder from plan 02 unchanged and refuses a script tag and an onerror attribute with a FormFieldError; Load serves content for an HTML value, content_html (via a stub Translated) for a markdown value, FormatHTML output when content_html is empty; with WithFieldWrites({content: [pl default "<p>A</p>", en "<p>B</p>"]}) and a backend principal, FormBeforeUpdate sets ContentHTML "<p>A</p>" and FormAfterUpdate writes content_html for en through a recording TranslationWriter published on a backpack app; without writes FormBeforeUpdate leaves ContentHTML unchanged (no goldmark).
+Smoke: controllers/posts_editor_smoke_test.go TestBlogEditorTracerSmoke (package controllers, no database): CompileFormWithTypes("golem15.journal", postsAdminController{}, os.DirFS(".."), classes.BlogEditorTypes(nil)) gives content type mlblogeditor, element golem15-journal-blogeditor, translatable, typeOptions htmlColumn content_html; Decode returns a clean HTML string byte for byte with no notice, strips a script element and an onerror attribute and returns two notices (removed_elements Count 1 names "script", removed_attributes Count 1 names "onerror"), decodes nil to "" and refuses a number with a FormFieldError; Load serves content for an HTML value, content_html (via a stub Translated) for a markdown value, FormatHTML output when content_html is empty; with WithFieldWrites({content: [pl default "<p>A</p>", en "<p>B</p>"]}) and a backend principal, FormBeforeUpdate sets ContentHTML "<p>A</p>" and FormAfterUpdate writes content_html for en through a recording TranslationWriter published on a backpack app; without writes FormBeforeUpdate leaves ContentHTML unchanged (no goldmark).
 
-Commit as "feat(admin): post content on the Blog Editor field type" (classes, field_types.go, posts.go, fields.yaml, lang, tests), staged by explicit path.</action>
+Commit as "feat(classes): report what the HTML policy removes" (format_html.go only) and "feat(admin): post content on the Blog Editor field type" (blog_editor.go, field_types.go, posts.go, fields.yaml, lang, tests), staged by explicit path.</action>
   <verify>
     <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^TestBlogEditorTracerSmoke$' -v ./controllers/ 2&gt;&amp;1 | grep -- '^--- PASS: TestBlogEditorTracerSmoke'</automated>
-    <fails_when>Non-zero exit: go vet fails (including the updated Docker tests), or no "--- PASS: TestBlogEditorTracerSmoke" line (fields.yaml does not compile with the types, Decode lets unsafe HTML through, Load ignores D-07, or the hooks do not write content_html).</fails_when>
-    <automated>go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestFormatHTMLKeepsRawHTML|TestFormatHTMLRejectsUnsafeHTML|TestCheckHTML)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 3</automated>
-    <fails_when>Non-zero exit: a classes or controllers test fails, or fewer than three "--- PASS: Test" lines for the FormatHTML and CheckHTML tests (the API-path renderer or the gate regressed).</fails_when>
+    <fails_when>Non-zero exit: go vet fails (including the updated Docker tests), or no "--- PASS: TestBlogEditorTracerSmoke" line (fields.yaml does not compile with the types, Decode stores unsafe HTML or refuses instead of stripping, a clean value changes or gets a notice, Load ignores D-07, or the hooks do not write content_html).</fails_when>
+    <automated>go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestFormatHTMLKeepsRawHTML|TestFormatHTMLSanitizesUnsafeHTML|TestFormatHTMLDuplicateAttributes|TestSanitizeHTML|TestCheckHTML)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 5</automated>
+    <fails_when>Non-zero exit: a classes or controllers test fails, or fewer than five "--- PASS: Test" lines for the FormatHTML, SanitizeHTML and CheckHTML tests (the API-path renderer, the byte-stability rule, the duplicate-attribute rule or the predicate regressed when SanitizeHTML moved onto SanitizeHTMLReport).</fails_when>
   </verify>
   <acceptance_criteria>
     - `grep -n "type: mlblogeditor" ../sm-journal-plugin/models/post/fields.yaml` prints one line and `grep -n "htmlColumn: content_html" ../sm-journal-plugin/models/post/fields.yaml` prints one line.
     - `grep -n "FieldWritesFromContext" ../sm-journal-plugin/controllers/posts.go` prints at least one line, and `grep -n "func (c postsAdminController) FormAfterUpdate" ../sm-journal-plugin/controllers/posts.go` prints one line.
-    - `git -C ../sm-journal-plugin diff --quiet 03907ee -- controllers/api/posts_helpers.go controllers/api/posts.go` exits 0 (D-09: the public posts API code is unchanged since the pre-phase head).
-    - TestBlogEditorTracerSmoke passes with its compile, Decode, Load (HTML, markdown, empty content_html) and hook subtests.
+    - `git -C ../sm-journal-plugin diff --quiet c60abc6 -- controllers/api/posts_helpers.go controllers/api/posts.go routes.go` exits 0 (D-09: the public posts API code and the route table are unchanged since the pre-phase head).
+    - `grep -n "func SanitizeHTMLReport" ../sm-journal-plugin/classes/format_html.go` prints one line, and `grep -n "SanitizeHTMLReport" ../sm-journal-plugin/classes/blog_editor.go` prints at least one line.
+    - `grep -n "CheckHTML(" ../sm-journal-plugin/classes/blog_editor.go ../sm-journal-plugin/controllers/posts.go` prints nothing (no call: the admin post path never refuses on markup).
+    - TestBlogEditorTracerSmoke passes with its compile, Decode (clean unchanged, strip with notices, nil, non-string), Load (HTML, markdown, empty content_html) and hook subtests.
     - TestPostsFormCompiles in posts_admin_smoke_test.go looks for "mlblogeditor".
   </acceptance_criteria>
-  <done>Post content compiles as mlblogeditor, unsafe HTML is refused per locale, markdown posts are served as their content_html, and a written content value lands in content_html for its locale without goldmark.</done>
+  <done>Post content compiles as mlblogeditor, unsafe HTML is stripped per locale with notices naming what was removed (clean HTML is stored byte for byte), markdown posts are served as their content_html, and a written content value lands in content_html for its locale without goldmark.</done>
 </task>
 
 <task type="auto" tdd="true">
-  <name>Task 2: Expansion: category content on blogeditor, editor uploads through the extracted media storage, README</name>
-  <files>../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/classes/media_store.go, ../sm-journal-plugin/classes/media_store_test.go, ../sm-journal-plugin/controllers/api/media.go, ../sm-journal-plugin/controllers/api/media_test.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/models/category/fields.yaml, ../sm-journal-plugin/README.md</files>
-  <read_first>../sm-journal-plugin/classes/blog_editor.go (Task 1 state), ../sm-journal-plugin/controllers/api/media.go, ../sm-journal-plugin/controllers/api/media_test.go, ../sm-journal-plugin/controllers/categories.go, ../sm-journal-plugin/models/category.go, ../sm-journal-plugin/models/category/fields.yaml, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/README.md, ../summercms.go/modules/lagoon/attach (PublicURL), /media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/models/Category.php (translatable list, lines 36-40)</read_first>
+  <name>Task 2: Expansion: category content on blogeditor (stripped like posts, the 422 gate retired), editor uploads through the extracted media storage, README</name>
+  <files>../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/classes/media_store.go, ../sm-journal-plugin/classes/media_store_test.go, ../sm-journal-plugin/controllers/api/media.go, ../sm-journal-plugin/controllers/api/media_test.go, ../sm-journal-plugin/controllers/categories.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/models/category/fields.yaml, ../sm-journal-plugin/journal_api_categories_test.go, ../sm-journal-plugin/README.md</files>
+  <read_first>../sm-journal-plugin/classes/blog_editor.go (Task 1 state), ../sm-journal-plugin/controllers/api/media.go, ../sm-journal-plugin/controllers/api/media_test.go, ../sm-journal-plugin/controllers/categories.go (prepareCategoryWrite 65-82), ../sm-journal-plugin/journal_api_categories_test.go (TestCategoriesAdminContent 138: assertContentRefused, the two unsafe subtests, blank update stores null), ../sm-journal-plugin/routes.go (public routes: GET categories only), ../sm-journal-plugin/models/category.go, ../sm-journal-plugin/models/category/fields.yaml, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/README.md, ../summercms.go/modules/lagoon/attach (PublicURL), /media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/models/Category.php (translatable list, lines 36-40)</read_first>
   <behavior>
     - StoreMedia keeps the public route's rules: extensions jpg, jpeg, png, gif, webp only; more than 10240 KiB is a MediaError on file with "The file may not be greater than 10240 kilobytes."; keys /journal/<folder>/<name> with the existing unique suffix; returns the attach.PublicURL of the key and the path.
     - UploadMedia answers exactly as before (201 {data:{url, path}}, the same 422 messages) using StoreMedia.
     - Editor Upload: a png named "Zdjęcie 1.PNG" with png bytes is stored under /journal/posts/ with a safe name and returns its URL; a .png whose bytes sniff as text/html is a FormFieldError; an svg is a FormFieldError; a missing bucket is an opaque error.
-    - Category content: models/category/fields.yaml content is type blogeditor with uploadFolder categories; CompileFormWithTypes accepts it; Load serves the stored HTML for a *string (nil gives ""); prepareCategoryWrite still maps blank to NULL and refuses unsafe HTML.
+    - Category content (D-19 amended): models/category/fields.yaml content is type blogeditor with uploadFolder categories; CompileFormWithTypes accepts it; Load serves the stored HTML for a *string (nil gives ""); Decode strips `<p onclick="steal()">x</p>` to `<p>x</p>` with a removed_attributes notice; prepareCategoryWrite maps blank (including whitespace only) to NULL and accepts every other value it receives, returning no error for markup.
   </behavior>
   <action>Finish the Journal half (per D-18, D-19, D-09).
 
@@ -213,11 +264,13 @@ Media storage (D-18, D-09): new classes/media_store.go with MediaMaxBytes (10240
 
 Editor Upload (D-18): uploadBlogImage, set as Upload on both types: looks up *blob.Bucket from the app accessor (missing is an opaque error), reads the first 512 bytes and requires http.DetectContentType to report image/jpeg, image/png, image/gif or image/webp (else FormFieldError "golem15.journal::lang.editor.image_invalid"), builds the name with safeUploadName (assumption: lowercase, characters outside a-z, 0-9, dot, underscore and hyphen become hyphens, runs collapsed, extension kept, empty becomes image), calls StoreMedia with the field's uploadFolder (default "editor") and the sniffed head re-joined to the rest of the body, maps a MediaError to a FormFieldError with its message and returns FormFieldUploadResult{URL}.
 
-Category (D-19): models/category/fields.yaml content becomes type blogeditor with uploadFolder: categories (keep label, comment, size and span); the Categories controller is not changed.
+Category (D-19 amended, D-10): models/category/fields.yaml content becomes type blogeditor with uploadFolder: categories (keep label, comment, size and span), so category content goes through the same strip-and-report Decode as posts. In controllers/categories.go, prepareCategoryWrite keeps the blank-to-NULL rule and drops the HTML gate and its 422; its doc comment says category content arrives already sanitized by the blogeditor Decode (D-10 amended, decision note), and that rows written by SQL or import commands are not sanitized here. Remove the classes import if nothing else in the file uses it. API parity: there is no public category write route (routes.go), so no public contract changes; if the executor finds one, it stops and reports instead of changing it.
+
+Postgres test (correctness, compiled by vet, run on a Docker host): in journal_api_categories_test.go TestCategoriesAdminContent, replace the 422 refusal helper with an assertContentStripped helper. "unsafe create refused" becomes "unsafe create stripped": the POST answers 201, the row exists with content `<p>x</p>`, and the response's meta.notices has one entry for field content naming onclick. "unsafe update refused" becomes "unsafe update stripped": the PUT answers 200, the stored content is "x" (bluemonday drops the javascript: href and the bare a element), and meta.notices names the removed a element. The safe create keeps its byte-identical assertion and gains "no notices key in meta"; "blank update stores null" and "posts-only token forbidden" stay as they are.
 
 Smoke: add TestBlogEditorUploadSmoke to controllers/posts_editor_smoke_test.go (gocloud.dev/blob/memblob bucket published on a backpack app) covering the behavior bullets for StoreMedia, the editor Upload and the category compile and Load.
 
-README.md (plugin README, may name the plugin): an Admin section update describing the Blog Editor field types blogeditor and mlblogeditor and their options, what an admin save stores (HTML in content and content_html per locale; untouched content is not rewritten; markdown posts open with their rendered HTML and become HTML on the first edit), that the public API stays markdown-in (D-09), and editor uploads. Commit as "feat(admin): category content on the Blog Editor and editor image uploads" and "refactor(api): share media storage with the editor upload" as two commits, staged by explicit path.</action>
+README.md (plugin README, may name the plugin): an Admin section update describing the Blog Editor field types blogeditor and mlblogeditor and their options; what an admin save stores (the sanitized HTML in content and content_html per locale; a value the policy keeps whole is stored byte for byte; anything the policy does not allow is removed and the save names what was removed; untouched content is not rewritten; markdown posts open with their rendered HTML and become HTML on the first edit); that category content follows the same rule and is no longer refused with a 422 (replace the "refuses content that fails classes.CheckHTML" sentence in the categories section); that the public API stays markdown-in (D-09); and editor uploads. Commit as "feat(admin): category content on the Blog Editor and editor image uploads" (category fields.yaml, categories.go, Upload, tests, README) and "refactor(api): share media storage with the editor upload" as two commits, staged by explicit path.</action>
   <verify>
     <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorTracerSmoke|TestBlogEditorUploadSmoke)$' -v ./controllers/ 2&gt;&amp;1 | grep -c '^--- PASS: TestBlogEditor' | grep -qx 2</automated>
     <fails_when>Non-zero exit: vet fails, or fewer than two "--- PASS: TestBlogEditor" lines (upload storage, sniffing, safe names, category compile or Load broken, or the Task 1 smoke regressed).</fails_when>
@@ -226,12 +279,59 @@ README.md (plugin README, may name the plugin): an Admin section update describi
   </verify>
   <acceptance_criteria>
     - `grep -n "type: blogeditor" ../sm-journal-plugin/models/category/fields.yaml` prints one line.
+    - `grep -n "CheckHTML(" ../sm-journal-plugin/controllers/categories.go` prints nothing and `grep -n "ValidationError" ../sm-journal-plugin/controllers/categories.go` prints nothing (the 422 gate is retired).
+    - `grep -n "assertContentRefused" ../sm-journal-plugin/journal_api_categories_test.go` prints nothing and `grep -n "unsafe create stripped" ../sm-journal-plugin/journal_api_categories_test.go` prints one line; `go -C ../sm-journal-plugin vet ./...` compiles the updated test.
+    - `grep -n "categories" ../sm-journal-plugin/routes.go` prints only GET lines (no public category write path).
     - `grep -n "StoreMedia" ../sm-journal-plugin/controllers/api/media.go` prints at least one line, and `grep -n '"path":' ../sm-journal-plugin/controllers/api/media.go` still prints one line (response shape kept).
     - `grep -n "func StoreMedia" ../sm-journal-plugin/classes/media_store.go` prints one line, and classes/media_store_test.go holds TestMediaObjectPath and TestMediaFolderPatternRejectsDotDot.
-    - TestBlogEditorUploadSmoke passes its sniff, svg, safe-name, size and category subtests.
-    - README.md mentions blogeditor and mlblogeditor.
+    - TestBlogEditorUploadSmoke passes its sniff, svg, safe-name, size and category (compile, Load, strip with notice, blank to NULL) subtests.
+    - README.md mentions blogeditor and mlblogeditor, and its categories section no longer says the form refuses content with a 422.
   </acceptance_criteria>
-  <done>Category content uses the Blog Editor, editor images upload into the same media storage and URLs as the public route, and the public route's contract is unchanged.</done>
+  <done>Category content uses the Blog Editor and is stripped and reported like posts (no 422), editor images upload into the same media storage and URLs as the public route, and the public route's contract is unchanged.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Expansion: the HTML policy admits exactly the Blog Editor's own output, pinned by plan 02's corpus; CheckHTML and README documentation; decision note</name>
+  <reversibility rating="costly">D-05: the embed placeholder and the editor's alt and start attributes become stored content that the policy must keep accepting; narrowing the policy later would strip them from live posts on their next edited save.</reversibility>
+  <precondition>../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json exists (plan 02 Task 3) and parses as JSON.</precondition>
+  <files>../sm-journal-plugin/classes/format_html.go, ../sm-journal-plugin/classes/editor_policy_test.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/README.md, .planning/notes/journal-html-sanitizing-bluemonday.md</files>
+  <read_first>../sm-journal-plugin/classes/format_html.go (newHTMLPolicy, SanitizeHTMLReport from Task 1), ../sm-journal-plugin/classes/format_html_test.go (unsafePayloads, TestFormatHTMLSanitizesUnsafeHTML), ../sm-journal-plugin/classes/check_html_test.go, ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json (plan 02), ../sm-journal-plugin/tests/blogeditor/fixtures/imported-post.html (plan 02), ~/go/pkg/mod/github.com/microcosm-cc/bluemonday@v1.0.27/policies.go (UGCPolicy) and helpers.go (AllowImages, AllowLists, AllowTables: what UGC already allows), ../sm-journal-plugin/README.md (Posts bullet, the CheckHTML row in API reference, Dependencies), .planning/notes/journal-html-sanitizing-bluemonday.md, ../vue-journal-layer/app/utils/htmlGate.ts (the mirror plan 04 extends with the same four rules)</read_first>
+  <behavior>
+    - Every entry of editor-corpus.json comes back from SanitizeHTML byte for byte, with an empty SanitizeHTMLReport and a nil CheckHTML.
+    - The placeholder `<figure data-embed="youtube" data-id="dQw4w9WgXcQ"></figure>` is kept, both through SanitizeHTML and as raw HTML inside markdown through FormatHTML.
+    - Still stripped and reported: data-embed other than youtube; data-id of 10 or 12 characters or holding a quote, space or angle bracket; data-embed or data-id on div, img or p; any other data attribute on figure; onload on the placeholder figure; an iframe next to a placeholder (the placeholder stays).
+    - img alt with a colon, a question mark and double quotes is kept; an alt whose text contains a double quote followed by an event-handler-like string stays one alt attribute (no new attribute appears in the tokens).
+    - ol start="3" is kept; start="x" on ol and start on ul are stripped.
+    - The 35 unsafePayloads are stripped exactly as before (TestFormatHTMLSanitizesUnsafeHTML unchanged) and the existing CheckHTML table passes unchanged.
+    - SanitizeHTMLReport: a style element, an onclick attribute, a comment, a repeated attribute, a style attribute that loses one property and more than ten distinct removed names each produce the documented report; for every unsafePayload, the imported-post fixture and every corpus entry, report.Empty() is true exactly when the output equals the input.
+  </behavior>
+  <action>Extend the shared policy for exactly the editor's own output (per D-05 amended, D-04, D-10).
+
+In newHTMLPolicy add, each with a comment naming the Blog Editor output (Phase 16.2 D-05) it serves: data-embed matching ^youtube$ and data-id matching ^[A-Za-z0-9_-]{11}$ on figure only; alt with any value on img only (added next to UGC's Paragraph rule; bluemonday accepts an attribute when any of its rules matches, and escapes the value on output); start matching ^[0-9]+$ on ol only. Add nothing else: no iframe allowance, no blanket data attribute allowance, no target, rel, style property or URL scheme. These are the same four rules plan 04 mirrors in the layer. If the corpus fails on any attribute outside this set, stop and report it (plans 03 and 04 must change together) instead of widening the policy.
+
+classes/editor_policy_test.go: TestEditorOutputPassesPolicy reads ../tests/blogeditor/fixtures/editor-corpus.json with os.ReadFile (a missing or empty file fails the test, never skips) and checks every entry plus the placeholder and negative cases of the behavior block; TestSanitizeHTMLReport covers the report cases and the Empty property, including the imported-post fixture.
+
+Update CheckHTML's doc comment: since Phase 16.2 no admin or API write path refuses with it (admin saves strip and report, D-10 amended); it reports whether the policy would change doc, the counterpart of the layer's isSafeJournalHtml, and the policy cross-check uses it. Extend TestBlogEditorTracerSmoke with the placeholder passing Decode unchanged with no notice.
+
+README.md: the API reference gains SanitizeHTMLReport and HTMLRemovals rows; the CheckHTML row says it is a predicate that no write path refuses with any more; the Posts and policy text lists the four editor-output additions and says admin saves strip and name what they removed.
+
+Decision note (summercms.go): append to the 2026-10-10 amendment a short paragraph and four table rows for the editor-output additions (figure data-embed and data-id, img alt any text, ol start), naming plan 02's corpus as the test that pins them and plan 04 as the layer mirror.
+
+Commit in sm-journal-plugin as "feat(classes): allow the Blog Editor's own markup in the HTML policy" (format_html.go, editor_policy_test.go, the smoke test, README), and in summercms.go, separately, as "docs(16.2): record the editor-output policy extension" (the note only), each staged by explicit path.</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestEditorOutputPassesPolicy|TestSanitizeHTMLReport|TestFormatHTMLSanitizesUnsafeHTML|TestFormatHTMLDuplicateAttributes|TestFormatHTMLKeepsRawHTML|TestSanitizeHTML|TestCheckHTML)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 7</automated>
+    <fails_when>Non-zero exit: vet fails, or fewer than seven "--- PASS: Test" lines: a corpus entry is changed by the policy (an editor attribute is still stripped), a negative case is no longer stripped (the extension is too wide), the report disagrees with the output, or an existing FormatHTML, SanitizeHTML or CheckHTML test regressed.</fails_when>
+    <automated>go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorTracerSmoke|TestBlogEditorUploadSmoke)$' -v ./controllers/ 2&gt;&amp;1 | grep -c '^--- PASS: TestBlogEditor' | grep -qx 2</automated>
+    <fails_when>Non-zero exit or fewer than two "--- PASS: TestBlogEditor" lines: a classes or controllers test fails, or the placeholder no longer passes Decode unchanged.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "data-embed" ../sm-journal-plugin/classes/format_html.go` and `grep -n "editor-corpus.json" ../sm-journal-plugin/classes/editor_policy_test.go` each print at least one line.
+    - `grep -n "func TestEditorOutputPassesPolicy" ../sm-journal-plugin/classes/editor_policy_test.go` and `grep -n "func TestSanitizeHTMLReport" ../sm-journal-plugin/classes/editor_policy_test.go` each print one line.
+    - `grep -n "SanitizeHTMLReport" ../sm-journal-plugin/README.md` prints at least one line.
+    - `grep -n "Phase 16.2" .planning/notes/journal-html-sanitizing-bluemonday.md` prints at least one line and the note names figure data-embed, data-id, img alt and ol start.
+    - `git -C ../sm-journal-plugin diff --quiet c60abc6 -- classes/format_html_test.go classes/check_html_test.go` exits 0 (the existing policy tests are not weakened).
+  </acceptance_criteria>
+  <done>The policy keeps every piece of markup the editor writes, still strips everything else it stripped before, and the corpus test fails the moment the editor's output and the policy drift apart.</done>
 </task>
 
 </tasks>
@@ -249,7 +349,9 @@ README.md (plugin README, may name the plugin): an Admin section update describi
 
 | Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
 |-----------|----------|-----------|----------|-------------|-----------------|
-| T-16.2-14 | Tampering (stored XSS) | decodeBlogHTML | high | mitigate | CheckHTML on every locale value cabana decodes (default and non-default), refuse with a FormFieldError, no rewrite; the smoke test covers script and onerror refusals and the placeholder passing |
+| T-16.2-14 | Tampering (stored XSS) | decodeBlogHTML (posts and categories) | high | mitigate | SanitizeHTMLReport on every locale value cabana decodes (default and non-default), for post and category content alike; the stored value is always the policy's output, never submitted bytes the policy would change; the removal is reported to the admin (no silent loss), and the layer sanitizes again before v-html; smoke and Postgres tests cover script, onerror, onclick and javascript: being stripped with notices and clean HTML staying byte for byte |
+| T-16.2-31 | Tampering (stored XSS) | newHTMLPolicy editor-output extension | high | mitigate | Exactly four additions with the narrowest patterns (figure data-embed ^youtube$, figure data-id ^[A-Za-z0-9_-]{11}$, img alt as an escaped attribute value, ol start ^[0-9]+$); no iframe, URL, style, event or blanket data attribute; TestEditorOutputPassesPolicy pins the corpus and the negative cases, the 35 existing payload tests stay unchanged (diff check against c60abc6), and the iframe exists only in the layer's rendered page (D-05) |
+| T-16.2-34 | Denial of Service | SanitizeHTMLReport and removal notices | low | mitigate | One pass over two token streams; at most 10 names per list with exact counts, so a body with thousands of removed parts yields at most four short notices (cabana also caps notices, T-16.2-33) |
 | T-16.2-15 | Tampering / Elevation | uploadBlogImage | high | mitigate | Extension allowlist without svg, http.DetectContentType magic-byte check for jpeg, png, gif and webp, 10240 KiB cap in StoreMedia plus cabana's upload cap; nginx serves the storage path with nosniff |
 | T-16.2-16 | Tampering | upload keys | medium | mitigate | uploadFolder validated at boot by the existing folder rule (no ..), safeUploadName limits the base name to a-z, 0-9, dot, underscore, hyphen; uniqueMediaKey never overwrites an existing object |
 | T-16.2-17 | Repudiation / contract | public posts and media routes | medium | mitigate | posts_helpers.go untouched (FormatHTML stays on the API path); UploadMedia keeps its response body and messages; the existing api tests keep passing |
@@ -258,14 +360,16 @@ README.md (plugin README, may name the plugin): an Admin section update describi
 </threat_model>
 
 <verification>
-- Task 1: go vet, TestBlogEditorTracerSmoke, the classes and controllers packages, FormatHTML and CheckHTML tests pass.
-- Task 2: go vet, both TestBlogEditor smoke tests, the classes and controllers packages pass.
-- The root-package Postgres tests (TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML) compile and run on a Docker host before the release (plan 05 docker-first option) or before /msd-verify-work.
+- Task 1: go vet, TestBlogEditorTracerSmoke, the classes and controllers packages, the FormatHTML, SanitizeHTML and CheckHTML tests pass.
+- Task 2: go vet, both TestBlogEditor smoke tests, the classes and controllers packages pass; the categories gate is gone.
+- Task 3: the corpus cross-check, the report tests and every existing policy test pass.
+- The root-package Postgres tests (TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent) compile and run on a Docker host before the release (plan 05 docker-first option) or before /msd-verify-work.
 </verification>
 
 <success_criteria>
-- Post content on mlblogeditor and category content on blogeditor, both gated by CheckHTML per locale.
-- Admin saves store HTML in both columns per written locale and leave untouched content byte-identical; the public API is unchanged.
+- Post content on mlblogeditor and category content on blogeditor, both stripped by the shared policy per locale with a removal report; no admin save fails because of markup.
+- Admin saves store the same sanitized HTML in both columns per written locale and leave untouched content byte-identical; the public API is unchanged.
+- The policy admits exactly the editor's own output (corpus test) and nothing more.
 - Editor uploads use the shared media storage with a magic-byte check.
 </success_criteria>
 

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-SUMMARY.md

@@ -0,0 +1,272 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 03
+subsystem: journal-admin
+tags: [sm-journal-plugin, field-types, blog-editor, bluemonday, sanitizing, uploads, cabana]
+
+requires:
+  - phase: 16.2-01
+    provides: pact field type API (FormFieldType with ListValue(ctx, value), FormFieldDecoded, FormFieldNotice, FormFieldUpload, FormFieldError), cabana FieldWritesFromContext, WithFieldWrites, TxFromContext, CompileFormWithTypes, TranslationWriter
+  - phase: 16.2-02
+    provides: golem15-journal-blogeditor element, assets/dist/blogeditor.js and .css in adminFS, tests/blogeditor/fixtures/editor-corpus.json
+provides:
+  - blogeditor and mlblogeditor field types on the Journal plugin (journal.Plugin.FormFieldTypes, classes.BlogEditorTypes, classes.BlogEditorElement, classes.LooksLikeHTML)
+  - classes.SanitizeHTMLReport and classes.HTMLRemovals (removal report behind the admin notices); SanitizeHTML is its string half
+  - newHTMLPolicy editor-output extension (figure data-embed/data-id, img alt, ol start)
+  - classes.StoreMedia, StoredMedia, MediaError, MediaMaxBytes, MediaFolderPattern shared by the public upload route and the editor upload
+  - postsAdminController FormAfterCreate/FormAfterUpdate writing content_html per written locale
+  - editor lang keys (content_invalid, image_invalid, upload_failed, removed_elements, removed_attributes, removed_comments, markup_changed) in en and pl
+affects: [16.2-04, 16.2-05, 16.2-06, journal]
+
+actuals:
+  tokens: 20600
+  tasks: 3
+  commits: 5
+plan_head_before: 086e485215f69bd8a78f61fb1d5e69b2246366cd
+plan_head_after: 2384a61e38f10afa522f38f8180cb62a32a9d9c0
+commits_repo: ../sm-journal-plugin
+docs_commits: [332993c]
+
+tech-stack:
+  added: []
+  patterns:
+    - "Removal report by in-order start-tag alignment: greedy match on an attribute-compatible output tag, falling back to element-name alignment; Other covers any change nothing else explains, so the report is empty exactly when the output equals the input"
+    - "Companion column through Form hooks: FieldWritesFromContext Default write to the host column in FormBefore*, non-default writes through the TranslationWriter in FormAfter*"
+    - "Policy pinned by the editor's own corpus: every corpus entry must survive byte for byte with an empty report"
+
+key-files:
+  created:
+    - ../sm-journal-plugin/classes/blog_editor.go
+    - ../sm-journal-plugin/classes/media_store.go
+    - ../sm-journal-plugin/classes/media_store_test.go
+    - ../sm-journal-plugin/classes/editor_policy_test.go
+    - ../sm-journal-plugin/field_types.go
+    - ../sm-journal-plugin/controllers/posts_editor_smoke_test.go
+  modified:
+    - ../sm-journal-plugin/classes/format_html.go
+    - ../sm-journal-plugin/controllers/posts.go
+    - ../sm-journal-plugin/controllers/admin_registry.go
+    - ../sm-journal-plugin/controllers/categories.go
+    - ../sm-journal-plugin/controllers/api/media.go
+    - ../sm-journal-plugin/controllers/api/media_test.go
+    - ../sm-journal-plugin/models/post/fields.yaml
+    - ../sm-journal-plugin/models/category/fields.yaml
+    - ../sm-journal-plugin/lang/en/lang.yaml
+    - ../sm-journal-plugin/lang/pl/lang.yaml
+    - ../sm-journal-plugin/posts_admin_smoke_test.go
+    - ../sm-journal-plugin/journal_api_categories_test.go
+    - ../sm-journal-plugin/README.md
+    - .planning/notes/journal-html-sanitizing-bluemonday.md
+
+key-decisions:
+  - "The policy needed exactly the four planned editor-output rules: a probe of the 15-entry corpus against the pre-change policy showed only figure data-embed/data-id, img alt and ol start being stripped; no fifth rule"
+  - "Editor upload: the sniffed type must be JPEG, PNG, GIF or WebP and must match an allowed extension; a name without an extension gets the sniffed one; a disallowed extension reaches StoreMedia's 'The file must be an image.'"
+  - "uniqueMediaKey fails instead of overwriting when all 999 numbered names are taken (the old code returned the original path); StoreMedia also checks the folder rule itself"
+  - "Load without a translation writer (Translated nil) serves FormatHTML(content) for a markdown value"
+  - "Removal notices end a cut name list with ', …'; HTMLRemovals keeps unexported cut flags"
+
+patterns-established:
+  - "A plugin field type's Decode reports changes as notices and never refuses on content it can repair"
+
+requirements-completed: [D-02, D-03, D-04, D-05, D-06, D-07, D-08, D-09, D-10, D-14, D-18, D-19]
+
+coverage:
+  - id: D1
+    description: "Post content compiles as mlblogeditor (element, translatable, htmlColumn, uploadFolder; assets exist); Decode keeps clean HTML and the embed placeholder byte for byte with no notice, strips script/onerror with two notices, nil to '', refuses a number; Load serves HTML as stored, markdown as content_html or FormatHTML; ListValue; hooks write content_html per written locale and leave untouched content alone; en/pl plural phrases"
+    requirement: D-08
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/controllers/posts_editor_smoke_test.go#TestBlogEditorTracerSmoke"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "SanitizeHTMLReport: elements, attributes (repeats and changed style), comments, Other, ten-name cut with exact counts; Empty exactly when the output equals the input for every unsafe payload, the imported-post fixture and every corpus entry"
+    requirement: D-10
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/editor_policy_test.go#TestSanitizeHTMLReport"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Policy admits every editor-corpus entry byte for byte (empty report, nil CheckHTML) and the placeholder through FormatHTML; other providers, malformed ids, data attributes on other elements, other data-* on figure, onload, iframe, non-numeric start and start on ul are still stripped; the 35 unsafe payloads and the CheckHTML table are unchanged (diff against c60abc6 empty)"
+    requirement: D-05
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/editor_policy_test.go#TestEditorOutputPassesPolicy"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/format_html_test.go#TestFormatHTMLSanitizesUnsafeHTML"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/check_html_test.go#TestCheckHTML"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "StoreMedia keeps the public route's key layout, unique suffix, URL, extension list and size message; editor Upload sniffs the type, uses safe lowercase names and the field's uploadFolder, refuses html/svg/mismatched types, maps MediaError to FormFieldError and a missing bucket to an opaque error; the route's error bodies are unchanged"
+    requirement: D-18
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/controllers/posts_editor_smoke_test.go#TestBlogEditorUploadSmoke"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/controllers/api/media_test.go#TestWriteMediaStoreError"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/media_store_test.go#TestMediaObjectPath"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Category content compiles as blogeditor, Load serves the stored *string, Decode strips onclick with a notice, the hooks map blank to NULL and accept any other content (422 retired)"
+    requirement: D-19
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/controllers/posts_editor_smoke_test.go#TestBlogEditorUploadSmoke"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Public posts API and route table unchanged since c60abc6 (D-09)"
+    requirement: D-09
+    verification:
+      - kind: other
+        ref: "git -C ../sm-journal-plugin diff --quiet c60abc6 -- controllers/api/posts_helpers.go controllers/api/posts.go routes.go"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "Postgres-backed admin saves and the media route: TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, journal_api_task3_test.go media upload, plugin boot with the field types"
+    verification: []
+    human_judgment: true
+    rationale: "No Docker on this host (docker.sock permission denied); the tests compile under go vet and run on a Docker host in plan 06"
+
+duration: 13min
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 03: Journal Blog Editor integration Summary
+
+**Journal post content (mlblogeditor) and category content (blogeditor) are edited with the Blog Editor; every admin save stores bluemonday's output per locale, byte for byte when nothing is unsafe, writes the same HTML to content and content_html without goldmark, and names what it removed through SanitizeHTMLReport notices; the policy admits exactly the editor's four extra attributes, pinned by the editor corpus, and editor images go through the extracted StoreMedia with a magic-byte check.**
+
+## Performance
+
+- **Duration:** about 13 min
+- **Started:** 2026-10-10T09:58:55Z
+- **Completed:** 2026-10-10T10:12Z
+- **Tasks:** 3 (tracer + 2 TDD expansions)
+- **Files:** 20 in sm-journal-plugin (6 created, 14 modified), 1 decision note in summercms.go
+
+## Accomplishments
+
+- **Removal report (D-10 amended):** `SanitizeHTMLReport(doc) (string, HTMLRemovals)` aligns the input's start tags with bluemonday's output in order; unmatched tags are removed elements, missing, repeated or changed attributes are removed attributes (a `style` that lost a property counts under `style`), comments are counted, `Other` covers anything else. At most ten distinct names per list, exact counts. `SanitizeHTML` is its string half; `FormatHTML`, `FormatTranslation` and `CheckHTML` keep their behaviour.
+- **Field types (D-08, D-14):** `classes.BlogEditorTypes` returns `blogeditor` (uploadFolder) and `mlblogeditor` (htmlColumn, uploadFolder) on `golem15-journal-blogeditor` with the plan 02 bundle; `journal.Plugin.FormFieldTypes` registers them. `checkBlogOptions` checks the options at boot.
+- **Decode / Load / ListValue (D-04, D-07, D-10):** Decode returns the policy output plus `removed_elements`, `removed_attributes`, `removed_comments` and `markup_changed` notices; nil is `""`, a non-string is a `FormFieldError` (`content_invalid`). Load serves HTML as stored and markdown (`LooksLikeHTML` false) as that locale's `content_html`, else `FormatHTML(content)`. ListValue (ctx form) strips tags and cuts at 120 runes.
+- **Admin save path (D-02, D-03):** `preparePostWrite` no longer calls goldmark; it copies the Default `content` write to `ContentHTML`. New `FormAfterCreate`/`FormAfterUpdate` write `content_html` for each non-default written locale through the `TranslationWriter` in the save transaction. Untouched content is not written, so both columns stay byte-identical.
+- **Categories (D-19 amended):** `content` is `blogeditor` with `uploadFolder: categories`; the `CheckHTML` 422 gate is gone, blank still becomes NULL; the field comment (en, pl) says unsafe HTML is removed on save.
+- **Media (D-18, D-09):** `classes.StoreMedia` holds the public route's storage (extensions, 10240 KiB, `/journal/<folder>/<name>`, unique suffix, `attach.PublicURL`); `UploadMedia` keeps auth, permissions, folder and form checks and the same bodies. The editor `Upload` sniffs the first 512 bytes (`http.DetectContentType`), requires a matching JPEG/PNG/GIF/WebP type, builds a safe lowercase name and stores in the field's folder (`editor` by default).
+- **Policy (D-05 amended):** `figure` `data-embed` `^youtube$` and `data-id` `^[A-Za-z0-9_-]{11}$`, `img` `alt` any text, `ol` `start` `^[0-9]+$`; nothing else. `CheckHTML` documented as a predicate no write path refuses with.
+- **Docs:** plugin README (field types, admin save rules, category rule, unchanged public API, editor uploads, the four policy rules, API reference rows); decision note amendment with the four table rows (summercms.go `332993c`).
+
+## Task Commits
+
+All code commits are in `../sm-journal-plugin` (branch main):
+
+1. **Task 1: tracer** - `cbf4891` feat(classes): report what the HTML policy removes; `fbd1c85` feat(admin): post content on the Blog Editor field type
+2. **Task 2: categories, uploads, README** - `15fcad7` refactor(api): share media storage with the editor upload; `cb1c688` feat(admin): category content on the Blog Editor and editor image uploads
+3. **Task 3: policy extension** - `2384a61` feat(classes): allow the Blog Editor's own markup in the HTML policy; summercms.go `332993c` docs(16.2): record the editor-output policy extension
+
+## Smoke test output
+
+```
+--- PASS: TestBlogEditorTracerSmoke (13 subtests: compile, type definitions, decode clean, decode placeholder,
+    decode strip with notices, decode nil/non-string, load HTML, load markdown content_html, load FormatHTML fallback,
+    list value, hooks write content_html, hooks leave untouched content, plural phrases)
+--- PASS: TestBlogEditorUploadSmoke (9 subtests: StoreMedia layout, StoreMedia refusals, editor upload safe name,
+    editor upload refusals, missing bucket, category compile, category load, category decode, category hooks)
+--- PASS: TestEditorOutputPassesPolicy (15 corpus entries, placeholder, 18 strip cases, alt, ol start)
+--- PASS: TestSanitizeHTMLReport
+--- PASS: TestFormatHTMLSanitizesUnsafeHTML, TestFormatHTMLDuplicateAttributes, TestFormatHTMLKeepsRawHTML,
+          TestSanitizeHTML, TestCheckHTML (unchanged since c60abc6)
+--- PASS: TestWriteMediaStoreError, TestMediaObjectPath, TestMediaFolderPatternRejectsDotDot
+```
+
+- `go -C ../sm-journal-plugin vet ./...` clean (compiles the updated Postgres tests).
+- `go test -short ./...`: `classes`, `controllers`, `controllers/api` pass; the root package, `models` and `updates` fail only on `docker.sock: permission denied`.
+- `npx vitest run` 33/33 and `scripts/check-dist.sh` ("assets/dist matches a fresh build") still pass.
+
+## Postgres tests that need a Docker host (plan 06)
+
+- `posts_admin_smoke_test.go`: `TestPostsFormCompiles` (expects `"type":"mlblogeditor"`), `TestPostsAdminCreateSmoke` (HTML content, `ContentHTML == Content`, no `meta.notices`), `TestPostsAdminResaveKeepsHTML` (exact bytes), `TestPostsAdminSaveSanitizesHTML` (save succeeds, both columns sanitized for en host and pl translation, notices name `a, base` and `onerror` per locale).
+- `journal_api_categories_test.go`: `TestCategoriesAdminContent` (schema type `blogeditor`, "unsafe create stripped" 201 + `<p>x</p>` + onclick notice, "unsafe update stripped" 200 + `x` + `a` notice, safe create without notices).
+- `journal_api_task3_test.go` media upload tests (the route now runs through `StoreMedia`), `plugin_test.go`, and a full plugin boot with `FormFieldTypes` (cabana's boot-time asset and alias checks against the embedded `adminFS`).
+
+## TDD Gate Compliance
+
+Tasks 2 and 3 are `tdd="true"`. CLAUDE.md requires `go test ./...` green at every commit, so no failing `test(...)` commit exists; as in plans 01 and 02, RED was run and verified before GREEN and tests were committed with the implementation.
+
+- **Task 2 RED:** compile stubs for `StoreMedia` and the moved helpers, then `TestBlogEditorUploadSmoke` failed on its assertions (`not implemented`, "blogeditor has no Upload") and `TestMediaObjectPath` on its path assertion. `go test -json` was converted to TAP and checked: `msd_run check tdd-red-evidence` returned `RED_EVIDENCE_OK` (`target_test_failed`, target `TestBlogEditorUploadSmoke`). The category subtests were masked by the parent's fatal at RED time; the category schema and hook subtests then failed (type `textarea`, `validation_failed`) after Upload went green and before the category change, and passed after it.
+- **Task 3 RED:** `TestEditorOutputPassesPolicy` failed on 18 subtests (corpus entries with the embed, alt and start; placeholder; the negative cases, whose `want` keeps the placeholder) before the policy change: `RED_EVIDENCE_OK`, target `TestEditorOutputPassesPolicy`. `TestSanitizeHTMLReport` was already green because the report shipped in the Task 1 tracer.
+- **GREEN:** the implementation commits listed above; no refactor commit was needed.
+
+## Decisions Made
+
+See key-decisions in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Plan text] Host and translation locales in TestPostsAdminSaveSanitizesHTML**
+- **Found during:** Task 1
+- **Issue:** The plan says "pl (host) and en (translation)", but the test harness (`bootJournal`) makes `en` the default locale and `pl` the translation.
+- **Fix:** The test asserts the host columns for `en` and `golem15_translate_attributes` for `pl`, and notices for both locales.
+- **Files modified:** posts_admin_smoke_test.go
+- **Commit:** fbd1c85
+
+**2. [Rule 2 - Security] uniqueMediaKey no longer overwrites**
+- **Found during:** Task 2
+- **Issue:** The moved `uniqueMediaKey` returned the original (existing) path when all 999 numbered names were taken, so a write would overwrite an object; the threat model (T-16.2-16) requires that it never overwrites.
+- **Fix:** It returns an error instead (a 500 on the public route in that pathological case only). `StoreMedia` also re-checks the folder rule (MediaError on `folder`), which the route already enforces first, so no response changes.
+- **Files modified:** classes/media_store.go
+- **Commit:** 15fcad7
+
+**3. [Rule 2 - Correctness] Editor upload type must match its extension**
+- **Found during:** Task 2
+- **Issue:** The plan's "first bytes sniff as that image type" needs a rule for names whose extension disagrees with the bytes, or that have none.
+- **Fix:** A sniffed type outside JPEG/PNG/GIF/WebP, or one that differs from an allowed extension's type, is `image_invalid`; a name without an extension gets the sniffed one; a disallowed extension gets StoreMedia's "The file must be an image." `safeUploadName` also trims leading and trailing `-` and `.` (no hidden or dot-only names).
+- **Files modified:** classes/blog_editor.go
+- **Commit:** cb1c688
+
+**4. [Rule 2 - Correctness] Category field comment**
+- **Found during:** Task 2
+- **Issue:** `category.content_comment` (en, pl) told administrators unsafe HTML "is refused", which is no longer true.
+- **Fix:** It now says unsafe HTML is removed on save and the form names what was removed.
+- **Files modified:** lang/en/lang.yaml, lang/pl/lang.yaml
+- **Commit:** cb1c688
+
+**5. Files and shapes outside the plan's lists**
+- `controllers/admin_registry.go` holds the new `pact.FormAfterCreate`/`pact.FormAfterUpdate` assertions next to the controller's other compile-time assertions (commit fbd1c85).
+- `controllers/api/media_test.go` now holds `TestWriteMediaStoreError` (the route's 422 and 500 bodies after the move); the two path tests moved to `classes/media_store_test.go` as planned.
+- `HTMLRemovals` carries two unexported flags recording that a name list was cut, so `removalNotices` can append `, …`.
+- Task 2 committed the refactor (`15fcad7`) before the feature (`cb1c688`) so that each commit builds on its own.
+- `loadBlogHTML` serves `FormatHTML(content)` when no translation writer is published (`Translated` is nil), and serves blank content as it is.
+
+---
+
+**Total deviations:** 4 auto-fixed (1 plan text, 3 correctness/security) plus file and ordering notes. **Impact:** no change to the planned API, the public routes' contract or the four policy rules.
+
+## Issues Encountered
+
+- No Docker on this host: the Postgres tests listed above compile but did not run (recorded in `.planning/WINDOWS.md` as unrun-verify entries 15 and 16).
+
+## Known Stubs
+
+None.
+
+## Next Phase Readiness
+
+- Plan 04 mirrors the same four policy rules in the layer and checks the same `editor-corpus.json`; no fifth rule was needed.
+- Plan 05/06: run the Docker-only tests above, then the browser UAT of the editor in the admin (typing, uploads through the cabana route, notices after a stripped save).
+
+## Self-Check: PASSED
+
+- Created files exist in ../sm-journal-plugin: classes/blog_editor.go, classes/media_store.go, classes/media_store_test.go, classes/editor_policy_test.go, field_types.go, controllers/posts_editor_smoke_test.go.
+- Commits exist in ../sm-journal-plugin: cbf4891, fbd1c85, 15fcad7, cb1c688, 2384a61; in summercms.go: 332993c.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-PLAN.md

@@ -2,10 +2,15 @@
 phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
 plan: 04
 type: execute
-wave: 1
-depends_on: []
+wave: 2
+depends_on: ["16.2-02"]
+coupling_justified: ["16.2-03: both plans add the same four editor-output rules (figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$, img alt any text, ol start integer), each in its own repository; the set is fixed in both plans' text and checked against the same plan 02 corpus, neither plan reads the other's files, and either one stops and reports if the corpus needs a fifth rule, so both execution orders give matching policies"]
 files_modified:
   - ../vue-journal-layer/app/utils/embeds.ts
+  - ../vue-journal-layer/app/utils/htmlGate.ts
+  - ../vue-journal-layer/tests/htmlGate.test.ts
+  - ../vue-journal-layer/tests/fixtures/editor-corpus.json
+  - ../vue-journal-layer/docs/decisions/0001-sanitize-html.md
   - ../vue-journal-layer/app/components/Journal/PostBody.vue
   - ../vue-journal-layer/app/components/Journal/CategoryHeader.vue
   - ../vue-journal-layer/app/assets/css/journal-base.css
@@ -19,20 +24,27 @@ files_modified:
 autonomous: false
 requirements: [D-05, D-17]
 estimate:
-  tokens: 45000
-  raw_tokens: 45000
+  tokens: 55000
+  raw_tokens: 55000
   tasks: 3
   confidence: low
 must_haves:
   truths:
-    - "D-17 and D-05: the layer's post body and category content run gateJournalHtml first and then expandEmbeds; only an exact <figure data-embed=\"youtube\" data-id=\"ID\"></figure> with an 11-character id from [A-Za-z0-9_-] becomes <figure class=\"journal-embed journal-embed--youtube\"> holding an iframe on https://www.youtube-nocookie.com/embed/ID; any other figure, provider or id stays unchanged and inert."
-    - "D-05: a raw iframe in stored HTML is still refused by gateJournalHtml before expansion (the blocked notice renders, no iframe)."
+    - "D-17 and D-05: JournalPostBody and JournalCategoryHeader render expandEmbeds(sanitizeJournalHtml(html)): the sanitizer runs first at the v-html sink and expansion is the very last step, so the iframe it builds is never passed through a sanitizer that would strip it; the payload transforms (toPostView, the category page) only sanitize and keep the placeholder; only an exact <figure data-embed=\"youtube\" data-id=\"ID\"></figure> with an 11-character id from [A-Za-z0-9_-] becomes <figure class=\"journal-embed journal-embed--youtube\"> holding an iframe on https://www.youtube-nocookie.com/embed/ID; any other figure, provider or id stays unchanged and inert."
+    - "D-05 (amended): htmlGate.ts mirrors plan 03's Go policy extension exactly (figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$, img alt with any text, ol start integer) and nothing more; every entry of tests/fixtures/editor-corpus.json, a byte copy of plan 02's corpus, is safe under gateJournalHtml, and the placeholder survives sanitizeJournalHtml twice (payload, then sink) before it expands."
+    - "D-05: a raw iframe in stored HTML is stripped by sanitizeJournalHtml before expansion (the rest of the body renders, no iframe comes from stored markup)."
     - "D-17: the built playground server, run with testing/smoke-ssr.mjs against the acme fixtures, renders the youtube-nocookie iframe for the fixture post that carries a placeholder."
     - "D-17: vue-journal-layer v0.2.0 is an annotated tag on origin, scripts/check-git-install.sh v0.2.0 passes, and vue-grzybyfunkcjonalne-app main pins git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.2.0 with a pnpm-lock.yaml that resolves to the tag's commit, builds and passes its tests."
   artifacts:
     - path: "../vue-journal-layer/app/utils/embeds.ts"
       provides: "expandEmbeds and the provider allowlist"
       contains: "youtube-nocookie.com/embed/"
+    - path: "../vue-journal-layer/app/utils/htmlGate.ts"
+      provides: "the sanitize-html mirror with the editor-output extension"
+      contains: "data-embed"
+    - path: "../vue-journal-layer/tests/fixtures/editor-corpus.json"
+      provides: "byte copy of the Blog Editor's output corpus (plan 02)"
+      contains: "data-embed"
     - path: "../vue-journal-layer/tests/embeds.test.ts"
       provides: "node:test smoke of the transform and the gate order"
       contains: "expandEmbeds"
@@ -42,14 +54,18 @@ must_haves:
   key_links:
     - from: "../vue-journal-layer/app/components/Journal/PostBody.vue"
       to: "../vue-journal-layer/app/utils/embeds.ts expandEmbeds"
-      via: "v-html of expandEmbeds(gated.html), only when gated.safe"
+      via: "v-html of expandEmbeds(sanitizeJournalHtml(html)), expansion last"
       pattern: "expandEmbeds"
+    - from: "../vue-journal-layer/tests/fixtures/editor-corpus.json"
+      to: "../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json"
+      via: "byte copy; the plan 06 phase gate compares the two files"
+      pattern: "editor-corpus.json"
     - from: "../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml"
       to: "vue-journal-layer v0.2.0 commit"
       via: "pnpm install after the pin bump"
       pattern: "vue-journal-layer"
   prohibitions:
-    - statement: "The layer never builds an iframe from anything but a validated provider id and a fixed host; it never loosens gateJournalHtml."
+    - statement: "The layer never builds an iframe from anything but a validated provider id and a fixed host; htmlGate.ts gains only the four editor-output rules plan 03 adds to the Go policy, never iframe, URL schemes, styles, event attributes or other data attributes."
       status: unresolved
       verification: judgment
     - statement: "A pushed layer tag is never moved or deleted; a defect after the push gets v0.2.1."
@@ -61,7 +77,16 @@ must_haves:
 
 ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
 
-This plan's slice (user decision 1, plan 04): the frontend half of embeds (D-17). The reusable Nuxt blog views layer expands the editor's allowlisted embed placeholders into privacy-enhanced YouTube iframes after its HTML gate, ships as tag v0.2.0, and the site app pins it.
+This plan's slice (user decision 1, plan 04): the frontend half of embeds (D-17). The reusable Nuxt blog views layer keeps the editor's markup through its sanitizer, expands the allowlisted embed placeholders into privacy-enhanced YouTube iframes as the last step before v-html, ships as tag v0.2.0, and the site app pins it.
+
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-05 amended)
+
+16.1 replaced the layer's regex gate with sanitize-html 2.18.0 (5beb1c5, decision note `docs/decisions/0001-sanitize-html.md`, tag v0.1.1 at 294a8d8). The layer now never blanks a body: `sanitizeJournalHtml` strips what the policy refuses, `gateJournalHtml` returns `{safe, html}` with `html` always sanitized, and there is no blocked notice. The body is sanitized twice: once in the payload (`toPostView`, the category page) and again at the sink (`JournalPostBody`, `JournalCategoryHeader`). Two consequences for this plan:
+
+- **Order.** Expansion must be the very last step at the sink, after `sanitizeJournalHtml`. Run anywhere earlier, for example in `toPostView`, the sink's sanitizer would strip the iframe again.
+- **Mirror.** The placeholder's `data-embed`/`data-id` (and the editor's `alt` text and `ol start`) are stripped by the mirror today. Amended D-05 extends the Go policy (plan 03) and this mirror with the same four rules, pinned by plan 02's corpus. That is why this plan now waits for plan 02 (wave 2, parallel with plan 03).
+
+The site app pins `#v0.1.1` today, and the layer's package.json version field still reads 0.1.0. Where RESEARCH Pattern 7 says the gate "refuses" a raw iframe, read "strips".
 
 Path note: the site app is the submodule `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app` (its own repository, origin git.golem15.com/golem15/vue-grzybyfunkcjonalne-app, branch main), not a sibling directory. Plan 05 bumps the host's gitlink to the app commit pushed here.
 
@@ -73,22 +98,26 @@ Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to
 
 - Provider allowlist: YouTube only, as one entry in `EMBED_PROVIDERS` (id pattern `^[A-Za-z0-9_-]{11}$`, src `https://www.youtube-nocookie.com/embed/<id>`), matching the editor's table in plan 02.
 - The placeholder is matched exactly as the editor writes it (attribute order data-embed then data-id, empty figure, no caption). Anything else is left as is, so an unknown or malformed placeholder renders as an empty figure.
-- Iframe attributes: `title="YouTube video"`, `loading="lazy"`, `referrerpolicy="strict-origin-when-cross-origin"`, `allow="encrypted-media; picture-in-picture; fullscreen"`, `allowfullscreen`. The site sets no CSP, so no header change is needed (RESEARCH Pattern 7).
+- Iframe attributes: `title="YouTube video"`, `loading="lazy"`, `referrerpolicy="strict-origin-when-cross-origin"`, `allow="encrypted-media; picture-in-picture; fullscreen"`, `allowfullscreen`. Since 16.1 the UAT vhost sends a public Content-Security-Policy-Report-Only whose default-src 'self' has no frame-src, so the iframe loads (report-only) but logs a violation; plan 05 adds frame-src https://www.youtube-nocookie.com to that policy in the host repository (RESEARCH Pattern 7's "no CSP" predates 16.1).
 - The layer tag push is a one-way door and gets its own checkpoint here; the summercms tag and the UAT deploy are gated in plan 05.
+- Mirror extension: exactly the four rules plan 03 adds to the Go policy: `figure` `data-embed` `^youtube$` and `data-id` `^[A-Za-z0-9_-]{11}$`, `img` `alt` with any value, and `ol` `start` (`INTEGER`). The corpus copy lives at `tests/fixtures/editor-corpus.json` with a test header comment naming its source; the copy is never edited by hand.
 
 ## Artifacts this phase produces (this plan)
 
 - `app/utils/embeds.ts`: `EMBED_PLACEHOLDER` (RegExp), `EMBED_PROVIDERS`, `expandEmbeds(html: string): string`.
+- `app/utils/htmlGate.ts`: `figure` and `ol` entries plus the widened `img` `alt` rule in `ELEMENT_ATTRS` (mirror of the Go extension).
+- `tests/fixtures/editor-corpus.json` (byte copy of plan 02's corpus); corpus, mirror and pipeline cases in `tests/htmlGate.test.ts` and `tests/embeds.test.ts`.
+- `docs/decisions/0001-sanitize-html.md`: the Policy section lists the four editor-output additions.
 - CSS classes `.journal-embed`, `.journal-embed--youtube` in `app/assets/css/journal-base.css`.
 - `tests/embeds.test.ts`; acme fixture post with a placeholder and the matching `testing/expect-acme.txt` line.
 - Layer version 0.2.0 and annotated tag `v0.2.0` on origin.
 - vue-grzybyfunkcjonalne-app main: pin `#v0.2.0` and the updated `pnpm-lock.yaml`.
 
 <objective>
-Expand editor embed placeholders in the vue-journal-layer blog views (D-17, D-05), release the layer as v0.2.0 and pin it in the site app.
+Mirror the editor-output policy extension in the layer's sanitizer, expand editor embed placeholders as the last step of the post and category sinks (D-17, D-05), release the layer as v0.2.0 and pin it in the site app.
 
-Purpose: grzybyfunkcjonalne.pl shows the YouTube embeds authors add in the Blog Editor while stored HTML keeps passing the strict gate.
-Output: embeds.ts with tests and SSR proof, tag v0.2.0, app pin and lockfile.
+Purpose: grzybyfunkcjonalne.pl shows the YouTube embeds authors add in the Blog Editor, and keeps their alt text and list numbering, while stored HTML still goes through the strict sanitizer.
+Output: the htmlGate.ts mirror and corpus test, embeds.ts with tests and SSR proof, tag v0.2.0, app pin and lockfile.
 </objective>
 
 <execution_context>
@@ -101,7 +130,7 @@ Output: embeds.ts with tests and SSR proof, tag v0.2.0, app pin and lockfile.
 @.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-RESEARCH.md
 @.planning/phases/16-grzybyfunkcjonalne-pl-on-reusable-blog-views/16-CONTEXT.md
 
-Repositories: `../vue-journal-layer` (branch main, tags v0.0.1 and v0.1.0, pnpm-lock.yaml, tests run with `npm test` = node --test on TypeScript with type stripping, Node 22.18 or later) and `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app` (branch main, pnpm). Commits: no co-author tags, stage by explicit path. Use only erasable TypeScript syntax in files node --test loads (no enums, no parameter properties) and import siblings with the .ts extension, as htmlGate.ts does.
+Repositories: `../vue-journal-layer` (branch main at 294a8d8 = tag v0.1.1, earlier tags v0.0.1 and v0.1.0; depends on sanitize-html 2.18.0; package.json version field 0.1.0; pnpm-lock.yaml; tests run with `npm test` = node --test on TypeScript with type stripping, Node 22.18 or later) and `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app` (branch main, pnpm). Commits: no co-author tags, stage by explicit path. Use only erasable TypeScript syntax in files node --test loads (no enums, no parameter properties) and import siblings with the .ts extension, as htmlGate.ts does.
 
 <interfaces>
 Placeholder written by the editor (plan 02) and the expansion it becomes:
@@ -112,50 +141,57 @@ Placeholder written by the editor (plan 02) and the expansion it becomes:
 <figure class="journal-embed journal-embed--youtube"><iframe src="https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ" title="YouTube video" loading="lazy" referrerpolicy="strict-origin-when-cross-origin" allow="encrypted-media; picture-in-picture; fullscreen" allowfullscreen></iframe></figure>
 ```
 
-Existing gate (app/utils/htmlGate.ts): `gateJournalHtml(html) -> { safe, html }`, refusing `<script|iframe|object|embed`, `on*=` and `javascript:|vbscript:|data:`. PostBody.vue renders `v-html="gated.html"` when `gated.safe`; CategoryHeader.vue renders `v-html="content.html"` when `content.safe && content.html`.
+Existing sanitizer (app/utils/htmlGate.ts, sanitize-html 2.18.0 mirroring the Go bluemonday policy): `sanitizeJournalHtml(html): string` strips what the policy refuses (iframe, script and style with their content; on* attributes; target and rel; URLs other than http, https, mailto and relative; attribute values failing their pattern) and always returns sanitize-html's own serialization; `gateJournalHtml(html) -> { safe, html }` never blanks (`safe` reports whether the policy kept everything); `isSafeJournalHtml(html)`. Policy tables: `GLOBAL_ATTRS`, `ELEMENT_ATTRS` (img alt uses `PARAGRAPH`; no figure or ol entry today), `EMPTY_ATTRS`. Call sites: `toPostView` (app/utils/postView.ts) and app/journal-pages/CategoryPage.vue sanitize the payload; `JournalPostBody` renders `v-html` of `sanitizeJournalHtml(props.html)`; `JournalCategoryHeader` renders `v-html` of `sanitizeJournalHtml(props.category.content)`.
+
+Pipeline after this plan: payload `sanitizeJournalHtml` (placeholder kept) → sink `sanitizeJournalHtml` (placeholder kept) → `expandEmbeds` (last) → `v-html`.
 </interfaces>
 </context>
 
 <tasks>
 
 <task type="tracer">
-  <name>Task 1: Tracer: a stored placeholder renders as a privacy-enhanced YouTube iframe on the post page (gate, expand, v-html, SSR)</name>
+  <name>Task 1: Tracer: a stored placeholder renders as a privacy-enhanced YouTube iframe on the post page (mirror extension, sanitize, expand last, v-html, SSR)</name>
   <reversibility rating="costly">D-05 and D-17: the layer's matcher is the reader of the stored placeholder format; both must change together if the markup ever changes.</reversibility>
-  <files>../vue-journal-layer/app/utils/embeds.ts, ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/app/components/Journal/CategoryHeader.vue, ../vue-journal-layer/app/assets/css/journal-base.css, ../vue-journal-layer/tests/embeds.test.ts, ../vue-journal-layer/testing/fixtures/acme/posts.json, ../vue-journal-layer/testing/expect-acme.txt, ../vue-journal-layer/README.md</files>
-  <read_first>../vue-journal-layer/app/utils/htmlGate.ts, ../vue-journal-layer/tests/htmlGate.test.ts (test style), ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/app/components/Journal/CategoryHeader.vue, ../vue-journal-layer/app/assets/css/journal-base.css, ../vue-journal-layer/app/assets/css/journal-tokens.css, ../vue-journal-layer/testing/expect-acme.txt (grammar), ../vue-journal-layer/testing/fixtures/acme/posts.json (post hello-acme), ../vue-journal-layer/testing/smoke-ssr.mjs, ../vue-journal-layer/.playground/nuxt.config.ts, ../vue-journal-layer/package.json, ../vue-journal-layer/README.md</read_first>
+  <precondition>../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json exists (plan 02 Task 3) and parses as JSON.</precondition>
+  <files>../vue-journal-layer/app/utils/htmlGate.ts, ../vue-journal-layer/app/utils/embeds.ts, ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/app/components/Journal/CategoryHeader.vue, ../vue-journal-layer/app/assets/css/journal-base.css, ../vue-journal-layer/tests/htmlGate.test.ts, ../vue-journal-layer/tests/embeds.test.ts, ../vue-journal-layer/tests/fixtures/editor-corpus.json, ../vue-journal-layer/testing/fixtures/acme/posts.json, ../vue-journal-layer/testing/expect-acme.txt, ../vue-journal-layer/docs/decisions/0001-sanitize-html.md, ../vue-journal-layer/README.md</files>
+  <read_first>../vue-journal-layer/app/utils/htmlGate.ts (ELEMENT_ATTRS, PARAGRAPH, INTEGER, EMPTY_ATTRS, filterAttributeValues, KEEP_ALL), ../vue-journal-layer/tests/htmlGate.test.ts (test style), ../vue-journal-layer/app/utils/postView.ts, ../vue-journal-layer/app/journal-pages/CategoryPage.vue, ../vue-journal-layer/app/journal-pages/PostPage.vue, ../vue-journal-layer/docs/decisions/0001-sanitize-html.md (Policy section), ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json (plan 02), ../sm-journal-plugin/classes/format_html.go (newHTMLPolicy: the Go side of the mirror), ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/app/components/Journal/CategoryHeader.vue, ../vue-journal-layer/app/assets/css/journal-base.css, ../vue-journal-layer/app/assets/css/journal-tokens.css, ../vue-journal-layer/testing/expect-acme.txt (grammar), ../vue-journal-layer/testing/fixtures/acme/posts.json (post hello-acme), ../vue-journal-layer/testing/smoke-ssr.mjs, ../vue-journal-layer/.playground/nuxt.config.ts, ../vue-journal-layer/package.json, ../vue-journal-layer/README.md</read_first>
   <action>Build the expansion on the post page end to end (per D-17, D-05).
 
-embeds.ts (header comment naming the editor's placeholder and the Go gate as the source of truth, in the htmlGate.ts style): EMBED_PROVIDERS with one entry youtube (id pattern ^[A-Za-z0-9_-]{11}$, src builder on https://www.youtube-nocookie.com/embed/, title "YouTube video"); EMBED_PLACEHOLDER, a global RegExp matching exactly the placeholder in the interfaces block with capture groups for provider and id (attribute values without quotes or angle brackets); expandEmbeds(html) replaces a match only when the provider is in EMBED_PROVIDERS and the id passes its pattern, producing exactly the expansion in the interfaces block; every other match is returned unchanged; empty input returns "".
+Mirror (D-05 amended): in htmlGate.ts add the same four rules plan 03 adds to the Go policy and nothing else: an ELEMENT_ATTRS entry for figure with data-embed matching ^youtube$ and data-id matching ^[A-Za-z0-9_-]{11}$; an ol entry gaining start (INTEGER) next to type; img alt accepting any value (a new rule constant, documented as the editor's free-text alt; sanitize-html escapes attribute values). Extend the header comment's list of additions. Copy ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json byte for byte to tests/fixtures/editor-corpus.json. In tests/htmlGate.test.ts: every corpus entry is safe under gateJournalHtml; the placeholder is kept by sanitizeJournalHtml applied twice; data-embed other than youtube, a 10- or 12-character id, data-id on div and any other data attribute on figure are still stripped; an iframe is still stripped with its content; ol start="3" kept and start="x" stripped; an alt with a colon, a question mark and quotes kept. Update the Policy section of docs/decisions/0001-sanitize-html.md with the four additions and their reason (the Blog Editor's own output, pinned by the corpus, mirroring the Go policy).
 
-Wiring: PostBody.vue computes the rendered HTML as expandEmbeds(gated.html) only when gated.safe (the gate always runs first, so a raw iframe is refused before expansion); CategoryHeader.vue does the same for content.html. journal-base.css adds .journal-embed (block, margin from the existing spacing tokens, aspect-ratio 16 / 9, width 100 percent) and its iframe (width and height 100 percent, border 0).
+embeds.ts (header comment naming the editor's placeholder and the Go policy as the source of truth, in the htmlGate.ts style): EMBED_PROVIDERS with one entry youtube (id pattern ^[A-Za-z0-9_-]{11}$, src builder on https://www.youtube-nocookie.com/embed/, title "YouTube video"); EMBED_PLACEHOLDER, a global RegExp matching exactly the placeholder in the interfaces block with capture groups for provider and id (attribute values without quotes or angle brackets); expandEmbeds(html) replaces a match only when the provider is in EMBED_PROVIDERS and the id passes its pattern, producing exactly the expansion in the interfaces block; every other match is returned unchanged; empty input returns "". The regex matches the serialization sanitize-html gives the placeholder (attribute order kept, double quotes), because its input is always sanitizer output.
+
+Wiring (order is the point): PostBody.vue computes the rendered HTML as expandEmbeds(sanitizeJournalHtml(props.html)) and CategoryHeader.vue as expandEmbeds(sanitizeJournalHtml(props.category.content)); expansion is the last step before v-html and its output is never sanitized again (sanitize-html would strip the iframe). toPostView and CategoryPage.vue keep only sanitizing (the payload carries the placeholder, not the iframe); do not expand there. Update the components' header comments to say so. journal-base.css adds .journal-embed (block, margin from the existing spacing tokens, aspect-ratio 16 / 9, width 100 percent) and its iframe (width and height 100 percent, border 0).
 
 Fixtures: append the placeholder for id dQw4w9WgXcQ to the content_html of the acme post hello-acme, and add to testing/expect-acme.txt the line "200 /blog/hello-acme contains=https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ" under the single-post block.
 
-Smoke: tests/embeds.test.ts (node:test): the placeholder expands to the exact iframe markup; a 10-character id, an unknown provider and a figure with extra attributes stay unchanged; a raw iframe in the input is refused by gateJournalHtml before expandEmbeds can run (the composed pipeline yields safe false); two placeholders in one body both expand.
+Smoke: tests/embeds.test.ts (node:test): the placeholder expands to the exact iframe markup; a 10-character id, an unknown provider and a figure with extra attributes stay unchanged; the composed sink pipeline expandEmbeds(sanitizeJournalHtml(x)) turns a stored placeholder into the iframe but strips a raw iframe in x, so the only iframe in the output is the one built from the placeholder; the payload-then-sink pipeline (sanitize, sanitize, expand) gives the same result; two placeholders in one body both expand; the corpus embed entry expands after sanitizing.
 
-README.md: an "Embeds" section describing the placeholder, the allowlist, the gate-first order and the CSS classes. Commit as "feat: expand Journal embed placeholders into privacy-enhanced iframes", staged by explicit path.</action>
+README.md: an "Embeds" section describing the placeholder, the allowlist, the sanitize-first, expand-last order and the CSS classes; the HTML sanitizer bullet names the four editor-output additions. Commit as "feat: keep Blog Editor markup in the sanitizer and expand Journal embed placeholders into privacy-enhanced iframes", staged by explicit path.</action>
   <verify>
     <automated>npm --prefix ../vue-journal-layer test 2&gt;&amp;1 | grep -E '^# fail 0$'</automated>
-    <fails_when>No "# fail 0" line in the TAP summary: an embeds test or an existing htmlGate, routes, seo, sitemap, i18n, pagination or client test failed.</fails_when>
+    <fails_when>No "# fail 0" line in the TAP summary: an embeds or mirror test failed (a corpus entry is unsafe, the placeholder does not survive two sanitizer passes, a negative case is no longer stripped, or a stored iframe reaches the output), or an existing htmlGate, postView, routes, seo, sitemap, i18n, pagination or client test failed.</fails_when>
     <automated>pnpm -C ../vue-journal-layer install --frozen-lockfile &amp;&amp; pnpm -C ../vue-journal-layer run build:playground &amp;&amp; node ../vue-journal-layer/testing/smoke-ssr.mjs --output ../vue-journal-layer/.playground/.output --fixtures ../vue-journal-layer/testing/fixtures/acme --expect ../vue-journal-layer/testing/expect-acme.txt 2&gt;&amp;1 | grep '^smoke-ssr: ok ('</automated>
-    <fails_when>No line starting with "smoke-ssr: ok (": the playground build failed, or an expectation failed (the new youtube-nocookie line on /blog/hello-acme, or an existing one such as the unsafe-sample blocked notice).</fails_when>
+    <fails_when>No line starting with "smoke-ssr: ok (": the playground build failed, or an expectation failed (the new youtube-nocookie line on /blog/hello-acme, or an existing one such as /blog/unsafe-sample containing <p>Before</p><p>After</p> without alert().</fails_when>
   </verify>
   <acceptance_criteria>
     - `grep -n "export function expandEmbeds" ../vue-journal-layer/app/utils/embeds.ts` prints one line.
-    - `grep -c "expandEmbeds" ../vue-journal-layer/app/components/Journal/PostBody.vue ../vue-journal-layer/app/components/Journal/CategoryHeader.vue` reports at least 1 for each file.
+    - `grep -c "expandEmbeds" ../vue-journal-layer/app/components/Journal/PostBody.vue ../vue-journal-layer/app/components/Journal/CategoryHeader.vue` reports at least 1 for each file, and `grep -c "expandEmbeds" ../vue-journal-layer/app/utils/postView.ts ../vue-journal-layer/app/journal-pages/CategoryPage.vue` reports 0 for each (no expansion before the sink's sanitizer).
+    - `grep -n "data-embed" ../vue-journal-layer/app/utils/htmlGate.ts` prints at least one line, and `cmp ../vue-journal-layer/tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` exits 0.
+<!-- planner-discipline-allow: expandEmbeds -->
     - `grep -n "youtube-nocookie.com/embed/dQw4w9WgXcQ" ../vue-journal-layer/testing/expect-acme.txt` prints one line.
     - The node test summary shows "# fail 0" and includes the embeds tests; smoke-ssr passes against the built playground.
   </acceptance_criteria>
-  <done>A placeholder in a stored post renders as a youtube-nocookie iframe in the SSR page, malformed placeholders stay inert, and raw iframes are still blocked.</done>
+  <done>The layer's sanitizer keeps exactly the editor's own markup, a placeholder in a stored post renders as a youtube-nocookie iframe in the SSR page, malformed placeholders stay inert, and raw iframes are still stripped.</done>
 </task>
 
 <task type="checkpoint:decision" gate="blocking-human">
   <name>Task 2: Approve pushing vue-journal-layer v0.2.0 and the site app pin</name>
   <precondition>Task 1's two verify commands passed.</precondition>
   <read_first>../vue-journal-layer/scripts/check-git-install.sh, ../vue-journal-layer/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json</read_first>
-  <action>Automate the checks, then stop. In ../vue-journal-layer: `git status --porcelain` prints nothing; `git fetch origin --tags`; `git log --oneline HEAD..origin/main` prints nothing (if it prints commits, stop and report); `git ls-remote --tags origin refs/tags/v0.2.0` prints nothing. Set package.json version to 0.2.0 and commit it as "chore: release v0.2.0". In the app submodule: `git status --porcelain` prints nothing and `git log --oneline HEAD..origin/main` prints nothing. Print the release sheet: the layer commits to push (`git log --oneline origin/main..HEAD`), the tag name and message "v0.2.0: Journal embed placeholders expand into privacy-enhanced YouTube iframes", the app change (pin #v0.1.0 to #v0.2.0 plus the regenerated lockfile), and the rollback (a defect means v0.2.1; the app pin can go back to #v0.1.0). Stop for the human.</action>
+  <action>Automate the checks, then stop. In ../vue-journal-layer: `git status --porcelain` prints nothing; `git fetch origin --tags`; `git log --oneline HEAD..origin/main` prints nothing (if it prints commits, stop and report); `git ls-remote --tags origin refs/tags/v0.2.0` prints nothing. Set package.json version to 0.2.0 and commit it as "chore: release v0.2.0". In the app submodule: `git status --porcelain` prints nothing and `git log --oneline HEAD..origin/main` prints nothing. Print the release sheet: the layer commits to push (`git log --oneline origin/main..HEAD`), the tag name and message "v0.2.0: Blog Editor markup kept by the sanitizer; Journal embed placeholders expand into privacy-enhanced YouTube iframes", the app change (pin #v0.1.1 to #v0.2.0 plus the regenerated lockfile), and the rollback (a defect means v0.2.1; the app pin can go back to #v0.1.1). Stop for the human.</action>
   <decision>Push vue-journal-layer main and the annotated tag v0.2.0, then push the vue-grzybyfunkcjonalne-app pin bump?</decision>
-  <context>A pushed tag is installed by consumer lockfiles (git+https ... #v0.2.0) and cannot be moved, only superseded. The site app's main is what plan 05 deploys to UAT through the host gitlink. The embed expansion is harmless before any post holds a placeholder.</context>
+  <context>A pushed tag is installed by consumer lockfiles (git+https ... #v0.2.0) and cannot be moved, only superseded. The site app's main (today ada03b2, pinning #v0.1.1) is what plan 05 deploys to UAT through the host gitlink. The embed expansion and the four mirror rules are harmless before any post holds editor markup.</context>
   <options>
     <option id="push">
       <name>Push now</name>
@@ -188,7 +224,7 @@ README.md: an "Embeds" section describing the placeholder, the allowlist, the ga
   <read_first>../vue-journal-layer/scripts/check-git-install.sh, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/ssr.test.ts (needs a build first), ../sm-grzybyfunkcjonalne-app/scripts/build.sh (how the host builds the app: pnpm install --frozen-lockfile)</read_first>
   <action>Release the layer (per D-17): in ../vue-journal-layer create the annotated tag with git tag -a v0.2.0 and the message from Task 2, then git push origin main and git push origin v0.2.0; run bash scripts/check-git-install.sh v0.2.0 (a scratch app installs the tag anonymously, the lockfile pins the tag commit, nuxt build and the acme SSR expectations, including the new embed line, pass).
 
-Pin in the site app: in ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app change the vue-journal-layer dependency from #v0.1.0 to git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.2.0, run pnpm install to regenerate pnpm-lock.yaml (it must record the tag's commit), then pnpm build and pnpm test (unit and SSR tests against the built output). Commit package.json and pnpm-lock.yaml as "chore(deps): vue-journal-layer v0.2.0 (Journal embeds)" and push origin main. Record both pushed heads and the tag commit in the SUMMARY.</action>
+Pin in the site app: in ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app change the vue-journal-layer dependency from #v0.1.1 to git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.2.0, run pnpm install to regenerate pnpm-lock.yaml (it must record the tag's commit), then pnpm build and pnpm test (unit and SSR tests against the built output). Commit package.json and pnpm-lock.yaml as "chore(deps): vue-journal-layer v0.2.0 (Journal embeds)" and push origin main. Record both pushed heads and the tag commit in the SUMMARY.</action>
   <verify>
     <automated>bash ../vue-journal-layer/scripts/check-git-install.sh v0.2.0</automated>
     <fails_when>Non-zero exit: the tag is not on origin, the scratch lockfile pins another commit, nuxt build fails, or an acme SSR expectation fails.</fails_when>
@@ -219,8 +255,9 @@ Pin in the site app: in ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
 | Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
 |-----------|----------|-----------|----------|-------------|-----------------|
 | T-16.2-19 | Tampering (iframe injection) | expandEmbeds | high | mitigate | Exact-markup regex, provider allowlist and an id pattern; the iframe src is built from a fixed host plus the validated id; anything else stays inert; tests cover malformed ids, unknown providers and extra attributes |
-| T-16.2-20 | Elevation of Privilege | gate order | high | mitigate | gateJournalHtml runs first and expandEmbeds only on safe output, so stored raw iframes are still refused; a test composes the two |
-| T-16.2-21 | Information Disclosure (visitor privacy) | YouTube frame | low | mitigate | youtube-nocookie.com privacy-enhanced domain, lazy loading, strict-origin-when-cross-origin referrer policy |
+| T-16.2-20 | Elevation of Privilege | sanitize-then-expand order | high | mitigate | sanitizeJournalHtml runs first at each v-html sink and expandEmbeds is the last step, so stored raw iframes are stripped and the only iframe is the one built from a validated placeholder; expansion never happens in a payload transform (acceptance grep); tests compose the sink and the payload-then-sink pipelines |
+| T-16.2-32 | Tampering (stored XSS) / policy drift | htmlGate.ts mirror extension | high | mitigate | Exactly the four editor-output rules the Go policy gains in plan 03, with the same patterns; no iframe, URL scheme, style or other data attribute; every corpus entry (byte copy of plan 02's corpus, compared with cmp here and in the plan 06 gate) is safe, and the negative cases stay stripped |
+| T-16.2-21 | Information Disclosure (visitor privacy) | YouTube frame | low | mitigate | youtube-nocookie.com privacy-enhanced domain, lazy loading, strict-origin-when-cross-origin referrer policy; the site's report-only CSP allows frames only from that host (frame-src, added by plan 05) |
 | T-16.2-22 | Tampering / Repudiation | tag and pushes | medium | mitigate | Clean trees and an absent tag checked at a blocking-human checkpoint; check-git-install proves the published tag; heads recorded in the SUMMARY |
 | T-16.2-SC | Tampering | npm/pnpm installs | high | mitigate | No new package: the layer adds no dependency; the app only changes its pin to the project's own layer tag and regenerates the lockfile with pnpm |
 </threat_model>
@@ -233,7 +270,7 @@ Pin in the site app: in ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
 
 <success_criteria>
 - D-17: embeds render on the site through the layer, v0.2.0 is published and pinned in the app.
-- D-05: the gate is unchanged and still runs first.
+- D-05: the sanitizer mirrors the Go policy's four editor-output rules and nothing more, still runs first at every sink, and expansion is last.
 </success_criteria>
 
 <output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-SUMMARY.md

@@ -0,0 +1,247 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 04
+subsystem: journal-frontend
+tags: [vue-journal-layer, nuxt, sanitize-html, embeds, youtube-nocookie, release, pnpm, vue-grzybyfunkcjonalne-app]
+
+requires:
+  - phase: 16.2-02
+    provides: tests/blogeditor/fixtures/editor-corpus.json (the Blog Editor's output corpus) and the placeholder format <figure data-embed="youtube" data-id="ID"></figure>
+  - phase: 16.1
+    provides: sanitize-html 2.18.0 mirror (htmlGate.ts, decision note 0001-sanitize-html.md), layer tag v0.1.1, app pin #v0.1.1
+provides:
+  - "vue-journal-layer htmlGate.ts mirror of the Go editor-output extension: figure data-embed ^youtube$, figure data-id ^[A-Za-z0-9_-]{11}$, img alt free text, ol start INTEGER"
+  - "vue-journal-layer app/utils/embeds.ts: EMBED_PLACEHOLDER, EMBED_PROVIDERS (youtube only), expandEmbeds(html)"
+  - "JournalPostBody and JournalCategoryHeader render expandEmbeds(sanitizeJournalHtml(html)); expansion is last, payload transforms only sanitize"
+  - "CSS classes .journal-embed and .journal-embed--youtube (16 / 9 frame)"
+  - "tests/fixtures/editor-corpus.json, a byte copy of plan 02's corpus"
+  - "Annotated tag vue-journal-layer v0.2.0 (tag object 042b65d0, commit 759e684e) on origin, installable anonymously over git+https"
+  - "vue-grzybyfunkcjonalne-app main 465286a pins #v0.2.0 with a lockfile resolving to 759e684e"
+affects: [16.2-05, 16.2-06, vue-journal-layer, vue-grzybyfunkcjonalne-app]
+
+actuals:
+  tokens: 9700
+  tasks: 3
+  commits: 3
+plan_head_before: 294a8d8b19b999d54cc3b1266d0f42968159f5f2
+plan_head_after: 759e684e862bd8a2f34e2bbcdf258f66aeddad4f
+commits_repo: ../vue-journal-layer
+app_head_before: ada03b202bdfce2c09812dc81c58b0890cf4b86b
+app_head_after: 465286a880f0aae6118c2915aa1475a5da353295
+app_commits_repo: ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
+app_commits: 1
+
+tech-stack:
+  added: []
+  patterns:
+    - "Sanitize first, expand last: the v-html sink runs sanitizeJournalHtml and then expandEmbeds; nothing sanitizes after expansion, and payload transforms never expand"
+    - "Exact-markup placeholder expansion: one global RegExp matching the sanitizer's serialization, a provider allowlist with an id pattern, and an iframe src built from a fixed host plus the validated id; any other match is returned unchanged"
+    - "Mirror pinned by the editor's corpus: the layer keeps a byte copy of the Go side's corpus and every entry must be safe under gateJournalHtml"
+
+key-files:
+  created:
+    - ../vue-journal-layer/app/utils/embeds.ts
+    - ../vue-journal-layer/tests/embeds.test.ts
+    - ../vue-journal-layer/tests/fixtures/editor-corpus.json
+  modified:
+    - ../vue-journal-layer/app/utils/htmlGate.ts
+    - ../vue-journal-layer/app/components/Journal/PostBody.vue
+    - ../vue-journal-layer/app/components/Journal/CategoryHeader.vue
+    - ../vue-journal-layer/app/assets/css/journal-base.css
+    - ../vue-journal-layer/tests/htmlGate.test.ts
+    - ../vue-journal-layer/testing/fixtures/acme/posts.json
+    - ../vue-journal-layer/testing/expect-acme.txt
+    - ../vue-journal-layer/docs/decisions/0001-sanitize-html.md
+    - ../vue-journal-layer/README.md
+    - ../vue-journal-layer/package.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml
+
+key-decisions:
+  - "The layer mirror gained exactly the four editor-output rules of the Go policy (figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$, img alt free text, ol start INTEGER); no fifth rule was needed for the corpus"
+  - "Embed expansion runs only at the v-html sinks, after sanitizeJournalHtml; the payload (toPostView, CategoryPage) carries the placeholder, never the iframe"
+  - "Human approved the one-way release at the Task 2 blocking-human checkpoint with the reply \"push\"; vue-journal-layer v0.2.0 is published and any later defect gets v0.2.1"
+  - "The release commit also moved the README install line from #v0.1.0 to #v0.2.0 so the documented pin matches the published tag"
+
+patterns-established:
+  - "A layer release is a separate 'chore: release vX.Y.Z' commit (package.json version plus README install line), tagged annotated, pushed after a blocking-human checkpoint, proven by scripts/check-git-install.sh, then pinned in the consuming app with a regenerated lockfile"
+
+requirements-completed: [D-05, D-17]
+
+coverage:
+  - id: D1
+    description: "htmlGate.ts mirrors the Go editor-output extension and nothing more; every corpus entry is safe, the placeholder survives two sanitizer passes, negative cases (other provider, 10/12-char id, data-id on div, other data attributes, iframe, ol start=x) are stripped"
+    requirement: "D-05"
+    verification:
+      - kind: unit
+        ref: "../vue-journal-layer/tests/htmlGate.test.ts (npm test: 136 pass, 0 fail)"
+        status: pass
+      - kind: other
+        ref: "cmp ../vue-journal-layer/tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json (exit 0)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "expandEmbeds turns only the exact allowlisted placeholder into a youtube-nocookie iframe, last at the post and category sinks; a raw stored iframe is stripped before expansion"
+    requirement: "D-17"
+    verification:
+      - kind: unit
+        ref: "../vue-journal-layer/tests/embeds.test.ts (npm test: 136 pass, 0 fail)"
+        status: pass
+      - kind: integration
+        ref: "node testing/smoke-ssr.mjs against the built playground: smoke-ssr: ok (29 checks), including 200 /blog/hello-acme contains=https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "vue-journal-layer v0.2.0 is an annotated tag on origin and installs anonymously; the scratch lockfile pins the tag commit and the acme SSR expectations pass"
+    requirement: "D-17"
+    verification:
+      - kind: integration
+        ref: "bash ../vue-journal-layer/scripts/check-git-install.sh v0.2.0 -> check-git-install: ok v0.2.0 759e684e862bd8a2f34e2bbcdf258f66aeddad4f"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "vue-grzybyfunkcjonalne-app main pins #v0.2.0, its lockfile resolves to 759e684e, it builds, its unit and SSR tests pass, and main equals origin/main"
+    requirement: "D-17"
+    verification:
+      - kind: integration
+        ref: "Task 3 app verify command -> # pass 26, # fail 0, app-pin-ok; pnpm run smoke:ssr -> smoke-ssr: ok (37 checks)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "A Blog Editor YouTube embed plays on the deployed grzybyfunkcjonalne.pl UAT page"
+    requirement: "D-17"
+    verification: []
+    human_judgment: true
+    rationale: "The UAT deploy and the CSP frame-src https://www.youtube-nocookie.com addition belong to plan 05; a real browser on the deployed site is needed to confirm the frame loads"
+
+duration: "about 50 min across two executor runs (Task 3 continuation 7 min)"
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 04: Journal Embeds in the Nuxt Layer Summary
+
+**vue-journal-layer v0.2.0 keeps the Blog Editor's markup through its sanitize-html mirror (four rules matching the Go policy) and expands `<figure data-embed="youtube" data-id="…">` placeholders into youtube-nocookie iframes as the last step before v-html. The tag is published and installs anonymously, and vue-grzybyfunkcjonalne-app main pins it.**
+
+## Performance
+
+- **Duration:** about 50 min over two executor runs. The first run covered Task 1, the release commit and the Task 2 checkpoint (layer commits at 10:19Z). This continuation ran Task 3 from 2026-10-10T11:01:53Z to about 11:08Z.
+- **Started:** about 2026-10-10T10:14Z, after plan 03 closed. The prior run did not record an exact start time.
+- **Completed:** 2026-10-10T11:10Z
+- **Tasks:** 3/3 (Task 1 tracer, Task 2 blocking-human decision, Task 3 release)
+- **Files modified:** 15 (13 in vue-journal-layer, 2 in vue-grzybyfunkcjonalne-app)
+
+## Accomplishments
+
+- **Mirror (D-05 amended).** `htmlGate.ts` gained exactly the four editor-output rules that plan 03 added to the Go bluemonday policy: figure `data-embed` `^youtube$`, figure `data-id` `^[A-Za-z0-9_-]{11}$`, img `alt` free text and ol `start` INTEGER. Every entry of the byte-copied corpus is safe. The Policy section of decision note 0001 lists the four additions.
+- **Embeds (D-17).** `app/utils/embeds.ts` exports `EMBED_PLACEHOLDER`, `EMBED_PROVIDERS` (YouTube only) and `expandEmbeds`. The iframe src is the fixed host `https://www.youtube-nocookie.com/embed/` plus the validated id, and the iframe gets lazy loading, a strict-origin-when-cross-origin referrer policy and a restricted `allow` list.
+- **Order.** `JournalPostBody` and `JournalCategoryHeader` render `expandEmbeds(sanitizeJournalHtml(html))`. `toPostView` and `CategoryPage.vue` only sanitize. A raw iframe in stored HTML is stripped before expansion.
+- **SSR proof.** The acme fixture post `hello-acme` carries a placeholder, and the built playground renders the iframe for it.
+- **Release.** Annotated tag `v0.2.0` is on origin and `check-git-install.sh v0.2.0` passes.
+- **App pin.** The site app pins `#v0.2.0` on its pushed main, with a lockfile that resolves to the tag commit.
+
+## Task Commits
+
+| Task | Name | Repo | Commit |
+|---|---|---|---|
+| 1 | Tracer: a stored placeholder renders as a privacy-enhanced YouTube iframe | vue-journal-layer | `a6ee443` (feat) |
+| 2 | Approve pushing vue-journal-layer v0.2.0 and the site app pin (prep: release commit) | vue-journal-layer | `759e684` (chore: release v0.2.0) |
+| 3 | Push the layer tag, prove the git install, pin v0.2.0 in the site app | vue-grzybyfunkcjonalne-app | `465286a` (chore(deps)) |
+
+Task 3 also created the annotated tag `v0.2.0` (tag object `042b65d072f276f7ee6f1d8bc6f66f518411161e`, peeled commit `759e684e862bd8a2f34e2bbcdf258f66aeddad4f`).
+
+**Pushed heads:**
+- vue-journal-layer `main`: `294a8d8..759e684` (`759e684e862bd8a2f34e2bbcdf258f66aeddad4f`) and tag `v0.2.0`, pushed to git@git.golem15.com:golem15/vue-journal-layer.git.
+- vue-grzybyfunkcjonalne-app `main`: `ada03b2..465286a` (`465286a880f0aae6118c2915aa1475a5da353295`), pushed to git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git.
+
+The summercms.go host gitlink and the sm-grzybyfunkcjonalne-app host gitlink were not touched. Plan 05 bumps them.
+
+## Evidence
+
+**Task 1 (tracer):**
+- `npm test`: 136 pass, 0 fail.
+- `pnpm install --frozen-lockfile` and `build:playground`: OK.
+- `smoke-ssr: ok (29 checks)`, including `200 /blog/hello-acme contains=https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ`.
+- `cmp tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json`: exit 0.
+- Exactly four mirror rules were added: figure data-embed `^youtube$`, figure data-id `^[A-Za-z0-9_-]{11}$`, img alt FREE_TEXT, ol start INTEGER.
+
+**Task 2 (checkpoint:decision, gate blocking-human):**
+- The verify command printed `push-precheck-ok`.
+- Release sheet:
+  - Layer commits to push: `a6ee443` feat, `759e684` chore: release v0.2.0.
+  - Tag `v0.2.0`, message "v0.2.0: Blog Editor markup kept by the sanitizer; Journal embed placeholders expand into privacy-enhanced YouTube iframes".
+  - App change: pin `#v0.1.1` to `#v0.2.0`, plus the regenerated lockfile.
+  - Rollback: a defect means v0.2.1, and the app pin can go back to `#v0.1.1`.
+- Human reply, verbatim: "push"
+
+**Task 3 (release):**
+- Re-check before tagging: `git ls-remote --tags origin refs/tags/v0.2.0` was empty, the layer and app trees were clean, and neither was behind origin/main.
+- `git ls-remote --tags origin`: `042b65d0… refs/tags/v0.2.0` and `759e684e… refs/tags/v0.2.0^{}`.
+- `bash scripts/check-git-install.sh v0.2.0`: `smoke-ssr: ok (29 checks)`, then `check-git-install: ok v0.2.0 759e684e862bd8a2f34e2bbcdf258f66aeddad4f`.
+- App `pnpm install`: `- vue-journal-layer 0.1.0` / `+ vue-journal-layer 0.2.0`. The lockfile diff only touches the layer's specifier, version and resolution `commit: 759e684e862bd8a2f34e2bbcdf258f66aeddad4f`.
+- App verify (`grep pin && pnpm install --frozen-lockfile && pnpm build && pnpm test && HEAD == origin/main`): `# pass 26`, `# fail 0`, `app-pin-ok`.
+- App `pnpm run smoke:ssr` (extra check): `smoke-ssr: ok (37 checks)`.
+
+## Files Created/Modified
+
+- `../vue-journal-layer/app/utils/embeds.ts`: placeholder RegExp, provider allowlist and `expandEmbeds`.
+- `../vue-journal-layer/app/utils/htmlGate.ts`: figure and ol entries and the widened img alt rule.
+- `../vue-journal-layer/app/components/Journal/PostBody.vue` and `CategoryHeader.vue`: sanitize, then expand, then v-html.
+- `../vue-journal-layer/app/assets/css/journal-base.css`: `.journal-embed` frame at a 16 / 9 aspect ratio.
+- `../vue-journal-layer/tests/embeds.test.ts`, `tests/htmlGate.test.ts` and `tests/fixtures/editor-corpus.json`: transform, pipeline and mirror tests, plus the corpus copy.
+- `../vue-journal-layer/testing/fixtures/acme/posts.json` and `testing/expect-acme.txt`: the SSR fixture and its expectation.
+- `../vue-journal-layer/docs/decisions/0001-sanitize-html.md` and `README.md`: the Policy additions and the Embeds section.
+- `../vue-journal-layer/package.json`: version 0.2.0.
+- `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json` and `pnpm-lock.yaml`: the `#v0.2.0` pin, resolving to 759e684e.
+
+## Decisions Made
+
+- The mirror has exactly four rules, matching the Go policy. The corpus needed no fifth rule.
+- Expansion happens only at the sinks and comes last, so the payload carries the placeholder and never an iframe.
+- The release is a separate commit, and the README install line moves with the version.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 2 - Correctness] README install line bumped with the version**
+- **Found during:** Task 2 (release prep, prior run)
+- **Issue:** The plan's release commit changes only the package.json version, but the README install snippet still pinned `#v0.1.0`. A consumer copying it would install an outdated layer.
+- **Fix:** The release commit also changes the README install line from `#v0.1.0` to `#v0.2.0`.
+- **Files modified:** ../vue-journal-layer/README.md
+- **Committed in:** `759e684` (chore: release v0.2.0)
+
+**2. [Rule 3 - Blocking] check-git-install could not write the shared /tmp pnpm store**
+- **Found during:** Task 3
+- **Issue:** The script's scratch app lives under `$TMPDIR` (/tmp), where pnpm picks the store `/tmp/.pnpm-store/v11`. On this machine another local user (`jin`) owns that store, so `pnpm install` failed with `ERR_SQLITE_ERROR attempt to write a readonly database`. The tag was not the cause.
+- **Fix:** I re-ran the unchanged script with `TMPDIR` and `npm_config_store_dir`/`pnpm_config_store_dir` pointing into the session scratchpad. The script, the tag and the remote were not touched.
+- **Files modified:** none
+- **Verification:** `check-git-install: ok v0.2.0 759e684e862bd8a2f34e2bbcdf258f66aeddad4f`
+
+---
+
+**Total deviations:** 2 (1 correctness, 1 environment blocker).
+**Impact on plan:** No change to the shipped code. The tag was created and pushed exactly as planned, with no moved tag and no force-push.
+
+## Issues Encountered
+
+- On this machine, `scripts/check-git-install.sh` fails under the default `/tmp` because the store there belongs to another user (see deviation 2). This is a machine-local environment issue, not a layer defect. Anyone re-running the script here should set `npm_config_store_dir`, or a `TMPDIR` whose pnpm store they own.
+
+## User Setup Required
+
+None. No external service configuration is required.
+
+## Next Phase Readiness
+
+- Plan 05 can bump the sm-grzybyfunkcjonalne-app host gitlink to app `465286a`. It also needs to add `frame-src https://www.youtube-nocookie.com` to the report-only CSP, then deploy to UAT.
+- The plan 06 phase gate can `cmp` the layer corpus copy against `../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json`.
+
+---
+*Phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget*
+*Completed: 2026-10-10*
+
+## Self-Check: PASSED
+
+- FOUND: ../vue-journal-layer/app/utils/embeds.ts, tests/embeds.test.ts, tests/fixtures/editor-corpus.json
+- FOUND commits: a6ee443, 759e684 (vue-journal-layer), 465286a (vue-grzybyfunkcjonalne-app)
+- expandEmbeds count 0 in postView.ts and CategoryPage.vue; app pin #v0.2.0 present; corpus cmp exit 0

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-PLAN.md

@@ -9,11 +9,14 @@ files_modified:
   - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
   - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
   - ../sm-grzybyfunkcjonalne-app/README.md
+  - ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+  - ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh
+  - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
 autonomous: false
-requirements: [D-02, D-03, D-05, D-07, D-17, D-18, D-19]
+requirements: [D-02, D-03, D-05, D-07, D-10, D-17, D-18, D-19]
 user_setup:
   - service: UAT admin (https://uat.grzybyfunkcjonalne.pl/gfadmin)
-    why: "The executor holds no UAT basic-auth or admin credentials; a human re-saves imported posts untouched, edits a test post with the Blog Editor and checks the public page (D-03, D-05, D-17, D-18)"
+    why: "The executor holds no UAT basic-auth or admin credentials; a human re-saves imported posts untouched, edits a test post with the Blog Editor (including a save that must strip markup and report it) and checks the public page (D-03, D-05, D-10, D-17, D-18)"
     dashboard_config:
       - task: "Log in to the admin through the UAT basic-auth realm with an admin account that may publish"
         location: "browser, https://uat.grzybyfunkcjonalne.pl/gfadmin"
@@ -24,10 +27,11 @@ estimate:
   confidence: low
 must_haves:
   truths:
-    - "Release (16.1 D-04 pattern): an annotated summercms tag (v0.1.17, or the next free v0.1.x if the concurrent session tagged first) contains every plan 01 commit and is on origin; sm-journal-plugin main with plans 02 and 03 and a go.mod require of that tag is on origin; the host's plugins/golem15/journal and vue-grzybyfunkcjonalne-app gitlinks point at the pushed heads."
+    - "Release (16.1 D-04 pattern): an annotated summercms tag (v0.1.18, or the next free v0.1.x if the concurrent session tagged first; v0.1.17 is the 16.1 security release) contains every plan 01 commit and is on origin; sm-journal-plugin main with plans 02 and 03 and a go.mod require of that tag is on origin; the host's plugins/golem15/journal and vue-grzybyfunkcjonalne-app gitlinks point at the pushed heads."
     - "Release: UAT runs a binary and Nuxt output built by scripts/build.sh from those heads; the server binary's sha256 equals the local build, both supervisor programs are RUNNING, the previous binary and Nuxt output are kept for rollback, and the on-server smoke ends with 'smoke: ok ('."
-    - "D-03 and todo journal-imported-html-admin-resave on UAT: after a human saves post 64 (markdown with the raw author footer) and one HTML post without editing, md5(content), md5(content_html) and the md5 of their translation rows are unchanged."
+    - "D-03 and todo journal-imported-html-admin-resave on UAT: after a human saves post 64 (ekstrakt-z-turkey-tail: markdown content with the raw author footer; its content_html was re-rendered in 16.1 without the style block, whose CSS now lives in the app's base.css) and one HTML post without editing, md5(content), md5(content_html) and the md5 of their translation rows are unchanged; the read-only snapshot taken first records post 64's current state (whether content and content_html contain a style element) instead of assuming it."
     - "D-02, D-05 and D-18 on UAT: a test post edited in the Blog Editor with an uploaded image (alt and caption) and a YouTube embed stores content equal to content_html, containing data-embed=\"youtube\", a figcaption and an image URL under /storage/app/uploads/public/journal/posts/."
+    - "D-10 on UAT (amended): a save of the test post after a style block and an onclick attribute were added in the source tab succeeds, the admin sees a notice naming the removed style element and onclick attribute, the editor reloads without them, and the stored content and content_html are equal and contain neither."
     - "D-17 on UAT: while the test post is published, its public page served on the server contains an iframe on https://www.youtube-nocookie.com/embed/."
     - "Release gate: the human chooses release-now or docker-first after seeing which Postgres suites could not run here and any open high finding of a code or security review."
   artifacts:
@@ -64,7 +68,11 @@ ROADMAP Goal (not in user-story format): plugins can register their own admin fo
 
 This plan's slice (user decision 3, plan 05; the 16.1-02 pattern): release the framework, the plugin and the site, redeploy UAT, and prove on the real imported data that untouched saves are byte-identical and that editing, uploads and embeds work.
 
-Wave order: 01, 02 and 04 (wave 1), 03 (wave 2), this plan (wave 3), 06 unit tests (wave 4). CLAUDE.md lean rule 3 keeps the unit-test plan last; as in 16.1 the release does not wait for it, and plan 06's tests ship with the next tag.
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-10 amended)
+
+16.1 closed after this plan was written. The release facts below are refreshed: v0.1.17 is taken, so this phase tags v0.1.18 or the next free tag; the plugin head is c60abc6; the layer is at v0.1.1. Posts 53 and 64 were re-saved on UAT, so post 64's content_html no longer has its style block, and the snapshot records its state read-only instead of assuming it. The UAT refusal step is replaced by a strip-and-report step (amended D-10). The public vhost now sends a report-only CSP, so the host commit also allows the youtube-nocookie frame.
+
+Wave order: 01 and 02 (wave 1), 03 and 04 (wave 2; 04 needs plan 02's editor corpus), this plan (wave 3), 06 unit tests (wave 4). CLAUDE.md lean rule 3 keeps the unit-test plan last; as in 16.1 the release does not wait for it, and plan 06's tests ship with the next tag.
 
 ## Spec-less probe fallback
 
@@ -72,14 +80,14 @@ Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to
 
 ## Artifacts this phase produces (this plan)
 
-- summercms annotated tag `v0.1.17` (or the next free `v0.1.x`) on origin.
+- summercms annotated tag `v0.1.18` (or the next free `v0.1.x`) on origin.
 - sm-journal-plugin main on origin with `chore(deps): require summercms <tag>`.
-- sm-grzybyfunkcjonalne-app master on origin: journal and vue-grzybyfunkcjonalne-app gitlink bumps and the README admin note.
+- sm-grzybyfunkcjonalne-app master on origin: journal and vue-grzybyfunkcjonalne-app gitlink bumps, the README admin note, and `frame-src https://www.youtube-nocookie.com` in the staging vhost's report-only CSP (with its check-deploy.sh needle and the DEPLOY.md line).
 - UAT: new binary and Nuxt output, `bin/grzybyfunkcjonalne.prev` and `build/nuxt/.output.prev` kept, both programs restarted.
-- Session values recorded in the SUMMARY: `RELEASE_TAG`, `RESTART_TS`, `HTML_POST`, the md5 snapshot before the human saves.
+- Session values recorded in the SUMMARY: `RELEASE_TAG`, `RESTART_TS`, `HTML_POST`, `POST64_STATE`, the md5 snapshot before the human saves.
 
 <objective>
-Release and redeploy (user decision 3): pass a human release gate, tag summercms, push the plugin and host bumps, build and deploy to uat.grzybyfunkcjonalne.pl per DEPLOY.md, smoke on the server, then accept D-02, D-03, D-05, D-17 and D-18 on UAT with human admin actions and read-only checks.
+Release and redeploy (user decision 3): pass a human release gate, tag summercms, push the plugin and host bumps, build and deploy to uat.grzybyfunkcjonalne.pl per DEPLOY.md, smoke on the server, then accept D-02, D-03, D-05, D-10, D-17, D-18 and D-19 on UAT with human admin actions and read-only checks.
 
 Purpose: the goal is to edit imported posts on UAT (CONTEXT Claude's Discretion: release recommended).
 Output: pushed tag and branches, a running UAT release, a passing on-server smoke and read-only proof of byte-identical untouched saves and working edits.
@@ -101,7 +109,7 @@ Output: pushed tag and branches, a running UAT release, a passing on-server smok
 
 Server facts (DEPLOY.md "Server facts", 16.1-02-SUMMARY): ssh alias `grzybyfunkcjonalne-uat`, install root `/srv/grzybyfunkcjonalne`, programs `grzybyfunkcjonalne-go` and `grzybyfunkcjonalne-nuxt`, sudo only for nginx -t, nginx reload and supervisorctl, PostgreSQL reachable by peer psql as the deploy user (database `grzybyfunkcjonalne`), default content locale pl. The UAT realm answers 401 off-server, so every HTTP check runs on the server with curl resolving the host to 127.0.0.1. The host builds the framework from the `../summercms.go` working tree through a replace, so the framework version in the host is nominal; the host bumps are the two gitlinks. Commits: no co-author tags, stage by explicit path.
 
-Release state at planning time: summercms latest tag v0.1.16; sm-journal-plugin pre-phase head 03907ee (go.mod requires v0.1.16); host journal gitlink a675f2f; vue-journal-layer v0.1.0 before plan 04.
+Release state at planning time (revised 2026-10-10, after 16.1 closed): summercms latest tag v0.1.17 (the 16.1 security release, tag commit c21fe36), so this phase's tag is v0.1.18 unless someone tags first; sm-journal-plugin pre-phase head c60abc6 (go.mod requires v0.1.17 with a replace to ../summercms.go); host sm-grzybyfunkcjonalne-app master 0b93ac2 with journal gitlink c60abc6 and vue-grzybyfunkcjonalne-app gitlink ada03b2; vue-journal-layer v0.1.1 (294a8d8, already ships sanitize-html) before plan 04, and the app pins #v0.1.1. UAT data: posts 53 and 64 were re-saved during 16.1; post 64's content_html no longer holds its style block (the footer CSS moved to the app's base.css, 2c46185).
 </context>
 
 <tasks>
@@ -113,11 +121,11 @@ Release state at planning time: summercms latest tag v0.1.16; sm-journal-plugin
 
 Concurrency: in summercms.go `git status --porcelain -- modules admin docs scripts` prints nothing, `git fetch origin --tags`, and `git log --oneline HEAD..origin/master` prints nothing; the same clean and not-behind checks for ../sm-journal-plugin (main) and ../sm-grzybyfunkcjonalne-app (master). If any origin has commits this checkout lacks, stop and report; do not merge or rebase on your own.
 
-Tag: if `git tag --contains` on the first plan 01 commit lists a tag, propose reusing it and cutting none. Otherwise propose the highest of `git tag -l 'v0.1.*' --sort=-v:refname` plus one (v0.1.17 if nobody tagged after v0.1.16) and confirm with `git ls-remote --tags origin` that it does not exist yet.
+Tag: if `git tag --contains` on the first plan 01 commit lists a tag, propose reusing it and cutting none. Otherwise propose the highest of `git tag -l 'v0.1.*' --sort=-v:refname` plus one (v0.1.18 if nobody tagged after v0.1.17) and confirm with `git ls-remote --tags origin` that it does not exist yet.
 
 Run the release gate (verify command). Then, read-only on UAT, report the D-07 split of the current data (assumption A1): ssh grzybyfunkcjonalne-uat psql -X -d grzybyfunkcjonalne -tAc with a SELECT counting golem15_journal_posts whose ltrim(content) starts with '<' (served as content) and those that do not (served as content_html).
 
-Release sheet: the proposed or reused tag; commits to push per repository (summercms.go origin/master..HEAD including planning-doc commits, sm-journal-plugin origin/main..HEAD, the host's gitlink targets: sm-journal-plugin HEAD and the vue-grzybyfunkcjonalne-app commit plan 04 pushed); the UAT HTML/markdown split; the Postgres suites that cannot run here (modules/cabana testcontainers suites; the sm-journal-plugin root harness including TestPostsFormCompiles, TestPostsAdminCreateSmoke and TestPostsAdminResaveKeepsHTML; ./models); open high findings from 16.2-REVIEW.md or 16.2-SECURITY.md if those files exist (an open high finding means only docker-first or hold may be chosen, per security_block_on high); the deploy steps from DEPLOY.md "Release" plus keeping build/nuxt/.output.prev on the server; the rollback (move bin/grzybyfunkcjonalne.prev and build/nuxt/.output.prev back and restart both programs). Stop for the human.</action>
+Release sheet: the proposed or reused tag; commits to push per repository (summercms.go origin/master..HEAD including planning-doc commits, sm-journal-plugin origin/main..HEAD, the host's gitlink targets: sm-journal-plugin HEAD and the vue-grzybyfunkcjonalne-app commit plan 04 pushed); the UAT HTML/markdown split; the Postgres suites that cannot run here (modules/cabana testcontainers suites; the sm-journal-plugin root harness including TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML and TestCategoriesAdminContent; ./models); open high findings from 16.2-REVIEW.md or 16.2-SECURITY.md if those files exist (an open high finding means only docker-first or hold may be chosen, per security_block_on high); the deploy steps from DEPLOY.md "Release" plus keeping build/nuxt/.output.prev on the server; the rollback (move bin/grzybyfunkcjonalne.prev and build/nuxt/.output.prev back and restart both programs). Stop for the human.</action>
   <decision>Push summercms master and the proposed annotated tag, push the plugin and host bumps, and deploy to UAT now?</decision>
   <context>A pushed tag is read by other repositories' go.mod and the Go module proxy and publishes the pact field-type API (D-12, one-way); it cannot be moved, only superseded. The save-path code is covered here by DryRun and unit smoke tests only; the real-database proof is the UAT acceptance in Task 3, with the previous binary and Nuxt output kept for rollback. Plan 06 adds full unit coverage after the release (lean rule 3).</context>
   <options>
@@ -134,13 +142,13 @@ Release sheet: the proposed or reused tag; commits to push per repository (summe
     <option id="hold">
       <name>Hold the release</name>
       <pros>Nothing leaves this machine</pros>
-      <cons>UAT keeps the markdown field and the 16.1 stopgap</cons>
+      <cons>UAT keeps the markdown field, whose admin save renders content through goldmark and the 16.1 sanitizer</cons>
     </option>
   </options>
   <resume-signal>Reply "release vX" (release-now), "docker passed, release vX" (docker-first, after the human ran the suites), or "hold".</resume-signal>
   <verify>
     <automated>go vet ./... &amp;&amp; go -C ../sm-journal-plugin vet ./... &amp;&amp; go test -count=1 -run '^(TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke|TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestListRelationSearchSmoke|TestEnabledLocalesDefaultFirstSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 6 &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; bash scripts/check-admin-openapi.sh --check &amp;&amp; ../sm-journal-plugin/node_modules/.bin/vitest run --root ../sm-journal-plugin &amp;&amp; bash ../sm-journal-plugin/scripts/check-dist.sh &amp;&amp; echo release-gate-ok</automated>
-    <fails_when>Non-zero exit or "release-gate-ok" absent: vet fails in either repository, fewer than six "--- PASS: Test" lines for the cabana smoke set, a journal classes or controllers test fails, TestDocsTree fails, a vitest suite fails, or a dist or OpenAPI drift gate reports stale output.</fails_when>
+    <fails_when>Non-zero exit or "release-gate-ok" absent: vet fails in either repository, fewer than six "--- PASS: Test" lines for the cabana smoke set, a journal classes or controllers test fails (including the editor-output policy cross-check and the removal report tests), TestDocsTree fails, a vitest suite fails (including the editor corpus test), or a dist or OpenAPI drift gate reports stale output.</fails_when>
   </verify>
   <acceptance_criteria>
     - The gate printed release-gate-ok and the three repositories were clean and not behind origin.
@@ -153,19 +161,19 @@ Release sheet: the proposed or reused tag; commits to push per repository (summe
   <name>Task 2: Tracer: tag, push, bump, build and deploy; the on-server smoke passes; snapshot the posts the human will re-save</name>
   <reversibility rating="one-way">A pushed annotated summercms tag publishes the pact field-type API to other repositories' go.mod and the Go module proxy; it can only be superseded.</reversibility>
   <precondition>Task 1 was answered "release vX" or "docker passed, release vX", RELEASE_TAG is set to that tag in the session, plan 04 pushed vue-grzybyfunkcjonalne-app main pinning v0.2.0, and `ssh grzybyfunkcjonalne-uat true` exits 0.</precondition>
-  <files>../sm-journal-plugin/go.mod, ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app, ../sm-grzybyfunkcjonalne-app/README.md</files>
-  <read_first>../sm-grzybyfunkcjonalne-app/DEPLOY.md (Build and upload, Release, Smoke), ../sm-grzybyfunkcjonalne-app/README.md (Admin section), ../sm-grzybyfunkcjonalne-app/scripts/build.sh, ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, ../sm-grzybyfunkcjonalne-app/.gitmodules, ../sm-journal-plugin/go.mod, the Task 1 release sheet in this plan's SUMMARY</read_first>
-  <action>Framework: unless Task 1 recorded an existing tag, re-run `git log --oneline HEAD..origin/master` (must print nothing), create the annotated tag on summercms.go master HEAD with git tag -a "$RELEASE_TAG" and the message "$RELEASE_TAG: plugin-registered admin form field types (pact.HasFormFieldTypes), field upload route, admin SPA plugin fields", then git push origin master and git push origin "$RELEASE_TAG".
+  <files>../sm-journal-plugin/go.mod, ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app, ../sm-grzybyfunkcjonalne-app/README.md, ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf, ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, ../sm-grzybyfunkcjonalne-app/DEPLOY.md</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/DEPLOY.md (Build and upload, Release, Smoke, Security headers), ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf (line 91: Content-Security-Policy-Report-Only), ../sm-grzybyfunkcjonalne-app/README.md (Admin section), ../sm-grzybyfunkcjonalne-app/scripts/build.sh, ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, ../sm-grzybyfunkcjonalne-app/.gitmodules, ../sm-journal-plugin/go.mod, the Task 1 release sheet in this plan's SUMMARY</read_first>
+  <action>Framework: unless Task 1 recorded an existing tag, re-run `git log --oneline HEAD..origin/master` (must print nothing), create the annotated tag on summercms.go master HEAD with git tag -a "$RELEASE_TAG" and the message "$RELEASE_TAG: plugin-registered admin form field types (pact.HasFormFieldTypes), save notices (meta.notices), field upload route, admin SPA plugin fields", then git push origin master and git push origin "$RELEASE_TAG".
 
 sm-journal-plugin: go -C ../sm-journal-plugin mod edit -require=git.golem15.com/golem15/summercms@$RELEASE_TAG (the go.work replace stays, so the require is nominal); go -C ../sm-journal-plugin vet ./...; commit go.mod only as "chore(deps): require summercms $RELEASE_TAG"; git -C ../sm-journal-plugin push origin main (this publishes plans 02 and 03).
 
-Host (../sm-grzybyfunkcjonalne-app): in plugins/golem15/journal fetch origin and check out the sm-journal-plugin main just pushed; in vue-grzybyfunkcjonalne-app fetch origin and check out the main plan 04 pushed. In README.md's Admin section add one sentence that Journal post and category content are edited with the Blog Editor (WYSIWYG with a source tab) and that saving an untouched post keeps its stored HTML. Commit both gitlinks and README.md as "chore: bump journal plugin (Blog Editor) and the site app (embeds)" and push origin master.
+Host (../sm-grzybyfunkcjonalne-app): in plugins/golem15/journal fetch origin and check out the sm-journal-plugin main just pushed; in vue-grzybyfunkcjonalne-app fetch origin and check out the main plan 04 pushed. In README.md's Admin section add one sentence that Journal post and category content are edited with the Blog Editor (WYSIWYG with a source tab), that saving an untouched post keeps its stored HTML, and that a save removes markup the HTML policy does not allow and names what it removed. Embeds and the public CSP (D-17): the staging vhost's Content-Security-Policy-Report-Only (16.1) has default-src 'self' and no frame-src, so every embed would log a violation and block the later switch to an enforced policy. Add frame-src https://www.youtube-nocookie.com to that policy in deploy/nginx/grzybyfunkcjonalne-staging.conf, add the needle frame-src https://www.youtube-nocookie.com to the vhost checks in scripts/check-deploy.sh, and name it in DEPLOY.md's Security headers bullet. Installing a changed vhost on UAT needs root (16.1 UAT item 1), which the executor does not have: record it in the SUMMARY as a pending human step; it blocks nothing here, because the policy only reports. Commit both gitlinks, README.md and the three deploy files as "chore: bump journal plugin (Blog Editor) and the site app (embeds)" and push origin master.
 
 Build: bash ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh, then bash ../sm-grzybyfunkcjonalne-app/scripts/build.sh. Record the local sha256sum of ../sm-grzybyfunkcjonalne-app/bin/grzybyfunkcjonalne.
 
 Release per DEPLOY.md "Release": on the server first cp -a build/nuxt/.output build/nuxt/.output.prev; rsync the binary to bin/grzybyfunkcjonalne.new and config/, scripts/ and build/nuxt/.output/ as listed in "Build and upload" (never a local .env); compare the sha256 of bin/grzybyfunkcjonalne.new with the local one; cp -p bin/grzybyfunkcjonalne bin/grzybyfunkcjonalne.prev and mv bin/grzybyfunkcjonalne.new bin/grzybyfunkcjonalne; bin/grzybyfunkcjonalne migrate (no new migration in this phase; must exit 0); record RESTART_TS as the server's date +'%Y/%m/%d %H:%M:%S'; sudo supervisorctl restart grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt. Smoke with the DEPLOY.md recipe (first verify). On any failure: move bin/grzybyfunkcjonalne.prev and build/nuxt/.output.prev back, restart both programs and report.
 
-Snapshot for Task 3 (read-only): pick HTML_POST as the lowest published post id whose ltrim(content) starts with the less-than character; then run exactly the two SELECTs of Task 3's first two verify commands (same column concatenation, same ORDER BY) and keep their outputs in the session as SNAPSHOT_POSTS and SNAPSHOT_TRANSLATIONS, and in the SUMMARY.</action>
+Snapshot for Task 3 (read-only): pick HTML_POST as the lowest published post id whose ltrim(content) starts with the less-than character; then run exactly the two SELECTs of Task 3's first two verify commands (same column concatenation, same ORDER BY) and keep their outputs in the session as SNAPSHOT_POSTS and SNAPSHOT_TRANSLATIONS, and in the SUMMARY. Record post 64's current state as POST64_STATE with one more read-only SELECT printing (content LIKE '%<style%')::int || ':' || (content_html LIKE '%<style%')::int for id 64. 16.1 left content_html without the style block (expected x:0); record whatever it prints, and report a 1 in the second position in the SUMMARY instead of treating it as a failure. The untouched re-save in Task 3 must not change either column, whatever their state.</action>
   <verify>
     <automated>ssh grzybyfunkcjonalne-uat 'C=$(mktemp -d); printf "resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n" &gt; "$C/.curlrc"; cd /srv/grzybyfunkcjonalne/go &amp;&amp; CURL_HOME="$C" scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl; rc=$?; rm -rf "$C"; exit $rc' | grep '^smoke: ok ('</automated>
     <fails_when>Non-zero exit: smoke.sh failed on the server, the output contains "smoke: FAIL", or no line starts with "smoke: ok (".</fails_when>
@@ -176,19 +184,20 @@ Snapshot for Task 3 (read-only): pick HTML_POST as the lowest published post id
     - `git ls-remote --tags origin` lists the release tag (or the SUMMARY names the reused tag).
     - `git -C ../sm-journal-plugin rev-parse main` equals `git -C ../sm-journal-plugin rev-parse origin/main`, and ../sm-journal-plugin/go.mod requires summercms at the release tag.
     - `git -C ../sm-grzybyfunkcjonalne-app ls-files -s plugins/golem15/journal vue-grzybyfunkcjonalne-app` shows the pushed sm-journal-plugin main and vue-grzybyfunkcjonalne-app main commits, and the host master equals origin/master.
+    - `grep -c "frame-src https://www.youtube-nocookie.com" ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh` reports at least 1 for each file, and check-deploy.sh passed before the build; the SUMMARY lists the vhost install as a pending root step.
     - The on-server smoke prints a line starting with "smoke: ok (" and the second verify prints deploy-ok.
-    - The SUMMARY records the tag, the pushed heads, both sha256 values, RESTART_TS, HTML_POST and the md5 snapshot; no credential appears in it.
+    - The SUMMARY records the tag, the pushed heads, both sha256 values, RESTART_TS, HTML_POST, POST64_STATE and the md5 snapshot; no credential appears in it.
   </acceptance_criteria>
   <done>UAT runs the released Blog Editor and embed rendering from pushed tags and branches, every smoke URL passes, and the pre-save snapshot is recorded.</done>
 </task>
 
 <task type="checkpoint:human-action" gate="blocking-human">
-  <name>Task 3: UAT acceptance: untouched re-saves are byte-identical; a Blog Editor edit stores HTML in both columns with an uploaded image and an embed that renders on the site</name>
+  <name>Task 3: UAT acceptance: untouched re-saves are byte-identical; a Blog Editor edit stores HTML in both columns with an uploaded image and an embed that renders on the site; unsafe markup is stripped and reported, never refused</name>
   <precondition>Task 2 printed deploy-ok; RESTART_TS, HTML_POST, SNAPSHOT_POSTS and SNAPSHOT_TRANSLATIONS are set in the session and recorded in the SUMMARY.</precondition>
   <read_first>.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md (Manual-Only Verifications), ../sm-grzybyfunkcjonalne-app/DEPLOY.md (Smoke, Rollback), this plan's SUMMARY (snapshot)</read_first>
   <action>Print the steps for the human and stop. The executor never asks for, receives or stores a credential.
 
-Human steps in https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts: (1) open post 64 (ekstrakt-z-turkey-tail, a markdown post with the raw author footer) and post HTML_POST; on each press "Zapisz" without touching the editor (D-03). (2) Create a post with slug uat-16-2-blog-editor, unpublished: a heading, bold text, a bullet list, a link, a 3x3 table, an image uploaded from the toolbar with alt text and a caption, and a YouTube embed from a youtube.com URL; save (D-02, D-05, D-18). (3) Publish it for the check, then reply. (4) In the source tab of the test post type a script tag and save: the field shows the refusal message and nothing is stored (D-10); remove it again.
+Human steps in https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts: (1) open post 64 (ekstrakt-z-turkey-tail: markdown content with the raw author footer, served in the editor as its content_html, which 16.1 re-rendered without the style block) and post HTML_POST; on each press "Zapisz" without touching the editor (D-03); no removal notice may appear. (2) Create a post with slug uat-16-2-blog-editor, unpublished: a heading, bold text, a bullet list, a link, a 3x3 table, an image uploaded from the toolbar with alt text containing a colon and a caption, and a YouTube embed from a youtube.com URL; save; no removal notice may appear (D-02, D-05, D-18). (3) Still unpublished, in the source tab of the test post add a harmless style block that colours paragraphs red and an onclick="void 0" attribute on one paragraph, then save (D-10 amended): the save succeeds, a notice under the field names the removed style element and the onclick attribute, and the editor reloads without them. (4) Publish the post for the site check, then reply with what the notice in step 3 said.
 
 After the reply run the verify commands, then tell the human to unpublish or delete the test post. If a check fails, report it and offer the rollback (move bin/grzybyfunkcjonalne.prev and build/nuxt/.output.prev back, restart both programs).</action>
   <instructions>
@@ -196,23 +205,23 @@ After the reply run the verify commands, then tell the human to unpublish or del
     The human logs in to the UAT admin (basic-auth realm plus an admin account), performs steps 1 to 4 and replies.
   </instructions>
   <verification>Read-only psql on the server compares the snapshot and checks the test post's stored HTML; an on-server curl checks the public page for the youtube-nocookie iframe; the Go log since RESTART_TS has no panic or SQLSTATE line.</verification>
-  <resume-signal>Type "saved and published" once steps 1 to 3 are done (and the step 4 result), or describe what went wrong.</resume-signal>
+  <resume-signal>Type "saved and published" once steps 1 to 4 are done, with the step 3 notice text, or describe what went wrong.</resume-signal>
   <verify>
     <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT id || ':' || md5(content) || ':' || md5(content_html) FROM golem15_journal_posts WHERE id IN (64, $HTML_POST) ORDER BY id\"" | diff - &lt;(printf '%s\n' "$SNAPSHOT_POSTS") &amp;&amp; echo posts-unchanged</automated>
     <fails_when>Non-zero exit or "posts-unchanged" absent: an untouched save changed content or content_html of post 64 or HTML_POST (SNAPSHOT_POSTS holds the Task 2 rows in the same id:md5:md5 format).</fails_when>
     <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT model_id || ':' || locale || ':' || md5(coalesce(attribute_data, '')) FROM golem15_translate_attributes WHERE model_type LIKE 'Golem15_Journal_Models_Post' AND model_id IN ('64', '$HTML_POST') ORDER BY model_id, locale\"" | diff - &lt;(printf '%s\n' "$SNAPSHOT_TRANSLATIONS") &amp;&amp; echo translations-unchanged</automated>
     <fails_when>Non-zero exit or "translations-unchanged" absent: an untouched save added, removed or changed a translation row of the two posts (for example empty en values).</fails_when>
-    <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT (content = content_html)::int || ':' || (content LIKE '%data-embed=_youtube_%')::int || ':' || (content LIKE '%&lt;figcaption%')::int || ':' || (content LIKE '%/storage/app/uploads/public/journal/posts/%')::int FROM golem15_journal_posts WHERE slug = 'uat-16-2-blog-editor'\"" | grep -qx '1:1:1:1' &amp;&amp; echo edit-ok</automated>
-    <fails_when>Non-zero exit or "edit-ok" absent: the test post is missing, content differs from content_html, or it lacks the embed placeholder, the figcaption or an uploaded image URL under journal/posts.</fails_when>
+    <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT (content = content_html)::int || ':' || (content LIKE '%data-embed=_youtube_%')::int || ':' || (content LIKE '%&lt;figcaption%')::int || ':' || (content LIKE '%/storage/app/uploads/public/journal/posts/%')::int || ':' || (position('&lt;style' in content) = 0 AND position('onclick' in content) = 0)::int FROM golem15_journal_posts WHERE slug = 'uat-16-2-blog-editor'\"" | grep -qx '1:1:1:1:1' &amp;&amp; echo edit-ok</automated>
+    <fails_when>Non-zero exit or "edit-ok" absent: the test post is missing, content differs from content_html, it lacks the embed placeholder (the policy stripped data-embed), the figcaption or an uploaded image URL under journal/posts, or the step 3 style element or onclick attribute was stored (the strip did not happen).</fails_when>
     <automated>ssh grzybyfunkcjonalne-uat 'C=$(mktemp -d); printf "resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n" &gt; "$C/.curlrc"; CURL_HOME="$C" curl -s https://uat.grzybyfunkcjonalne.pl/blog/uat-16-2-blog-editor; rm -rf "$C"' | grep -c 'src="https://www.youtube-nocookie.com/embed/' | grep -qv '^0$' &amp;&amp; ssh grzybyfunkcjonalne-uat 'sudo supervisorctl tail -65536 grzybyfunkcjonalne-go' | awk -v since="$RESTART_TS" 'substr($0,1,19) &gt;= since' | grep -ciE 'panic|SQLSTATE' | grep -qx 0 &amp;&amp; echo site-ok</automated>
     <fails_when>Non-zero exit or "site-ok" absent: the public page of the test post has no youtube-nocookie iframe (the layer did not expand the placeholder, or the page is not reachable because the post is not published), or the Go log has a panic or SQLSTATE line after RESTART_TS.</fails_when>
-    <human-check>In the admin (D-19): open a category with content, change one word in the Blog Editor and save; the category page on the site shows the change. Open post HTML_POST, switch to the source tab: it shows the stored HTML exactly as before. Reply "UAT approved" or list the issues.</human-check>
+    <human-check>In the admin (D-19): open a category with content, change one word in the Blog Editor and save; no removal notice appears (all 6 UAT category bodies passed the policy in 16.1) and the category page on the site shows the change. Open post HTML_POST, switch to the source tab: it shows the stored HTML exactly as before. Reply "UAT approved" or list the issues.</human-check>
   </verify>
   <acceptance_criteria>
     - posts-unchanged, translations-unchanged, edit-ok and site-ok are printed.
-    - The SUMMARY records the human's replies, the step 4 refusal result, the human-check answer (or marks it pending for /msd-verify-work), and that the test post was unpublished or deleted afterwards.
+    - The SUMMARY records the human's replies, the step 3 notice text, the human-check answer (or marks it pending for /msd-verify-work), and that the test post was unpublished or deleted afterwards.
   </acceptance_criteria>
-  <done>Untouched saves of imported posts are byte-identical on UAT, and a Blog Editor edit with an upload and an embed is stored in both columns and renders on the site.</done>
+  <done>Untouched saves of imported posts are byte-identical on UAT, a Blog Editor edit with an upload and an embed is stored in both columns and renders on the site, and unsafe markup added in the source tab is stripped and reported instead of refused.</done>
 </task>
 
 </tasks>
@@ -235,6 +244,7 @@ After the reply run the verify commands, then tell the human to unpublish or del
 | T-16.2-24 | Tampering / Repudiation | annotated tag and pushes | high | mitigate | Tag only with clean trees and nothing behind origin, re-checked right before the push; git tag --contains decides whether a concurrent release already includes plan 01; the binary's sha256 must equal the local build; the SUMMARY records every pushed head |
 | T-16.2-25 | Information Disclosure | credentials | high | mitigate | No .env is rsynced; the executor never asks for, prints or stores UAT basic-auth or admin credentials; all admin steps are done by the human |
 | T-16.2-26 | Tampering | UAT database and the Winter site | medium | mitigate | The executor runs only SELECT queries; data changes only through human admin saves; the Winter vhost, php-fpm and PHP database are untouched; binary and Nuxt output rollback copies are kept |
+| T-16.2-35 | Tampering | UAT strip check (Task 3 step 3) | low | mitigate | Only harmless markup is added (a red-paragraph style block and onclick="void 0"), on an unpublished test post; the strip is verified read-only before the post is published for the site check; the layer sanitizes again at render; the test post is unpublished or deleted afterwards |
 | T-16.2-27 | Elevation of Privilege | sudo on the server | low | accept | sudo is limited by the server to nginx -t, nginx reload and supervisorctl; this plan uses supervisorctl restart, status and tail only |
 | T-16.2-SC | Tampering | packages | high | mitigate | No package is installed: build.sh builds from committed lockfiles and go.sum (pnpm install --frozen-lockfile for the app, which pins vue-journal-layer v0.2.0 from plan 04); go mod edit changes only the nominal summercms require |
 </threat_model>
@@ -247,9 +257,9 @@ After the reply run the verify commands, then tell the human to unpublish or del
 
 <success_criteria>
 - Tag, plugin and host bumps pushed; UAT redeployed per DEPLOY.md with rollback copies; on-server smoke passes.
-- D-03 proven on real imported posts; D-02, D-05, D-17 and D-18 proven with a test post; no credential handled by the executor; no write SQL.
+- D-03 proven on real imported posts; D-02, D-05, D-10 (strip and report), D-17 and D-18 proven with a test post, D-19 with a category edit; no credential handled by the executor; no write SQL.
 </success_criteria>
 
 <output>
-Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md` when done, with the release sheet, the human replies, the tag and pushed heads, both sha256 values, RESTART_TS, HTML_POST, the snapshot and every check result.
+Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md` when done, with the release sheet, the human replies, the tag and pushed heads, both sha256 values, RESTART_TS, HTML_POST, POST64_STATE, the snapshot and every check result.
 </output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md

@@ -0,0 +1,316 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 05
+subsystem: release
+tags: [release, uat, deploy, summercms-tag, journal, blog-editor, embeds, csp, grzybyfunkcjonalne]
+
+requires:
+  - phase: 16.2-01
+    provides: pact.HasFormFieldTypes, meta.notices, the field upload route and admin SPA plugin fields (released as summercms v0.1.18)
+  - phase: 16.2-02
+    provides: the Blog Editor formwidget and its editor corpus in sm-journal-plugin
+  - phase: 16.2-03
+    provides: Journal post and category content on the Blog Editor, the editor-output policy extension and the strip-and-report save
+  - phase: 16.2-04
+    provides: vue-journal-layer v0.2.0 (embed expansion) pinned by vue-grzybyfunkcjonalne-app main 465286a
+provides:
+  - "summercms annotated tag v0.1.18 (tag object 04dc5bd, commit f1d8a75) on origin"
+  - "sm-journal-plugin main 9d5bfc4 on origin, go.mod requiring summercms v0.1.18"
+  - "sm-grzybyfunkcjonalne-app master 6f4f222 on origin: journal gitlink 9d5bfc4, vue-grzybyfunkcjonalne-app gitlink 465286a, README Blog Editor note, report-only CSP frame-src https://www.youtube-nocookie.com"
+  - "UAT (uat.grzybyfunkcjonalne.pl) running the Blog Editor release, with rollback copies of the previous binary and Nuxt output"
+affects: [16.2-06, sm-journal-plugin, sm-grzybyfunkcjonalne-app, uat]
+
+actuals:
+  tokens: 9000
+  tasks: 3
+  commits: 0
+plan_head_before: f1d8a757fd5c1174f7f1959779602e2ad11b0de2
+plan_head_after: f1d8a757fd5c1174f7f1959779602e2ad11b0de2
+commits_note: "summercms.go got the tag only (no commit). Code commits live in the sibling repositories below."
+plugin_commits_repo: ../sm-journal-plugin
+plugin_head_before: c60abc6
+plugin_head_after: 9d5bfc4a3597be8ba4abee26d80dc2b81d343da8
+plugin_commits: 1
+host_commits_repo: ../sm-grzybyfunkcjonalne-app
+host_head_before: 0b93ac2
+host_head_after: 6f4f22296b6295e2750e3d376bd0300c8031ba51
+host_commits: 1
+
+tech-stack:
+  added: []
+  patterns:
+    - "Restart-anchored log check: the Go log is filtered from the River client_id line the restart logged, read straight from /var/log/supervisor, instead of `supervisorctl tail` (which fails on UAT)"
+
+key-files:
+  created: []
+  modified:
+    - ../sm-journal-plugin/go.mod
+    - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+    - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
+    - ../sm-grzybyfunkcjonalne-app/README.md
+    - ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf
+    - ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh
+    - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
+
+key-decisions:
+  - "Human chose release-now at the Task 1 gate with the reply \"release v0.1.18\"; summercms v0.1.18 is published and a later defect gets v0.1.19"
+  - "On UAT the Nuxt rollback copy lives at /srv/grzybyfunkcjonalne/nuxt/.output.prev, not go/build/nuxt/.output.prev as the plan assumed"
+  - "The site-ok log check reads /var/log/supervisor/grzybyfunkcjonalne-go.log from the restart's River client_id anchor; `sudo supervisorctl tail` fails on UAT (ExpatError) and would pass vacuously"
+
+patterns-established:
+  - "A UAT release check that reads a log must prove it read lines (anchor present) before counting zero errors"
+
+requirements-completed: [D-02, D-05, D-10, D-17, D-18]
+
+coverage:
+  - id: R1
+    description: "Release: tag v0.1.18, plugin and host bumps pushed; UAT binary sha256 equals the local build; both programs RUNNING; rollback copies kept; on-server smoke passes"
+    requirement: "D-07"
+    verification:
+      - kind: integration
+        ref: "Task 2 verify: smoke: ok (98 urls); deploy-ok (with the corrected Nuxt rollback path)"
+        status: pass
+    human_judgment: false
+  - id: R2
+    description: "D-03: an untouched admin save of post 64 (markdown with the raw author footer) leaves md5(content), md5(content_html) and its en translation row unchanged"
+    requirement: "D-03"
+    verification:
+      - kind: integration
+        ref: "Task 3 verify: posts-unchanged and translations-unchanged; post 64 updated_at moved to 2026-10-10 11:26:13+00, so the save reached the database"
+        status: pass
+    human_judgment: false
+  - id: R3
+    description: "D-03: an untouched admin save of HTML_POST (post 1) leaves its bytes unchanged"
+    requirement: "D-03"
+    verification:
+      - kind: integration
+        ref: "posts-unchanged passed for post 1, but post 1 updated_at is still 2026-10-09 17:33:51+00 and no post other than 64 and 105 was written after RESTART_TS, so no save of post 1 reached the database and the pass is vacuous"
+        status: inconclusive
+    human_judgment: true
+    rationale: "A human must save post 1 untouched again; then re-run the posts-unchanged SELECT and confirm post 1's updated_at moved"
+  - id: R4
+    description: "D-02, D-05, D-18: the Blog Editor test post stores content = content_html with a YouTube placeholder, a figcaption and an uploaded image URL under journal/posts"
+    requirement: "D-18"
+    verification:
+      - kind: integration
+        ref: "Task 3 verify: edit-ok (1:1:1:1:1)"
+        status: pass
+    human_judgment: false
+  - id: R5
+    description: "D-10 amended: a style element and an onclick attribute added in the source tab are stripped on save and reported"
+    requirement: "D-10"
+    verification:
+      - kind: integration
+        ref: "edit-ok fifth column 1 (no <style, no onclick stored)"
+        status: pass
+      - kind: manual
+        ref: "Human reply \"Did tests, all points passed, bravo.\" covers the step 3 notice; the notice text was not quoted"
+        status: pass
+    human_judgment: true
+  - id: R6
+    description: "D-17: the published test post's public page contains a youtube-nocookie iframe; the Go log since the restart has no panic or SQLSTATE line"
+    requirement: "D-17"
+    verification:
+      - kind: integration
+        ref: "Task 3 verify: site-ok (1 iframe; 14 log lines after the anchor, 0 panic|SQLSTATE)"
+        status: pass
+    human_judgment: false
+  - id: R7
+    description: "D-19: a one-word category edit saves without a removal notice and shows on the site"
+    requirement: "D-19"
+    verification: []
+    human_judgment: true
+    rationale: "Not among the four steps the human ran; no journal category row was updated after RESTART_TS, so no read-only check covers it"
+
+duration: "about 25 min of executor time across three runs, plus the human UAT session (11:26 to 11:30Z)"
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 05: Release and UAT Acceptance of the Blog Editor Summary
+
+**summercms v0.1.18, sm-journal-plugin 9d5bfc4 and host 6f4f222 are released to UAT. The build there matches the local sha256, and the on-server smoke passes on 98 URLs. On real data, an untouched save of post 64 is byte-identical. A Blog Editor test post stores identical content and content_html with an uploaded figure and a YouTube embed, the embed renders as a youtube-nocookie iframe on the site, and markup that was not allowed was stripped on save. The untouched save of HTML post 1 has no database evidence yet, and the D-19 category check is still open.**
+
+## Performance
+
+- **Duration:** about 25 min of executor time across three runs, plus the human session.
+- **Started:** about 2026-10-10T11:10Z, after plan 04 closed.
+- **Completed:** 2026-10-10T11:36Z
+- **Tasks:** 3/3 (Task 1 blocking-human decision, Task 2 tracer, Task 3 blocking-human human-action)
+- **Files modified:** 7 across sm-journal-plugin and sm-grzybyfunkcjonalne-app. summercms.go got only the tag.
+
+## Release Sheet (Task 1)
+
+- **Gate:** the Task 1 verify printed `release-gate-ok`. It covered vet in both Go repositories, the six-test cabana smoke set, the journal classes and controllers tests, TestDocsTree, the admin vitest suite, the admin dist and OpenAPI drift gates, the journal vitest suite and the journal dist gate. All three repositories were clean and not behind origin.
+- **Tag:** `v0.1.18`. v0.1.17 was the latest tag, and v0.1.18 did not exist on origin.
+- **Commits pushed per repository:**
+  - summercms.go master `c21fe36..f1d8a75` (19 commits, including planning docs).
+  - sm-journal-plugin main `c60abc6..9d5bfc4` (9 commits: plans 02 and 03, plus the go.mod bump).
+  - Host master `0b93ac2..6f4f222`.
+- **UAT D-07 split (read-only SELECT):** 102 posts whose content starts with `<` and are served as content, and 3 markdown posts served as content_html. Re-read after Task 3, so the count includes test post 105. Before the test post it was 101:3.
+- **Suites not run here (Docker host needed):**
+  - The modules/cabana testcontainers suites.
+  - The sm-journal-plugin root harness: TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML and TestCategoriesAdminContent.
+  - ./models.
+  - These are WINDOWS.md entries 14 to 16, which go to plan 06.
+- **Review findings:** neither 16.2-REVIEW.md nor 16.2-SECURITY.md exists, so there are no open high findings.
+- **Human reply, verbatim:** "release v0.1.18" (release-now).
+
+## Task Commits
+
+| Task | Name | Repo | Commit |
+|---|---|---|---|
+| 1 | Release gate | (none) | release-gate-ok, no commit |
+| 2 | Tag summercms | summercms.go | annotated tag `v0.1.18` (object `04dc5bdabecd95a58b5b7d3a02ed465a45fbc99a`, commit `f1d8a757fd5c1174f7f1959779602e2ad11b0de2`) |
+| 2 | Require summercms v0.1.18 | sm-journal-plugin | `9d5bfc4` chore(deps): require summercms v0.1.18 |
+| 2 | Bump gitlinks, README note, CSP frame-src | sm-grzybyfunkcjonalne-app | `6f4f222` chore: bump journal plugin (Blog Editor) and the site app (embeds) |
+| 3 | UAT acceptance (read-only checks) | (none) | no commit |
+
+**Pushed heads:**
+- summercms.go master `f1d8a75`, plus tag `v0.1.18`.
+- sm-journal-plugin main `9d5bfc4a3597be8ba4abee26d80dc2b81d343da8`.
+- sm-grzybyfunkcjonalne-app master `6f4f22296b6295e2750e3d376bd0300c8031ba51`, with journal gitlink `9d5bfc4a…` and vue-grzybyfunkcjonalne-app gitlink `465286a880f0aae6118c2915aa1475a5da353295` (was `ada03b2`; it pins vue-journal-layer v0.2.0).
+
+## Deploy (Task 2)
+
+- **Build sha256:** local `01c0b64a53a3b95f6481be21408cfa7450828414516e6868c3801e937680edc4`. The remote copy matched, first as `bin/grzybyfunkcjonalne.new` and again after the move.
+- **Previous binary:** `bin/grzybyfunkcjonalne.prev`, sha256 `e5b0ad28ca0384993470ac5a3177d502b7bd0b67c553488f86b43ae3363af232`.
+- **Nuxt rollback copy:** `/srv/grzybyfunkcjonalne/nuxt/.output.prev`.
+- **Migrations:** `migrate` printed `✓ migrations applied`, rc 0.
+- **RESTART_TS:** `2026/10/10 11:17:46` (server time, UTC). Log anchor: `client_id=alexandria_2026_10_10T11_17_46_316300`.
+- **Smoke:** `smoke: ok (98 urls)`, then `deploy-ok`.
+
+**Snapshot taken before the human saves (read-only):**
+- `HTML_POST=1` (10-faktow-na-temat-cordycepsu).
+- `SNAPSHOT_POSTS`:
+  ```
+  1:a026264105f900175b9770e637e5ec5c:a026264105f900175b9770e637e5ec5c
+  64:0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c
+  ```
+- `SNAPSHOT_TRANSLATIONS`: `64:en:862fc5b362cc9856e6736a2078dca3ba`. Post 1 has no translation rows.
+- `POST64_STATE=1:1`. The plan expected `x:0`. Post 64's content and content_html both still contain a `<style` element: one `.author-footer` CSS block, at offset 4584 in content and 5035 in content_html. The style block was not removed from content_html on UAT as the plan assumed. This is reported, not a failure. The untouched re-save kept it byte-for-byte, and a re-read after Task 3 still prints `1:1`.
+
+## UAT Acceptance (Task 3)
+
+**Human reply, verbatim:** "Did tests, all points passed, bravo."
+
+The human confirmed that all four steps passed, including the step 3 strip notice, but did not quote the notice text.
+
+**Read-only checks, run after the reply:**
+
+| Check | Result | Detail |
+|---|---|---|
+| posts-unchanged | pass | The md5 rows of posts 1 and 64 match the snapshot exactly |
+| translations-unchanged | pass | `64:en:862fc5b3…` matches; there are still no rows for post 1 |
+| edit-ok | pass | Test post `uat-16-2-blog-editor` (id 105) prints `1:1:1:1:1`: content = content_html, a `data-embed="youtube"` placeholder, a figcaption, an image under `/storage/app/uploads/public/journal/posts/`, and neither `<style` nor `onclick` |
+| site-ok | pass | The public page `/blog/uat-16-2-blog-editor`, fetched on the server, has 1 `src="https://www.youtube-nocookie.com/embed/` iframe. The Go log has 14 lines after the restart anchor, with 0 panic and 0 SQLSTATE |
+
+**Which rows the saves wrote:** only post 64 (11:26:13Z) and post 105 (11:29:56Z) have `updated_at` after RESTART_TS. Post 105 is published. Post 1 still has `updated_at` 2026-10-09 17:33:51Z. The admin save runs GORM `Save`, which always sets `updated_at`, so no save of post 1 reached the database. Either it was not saved, or a different post was opened. The posts-unchanged pass for post 1 is therefore vacuous, and D-03 is proven on post 64 only (see Open Items).
+
+## Files Created/Modified
+
+- `../sm-journal-plugin/go.mod`: nominal require of summercms v0.1.18. The go.work replace stays.
+- `../sm-grzybyfunkcjonalne-app/plugins/golem15/journal` and `vue-grzybyfunkcjonalne-app`: gitlink bumps.
+- `../sm-grzybyfunkcjonalne-app/README.md`: an Admin note on the Blog Editor, lossless untouched saves, and stripped markup being reported.
+- `../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf`, `scripts/check-deploy.sh` and `DEPLOY.md`: `frame-src https://www.youtube-nocookie.com` in the report-only CSP, its check needle and its docs line.
+
+## Decisions Made
+
+- Release now with v0.1.18 (human, Task 1).
+- The real Nuxt rollback path is `nuxt/.output.prev`.
+- The site-ok log check reads the supervisor log file from the restart anchor.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] The plan's Nuxt rollback path was wrong**
+- **Found during:** Task 2
+- **Issue:** The plan copies, checks and restores `go/build/nuxt/.output(.prev)`. On UAT the Nuxt server runs from `/srv/grzybyfunkcjonalne/nuxt/.output`.
+- **Fix:** The rollback copy was made at `/srv/grzybyfunkcjonalne/nuxt/.output.prev`, and the deploy-ok check tested that path.
+- **Files modified:** none (server layout only)
+- **Commit:** none
+
+**2. [Rule 1 - Bug] The site-ok log check passed vacuously**
+- **Found during:** Task 2 (log check), applied in Task 3
+- **Issue:** `sudo supervisorctl tail -65536 grzybyfunkcjonalne-go` fails on UAT with an ExpatError. The pipeline then counted 0 matching lines, so the check would pass whatever the log contained.
+- **Fix:** Read `/var/log/supervisor/grzybyfunkcjonalne-go.log` directly. The command first requires the restart's River anchor (`client_id=alexandria_2026_10_10T11_17_46_316300`) to be present, then counts panic|SQLSTATE only in the lines after it:
+  `ssh grzybyfunkcjonalne-uat 'F=/var/log/supervisor/grzybyfunkcjonalne-go.log; A=client_id=alexandria_2026_10_10T11_17_46_316300; grep -q "$A" "$F" && awk -v a="$A" "found{print} index(\$0,a){found=1}" "$F" | grep -ciE "panic|SQLSTATE"' | grep -qx 0`
+  The anchor was still in the file (14 lines after it), so the timestamp fallback was not needed. The file holds 6 older SQLSTATE lines, all from before the restart.
+- **Files modified:** none
+- **Commit:** none
+
+---
+
+**Total deviations:** 2, both Rule 1 bugs in the plan's server commands. No shipped code changed.
+**Impact on plan:** Both fixes make the checks stricter. They do not loosen them.
+
+## Open Items (pending human)
+
+1. **D-03 on an HTML post is unproven.** Save post 1 (`10-faktow-na-temat-cordycepsu`) in `/gfadmin/golem15/journal/posts` without touching the editor. Then re-run the posts-unchanged SELECT and confirm that post 1's `updated_at` moved past 2026-10-10 11:17:46Z.
+2. **D-19 category check:** in a category with content, change one word in the Blog Editor and save. No removal notice should appear, and the category page on the site should show the change. Also open post 1's source tab and confirm the stored HTML is unchanged. Not human-verified yet; pending for /msd-verify-work.
+3. **Vhost install (root):** install `/srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf` (frame-src https://www.youtube-nocookie.com), then `sudo nginx -t && sudo systemctl reload nginx`. This blocks nothing, because the CSP is report-only.
+4. **Test post `uat-16-2-blog-editor` (id 105) is still published.** Unpublish or delete it when it is no longer needed. The human may keep it for now.
+5. **Docker-host suites:** these go to plan 06 (WINDOWS.md entries 14 to 16).
+
+**Rollback, if any open item fails** (on the server, in `/srv/grzybyfunkcjonalne`):
+- Move `go/bin/grzybyfunkcjonalne.prev` back to `go/bin/grzybyfunkcjonalne`.
+- Move `nuxt/.output.prev` back to `nuxt/.output`.
+- Run `sudo supervisorctl restart grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt`.
+
+## Auth Gates
+
+None. The executor never asked for, printed or stored a credential. All admin actions were done by the human. On UAT the executor ran only SELECT queries and on-server curl, apart from the Task 2 deploy steps the human approved at the Task 1 gate.
+
+## User Setup Required
+
+See Open Items 1 to 4.
+
+## Next Phase Readiness
+
+- Plan 06 (unit tests) can run. Its tests ship with the next summercms tag, v0.1.19.
+- /msd-verify-work should pick up Open Items 1 and 2.
+
+---
+*Phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget*
+*Completed: 2026-10-10*
+
+## Self-Check: PASSED
+
+- FOUND on origin: tag `v0.1.18` (object `04dc5bd`).
+- FOUND: sm-journal-plugin `9d5bfc4`, equal to origin/main. go.mod requires summercms v0.1.18, and the replace stays.
+- FOUND: host `6f4f222`, equal to origin/master. The gitlinks are journal `9d5bfc4` and vue-grzybyfunkcjonalne-app `465286a`.
+- FOUND: the `frame-src https://www.youtube-nocookie.com` needle in both the staging vhost and check-deploy.sh (1 each).
+- Task 3 checks: posts-unchanged, translations-unchanged, edit-ok and site-ok were all printed in this run.
+
+## Post 1 untouched re-save (closes WINDOWS entry 17)
+
+After the human re-saved post 1 (`10-faktow-na-temat-cordycepsu`) untouched, the orchestrator ran a read-only SELECT on UAT:
+
+- Post 1: `updated_at` is 2026-10-10 12:02:40.245712+00, after RESTART_TS, so the save reached the database. The md5 of `content` and of `content_html` are both still `a026264105f900175b9770e637e5ec5c`, equal to the snapshot.
+- Post 64 is unchanged: `0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c`.
+
+D-03 is now proven on UAT for an HTML post (post 1) and for a markdown post (post 64).
+
+## Follow-up deploy (preview pane and View site)
+
+On 2026-10-10, everything committed was released to UAT: the Blog Editor live preview pane and the admin "View site" link.
+
+- **Pushed refs:**
+  - sm-journal-plugin `2c78211`, equal to origin/main.
+  - Host `0ad1004`, equal to origin/master. Its journal gitlink is `2c78211`.
+  - summercms.go master `b5c70b7` before this record. It includes `85fe541` (View site) and was pushed to origin as `f1d8a75..b5c70b7`.
+- **Binary sha256:**
+  - New: `c68a2099ec6a67d4cbf74086f501b2af2bb4b54f3e7f94fddc04e459d2ab486f`. The local build, the uploaded `.new` and the installed binary all match.
+  - Rollback copy `go/bin/grzybyfunkcjonalne.prev`: `01c0b64a53a3b95f6481be21408cfa7450828414516e6868c3801e937680edc4` (the v0.1.18 deploy from 11:16).
+- **Nuxt rollback:** `nuxt/.output.prev` now holds the v0.1.18 output. The old `.prev` was removed before the copy, so `cp -a` replaced it and did not nest into it.
+- **Release steps:**
+  - `scripts/check-deploy.sh`: ok.
+  - `migrate`: exit 0 ("migrations applied").
+  - Restart of both programs at 2026-10-10T12:37:43Z.
+- **Smoke:** `smoke: ok (98 urls)`.
+- **Go log:** checked after the anchor `River client started client_id=alexandria_2026_10_10T12_37_43_865055`. It has 0 panic or SQLSTATE lines and 0 `level=ERROR` lines.
+- **Feature checks:**
+  - The deployed binary contains `blogeditor__preview` and `previewFrame`, from the journal `assets/dist/blogeditor.js`.
+  - The admin bundle served at `/gfadmin/assets/index-Bqh6wnN4.js` contains `data-view-site`.
+- **Tag:** none was cut. v0.1.19 is still pending, after the unit-test plan (06). The plugin go.mod still requires summercms v0.1.18 with the local replace, and the host builds against the summercms.go working tree through go.work.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md

@@ -9,6 +9,7 @@ files_modified:
   - modules/cabana/field_type_test.go
   - modules/cabana/field_type_postgres_test.go
   - admin/tests/form/PluginField.test.ts
+  - admin/tests/form/FormField.test.ts
   - admin/tests/form/registry.test.ts
   - admin/tests/form/formState.test.ts
   - admin/tests/app/fieldTypes.test.ts
@@ -16,6 +17,7 @@ files_modified:
   - scripts/check-phase16.2.sh
   - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md
   - ../sm-journal-plugin/classes/blog_editor_test.go
+  - ../sm-journal-plugin/classes/editor_policy_test.go
   - ../sm-journal-plugin/classes/media_store_test.go
   - ../sm-journal-plugin/controllers/posts_editor_test.go
   - ../sm-journal-plugin/posts_admin_smoke_test.go
@@ -25,22 +27,25 @@ files_modified:
   - ../sm-journal-plugin/tests/blogeditor/serializer.test.ts
   - ../sm-journal-plugin/tests/blogeditor/embed.test.ts
   - ../vue-journal-layer/tests/embeds.test.ts
+  - ../vue-journal-layer/tests/htmlGate.test.ts
 autonomous: true
-requirements: [D-03, D-05, D-07, D-10, D-11, D-12, D-13, D-14, D-17, D-18, D-19]
+requirements: [D-02, D-03, D-05, D-07, D-10, D-11, D-12, D-13, D-14, D-17, D-18, D-19]
 estimate:
-  tokens: 115000
-  raw_tokens: 115000
+  tokens: 125000
+  raw_tokens: 125000
   tasks: 3
   confidence: low
 must_haves:
   truths:
     - "CLAUDE.md lean rule 3: every piece of Phase 16.2 code has unit tests in this last plan: the pact types, the cabana registry, compile, decode, skip, load, list, writes accessor, field-types and upload routes, the SPA PluginField, MLPluginField, loader and registry helpers, the Journal field types, media storage and hooks, the editor element, schema, serializer and embed parsing, and the layer's expandEmbeds."
-    - "Todo journal-imported-html-admin-resave and D-03 at every layer: the element returns an untouched value unchanged, PluginField does not re-set an echoed value, cabana writes nothing for a value equal to the served one, Journal Load serves content for HTML and content_html for markdown, and the Postgres test TestPostsAdminResaveKeepsHTML asserts exact bytes for an untouched HTML post and an untouched markdown post, and equal content and content_html per locale after an edit."
+    - "Todo journal-imported-html-admin-resave and D-03 at every layer: the element returns an untouched value unchanged, PluginField does not re-set an echoed value, cabana writes nothing and reports nothing for a value equal to the served one, Journal Load serves content for HTML and content_html for markdown, and the Postgres test TestPostsAdminResaveKeepsHTML asserts exact bytes for an untouched HTML post and an untouched markdown post with no meta.notices, and equal content and content_html per locale after an edit."
     - "D-11 and D-12: every boot rule (alias pattern, core-type clash, cross-plugin clash, element prefix, missing Decode, option-key pattern and clash, missing AdminFS, asset path and extension) has a failing case; CompileForm stays core-only and settings and relation forms refuse plugin types."
-    - "D-10 and D-14: a FormFieldError on the default or a non-default locale is a 422 on the field with no write; a non-FormFieldError and a non-string translatable Decode are opaque 500s."
+    - "D-10 and D-14 (framework): a FormFieldError on the default or a non-default locale is a 422 on the field with no write and no notices; a non-FormFieldError and a non-string translatable Decode value are opaque 500s; FormFieldDecoded notices become meta.notices entries with field and locale, localized (plural forms through Count), at most 10 per field and locale and 500 runes each; a save without notices has no notices key; the SPA renders notices as text under the field and in the saved toast."
+    - "D-10 and D-02 (Journal, amended): SanitizeHTMLReport returns the input byte for byte with an empty report exactly when the policy keeps everything (property checked over the 35 unsafe payloads, the imported-post fixture and the editor corpus); post and category admin saves strip and report, never answer 422 for markup, and store equal sanitized HTML in content and content_html per locale; an untouched save writes and reports nothing."
+    - "D-05 (amended): every editor-corpus entry passes the Go policy byte for byte and is safe under the layer's sanitizer, the two corpus copies are identical, and the four editor-output rules admit nothing else (other providers, malformed ids, data attributes elsewhere, iframes stay stripped in both policies)."
     - "D-18: the upload route answers 201, 403, 404 (core field, no Upload, out-of-scope record), 413 and 422, and the Journal upload refuses a disguised file and an svg."
-    - "D-17 and D-05: expandEmbeds expands only exact allowlisted placeholders and runs after the gate; parseEmbedUrl accepts only the four YouTube URL forms."
-    - "Postgres-backed tests (cabana TestFieldTypeSavePostgres, the sm-journal-plugin admin harness tests) exist, compile under go vet and fail rather than skip without a database; they run on a Docker host before /msd-verify-work."
+    - "D-17 and D-05: expandEmbeds expands only exact allowlisted placeholders and runs last, after sanitizeJournalHtml at each sink; a stored iframe never reaches the output; parseEmbedUrl accepts only the four YouTube URL forms."
+    - "Postgres-backed tests (cabana TestFieldTypeSavePostgres, the sm-journal-plugin admin harness tests including TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent and TestCategoriesAdminBlogEditor) exist, compile under go vet and fail rather than skip without a database; they run on a Docker host before /msd-verify-work."
     - "scripts/check-phase16.2.sh runs every runnable suite fail-closed and ends with 'Phase 16.2 gate passed'; 16.2-VALIDATION.md has its per-task map filled and nyquist_compliant true."
   artifacts:
     - path: "modules/cabana/field_type_test.go"
@@ -68,7 +73,7 @@ must_haves:
     - statement: "No test touches the UAT server, the network or a shared database: pure tests use stubs, DryRun handles or memblob; Postgres tests use throwaway testcontainers databases."
       status: unresolved
       verification: judgment
-    - statement: "Tests are not weakened to pass: existing assertions (FormatHTML refuse cases, widget, ML, list-state and SSR expectations) stay."
+    - statement: "Tests are not weakened to pass: every existing assertion that still describes the shipped behaviour stays (FormatHTML strip and byte-stability cases, the 35 unsafe payloads, the duplicate-attribute rule, CheckHTML as a predicate, upload sniffing, alias collision, upload permission, sanitize-then-expand order, widget, ML, list-state and SSR expectations); only the two category 422 assertions retired by amended D-10 became strip-and-report assertions (plan 03), and nothing else is relaxed."
       status: unresolved
       verification: judgment
 ---
@@ -79,16 +84,20 @@ ROADMAP Goal (not in user-story format): plugins can register their own admin fo
 
 This plan's slice (CLAUDE.md lean rule 3, user decision 1, plan 06): full unit coverage of the phase's code across summercms.go, sm-journal-plugin and vue-journal-layer, the Postgres tests for a Docker host, and the phase gate. This plan changes tests, the gate script and VALIDATION.md only, so no dist or bundle changes.
 
+## Revision 2026-10-10 (16.1 drift, CONTEXT D-10 amended)
+
+Admin saves now strip and report instead of refusing, so the refusal-case assertions planned here became strip-and-report assertions: a FormFieldError still answers 422, but markup never does. The plan adds the policy cross-check (the editor corpus against both policies, and the identity of the two copies), category strip coverage, "notices only when something was stripped" and "an untouched save writes and reports nothing". The tests that still hold are unchanged in intent: upload sniffing, alias collision, permission, sanitize-then-expand order, byte-stability, the duplicate-attribute rule.
+
 ## Spec-less probe fallback
 
 Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
 
 ## Artifacts this phase produces (this plan)
 
-- Go tests: `TestFormFieldErrorMessage` (pact); `TestFieldTypeRegistry`, `TestFieldTypeOptions`, `TestFieldTypeCompile`, `TestFieldTypeDecode`, `TestFieldTypeUntouched`, `TestFieldTypeLoad`, `TestFieldTypeListValue`, `TestFieldTypeWrites`, `TestFieldTypesRoute`, `TestFieldUpload` (cabana); `TestFieldTypeSavePostgres` (cabana, Docker); `TestBlogEditorDecode`, `TestBlogEditorLoad`, `TestLooksLikeHTML`, `TestBlogEditorOptions`, `TestBlogEditorListValue`, `TestBlogEditorUpload`, `TestStoreMedia` (Journal classes); `TestPostsEditorHooks` (Journal controllers); `TestCategoriesAdminBlogEditor` and the extended `TestPostsAdminResaveKeepsHTML` (Journal root, Docker).
-- Vitest files: `admin/tests/app/fieldTypes.test.ts`; extended `PluginField.test.ts`, `registry.test.ts`, `formState.test.ts`, `ListView.test.ts`; `../sm-journal-plugin/tests/blogeditor/{element,schema,serializer,embed}.test.ts`.
-- Layer: extended `tests/embeds.test.ts`.
-- `scripts/check-phase16.2.sh` (stages `go`, `admin`, `editor`, `layer`, `docs`, `postgres`; flags `--all`, `--self-test`).
+- Go tests: `TestFormFieldErrorMessage` (pact); `TestFieldTypeRegistry`, `TestFieldTypeOptions`, `TestFieldTypeCompile`, `TestFieldTypeDecode`, `TestFieldTypeNotices`, `TestFieldTypeUntouched`, `TestFieldTypeLoad`, `TestFieldTypeListValue`, `TestFieldTypeWrites`, `TestFieldTypesRoute`, `TestFieldUpload` (cabana); `TestFieldTypeSavePostgres` (cabana, Docker); `TestBlogEditorDecode`, `TestBlogEditorNotices`, `TestBlogEditorLoad`, `TestLooksLikeHTML`, `TestBlogEditorOptions`, `TestBlogEditorListValue`, `TestBlogEditorUpload`, `TestStoreMedia` and the extended `TestEditorOutputPassesPolicy` and `TestSanitizeHTMLReport` (Journal classes); `TestPostsEditorHooks` (Journal controllers); `TestCategoriesAdminBlogEditor` and the extended `TestPostsAdminResaveKeepsHTML` (Journal root, Docker).
+- Vitest files: `admin/tests/app/fieldTypes.test.ts`; extended `PluginField.test.ts`, `FormField.test.ts`, `registry.test.ts`, `formState.test.ts`, `ListView.test.ts`; `../sm-journal-plugin/tests/blogeditor/{element,schema,serializer,embed}.test.ts`.
+- Layer: extended `tests/embeds.test.ts` and `tests/htmlGate.test.ts`.
+- `scripts/check-phase16.2.sh` (stages `go`, `admin`, `editor`, `layer`, `docs`, `postgres`; the layer stage also compares the two editor-corpus copies; flags `--all`, `--self-test`).
 
 <objective>
 Bring full unit coverage to Phase 16.2 (lean rule 3), add the Postgres tests for a Docker host, write the phase gate and complete the validation map.
@@ -126,11 +135,11 @@ Element (element.test.ts, happy-dom): for the imported-post fixture and for a ma
 
 SPA (PluginField.test.ts): a stub element that re-emits its current value on connect; the form value stays identical and PluginField never writes the property a second time for an equal value.
 
-cabana (field_type_test.go, TestFieldTypeUntouched): with a translatable stub type and a recording writer, an update whose submitted pl and en values equal servedFieldValue writes nothing (no projected key, no WriteTranslated call, no FieldWrite); one changed locale writes only that locale; canonical comparison treats equal JSON objects with different key order as equal and a string "1" and number 1 as different; a create never skips.
+cabana (field_type_test.go, TestFieldTypeUntouched): with a translatable stub type (whose Decode always returns a notice) and a recording writer, an update whose submitted pl and en values equal servedFieldValue writes nothing and reports nothing (no projected key, no WriteTranslated call, no FieldWrite, no notice); one changed locale writes and reports only that locale; canonical comparison treats equal JSON objects with different key order as equal and a string "1" and number 1 as different; a create never skips.
 
 Journal (blog_editor_test.go, TestBlogEditorLoad): HTML content is served verbatim (including leading whitespace and a leading HTML comment), markdown content is served as the Translated content_html, an empty content_html falls back to FormatHTML, nil and empty pointers give "".
 
-Postgres (posts_admin_smoke_test.go, Docker host): TestPostsAdminResaveKeepsHTML creates an HTML post and a markdown post through the admin API, reads the served form values with GET, PUTs them back unchanged and asserts content and content_html are byte-identical for both (the markdown post keeps markdown content), that no en translation row was added for an untouched empty en, then PUTs an edited pl and en value and asserts content equals content_html for pl and that the en content_html translation equals the en content.
+Postgres (posts_admin_smoke_test.go, Docker host): TestPostsAdminResaveKeepsHTML creates an HTML post and a markdown post through the admin API, reads the served form values with GET, PUTs them back unchanged and asserts content and content_html are byte-identical for both (the markdown post keeps markdown content), that no en translation row was added for an untouched empty en and that the PUT response has no meta.notices key, then PUTs an edited pl and en value of clean HTML and asserts content equals content_html for pl, that the en content_html translation equals the en content, and that no notices are reported.
 
 Commit per repository as test(...) commits, staged by explicit path.</action>
   <verify>
@@ -139,7 +148,7 @@ Commit per repository as test(...) commits, staged by explicit path.</action>
   </verify>
   <acceptance_criteria>
     - `grep -n "func TestFieldTypeUntouched" modules/cabana/field_type_test.go` and `grep -n "func TestBlogEditorLoad" ../sm-journal-plugin/classes/blog_editor_test.go` each print one line.
-    - TestPostsAdminResaveKeepsHTML compares bytes without TrimSpace and covers an HTML post, a markdown post and an edited save (read the test: three stages).
+    - TestPostsAdminResaveKeepsHTML compares bytes without TrimSpace and covers an HTML post, a markdown post and an edited save, and asserts no meta.notices on the untouched and clean saves (read the test: three stages).
     - The four runnable checks pass; the Postgres test compiles (go vet).
   </acceptance_criteria>
   <done>The untouched-resave contract is pinned at the element, SPA, cabana and Journal layers here, and on Postgres for the Docker host.</done>
@@ -147,28 +156,30 @@ Commit per repository as test(...) commits, staged by explicit path.</action>
 
 <task type="auto" tdd="true">
   <name>Task 2: Full Go coverage: pact, cabana field types and routes, Journal field types, media storage and hooks; Postgres tests</name>
-  <files>modules/pact/field_type_test.go, modules/cabana/field_type_test.go, modules/cabana/field_type_postgres_test.go, ../sm-journal-plugin/classes/blog_editor_test.go, ../sm-journal-plugin/classes/media_store_test.go, ../sm-journal-plugin/controllers/posts_editor_test.go, ../sm-journal-plugin/categories_admin_editor_test.go</files>
-  <read_first>modules/pact/capabilities.go, modules/cabana/field_type.go, modules/cabana/field_type_upload.go, modules/cabana/tx_context.go, modules/cabana/field_ml.go, modules/cabana/list_schema.go, modules/cabana/field_type_smoke_test.go, modules/cabana/query_test.go (Postgres container fixture), modules/cabana/crud_lifecycle_test.go (hookFixture, principalCtx, crudCall), ../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/classes/media_store.go, ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/admin_harness_test.go, ../sm-journal-plugin/controllers/categories.go</read_first>
+  <files>modules/pact/field_type_test.go, modules/cabana/field_type_test.go, modules/cabana/field_type_postgres_test.go, ../sm-journal-plugin/classes/blog_editor_test.go, ../sm-journal-plugin/classes/editor_policy_test.go, ../sm-journal-plugin/classes/media_store_test.go, ../sm-journal-plugin/controllers/posts_editor_test.go, ../sm-journal-plugin/categories_admin_editor_test.go</files>
+  <read_first>modules/pact/capabilities.go, modules/cabana/relation_field.go (RecordMeta.Notices, FieldNotice), modules/cabana/field_type.go, modules/cabana/field_type_upload.go, modules/cabana/tx_context.go, modules/cabana/field_ml.go, modules/cabana/list_schema.go, modules/cabana/field_type_smoke_test.go, modules/cabana/query_test.go (Postgres container fixture), modules/cabana/crud_lifecycle_test.go (hookFixture, principalCtx, crudCall), ../sm-journal-plugin/classes/blog_editor.go, ../sm-journal-plugin/classes/format_html.go (SanitizeHTMLReport, newHTMLPolicy), ../sm-journal-plugin/classes/editor_policy_test.go (plan 03), ../sm-journal-plugin/classes/format_html_test.go (unsafePayloads), ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/lang/pl/lang.yaml, ../sm-journal-plugin/classes/media_store.go, ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/posts_editor_smoke_test.go, ../sm-journal-plugin/admin_harness_test.go, ../sm-journal-plugin/controllers/categories.go, ../sm-journal-plugin/journal_api_categories_test.go</read_first>
   <behavior>
     - pact: FormFieldError.Error joins messages with "; "; a nil pointer does not panic.
     - Registry: bad alias pattern, core clash, cross-plugin clash naming both IDs, wrong element prefix, reserved or invalid tag, nil Decode, bad and core-clashing and repeated option keys, assets without AdminFS, bad asset path and extension each fail boot with the documented message; valid types register their assets with ?v= hashes.
     - Compile: general keys accepted, core type-specific keys refused, option values of every YAML kind decoded, CheckOptions error surfaced, CompileForm refuses a plugin alias, CompileFormWithTypes accepts it, settings and relation forms refuse plugin types.
-    - Decode/Load: default and non-default FormFieldError become a 422 on the field with no write; other errors and a non-string translatable Decode are opaque 500 without the plugin text; nil Load keeps the stored value; Load errors are opaque 500.
+    - Decode/Load: default and non-default FormFieldError become a 422 on the field with no write and no notices; other errors and a non-string translatable Decode value are opaque 500 without the plugin text; nil Load keeps the stored value; Load errors are opaque 500.
+    - Notices: a Decode notice becomes one FieldNotice with field and locale (none for a non-translatable type); Count selects the plural form and Params fill placeholders through a real phrasebook translator; text that is not a phrase key passes through; more than 10 notices per field and locale are cut to 10 and a message over 500 runes is cut with an ellipsis; the encoded RecordMeta has no notices key when there are none.
     - List: ListValue applied, nil ListValue keeps raw value. Writes: copy semantics, false outside save, Before and After hooks see the same writes.
     - Routes: field-types sorted, empty list, assets URLs; upload 201, 403, 404 (core field, no Upload, unknown field, context refusal), 413, 422, missing part, id 0 Record nil.
     - Postgres (Docker host): create, update, show through the HTTP handlers with a translatable plugin type and the real column; an untouched update leaves the row unchanged; upload with id != 0 outside the FormExtendQuery scope is 404.
-    - Journal: Decode table (string, non-string, each CheckHTML pattern, placeholder passes); LooksLikeHTML table; options (htmlColumn identifier, uploadFolder rule); ListValue (tags stripped, 120-rune truncation); Upload (png, jpeg, gif and webp sniff, disguised text, svg, safe names, size, missing bucket); StoreMedia (extension, size message, key layout, unique suffix, URL); hooks (create and update, default and non-default writes, no writes, no writer); categories on Postgres: content saved through blogeditor, blank to NULL, unsafe 422.
+    - Journal: Decode table (clean string unchanged with no notice; nil gives ""; non-string FormFieldError; each of the 35 unsafePayloads stripped with at least one notice and an output equal to SanitizeHTML; the placeholder and every corpus entry unchanged with no notice); removal notices (order elements, attributes, comments, other; Count; names joined; ellipsis after 10 names; every key present in lang/en with one and other and in lang/pl with one, few, many and other); SanitizeHTMLReport property over the unsafePayloads, the imported-post fixture and the corpus (report empty exactly when the output equals the input); the corpus cross-check negatives (other provider, 10- and 12-character ids, data attributes on other elements, extra data attribute on figure, onload on the placeholder, iframe); LooksLikeHTML table; options (htmlColumn identifier, uploadFolder rule); ListValue (tags stripped, 120-rune truncation); Upload (png, jpeg, gif and webp sniff, disguised text, svg, safe names, size, missing bucket); StoreMedia (extension, size message, key layout, unique suffix, URL); hooks (create and update, default and non-default writes, no writes, no writer); categories on Postgres: content saved through blogeditor, blank to NULL, unsafe content stored stripped with a notice in meta.notices and no 422, safe content byte-identical with no notices key.
   </behavior>
-  <action>Write the Go tests listed in the behavior block (per D-10, D-11, D-12, D-14, D-18, D-19), table-driven where the cases share a shape. cabana unit tests use no database (DryRun handles, stubs, the recording writer, httptest with principalCtx-style contexts); TestFieldTypeSavePostgres reuses the existing testcontainers fixture pattern and fails, not skips, without Docker. The Journal root-package TestCategoriesAdminBlogEditor uses newPostsEnv-style harness setup for the categories controller. Do not change production code; if a test exposes a defect, fix it in a separate fix(...) commit with its own test and record it in the SUMMARY. Commit per repository as test(...) commits, staged by explicit path.</action>
+  <action>Write the Go tests listed in the behavior block (per D-02, D-05, D-10, D-11, D-12, D-14, D-18, D-19), table-driven where the cases share a shape. Extend plan 03's TestEditorOutputPassesPolicy and TestSanitizeHTMLReport in place rather than duplicating them. cabana unit tests use no database (DryRun handles, stubs, the recording writer, httptest with principalCtx-style contexts); TestFieldTypeSavePostgres reuses the existing testcontainers fixture pattern and fails, not skips, without Docker. The Journal root-package TestCategoriesAdminBlogEditor uses newPostsEnv-style harness setup for the categories controller. Do not change production code; if a test exposes a defect, fix it in a separate fix(...) commit with its own test and record it in the SUMMARY. Commit per repository as test(...) commits, staged by explicit path.</action>
   <verify>
-    <automated>go vet ./modules/pact ./modules/cabana &amp;&amp; go test -count=1 ./modules/pact &amp;&amp; go test -count=1 -run '^(TestFieldTypeRegistry|TestFieldTypeOptions|TestFieldTypeCompile|TestFieldTypeDecode|TestFieldTypeUntouched|TestFieldTypeLoad|TestFieldTypeListValue|TestFieldTypeWrites|TestFieldTypesRoute|TestFieldUpload|TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 12</automated>
-    <fails_when>Non-zero exit: vet or the pact package fails, or fewer than twelve top-level "--- PASS: Test" lines for the named cabana tests (one missing or failing).</fails_when>
-    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorDecode|TestBlogEditorLoad|TestLooksLikeHTML|TestBlogEditorOptions|TestBlogEditorListValue|TestBlogEditorUpload|TestStoreMedia)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 7</automated>
-    <fails_when>Non-zero exit: vet fails, a classes or controllers test fails, or fewer than seven "--- PASS: Test" lines for the named Journal classes tests.</fails_when>
+    <automated>go vet ./modules/pact ./modules/cabana &amp;&amp; go test -count=1 ./modules/pact &amp;&amp; go test -count=1 -run '^(TestFieldTypeRegistry|TestFieldTypeOptions|TestFieldTypeCompile|TestFieldTypeDecode|TestFieldTypeNotices|TestFieldTypeUntouched|TestFieldTypeLoad|TestFieldTypeListValue|TestFieldTypeWrites|TestFieldTypesRoute|TestFieldUpload|TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 13</automated>
+    <fails_when>Non-zero exit: vet or the pact package fails, or fewer than thirteen top-level "--- PASS: Test" lines for the named cabana tests (one missing or failing).</fails_when>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorDecode|TestBlogEditorNotices|TestBlogEditorLoad|TestLooksLikeHTML|TestBlogEditorOptions|TestBlogEditorListValue|TestBlogEditorUpload|TestStoreMedia|TestEditorOutputPassesPolicy|TestSanitizeHTMLReport)$' -v ./classes/ 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 10</automated>
+    <fails_when>Non-zero exit: vet fails, a classes or controllers test fails, or fewer than ten "--- PASS: Test" lines for the named Journal classes tests (a strip, notice, report, corpus or upload case regressed).</fails_when>
   </verify>
   <acceptance_criteria>
     - `grep -n "func TestFieldTypeSavePostgres" modules/cabana/field_type_postgres_test.go` and `grep -n "func TestCategoriesAdminBlogEditor" ../sm-journal-plugin/categories_admin_editor_test.go` each print one line, and both files pass go vet.
-    - The twelve named cabana tests and seven named Journal classes tests pass; `go -C ../sm-journal-plugin test -count=1 -run '^TestPostsEditorHooks$' ./controllers/` passes.
+    - The thirteen named cabana tests and ten named Journal classes tests pass; `go -C ../sm-journal-plugin test -count=1 -run '^TestPostsEditorHooks$' ./controllers/` passes.
+    - `git -C ../sm-journal-plugin diff --quiet c60abc6 -- classes/format_html_test.go classes/check_html_test.go classes/format_translation_test.go` exits 0 (the 16.1 policy tests are not weakened).
     - For each repository, `git diff --stat "$TASK2_START"..HEAD` (TASK2_START is that repository's head recorded in the SUMMARY before this task) lists only *_test.go files, except files of separate fix(...) commits that the SUMMARY names.
   </acceptance_criteria>
   <done>Every Go behaviour of the phase has a passing unit test here, and the database-backed paths have Postgres tests for the Docker host.</done>
@@ -176,18 +187,18 @@ Commit per repository as test(...) commits, staged by explicit path.</action>
 
 <task type="auto" tdd="true">
   <name>Task 3: Full JS coverage (admin, editor, layer), the phase gate script and the validation map</name>
-  <files>admin/tests/app/fieldTypes.test.ts, admin/tests/form/registry.test.ts, admin/tests/form/formState.test.ts, admin/tests/list/ListView.test.ts, ../sm-journal-plugin/tests/blogeditor/schema.test.ts, ../sm-journal-plugin/tests/blogeditor/serializer.test.ts, ../sm-journal-plugin/tests/blogeditor/embed.test.ts, ../vue-journal-layer/tests/embeds.test.ts, scripts/check-phase16.2.sh, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md</files>
-  <read_first>admin/src/app/fieldTypes.ts, admin/src/app/pluginAssets.ts, admin/src/components/form/registry.ts, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts, admin/src/views/ListView.vue, admin/tests/form/registry.test.ts, admin/tests/form/formState.test.ts, admin/tests/list/ListView.test.ts, ../sm-journal-plugin/assets/src/blogeditor/extensions.ts, ../sm-journal-plugin/assets/src/blogeditor/serializer.ts, ../sm-journal-plugin/assets/src/blogeditor/embed.ts, ../sm-journal-plugin/assets/src/blogeditor/element.ts, ../vue-journal-layer/app/utils/embeds.ts, ../vue-journal-layer/tests/embeds.test.ts, scripts/check-phase16.sh (fail-closed stage and detector style), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md</read_first>
+  <files>admin/tests/app/fieldTypes.test.ts, admin/tests/form/registry.test.ts, admin/tests/form/formState.test.ts, admin/tests/form/FormField.test.ts, admin/tests/list/ListView.test.ts, ../sm-journal-plugin/tests/blogeditor/schema.test.ts, ../sm-journal-plugin/tests/blogeditor/serializer.test.ts, ../sm-journal-plugin/tests/blogeditor/embed.test.ts, ../vue-journal-layer/tests/embeds.test.ts, ../vue-journal-layer/tests/htmlGate.test.ts, scripts/check-phase16.2.sh, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md</files>
+  <read_first>admin/src/app/fieldTypes.ts, admin/src/app/pluginAssets.ts, admin/src/components/form/registry.ts, admin/src/components/form/mlLocale.ts, admin/src/components/form/formState.ts, admin/src/views/ListView.vue, admin/tests/form/registry.test.ts, admin/tests/form/formState.test.ts, admin/tests/list/ListView.test.ts, ../sm-journal-plugin/assets/src/blogeditor/extensions.ts, ../sm-journal-plugin/assets/src/blogeditor/serializer.ts, ../sm-journal-plugin/assets/src/blogeditor/embed.ts, ../sm-journal-plugin/assets/src/blogeditor/element.ts, ../vue-journal-layer/app/utils/embeds.ts, ../vue-journal-layer/app/utils/htmlGate.ts, ../vue-journal-layer/app/components/Journal/PostBody.vue, ../vue-journal-layer/tests/embeds.test.ts, ../vue-journal-layer/tests/htmlGate.test.ts, ../sm-journal-plugin/tests/blogeditor/corpus.test.ts, admin/src/components/form/FormField.vue, scripts/check-phase16.sh (fail-closed stage and detector style), .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md</read_first>
   <behavior>
     - fieldTypes: each script URL loads once even when loadFieldTypes runs twice; global styles stay enabled after activateStyles for any controller; a failed GET or script does not reject; URLs outside the asset prefix are refused.
-    - registry: rendererForField returns PluginField, MLPluginField or the core renderer; isRegisteredField true for plugin fields; groupLabelled true for plugin fields. formState: isMLField fields get locale maps in initial values and editable payloads. ListView: an unknown column type renders the row value as text.
+    - registry: rendererForField returns PluginField, MLPluginField or the core renderer; isRegisteredField true for plugin fields; groupLabelled true for plugin fields. formState: isMLField fields get locale maps in initial values and editable payloads; noticeLines groups notices by field with the locale prefix. FormField: notices render as literal text in a status line linked by aria-describedby, none without notices. ListView: an unknown column type renders the row value as text.
     - Editor schema: every rawHtml tag rule, figure shapes (img only, img plus figcaption, other content to rawHtml), span mark, global attributes on each modelled type, link attributes without defaults and javascript: refused, table rendering without colgroup, thead kept, cell paragraph unwrapping, no trailing paragraph, rawHtml card escaping.
     - Serializer: block reuse after one edit, after a deletion and after an insertion; whitespace between blocks kept for reused runs.
-    - Embed: parseEmbedUrl table (watch, youtu.be, shorts, embed, extra query params, 10 and 12 character ids, other hosts, javascript:), node round trip, insert flow; upload flow timeout and mismatched id; labels pl and en with en fallback; disabled and invalid attributes.
-    - Layer: expandEmbeds table (valid, invalid id, unknown provider, extra attribute, attribute order swapped, two placeholders, empty input) and the gate-first pipeline.
-    - Gate: stages go, admin, editor, layer, docs run fail-closed (a go run with "no tests to run", a skip or a missing named test fails; a node run with "not ok" or "# fail" non-zero fails); --self-test proves the detectors fail on planted output; --all ends with "Phase 16.2 gate passed"; the postgres stage runs the Docker suites and is documented as Docker-host only.
+    - Embed: parseEmbedUrl table (watch, youtu.be, shorts, embed, extra query params, 10 and 12 character ids, other hosts, javascript:), node round trip, insert flow; isPolicyUrl table (http, https, mailto, relative, #fragment accepted; javascript:, vbscript:, data:, tel: and tab- or newline-split schemes refused); upload flow timeout and mismatched id; labels pl and en with en fallback; disabled and invalid attributes.
+    - Layer: expandEmbeds table (valid, invalid id, unknown provider, extra attribute, attribute order swapped, two placeholders, empty input); the sanitize-then-expand pipeline at the sink and the payload-then-sink pipeline (stored iframe stripped, placeholder expanded, expansion output never sanitized again); the mirror: every corpus entry safe, the four rules accepted, the negative cases stripped, existing htmlGate cases unchanged.
+    - Gate: stages go, admin, editor, layer, docs run fail-closed (a go run with "no tests to run", a skip or a missing named test fails; a node run with "not ok" or "# fail" non-zero fails); the editor stage includes corpus.test.ts and the go stage the Journal policy cross-check; the layer stage fails when the layer's tests/fixtures/editor-corpus.json differs from the plugin's (cmp); --self-test proves the detectors and the corpus comparison fail on planted output; --all ends with "Phase 16.2 gate passed"; the postgres stage runs the Docker suites (including TestPostsAdminSaveSanitizesHTML and TestCategoriesAdminContent) and is documented as Docker-host only.
   </behavior>
-  <action>Write the JS tests in the behavior block (per D-03, D-04, D-05, D-13, D-14, D-17, D-18) in each repository's existing runner (admin vitest, plugin vitest, layer node:test with erasable TypeScript only). Write scripts/check-phase16.2.sh in the check-phase16.sh style (set -euo pipefail, unset FORCE_COLOR, ROOT from the script path, overridable JOURNAL and LAYER paths, required-test name lists per stage, the go and node detectors, --self-test, --all, stage names go, admin, editor, layer, docs, postgres; the docs stage runs TestDocsTree, check-admin-openapi.sh --check, check-admin-dist.sh and the plugin check-dist.sh). Update 16.2-VALIDATION.md: fill the per-task map with the real task IDs (16.2-01-T2 and so on), commands and statuses, tick Wave 0, set wave_0_complete and nyquist_compliant to true, and keep the Manual-Only rows (Docker-host suites; UAT editing, which plan 05 recorded). Commit tests per repository as test(...) commits, the script as "test(16.2): phase gate", and VALIDATION.md separately as docs(16.2), staged by explicit path.</action>
+  <action>Write the JS tests in the behavior block (per D-03, D-04, D-05, D-10, D-13, D-14, D-17, D-18) in each repository's existing runner (admin vitest, plugin vitest, layer node:test with erasable TypeScript only). Write scripts/check-phase16.2.sh in the check-phase16.sh style (set -euo pipefail, unset FORCE_COLOR, ROOT from the script path, overridable JOURNAL and LAYER paths, required-test name lists per stage, the go and node detectors, --self-test, --all, stage names go, admin, editor, layer, docs, postgres; the docs stage runs TestDocsTree, check-admin-openapi.sh --check, check-admin-dist.sh and the plugin check-dist.sh). Update 16.2-VALIDATION.md: fill the per-task map with the real task IDs (16.2-01-T2 and so on, including the strip, notices, corpus and category rows added in the 2026-10-10 revision), commands and statuses, tick Wave 0, set wave_0_complete and nyquist_compliant to true, and keep the Manual-Only rows (Docker-host suites; UAT editing and the UAT strip check, which plan 05 recorded). Commit tests per repository as test(...) commits, the script as "test(16.2): phase gate", and VALIDATION.md separately as docs(16.2), staged by explicit path.</action>
   <verify>
     <automated>npm --prefix admin test &amp;&amp; ../sm-journal-plugin/node_modules/.bin/vitest run --root ../sm-journal-plugin &amp;&amp; npm --prefix ../vue-journal-layer test 2&gt;&amp;1 | grep -E '^# fail 0$'</automated>
     <fails_when>Non-zero exit or no "# fail 0" line: an admin or editor vitest file fails, or a layer node test fails.</fails_when>
@@ -218,7 +229,7 @@ Commit per repository as test(...) commits, staged by explicit path.</action>
 |-----------|----------|-----------|----------|-------------|-----------------|
 | T-16.2-28 | Tampering | test isolation | low | mitigate | Pure tests use stubs, DryRun handles on a DSN that is never dialled, memblob and happy-dom; Postgres tests use testcontainers; no ssh or curl in any test |
 | T-16.2-29 | Repudiation (false green) | phase gate | medium | mitigate | Fail-closed detectors for "no tests to run", skips, missing named tests and node "# fail"; --self-test proves them; Docker suites are named as manual rows, not silently skipped |
-| T-16.2-30 | Tampering (security regression) | refusal tests | medium | mitigate | The CheckHTML, upload sniffing, alias collision, upload permission and gate-order cases are explicit tests, so a later change that weakens them fails the gate |
+| T-16.2-30 | Tampering (security regression) | strip, policy and permission tests | medium | mitigate | The strip-and-report cases (35 payloads, report property, category strip), the editor-corpus cross-check against both policies and the corpus-copy comparison, upload sniffing, alias collision, upload permission and sanitize-then-expand order are explicit tests in the fail-closed gate, and the 16.1 policy test files are diff-checked against c60abc6, so a later change that weakens them fails the gate |
 | T-16.2-SC | Tampering | packages | high | mitigate | No package is installed: every runner uses the lockfiles committed in plans 01, 02 and 04 |
 </threat_model>
 

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-SUMMARY.md

@@ -0,0 +1,277 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 06
+subsystem: testing
+tags: [unit-tests, vitest, node-test, testcontainers, phase-gate, cabana, pact, blog-editor, embeds, d-03]
+
+requires:
+  - phase: 16.2-01
+    provides: pact field type API (ListValue takes ctx), cabana registry, decode, skip, load, list, writes, routes, SPA PluginField/MLPluginField and fieldTypes loader
+  - phase: 16.2-02
+    provides: golem15-journal-blogeditor element, schema, serializer, embeds, editor corpus
+  - phase: 16.2-03
+    provides: Journal blogeditor/mlblogeditor types, SanitizeHTMLReport, StoreMedia, posts and category hooks
+  - phase: 16.2-04
+    provides: vue-journal-layer expandEmbeds and the four-rule sanitizer mirror
+  - phase: 16.2-05
+    provides: UAT release (v0.1.18) plus the untagged preview pane (quick 261010-iwu) and the admin View site link
+provides:
+  - "Full unit coverage of the phase across summercms.go, sm-journal-plugin and vue-journal-layer (lean rule 3)"
+  - "The imported-post resave contract (D-03) pinned at the element, PluginField, cabana, Journal Load and Postgres layers"
+  - "Postgres tests for a Docker host: TestFieldTypeSavePostgres, TestCategoriesAdminBlogEditor, the three-stage TestPostsAdminResaveKeepsHTML"
+  - "scripts/check-phase16.2.sh: fail-closed stages go, admin, editor, layer, docs, postgres with go/vitest-JSON/TAP detectors and a self-test"
+  - "16.2-VALIDATION.md map filled with real task IDs, nyquist_compliant and wave_0_complete true"
+affects: [16.2 verify-work, v0.1.19 tag, sm-journal-plugin, vue-journal-layer]
+
+actuals:
+  tokens: 58692
+  tasks: 3
+  commits: 5
+plan_head_before: c07da3912b1cc4b5d112200f7af16c5ad3061d02
+plan_head_after: 7e113013a364f8e1668d0b5033e183204ec18d9f
+plugin_commits_repo: ../sm-journal-plugin
+plugin_head_before: 2c78211cb90e27cf8515b104613c3eac1a0aca5f
+plugin_head_after: 85963b19eff80530c301454095377cde1350621a
+plugin_commits: 4
+layer_commits_repo: ../vue-journal-layer
+layer_head_before: 759e684e862bd8a2f34e2bbcdf258f66aeddad4f
+layer_head_after: 782aa4da7d618b0d7e678421fc02dee29e5b9f54
+layer_commits: 1
+task2_start:
+  summercms.go: 08a2002
+  sm-journal-plugin: d5a5413
+
+tech-stack:
+  added: []
+  patterns:
+    - "vitest JSON-reporter detector: a failed, skipped or todo test, a failed file, no passing test or a missing required file or test name fails the gate"
+    - "Docker-only stages are explicit: --all runs postgres only when a daemon answers and otherwise prints NOT RUN; the stage itself fails without Docker"
+    - "Edited-block markup compared by shape (element, sorted attributes, text), byte comparison kept for untouched blocks"
+
+key-files:
+  created:
+    - modules/pact/field_type_test.go
+    - modules/cabana/field_type_test.go
+    - modules/cabana/field_type_postgres_test.go
+    - admin/tests/app/fieldTypes.test.ts
+    - scripts/check-phase16.2.sh
+    - ../sm-journal-plugin/classes/blog_editor_test.go
+    - ../sm-journal-plugin/controllers/posts_editor_test.go
+    - ../sm-journal-plugin/categories_admin_editor_test.go
+    - ../sm-journal-plugin/tests/blogeditor/element.test.ts
+    - ../sm-journal-plugin/tests/blogeditor/schema.test.ts
+    - ../sm-journal-plugin/tests/blogeditor/serializer.test.ts
+    - ../sm-journal-plugin/tests/blogeditor/embed.test.ts
+  modified:
+    - admin/tests/form/PluginField.test.ts
+    - admin/tests/form/FormField.test.ts
+    - admin/tests/form/registry.test.ts
+    - admin/tests/form/formState.test.ts
+    - admin/tests/list/ListView.test.ts
+    - admin/tests/shell/AppShell.test.ts
+    - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md
+    - .planning/WINDOWS.md
+    - ../sm-journal-plugin/classes/editor_policy_test.go
+    - ../sm-journal-plugin/classes/media_store_test.go
+    - ../sm-journal-plugin/posts_admin_smoke_test.go
+    - ../sm-journal-plugin/vite.config.ts
+    - ../vue-journal-layer/tests/embeds.test.ts
+    - ../vue-journal-layer/tests/htmlGate.test.ts
+
+key-decisions:
+  - "The Postgres resave test adapts the plan's locales to the harness: en is the host locale and pl the translation, as plan 03 already recorded"
+  - "check-phase16.2.sh --all runs the postgres stage only when a Docker daemon answers; without one it prints a loud NOT RUN block and still ends with 'Phase 16.2 gate passed' for the runnable stages. The postgres stage invoked directly fails without Docker, and PHASE162_REQUIRE_POSTGRES=1 makes --all fail too"
+  - "Edited (re-serialized) blocks are compared by element, attribute set and text rather than bytes: attribute order and the DOM's style normalization change there by design (plan 02); untouched blocks keep the byte comparison"
+  - "The happy-dom iframe page loading is disabled in the editor tests so no test reaches the network (T-16.2-28)"
+
+patterns-established:
+  - "A phase gate names its required tests per stage and fails on a missing one, a skip, a todo or zero tests, in Go, vitest and node:test alike"
+
+requirements-completed: [D-02, D-03, D-05, D-07, D-10, D-11, D-12, D-13, D-14, D-17, D-18, D-19]
+
+coverage:
+  - id: D1
+    description: "Imported-post resave contract (D-03): untouched value unchanged at the element (Source tab, tab buttons, preview, reattach), PluginField never re-sets an echoed value, cabana writes and reports nothing for a served value, Journal Load serves HTML verbatim and markdown as content_html"
+    requirement: D-03
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/tests/blogeditor/element.test.ts"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/form/PluginField.test.ts#untouched value (D-03)"
+        status: pass
+      - kind: unit
+        ref: "modules/cabana/field_type_test.go#TestFieldTypeUntouched"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/blog_editor_test.go#TestBlogEditorLoad"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Framework coverage: pact FormFieldError, boot rules, compile, decode 422/500, localized capped notices, Load, ListValue, writes, field-types and upload routes"
+    requirement: D-11
+    verification:
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh go (19 named framework tests)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Journal coverage: Decode strip-and-report over the 35 payloads, notices and plural forms, LooksLikeHTML, options, ListValue, Upload sniffing and safe names, StoreMedia, policy corpus cross-check, posts hooks"
+    requirement: D-10
+    verification:
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh go (20 named Journal tests, 16.1 policy tests unchanged since c60abc6)"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "JS coverage: admin fieldTypes, registry, formState, FormField, ListView, AppShell View site; editor schema, serializer, embed, preview; layer expandEmbeds order and mirror negatives; corpus copies identical"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh admin (1218 tests, 78 files)"
+        status: pass
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh editor (220 tests, 7 files)"
+        status: pass
+      - kind: unit
+        ref: "bash scripts/check-phase16.2.sh layer (144 tests, corpus cmp)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Phase gate and validation map"
+    verification:
+      - kind: other
+        ref: "bash scripts/check-phase16.2.sh --self-test && bash scripts/check-phase16.2.sh --all -> Phase 16.2 gate passed"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Postgres-backed suites: TestFieldTypeSavePostgres, TestPostsAdminResaveKeepsHTML (HTML, markdown, edited), TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, TestCategoriesAdminBlogEditor, TestJournalSVGEmbed and the rest of the testcontainers suites"
+    requirement: D-18
+    verification: []
+    human_judgment: true
+    rationale: "No Docker on this host (docker.sock permission denied); the tests compile under go vet and fail rather than skip here. Run bash scripts/check-phase16.2.sh postgres on a Docker host before /msd-verify-work"
+
+duration: 43min
+completed: 2026-10-10
+status: complete
+---
+
+# Phase 16.2 Plan 06: Unit Coverage, Postgres Tests and Phase Gate Summary
+
+**Every Phase 16.2 behaviour is now pinned by a test that fails on regression: the untouched-resave contract at five layers, the framework's field type rules and routes, the Journal editor types, storage and policy cross-check, the editor element, schema, serializer and embeds, the layer's sanitize-then-expand order, and a fail-closed gate (`scripts/check-phase16.2.sh`) that passes here with the Docker-only suites reported as NOT RUN.**
+
+## Performance
+
+- **Duration:** 43 min
+- **Started:** 2026-10-10T13:34:11Z
+- **Completed:** 2026-10-10T14:17Z
+- **Tasks:** 3 (tracer, Go coverage, JS coverage plus gate and validation map)
+- **Files:** 26 test, script and planning files across three repositories (14 created, 12 modified), plus one test config (`vite.config.ts`)
+
+## Accomplishments
+
+- **Tracer (Task 1, D-03, D-07):** element.test.ts (15 cases: Source tab, tab buttons, echo, preview, reattach, a real Source edit); PluginField echo-on-connect stub; `TestFieldTypeUntouched` (served values skip Decode, writes and notices; one changed locale only; canonical JSON; create never skips); `TestBlogEditorLoad`; `TestPostsAdminResaveKeepsHTML` rewritten in three stages (HTML post, markdown post with imported content_html, edited clean save), byte comparisons without TrimSpace and no meta.notices.
+- **Go (Task 2):** pact `TestFormFieldErrorMessage`, `TestFormFieldTypeContract`; cabana `TestFieldTypeRegistry`, `TestFieldTypeOptions`, `TestFieldTypeCompile`, `TestFieldTypeDecode`, `TestFieldTypeNotices`, `TestFieldTypeLoad`, `TestFieldTypeListValue`, `TestFieldTypeWrites`, `TestFieldTypesRoute`, `TestFieldUpload`; Docker `TestFieldTypeSavePostgres`. Journal `TestBlogEditorDecode`, `TestBlogEditorNotices`, `TestLooksLikeHTML`, `TestBlogEditorOptions`, `TestBlogEditorListValue`, `TestBlogEditorUpload`, `TestStoreMedia`, extended `TestEditorOutputPassesPolicy` and `TestSanitizeHTMLReport`, `TestPostsEditorHooks`, Docker `TestCategoriesAdminBlogEditor`.
+- **JS (Task 3):** admin `fieldTypes.test.ts` (new) plus registry, formState, FormField, ListView and AppShell (View site: href `origin + "/"`, `_blank`, `noopener noreferrer`, en/pl label and phrasebook keys); editor `schema`, `serializer`, `embed` tests (new) next to the existing smoke, corpus and preview tests; layer embeds (order at the sinks, exact-serialization only, stable global regex, fixed src) and htmlGate (four rules accept, Go negatives stripped, corpus free of danger).
+- **Gate:** `scripts/check-phase16.2.sh` with stages go, admin, editor, layer, docs, postgres, `--self-test` (go, TAP and vitest-JSON detectors plus the corpus `cmp` on planted output) and `--all`.
+- **Validation map:** every row has real task IDs, commands and statuses; Docker suites are manual rows; `nyquist_compliant: true`, `wave_0_complete: true`.
+
+## Test counts per repository
+
+| Repository | Suite | Before | After |
+|---|---|---|---|
+| summercms.go | Go: new top-level tests in pact and cabana | — | 13 (12 run here + `TestFieldTypeSavePostgres` for Docker) |
+| summercms.go | admin vitest | 1190 tests (plan 01), 77 files | 1218 tests, 78 files |
+| sm-journal-plugin | Go classes/controllers new top-level tests | — | 9 (+2 extended in place) |
+| sm-journal-plugin | Go root (Docker) | — | `TestCategoriesAdminBlogEditor` new, `TestPostsAdminResaveKeepsHTML` rewritten |
+| sm-journal-plugin | editor vitest | 55 tests, 3 files | 220 tests, 7 files |
+| vue-journal-layer | node --test | 136 | 144 |
+
+## Task Commits
+
+**summercms.go**
+1. Task 1: `08a2002` test(16.2-06): pin the untouched-value skip in cabana and PluginField
+2. Task 2: `3404a4b` test(16.2-06): full unit coverage of the plugin field type framework
+3. Task 3: `9f5e807` test(16.2-06): admin SPA coverage of plugin field types and View site; `3da2fd6` test(16.2): phase gate; `7e11301` docs(16.2): complete the validation map
+
+**sm-journal-plugin**
+1. Task 1: `d5a5413` test(16.2-06): pin the imported-post resave contract
+2. Task 2: `da7a073` test(16.2-06): full unit coverage of the Journal Blog Editor field types
+3. Task 3: `a578dda` test(16.2-06): Blog Editor schema, serializer and embed coverage; `85963b1` test(16.2-06): keep happy-dom iframe pages offline in the editor tests
+
+**vue-journal-layer**
+3. Task 3: `782aa4d` test: pin embed expansion order and the editor policy mirror
+
+No fix(...) commit: no test exposed a production defect. Nothing was pushed or tagged.
+
+## Verification
+
+- Task 1 verify: element vitest 15/15, PluginField 17/17, `--- PASS: TestFieldTypeUntouched`, `--- PASS: TestBlogEditorLoad`, `go -C ../sm-journal-plugin vet ./...` clean.
+- Task 2 verify: 13 of 13 named cabana tests pass, 10 of 10 named Journal classes tests pass, `TestPostsEditorHooks` passes, vet clean in both repositories; `git -C ../sm-journal-plugin diff --quiet c60abc6 -- classes/format_html_test.go classes/check_html_test.go classes/format_translation_test.go` exits 0; Task 2's diffs (`08a2002..3404a4b`, `d5a5413..da7a073`) hold only `*_test.go` files.
+- Task 3 verify: admin 1218/1218, editor 220/220, layer `# fail 0` (144 pass); `check-phase16.2.sh --self-test` passes; `--all` ends with `Phase 16.2 gate passed` (go, admin, editor, layer, docs PASS; postgres NOT RUN).
+- Typecheck: `vue-tsc --noEmit` (admin) and `tsc --noEmit` (plugin) clean; `check-dist.sh` and `check-admin-dist.sh` report current bundles.
+- Full `go test ./...`: the only failures in summercms.go (beachcomber, bouncer, cabana, conga, lagoon, lagoon/attach, lighthouse, postcard, docs/examples/blog) and sm-journal-plugin (root, models, updates) are the testcontainers suites failing on `docker.sock: permission denied`; no other failing test line.
+
+## Docker-host command list (not run here)
+
+```
+bash scripts/check-phase16.2.sh postgres
+# which runs, fail-closed:
+go test -json -count=1 -timeout 15m ./modules/cabana          # requires TestFieldTypeSavePostgres, TestListRelationSearchPostgres
+go -C ../sm-journal-plugin test -json -count=1 -timeout 20m ./...  # requires TestPostsFormCompiles, TestPostsAdminCreateSmoke,
+#   TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent,
+#   TestCategoriesAdminBlogEditor, TestJournalSVGEmbed
+```
+
+These cover WINDOWS entries 11, 12, 14, 15, 16, 20 and 21.
+
+## Decisions Made
+
+See key-decisions in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 2 - Test isolation] happy-dom loaded remote iframe pages in the editor tests**
+- **Found during:** Task 1 (baseline run of the plugin vitest suite)
+- **Issue:** The quick-task preview tests put payloads with `https://example.test/` iframes into the preview frame's srcdoc; happy-dom tried to fetch them (12 `getaddrinfo ENOTFOUND example.test` per run). The threat model (T-16.2-28) says no test reaches the network.
+- **Fix:** `test.environmentOptions.happyDOM.settings.disableIframePageLoading: true` in the plugin's `vite.config.ts` (test block only; the build output is unchanged, `check-dist.sh` passes). The admin suite was checked and makes no such request.
+- **Files modified:** ../sm-journal-plugin/vite.config.ts
+- **Commit:** 85963b1
+
+**2. [Plan text] Locales of the Postgres resave test**
+- **Issue:** The plan says "pl and en ... no en translation row ... en content_html translation" with pl as host; the harness (`bootJournal`) makes en the default locale and pl the translation (as plan 03 recorded).
+- **Fix:** host assertions on en; the untouched empty value and the translation assertions on pl. The untouched-empty check compares pl `content`/`content_html` presence and the translation row count before and after the PUT.
+- **Commit:** d5a5413
+
+**3. [Plan text] Edited-block markup compared by shape**
+- **Issue:** schema tests that serialize a whole document from the model saw attribute order and style normalization differ from the source (`<a class="more" data-id="7" href="/a">`, `color: red;`). This is plan 02's documented behaviour for edited blocks, not a defect.
+- **Fix:** those cases compare element names, sorted attributes and text; untouched blocks keep byte comparisons everywhere.
+- **Commit:** a578dda
+
+**4. Files outside the plan's list**
+- `admin/tests/shell/AppShell.test.ts` (the View site link test the orchestrator asked for), `../sm-journal-plugin/vite.config.ts` (deviation 1), `.planning/WINDOWS.md` (entries 20 and 21).
+
+---
+
+**Total deviations:** 1 auto-fixed (test isolation) plus 2 plan-text adaptations and the listed extra files. **Impact:** no production code changed; no assertion that describes shipped behaviour was relaxed (the 16.1 policy test files are unchanged since c60abc6).
+
+## Issues Encountered
+
+- No Docker on this host: the Postgres suites compile under go vet and fail rather than skip; see the Docker-host command list.
+
+## Known Stubs
+
+None.
+
+## Next Phase Readiness
+
+- Run `bash scripts/check-phase16.2.sh postgres` on a Docker host, then /msd-verify-work 16.2 (WINDOWS 18 and 19 remain human UAT items from plan 05).
+- The orchestrator tags v0.1.19 separately.
+- STATE.md and ROADMAP.md updates are pending: another session holds uncommitted edits to them (see below).
+
+## Self-Check: PASSED
+
+- Created files exist: modules/pact/field_type_test.go, modules/cabana/field_type_test.go, modules/cabana/field_type_postgres_test.go, admin/tests/app/fieldTypes.test.ts, scripts/check-phase16.2.sh, ../sm-journal-plugin/classes/blog_editor_test.go, ../sm-journal-plugin/controllers/posts_editor_test.go, ../sm-journal-plugin/categories_admin_editor_test.go, ../sm-journal-plugin/tests/blogeditor/{element,schema,serializer,embed}.test.ts.
+- Commits exist: summercms.go 08a2002, 3404a4b, 9f5e807, 3da2fd6, 7e11301; sm-journal-plugin d5a5413, da7a073, a578dda, 85963b1; vue-journal-layer 782aa4d.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-07-PLAN.md

@@ -0,0 +1,690 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 07
+type: execute
+wave: 5
+depends_on: ["16.2-01", "16.2-02", "16.2-03", "16.2-04", "16.2-05", "16.2-06"]
+gap_closure: true
+gap_ids: [G-16.2-1, G-16.2-2]
+files_modified:
+  - modules/cabana/openapi_conformance_test.go
+  - scripts/check-phase16.2.sh
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md
+  - ../sm-journal-plugin/classes/site_cache.go
+  - ../sm-journal-plugin/classes/site_cache_test.go
+  - ../sm-journal-plugin/plugin.go
+  - ../sm-journal-plugin/controllers/categories.go
+  - ../sm-journal-plugin/controllers/posts.go
+  - ../sm-journal-plugin/controllers/admin_registry.go
+  - ../sm-journal-plugin/site_cache_admin_test.go
+  - ../sm-journal-plugin/plugin_test.go
+  - ../sm-journal-plugin/README.md
+  - ../sm-journal-plugin/go.mod
+  - ../vue-journal-layer/nuxt.config.ts
+  - ../vue-journal-layer/app/utils/siteCache.ts
+  - ../vue-journal-layer/server/api/__journal__/cache/purge.post.ts
+  - ../vue-journal-layer/server/plugins/journal-revalidate.ts
+  - ../vue-journal-layer/testing/fixture-api.mjs
+  - ../vue-journal-layer/testing/purge-check.mjs
+  - ../vue-journal-layer/.playground/nuxt.config.ts
+  - ../vue-journal-layer/tests/siteCache.test.ts
+  - ../vue-journal-layer/README.md
+  - ../vue-journal-layer/package.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md
+  - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+  - ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app
+  - ../sm-grzybyfunkcjonalne-app/deploy/env.example
+  - ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example
+  - ../sm-grzybyfunkcjonalne-app/DEPLOY.md
+  - ../sm-grzybyfunkcjonalne-app/README.md
+autonomous: false
+requirements: [D-03, D-13, D-18, D-19]
+user_setup:
+  - service: UAT admin (https://uat.grzybyfunkcjonalne.pl/gfadmin)
+    why: "The executor holds no UAT basic-auth or admin credentials. A human re-saves posts 1 and 64 untouched (UAT Test 3, D-03) and edits one word of category 2 (UAT Test 2, D-19), then checks the public category page in a browser."
+    dashboard_config:
+      - task: "Log in to the admin through the UAT basic-auth realm with an admin account that may edit posts and categories"
+        location: "browser, https://uat.grzybyfunkcjonalne.pl/gfadmin"
+estimate:
+  tokens: 220000
+  raw_tokens: 220000
+  tasks: 6
+  confidence: low
+must_haves:
+  truths:
+    - "G-16.2-1: on this Docker host `PHASE162_REQUIRE_POSTGRES=1 bash scripts/check-phase16.2.sh --all` prints `PASS postgres` and `PASS cache` and ends with `Phase 16.2 gate passed`; the postgres stage requires TestPhase10OpenAPIConformance, TestJournalSVGEmbed and every Journal admin harness suite named in UAT Test 1 (TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, TestCategoriesAdminBlogEditor) by name, and they pass."
+    - "G-16.2-1 (D-13, D-18): TestPhase10OpenAPIConformance calls GET /field-types (200, decoded into cabana.FieldTypesResponse with unknown fields disallowed, admin.json ref cabana.FieldTypesResponse, the fixture plugin's field type listed with a served script) and POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload (201, decoded into cabana.Envelope[cabana.FieldUploadResponse], ref cabana.Envelope-cabana_FieldUploadResponse, multipart part `file`)."
+    - "G-16.2-1 recurrence guard: the Docker-free TestPhase10ConformanceInventory fails, naming every missing key at once, when an inventoried admin route has no conformance case; it passes with -short and no database, and the gate's go stage requires it by name; 16.2-PATTERNS.md names modules/cabana/openapi_conformance_test.go next to phase09Routes and admin_openapi.go."
+    - "G-16.2-2 (D-19): after the transaction of an admin create, update or delete of a Journal post or category commits, the Journal plugin sends exactly one POST to golem15.journal.site_cache.purge_url with `Authorization: Bearer <purge_token>` and a JSON body naming the kind and slug; a save that fails sends none; a failing, refused or slow purge (2 s timeout) is logged without the token and never changes the save response."
+    - "G-16.2-2: the vue-journal-layer route POST /api/__journal__/cache/purge removes every Nitro route-cache entry (pages, _payload.json and feeds) and answers 200 {purged}; it answers 404 when no token of at least 32 characters is configured or the request carries a proxy header, 401 for a missing or wrong bearer token, and it is never route-cached itself, so every call runs."
+    - "G-16.2-2: on a built site with swr route rules, a page cached before a content change shows the change on the first request after a purge, and route-cached pages and their 304 revalidations tell browsers max-age=0 while shared caches keep s-maxage; testing/purge-check.mjs proves this on the layer playground and on the host app build."
+    - "Release: summercms v0.1.20 (the tag after v0.1.19), vue-journal-layer v0.3.0 (check-git-install passes), sm-journal-plugin main requiring v0.1.20, vue-grzybyfunkcjonalne-app main pinning #v0.3.0 and the host gitlinks are on origin; UAT runs the binary and Nuxt output built from those heads (sha256 equal); the purge URL and token exist once in go/.env and the same token once in nuxt/.env, generated on the server and never printed; the on-server smoke passes; an on-server purge answers 200 with purged >= 1 while a POST through nginx answers 403 and one without a token answers 401."
+    - "UAT Test 3 (D-03) on the deployed build: after the human saves posts 1 and 64 untouched, the rows read 1:a026264105f900175b9770e637e5ec5c:a026264105f900175b9770e637e5ec5c and 64:0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c, the post 64 en translation reads 64:en:862fc5b362cc9856e6736a2078dca3ba, and both updated_at values moved past the restart."
+    - "UAT Test 2 (D-19, D-10): after the human changes one word of category 2 and saves, no removal notice appears, the Go log has a successful site cache purge line for kind=category, the /cordyceps page served on the server is not older than the category's updated_at, and the human sees the change on the first view in the browser."
+  artifacts:
+    - path: "modules/cabana/openapi_conformance_test.go"
+      provides: "conformance cases for both 16.2 routes and the Docker-free inventory test"
+      contains: "TestPhase10ConformanceInventory"
+    - path: "scripts/check-phase16.2.sh"
+      provides: "gate with the inventory test in the go stage, the purge tests and the cache stage"
+      contains: "TestPhase10ConformanceInventory"
+    - path: "../sm-journal-plugin/classes/site_cache.go"
+      provides: "SiteCachePurger, NewSiteCachePurger, PurgeSiteCacheAfterCommit"
+      contains: "PurgeSiteCacheAfterCommit"
+    - path: "../vue-journal-layer/server/api/__journal__/cache/purge.post.ts"
+      provides: "token-protected route-cache purge"
+      contains: "purgeRouteCache"
+    - path: "../vue-journal-layer/server/plugins/journal-revalidate.ts"
+      provides: "max-age=0 for browsers on route-cached responses"
+      contains: "privateRevalidate"
+    - path: "../vue-journal-layer/testing/purge-check.mjs"
+      provides: "end-to-end purge check against a built server"
+      contains: "purge-check: ok"
+  key_links:
+    - from: "../sm-journal-plugin/controllers/categories.go and posts.go (FormAfterCreate, FormAfterUpdate, FormAfterDelete)"
+      to: "classes.PurgeSiteCacheAfterCommit"
+      via: "lagoon.AfterCommit on the cabana save transaction"
+      pattern: "PurgeSiteCacheAfterCommit"
+    - from: "../sm-journal-plugin/classes/site_cache.go SiteCachePurger.Purge"
+      to: "../vue-journal-layer/server/api/__journal__/cache/purge.post.ts"
+      via: "HTTP POST on loopback with the shared bearer token"
+      pattern: "api/__journal__/cache/purge"
+    - from: "../vue-journal-layer/server/api/__journal__/cache/purge.post.ts"
+      to: "Nitro cache storage, group nitro/routes"
+      via: "useStorage('cache') getKeys and removeItem"
+      pattern: "nitro:routes"
+    - from: "UAT go/.env SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN"
+      to: "UAT nuxt/.env NUXT_JOURNAL_CACHE_PURGE_TOKEN"
+      via: "the same server-generated value"
+      pattern: "NUXT_JOURNAL_CACHE_PURGE_TOKEN"
+  prohibitions:
+    - statement: "The executor runs only SELECT queries on the UAT database; post and category data change only through human admin saves."
+      status: unresolved
+      verification: judgment
+    - statement: "The executor never requests, prints, stores or commits a credential: UAT basic auth, admin password, server .env values and the purge token (generated on the server, compared there, and passed to curl on stdin, never in argv or output)."
+      status: unresolved
+      verification: judgment
+    - statement: "The live Winter site, its vhost, php-fpm and the PHP database are not touched (Phase 16 D-10)."
+      status: unresolved
+      verification: judgment
+    - statement: "No pushed tag is moved or deleted; a defect after a push gets the next tag (v0.1.21, v0.3.1)."
+      status: unresolved
+      verification: judgment
+    - statement: "Framework packages, READMEs and docs under summercms.go stay free of consuming-application names; the Journal and layer READMEs use neutral names (the host application, acme, blog)."
+      status: unresolved
+      verification: judgment
+    - statement: "Tests are not weakened: the only changed assertion is TestJournalSVGEmbed's stale mlmarkdown check, which now asserts the intended mlblogeditor type."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): plugins can register their own admin form field types, and the Journal plugin ships a first-class Blog Editor formwidget for post content that edits imported HTML posts losslessly.
+
+This plan's slice: close the two gaps UAT found (16.2-UAT.md, diagnosed 2026-10-10), then release and redeploy so UAT Tests 2 and 3 can be re-run on the deployed build.
+
+- **G-16.2-1** (UAT Test 1, `.planning/debug/postgres-gate-field-types-conformance.md`): the postgres stage of the phase gate is red. Two 16.2 admin routes have no conformance case, the Journal SVG test still expects `mlmarkdown`, and both checks were hidden inside Docker-only test binaries.
+- **G-16.2-2** (UAT Test 2, `.planning/debug/category-content-not-on-site.md`): the save was correct, but the host Nuxt app's Nitro swr route cache (`'/**': { swr: 300 }`, Phase 16 decision D-07) kept serving the page rendered before the edit. User decision 2026-10-10: fix it in 16.2. A Journal post or category save in the admin clears the host's route-cache entries, so the site shows the edit on the next view.
+
+## User decisions (binding, 2026-10-10)
+
+- Exactly one plan, this one. The user overrode CLAUDE.md lean rule 3 ("unit tests are a separate last plan") for this gap closure. The tests are the final code task (Task 3), before the release tasks. The 2-3 tasks per plan guideline gives way to that decision, so this plan has six tasks.
+- G-16.2-2 is fixed inside 16.2, by a Journal save event, a token-protected Nuxt server route on 127.0.0.1, and host configuration for the URL and token.
+- G-16.2-1: two conformance cases, a Docker-free route-coverage check in the gate's go stage, the TestJournalSVGEmbed fix and the PATTERNS checklist line.
+- The plan ends with the full gate green, including postgres (this machine has Docker), then a release and a UAT deploy following 16.2-05. The UAT-touching steps are checkpoints, as in 16.2-05.
+
+## Design decisions (planner, within the user decisions)
+
+- **Where each part lives.**
+  - The Go save event is in **sm-journal-plugin** (`classes/site_cache.go` plus the post and category Form hooks). The framework is unchanged, so no framework README or docs page changes.
+  - The purge route is in **vue-journal-layer**, so every blog host that extends the layer gets it.
+  - The host supplies the URL and the shared token through the server `.env` files: `go/.env` gets `SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_URL` and `..._TOKEN`, and `nuxt/.env` gets `NUXT_JOURNAL_CACHE_PURGE_TOKEN`.
+  - With neither set, nothing changes. Local development and the existing tests need no configuration.
+- **What is purged.** The route removes every entry of Nitro's route-cache group (`cache:nitro:routes:*`): pages, `_payload.json` and feeds. This is a superset of the decision's list (category and post pages, `/blog` lists and their payloads).
+  - A precise per-page purge cannot be computed from one save. The host's header menu lists every category on every page. The home page, category pages, related posts and the author page all list posts.
+  - Nitro keys entries as the first 16 word characters of the path plus a hash, so matching pages would mean mirroring Nitro internals.
+  - At blog scale, a full purge only costs one fresh render per page on its next view.
+- **Ordering.** The purge runs through `lagoon.AfterCommit` on the cabana save transaction. If it ran before the commit, a concurrent view could re-cache the old content for the whole TTL. It never runs for a failed save. It runs synchronously before the save response, with a 2 s timeout on `context.WithoutCancel`, so the cache is already clear when the admin sees "saved". Errors are logged, never returned.
+- **The route is never cached itself.** Nitro wraps every handler whose route matches a host rule such as `'/**': { swr }` in its cached handler. That handler keys by path and does not skip POST (nitropack 2.13.4 `dist/runtime/internal/cache.mjs`), so without a rule a second purge within the TTL would get the first response from the cache. The layer adds `routeRules: { '/api/__journal__/**': { cache: false } }`.
+- **Browsers.** Nitro answers route-cached pages with `cache-control: s-maxage=<n>, stale-while-revalidate`. That carries no browser max-age, so browsers apply heuristic freshness from Last-Modified. h3's `handleCacheHeaders` answers a 304 with `public, max-age=<n>, s-maxage=<n>` and ends the response itself. After one revalidation, a browser may reuse its copy for the whole TTL without asking, and no server purge would reach it.
+  - The layer's Nitro plugin rewrites every cache-control value that carries s-maxage to include `max-age=0`.
+  - Browsers then revalidate each view, which is a cheap 304 while the page is unchanged. Shared caches keep s-maxage.
+  - The rewrite works through a per-request wrapper of `res.setHeader`, because the 304 path ends the response before any beforeResponse hook runs.
+- **Guards.** The route is POST only. It answers 404 when the token is missing or shorter than 32 characters. It also answers 404 when the request carries `X-Forwarded-For`, `X-Real-IP` or `Forwarded`: the UAT vhost sets the first two on every proxied request, and the Go caller sends none. A missing or wrong bearer token gets 401, compared in constant time. The UAT vhost already refuses POST to Nuxt (`limit_except GET HEAD`, required by check-deploy.sh), so the route is reachable only on loopback.
+- **Scope.** Admin saves of posts and categories purge. The public write API (D-09), the import action and tags do not, because the decision names admin post and category saves.
+
+## Multi-source coverage audit
+
+| Source | Item | Covered by |
+|---|---|---|
+| GOAL | Imported HTML posts edited losslessly, visible on the site | Task 6 (Test 3 md5, Test 2 site view) |
+| REQ | ROADMAP lists none (TBD); the phase's decisions act as requirements | D-03, D-13, D-18, D-19 below |
+| CONTEXT | D-03 untouched re-save byte-identical | Tasks 3 (TestPostsAdminPurgesSiteCache untouched update), 6 (Test 3) |
+| CONTEXT | D-13 global field-type assets (GET /field-types) | Task 3 conformance case |
+| CONTEXT | D-18 field upload route | Task 3 conformance case |
+| CONTEXT | D-19 category content on the Blog Editor, visible on the site | Tasks 1, 2, 3, 6 |
+| GAP | G-16.2-1 conformance case GET /field-types | Task 3 |
+| GAP | G-16.2-1 conformance case for the field upload route | Task 3 |
+| GAP | G-16.2-1 TestJournalSVGEmbed expects mlblogeditor | Task 3 |
+| GAP | G-16.2-1 route-coverage check without Docker in the go stage | Task 3 |
+| GAP | G-16.2-1 PATTERNS checklist names openapi_conformance_test.go | Task 3 |
+| GAP | G-16.2-2 save clears the matching host page caches (pages, /blog lists, _payload.json) | Tasks 1, 2 (superset purge, see Design decisions) |
+| USER | Full gate incl. postgres green on this Docker host | Task 3 |
+| USER | Release (tag after v0.1.19, plugin/layer/host bumps) and UAT deploy per 16.2-05 | Tasks 4, 5 |
+| USER | UAT Tests 3 and 2 can be re-run | Task 6 |
+| RESEARCH | 16.2-RESEARCH.md has no item open for these gaps | none |
+
+No item is missing. Deferred ideas from 16.2-CONTEXT.md are untouched.
+
+## Release facts at planning time (2026-10-10)
+
+- summercms.go: v0.1.19 is tagged and on origin (cf10ce8). UAT never ran it: the UAT binary was built from b5c70b7 at 12:37 UTC. The next tag is **v0.1.20**.
+- sm-journal-plugin: main 0efaa04 is on origin and requires v0.1.19.
+- vue-journal-layer: main 782aa4d is on origin. The latest tag is v0.2.0, so the next tag is **v0.3.0** (a new feature).
+- vue-grzybyfunkcjonalne-app: main 465286a is on origin and pins #v0.2.0.
+- Host sm-grzybyfunkcjonalne-app: master 0ad1004 is on origin, with journal gitlink 2c78211 (before the review fixes) and vue app gitlink 465286a.
+- Docker 29.7.2 answers on this machine.
+
+<objective>
+Close G-16.2-1 (the phase gate's postgres stage is red) and G-16.2-2 (an admin save does not show on the site until the Nitro swr cache expires). Then run the full gate including postgres, release summercms v0.1.20 and vue-journal-layer v0.3.0 with the plugin and host bumps, deploy to UAT per 16.2-05, and re-run UAT Tests 3 and 2 (D-03, D-19).
+
+Purpose: the phase cannot pass verification while its gate is red, and editors must see a Journal edit on the site at once.
+Output: the conformance and purge code and tests in four repositories, an updated gate, pushed tags and heads, a UAT release, and recorded UAT results.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-UAT.md
+@.planning/debug/postgres-gate-field-types-conformance.md
+@.planning/debug/category-content-not-on-site.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-PLAN.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md
+@../sm-grzybyfunkcjonalne-app/DEPLOY.md
+
+Repositories (siblings of summercms.go; run commands from summercms.go):
+- summercms.go: framework tests, gate, planning docs.
+- ../sm-journal-plugin: the Go save event.
+- ../vue-journal-layer: the purge route, browser revalidation and the end-to-end check.
+- ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app: the layer pin and README.
+- ../sm-grzybyfunkcjonalne-app: deploy files, docs, gitlinks and the UAT build.
+
+The host builds the Journal plugin from its own submodule checkout (plugins/golem15/journal) and the framework from ../summercms.go through go.work.
+
+Server facts (DEPLOY.md, 16.2-05-SUMMARY):
+- SSH alias `grzybyfunkcjonalne-uat`; install root `/srv/grzybyfunkcjonalne`, with `go/.env` and `nuxt/.env` owned by the deploy user, mode 0600.
+- The Nuxt rollback copy lives at `nuxt/.output.prev`. Delete the old copy before `cp -a`.
+- `sudo supervisorctl tail` fails on UAT, so log checks read `/var/log/supervisor/grzybyfunkcjonalne-go.log` from the restart's River `client_id=` anchor.
+- The UAT realm exempts requests from 127.0.0.1, so on-server curls resolve the host to loopback.
+
+Helpers to reuse:
+- `newPostsEnv(t, extraEnv ...string)` and `adminAPI` (../sm-journal-plugin/admin_harness_test.go).
+- `lagoon.AfterCommit` (modules/lagoon/transaction.go) and `app.Publish`/`app.Lookup` (modules/backpack/app.go).
+- `startFixtureApi` and `startNuxtServer` (../vue-journal-layer/testing/).
+- The fail-closed detectors in scripts/check-phase16.2.sh.
+
+Commits: no co-author tags; one logical change per commit; planning docs and code in separate commits; stage by explicit path in every repository (another session may work in modules/).
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: a Journal category admin update purges the host Nuxt route cache after commit, one path only (sm-journal-plugin, vue-journal-layer)</name>
+  <reversibility rating="costly">The route path /api/__journal__/cache/purge, the JSON body, the config keys golem15.journal.site_cache.purge_url/purge_token and the env name NUXT_JOURNAL_CACHE_PURGE_TOKEN become host configuration in every blog host; renaming them means editing each host's server .env files.</reversibility>
+  <precondition>`docker info` exits 0 on this machine (the sm-journal-plugin root package harness starts PostgreSQL through testcontainers).</precondition>
+  <files>../sm-journal-plugin/classes/site_cache.go, ../sm-journal-plugin/plugin.go, ../sm-journal-plugin/controllers/categories.go, ../sm-journal-plugin/site_cache_admin_test.go, ../vue-journal-layer/nuxt.config.ts, ../vue-journal-layer/app/utils/siteCache.ts, ../vue-journal-layer/server/api/__journal__/cache/purge.post.ts, ../vue-journal-layer/testing/fixture-api.mjs, ../vue-journal-layer/testing/purge-check.mjs, ../vue-journal-layer/.playground/nuxt.config.ts</files>
+  <read_first>.planning/debug/category-content-not-on-site.md (Evidence and Resolution); ../sm-journal-plugin/plugin.go; ../sm-journal-plugin/controllers/categories.go; ../sm-journal-plugin/controllers/posts.go (db helper, existing Form hooks); ../sm-journal-plugin/admin_harness_test.go (newPostsEnv extraEnv, adminAPI, the pool); ../sm-journal-plugin/categories_admin_editor_test.go (a category PUT through the harness); modules/lagoon/transaction.go (Transaction, AfterCommit); modules/backpack/app.go (Publish, Lookup); modules/compass/env.go (SUMMER_ key mapping: `__` becomes a dot, parts lower-cased); ../vue-journal-layer/nuxt.config.ts; ../vue-journal-layer/server/routes/rss.xml.ts and ../vue-journal-layer/server/api/__sitemap__/journal.ts (server handler style, imports from app/utils); ../vue-journal-layer/app/utils/routes.ts (pure erasable TypeScript helper style); ../vue-journal-layer/testing/fixture-api.mjs; ../vue-journal-layer/testing/nuxt-server.mjs; ../vue-journal-layer/testing/smoke-ssr.mjs (CLI style); ../vue-journal-layer/.playground/nuxt.config.ts; the nitropack runtime in ../vue-journal-layer/node_modules (dist/runtime/internal/cache.mjs: the route cache key is cache:nitro:routes:_:&lt;path&gt;.&lt;hash&gt;.json and POST is not excluded)</read_first>
+  <action>Wire the one path: a category admin update goes through an after-commit purge request to a layer route that clears the route cache. This serves the G-16.2-2 user decision and D-19. Every other save path is Task 2.
+
+Contract (both repositories implement it; Task 2 documents it in both READMEs): a `POST <purge_url>` with `Authorization: Bearer <token>`, `Content-Type: application/json` and the body `{"kind":"category"|"post","slug":"<slug>"}`. The answer is 200 `{"purged":<n>}`.
+
+sm-journal-plugin:
+
+- `classes/site_cache.go` provides the following.
+  - `type SiteCachePurger`.
+  - `NewSiteCachePurger(purgeURL, token string) (*SiteCachePurger, error)`: both empty returns nil, nil (disabled). The tracer checks only that the URL parses with an http or https scheme and a host, and that the token is not empty. Task 2 adds the full rules.
+  - `(*SiteCachePurger).Purge(ctx context.Context, kind, slug string)`:
+    - A nil receiver does nothing.
+    - It sends the contract request with a 2 s timeout on `context.WithoutCancel(ctx)` and reads at most 4 KiB of the answer.
+    - It logs one slog line: Info `journal: site cache purged` with kind, slug, status and purged (when the answer parses), or Warn `journal: site cache purge failed` with kind, slug and the status or the error.
+    - It never logs the token or the Authorization header, and it returns nothing.
+  - `PurgeSiteCacheAfterCommit(ctx context.Context, db *gorm.DB, p *SiteCachePurger, kind, slug string)`: for a non-nil p, it registers p.Purge through `lagoon.AfterCommit(ctx, db, ...)`. The purge then runs only after the surrounding cabana save transaction commits, and never for a failed save.
+- `plugin.go` Boot reads `golem15.journal.site_cache.purge_url` and `golem15.journal.site_cache.purge_token` from `app.Config`. The env names are `SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_URL` and `SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN`. Boot builds the purger, returns a wrapped boot error for invalid configuration, and calls `app.Publish` with it when it is enabled.
+- `controllers/categories.go` gets a new FormAfterUpdate. It looks up `*classes.SiteCachePurger` through `c.app()` and `Lookup`, then calls `PurgeSiteCacheAfterCommit` with the tx from `cabana.TxFromContext(ctx)`, kind `category` and the saved slug.
+- New root-package test `site_cache_admin_test.go`, `TestCategoriesAdminPurgesSiteCache` (Docker):
+  - An httptest receiver on 127.0.0.1 records each request. Inside its handler it reads the category's content through the harness pool.
+  - Start with `newPostsEnv(t, "SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_URL=<receiver>/api/__journal__/cache/purge", "SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN=<a 40-character test token>")`, or the harness's equivalent.
+  - PUT an edited category content through `adminAPI`.
+  - Assert exactly one POST, the path, the Bearer token and the JSON body (kind category, the slug).
+  - Assert that the content read inside the receiver is the new content, which proves the purge ran after the commit.
+
+vue-journal-layer:
+
+- `nuxt.config.ts`:
+  - `runtimeConfig.journal.cachePurgeToken: ''` (server-only; env `NUXT_JOURNAL_CACHE_PURGE_TOKEN`).
+  - `routeRules: { '/api/__journal__/**': { cache: false } }`. This is required: Nitro wraps a handler matching a host's `'/**': { swr }` rule in a cached handler keyed by path that does not skip POST, so without it a second purge inside the TTL would be answered from the cache without running.
+- `app/utils/siteCache.ts` is pure erasable TypeScript that node --test can import, like routes.ts:
+  - `MIN_PURGE_TOKEN_LENGTH = 32`.
+  - `authorizePurge({ token, authorization, proxied })` returns `'ok' | 'disabled' | 'proxied' | 'unauthorized'`:
+    - `disabled` when the token is shorter than 32 characters;
+    - `proxied` when the request carried X-Forwarded-For, X-Real-IP or Forwarded (checked before the token);
+    - otherwise the `Bearer` value is compared in constant time, over sha256 digests with node:crypto timingSafeEqual.
+  - `ROUTE_CACHE_BASE = 'nitro:routes'`.
+  - `purgeRouteCache(storage)` takes any object with getKeys(base) and removeItem(key), removes every key under ROUTE_CACHE_BASE and returns the count.
+  - `parsePurgeEvent(body)` returns a kind (post, category or unknown) and a slug, with control characters removed and at most 200 characters.
+- `server/api/__journal__/cache/purge.post.ts`:
+  - `disabled` or `proxied` answers 404; `unauthorized` answers 401.
+  - Otherwise it runs `purgeRouteCache(useStorage('cache'))` and logs one console.info line: `[journal] cache purge: removed <n> route cache entries (<kind> <slug>)`.
+  - It sets `cache-control: no-store` and returns `{ purged }`.
+- `testing/fixture-api.mjs`: add `reload()` to the returned object. It re-reads the JSON fixtures; existing behaviour is unchanged.
+- New `testing/purge-check.mjs` is plain .mjs with JSDoc, so it runs from node_modules like smoke-ssr.mjs. Arguments: `--output <.output> --fixtures <dir> --kind post|category --slug <slug> --path <page path>`. Steps:
+  1. Copy the fixtures to a temp directory and start the fixture API on it.
+  2. Start the built server with a random 48-hex-character `NUXT_JOURNAL_CACHE_PURGE_TOKEN`.
+  3. GET the path (200).
+  4. Append a unique marker paragraph to the entity in the temp fixture (post: content and content_html; category: content) and reload the API.
+  5. GET again and require the marker to be absent. This proves the page is route-cached; if the marker shows, fail with a message about missing swr route rules.
+  6. POST the purge with the token and the contract body. Require 200 and purged >= 1.
+  7. GET again and require the marker.
+  8. POST without a token (401), with a wrong token (401), and with the right token plus X-Forwarded-For (404).
+  9. Print the last line as `purge-check: ok (<n> checks)`.
+- `.playground/nuxt.config.ts`: add `routeRules: { '/**': { swr: 300 } }` so the playground caches like a real host.
+
+Commit as feat(...) in each repository, staged by explicit path. Task 2 adds the READMEs.</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -timeout 15m -run '^TestCategoriesAdminPurgesSiteCache$' -v . 2&gt;&amp;1 | grep -- '^--- PASS: TestCategoriesAdminPurgesSiteCache'</automated>
+    <fails_when>Non-zero exit or no PASS line: vet fails, the harness cannot start PostgreSQL, the PUT sends no purge or more than one, the request lacks the Bearer token or body, or the receiver read the old content (the purge ran before the commit).</fails_when>
+    <automated>pnpm -C ../vue-journal-layer run build:playground &amp;&amp; node ../vue-journal-layer/testing/purge-check.mjs --output ../vue-journal-layer/.playground/.output --fixtures ../vue-journal-layer/testing/fixtures/acme --kind post --slug hello-acme --path /blog/hello-acme | tail -1 | grep '^purge-check: ok'</automated>
+    <fails_when>Non-zero exit or the last line does not start with "purge-check: ok": the playground build fails, the page is not route-cached, the authorized purge does not answer 200 with purged of at least 1, the page still lacks the marker after the purge, or an unauthenticated, wrong-token or proxied purge is accepted.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func PurgeSiteCacheAfterCommit" ../sm-journal-plugin/classes/site_cache.go` and `grep -n "func TestCategoriesAdminPurgesSiteCache" ../sm-journal-plugin/site_cache_admin_test.go` each print one line.
+    - `grep -n "cache: false" ../vue-journal-layer/nuxt.config.ts` and `grep -n "purgeRouteCache" ../vue-journal-layer/server/api/__journal__/cache/purge.post.ts` each print at least one line.
+    - Both verify commands pass.
+  </acceptance_criteria>
+  <done>One category admin update sends one authorized purge after its commit, and on a built swr site a cached page shows a content change on the first request after that purge; unauthenticated, wrong-token and proxied purges are refused.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Expansion: every admin post and category write purges, boot validates the config, browsers revalidate route-cached pages; READMEs, host app and deploy files</name>
+  <files>../sm-journal-plugin/classes/site_cache.go, ../sm-journal-plugin/plugin.go, ../sm-journal-plugin/controllers/posts.go, ../sm-journal-plugin/controllers/categories.go, ../sm-journal-plugin/controllers/admin_registry.go, ../sm-journal-plugin/site_cache_admin_test.go, ../sm-journal-plugin/README.md, ../vue-journal-layer/app/utils/siteCache.ts, ../vue-journal-layer/server/plugins/journal-revalidate.ts, ../vue-journal-layer/testing/purge-check.mjs, ../vue-journal-layer/README.md, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md, ../sm-grzybyfunkcjonalne-app/deploy/env.example, ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example, ../sm-grzybyfunkcjonalne-app/DEPLOY.md, ../sm-grzybyfunkcjonalne-app/README.md</files>
+  <read_first>The Task 1 files; ../sm-journal-plugin/controllers/posts.go (FormAfterCreate, FormAfterUpdate, writeContentHTMLTranslations, FormBeforeDelete); ../sm-journal-plugin/controllers/admin_registry.go; ../sm-journal-plugin/README.md (section order: Overview, Features, Usage, API reference, CLI commands, Dependencies, Testing); the nitropack runtime (dist/runtime/internal/cache.mjs: the cache-control the cached handler writes; h3 handleCacheHeaders: the 304 answer and its cache-control); ../vue-journal-layer/README.md (Configuration, Testing); ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md (Configuration: routeRules bullet and the env table) and nuxt.config.ts (routeRules comment); ../sm-grzybyfunkcjonalne-app/deploy/env.example; ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example; ../sm-grzybyfunkcjonalne-app/DEPLOY.md (Overview, First install, Release); ../sm-grzybyfunkcjonalne-app/README.md (Ports and environment); ../sm-grzybyfunkcjonalne-app/deploy/nginx/grzybyfunkcjonalne-staging.conf (location / with limit_except GET HEAD and X-Forwarded-For)</read_first>
+  <action>Expand from the proven slice (G-16.2-2, D-19).
+
+sm-journal-plugin:
+
+- Hooks:
+  - posts.go: FormAfterCreate and FormAfterUpdate call `PurgeSiteCacheAfterCommit` with kind `post` and the post's slug, after writeContentHTMLTranslations succeeds. Add a new FormAfterDelete that does the same.
+  - categories.go: add FormAfterCreate and FormAfterDelete (kind `category`).
+  - An untouched update (D-03) still purges. That is harmless, because the stored bytes are unchanged.
+  - Add compile-time assertions for the new hooks in admin_registry.go.
+  - Tags, the posts import action and the public write API (D-09) do not purge. They are outside the decision, which names admin post and category saves.
+- `NewSiteCachePurger` rules. Boot fails loudly and the error names the key:
+  - only one of url and token is set;
+  - the URL does not parse with an http or https scheme and a host, or it has user info or a fragment;
+  - an http URL whose host is not loopback (127.0.0.0/8, ::1 or localhost), because the bearer token would cross the network in clear;
+  - a token shorter than 32 characters (the layer's minimum).
+  When the purger is enabled, log one Info line at Boot with only the URL's host and path.
+- `site_cache_admin_test.go`: a `TestPostsAdminPurgesSiteCache` smoke test, in which an edited post PUT sends one purge with kind post after the commit.
+- `README.md`: a new "Configuration" section between Usage and API reference. It covers:
+  - the two keys and their env names;
+  - the request contract;
+  - the after-commit timing and the 2 s timeout;
+  - that a purge never fails a save;
+  - which writes purge and which do not;
+  - that the receiver is the host's Nuxt app built on vue-journal-layer.
+  Use neutral names only. The Testing section names the new tests.
+
+vue-journal-layer:
+
+- `app/utils/siteCache.ts` gains `privateRevalidate(cacheControl: string): string`. For a value that contains `s-maxage`, it sets `max-age=0`: it replaces any `max-age=<n>` or prepends `max-age=0`. Other values are returned unchanged.
+- New `server/plugins/journal-revalidate.ts` is a Nitro plugin. Its request hook wraps that request's `event.node.res.setHeader`, so every cache-control value passes through privateRevalidate.
+  - Why: Nitro's route cache answers 200 with `s-maxage=<n>, stale-while-revalidate`, which gives browsers no max-age, so they apply heuristic freshness from Last-Modified.
+  - h3 answers a 304 with `public, max-age=<n>, s-maxage=<n>` and ends the response itself, so a beforeResponse hook cannot change it. After one 304, a browser could keep its copy for the whole TTL, past any purge.
+  - Static assets carry no s-maxage and are untouched.
+- `testing/purge-check.mjs` adds these checks:
+  - After the purge, the page's cache-control contains max-age=0 and s-maxage.
+  - A GET with `If-None-Match: <the new ETag>` answers 304, and its cache-control contains max-age=0.
+  - When `<path>/_payload.json` answered 200 before the change, it carries the marker after the purge.
+  - A second purge after the page was re-cached also reports purged >= 1, which shows the route itself is never cached.
+  - A second server start without the token answers 404 to a POST that carries any token.
+- `README.md`:
+  - A runtime config row for `runtimeConfig.journal.cachePurgeToken` / `NUXT_JOURNAL_CACHE_PURGE_TOKEN`.
+  - A "Site cache purge" section covering:
+    - the route and the request contract;
+    - the guards: POST only; 404 without a token of at least 32 characters or behind a proxy; 401 on a wrong token; never route-cached;
+    - what it removes: every Nitro route-cache entry (pages, _payload.json, feeds), and why;
+    - browser revalidation;
+    - deployment: the reverse proxy must not forward POST to Nuxt; the purge clears the cache storage of the process that answers, so a multi-process server needs a shared cache storage driver.
+  - Testing mentions purge-check.mjs.
+  - Neutral names only.
+
+Site app (../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app; commit locally, Task 5 pushes):
+
+- In README.md, the routeRules bullet says that admin saves of Journal posts and categories purge the route cache. The env table gains a `NUXT_JOURNAL_CACHE_PURGE_TOKEN` row.
+- The routeRules comment in nuxt.config.ts says the same. The routeRules themselves do not change.
+- Commit as docs(...). The layer pin waits for the tag (Task 5).
+
+Host (../sm-grzybyfunkcjonalne-app; commit locally, Task 5 pushes):
+
+- `deploy/env.example`: add the lines `SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_URL=http://127.0.0.1:3016/api/__journal__/cache/purge` and `SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN=`, with a comment: the same value as NUXT_JOURNAL_CACHE_PURGE_TOKEN in nuxt/.env, generated on the server.
+- `deploy/nuxt.env.example`: add `NUXT_JOURNAL_CACHE_PURGE_TOKEN=` with the comment, and correct the header sentence that says the file holds no secrets.
+- `DEPLOY.md`:
+  - First install: a bullet for the shared token.
+  - Overview: the Go to Nuxt purge.
+  - Release: replace "The Nuxt page caches (swr) expire by themselves." with how admin saves purge them and the on-server purge check from Task 5. Note that the vhost's `limit_except GET HEAD` keeps the route off the public path; check-deploy.sh already requires it.
+- `README.md`: the "Ports and environment" table lists the new variables.
+- Commit as docs(deploy): ...</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -timeout 15m -run '^(TestCategoriesAdminPurgesSiteCache|TestPostsAdminPurgesSiteCache)$' -v . 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 2</automated>
+    <fails_when>Non-zero exit: vet or an existing classes or controllers test fails, or fewer than two PASS lines (a post or category save path does not purge after commit).</fails_when>
+    <automated>npm --prefix ../vue-journal-layer test 2&gt;&amp;1 | grep -E '^# fail 0$' &amp;&amp; pnpm -C ../vue-journal-layer run build:playground &amp;&amp; node ../vue-journal-layer/testing/purge-check.mjs --output ../vue-journal-layer/.playground/.output --fixtures ../vue-journal-layer/testing/fixtures/acme --kind post --slug hello-acme --path /blog/hello-acme | tail -1 | grep '^purge-check: ok'</automated>
+    <fails_when>Non-zero exit or a missing line: a layer unit test fails, or purge-check fails a check (purge, guards, max-age=0 on 200 and 304, payload marker, second purge, disabled server).</fails_when>
+    <automated>S=$(mktemp -d) &amp;&amp; rsync -a --exclude node_modules --exclude .output --exclude .nuxt ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/ "$S/app/" &amp;&amp; printf 'overrides:\n  vue-journal-layer: link:%s\n' "$(cd ../vue-journal-layer &amp;&amp; pwd)" &gt;&gt; "$S/app/pnpm-workspace.yaml" &amp;&amp; pnpm -C "$S/app" install --no-frozen-lockfile &amp;&amp; pnpm -C "$S/app" build &amp;&amp; node ../vue-journal-layer/testing/purge-check.mjs --output "$S/app/.output" --fixtures ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/tests/fixtures/api --kind category --slug cordyceps --path /cordyceps | tail -1 | grep '^purge-check: ok'</automated>
+    <fails_when>Non-zero exit or no "purge-check: ok": the host app, built in a scratch copy against the local layer (nothing in the real app checkout changes), does not purge its root-level category page /cordyceps under its own route rules.</fails_when>
+    <automated>grep -c 'SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN' ../sm-grzybyfunkcjonalne-app/deploy/env.example ../sm-grzybyfunkcjonalne-app/DEPLOY.md | grep -c ':0$' | grep -qx 0 &amp;&amp; grep -q 'NUXT_JOURNAL_CACHE_PURGE_TOKEN' ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example &amp;&amp; grep -q 'NUXT_JOURNAL_CACHE_PURGE_TOKEN' ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/README.md &amp;&amp; grep -q 'NUXT_JOURNAL_CACHE_PURGE_TOKEN' ../vue-journal-layer/README.md &amp;&amp; grep -q 'site_cache.purge_url' ../sm-journal-plugin/README.md &amp;&amp; echo docs-ok</automated>
+    <fails_when>Non-zero exit or no docs-ok: a deploy template, DEPLOY.md, the app README, the layer README or the Journal README does not name its new setting.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - posts.go and categories.go each implement FormAfterCreate, FormAfterUpdate and FormAfterDelete (`grep -cE "func \(.*\) FormAfter(Create|Update|Delete)\(" ` prints 3 for each file), each reaching PurgeSiteCacheAfterCommit (`grep -c "PurgeSiteCacheAfterCommit"` prints at least 1 for each file; Task 3's Postgres tests prove all six paths).
+    - `grep -n "privateRevalidate" ../vue-journal-layer/server/plugins/journal-revalidate.ts` prints at least one line.
+    - All four verify commands pass; the real vue-grzybyfunkcjonalne-app checkout has no pnpm-workspace override and its package.json still pins #v0.2.0 (`git -C ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app diff --quiet -- package.json pnpm-lock.yaml pnpm-workspace.yaml`).
+  </acceptance_criteria>
+  <done>Every admin post and category write purges after its commit, misconfiguration fails at boot, route-cached pages tell browsers to revalidate, the host app purges its own category page in a scratch build, and the READMEs and deploy files describe the setting.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Tests: G-16.2-1 conformance cases, Docker-free inventory and the stale Journal assertion; full coverage of the purge; gate stages; full gate green including postgres</name>
+  <precondition>`docker info` exits 0 on this machine.</precondition>
+  <files>modules/cabana/openapi_conformance_test.go, scripts/check-phase16.2.sh, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md, ../sm-journal-plugin/plugin_test.go, ../sm-journal-plugin/classes/site_cache_test.go, ../sm-journal-plugin/site_cache_admin_test.go, ../vue-journal-layer/tests/siteCache.test.ts</files>
+  <read_first>.planning/debug/postgres-gate-field-types-conformance.md (Evidence and suggested_fix_direction); modules/cabana/openapi_conformance_test.go (conformCase, TestPhase10OpenAPIConformance with the coverage loop near line 400, conformEnv helpers upload/send/assertPluginAsset, newConformEnv, conformGadget, conformPlugin, conformFS and the gadget fields.yaml); modules/cabana/export_test.go (AdminAPIRoutes); modules/cabana/field_type.go (FieldTypeAssets, FieldTypesResponse, FieldUploadResponse, compileFieldTypes rules); modules/cabana/field_type_upload.go; modules/pact/capabilities.go (FormFieldType, FormFieldUpload, FormFieldUploadResult, HasFormFieldTypes); admin/openapi/admin.json (both routes); scripts/check-phase16.2.sh (all of it); ../sm-journal-plugin/plugin_test.go (TestJournalSVGEmbed); ../sm-journal-plugin/models/post/fields.yaml; the Task 1 and Task 2 Go and layer files; ../vue-journal-layer/tests/routes.test.ts (node --test style); .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md (line 24 and the field_type_upload.go section); .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md (Per-Task Verification Map)</read_first>
+  <behavior>
+    - Inventory (no database): every inventoried admin route has exactly one conformance case; a missing, extra or duplicate key fails with all offending keys listed in sorted order; the test passes under -short with no Docker.
+    - GET /field-types: 200; the body decodes into cabana.FieldTypesResponse with unknown fields disallowed; admin.json documents cabana.FieldTypesResponse; the fixture type is listed with its element and a script URL that serves with ETag and the ?v= hash.
+    - Field upload: a multipart part named file to the fixture field answers 201; the body decodes into cabana.Envelope[cabana.FieldUploadResponse]; admin.json documents cabana.Envelope-cabana_FieldUploadResponse; the existing create, update and show cases still pass with the plugin-typed field on the gadget form.
+    - TestJournalSVGEmbed: post content is `type: mlblogeditor` with `htmlColumn: content_html`.
+    - NewSiteCachePurger table: both empty gives disabled; only URL or only token, a bad scheme, no host, user info, a fragment, http to a non-loopback host and a 31-character token are each refused with the key in the error; https to any host, and http to 127.0.0.1, ::1 and localhost with a 32-character token are accepted.
+    - Purge request: POST, the configured path, the Bearer token, the JSON content type and body; an Info log with purged from the answer; a 500 and a 401 answer each give one Warn line; a receiver slower than the timeout returns within about 2 s; a cancelled parent context still sends; no captured log line contains the token; a nil purger sends nothing.
+    - Categories on Postgres: create, update and delete each send one purge with kind category after the commit; a failed update (validation 422) sends none.
+    - Posts on Postgres: create, an untouched update (content and content_html still byte-identical, D-03) and delete each send one purge with kind post; with the receiver answering 500, and with no receiver listening, the save still answers 200 and the row is saved; a failed save sends none.
+    - Layer (node --test, exact names): "purge auth: a missing or short token disables the route", "purge auth: a proxied request is refused before the token is checked", "purge auth: a missing or wrong bearer token is unauthorized", "purge removes every route cache entry and only those"; plus parsePurgeEvent cases (kinds, control characters, 200-character cap, non-object bodies) and privateRevalidate cases (s-maxage with and without max-age, the 304 form "public, max-age=300, s-maxage=300", a static "public, max-age=31536000, immutable" unchanged, an empty value unchanged).
+  </behavior>
+  <action>Write the tests in the behavior block, close G-16.2-1, extend the gate and run it in full.
+
+summercms.go (G-16.2-1, per D-13 and D-18):
+
+- Move the case list of TestPhase10OpenAPIConformance into a package-level `conformCases() []conformCase`. The closures already take the env as a parameter.
+- Add `checkConformInventory(t *testing.T, cases []conformCase)`. It reports every missing key in sorted order, plus every extra or duplicate key, in one failure.
+- The new `TestPhase10ConformanceInventory` calls it with no database. TestPhase10OpenAPIConformance calls it before newConformEnv, so the static check can no longer hide behind the testcontainers setup.
+- Add the two cases.
+  - GET /field-types: status 200, ref `cabana.FieldTypesResponse`, decode `into[cabana.FieldTypesResponse]()`. The call asserts the fixture type is listed and checks its script with `e.assertPluginAsset`.
+  - POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload: status 201, ref `cabana.Envelope-cabana_FieldUploadResponse`, decode `into[cabana.Envelope[cabana.FieldUploadResponse]]()`. Send a multipart part named `file` with the requireAjax header to the gadget's fixture field. Use an id the route accepts: 0 for a new record, or a gadget created earlier in the case list.
+- Fixture changes:
+  - conformPlugin implements `pact.HasFormFieldTypes` with one type: an alias such as `conformnote`, an element under the `acme-conform-` widget tag prefix, a script already in conformFS, Decode returning the string, Load returning the stored value, and Upload returning a URL.
+  - conformGadget gets a nullable `note` column, and the gadget fields.yaml gets a `note` field of that type.
+  - The existing create, update and show cases now Decode and Load the note; keep them passing.
+- `scripts/check-phase16.2.sh`:
+  - FRAMEWORK_RUN and FRAMEWORK_REQUIRE gain TestPhase10ConformanceInventory.
+  - JOURNAL_REQUIRE gains TestSiteCachePurgeConfig and TestSiteCachePurgeRequest.
+  - PG_FRAMEWORK_REQUIRE gains TestPhase10OpenAPIConformance.
+  - PG_JOURNAL_REQUIRE gains TestCategoriesAdminPurgesSiteCache and TestPostsAdminPurgesSiteCache.
+  - LAYER_REQUIRE gains the four layer test names.
+  - Add a new stage `cache`. Wire it into usage, the case statement (cache and --cache), run_all after layer, and the self-test mode loop.
+    - It runs `pnpm -C "$LAYER" run build:playground`.
+    - It runs purge-check on the playground (post hello-acme at /blog/hello-acme) and fails unless the last line starts with "purge-check: ok".
+    - Then it runs the acme SSR smoke against the same build: `node "$LAYER/testing/smoke-ssr.mjs" --output "$LAYER/.playground/.output" --fixtures "$LAYER/testing/fixtures/acme" --expect "$LAYER/testing/expect-acme.txt"`.
+  - Update the header comment for the new stage and names.
+
+sm-journal-plugin:
+
+- In `plugin_test.go`, TestJournalSVGEmbed asserts `type: mlblogeditor` and `htmlColumn: content_html` for post content. This is the intended 16.2-03 change (D-08); no other assertion changes.
+- `classes/site_cache_test.go`: TestSiteCachePurgeConfig and TestSiteCachePurgeRequest. Capture logs with a slog handler on a buffer; use httptest.
+- Extend `site_cache_admin_test.go` as the behavior block lists. The receiver records requests and can answer 500. To test the "nothing listening" case, close it before the save.
+
+vue-journal-layer:
+
+- `tests/siteCache.test.ts` uses node --test with erasable TypeScript only and the exact names above. Use a fake storage whose keys include nitro:routes entries and other cache groups.
+
+Docs (summercms.go, one separate docs(16.2) commit):
+
+- 16.2-PATTERNS.md: name `modules/cabana/openapi_conformance_test.go` (one conformCase per new admin route; TestPhase10ConformanceInventory enforces it without Docker) in two places. First, the `admin_openapi.go` table row. Second, the sentence of the field_type_upload.go section that lists admin_openapi.go and phase09Routes.
+- 16.2-VALIDATION.md: add the 16.2-07-T1 to T6 rows to the per-task map, with their commands, and move the Docker-host suites from Manual-Only to automated.
+
+Then run `PHASE162_REQUIRE_POSTGRES=1 bash scripts/check-phase16.2.sh --all`. If a suite exposes a production defect, fix it in a separate fix(...) commit with its own test, and name it in the SUMMARY. Commit tests per repository as test(...) commits, and the gate as "test(16.2-07): ...", staged by explicit path.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -short -run '^TestPhase10ConformanceInventory$' -v ./modules/cabana 2&gt;&amp;1 | grep -- '^--- PASS: TestPhase10ConformanceInventory'</automated>
+    <fails_when>No PASS line: the inventory test needs a database (it must pass under -short), or an inventoried route still has no conformance case.</fails_when>
+    <automated>go test -count=1 -timeout 15m -run '^TestPhase10OpenAPIConformance$' -v ./modules/cabana 2&gt;&amp;1 | grep -- '^--- PASS: TestPhase10OpenAPIConformance'</automated>
+    <fails_when>No PASS line: a case fails its status, its decode with unknown fields disallowed, or the admin.json ref, including the two new cases.</fails_when>
+    <automated>L=$(mktemp) &amp;&amp; { PHASE162_REQUIRE_POSTGRES=1 bash scripts/check-phase16.2.sh --all &gt; "$L" 2&gt;&amp;1; grep -qx 'PASS postgres' "$L" &amp;&amp; grep -qx 'PASS cache' "$L" &amp;&amp; tail -1 "$L" | grep -qx 'Phase 16.2 gate passed'; }</automated>
+    <fails_when>Non-zero exit: any stage fails (self-test, go, admin, editor, layer, cache, docs, postgres), a required test is missing by name, or the last line is not exactly "Phase 16.2 gate passed". This includes the UAT Test 1 suites and TestJournalSVGEmbed in the postgres stage.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func TestPhase10ConformanceInventory" modules/cabana/openapi_conformance_test.go` prints one line; `grep -c "TestPhase10ConformanceInventory" scripts/check-phase16.2.sh` prints at least 2 (run regex and required list).
+    - `grep -n "fields/{field}/upload" modules/cabana/openapi_conformance_test.go` and `grep -n '"GET /field-types"' modules/cabana/openapi_conformance_test.go` each print at least one line.
+    - `grep -n "openapi_conformance_test.go" .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md` prints at least two lines.
+    - `grep -n "type: mlblogeditor" ../sm-journal-plugin/plugin_test.go` prints at least one line.
+    - The three verify commands pass; the gate log (in the SUMMARY) shows PASS for every stage, including postgres and cache.
+  </acceptance_criteria>
+  <done>The gate's postgres stage is green on this Docker host, the route-coverage invariant is enforced without Docker, and the purge has full unit and Postgres coverage in the fail-closed gate.</done>
+</task>
+
+<task type="checkpoint:decision" gate="blocking-human">
+  <name>Task 4: Release gate: clean trees, tags chosen, UAT state read, a human approves the pushes, the tags and the UAT deploy (with the server-generated purge token)</name>
+  <read_first>../sm-grzybyfunkcjonalne-app/DEPLOY.md (Build and upload, Release, Smoke, Rollback); .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md (deviations: Nuxt rollback path, log anchor); .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW-FIX.md and 16.2-SECURITY.md when present; the Task 3 gate log</read_first>
+  <action>Do every automatable check, print a release sheet, then stop.
+
+1. Concurrency. Each repository must be clean with nothing missing from origin:
+   - summercms.go master: `git status --porcelain -- modules admin docs scripts cmd` prints nothing.
+   - ../sm-journal-plugin main, ../vue-journal-layer main, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app main and ../sm-grzybyfunkcjonalne-app master: `git status --porcelain --untracked-files=no` prints nothing.
+   - In every repository, after `git fetch origin --tags`, `git log --oneline HEAD..origin/<branch>` prints nothing. If any origin has commits this checkout lacks, stop and report. Do not merge or rebase.
+2. Tags:
+   - summercms: propose the highest `v0.1.*` tag plus one, v0.1.20 unless someone tagged after v0.1.19. Confirm with `git ls-remote --tags origin` that it is absent.
+   - vue-journal-layer: propose v0.3.0 and confirm it is absent on origin.
+3. Read-only on UAT:
+   - The sha256 and mtime of `/srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne`.
+   - The count, never the value, of lines starting with SUMMER_GOLEM15__JOURNAL__SITE_CACHE__ in go/.env and NUXT_JOURNAL_CACHE_PURGE_TOKEN in nuxt/.env.
+   - The SELECTs of Task 6's posts and translations verify, compared with the 16.2-05 snapshot.
+   - The category 2 row as id:slug:md5(content):updated_at.
+4. The release sheet:
+   - the tags;
+   - the commits to push per repository (`git log --oneline origin/<branch>..HEAD`, including planning-doc commits);
+   - the Task 3 gate result;
+   - every write on the server: the binary, Nuxt output, config/ and scripts/ uploads, the rollback copies, and two lines appended to go/.env and one to nuxt/.env, holding a token generated on the server that is never printed;
+   - the steps of DEPLOY.md "Release";
+   - the rollback: move go/bin/grzybyfunkcjonalne.prev and nuxt/.output.prev back and restart both programs. The appended .env lines are inert for the previous build;
+   - any open high finding from the review or security reports. An open high finding allows only hold.
+
+Then stop for the human.</action>
+  <decision>Push the branches and the tags summercms v0.1.20 and vue-journal-layer v0.3.0, generate the purge token on the server, and deploy to UAT now?</decision>
+  <context>A pushed tag is read by other repositories and the Go module proxy and cannot be moved, only superseded (v0.1.21, v0.3.1). The deploy writes the binary, the Nuxt output and two env files on the UAT server, next to the live Winter site, which it does not touch. Task 3 ran the full gate including the Docker suites on this machine.</context>
+  <options>
+    <option id="release">
+      <name>Release and deploy now</name>
+      <pros>UAT gets the v0.1.19 review fixes plus the purge; Tests 3 and 2 can be re-run at once; rollback is two moves and a restart</pros>
+      <cons>Two tags are published; a later defect needs the next tags</cons>
+    </option>
+    <option id="hold">
+      <name>Hold</name>
+      <pros>Nothing leaves this machine</pros>
+      <cons>UAT keeps the 12:37 build without the review fixes; Tests 2 and 3 stay open</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "release" (with any tag change, for example "release v0.1.21") or "hold".</resume-signal>
+  <verify>
+    <automated>bash scripts/check-phase16.2.sh --self-test &amp;&amp; test -z "$(git status --porcelain -- modules admin docs scripts cmd)" &amp;&amp; test -z "$(git ls-remote --tags origin refs/tags/v0.1.20)" &amp;&amp; test -z "$(git -C ../vue-journal-layer ls-remote --tags origin refs/tags/v0.3.0)" &amp;&amp; echo release-gate-ok</automated>
+    <fails_when>Non-zero exit or no release-gate-ok: the gate self-test fails, summercms.go has uncommitted framework changes, or a proposed tag already exists on origin (then propose the next free tag and record it).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The SUMMARY records the release sheet and the human's reply verbatim.
+  </acceptance_criteria>
+  <done>A human chose release with named tags, or hold (the plan stops).</done>
+</task>
+
+<task type="auto">
+  <name>Task 5: Release and deploy: tags, pushes, layer pin, host bumps, build, UAT deploy with the server-generated purge token, smoke and an on-server purge check; snapshot for Task 6</name>
+  <reversibility rating="one-way">Annotated tags summercms v0.1.20 and vue-journal-layer v0.3.0 are read by other repositories' go.mod and package.json; they can only be superseded.</reversibility>
+  <precondition>Task 4 was answered "release" (RELEASE_TAG and LAYER_TAG set in the session, default v0.1.20 and v0.3.0) and `ssh grzybyfunkcjonalne-uat true` exits 0.</precondition>
+  <files>../sm-journal-plugin/go.mod, ../vue-journal-layer/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/pnpm-lock.yaml, ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal, ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app</files>
+  <read_first>../sm-grzybyfunkcjonalne-app/DEPLOY.md (Build and upload, Release, Smoke); ../sm-grzybyfunkcjonalne-app/scripts/build.sh; ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh; ../vue-journal-layer/scripts/check-git-install.sh; .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md (Deploy, Follow-up deploy, deviations); the Task 4 release sheet in this plan's SUMMARY</read_first>
+  <action>Run the release in this order. Re-check before each push that `git log --oneline HEAD..origin/<branch>` prints nothing.
+
+1. **Framework.** `git tag -a "$RELEASE_TAG"` on summercms.go master HEAD with the message "$RELEASE_TAG: conformance cases for the field types and field upload routes, Docker-free route inventory check, phase 16.2 gate with the site cache purge". Then `git push origin master` and `git push origin "$RELEASE_TAG"`.
+2. **Plugin.** `go -C ../sm-journal-plugin mod edit -require=git.golem15.com/golem15/summercms@$RELEASE_TAG`. The replace stays, so the require is nominal. Run `go -C ../sm-journal-plugin vet ./...`, commit go.mod only as "chore(deps): require summercms $RELEASE_TAG", then `git -C ../sm-journal-plugin push origin main`.
+3. **Layer.**
+   - Set package.json version 0.3.0 and commit "chore: release v0.3.0".
+   - `git -C ../vue-journal-layer tag -a v0.3.0` with the message "v0.3.0: token-protected site cache purge route (POST /api/__journal__/cache/purge) and browser revalidation of route-cached pages".
+   - Push main and the tag.
+   - `bash ../vue-journal-layer/scripts/check-git-install.sh v0.3.0`. Run it from a directory outside any vue-journal-layer directory.
+4. **Site app** (../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app).
+   - Change the pin to `git+https://git.golem15.com/golem15/vue-journal-layer.git#v0.3.0`. Run `pnpm install` (the lockfile must record the tag's commit), then `pnpm build` and `pnpm test`.
+   - Run `node node_modules/vue-journal-layer/testing/purge-check.mjs --output .output --fixtures tests/fixtures/api --kind category --slug cordyceps --path /cordyceps`. It must end with "purge-check: ok".
+   - Commit package.json and pnpm-lock.yaml as "chore(deps): vue-journal-layer v0.3.0 (site cache purge on Journal saves)" and push main together with the Task 2 docs commit.
+5. **Host** (../sm-grzybyfunkcjonalne-app).
+   - In plugins/golem15/journal, fetch origin and check out the sm-journal-plugin main just pushed. In vue-grzybyfunkcjonalne-app, check out the main just pushed.
+   - Commit both gitlinks as "chore: bump journal plugin and the site app (site cache purge on admin saves)".
+   - Push master, which also pushes the Task 2 deploy-docs commit.
+6. **Build.** Run `bash ../sm-grzybyfunkcjonalne-app/scripts/check-deploy.sh`, then `bash ../sm-grzybyfunkcjonalne-app/scripts/build.sh`. Record the local sha256 of bin/grzybyfunkcjonalne.
+7. **Release on the server**, per DEPLOY.md "Release" with the 16.2-05 corrections.
+   - Remove the old nuxt/.output.prev, then `cp -a nuxt/.output nuxt/.output.prev`.
+   - rsync the binary to go/bin/grzybyfunkcjonalne.new, plus config/, scripts/ and build/nuxt/.output/, exactly as DEPLOY.md "Build and upload" lists. Never upload a local .env.
+   - Compare the sha256 of the .new binary with the local one.
+   - `cp -p bin/grzybyfunkcjonalne bin/grzybyfunkcjonalne.prev`, then move the .new binary into place.
+8. **Purge token, on the server, idempotent and never printed.**
+   - If go/.env has no line starting with SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN=:
+     - generate T on the server from 32 bytes of /dev/urandom, base64 with `+/` mapped to `-_` and `=` and newlines removed;
+     - append `SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_URL=http://127.0.0.1:3016/api/__journal__/cache/purge` and `SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN=$T` to go/.env, and `NUXT_JOURNAL_CACHE_PURGE_TOKEN=$T` to nuxt/.env, with printf builtins.
+   - If only one file has its line, stop and report. Never echo T.
+   - Both files stay mode 0600.
+9. **Start.**
+   - Run `bin/grzybyfunkcjonalne migrate`; it must exit 0.
+   - Record RESTART_UTC as the server's `date -u +%Y-%m-%dT%H:%M:%SZ`.
+   - `sudo supervisorctl restart grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt`.
+   - Record LOG_ANCHOR, the `client_id=` value of the River line the Go restart logged in /var/log/supervisor/grzybyfunkcjonalne-go.log.
+   - Run the smoke (first verify).
+10. **Checks.** Run the deploy, token and purge verifies. On any failure: move go/bin/grzybyfunkcjonalne.prev and nuxt/.output.prev back, restart both programs and report.
+11. **Snapshot for Task 6** (read-only SELECTs, kept in the session and the SUMMARY).
+    - The posts and translations SELECTs of Task 6's first and third verify. They must already equal the expected rows; if they differ, report it, because the data changed since 16.2-05.
+    - posts 1 and 64 as id:updated_at.
+    - category 2 as id:slug:md5(coalesce(content,'')):updated_at.</action>
+  <verify>
+    <automated>ssh grzybyfunkcjonalne-uat 'C=$(mktemp -d); printf "resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n" &gt; "$C/.curlrc"; cd /srv/grzybyfunkcjonalne/go &amp;&amp; CURL_HOME="$C" scripts/smoke.sh --url https://uat.grzybyfunkcjonalne.pl; rc=$?; rm -rf "$C"; exit $rc' | grep '^smoke: ok ('</automated>
+    <fails_when>Non-zero exit or no line starting with "smoke: ok (": a smoke URL failed on the server.</fails_when>
+    <automated>test "$(sha256sum ../sm-grzybyfunkcjonalne-app/bin/grzybyfunkcjonalne | cut -d' ' -f1)" = "$(ssh grzybyfunkcjonalne-uat 'sha256sum /srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne' | cut -d' ' -f1)" &amp;&amp; ssh grzybyfunkcjonalne-uat 'sudo supervisorctl status grzybyfunkcjonalne-go grzybyfunkcjonalne-nuxt' | grep -c RUNNING | grep -qx 2 &amp;&amp; test -n "$(git ls-remote --tags origin "refs/tags/$RELEASE_TAG")" &amp;&amp; test -n "$(git -C ../vue-journal-layer ls-remote --tags origin refs/tags/v0.3.0)" &amp;&amp; grep -q 'vue-journal-layer.git#v0.3.0' ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json &amp;&amp; ssh grzybyfunkcjonalne-uat 'test -x /srv/grzybyfunkcjonalne/go/bin/grzybyfunkcjonalne.prev &amp;&amp; test -d /srv/grzybyfunkcjonalne/nuxt/.output.prev' &amp;&amp; echo deploy-ok</automated>
+    <fails_when>Non-zero exit or no deploy-ok: the server binary differs from the local build, fewer than two programs are RUNNING, a tag is missing on origin, the app does not pin v0.3.0, or a rollback copy is missing.</fails_when>
+    <automated>ssh grzybyfunkcjonalne-uat 'cd /srv/grzybyfunkcjonalne &amp;&amp; test "$(grep -c "^SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN=" go/.env)" = 1 &amp;&amp; test "$(grep -c "^NUXT_JOURNAL_CACHE_PURGE_TOKEN=" nuxt/.env)" = 1 &amp;&amp; test "$(grep -c "^SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_URL=http://127.0.0.1:3016/api/__journal__/cache/purge$" go/.env)" = 1 &amp;&amp; a=$(sed -n "s/^SUMMER_GOLEM15__JOURNAL__SITE_CACHE__PURGE_TOKEN=//p" go/.env) &amp;&amp; b=$(sed -n "s/^NUXT_JOURNAL_CACHE_PURGE_TOKEN=//p" nuxt/.env) &amp;&amp; test ${#a} -ge 32 &amp;&amp; test "$a" = "$b" &amp;&amp; echo token-match' | grep -qx token-match</automated>
+    <fails_when>No token-match: a line is missing or duplicated, the URL differs, the token is shorter than 32 characters, or the two files hold different values. Only the word token-match crosses the connection.</fails_when>
+    <automated>ssh grzybyfunkcjonalne-uat 'cd /srv/grzybyfunkcjonalne &amp;&amp; C=$(mktemp -d) &amp;&amp; printf "resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n" &gt; "$C/.curlrc" &amp;&amp; CURL_HOME="$C" curl -s -o /dev/null https://uat.grzybyfunkcjonalne.pl/cordyceps &amp;&amp; T=$(sed -n "s/^NUXT_JOURNAL_CACHE_PURGE_TOKEN=//p" nuxt/.env) &amp;&amp; printf "Authorization: Bearer %s\n" "$T" | curl -s -o "$C/p.json" -w "%{http_code}\n" -X POST -H @- -H "Content-Type: application/json" --data "{\"kind\":\"category\",\"slug\":\"cordyceps\"}" http://127.0.0.1:3016/api/__journal__/cache/purge &amp;&amp; grep -oE "\"purged\": *[0-9]+" "$C/p.json" | grep -oE "[0-9]+$" &amp;&amp; CURL_HOME="$C" curl -s -o /dev/null -w "%{http_code}\n" -X POST https://uat.grzybyfunkcjonalne.pl/api/__journal__/cache/purge &amp;&amp; curl -s -o /dev/null -w "%{http_code}\n" -X POST http://127.0.0.1:3016/api/__journal__/cache/purge; rm -rf "$C"' | paste -sd' ' | grep -Eq '^200 [1-9][0-9]* 403 401$' &amp;&amp; echo purge-ok</automated>
+    <fails_when>No purge-ok: the authorized loopback purge (token read on the server and passed to curl on stdin) does not answer 200 with purged of at least 1 after the category page was cached, a POST through nginx is not refused with 403, or a loopback POST without a token is not refused with 401.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `git -C ../sm-journal-plugin rev-parse main` equals its origin/main and its go.mod requires summercms at RELEASE_TAG; ../vue-journal-layer main equals origin/main and package.json says 0.3.0; check-git-install.sh v0.3.0 passed.
+    - `git -C ../sm-grzybyfunkcjonalne-app ls-files -s plugins/golem15/journal vue-grzybyfunkcjonalne-app` shows the pushed heads and the host master equals origin/master.
+    - The four verify commands print their markers.
+    - The SUMMARY records both tags, every pushed head, both sha256 values, RESTART_UTC, LOG_ANCHOR, the snapshot rows, and no credential or token.
+  </acceptance_criteria>
+  <done>UAT runs the released framework, plugin, layer and site from pushed tags and branches; the purge works on the server and is refused from outside; the pre-save snapshot is recorded.</done>
+</task>
+
+<task type="checkpoint:human-action" gate="blocking-human">
+  <name>Task 6: UAT re-run: Test 3 (untouched re-save of posts 1 and 64, D-03) and Test 2 (category edit visible on the next view, D-19)</name>
+  <precondition>Task 5 printed deploy-ok, token-match and purge-ok; RESTART_UTC, LOG_ANCHOR and the snapshot are set in the session and recorded in the SUMMARY.</precondition>
+  <read_first>.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-UAT.md (Tests 2 and 3); this plan's SUMMARY (snapshot, RESTART_UTC, LOG_ANCHOR)</read_first>
+  <action>Print the steps for the human and stop. The executor never asks for, receives or stores a credential.
+
+Human steps:
+
+1. Open https://uat.grzybyfunkcjonalne.pl/cordyceps in the browser. This view caches the page, as in the original failure.
+2. In /gfadmin/golem15/journal/posts, open post 1 (10-faktow-na-temat-cordycepsu) and post 64 (ekstrakt-z-turkey-tail). On each, press "Zapisz" without touching the editor. No removal notice may appear (Test 3, D-03).
+3. Open /gfadmin/golem15/journal/categories/2, change one word of the content and save. No removal notice may appear (D-10, D-19).
+4. Go straight back to the /cordyceps tab and view it again, both by reload and by the site menu link. The change must show on that first view (Test 2).
+5. Reply with the phrase as it reads after your edit, and whether you want the word changed back.
+
+After the reply, run the verify commands. Then fetch /cordyceps on the server, resolved to loopback, and count the reported phrase in it. The count must not be 0; record it in the SUMMARY. Mark Tests 2 and 3 for /msd-verify-work. If a check fails, report it and offer the rollback: move go/bin/grzybyfunkcjonalne.prev and nuxt/.output.prev back and restart both programs.</action>
+  <instructions>
+    Claude deployed v0.1.20 with the Journal site cache purge and vue-journal-layer v0.3.0, passed the smoke and an on-server purge check, and recorded a snapshot of posts 1 and 64 and category 2.
+    The human logs in to the UAT admin (basic-auth realm plus an admin account), does steps 1 to 5 and replies.
+  </instructions>
+  <verification>Read-only psql on the server compares the posts with the 16.2-05 snapshot and checks updated_at; the Go log after the restart anchor shows successful purges, including one for the category; the category page served on the server is not older than the category's updated_at and contains the human's phrase.</verification>
+  <resume-signal>Type "saved" with the phrase after the edit, or describe what went wrong.</resume-signal>
+  <verify>
+    <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT id || ':' || md5(content) || ':' || md5(content_html) FROM golem15_journal_posts WHERE id IN (1, 64) ORDER BY id\"" | diff - &lt;(printf '%s\n' 1:a026264105f900175b9770e637e5ec5c:a026264105f900175b9770e637e5ec5c 64:0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c) &amp;&amp; ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT string_agg(id || ':' || (updated_at &gt; '$RESTART_UTC'::timestamptz)::int, ' ' ORDER BY id) FROM golem15_journal_posts WHERE id IN (1, 64)\"" | grep -qx '1:1 64:1' &amp;&amp; echo posts-unchanged</automated>
+    <fails_when>No posts-unchanged: an untouched save changed content or content_html of post 1 or 64, or a post's updated_at did not move past RESTART_UTC (the save did not reach the database).</fails_when>
+    <automated>ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT model_id || ':' || locale || ':' || md5(coalesce(attribute_data, '')) FROM golem15_translate_attributes WHERE model_type LIKE 'Golem15_Journal_Models_Post' AND model_id IN ('1', '64') ORDER BY model_id, locale\"" | grep -qx '64:en:862fc5b362cc9856e6736a2078dca3ba' &amp;&amp; echo translations-unchanged</automated>
+    <fails_when>No translations-unchanged: the untouched saves added, removed or changed a translation row of posts 1 or 64.</fails_when>
+    <automated>S=$(mktemp -d) &amp;&amp; ssh grzybyfunkcjonalne-uat "F=/var/log/supervisor/grzybyfunkcjonalne-go.log; grep -q '$LOG_ANCHOR' \$F &amp;&amp; awk -v a='$LOG_ANCHOR' 'f{print} index(\$0,a){f=1}' \$F" &gt; "$S/go.log" &amp;&amp; grep 'journal: site cache purged' "$S/go.log" | grep 'kind=category' | grep -q 'status=200' &amp;&amp; test "$(grep -c 'journal: site cache purge' "$S/go.log")" = "$(grep -c 'journal: site cache purged' "$S/go.log")" &amp;&amp; grep -ciE 'panic|SQLSTATE' "$S/go.log" | grep -qx 0 &amp;&amp; ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT (updated_at &gt; '$RESTART_UTC'::timestamptz)::int FROM golem15_journal_categories WHERE id = 2\"" | grep -qx 1 &amp;&amp; echo category-purged</automated>
+    <fails_when>No category-purged: the restart anchor is gone from the log, there is no successful purge line for kind=category, any purge did not succeed, the Go log has an error line of those kinds after the restart, or category 2 was not saved after RESTART_UTC.</fails_when>
+    <automated>LM=$(ssh grzybyfunkcjonalne-uat 'C=$(mktemp -d); printf "resolve = uat.grzybyfunkcjonalne.pl:443:127.0.0.1\n" &gt; "$C/.curlrc"; CURL_HOME="$C" curl -s -o /dev/null -D - https://uat.grzybyfunkcjonalne.pl/cordyceps; rm -rf "$C"' | tr -d '\r' | sed -n 's/^last-modified: //Ip') &amp;&amp; UA=$(ssh grzybyfunkcjonalne-uat "psql -X -d grzybyfunkcjonalne -tAc \"SELECT extract(epoch FROM updated_at)::bigint FROM golem15_journal_categories WHERE id = 2\"") &amp;&amp; test -n "$LM" &amp;&amp; test "$(date -d "$LM" +%s)" -ge "$UA" &amp;&amp; echo category-fresh</automated>
+    <fails_when>No category-fresh: the /cordyceps page served on the server carries no Last-Modified, or it was rendered before category 2 was saved (a stale cache entry survived the save).</fails_when>
+    <human-check>Steps 1 to 4 above: no removal notice on any save, and the category edit shows on the first view of /cordyceps after the save, by reload and by the menu link. Reply "UAT approved" or list the issues.</human-check>
+  </verify>
+  <acceptance_criteria>
+    - posts-unchanged, translations-unchanged, category-purged and category-fresh are printed, and the on-server page contains the human's phrase.
+    - The SUMMARY records the human's replies, the phrase and its count, each check result, and whether the word was changed back. It lists Tests 2 and 3 as ready for /msd-verify-work to mark pass, and Test 1 as covered by the Task 3 gate log.
+  </acceptance_criteria>
+  <done>On the deployed build, untouched re-saves of posts 1 and 64 are byte-identical, and a category edit is visible on the next view of the site.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Go host → Nuxt (loopback HTTP) | the Journal plugin calls the purge route with a bearer token |
+| internet → nginx → Nuxt | visitors reach Nuxt only with GET/HEAD; nginx adds X-Forwarded-For and X-Real-IP |
+| server .env files → processes | the purge token lives only in go/.env and nuxt/.env (0600) |
+| executor → git origin | tags and branches pushed here are read by other repositories |
+| executor → UAT server (ssh) | the release runs next to the live Winter site |
+| human admin → UAT admin | the only path that writes post and category data in this plan |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.2-36 | Spoofing / Denial of Service | layer purge route | medium | mitigate | POST only; 404 unless a token of at least 32 characters is configured; 404 for any request with X-Forwarded-For, X-Real-IP or Forwarded (proxied); 401 for a missing or wrong bearer token, compared in constant time over sha256 digests; the UAT vhost refuses POST to Nuxt (limit_except GET HEAD, required by check-deploy.sh); proven by purge-check and the Task 5 on-server 403/401 checks |
+| T-16.2-37 | Information Disclosure | purge token | high | mitigate | Generated on the server from /dev/urandom and appended with printf builtins; compared on the server so only "token-match" crosses ssh; passed to curl on stdin (-H @-), never in argv or output; never logged by Go (TestSiteCachePurgeRequest checks captured logs) or by the layer; .env files stay 0600 and are never committed or rsynced |
+| T-16.2-38 | Tampering (stale content) | purge ordering | medium | mitigate | lagoon.AfterCommit runs the purge only after the save transaction commits and never for a failed save; the Postgres tests read the row inside the receiver to prove commit-before-purge |
+| T-16.2-39 | Denial of Service | admin save path | low | mitigate | 2 s timeout on context.WithoutCancel; errors and non-2xx answers are logged, never returned; tests cover a 500 answer and a closed receiver with the save still 200 |
+| T-16.2-40 | Information Disclosure | purge URL misconfiguration | medium | mitigate | Boot refuses an http URL to a non-loopback host (the bearer token would cross the network in clear), user info, fragments and short tokens; only one of URL and token set is a boot error |
+| T-16.2-41 | Tampering (log injection) | layer purge log line | low | mitigate | parsePurgeEvent strips control characters and caps the slug at 200 characters before logging |
+| T-16.2-42 | Tampering (cache poisoning of the purge response) | Nitro route cache | medium | mitigate | routeRules cache: false for /api/__journal__/**; cache-control no-store; purge-check requires a second purge after re-caching to report purged of at least 1 |
+| T-16.2-43 | Denial of Service | full route-cache purge | low | accept | Only authenticated loopback callers can purge; admin saves are rare; the next view of each page renders once from the local API |
+| T-16.2-44 | Repudiation (false-green gate) | phase gate | medium | mitigate | The inventory check runs without Docker in the go stage; the postgres stage requires TestPhase10OpenAPIConformance and the purge suites by name; the final run sets PHASE162_REQUIRE_POSTGRES=1 and checks the PASS postgres and PASS cache lines |
+| T-16.2-45 | Tampering / Repudiation | tags and pushes | high | mitigate | Clean trees and nothing behind origin, checked at a blocking-human gate and again before each push; absent tags confirmed on origin; binary sha256 compared; check-git-install proves the layer tag; every pushed head recorded |
+| T-16.2-46 | Tampering | UAT database and the Winter site | medium | mitigate | The executor runs only SELECTs; data changes only through human admin saves; the Winter vhost, php-fpm and PHP database are untouched; binary and Nuxt rollback copies are kept |
+| T-16.2-SC | Tampering | packages | high | mitigate | No new package: the Go purger uses net/http and lagoon, the layer uses node:crypto and Nitro built-ins; the app only moves its pin to the project's own layer tag and regenerates the lockfile; build.sh installs with --frozen-lockfile |
+</threat_model>
+
+<verification>
+- Task 1: TestCategoriesAdminPurgesSiteCache passes; purge-check on the playground ends "purge-check: ok".
+- Task 2: both Journal purge tests pass; layer tests and the playground purge-check pass; the host app purges /cordyceps in a scratch build; docs-ok.
+- Task 3: TestPhase10ConformanceInventory passes under -short; TestPhase10OpenAPIConformance passes; `PHASE162_REQUIRE_POSTGRES=1 bash scripts/check-phase16.2.sh --all` prints PASS postgres and PASS cache and ends "Phase 16.2 gate passed".
+- Task 4: release-gate-ok and a human "release".
+- Task 5: smoke ok, deploy-ok, token-match, purge-ok.
+- Task 6: posts-unchanged, translations-unchanged, category-purged, category-fresh, and the human's approval.
+</verification>
+
+<success_criteria>
+- G-16.2-1 closed: the gate's postgres stage is green on a Docker host, the conformance inventory is enforced without Docker, and the stale Journal assertion and the PATTERNS checklist are fixed.
+- G-16.2-2 closed: a Journal post or category save in the admin clears the host Nuxt route cache after commit, and browsers revalidate, so the site shows the edit on the next view.
+- Released (summercms v0.1.20, vue-journal-layer v0.3.0, plugin and host bumps) and deployed to UAT with rollback copies; UAT Tests 3 and 2 re-run with their results recorded for /msd-verify-work.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-07-SUMMARY.md` when done. Include:
+- the commits per repository and the full gate log summary;
+- the release sheet and the human replies;
+- both tags and every pushed head;
+- both sha256 values, RESTART_UTC, LOG_ANCHOR and the snapshot;
+- every check result, and the status of UAT Tests 1 to 3 for /msd-verify-work.
+</output>

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-07-SUMMARY.md

@@ -0,0 +1,129 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+plan: 07
+subsystem: gap-closure
+tags: [gap-closure, conformance, site-cache, purge, nitro-swr, release, uat, d-03, d-19]
+gap_closure: true
+gap_ids: [G-16.2-1, G-16.2-2]
+
+requires:
+  - phase: 16.2-06
+    provides: scripts/check-phase16.2.sh and the Postgres suites whose stage G-16.2-1 found red
+  - phase: 16.2-05
+    provides: the UAT deploy procedure and its corrections
+provides:
+  - "Conformance cases for GET /field-types and the field upload route, and a Docker-free route inventory check in the gate's go stage (G-16.2-1)"
+  - "Journal admin post and category writes purge the host Nuxt route cache after commit through a token-protected loopback route (G-16.2-2)"
+  - "summercms v0.1.20 and vue-journal-layer v0.3.0, released to UAT with the plugin and host bumps"
+  - "UAT Tests 2 and 3 re-run on the deployed build: all four on-server checks pass"
+affects: [16.2 verify-work, sm-journal-plugin, vue-journal-layer, sm-grzybyfunkcjonalne-app]
+
+actuals:
+  tasks: 6
+  executor_sessions: [summercms-go-da (Tasks 1-5 except step 8), summercms-go-16 (Task 5 step 8 onward, Task 6)]
+plan_head_before: d0b7fe4
+plan_head_after: aba063f
+plugin_commits_repo: ../sm-journal-plugin
+plugin_head_after: 5eea57f
+layer_commits_repo: ../vue-journal-layer
+layer_head_after: 25e9bfe
+site_app_head_after: 3a920c7
+host_head_after: f1d53af
+
+key-files:
+  created:
+    - ../sm-journal-plugin/classes/site_cache.go
+    - ../sm-journal-plugin/classes/site_cache_test.go
+    - ../sm-journal-plugin/controllers/site_cache.go
+    - ../vue-journal-layer/app/utils/siteCache.ts
+    - ../vue-journal-layer/server/api/__journal__/cache/purge.post.ts
+    - ../vue-journal-layer/testing/purge-check.mjs
+  modified:
+    - modules/cabana/openapi_conformance_test.go
+    - scripts/check-phase16.2.sh
+    - ../sm-journal-plugin/plugin_test.go
+    - ../sm-journal-plugin/README.md
+    - ../vue-journal-layer/README.md
+---
+
+# Phase 16.2 Plan 07: Gap closure for G-16.2-1 and G-16.2-2
+
+**The phase gate is green again with the field type routes under conformance, and a Journal admin save now clears the host Nuxt route cache, so an edited category shows on the next view of the site. Released as summercms v0.1.20 and vue-journal-layer v0.3.0 and confirmed on UAT.**
+
+## Task 4 answer
+
+"release" (verbatim).
+
+## Release
+
+| Item | Value |
+|------|-------|
+| summercms tag | v0.1.20, tag object ad7981f, pushed |
+| vue-journal-layer tag | v0.3.0, tag object c09e0d0 on 25e9bfe, pushed |
+| summercms.go master | aba063f |
+| sm-journal-plugin main | 5eea57f (requires summercms v0.1.20) |
+| vue-journal-layer main | 25e9bfe |
+| vue-grzybyfunkcjonalne-app main | 3a920c7 (pins vue-journal-layer#v0.3.0) |
+| sm-grzybyfunkcjonalne-app master | f1d53af |
+| UAT binary sha256 | 8a64d015… (matches the local build) |
+| First start | migrate, smoke (98 URLs) and deploy-ok at 2026-10-10T17:34:31Z |
+
+### Purge token (Task 5 step 8) and restart
+
+- The token was generated and written on the server by a script the user approved: `token-written`. It was never printed or sent back over the connection. Both env files stay mode 0600.
+- RESTART_UTC: 2026-10-10T17:57:57Z. Both programs RUNNING.
+- LOG_ANCHOR: `client_id=alexandria_2026_10_10T17_57_58_009306`. This replaces the first anchor (`client_id=alexandria_2026_10_10T17_34_31_364928`).
+- smoke: `smoke: ok (98 urls)`
+- token-match: `token-match`
+- purge-ok: `200 83 403 401` (an authorized loopback purge removed 83 entries; a POST through nginx gets 403, a loopback POST without a token gets 401)
+
+### Snapshot before Task 6 (equal to the 16.2-05 expected rows)
+
+- posts md5: `1:a026264105f900175b9770e637e5ec5c:a026264105f900175b9770e637e5ec5c`, `64:0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c`
+- translations: `64:en:862fc5b362cc9856e6736a2078dca3ba`
+- updated_at: post 1 `2026-10-10 15:05:09.645641+00`, post 64 `2026-10-10 15:05:18.083705+00`
+- category 2: `cordyceps:4053158bd1a58eb7f9547c18cb5a1724:2026-10-10 15:00:27.940875+00`
+
+## Task 6: UAT re-run
+
+Human replies: step 1 approved, step 2 approved (no removal notice on the untouched saves of posts 1 and 64), step 3 confirmed (category 2 saved with no removal notice), step 4 confirmed (the edit showed on the first view of /cordyceps, by reload and by the menu link).
+
+Phrase after the edit: "Te grzyby, a szczególnie Cordyceps sinensis i Cordyceps militaris, od wieków zajmują bardzo ważne miejsce" (was "… zajmują ważne miejsce"). The user chose to keep the edit; the word was not changed back.
+
+| Check | Result |
+|-------|--------|
+| posts-unchanged | pass: content and content_html of posts 1 and 64 are byte-identical, and both saves moved updated_at past RESTART_UTC |
+| translations-unchanged | pass |
+| category-purged | pass: successful `kind=category slug=cordyceps` purges after the anchor, every purge succeeded, no panic or SQLSTATE lines, category 2 saved after RESTART_UTC |
+| category-fresh | pass: /cordyceps Last-Modified 2026-10-10 19:00:35 GMT, after the category's updated_at |
+| Phrase on the server-rendered /cordyceps | found 1 time |
+
+Purge lines after the anchor: post `10-faktow-na-temat-cordycepsu` purged=5, post `ekstrakt-z-turkey-tail` purged=0, category `shiitake` purged=0 (twice), category `cordyceps` purged=7, 3, 3. All status=200. The shiitake purges are from other admin activity during the session and do not affect any check.
+
+**Ready for /msd-verify-work:** UAT Test 2 (D-19) and Test 3 (D-03) can be marked pass. Test 1 (the postgres gate stage) is covered by the Task 3 gate log (gate2.log, full gate including postgres).
+
+## Commits
+
+summercms.go: 11be08d (conformance cases), ee62410 (gate stages), aba063f (docs: route checklist, validation rows).
+
+sm-journal-plugin: f3b223f (tracer: purge after a category update), 2a3afb5 (purge on every post and category write), 09e5643 (TestJournalSVGEmbed expects mlblogeditor), 4405fee (full purge coverage), 5eea57f (require v0.1.20).
+
+vue-journal-layer: a03e076 (token-protected purge route), 0a01bfe (browser revalidation, docs), 4f55511 (tests), 03a90e9 (forward the visitor address), 25e9bfe (release v0.3.0).
+
+vue-grzybyfunkcjonalne-app: 5095f95 (docs), 3a920c7 (layer v0.3.0). sm-grzybyfunkcjonalne-app: 152e1ef (deploy docs: purge token), f1d53af (bump plugin and site app).
+
+## Deviations from Plan
+
+1. **[Rule 1 - Bug] Visitor address lost on route-cached renders.** Layer fix 03a90e9 forwards it through `event.context.journalForwardedFor`.
+2. **Scratch host build.** It uses a `file:` override instead of `link:`, and TMPDIR moved off /tmp.
+3. **TDD RED and GREEN in one commit.** RED for TestPhase10ConformanceInventory was run locally (RED_EVIDENCE_OK), then committed together with GREEN in 11be08d, because go test must stay green at every commit.
+4. **Extra helper file.** `controllers/site_cache.go` in sm-journal-plugin, not listed in files_modified.
+5. **Layer README additions.** The 16.2-VALIDATION.md rows for Tasks 4 to 6 were left pending by the first executor.
+6. **pnpm store.** `pnpm_config_store_dir=/media/nvme/dev/golem15/summercms.io/summercms/.pnpm-store`, because /tmp/.pnpm-store belongs to another user.
+7. **Task 5 step 8 blocked by the Secret read guard.** The hook blocks agent commands that name a .env file. The step ran as a server-side script whose command line does not name the file, with the user's explicit approval of each command; the token was never printed.
+8. **Executor handover.** summercms-go-da ran Tasks 1 to 5 up to step 8, then stood down when the user lost access to that console. summercms-go-16 ran step 8 onward and Task 6, so RESTART_UTC and LOG_ANCHOR come from the second restart.
+
+## Next
+
+- /msd-verify-work 16.2: mark Tests 2 and 3 pass, then re-run phase verification (VERIFICATION.md is still `human_needed`).
+- Fill the 16.2-VALIDATION.md rows for Tasks 4 to 6.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-CONTEXT.md

@@ -21,17 +21,17 @@ Out of scope: a core cabana `richeditor` type, a media library browser, and HTML
 
 ### Blog Editor: what it is
 - **D-01:** The Blog Editor is a **WYSIWYG HTML editor with a source (raw HTML) toggle**, built on ProseMirror through TipTap. It is not a block editor and not a markdown editor.
-- **D-02:** **An admin save stores HTML in both columns.** `content` holds the edited HTML and `content_html` holds the same HTML after it passes `classes.CheckHTML`. The API response shape is unchanged; `content` is simply HTML, as the PHP export already carries for imported posts. — **Reversibility:** costly — every post saved from the admin becomes HTML-content. A later move back to markdown would need an HTML-to-markdown migration across live posts.
+- **D-02:** **An admin save stores HTML in both columns.** `content` holds the edited HTML and `content_html` holds the same HTML after the sanitizer (D-10); both columns store the sanitized HTML. The API response shape is unchanged; `content` is simply HTML, as the PHP export already carries for imported posts. — **Reversibility:** costly — every post saved from the admin becomes HTML-content. A later move back to markdown would need an HTML-to-markdown migration across live posts.
 - **D-03:** **Byte-preserving unless edited.** If the post body is not touched in the editor, the save writes back exactly the stored HTML; the editor must not re-serialize an untouched document. Once the body is edited in WYSIWYG, markup the schema doesn't know (custom classes, divs, attributes) is kept as far as possible through generic node and attribute preservation. The source tab always edits the exact HTML.
-- **D-04:** v1 features: basic text (headings, bold/italic, lists, links, blockquote), **images**, **tables**, and **embeds plus a raw HTML block**. The raw HTML block is still subject to `CheckHTML`.
-- **D-05:** **Embeds are an allowlisted placeholder node**, for example `<figure data-embed="youtube" data-id="…">`, that passes `CheckHTML` unchanged. **The XSS gate is not relaxed to allow iframes.** The frontend expands the placeholder into the real iframe (D-17). — **Reversibility:** costly — the placeholder markup becomes stored content in live posts, and the layer's renderer depends on it.
+- **D-04:** v1 features: basic text (headings, bold/italic, lists, links, blockquote), **images**, **tables**, and **embeds plus a raw HTML block**. The raw HTML block is still subject to the sanitizer (D-10).
+- **D-05:** **Embeds are an allowlisted placeholder node**, for example `<figure data-embed="youtube" data-id="…">`, that passes the bluemonday policy (and the layer's sanitize-html policy) byte for byte; both policies are extended for exactly the editor's own output (`figure` `data-embed`/`data-id`, and any image or table attributes the editor emits), pinned by a test. **The XSS gate is not relaxed to allow iframes.** The frontend expands the placeholder into the real iframe (D-17). — **Reversibility:** costly — the placeholder markup becomes stored content in live posts, and the layer's renderer depends on it.
 - **D-06:** The editor is **translatable like today's `mlmarkdown`**: a locale switcher over a locale → HTML map, stored through the translate overlay.
 
 ### Markdown vs HTML posts
 - **D-07:** **A markdown post opens with its `content_html`**, and the next admin save stores HTML (D-02). This is a one-way migration on first edit, with **no per-post format flag** and no new column.
 - **D-08:** **The Blog Editor replaces `mlmarkdown` for Journal post `content`** in `models/post/fields.yaml`. `markdown` and `mlmarkdown` stay cabana core types for other plugins. The `excerpt` field is unchanged.
 - **D-09:** **The public write API is unchanged.** `POST`/`PUT /_journal/api/v1/posts` keep the PHP contract: `content` is markdown and the server renders `content_html` with `FormatHTML`. Only the admin form path stores HTML.
-- **D-10:** **Admin save gate: `CheckHTML` refuses, nothing is sanitized.** Unsafe HTML returns a 422 with a field error, as category content does today, and nothing is silently rewritten. No sanitizer dependency is added. `CheckHTML` must run on every admin write path for both the default and the non-default locale values. The admin save path must stop running `FormatHTML`/goldmark over HTML content, which is the current data-loss bug (todo `journal-imported-html-admin-resave.md`).
+- **D-10 (amended 2026-10-10, supersedes the original refuse-only gate):** **Admin save gate: strip, never refuse.** Every admin write of post and category content (default and non-default locale) stores the output of the shared bluemonday policy (`classes.SanitizeHTML`, decision note `journal-html-sanitizing-bluemonday.md`), which returns the bytes unchanged when nothing is stripped. A save never fails because of unsafe markup. When the policy removed anything, the save response tells the admin what was removed (for example "2 elements were removed: style, iframe") and the form reloads the stored value; a save that removed nothing keeps today's response shape. The admin save path must stop running `FormatHTML`/goldmark over HTML content, which is the current data-loss bug (todo `journal-imported-html-admin-resave.md`). — *Original text: "`CheckHTML` refuses, nothing is sanitized … No sanitizer dependency is added." Superseded because 16.1 adopted bluemonday and the user chose strip (WordPress/Winter-post behaviour) so an edit never fails on legacy blocks the author did not touch.*
 
 ### Field type contract (framework)
 - **D-11:** **Plugins register field types under a short global alias**, for example `type: blogeditor`. Boot fails loudly if two plugins, or a plugin and a cabana core type, claim the same alias. This is closer to Winter's `registerFormWidgets` aliases than to a namespaced key. — **Reversibility:** costly — aliases end up in plugin `fields.yaml` files across repos; renaming means editing every consumer.
@@ -50,7 +50,7 @@ Out of scope: a core cabana `richeditor` type, a media library browser, and HTML
 - **D-16:** **The editor library is TipTap (ProseMirror, MIT).** It is wrapped in a plain custom element and bundled in **sm-journal-plugin's own JS build** (`assets/src` → `assets/dist`), with the bundle committed and embedded, like the admin SPA `dist/`. The host app needs no npm. The admin SPA itself gains no editor dependency.
 - **D-17:** **Embeds render in the `vue-journal-layer` blog views.** The layer expands allowlisted embed placeholders into privacy-friendly iframes (for example `youtube-nocookie.com`), so grzybyfunkcjonalne.pl shows them. A new layer tag is pinned in `vue-grzybyfunkcjonalne-app`.
 - **D-18:** **Images are uploaded through the existing backend-authenticated Journal media upload route**, by drag-and-drop or file picker. The editor inserts `<img src>` with alt text and an optional caption (`figure`/`figcaption`). There is no media library browser.
-- **D-19:** **Journal category content uses the Blog Editor** (`blogeditor`, or `mlblogeditor` if the category content attribute is translatable in the PHP tree) instead of the textarea. **No core cabana `richeditor` type** is added. This closes todo `cabana-richeditor-field-type.md` inside Journal. The existing `CheckHTML` gate in the Categories controller's `FormBeforeCreate`/`FormBeforeUpdate` stays.
+- **D-19:** **Journal category content uses the Blog Editor** (`blogeditor`, or `mlblogeditor` if the category content attribute is translatable in the PHP tree) instead of the textarea. **No core cabana `richeditor` type** is added. This closes todo `cabana-richeditor-field-type.md` inside Journal. Category content follows D-10 (amended): it is stripped like posts, not refused. This replaces the 422 `CheckHTML` gate in the Categories controller's `FormBeforeCreate`/`FormBeforeUpdate` (Winter stored category content unsanitized; that was a gap, not a contract to keep).
 
 ### Claude's Discretion
 - The exact `pact` interface name and method set, Go identifiers, the element value/event contract details, and the asset declaration shape, all within D-11 to D-15.

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md

@@ -21,7 +21,7 @@ All paths are git-tracked source in their own repos (sm-journal-plugin, vue-jour
 | `modules/cabana/tx_context.go` (+withFieldWrites / FieldWritesFromContext) | utility | request-response | same file `withVirtualFields`/`VirtualFieldsFromContext` (36-60) | exact |
 | `modules/cabana/list_schema.go`, `http.go` `projectRow` (plugin column ListValue) | service | transform | `list_schema.go:22-24`, `http.go:1067` | self |
 | `modules/cabana/http.go` (Activate threading + route + field-types endpoint) | route | request-response | `http.go:74-121` (Activate), `:335-347` (file routes) | self |
-| `modules/cabana/admin_openapi.go` + phase09Routes test list | config | — | existing file-route entries in same file | self |
+| `modules/cabana/admin_openapi.go` + phase09Routes test list + `modules/cabana/openapi_conformance_test.go` (one conformCase per new admin route; TestPhase10ConformanceInventory enforces it without Docker) | config | — | existing file-route entries in same file | self |
 | `modules/cabana/README.md`, `modules/pact/README.md`, `docs/backend/...` + site nav | docs | — | Phase 10.1 widget sections in same READMEs / `docs/` partials-and-widgets page | role-match |
 | `admin/src/components/form/fields/PluginField.vue` (NEW) | component | event-driven | `admin/src/components/form/fields/WidgetField.vue` | exact |
 | `admin/src/components/form/fields/MLPluginField.vue` or MLField wiring | component | event-driven | `admin/src/components/form/fields/MLMarkdownField.vue` + `MLField.vue` | exact |
@@ -106,7 +106,7 @@ func (s *service) fileUpload(w http.ResponseWriter, r *http.Request) {
 		ctx = withTx(ctx, tx)
 		sc, err := fr.scope(ctx, tx, r)
 ```
-Route registration follows `g.Post("/{vendor}/{plugin}/{controller}/{id}/files/{field}", requireAjax(s.fileUpload))`, so the new route is `g.Post("/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload", requireAjax(s.fieldUpload))`. Use `s.uploadBytes` for the cap, load the record through the `FormExtendQuery` scope when `id != 0`, map `pact.FieldError` to 422 on the field, and answer 201 `{data:{url}}`. Also add an entry to `admin_openapi.go` and `phase09Routes` and rerun `scripts/check-admin-openapi.sh`.
+Route registration follows `g.Post("/{vendor}/{plugin}/{controller}/{id}/files/{field}", requireAjax(s.fileUpload))`, so the new route is `g.Post("/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload", requireAjax(s.fieldUpload))`. Use `s.uploadBytes` for the cap, load the record through the `FormExtendQuery` scope when `id != 0`, map `pact.FieldError` to 422 on the field, and answer 201 `{data:{url}}`. Also add an entry to `admin_openapi.go` and `phase09Routes`, add a conformCase for the route to `modules/cabana/openapi_conformance_test.go` (one conformCase per new admin route; TestPhase10ConformanceInventory enforces it without Docker), and rerun `scripts/check-admin-openapi.sh`.
 
 ---
 

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW-FIX.md

@@ -0,0 +1,228 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+fixed_at: 2026-10-10T14:46:56Z
+review_path: .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW.md
+iteration: 1
+findings_in_scope: 8
+fixed: 8
+skipped: 0
+status: all_fixed
+---
+
+# Phase 16.2: Code Review Fix Report
+
+**Fixed at:** 2026-10-10T14:46:56Z
+**Source review:** .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW.md
+**Iteration:** 1
+
+**Summary:**
+- Findings in scope: 8 (CR-01, WR-01, WR-02, WR-03, WR-04, WR-05, WR-06, IN-04, as the orchestrator chose)
+- Fixed: 8
+- Skipped: 0 in scope. WR-07, WR-08, IN-01, IN-02, IN-03, IN-05, IN-06, IN-07 and IN-08 are out of scope by decision. Each is listed under Skipped Issues.
+
+The fixes span three repositories, and each fix is committed in the repository that owns the file:
+- summercms.go: `/media/nvme/dev/golem15/summercms.io/summercms/summercms.go`
+- sm-journal-plugin: `/media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin`
+- vue-journal-layer: no fix touched it.
+
+## Fixed Issues
+
+### CR-01: Blog Editor hides a locale's existing `content_html` when its `content` is blank
+
+**Repository:** sm-journal-plugin
+**Files modified:** `classes/blog_editor.go`, `classes/blog_editor_test.go`, `controllers/posts_editor_smoke_test.go`
+**Commit:** 1593231
+**Applied fix:** `loadBlogHTML` now reads the `htmlColumn` attribute when the stored content is blank and serves it whenever it is not empty. This applies to every locale and to the host row. When it is empty or missing, the blank value is served as stored. FormatHTML never runs on a blank value. An untouched save echoes the served value, which cabana skips. An edit writes the edited HTML to `content`, and FormAfterUpdate writes it to that locale's `content_html`.
+**Tests:**
+- Blank or nil content is served as `content_html`, in a translation and on the host row.
+- Blank content with an empty or missing `content_html` is still served as `""`.
+- A failing read is the Load error.
+- A field without `htmlColumn` never reads.
+- The controller smoke test covers the whole flow: Load serves the API-written body, Decode accepts the edit, and FormAfterUpdate writes `content_html` for that locale.
+
+### WR-01: Field upload route skips the controller's create/update capability check
+
+**Repository:** summercms.go
+**Files modified:** `modules/cabana/field_type_upload.go`, `modules/cabana/field_type_test.go`, `modules/cabana/field_type_smoke_test.go`, `modules/cabana/README.md`, `docs/backend/field-types.md`
+**Commit:** 3158bb5
+**Applied fix:** `fieldUpload` now calls `s.operationDeclared(w, r, cc, op)` right after parsing `{id}`, before it reads the body. The operation is `create` for id 0 and `update` otherwise, as on the save routes.
+**Tests:**
+- New `TestFieldUpload` case: a controller with no `create` toolbar button answers 403 for id 0 and never calls Upload. The same field with the button answers 201.
+- The test fixtures for upload (`upFS`, `ftMLPlugin`) now declare `toolbar.buttons: [create]`.
+**Docs:** the README route row and the field-types page now describe the 403.
+
+### WR-02: Stored upload objects are orphaned when the route refuses after Upload succeeded
+
+**Repository:** summercms.go
+**Files modified:** `modules/cabana/field_type_upload.go`, `modules/cabana/field_type_test.go`, `modules/cabana/README.md`, `docs/backend/field-types.md`
+**Commit:** c532529
+**Applied fix:**
+- The route reads the whole multipart body with `ReadForm` before Upload runs. Files over 8 MiB (`fieldUploadMemory`) spool to a temporary file, which `RemoveAll` deletes.
+- `singleUploadFile` requires exactly one part: a file part named `file` with a non-blank file name. Only then is Upload called, with the opened file.
+- An extra part, a value part or an oversized body is refused (422 or 413) without calling Upload.
+- Two windows remain, and the docs now name them: a record transaction that fails after Upload returns, and an element that stops waiting. In both cases `Upload` should store under a name that is safe to leave behind.
+**Tests:**
+- New cases check that a second file part, a later field, a value part before or after the file, and an oversized body never call Upload.
+- A file larger than the in-memory threshold reaches Upload byte for byte.
+
+### WR-03: Media key uniqueness is check-then-write
+
+**Repository:** sm-journal-plugin
+**Files modified:** `classes/media_store.go`, `classes/media_store_test.go`
+**Commit:** 2c961b8
+**Applied fix:**
+- `StoreMedia` reserves the chosen key in an in-process set, per bucket, while it writes. `uniqueMediaKey` treats reserved keys as taken.
+- The write uses `blob.WriterOptions{IfNotExist: true}`. A `gcerrors.FailedPrecondition` moves the upload on to the next free name, for at most 10 attempts.
+- Both parts are needed: fileblob's `IfNotExist` is stat-then-rename under a per-writer mutex, so on its own it would not close the race within one process. The reservation closes it within the process, and `IfNotExist` covers other processes on backends that enforce it atomically, such as S3.
+**Tests (run with `-race`):**
+- 16 concurrent uploads of `image.png` get distinct keys and keep their own bytes, and no reservations are left behind.
+- A test hook (`mediaBeforeWrite`) simulates another process writing the chosen keys. The upload moves to `image-2.png` and leaves the other objects untouched.
+- When the upload loses every attempt, it gives up with an opaque error.
+
+### WR-04: `LooksLikeHTML` treats markdown that starts with a tag as HTML
+
+**Repository:** sm-journal-plugin
+**Files modified:** `classes/blog_editor.go`, `classes/blog_editor_test.go`, `controllers/posts_editor_smoke_test.go`
+**Commit:** 5af746f
+**Status:** fixed: requires human verification (this changes a heuristic)
+**Applied fix:**
+- A value that starts with `<` is served as it is only when one of these holds:
+  - `content_html` is empty or missing, or cannot be read (no translation writer).
+  - `content_html` equals the value, ignoring white space at either end.
+  - `content_html` equals `SanitizeHTML(value)`, ignoring white space at either end.
+- Otherwise the value is markdown that starts with a tag, and `content_html` is served.
+- `sameStoredHTML` holds the comparison.
+**Why `FormatHTML(value)` is not a match:** that render also matches markdown which starts with `<img>`, so counting it would bring the bug back.
+**Side effect:** an imported HTML post whose `content_html` differs from its `content` (for example, Winter's Markdown::parse split an HTML block) now opens with `content_html`. That is what the site renders, so an untouched save still skips and an edit writes both columns from it.
+**Tests:**
+- The HTML-verbatim cases now cover a `content_html` that is missing, empty, equal, sanitized, trimmed, or both sanitized and trimmed.
+- New fixtures cover markdown that starts with `<img>`, `<div>` and `<!-- comment -->`. Each is served as its `content_html`, with no `##` or `**` markers.
+- A read error on an HTML value is the Load error.
+- A controller smoke case covers the `<img>` hero.
+
+### WR-05: Attribute preservation lets `id`, `name`, `style`, `srcset` into the live admin DOM
+
+**Repository:** sm-journal-plugin
+**Files modified:** `assets/src/blogeditor/extensions.ts`, `assets/dist/blogeditor.js`, `tests/blogeditor/schema.test.ts`, `tests/blogeditor/smoke.test.ts`, `README.md`
+**Commit:** f1e6c11
+**Applied fix:**
+- `captureAttributes` and `renderCaptured` now use the conservative allowlist from the orchestrator (`KEPT_ATTRIBUTES`, `isKeptAttribute`): `class`, `title`, `alt`, `width`, `height`, `colspan`, `rowspan`, `start`, `rel`, `target` and `data-*`.
+- `href` and `src` stay modelled on the link and image nodes, which check them.
+- Every other attribute is never captured, so it is never rendered into the ProseMirror view. This covers `id`, `name`, `style`, `srcset`, `background`, `form`, `contenteditable`, `popover`, `itemprop`, `dir`, `lang` and `on*`. Such attributes drop out of a block once that block is edited.
+- A `span` is kept as a mark only when it has a kept attribute.
+- Untouched documents and untouched blocks still return their stored bytes (D-03).
+**Tests:**
+- The schema tests use view-safe attributes for the "keeps" cases.
+- New table cases drop `id`, `name`, `style`, `srcset`, `loading`, `background`, `form`/`contenteditable`/`popover`, `itemprop`/`dir`/`lang` and a cell's `style`.
+- A live-DOM test asserts that no stored `id`, `name`, `srcset`, `background` or style value reaches `.ProseMirror`, and that the untouched value is still the exact input.
+- The smoke expectation for edited blocks is updated.
+- A new test confirms that an untouched block keeps `id`, `style` and `itemprop` byte for byte after another block is edited.
+**Other changes:** the dist bundle is rebuilt and the plugin README's untouched-values paragraph is updated.
+
+### WR-06: Translatable Decode can receive non-string values
+
+**Repository:** summercms.go
+**Files modified:** `modules/cabana/field_type.go`, `modules/cabana/field_type_test.go`, `modules/pact/capabilities.go`, `modules/pact/README.md`, `docs/backend/field-types.md`
+**Commit:** f388d27
+**Applied fix:** before `decodeOne` handles a translatable field's default value, `decodePluginFields` now does the following:
+- A string passes through.
+- `nil` becomes `""`.
+- Any other value is a 422 on the field: "The X field must be text or an object of locale codes to text."
+**Docs:** the pact `FormFieldValue` doc comment, the pact README row and the field-types page now state the enforced contract.
+**Tests:** a probe Decode does `in.Value.(string)` and so panics on a broken contract.
+- A string and null each reach it as a string.
+- A number, a boolean and an int are refused with a 422 before Decode runs.
+
+### IN-04: `crypto.randomUUID()` throws outside a secure context
+
+**Repository:** sm-journal-plugin
+**Files modified:** `assets/src/blogeditor/element.ts`, `assets/dist/blogeditor.js`, `tests/blogeditor/smoke.test.ts`
+**Commit:** b997a41
+**Applied fix:** a new exported `uploadRequestId()` picks the request id in this order:
+- `crypto.randomUUID` when it exists.
+- Otherwise, a version 4 UUID built from `crypto.getRandomValues`, which works in insecure contexts.
+- Otherwise, a time-plus-counter id.
+The admin host (`PluginField.vue`) echoes any id back, so nothing else changes.
+**Tests:**
+- With `randomUUID` stubbed away, ids are unique v4 UUIDs and a full upload round trip still works.
+- With no `crypto` object, ids are unique counter ids.
+**Other changes:** the dist bundle is rebuilt.
+
+## Skipped Issues
+
+### WR-07: "View site" links to the admin's own origin
+
+**File:** `admin/src/components/shell/AppShell.vue:25-27, 40-48`
+**Reason:** By explicit user decision, "View site" defaults to the admin origin. The `SUMMER_FRONTEND__URL` override is a tracked follow-up.
+**Original issue:** `siteURL` assumes the public site and the admin share an origin, which is wrong for the headless deployment.
+
+### WR-08: The phase gate prints "Phase 16.2 gate passed" without running the data-loss regression suites
+
+**File:** `scripts/check-phase16.2.sh:521-544`
+**Reason:** This is by design. The gate prints a loud NOT RUN block, and `PHASE162_REQUIRE_POSTGRES=1` enforces the Postgres stage. The Postgres run is a tracked Docker-host step.
+**Original issue:** `--all` exits 0 when Docker is unreachable, without the D-03/D-10 Postgres acceptance tests.
+
+### IN-01: An embed placeholder that both policies accept may never expand
+
+**File:** `../vue-journal-layer/app/utils/embeds.ts:41`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** `EMBED_PLACEHOLDER` matches only `data-embed` before `data-id`.
+
+### IN-02: The expanded YouTube iframe has no `sandbox`, and the exported `/g` regex carries shared `lastIndex` state
+
+**File:** `../vue-journal-layer/app/utils/embeds.ts:41, 56-60`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** There is no defence-in-depth `sandbox` on the iframe, and the exported global regex is stateful.
+
+### IN-03: Plugin aliases can shadow list column types
+
+**File:** `modules/cabana/field_type.go:104-109`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** A plugin alias `date`, `datetime` or `time` is accepted, but its `ListValue` is never called.
+
+### IN-05: content_html translations are skipped silently when the application is unavailable
+
+**File:** `../sm-journal-plugin/controllers/posts.go:263-270`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** `writeContentHTMLTranslations` returns nil without a writer, and the columns diverge.
+
+### IN-06: Untouched detection cannot be byte-exact for legacy content with invalid UTF-8
+
+**File:** `modules/cabana/field_type.go:641-651`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** JSON transport replaces invalid UTF-8, so an untouched save rewrites such rows.
+
+### IN-07: "Edit as HTML" selects the first identical block
+
+**File:** `../sm-journal-plugin/assets/src/blogeditor/element.ts:524-532`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** `indexOf(html)` highlights the first of two identical raw blocks.
+
+### IN-08: Plugin-typed fields cannot declare `readOnly`/`hidden`/`disabled` in YAML
+
+**File:** `modules/cabana/field_type.go:33-36`
+**Reason:** Deferred. Info findings other than IN-04 are out of scope for this fix pass.
+**Original issue:** `pluginFieldKeys` excludes the general keys that the SPA honours.
+
+## Verification
+
+All verification ran in the main checkouts. `workflow.use_worktrees` is `false`, so no worktree was created and the numbers can be reproduced from the trees as committed.
+
+- **summercms.go:**
+  - `go vet ./...` is clean.
+  - The phase gate's framework set (`FRAMEWORK_RUN` over `./modules/pact ./modules/cabana`) passes.
+  - `go test ./cmd/summer -run TestDocsTree` passes.
+  - The other cabana failures are Docker-only (testcontainers). The failing subtest list is identical before and after these changes; this was checked with `git stash`.
+- **sm-journal-plugin:**
+  - `go vet ./...` is clean.
+  - `go test ./classes ./controllers ./controllers/api` passes. The root, `models` and `updates` packages need Docker.
+  - vitest passes 232 of 232, and `tsc --noEmit` is clean.
+  - `scripts/check-dist.sh` matches a fresh build.
+- **vue-journal-layer:** untouched. The gate's layer stage passes 144 of 144, and the corpus copy equals the plugin's.
+- **Full gate:** `bash scripts/check-phase16.2.sh --all` passes the go, admin (vitest 1218 of 1218), editor, layer and docs stages; docs includes check-admin-openapi, check-admin-dist and the Journal check-dist. Postgres is NOT RUN because no Docker daemon is reachable. Its suites (TestFieldTypeSavePostgres, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdmin*) still need a Docker-host run. That run matters most for CR-01 and WR-04, whose end-to-end untouched-save behavior those suites cover.
+
+---
+
+_Fixed: 2026-10-10T14:46:56Z_
+_Fixer: Claude (msd-code-fixer)_
+_Iteration: 1_

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-REVIEW.md

@@ -0,0 +1,294 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+reviewed: 2026-10-10T14:29:09Z
+depth: standard
+files_reviewed: 73
+files_reviewed_list:
+  - admin/src/api/schema.d.ts
+  - admin/src/api/types.ts
+  - admin/src/app/fieldTypes.ts
+  - admin/src/app/pluginAssets.ts
+  - admin/src/components/form/FieldRenderer.vue
+  - admin/src/components/form/FormField.vue
+  - admin/src/components/form/FormGrid.vue
+  - admin/src/components/form/PreviewField.vue
+  - admin/src/components/form/fields/MLField.vue
+  - admin/src/components/form/fields/MLPluginField.vue
+  - admin/src/components/form/fields/PluginField.vue
+  - admin/src/components/form/formContext.ts
+  - admin/src/components/form/formState.ts
+  - admin/src/components/form/mlLocale.ts
+  - admin/src/components/form/registry.ts
+  - admin/src/components/relation/RelationChildModal.vue
+  - admin/src/components/shell/AppShell.vue
+  - admin/src/main.ts
+  - admin/src/views/FormView.vue
+  - admin/src/views/LoginView.vue
+  - modules/cabana/admin_openapi.go
+  - modules/cabana/contracts.go
+  - modules/cabana/crud.go
+  - modules/cabana/extension.go
+  - modules/cabana/field_ml.go
+  - modules/cabana/field_type.go
+  - modules/cabana/field_type_upload.go
+  - modules/cabana/form_schema.go
+  - modules/cabana/http.go
+  - modules/cabana/list_schema.go
+  - modules/cabana/query.go
+  - modules/cabana/registry.go
+  - modules/cabana/relation.go
+  - modules/cabana/relation_field.go
+  - modules/cabana/relation_form.go
+  - modules/cabana/schema_types.go
+  - modules/cabana/settings.go
+  - modules/cabana/tx_context.go
+  - modules/pact/capabilities.go
+  - modules/phrasebook/backend/lang/en/lang.yaml
+  - modules/phrasebook/backend/lang/pl/lang.yaml
+  - scripts/check-phase16.2.sh
+  - ../sm-journal-plugin/admin.go
+  - ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css
+  - ../sm-journal-plugin/assets/src/blogeditor/element.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/embed.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/extensions.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/index.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/labels.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/preview.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/serializer.ts
+  - ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts
+  - ../sm-journal-plugin/classes/blog_editor.go
+  - ../sm-journal-plugin/classes/format_html.go
+  - ../sm-journal-plugin/classes/media_store.go
+  - ../sm-journal-plugin/controllers/admin_registry.go
+  - ../sm-journal-plugin/controllers/api/media.go
+  - ../sm-journal-plugin/controllers/categories.go
+  - ../sm-journal-plugin/controllers/posts.go
+  - ../sm-journal-plugin/field_types.go
+  - ../sm-journal-plugin/go.mod
+  - ../sm-journal-plugin/lang/en/lang.yaml
+  - ../sm-journal-plugin/lang/pl/lang.yaml
+  - ../sm-journal-plugin/models/category/fields.yaml
+  - ../sm-journal-plugin/models/post/fields.yaml
+  - ../sm-journal-plugin/scripts/check-dist.sh
+  - ../sm-journal-plugin/vite.config.ts
+  - ../vue-journal-layer/app/assets/css/journal-base.css
+  - ../vue-journal-layer/app/components/Journal/CategoryHeader.vue
+  - ../vue-journal-layer/app/components/Journal/PostBody.vue
+  - ../vue-journal-layer/app/utils/embeds.ts
+  - ../vue-journal-layer/app/utils/htmlGate.ts
+  - ../vue-journal-layer/testing/expect-acme.txt
+findings:
+  critical: 1
+  warning: 8
+  info: 8
+  total: 17
+status: issues_found
+---
+
+# Phase 16.2: Code Review Report
+
+**Reviewed:** 2026-10-10T14:29:09Z
+**Depth:** standard
+**Files Reviewed:** 73 (summercms.go diff 0754a6e..HEAD, sm-journal-plugin diff c60abc6..HEAD, vue-journal-layer diff 294a8d8..HEAD)
+**Status:** issues_found
+
+Paths starting with `../` are relative to the summercms.go repository root; they live in the sibling sm-journal-plugin and vue-journal-layer repositories.
+
+## Summary
+
+The review covered the new `pact.FormFieldType` API, cabana's compile, decode, untouched-skip, load, list and upload paths, the admin SPA host (PluginField, MLPluginField, the field-type loader, notices, View site), the Journal Blog Editor types (Decode/Load/ListValue/Upload, StoreMedia, the bluemonday extension and SanitizeHTMLReport), the TipTap custom element (schema, serializer, preview, toolbar), and the layer's sanitize-html mirror and embed expansion.
+
+The security core holds up:
+- Decode runs inside the save transaction for every written locale. The untouched skip compares against the value the form was served, so it cannot be used to store unsanitized bytes that are not already stored.
+- SanitizeHTMLReport returns the input unchanged only when the token comparison matches.
+- The layer expands embeds only after sanitizing, with a fixed `src` and a validated id.
+- The preview iframe uses an empty sandbox, and stored HTML is parsed only into inert documents.
+- Upload sniffing plus StoreMedia's extension list refuses SVG and HTML.
+
+Problems found:
+- **Blocker (data loss):** Journal `Load` serves an empty editor for a locale whose `content` is blank but whose `content_html` holds the body. The public API's `FormatTranslation` path supports that state. Any edit in that locale silently replaces the hidden translated body.
+- **Upload route:** it skips the controller's create/update capability check and can leave orphaned public objects. The Journal storage key check is racy, so concurrent uploads can overwrite each other.
+- **Live admin DOM:** the editor's attribute preservation is a deny-list (`on*` only). `id`, `name`, `style` and `srcset` from stored HTML reach the live admin DOM, which contradicts the threat-model claim.
+- Other warnings: the markdown/HTML heuristic, the translatable Decode contract, the View site URL, and a phase gate that reports success without its data-loss regression tests.
+
+## Critical Issues
+
+### CR-01: Blog Editor hides a locale's existing `content_html` when its `content` is blank; editing that locale overwrites the hidden body
+
+**File:** `../sm-journal-plugin/classes/blog_editor.go:204-209`
+**Issue:** `loadBlogHTML` returns the stored text as-is when it is blank:
+
+```go
+if column == "" || LooksLikeHTML(text) || strings.TrimSpace(text) == "" {
+    return text, nil
+}
+```
+
+`FormatTranslation` (`classes/format_html.go:292-316`) supports translations that carry only `content_html` with blank or missing `content`, for example API writes of a translated body. For such a locale, cabana's `hydratePluginFields` and `servedFieldValue` serve `""`. The administrator therefore sees an empty editor although the site renders a full translated post. The untouched skip protects only a save that leaves that locale empty. As soon as the administrator types anything there, for example believing no translation exists, `decodeOne` writes the new value. `FormAfterUpdate` (`controllers/posts.go:241-280`) then stores it as that locale's `content_html`, and the existing translated body is lost with no notice. This breaks D-07's intent ("a markdown post opens with its `content_html`"). The same applies to a host row whose `content` is blank but whose `content_html` is not.
+**Fix:** When `htmlColumn` is set, serve the HTML column whenever `content` is blank, not only when it is markdown:
+
+```go
+text := storedText(in.Value)
+column, _ := in.Options["htmlColumn"].(string)
+if column == "" || (LooksLikeHTML(text) && strings.TrimSpace(text) != "") {
+    return text, nil
+}
+if in.Translated != nil {
+    html, found, err := in.Translated(column)
+    if err != nil {
+        return nil, err
+    }
+    if found && html != "" {
+        return html, nil
+    }
+}
+if strings.TrimSpace(text) == "" {
+    return text, nil
+}
+html, err := FormatHTML(text)
+...
+```
+
+Add a test: a pl translation with only `content_html` is served as that HTML, an untouched save keeps it, and an edit writes both columns from the edited value.
+
+## Warnings
+
+### WR-01: Field upload route skips the controller's create/update capability check
+
+**File:** `modules/cabana/field_type_upload.go:25-36, 80-81`
+**Issue:** `fieldUpload` only runs `protect`, which checks the controller's required permissions. Unlike `create` and `update` (`http.go:831, 860`), it never calls `s.operationDeclared(w, r, cc, "create"|"update")`. Consequences:
+- With `{id}` 0, any administrator holding the controller permission can write files to the public media bucket through a controller whose YAML declares no create capability (no toolbar `create`).
+- The `id == 0` path never applies the controller's `FormExtendQuery` scope, so an administrator scoped to a subset of records can still upload.
+- With `{id} > 0`, a record the administrator may view but whose form declares no update can still receive uploads.
+
+**Fix:** Mirror the save routes before reading the body:
+
+```go
+op := "update"
+if id == 0 {
+    op = "create"
+}
+if !s.operationDeclared(w, r, cc, op) {
+    return
+}
+```
+
+Add `TestFieldUpload` cases for a controller without the `create` toolbar button (403 for id 0).
+
+### WR-02: Stored upload objects are orphaned when the route refuses after Upload succeeded
+
+**File:** `modules/cabana/field_type_upload.go:58-78, 83-99`
+**Issue:** The type's `Upload` writes the object to the bucket first. Only then does `run` check that no second multipart part follows (`mr.NextPart()`), and that check returns 422. In the `id != 0` case, a later transaction error rolls back the DB transaction but not the blob write. The element's 60 s timeout (`element.ts:553-556`) also drops a late successful answer. Each case leaves a public, unreferenced object under `/journal/<folder>/` with no cleanup.
+**Fix:** Before calling `Upload`, check that the stream has exactly one part. For example, buffer the part up to the cap, then read `NextPart` before calling `Upload`. Alternatively, add an optional `pact.FormFieldType.Discard(ctx, url)` that cabana calls when it refuses after a successful Upload. At minimum, document that a refused upload may leave the object behind.
+
+### WR-03: Media key uniqueness is check-then-write; concurrent uploads of the same name overwrite each other
+
+**File:** `../sm-journal-plugin/classes/media_store.go:79-85, 122-151`
+**Issue:** `uniqueMediaKey` calls `bucket.Exists` and then `bucket.NewWriter(ctx, key, nil)` writes without a precondition. Two concurrent uploads of the same name to the same folder both see the key as free, and the second write replaces the first. One post then shows the other's image. Clipboard and drag-and-drop images commonly share names such as `image.png`, and `safeUploadName` maps every nameless file to `image.<ext>`, so collisions are likely. The plan-03 fix (T-16.2-16, "never overwrites") covers only the 999-suffix exhaustion case.
+**Fix:** Write with `&blob.WriterOptions{IfNotExist: true}` (available in gocloud.dev v0.46) and retry with the next suffix on a `gcerrors.FailedPrecondition`. Alternatively, add a short random component to editor upload names.
+
+### WR-04: `LooksLikeHTML` treats markdown that starts with a tag as HTML; the first edit stores raw markdown as HTML in both columns
+
+**File:** `../sm-journal-plugin/classes/blog_editor.go:112-115, 207`
+**Issue:** A markdown post whose first non-space character is `<` is served as raw markdown in the WYSIWYG editor, not as its `content_html`. Examples: a hero `<img …>`, a leading `<div>`, or `<!-- comment -->` followed by `## Heading` and `**bold**`. Any edit makes `preparePostWrite` (`controllers/posts.go:212-224`) copy that string into `content_html`. From then on the site renders literal `##` and `**` markers. This is silent corruption on first edit; it is listed as assumption A1, but no safeguard backs it.
+**Fix:** Do not decide by the first character alone. For example, treat the value as HTML only when `content_html` is empty, equals `content`, or equals `SanitizeHTML(content)`; otherwise serve `content_html`. Add a fixture with a markdown post that starts with `<img>`.
+
+### WR-05: Attribute preservation lets `id`, `name`, `style`, `srcset` and other stored attributes into the live admin DOM
+
+**File:** `../sm-journal-plugin/assets/src/blogeditor/extensions.ts:100-125, 133-173`
+**Issue:**
+- `captureAttributes` and `renderCaptured` drop only `on*` names. Every other attribute of a paragraph, heading, list, table, cell, image, figure or link, and every attribute of a `span`, is rendered by ProseMirror into the contenteditable view in the admin document. This happens on the form and also on the read-only preview screen, which renders the element with `disabled`.
+- Legacy imported HTML is never sanitized by an untouched save, so its attributes reach the admin DOM unchanged:
+  - `<img src=… name="querySelector">` clobbers `document.querySelector` (Document named properties override built-ins) and breaks the SPA while the post is open.
+  - `style="position:fixed;inset:0;z-index:99999;…"` can overlay the admin UI with attacker text (UI redress).
+  - `srcset` and `background` load remote resources.
+- The policy also allows `id` globally, so any administrator can plant window-level named elements.
+- Plan 02's statement "Stored HTML never reaches the live admin DOM" is inaccurate for attributes.
+
+**Fix:** Switch to an allow-list that mirrors the server policy: `class`, `style` (filtered to the four allowed properties, as in htmlGate), `dir`, `lang`, `title`, `itemscope`/`itemtype`/`itemprop`, `data-message-*`, plus element-specific attributes. Keep any other attribute only as an opaque value on the node, and serialize it in the inert document without rendering it in the view. One way is to render `htmlAttrs` in the view through `addNodeView` or a `renderHTML` that filters by a view-safe list, while the serializer path emits everything. At minimum, drop `id`, `name`, `form`, `srcset`, `contenteditable`, `popover*` and `style` from the view rendering.
+
+### WR-06: Translatable Decode can receive non-string values despite the documented pact contract
+
+**File:** `modules/cabana/field_type.go:476-486`, `modules/pact/capabilities.go` (FormFieldValue doc: "it is a string for a translatable type")
+**Issue:** `liftMLValues` validates only object-shaped submissions. A scalar submitted for a translatable plugin field (`null`, `3`, `true`) passes through `projectOperation` and reaches `ft.def.Decode` as `nil`/`float64`/`bool`. The published API promises a string, so a third-party type that does `in.Value.(string)` will panic, and the save fails as an unexpected 500. Journal guards against this; the framework contract does not.
+**Fix:** Enforce the contract in `decodePluginFields` before calling `decodeOne` for a translatable default value:
+
+```go
+switch v := value.(type) {
+case string:
+case nil:
+    value = ""
+default:
+    return pluginDecodeResult{}, &ValidationError{Details: fieldDetail(field.Name, "The "+field.Name+" field must be text or an object of locale codes to text.")}
+}
+```
+
+Alternatively, change the pact doc to "any JSON scalar".
+
+### WR-07: "View site" links to the admin's own origin, which is wrong for the headless deployment
+
+**File:** `admin/src/components/shell/AppShell.vue:25-27, 40-48`
+**Issue:** `siteURL = ${window.location.origin}/` assumes the public site and the admin share an origin. v1 is a headless backend with a separate Nuxt frontend. When the admin is served from an API or admin host, the link opens the Go binary's root (the SPA shell or a 404), not the site. WinterCMS's "View site" uses the configured application URL. The link attributes themselves are safe (`noopener noreferrer`, fixed origin).
+**Fix:** Serve the site URL from configuration, for example an `app.url` or `backend.site_url` key exposed in `/navigation` or `/me`. Hide the link when the key is unset, or fall back to the origin only when it is explicitly configured as the same host. Update the module README and config docs in the same change.
+
+### WR-08: The phase gate prints "Phase 16.2 gate passed" (exit 0) without running the data-loss regression suites
+
+**File:** `scripts/check-phase16.2.sh:521-544`
+**Issue:** The header calls the script fail-closed. Yet `--all` (the default mode) exits 0 and prints "Phase 16.2 gate passed" when Docker is unreachable. The Postgres stage holds `TestPostsAdminResaveKeepsHTML`, `TestPostsAdminSaveSanitizesHTML`, `TestCategoriesAdminContent`, `TestCategoriesAdminBlogEditor` and `TestFieldTypeSavePostgres`, which are this phase's D-03/D-10 acceptance tests. Plan 06 records that this host has no Docker, so the green gate was produced without them. A CI job or a later reader that trusts the exit code will treat the phase as verified.
+**Fix:** Make the default fail closed. Exit non-zero, or at least print "Phase 16.2 gate INCOMPLETE" and exit 3, when Postgres did not run, unless `PHASE162_ALLOW_NO_POSTGRES=1` is set. This inverts the current `PHASE162_REQUIRE_POSTGRES` opt-in.
+
+## Info
+
+### IN-01: An embed placeholder that both policies accept may never expand
+
+**File:** `../vue-journal-layer/app/utils/embeds.ts:41`
+**Issue:** `EMBED_PLACEHOLDER` matches only `data-embed` before `data-id`, double-quoted, with an empty body. A placeholder written in the Source tab as `<figure data-id="…" data-embed="youtube"></figure>` passes the Go policy and the layer sanitizer. sanitize-html keeps attribute order, so it renders as an inert empty figure with no error anywhere. The editor's Embed node accepts either order (`extensions.ts:327-341`).
+**Fix:** In the layer, match either attribute order (or parse the figure's attributes after sanitizing). Alternatively, have Decode normalize the placeholder's attribute order.
+
+### IN-02: The expanded YouTube iframe has no `sandbox`, and the exported `/g` regex carries shared `lastIndex` state
+
+**File:** `../vue-journal-layer/app/utils/embeds.ts:41, 56-60`
+**Issue:** The iframe is fixed to youtube-nocookie with a validated id, which is fine, but it has no `sandbox` attribute as defence in depth. `EMBED_PLACEHOLDER` is an exported global regex; a consumer that calls `.test()` or `.exec()` on it gets stateful results.
+**Fix:** Add `sandbox="allow-scripts allow-same-origin allow-presentation allow-popups"`. Export a factory or a non-global pattern and build the `/g` regex inside `expandEmbeds`.
+
+### IN-03: Plugin aliases can shadow list column types, and ListValue is then silently ignored
+
+**File:** `modules/cabana/field_type.go:104-109`, `modules/cabana/list_schema.go:22-24, 242-251`
+**Issue:** `checkFieldTypeDef` refuses only `formFieldTypes`. A plugin alias `date`, `datetime` or `time` is accepted at boot, but a list column of that type resolves to the built-in column type and never calls the plugin's `ListValue`.
+**Fix:** Also refuse aliases in `listColumnTypes`.
+
+### IN-04: `crypto.randomUUID()` throws outside a secure context
+
+**File:** `../sm-journal-plugin/assets/src/blogeditor/element.ts:551`
+**Issue:** On an admin served over plain HTTP from a non-localhost host (a LAN dev box), `crypto.randomUUID` is undefined and every upload throws. The status line still says "uploading".
+**Fix:** Fall back to `crypto.getRandomValues` or a counter for the request id.
+
+### IN-05: content_html translations are skipped silently when the application is unavailable
+
+**File:** `../sm-journal-plugin/controllers/posts.go:263-270`
+**Issue:** `writeContentHTMLTranslations` returns nil when `c.application()` or the writer is nil, while cabana has already written the `content` translation through its own writer. The two columns then diverge with no error.
+**Fix:** Return an error, which aborts the transaction, when a non-default write exists but no writer can be resolved.
+
+### IN-06: Untouched detection cannot be byte-exact for legacy content with invalid UTF-8
+
+**File:** `modules/cabana/field_type.go:641-651`
+**Issue:** JSON transport replaces invalid UTF-8 with U+FFFD, so the echoed value never equals the served value under `sameJSON`. An untouched save then rewrites such a row with replacement characters, which breaks D-03 for those rows.
+**Fix:** Document the limitation, or compare after normalizing the served value with `strings.ToValidUTF8(s, "<22>")`.
+
+### IN-07: "Edit as HTML" selects the first identical block
+
+**File:** `../sm-journal-plugin/assets/src/blogeditor/element.ts:524-532`
+**Issue:** `textarea.value.indexOf(html)` selects the first occurrence when two raw HTML blocks are identical, so the wrong block is highlighted.
+**Fix:** Pass the node position and map it to the block's source offset through `#blocks`.
+
+### IN-08: Plugin-typed fields cannot declare `readOnly`/`hidden`/`disabled` in YAML
+
+**File:** `modules/cabana/field_type.go:33-36`
+**Issue:** `pluginFieldKeys` excludes general keys such as `readOnly` (and `checkFieldTypeDef` forbids options with those names), but `PluginField.vue:50` honours `field.readOnly`. A plugin field can therefore never be made read-only from fields.yaml.
+**Fix:** Allow the general keys the SPA and server already understand (`readOnly`, `hidden`, `placeholder`, `cssClass`) for plugin fields, or document the restriction in `docs/backend/field-types.md`.
+
+---
+
+_Reviewed: 2026-10-10T14:29:09Z_
+_Reviewer: Claude (msd-code-reviewer)_
+_Depth: standard_

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-SECURITY.md

@@ -0,0 +1,131 @@
+---
+phase: "16.2"
+slug: "plugin-provided-field-types-and-the-blog-editor-formwidget"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+asvs_level: 1
+created: "2026-10-28"
+---
+
+# Phase 16.2 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+Paths are relative to the meta repo (`summercms.go/`, `sm-journal-plugin/`, `vue-journal-layer/`, `sm-grzybyfunkcjonalne-app/`). Code was checked at each repo's HEAD; for code that later moved (the site-cache purger now lives in `summercms.go/modules/cooler`), the 16.2 release commit `5eea57f` was checked too.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| admin browser → cabana admin API | Save bodies, upload bodies and field-type requests (cookie or Bearer session) | field values in every locale, uploaded files |
+| plugin Go code → cabana | Decode, Load, ListValue and Upload run inside cabana's handlers and save transaction | decoded values, plugin errors and notices |
+| plugin element JS → admin SPA DOM | The element runs in the admin origin under CSP `script-src 'self'` | `value` property, plain attributes, `summer-upload` events |
+| stored post HTML → admin editor DOM | Imported or previously saved HTML is parsed into the editor | untrusted HTML |
+| admin save body → Journal Decode | Every locale's content value crosses here through cabana | HTML to sanitize |
+| editor upload → media bucket | User files become public URLs under `/storage/app/uploads/public` | image bytes, object keys |
+| Journal API `content_html` → site `v-html` | Stored HTML becomes page markup | HTML, embed placeholders |
+| site page → youtube-nocookie.com | The visitor's browser loads a third-party frame | referrer, visitor IP |
+| Go host → Nuxt (loopback HTTP) | Journal calls the layer purge route with a bearer token | purge token, slug |
+| internet → nginx → Nuxt | Visitors reach Nuxt with GET/HEAD only; nginx adds forwarding headers | requests, X-Forwarded-For |
+| npm registry → plugin build | `@tiptap/*` packages enter the committed bundle | third-party code |
+| executor → git origin / UAT server | Tags and pushes read by other repos; release runs next to the live Winter site | tags, binaries, `.env` secrets (server only) |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-16.2-01 | Spoofing | compileFieldTypes alias registry | high | mitigate | `summercms.go/modules/cabana/field_type.go:106` refuses core aliases, `:166-171` refuses a cross-plugin alias naming both owners, `:172` checkWidgetTag (prefix check `extension.go:346`) | closed |
+| T-16.2-02 | Tampering (stored XSS) | decodePluginFields | high | mitigate | `crud.go:830-852` runs it inside the save transaction; `field_type.go:465/489/511` decode host value and every locale; only skip is the served-value match `:539-541`, which writes nothing | closed |
+| T-16.2-03 | Elevation of Privilege | fieldUpload route | high | mitigate | `http.go:452` requireAjax; `field_type_upload.go:35` protect (guard and permissions `http.go:1216-1225`), `:49/:142-160` field/context check and 404 without Upload, `:124` loadRecord scope; `auth.go:253` SameSite=Strict | closed |
+| T-16.2-04 | Denial of Service | fieldUpload body | medium | mitigate | `field_type_upload.go:69` MaxBytesReader on `upload_bytes`, `:85/:168-177` exactly one part, `:200-204` 413 | closed |
+| T-16.2-05 | Information Disclosure | PluginField / element | high | mitigate | `admin/src/components/form/fields/PluginField.vue:63-65,76-84` value and plain attributes only, upload via SPA `api.POST` `:133`; test `admin/tests/form/PluginField.test.ts:103` | closed |
+| T-16.2-06 | Tampering | typeOptions to element | low | mitigate | `PluginField.vue:44,81` JSON attribute string; no `v-html` | closed |
+| T-16.2-07 | Information Disclosure | plugin errors | medium | mitigate | `field_type.go:669-686` only `*pact.FormFieldError` → 422; `:690-693` and `:727-729` opaque 500 | closed |
+| T-16.2-08 | Tampering | untouched skip | low | accept | See AR-16.2-01 | closed |
+| T-16.2-33 | Tampering (admin XSS) / DoS | save notices | medium | mitigate | `admin/src/components/form/FormField.vue:86`, `ui/Toast.vue:34` text interpolation only; `field_type.go:40-42,799,811` 10 notices per field/locale, 500 runes; test `FormField.test.ts:50` | closed |
+| T-16.2-09 | Elevation of Privilege (admin XSS) | rawHtml node view | high | mitigate | `sm-journal-plugin/assets/src/blogeditor/extensions.ts:301,315` textContent; parse in inert document `:270-273`; test `tests/blogeditor/smoke.test.ts:135` | closed |
+| T-16.2-10 | Tampering (stored XSS) | Source tab and pasted HTML | high | mitigate | `classes/blog_editor.go:164` SanitizeHTMLReport on every locale; admin `FormView.vue:478` adopts the stored value; layer `PostBody.vue:13` sanitizes again | closed |
+| T-16.2-11 | Tampering | link mark | medium | mitigate | `extensions.ts:42-63` isPolicyUrl (control chars removed first), `:545`; `element.ts:465,570`; tests `smoke.test.ts:417-424` | closed |
+| T-16.2-12 | Elevation of Privilege | bundle under admin CSP | medium | mitigate | no `eval(`/`new Function(` in `assets/dist/blogeditor.js`; `element.ts:202` `injectCSS: false`; CSS scoped under `golem15-journal-blogeditor` | closed |
+| T-16.2-13 | Information Disclosure | uploads | high | mitigate | `element.ts:559` dispatches `summer-upload {id, file}` only; no fetch, XHR, cookie or storage access in `assets/src/blogeditor` | closed |
+| T-16.2-14 | Tampering (stored XSS) | decodeBlogHTML (posts, categories) | high | mitigate | `blog_editor.go:154-166`; `models/post/fields.yaml:19`, `models/category/fields.yaml:28`; tests `posts_admin_smoke_test.go:360`, `categories_admin_editor_test.go:56` | closed |
+| T-16.2-31 | Tampering (stored XSS) | newHTMLPolicy editor-output extension | high | mitigate | `classes/format_html.go:63-72`, exactly four AllowAttrs added since `c60abc6`; 16.1 policy tests unchanged; `editor_policy_test.go:68` | closed |
+| T-16.2-34 | Denial of Service | SanitizeHTMLReport and removal notices | low | mitigate | `format_html.go:105` (`maxRemovalNames = 10`), `:145-153`; cabana cap (T-16.2-33) | closed |
+| T-16.2-15 | Tampering / Elevation | uploadBlogImage | high | mitigate | `media_store.go:89-93` allowlist without svg, `:20,98-104` 10240 KiB cap; `blog_editor.go:365-375` DetectContentType; staging vhost `:89` nosniff | closed |
+| T-16.2-16 | Tampering | upload keys | medium | mitigate | `blog_editor.go:129-147` folder check at boot, `:397-426` safeUploadName; `media_store.go:155,193-224` never overwrites | closed |
+| T-16.2-17 | Repudiation / contract | public posts and media routes | medium | mitigate | `controllers/api/posts_helpers.go`, `posts.go`, `routes.go` unchanged `c60abc6..5eea57f`; `api/media.go:43-63` keeps body and errors | closed |
+| T-16.2-18 | Information Disclosure | content_html companion writes | low | mitigate | `controllers/posts.go:216-224,271-308` written locales only, in the transaction | closed |
+| T-16.2-19 | Tampering (iframe injection) | expandEmbeds | high | mitigate | `vue-journal-layer/app/utils/embeds.ts:41` exact regex, `:51` provider allowlist, `:53` id pattern, `:29` fixed host | closed |
+| T-16.2-20 | Elevation of Privilege | sanitize-then-expand order | high | mitigate | `Journal/PostBody.vue:13`, `CategoryHeader.vue:11` `expandEmbeds(sanitizeJournalHtml(...))`, no other caller; gate `check-phase16.2.sh:123` | closed |
+| T-16.2-32 | Tampering (policy drift) | htmlGate.ts mirror | high | mitigate | `app/utils/htmlGate.ts:68-71,122-127`, only these rules since `294a8d8`; corpus copies identical (`cmp`) | closed |
+| T-16.2-21 | Information Disclosure (visitor privacy) | YouTube frame | low | mitigate | `embeds.ts:29,57-58` nocookie host, lazy, strict-origin-when-cross-origin; staging vhost `:93` frame-src (report-only; server install pending, WINDOWS 19) | closed |
+| T-16.2-22 | Tampering / Repudiation | layer tag and pushes | medium | mitigate | v0.2.0 annotated (`042b65d → 759e684`); `scripts/check-git-install.sh`; 04-SUMMARY records `check-git-install: ok` and pushed heads | closed |
+| T-16.2-23 | Tampering (false-green release) | release gate | medium | mitigate | 05-SUMMARY `release-gate-ok`, Docker-only suites listed, human reply "release v0.1.18" | closed |
+| T-16.2-24 | Tampering / Repudiation | annotated tag and pushes | high | mitigate | v0.1.18 annotated (`04dc5bd → f1d8a75`), contains plan 01 head `4adb48a`; binary sha256 matched; heads on origin | closed |
+| T-16.2-25 | Information Disclosure | credentials | high | mitigate | `sm-grzybyfunkcjonalne-app/DEPLOY.md:74` no `.env` rsync; no env file tracked; `.gitignore:5`; 05-SUMMARY no auth gates | closed |
+| T-16.2-26 | Tampering | UAT database and Winter site | medium | mitigate | 05-SUMMARY: SELECT-only checks, `.prev` rollback copies kept | closed |
+| T-16.2-35 | Tampering | UAT strip check | low | mitigate | Strip verified (05-SUMMARY edit-ok); test post `uat-16-2-blog-editor` (id 105) deleted by the user on 2026-10-28 | closed |
+| T-16.2-27 | Elevation of Privilege | sudo on the server | low | accept | See AR-16.2-02 | closed |
+| T-16.2-28 | Tampering | test isolation | low | mitigate | `sm-journal-plugin/vite.config.ts:38`; memblob, testcontainers; no ssh, curl or child_process in tests | closed |
+| T-16.2-29 | Repudiation (false green) | phase gate | medium | mitigate | `summercms.go/scripts/check-phase16.2.sh:143-270` detectors, `:376-450` self-test, `:570-586` NOT RUN and `PHASE162_REQUIRE_POSTGRES` | closed |
+| T-16.2-30 | Tampering (security regression) | strip, policy, permission tests | medium | mitigate | `check-phase16.2.sh:64-130` named tests, `:479-482` 16.1 policy tests pinned to `c60abc6`, `:502` corpus `cmp` | closed |
+| T-16.2-36 | Spoofing / DoS | layer purge route | medium | mitigate | `server/api/__journal__/cache/purge.post.ts:25-30`; `app/utils/siteCache.ts:39` 32-char minimum, `:40` proxied → 404, `:43` timingSafeEqual over sha256; staging vhost `:236-239` `limit_except`; 07-SUMMARY purge-ok `200 83 403 401` | closed |
+| T-16.2-37 | Information Disclosure | purge token | high | mitigate | log-capture tests `5eea57f:classes/site_cache_test.go:158-162`, now `modules/cooler/sitecache_test.go:257`; `DEPLOY.md:86,210-213` urandom/printf, `-H @-`; only `token-match` crossed ssh. See Follow-ups for a later leak path | closed |
+| T-16.2-38 | Tampering (stale content) | purge ordering | medium | mitigate | lagoon.AfterCommit `5eea57f:classes/site_cache.go:181`, now `cooler/sitecache.go:306`; tests `site_cache_admin_test.go:162,240` | closed |
+| T-16.2-39 | Denial of Service | admin save path | low | mitigate | 2 s WithTimeout(WithoutCancel) `cooler/sitecache.go:32,159`; tests `site_cache_admin_test.go:319,349` | closed |
+| T-16.2-40 | Information Disclosure | purge URL misconfiguration | medium | mitigate | `cooler/sitecache.go:82-109` (was `site_cache.go:57-84`): both-or-neither, no userinfo or fragment, http only to loopback, 32-char token | closed |
+| T-16.2-41 | Tampering (log injection) | layer purge log line | low | mitigate | `siteCache.ts:83` strips control chars, `:14` 200-char slug cap | closed |
+| T-16.2-42 | Tampering (cache poisoning) | Nitro route cache | medium | mitigate | `nuxt.config.ts:77` `cache: false`; `purge.post.ts:18` no-store; `testing/purge-check.mjs:175-184` | closed |
+| T-16.2-43 | Denial of Service | full route-cache purge | low | accept | See AR-16.2-03 | closed |
+| T-16.2-44 | Repudiation (false-green gate) | phase gate | medium | mitigate | `check-phase16.2.sh:72,88,93,557,565`; VALIDATION 07-T3 green with `PHASE162_REQUIRE_POSTGRES=1` | closed |
+| T-16.2-45 | Tampering / Repudiation | tags and pushes | high | mitigate | v0.1.20 (`ad7981f → aba063f`), layer v0.3.0 (`c09e0d0 → 25e9bfe`) match 07-SUMMARY; heads on origin; sha256 matched; site lockfile `3a920c7` resolves to `25e9bfe` | closed |
+| T-16.2-46 | Tampering | UAT database and Winter site | medium | mitigate | 07-SUMMARY: read-only snapshots, human-only data changes, deploy-ok `.prev` rollback checks | closed |
+| T-16.2-SC | Tampering | packages (all seven plans) | high | mitigate | 01, 03, 06: no dependency file changes; 02: exact `@tiptap/*` pins 3.31.4, committed lockfile, `scripts/check-dist.sh` rebuild diff, human "packages approved"; 04, 07: layer version bump and pin only, `node:crypto` only; 05: `build.sh:53` `--frozen-lockfile` | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-16.2-01 | T-16.2-08 | Submitting the served value only skips the write; the skip cannot store anything Decode did not already accept (`field_type.go:539-541`) | plan 16.2-01 threat model; reconfirmed by audit | 2026-10-28 |
+| AR-16.2-02 | T-16.2-27 | Server sudo is limited to `nginx -t`, nginx reload and supervisorctl (`DEPLOY.md:34`); the release used supervisorctl only | plan 16.2-05 threat model; reconfirmed by audit | 2026-10-28 |
+| AR-16.2-03 | T-16.2-43 | Only authenticated loopback callers can purge; admin saves are rare; each page re-renders once from the local API | plan 16.2-07 threat model; reconfirmed by audit | 2026-10-28 |
+
+*Accepted risks do not resurface in future audit runs.*
+
+---
+
+## Follow-ups (outside the 16.2 register)
+
+- **Purge token likely exposed on UAT (later regression, not 16.2 code).** The site app pins vue-journal-layer v0.4.0, which brings `@nuxtjs/seo` / nuxt-site-config; that copies every `NUXT_SITE_*` variable into page payloads, and `sm-grzybyfunkcjonalne-app/DEPLOY.md:86` names the token `NUXT_SITE_CACHE_PURGE_TOKEN`. Fixed in the layer at v0.6.0 (`e0cc871`). Not checked on the live server. Action: bump the pin to ≥ v0.6.0, rename to `NUXT_CACHE_PURGE_TOKEN`, rotate the token.
+- **Surface added after planning, no threat ID:** Blog Editor preview pane (empty-sandbox `srcdoc` iframe with CSP meta, `sm-journal-plugin/assets/src/blogeditor/preview.ts:6-14,190`, accepted in UAT test 5); admin "View site" link (`admin/src/components/shell/AppShell.vue:80-81`, `noopener noreferrer`); visitor X-Forwarded-For forwarded to Go on cached renders (`vue-journal-layer/server/plugins/journal-client-address.ts`, commit `03a90e9`).
+- **Housekeeping:** WINDOWS entry 19 still needs the staging vhost install (frame-src); the test-post part is done. 16.2-VALIDATION rows 07-T4..T6 still read pending although 07-SUMMARY records them as passed.
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-10-28 | 47 | 47 | 0 | msd-security-auditor (retroactive, State B); T-16.2-35 closed after the user deleted UAT post 105 |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-28

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-UAT.md

@@ -0,0 +1,86 @@
+---
+status: complete
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+source: [16.2-VERIFICATION.md]
+started: 2026-10-10T14:54:46Z
+updated: 2026-10-10T19:15:00Z
+---
+
+## Current Test
+
+[testing complete]
+
+## Tests
+
+### 1. Postgres suites on a Docker host
+expected: bash scripts/check-phase16.2.sh postgres passes. This is the end-to-end proof for the CR-01 and WR-04 Load changes and for the category save.
+result: pass
+reported: "Re-run after 16.2-07 (gate2.log, 2026-10-10 18:44): phase16.2 postgres passed — 293 cabana tests and 78 sm-journal-plugin tests; full gate \'Phase 16.2 gate passed\', exit 0. Was: TestPhase10OpenAPIConformance had no case for GET /field-types (G-16.2-1, fixed in 11be08d)."
+
+### 2. D-19 category content on UAT (WINDOWS 18)
+expected: Change one word in a category body and save. No removal notice appears, and the site shows the change.
+result: pass
+reported: "Re-run on v0.1.20 with the site cache purge (16.2-07 Task 6): user changed \'zajmują ważne miejsce\' to \'zajmują bardzo ważne miejsce\' on category 2, no removal notice, change visible on the first view of /cordyceps by reload and menu link. category-purged and category-fresh pass; phrase found once in the server-rendered page. Was: Nitro swr cache served the old page (G-16.2-2)."
+
+### 3. Untouched re-save after the next deploy (with the CR-01/WR-04 fixes)
+expected: Re-save posts 1 and 64 untouched. The md5 SELECT is unchanged (1: a026264105f900175b9770e637e5ec5c both columns; 64: 0e4be845390b1656871513957d471a7c:e785e14e80f6400534e16b4769749d3c) and updated_at moves.
+result: pass
+reported: "Re-run on v0.1.20 (includes CR-01/WR-04), 16.2-07 Task 6: user re-saved posts 1 and 64 untouched, no removal notice. posts-unchanged (md5 equal to the snapshot, updated_at moved past the 17:57:57Z restart) and translations-unchanged pass."
+
+### 4. Preview pane in a real browser (quick 261010-iwu)
+expected: 50/50 split; the pane wraps below the editor when the element is narrower than about 720px; a <script> in a raw HTML block stays inert; YouTube thumbnails load; relative /storage images resolve.
+result: pass
+
+### 5. Accept the sandboxed preview iframe as an exception to plan 02's "no iframe in the admin"
+expected: The human accepts the empty-sandbox srcdoc preview, or asks for a change.
+result: pass
+
+## Summary
+
+total: 5
+passed: 5
+issues: 0
+pending: 0
+skipped: 0
+blocked: 0
+
+## Gaps
+
+- gap_id: G-16.2-1
+  truth: "bash scripts/check-phase16.2.sh postgres passes on a Docker host"
+  status: resolved
+  reason: "Observed by Claude running the postgres stage: TestPhase10OpenAPIConformance fails: admin route GET /field-types (added in 16.2) has no conformance case in modules/cabana/openapi_conformance_test.go; the Journal Postgres suites never ran because the stage aborted"
+  severity: major
+  test: 1
+  root_cause: "Two 16.2 test defects, hidden because both checks live in Docker-gated packages and the 16.2 execution host had no Docker: (1) TestPhase10OpenAPIConformance has no case for the two routes plan 16.2-01 added to phase09Routes/admin.json, GET /field-types and POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload (map order decides which is reported); (2) sm-journal-plugin TestJournalSVGEmbed still asserts post content type mlmarkdown, but 16.2-03 changed it to mlblogeditor. The gate's go stage (FRAMEWORK_RUN) never runs the route check. All four Journal Postgres suites named in Test 1 and the rest of cabana pass on a Docker host."
+  artifacts:
+    - path: "modules/cabana/openapi_conformance_test.go"
+      issue: "no conformance case for GET /field-types or the field upload route; conformPlugin registers no plugin field type; route-key check runs after the testcontainers setup"
+    - path: "../sm-journal-plugin/plugin_test.go"
+      issue: "TestJournalSVGEmbed lines 122-123 expect type: mlmarkdown"
+    - path: "scripts/check-phase16.2.sh"
+      issue: "FRAMEWORK_RUN does not include the route-coverage check"
+    - path: ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-PATTERNS.md"
+      issue: "new-route checklist omits openapi_conformance_test.go"
+  missing:
+    - "Conformance case for GET /field-types (200, cabana.FieldTypesResponse), with conformPlugin implementing pact.HasFormFieldTypes"
+    - "Conformance case for the field upload route (201, cabana.Envelope-cabana_FieldUploadResponse, multipart file)"
+    - "TestJournalSVGEmbed expects type: mlblogeditor"
+    - "Route-coverage check runnable without Docker and included in the gate's go stage"
+  debug_session: .planning/debug/postgres-gate-field-types-conformance.md
+
+- gap_id: G-16.2-2
+  truth: "Changing one word in a category body and saving shows no removal notice, and the site shows the change"
+  status: resolved
+  reason: "User reported: something is wrong. Updated content in https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/categories/2 (\"Te grzyby, szczególnie\" changed into \"Te grzyby, a szczególnie\") and i see the change in backend even after refresh but not on frontend"
+  severity: major
+  test: 2
+  root_cause: "Not a 16.2 save defect. DB row (category 2, content) and the Journal API both hold the new text. The public page was served from the host Nuxt app's Nitro swr route cache (nuxt.config.ts routeRules '/**': { swr: 300 }, per Phase 16 D-07): /cordyceps was cached at 14:59:08 UTC, 40 s before the first save, and all post-save views fell inside the 300 s fresh window. Nothing purges the cache on admin save; after expiry the first view still gets stale content and triggers revalidation. At 15:25 UTC the page served the new text with no intervention. The UAT expectation omitted the cache window."
+  artifacts:
+    - path: "sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/nuxt.config.ts"
+      issue: "swr 300 / 120 route cache with no purge path on admin save (by design, Phase 16 D-07)"
+    - path: ".planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-UAT.md"
+      issue: "Test 2 expectation does not account for the swr TTL"
+  missing:
+    - "User decision 2026-10-10: fix in 16.2. A Journal post/category save clears the matching host Nuxt page cache entries (pages, /blog lists, _payload.json) so the site shows the edit on the next view"
+  debug_session: .planning/debug/category-content-not-on-site.md

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md

@@ -4,9 +4,10 @@ slug: "plugin-provided-field-types-and-the-blog-editor-formwidget"
 # status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
 # audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
 status: draft
-nyquist_compliant: false
-wave_0_complete: false
+nyquist_compliant: true
+wave_0_complete: true
 created: "2026-10-09"
+revised: "2026-10-10"
 ---
 
 # Phase 16.2 — Validation Strategy
@@ -40,30 +41,54 @@ created: "2026-10-09"
 
 | Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
 |---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
-| TBD | — | — | D-11 | — | Alias collision fails boot | unit | `go test -short ./modules/cabana -run TestFieldTypeRegistry` | ❌ W0 | ⬜ pending |
-| TBD | — | — | D-12.1 | — | Unknown plugin key fails boot | unit | `go test -short ./modules/cabana -run TestFieldTypeOptions` | ❌ W0 | ⬜ pending |
-| TBD | — | — | D-12.2 / D-10 | XSS | CheckHTML refuses per locale → 422 | unit | `go test -short ./modules/cabana -run TestFieldTypeDecode` | ❌ W0 | ⬜ pending |
-| TBD | — | — | D-03 | — | Untouched value writes nothing | unit | `go test -short ./modules/cabana -run TestFieldTypeUntouched` | ❌ W0 | ⬜ pending |
-| TBD | — | — | D-12.4 | — | List column uses plugin formatter | unit | `go test -short ./modules/cabana -run TestFieldTypeListValue` | ❌ W0 | ⬜ pending |
-| TBD | — | — | D-13 / D-15 | — | Schema/OpenAPI/TS in sync | unit + script | `bash scripts/check-admin-openapi.sh --check` | ✅ | ⬜ pending |
-| TBD | — | — | D-13 | — | PluginField binds value, emits on summer-change | vitest | `npm --prefix admin test -- PluginField` | ❌ W0 | ⬜ pending |
-| TBD | — | — | D-18 | upload | Auth, CSRF, permission, scope, size cap, type allowlist | unit | `go test -short ./modules/cabana -run TestFieldUpload` | ❌ W0 | ⬜ pending |
-| TBD | — | — | D-07 | — | Markdown post served as content_html | unit | `go -C ../sm-journal-plugin test -short ./classes -run TestBlogEditorLoad` | ❌ W0 | ⬜ pending |
-| TBD | — | — | D-03 / D-04 | XSS | Element round-trips; rawHtml card shows escaped text | vitest | `npm --prefix ../sm-journal-plugin test` | ❌ W0 | ⬜ pending |
-| TBD | — | — | todo resave | — | Untouched re-save byte-identical | integration (Postgres) | `go -C ../sm-journal-plugin test -run TestPostsAdminResaveKeepsHTML ./...` | ✅ (tighten) | ⬜ pending |
-| TBD | — | — | D-17 | iframe | Embed allowlist, id regex, gate-first | node:test | `npm --prefix ../vue-journal-layer test` | ❌ W0 | ⬜ pending |
-| TBD | — | — | docs | — | README/docs identifiers exist | unit | `go test ./cmd/summer -run TestDocsTree` | ✅ | ⬜ pending |
+| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-11 | T-16.2 boot | Alias pattern, core and cross-plugin clash (both IDs named), element prefix and reserved tag, missing Decode, missing AdminFS, asset path and extension fail boot | unit | `go test -count=1 -run '^TestFieldTypeRegistry$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.1 | — | Option key pattern, field-key clash and repeats fail boot; an undeclared fields.yaml key fails naming field and key | unit | `go test -count=1 -run '^TestFieldTypeOptions$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-12 | — | General keys accepted, core type keys refused, option values of every YAML kind decoded, CheckOptions error surfaced; CompileForm core-only; settings and relation forms refuse plugin types | unit | `go test -count=1 -run '^TestFieldTypeCompile$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.2 / D-10 | XSS | FormFieldError on the default or a non-default locale → 422 on the field, no write, no notices; other errors and a non-string translatable value → opaque 500 | unit | `go test -count=1 -run '^TestFieldTypeDecode$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-10 | — | Notices → meta.notices with field and locale, localized through phrasebook (Count plural, Params), ≤ 10 per field and locale, ≤ 500 runes; no notices key when none | unit | `go test -count=1 -run '^TestFieldTypeNotices$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-03-T1, 16.2-06-T2 | 03, 06 | 2, 4 | D-10 / D-02 | XSS | Journal Decode strips per locale and reports; clean HTML byte-identical with no notice; report empty exactly when nothing changed; notices only when stripped | unit | `go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorDecode\|TestBlogEditorNotices\|TestSanitizeHTMLReport)$' ./classes/` | ✅ | ✅ green |
+| 16.2-03-T3, 16.2-06-T2 | 03, 06 | 2, 4 | D-05 | XSS | Editor corpus passes SanitizeHTML byte for byte; the four editor rules admit nothing else (other providers, malformed ids, data attributes elsewhere, iframe stripped) | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestEditorOutputPassesPolicy$' ./classes/` | ✅ | ✅ green |
+| 16.2-01-T4, 16.2-06-T3 | 01, 06 | 1, 4 | D-10 | XSS | Save notices render as literal text under the field (aria-describedby) and in the toast; stored value reloaded into the element | vitest | `npm --prefix admin test -- tests/form/FormField.test.ts tests/form/formState.test.ts tests/form/PluginField.test.ts` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T1 | 01, 06 | 1, 4 | D-03 | — | Untouched value writes and reports nothing; one changed locale writes only that locale; canonical JSON comparison; create never skips | unit | `go test -count=1 -run '^TestFieldTypeUntouched$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.3 | — | Load per locale; nil Load keeps the stored value; Load errors (FormFieldError included) are opaque 500 | unit | `go test -count=1 -run '^TestFieldTypeLoad$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.4 | — | List column uses ListValue with the request ctx; nil ListValue keeps the raw value | unit | `go test -count=1 -run '^TestFieldTypeListValue$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-14 | — | FieldWritesFromContext copies; false outside a save; Before and After hooks of create and update see the same writes | unit | `go test -count=1 -run '^TestFieldTypeWrites$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-13 | — | GET /field-types sorted, versioned asset URLs under the admin prefix, [] lists, 401 without a backend session | unit | `go test -count=1 -run '^TestFieldTypesRoute$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-01-T4 | 01 | 1 | D-13 / D-15 | — | Schema/OpenAPI/TS in sync; admin dist current | unit + script | `bash scripts/check-admin-openapi.sh --check && bash scripts/check-admin-dist.sh` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-01-T4, 16.2-06-T1, 16.2-06-T3 | 01, 06 | 1, 4 | D-13 / D-03 | — | PluginField binds value, takes summer-change, never re-sets an echoed value; fieldTypes loads each script once, global styles stay on, nothing rejects; registry renders PluginField / MLPluginField | vitest | `npm --prefix admin test -- tests/form/PluginField.test.ts tests/app/fieldTypes.test.ts tests/form/registry.test.ts tests/list/ListView.test.ts` | ✅ | ✅ green |
+| 16.2-01-T3, 16.2-03-T2, 16.2-06-T2 | 01, 03, 06 | 1, 2, 4 | D-18 | upload | Upload 201, 403, 401, 404 (core field, no Upload, unknown field, context refusal, unknown controller), 413, 422 (FormFieldError, missing/misnamed/extra part, not multipart), opaque 500; Journal sniffing refuses disguised files and svg; safe names; StoreMedia never overwrites | unit | `go test -count=1 -run '^TestFieldUpload$' ./modules/cabana && go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorUpload\|TestStoreMedia)$' ./classes/` | ✅ | ✅ green |
+| 16.2-03-T1, 16.2-06-T1 | 03, 06 | 2, 4 | D-07 | — | HTML served verbatim (leading white space, comment); markdown served as content_html, empty falls back to FormatHTML; nil and empty pointers give "" | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestBlogEditorLoad$' ./classes/` | ✅ | ✅ green |
+| 16.2-03-T1, 16.2-06-T2 | 03, 06 | 2, 4 | D-02 / D-14 | — | Posts hooks: default write copied to content_html, non-default writes through the TranslationWriter, nothing for untouched content or without a writer | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestPostsEditorHooks$' ./controllers/` | ✅ | ✅ green |
+| 16.2-02-T2, 16.2-02-T3, 16.2-06-T1, 16.2-06-T3 | 02, 06 | 1, 4 | D-03 / D-04 | XSS | Element returns an untouched value byte for byte through Source, tabs, preview and reattach; raw HTML cards are escaped text; every raw tag rule; figures; links limited to http, https, mailto, relative; block reuse after edit, deletion and insertion | vitest | `npm --prefix ../sm-journal-plugin test` | ✅ | ✅ green |
+| 16.2-02-T3 | 02 | 1 | D-05 | — | Committed editor corpus equals the editor's current output | vitest | `npm --prefix ../sm-journal-plugin test -- tests/blogeditor/corpus.test.ts` | ✅ | ✅ green |
+| 16.2-03-T1, 16.2-06-T1 | 03, 06 | 2, 4 | todo resave / D-03 | — | Untouched GET-then-PUT of an HTML and a markdown post byte-identical with no notices and no translated content added; a clean edited save stores equal content and content_html per locale | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run TestPostsAdminResaveKeepsHTML .` | ✅ | ✅ green (Docker host, gate postgres stage, 16.2-07) |
+| 16.2-03-T1 | 03 | 2 | D-10 / D-02 | XSS | Admin post save strips unsafe markup in both columns per locale and reports it (no 422) | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run TestPostsAdminSaveSanitizesHTML .` | ✅ | ✅ green (Docker host, gate postgres stage, 16.2-07) |
+| 16.2-03-T2, 16.2-06-T2 | 03, 06 | 2, 4 | D-19 / D-10 | XSS | Category content: untouched saves keep imported markup and NULL, clean edit as sent, unsafe edit stripped with notices (no 422), blank to NULL, editor upload under journal/categories | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run '^(TestCategoriesAdminContent\|TestCategoriesAdminBlogEditor)$' .` | ✅ | ✅ green (Docker host, gate postgres stage, 16.2-07) |
+| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12 / D-18 | upload | Real-database create, show, untouched and changed update, refused update rolls back, upload in and out of the FormExtendQuery scope | integration (Postgres) | `go test -count=1 -run '^TestFieldTypeSavePostgres$' ./modules/cabana` | ✅ | ✅ green (Docker host, gate postgres stage, 16.2-07) |
+| 16.2-04-T1, 16.2-06-T3 | 04, 06 | 2, 4 | D-17 / D-05 | iframe | Embed allowlist and id regex; sanitize first, expand last at each sink, never in payload transforms; stored iframe stripped; corpus safe under the mirror; Go negatives stripped the same way; corpus copies identical | node:test + cmp | `npm --prefix ../vue-journal-layer test && cmp ../vue-journal-layer/tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` | ✅ | ✅ green |
+| 16.2-01-T2, 16.2-06-T3 | 01, 06 | 1, 4 | docs | — | README/docs identifiers exist; plugin dist current | unit + script | `go test -count=1 ./cmd/summer -run TestDocsTree && bash ../sm-journal-plugin/scripts/check-dist.sh` | ✅ | ✅ green |
+| 16.2-06-T3 | 06 | 4 | all | T-16.2-29 | Phase gate: every runnable stage fail-closed, detectors self-tested | script | `bash scripts/check-phase16.2.sh --self-test && bash scripts/check-phase16.2.sh --all` | ✅ | ✅ green |
+| 16.2-07-T1 | 07 | 5 | D-19 | T-16.2-36, T-16.2-38 | Tracer: a category admin update sends one authorized purge after its commit; on a built swr site a cached page shows a change on the first request after the purge; unauthenticated, wrong-token and proxied purges refused | integration (Postgres) + e2e | `go -C ../sm-journal-plugin test -count=1 -run '^TestCategoriesAdminPurgesSiteCache$' . && pnpm -C ../vue-journal-layer run build:playground && node ../vue-journal-layer/testing/purge-check.mjs --output ../vue-journal-layer/.playground/.output --fixtures ../vue-journal-layer/testing/fixtures/acme --kind post --slug hello-acme --path /blog/hello-acme` | ✅ | ✅ green |
+| 16.2-07-T2 | 07 | 5 | D-19 | T-16.2-37, T-16.2-40, T-16.2-42 | Every admin post and category write purges after commit; boot refuses bad purge config; route-cached pages and 304s carry max-age=0; second purge after re-cache runs; payload purged; no-token server 404 | integration (Postgres) + e2e | `go -C ../sm-journal-plugin test -count=1 -run '^(TestCategoriesAdminPurgesSiteCache\|TestPostsAdminPurgesSiteCache)$' . && bash scripts/check-phase16.2.sh cache` | ✅ | ✅ green |
+| 16.2-07-T3 | 07 | 5 | D-13, D-18 | T-16.2-44 | Every inventoried admin route has a conformance case, checked without Docker; GET /field-types and the field upload route decode into their documented types with unknown fields disallowed and match admin.json; TestJournalSVGEmbed expects mlblogeditor | unit + integration (Postgres) | `go test -count=1 -short -run '^TestPhase10ConformanceInventory$' ./modules/cabana && go test -count=1 -run '^TestPhase10OpenAPIConformance$' ./modules/cabana` | ✅ | ✅ green |
+| 16.2-07-T3 | 07 | 5 | D-19 | T-16.2-37, T-16.2-39, T-16.2-41 | Purger config table, request contract, Warn on 500/401, 2 s timeout, cancelled parent context, no token in logs; layer auth, purge, body parsing and revalidation | unit + node:test | `go -C ../sm-journal-plugin test -count=1 -run '^(TestSiteCachePurgeConfig\|TestSiteCachePurgeRequest)$' ./classes/ && npm --prefix ../vue-journal-layer test` | ✅ | ✅ green |
+| 16.2-07-T3 | 07 | 5 | all | T-16.2-44 | Full gate including the Docker suites and the cache stage | script | `PHASE162_REQUIRE_POSTGRES=1 bash scripts/check-phase16.2.sh --all` | ✅ | ✅ green |
+| 16.2-07-T4 | 07 | 5 | release | T-16.2-45 | Release gate: clean trees, nothing behind origin, proposed tags absent on origin, human decision | script + human | `bash scripts/check-phase16.2.sh --self-test && test -z "$(git status --porcelain -- modules admin docs scripts cmd)" && test -z "$(git ls-remote --tags origin refs/tags/v0.1.20)"` | ✅ | ⬜ pending |
+| 16.2-07-T5 | 07 | 5 | release | T-16.2-36, T-16.2-37, T-16.2-45 | UAT deploy: smoke, binary sha256 equal, both programs running, tokens equal and never printed, on-server purge 200 with purged >= 1, nginx POST 403, no-token 401 | script (ssh) | Task 5 verify commands in 16.2-07-PLAN.md (smoke ok, deploy-ok, token-match, purge-ok) | ✅ | ⬜ pending |
+| 16.2-07-T6 | 07 | 5 | D-03, D-19 | T-16.2-46 | UAT Test 3 untouched re-saves byte-identical; UAT Test 2 category edit visible on the next view after a logged purge | psql (read-only) + human | Task 6 verify commands in 16.2-07-PLAN.md (posts-unchanged, translations-unchanged, category-purged, category-fresh) | ✅ | ⬜ pending |
 
-*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky or manual (Docker host)*
 
 ---
 
 ## Wave 0 Requirements
 
-- [ ] `../sm-journal-plugin/package.json`, `package-lock.json`, `vite.config.ts`, vitest + happy-dom setup, `scripts/check-dist.sh`
-- [ ] `modules/cabana/field_type_test.go` — registry, options, decode/skip, list, upload
-- [ ] `admin/tests/form/PluginField.test.ts` — stub custom element
-- [ ] `../vue-journal-layer/tests/embeds.test.ts`
+- [x] `../sm-journal-plugin/package.json`, `package-lock.json`, `vite.config.ts`, vitest + happy-dom setup, `scripts/check-dist.sh` (plan 02)
+- [x] `../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` (plan 02) and its layer copy `../vue-journal-layer/tests/fixtures/editor-corpus.json` (plan 04)
+- [x] `../sm-journal-plugin/classes/editor_policy_test.go` (plan 03, extended in plan 06)
+- [x] `modules/cabana/field_type_test.go` — registry, options, compile, decode, notices, skip, load, list, writes, routes, upload (plan 06)
+- [x] `admin/tests/form/PluginField.test.ts` — stub custom element (plan 01, extended in plan 06)
+- [x] `../vue-journal-layer/tests/embeds.test.ts` (plan 04, extended in plan 06)
 
 ---
 
@@ -71,18 +96,18 @@ created: "2026-10-09"
 
 | Behavior | Requirement | Why Manual | Test Instructions |
 |----------|-------------|------------|-------------------|
-| Testcontainers Postgres suites | todo resave | No Docker on the dev machine | Run on a Docker host, as in 16.1 |
-| Editing imported posts on UAT | Phase goal | Real browser editing of live posts | Open an imported post, save untouched, then edit and save; compare columns |
+| Editing imported posts on UAT | Phase goal | Real browser editing of live posts | Open an imported post, save untouched (no notice, md5 unchanged), then edit and save; compare columns |
+| Strip and report on UAT | D-10 (amended) | Needs the admin session and a real save | Add a harmless style block and onclick in the source tab of an unpublished test post, save: it succeeds, the notice names both, the stored columns are equal and contain neither (plan 05 Task 3) |
 
 ---
 
 ## Validation Sign-Off
 
-- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
-- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
-- [ ] Wave 0 covers all MISSING references
-- [ ] No watch-mode flags
-- [ ] Feedback latency < 120s
-- [ ] `nyquist_compliant: true` set in frontmatter
+- [x] All tasks have `<automated>` verify or Wave 0 dependencies
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all MISSING references
+- [x] No watch-mode flags
+- [x] Feedback latency < 120s for the Docker-free stages; the Docker suites run in the gate's postgres stage on a Docker host (`PHASE162_REQUIRE_POSTGRES=1 bash scripts/check-phase16.2.sh --all`, 16.2-07)
+- [x] nyquist_compliant set to true in the frontmatter
 
-**Approval:** pending
+**Approval:** automated map complete (plan 06, 2026-10-10); the Docker-host suites are automated in the gate's postgres stage since plan 07 (2026-10-10); the UAT rows above stay manual

.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VERIFICATION.md

@@ -0,0 +1,267 @@
+---
+phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+verified: 2026-10-10T20:10:00Z
+status: passed
+score: 14/14 must-haves verified
+covered_files:
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-01-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-02-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-03-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-04-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-05-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-SUMMARY.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-07-PLAN.md
+  - .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-07-SUMMARY.md
+  - admin/src/app/fieldTypes.ts
+  - admin/src/components/form/fields/MLPluginField.vue
+  - admin/src/components/form/fields/PluginField.vue
+  - admin/src/components/form/registry.ts
+  - admin/src/views/FormView.vue
+  - docs/backend/field-types.md
+  - modules/cabana/crud.go
+  - modules/cabana/field_type.go
+  - modules/cabana/field_type_upload.go
+  - modules/cabana/http.go
+  - modules/cabana/openapi_conformance_test.go
+  - modules/cabana/relation_field.go
+  - modules/cabana/tx_context.go
+  - modules/pact/capabilities.go
+  - scripts/check-phase16.2.sh
+covered_digest: "v2:sha256:1172372f0148895ed07ee76d9d0d9996ba7497c35d22ad3443e564c7a817e5d4"
+behavior_unverified: 0
+overrides_applied: 0
+re_verification: "2026-10-10, after gap closure plan 16.2-07 (G-16.2-1, G-16.2-2) and human UAT on the v0.1.20 UAT deploy; manual re-verification because msd-core 1.14.0 loops stale/human_needed after gap closure"
+human_verification_resolved:
+  - test: "On a host with Docker, run `bash scripts/check-phase16.2.sh postgres` from summercms.go"
+    result: pass
+    evidence: "Full gate at ee62410 (gate2.log, 2026-10-10 18:44): phase16.2 postgres passed, 293 cabana and 78 sm-journal-plugin top-level tests; 'Phase 16.2 gate passed', exit 0. No non-planning change since. UAT Test 1"
+  - test: "D-19 on UAT: change one word of a category's content in the Blog Editor and save"
+    result: pass
+    evidence: "16.2-07 Task 6 on v0.1.20: category 2 saved with no removal notice, edit visible on the first view of /cordyceps; category-purged and category-fresh pass. UAT Test 2"
+  - test: "After the next deploy, save post 1 and post 64 untouched again and re-run the read-only md5 SELECT"
+    result: pass
+    evidence: "16.2-07 Task 6 on v0.1.20 (includes CR-01/WR-04): posts-unchanged and translations-unchanged pass, updated_at moved past the 17:57:57Z restart. UAT Test 3"
+  - test: "Blog Editor preview pane in a real browser"
+    result: pass
+    evidence: "UAT Test 4"
+  - test: "Judgment-tier prohibition: sandboxed preview iframe accepted as an exception"
+    result: pass
+    evidence: "Human accepted. UAT Test 5"
+---
+
+# Phase 16.2: Plugin-provided field types and the Blog Editor formwidget Verification Report
+
+**Phase Goal:** Plugins can register their own admin form field types (todo: cabana-richeditor-field-type), and the Journal plugin ships a first-class Blog Editor formwidget for post content (beyond the current markdown field or a plain rich editor) that edits imported HTML posts losslessly.
+**Verified:** 2026-10-10T17:05:00Z
+**Status:** passed
+**Re-verification:** Yes, 2026-10-10 after gap closure 16.2-07 and UAT (see Re-verification below)
+
+ROADMAP lists no success criteria and REQUIREMENTS.md has none for this phase, so the must-haves are the six plans' frontmatter truths, keyed to CONTEXT decisions D-01 to D-19. They are merged into 14 truths below.
+
+## Goal Achievement
+
+### Observable Truths
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 1 | D-11: a plugin registers a value-bearing field type under a short alias; duplicate aliases across plugins and clashes with core types fail boot | ✓ VERIFIED | `pact.HasFormFieldTypes` (capabilities.go:491). `compileFieldTypes` (field_type.go:151) checks the alias pattern and core-type clash, and names both owners on a cross-plugin clash. It is called from `Activate` (http.go:99) and passed to `compileRegistryWithTypes`. `TestFieldTypeRegistry` and `TestFieldTypeCompile` pass in the gate |
+| 2 | D-12.1: plugin fields accept the general keys plus the type's Options; other keys and CheckOptions errors fail boot | ✓ VERIFIED | `pluginFieldKeys` and `fieldKeyAllowed`, plus `compilePluginField` running CheckOptions. `TestFieldTypeOptions` passes |
+| 3 | D-12.2 and D-10 (framework): Decode runs inside the save transaction per locale; FormFieldError becomes 422 with no write; other errors become an opaque 500; notices become meta.notices only when present | ✓ VERIFIED | crud.go:609-636: lift, then loadRecord, then `decodePluginFields`, then Fill, all inside `s.transaction`. crud.go:733 calls `localizeNotices`, and `RecordMeta.Notices` is `json:"notices,omitempty"`. WR-06 adds a 422 for a non-string translatable value. `TestFieldTypeDecode` and `TestFieldTypeNotices` pass |
+| 4 | D-12.3 and D-12.4: Show and the save response serve plugin fields through Load (per locale); list columns use ListValue | ✓ VERIFIED | `hydratePluginFields` is called in Show (crud.go:447) and in save (crud.go:728). `projectRowCtx` calls `ListValue` (http.go:1114). `TestFieldTypeLoad` and `TestFieldTypeListValue` pass |
+| 5 | D-03 (server half): on update, a value equal to the served value is neither decoded nor written | ✓ VERIFIED | `decodeOne` compares with `servedFieldValue` (Load over the loaded record) through `sameJSON` and skips. An untouched default-locale value is deleted from Projected. The behavioural test `TestFieldTypeUntouched` passes |
+| 6 | D-14 and D-06: translatable plugin types use cabana's ML lift, translation writer and hydrate; Form hooks read writes through `FieldWritesFromContext` | ✓ VERIFIED | Translations are decoded in place on the `mlValue` items that `applyMLTranslations` writes. `withFieldWrites` (crud.go:636) feeds `FieldWritesFromContext`. `TestFieldTypeWrites` passes |
+| 7 | D-13 and D-15: the SPA loads field-type assets globally after login; PluginField/MLPluginField bind `value` and `summer-change`; the schema carries plugin fields generically; OpenAPI, TS types, dist and docs are regenerated | ✓ VERIFIED | `loadFieldTypes` is called in main.ts:26 and LoginView.vue:33. `registry.ts` routes any field with `element` to PluginField or MLPluginField. PluginField only re-sets `value` when it differs (echo guard). admin.json and schema.d.ts carry `element`, `translatable` and `typeOptions`. Gate docs stage: check-admin-openapi, check-admin-dist and TestDocsTree pass. Vitest 1218/1218 |
+| 8 | D-18: cabana-owned upload route (guard, X-Requested-With, permissions, declared op, record scope, body cap) answers 201 {data:{url}}; Journal Upload accepts only sniffed jpg/jpeg/png/gif/webp up to 10240 KiB | ✓ VERIFIED | Route at http.go:360, wrapped in `requireAjax`. `fieldUpload` calls `protect` and `operationDeclared` (WR-01), reads the whole body before Upload (WR-02) and scopes the record through `loadRecord`. Journal `uploadBlogImage` sniffs the bytes. `StoreMedia` enforces the extension allowlist, so a PNG named `.svg` is refused there, and caps the size. `TestFieldUpload`, `TestBlogEditorUpload` and `TestStoreMedia` pass. UAT edit-ok shows an image under journal/posts |
+| 9 | D-01, D-04, D-16: Blog Editor is a TipTap WYSIWYG custom element `golem15-journal-blogeditor` with a source tab, a toolbar (headings, marks, lists, links, blockquote, tables, images, embeds, raw HTML), unknown blocks shown as raw cards, and a committed and embedded bundle with a dist drift gate | ✓ VERIFIED | assets/src/blogeditor/*.ts and toolbar.ts provide H2-H4, bold, italic, lists, link, blockquote, table ops, image, embed and rawHtml. extensions.ts lists the raw block tags (footer, section, aside, details…). admin.go:22 embeds the dist. `check-dist.sh` (diff -r) passes in the gate. Editor vitest 232/232 |
+| 10 | D-03 (editor and Journal halves) and todo journal-imported-html-admin-resave: an untouched value round-trips byte-identically; Load serves HTML content verbatim and markdown as content_html; an untouched save leaves content and content_html byte-identical | ✓ VERIFIED | The element's `value` getter returns the stored string in clean mode and uses `serializeDocument` (top-level block reuse) only after an edit. It never calls `getHTML`. `loadBlogHTML` implements D-07 plus the CR-01 and WR-04 refinements. element.test.ts, `TestBlogEditorLoad` and `TestFieldTypeUntouched` pass. UAT: post 1 (HTML) and post 64 (markdown) kept the same md5 after untouched saves, and updated_at moved (16.2-05 SUMMARY, follow-up section). The Postgres `TestPostsAdminResaveKeepsHTML` did not run (human item 1) |
+| 11 | D-02, D-07, D-08, D-09: post content is `mlblogeditor` (excerpt unchanged); an admin save stores the same sanitized HTML in content and content_html per locale without goldmark; the public write API keeps markdown and FormatHTML | ✓ VERIFIED | models/post/fields.yaml: `type: mlblogeditor`, `htmlColumn: content_html`. `preparePostWrite` copies the default-locale write into `ContentHTML`. `writeContentHTMLTranslations` writes non-default locales through `WriteTranslated`. The only remaining FormatHTML callers are the API helpers, the import console and Load's markdown fallback. No migration or column was added. `TestPostsEditorHooks` passes. UAT edit-ok: content = content_html |
+| 12 | D-10 (amended) and D-05: Decode stores `SanitizeHTMLReport` output and reports removals as notices, never refusing on markup; the policy gains exactly four editor-output rules; every corpus entry passes byte for byte | ✓ VERIFIED | `decodeBlogHTML` and `removalNotices` are in blog_editor.go. Commit 2384a61 adds only `figure data-embed ^youtube$`, `figure data-id ^[A-Za-z0-9_-]{11}$`, `img alt` and `ol start ^[0-9]+$`. `TestEditorOutputPassesPolicy`, `TestSanitizeHTMLReport`, `TestBlogEditorDecode` and `TestBlogEditorNotices` pass. On UAT a style element and an onclick attribute were stripped and the notice was confirmed by the human |
+| 13 | D-17 and D-05 (layer): `expandEmbeds(sanitizeJournalHtml(html))` at the PostBody and CategoryHeader sinks, with payload transforms only sanitizing; htmlGate mirrors the four rules; corpus copies identical; v0.2.0 tagged and pinned | ✓ VERIFIED | PostBody.vue:13 and CategoryHeader.vue:11 expand last. postView.ts and CategoryPage.vue only sanitize. `expandEmbeds` builds the iframe only from an allowlisted provider, a validated id and a fixed host. `cmp` of the two corpus files is identical. Tag v0.2.0 exists on origin (759e684). The app's package.json pins `#v0.2.0`. Layer 144/144. UAT site-ok found 1 youtube-nocookie iframe |
+| 14 | D-19 (amended): category content uses blogeditor and is stripped and reported; the 422 CheckHTML gate is retired | ⚠️ PRESENT_BEHAVIOR_UNVERIFIED | models/category/fields.yaml has `type: blogeditor`. `prepareCategoryWrite` only nulls blank content, and no CheckHTML caller remains. The end-to-end category save is covered only by the Docker-only `TestCategoriesAdminContent` and `TestCategoriesAdminBlogEditor` (not run), and the UAT category step was never done |
+
+**Score:** 13/14 truths verified (1 present, behavior-unverified)
+
+Release truths from plan 05 are verified separately. Tag v0.1.18 is an annotated tag object 04dc5bd on origin, pointing at commit f1d8a75. The UAT binary sha256 matched the local build, and the on-server smoke passed on 98 URLs. These rest on SUMMARY records; the tag is confirmed directly with `git ls-remote`.
+
+### Required Artifacts
+
+| Artifact | Expected | Status | Details |
+|----------|----------|--------|---------|
+| `modules/pact/capabilities.go` | FormFieldType family and HasFormFieldTypes | ✓ VERIFIED | All types are present, with Decode, Load, ListValue, Upload and CheckOptions |
+| `modules/cabana/field_type.go` | registry, compile and the decode/skip/load/list runner | ✓ VERIFIED | 877 lines, substantive, wired from http.go and crud.go |
+| `modules/cabana/field_type_upload.go` | upload route | ✓ VERIFIED | Mounted at http.go:360 |
+| `modules/cabana/tx_context.go` | FieldWritesFromContext | ✓ VERIFIED | Consumed by Journal posts.go |
+| `modules/cabana/relation_field.go` | `notices,omitempty` | ✓ VERIFIED | relation_field.go:99 |
+| `admin/src/components/form/fields/PluginField.vue` | element host | ✓ VERIFIED | Handles summer-change and summer-upload; passes no token or function to the element |
+| `admin/src/app/fieldTypes.ts` | global loader | ✓ VERIFIED | Wired in main.ts and LoginView.vue |
+| `docs/backend/field-types.md` | guide | ✓ VERIFIED | Names HasFormFieldTypes; no consuming application is named |
+| `../sm-journal-plugin/classes/blog_editor.go` | BlogEditorTypes | ✓ VERIFIED | Registered through field_types.go |
+| `../sm-journal-plugin/classes/format_html.go` | SanitizeHTMLReport and the four rules | ✓ VERIFIED | |
+| `../sm-journal-plugin/classes/media_store.go` | StoreMedia | ✓ VERIFIED | Shared with controllers/api/media.go:39 |
+| `../sm-journal-plugin/assets/dist/blogeditor.js` | committed bundle | ✓ VERIFIED | Embedded at admin.go:22; check-dist passes |
+| `../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` | corpus | ✓ VERIFIED | Byte-identical to the layer copy |
+| `../vue-journal-layer/app/utils/embeds.ts` | expandEmbeds | ✓ VERIFIED | |
+| `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json` | `#v0.2.0` pin | ✓ VERIFIED | |
+| `modules/cabana/field_type_postgres_test.go` | Postgres test | ✓ EXISTS (not run) | Compiles under go vet; needs Docker |
+| `scripts/check-phase16.2.sh` | phase gate | ✓ VERIFIED | Re-run in this verification, exit 0 |
+
+### Key Link Verification
+
+| From | To | Via | Status |
+|------|----|-----|--------|
+| http.go Activate | compileRegistryWithTypes | `compileFieldTypes(plugins)` passed as a parameter | ✓ WIRED |
+| crud.go save | Decode and Load | `decodePluginFields` between loadRecord and Fill, in the transaction | ✓ WIRED |
+| crud.go save | meta.notices | `localizeNotices` after commit | ✓ WIRED |
+| FormView.vue save | FormField notices and toast | `noticeLines(result.data.meta.notices)` | ✓ WIRED |
+| main.ts / LoginView.vue | GET /field-types | `loadFieldTypes` | ✓ WIRED |
+| PluginField.vue | upload route | `summer-upload` handled by `api.POST` | ✓ WIRED |
+| blog_editor.go decodeBlogHTML | SanitizeHTMLReport | direct call | ✓ WIRED |
+| posts.go preparePostWrite | FieldWritesFromContext | default-locale write sets ContentHTML | ✓ WIRED |
+| posts.go FormAfterUpdate | TranslationWriter.WriteTranslated | content_html per written locale | ✓ WIRED |
+| api/media.go UploadMedia | StoreMedia | media.go:39 | ✓ WIRED |
+| PostBody.vue / CategoryHeader.vue | expandEmbeds | `expandEmbeds(sanitizeJournalHtml(...))` | ✓ WIRED |
+| admin.go adminFS | assets/dist/blogeditor.js | `//go:embed` | ✓ WIRED |
+
+### Data-Flow Trace (Level 4)
+
+| Artifact | Data | Source | Real data | Status |
+|----------|------|--------|-----------|--------|
+| PluginField element `value` | form value | Show response from `hydratePluginFields`, which runs Load over the record loaded in the transaction | yes | ✓ FLOWING |
+| content_html (admin path) | sanitized HTML | Decode output, then FieldWrite, then the hooks | yes (UAT edit-ok shows content = content_html) | ✓ FLOWING |
+| Site post body | content_html | Journal API, then postView sanitize, then the PostBody sink expandEmbeds | yes (UAT site-ok found the iframe) | ✓ FLOWING |
+
+### Behavioral Spot-Checks
+
+| Behavior | Command | Result | Status |
+|----------|---------|--------|--------|
+| Full phase gate | `bash scripts/check-phase16.2.sh --all` (TMPDIR in the scratchpad) | self-test, go (19 framework + 29 Journal tests), admin 1218, editor 232, layer 144 plus corpus cmp, and docs all PASS; postgres NOT RUN; "Phase 16.2 gate passed", exit 0 | ✓ PASS |
+| go vet | `go vet ./...` in summercms.go and sm-journal-plugin | clean | ✓ PASS |
+| Release tag on origin | `git ls-remote --tags origin v0.1.18` | 04dc5bd, which points at f1d8a75 | ✓ PASS |
+| Layer tag on origin | `git ls-remote --tags origin` (vue-journal-layer) | v0.2.0, which points at 759e684 | ✓ PASS |
+| Postgres suites | `check-phase16.2.sh postgres` | no Docker daemon | ? SKIP (human item 1) |
+
+### Probe Execution
+
+Step 7c: no `scripts/*/tests/probe-*.sh` is declared or present for this phase. The phase gate above serves as the runnable check.
+
+### Requirements Coverage
+
+REQUIREMENTS.md lists no IDs for this phase. The CONTEXT decisions the plans cite:
+
+| Decision | Status | Evidence |
+|----------|--------|----------|
+| D-01, D-04, D-16 | ✓ SATISFIED | Truth 9 |
+| D-02, D-07, D-08, D-09 | ✓ SATISFIED | Truth 11 |
+| D-03 | ✓ SATISFIED | Truths 5 and 10 (unit tests plus UAT; Postgres run pending) |
+| D-05, D-10 | ✓ SATISFIED | Truths 3, 12 and 13 |
+| D-06, D-14 | ✓ SATISFIED | Truth 6 |
+| D-11, D-12, D-13, D-15 | ✓ SATISFIED | Truths 1 to 4 and 7 |
+| D-17 | ✓ SATISFIED | Truth 13 |
+| D-18 | ✓ SATISFIED | Truth 8 |
+| D-19 | ? NEEDS HUMAN | Truth 14 |
+
+### Prohibitions (judgment tier, non-authoritative LLM verdicts)
+
+| Prohibition | Verdict |
+|-------------|---------|
+| No package-level mutable field type registry in cabana | Holds. The only package-level vars are regexes and a static key set. The registry is built per Activate |
+| The element never receives a token, cookie, function or Vue instance | Holds. PluginField sets only `value` and string attributes; uploads go through `api.POST` |
+| Core field types, the `type: widget` contract and CompileForm unchanged | Holds as far as the gate shows. TestPhase10CSRF, TestPhase09ContractInventory and ExampleCompileFormWithTypes pass, and settings and relation forms use a refusing registry |
+| Framework docs name no consuming application | Holds. grep for journal, grzyb, fonoteka and blogeditor in field-types.md, forms.md and the two READMEs finds nothing |
+| The editor never re-serializes an untouched document or uses getHTML() | Holds. The clean-mode getter returns the stored string |
+| No eval, no `new Function`, no style injection | Holds. `injectCSS: false`, and no eval in the sources |
+| The element renders no iframe and no live raw HTML in the admin | **Flagged for human review.** The preview pane folded in from quick 261010-iwu adds a lazily created iframe with an empty `sandbox`, `srcdoc` only and a CSP meta. Raw blocks in the editor itself still render as escaped text |
+| htmlPolicy gains only the four editor rules; the layer mirrors the same four | Holds. Diff 2384a61 and htmlGate.ts:122-127 |
+| Public write API and media route keep the PHP contract | Holds. Posts still go through FormatHTML in the API helpers, and media.go keeps its error mapping through MediaError |
+| No format flag, column or migration | Holds. No migration commit in updates/ during the phase |
+| Executor ran only SELECTs on UAT; no credentials handled; no tag moved | Taken from the SUMMARY; the tags are unmoved on origin |
+| Tests not weakened | Taken from the SUMMARY: the 16.1 policy test files are unchanged since c60abc6 |
+
+### Anti-Patterns Found
+
+| File | Line | Pattern | Severity | Impact |
+|------|------|---------|----------|--------|
+| (none) | | No TBD, FIXME, XXX, TODO or HACK marker in the phase's source files | | |
+
+Known open review items, skipped by decision (16.2-REVIEW-FIX.md):
+- WR-07: View site uses the admin origin.
+- WR-08: the gate passes with postgres NOT RUN; `PHASE162_REQUIRE_POSTGRES=1` enforces it.
+- IN-01 to IN-03 and IN-05 to IN-08.
+
+These are information only and do not block.
+
+### Human Verification Required
+
+#### 1. Postgres suites on a Docker host
+
+**Test:** `bash scripts/check-phase16.2.sh postgres`
+**Expected:** Every named suite passes. This covers WINDOWS 11, 12, 14 to 16, 20 and 21.
+**Why human:** No Docker on this host. These suites are the only end-to-end proof of the CR-01 and WR-04 Load changes and of the category strip.
+
+#### 2. D-19 category edit on UAT
+
+**Test:** Change one word of a category's content in the Blog Editor and save.
+**Expected:** No removal notice; the site shows the change.
+**Why human:** WINDOWS 18; never performed.
+
+#### 3. Re-confirm the untouched resave after the review-fix deploy
+
+**Test:** After v0.1.19 is deployed, save posts 1 and 64 untouched and re-run the md5 SELECT.
+**Expected:** The md5 values equal the 16.2-05 snapshot.
+**Why human:** The UAT proof ran on v0.1.18, before the CR-01 and WR-04 Load changes. The code reading says the outcome is unchanged for these posts.
+
+#### 4. Preview pane browser check
+
+**Test:** Check the layout, the sandbox (script in a raw block), the embed card and relative images.
+**Expected:** As listed in the 261010-iwu SUMMARY.
+**Why human:** Real browser behaviour.
+
+#### 5. Accept the preview iframe against the plan 02 prohibition
+
+**Test:** Decide whether the sandboxed srcdoc preview is an accepted exception to "no iframe in the admin".
+**Expected:** Accept, or ask for a change.
+**Why human:** Judgment-tier prohibition.
+
+### Gaps Summary
+
+No must-have failed. The framework API (pact.HasFormFieldTypes, the cabana registry, the decode/skip/load/list runner, meta.notices, the upload route), the SPA host, the Journal Blog Editor (element, Go types, policy, hooks, storage) and the layer's embed expansion all exist, are substantive and are wired. The fixed tree passes the phase gate here, and vet is clean in both Go repositories. On UAT (v0.1.18) the goal was proven on real data:
+- An imported HTML post and a markdown post re-saved untouched with identical md5.
+- An edited post stored identical content and content_html, with an uploaded figure and a YouTube placeholder.
+- Disallowed markup was stripped and reported.
+- The site rendered a youtube-nocookie iframe.
+
+Status is `human_needed`, not `passed`, for three reasons:
+- The Docker-only Postgres suites have never run.
+- The D-19 category path has no executed end-to-end evidence: no Postgres run and no UAT step.
+- The review fixes (CR-01, WR-01 to WR-06, IN-04) are committed but not deployed or tagged, so the UAT evidence predates them. summercms.go master is 13 commits ahead of origin, and the sm-journal-plugin test and fix commits are not pushed either.
+
+---
+
+_Verified: 2026-10-10T17:05:00Z_
+_Verifier: Claude (msd-verifier)_
+
+## Re-verification (2026-10-10, after 16.2-07)
+
+Gap closure plan 16.2-07 closed G-16.2-1 (conformance cases for GET /field-types and the field upload route; a Docker-free route inventory check in the gate) and G-16.2-2 (Journal admin writes purge the host Nuxt route cache). It was released as summercms v0.1.20 and vue-journal-layer v0.3.0 and deployed to UAT.
+
+All five human verification items above are resolved by evidence, recorded in `human_verification_resolved` and in 16.2-UAT.md (status complete, 5/5 pass):
+
+| Item | Evidence |
+|------|----------|
+| Postgres suites (truth 10 Postgres half, truth 14) | gate2.log at ee62410: `phase16.2 postgres passed`, `Phase 16.2 gate passed` |
+| D-19 category save and site visibility (truth 14) | 16.2-07 Task 6: category-purged, category-fresh, phrase found on the server-rendered page |
+| Untouched re-save on the build with CR-01/WR-04 (truth 10) | 16.2-07 Task 6: posts-unchanged, translations-unchanged |
+| Preview pane in a browser | UAT Test 4 pass |
+| Preview iframe exception | UAT Test 5 pass, accepted by the human |
+
+Checks at this re-verification: `go vet ./modules/cabana/ ./modules/pact/` clean; `go test ./modules/pact/` and `TestPhase10ConformanceInventory` pass; no change outside `.planning/` since aba063f. `covered_files` now includes 16.2-07-PLAN.md, 16.2-07-SUMMARY.md and modules/cabana/openapi_conformance_test.go, and `covered_digest` was recomputed with `msd_run query verification.fingerprint`.
+
+Truth 14 (D-19) moves from NEEDS HUMAN to VERIFIED; the score is 14/14 and the status is `passed`.
+
+This report was re-verified by hand, as Phase 9's was, because msd-core 1.14.0 makes a report stale after any gap-closure plan and its verifier ignores passed UAT results. Re-running execute-phase would have reset 16.2-UAT.md to pending.

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-01-PLAN.md

@@ -0,0 +1,498 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - modules/pact/capabilities.go
+  - modules/pact/README.md
+  - modules/bouncer/context.go
+  - modules/bouncer/README.md
+  - modules/party/registry.go
+  - modules/party/registry_test.go
+  - modules/party/README.md
+  - modules/lagoon/backend_admin_migrations.go
+  - modules/lagoon/backend_admin_migrations_test.go
+  - modules/lagoon/README.md
+  - modules/cabana/api_tokens.go
+  - modules/cabana/token_scopes.go
+  - modules/cabana/token_guard.go
+  - modules/cabana/account_tokens.go
+  - modules/cabana/token_commands.go
+  - modules/cabana/contracts.go
+  - modules/cabana/registry.go
+  - modules/cabana/messages.go
+  - modules/cabana/http.go
+  - modules/cabana/auth.go
+  - modules/cabana/field_type.go
+  - modules/cabana/field_markdown.go
+  - modules/cabana/commands.go
+  - modules/cabana/admin_openapi.go
+  - modules/cabana/export_test.go
+  - modules/cabana/security_coverage_test.go
+  - modules/cabana/openapi_conformance_test.go
+  - modules/cabana/token_smoke_test.go
+  - modules/cabana/token_postgres_smoke_test.go
+  - modules/cabana/README.md
+  - modules/phrasebook/backend/lang/en/lang.yaml
+  - modules/phrasebook/backend/lang/pl/lang.yaml
+  - admin/openapi/admin.json
+  - admin/src/api/schema.d.ts
+  - cmd/summer/runtime.go
+  - cmd/summer/runtime_test.go
+  - docs/examples/blog/token_scopes.go
+  - docs/examples/blog/lang/en/lang.yaml
+  - docs/backend/users-and-permissions.md
+  - docs/services/authentication.md
+  - docs/console/setup-and-maintenance.md
+  - docs/console/introduction.md
+  - docs/plugins/registration.md
+autonomous: true
+requirements: [SC-1, SC-2, SC-3, SC-5]
+estimate:
+  tokens: 170000
+  raw_tokens: 170000
+  tasks: 4
+  confidence: low
+must_haves:
+  truths:
+    - "D-07 and D-12: a token is g15_ plus 40 lowercase hex characters from 20 crypto/rand bytes; only its sha256 hex (unique column) and its last four characters are stored, in backend_api_tokens, created by migration 202610110001_backend_api_tokens appended to lagoon.BackendAdminMigrations under the summercms.cabana history (backend_user_id FK ON DELETE CASCADE, revoked_by FK ON DELETE SET NULL); TestBackendAdminMetadataColumn is updated in the same commit; Apparatus rows are not migrated."
+    - "D-13 and SC-1: the cabana backend guard is composite: Authorization Bearer g15_… goes to the token lookup, every other request goes to the unchanged NewBackendJWTGuard path (Bearer JWT, then the admin cookie); a g15_ value is never read from a cookie or the query string and is never handed to the JWT parser; on success the request runs as the token's owner and the *cabana.BackendAPIToken row is the bouncer credential."
+    - "D-08, D-09 and D-10: a malformed, unknown, expired or revoked token, or one whose owner is deactivated or soft-deleted, answers the existing 401 unauthenticated envelope; the owner is loaded fresh per request through lazyBackendUsers (role, code-declared and user grants), and neither a password reset nor tokens_valid_after invalidates a token."
+    - "D-02, D-03 and D-04: only stored scopes whose method list includes the request method count; when a known scope exists but none allows the method the guard answers 403 forbidden with details.reason token_scope before any handler runs; a token whose stored scopes are all unknown answers 401; `*` behaves as the owner on every method and `admin:read` as the owner on GET and HEAD."
+    - "D-14, D-03 and D-05: cabana.Allows evaluates the scope before the superuser and empty-list shortcuts; a scoped (non-full) principal passes only when one method-allowed scope matches every required code and the owner holds a required code inside that scope; a superuser with a scoped token is limited to the scope; an empty requirement list is refused unless the scope is full; JWT principals keep today's behaviour exactly."
+    - "D-01: plugins register scopes through pact.HasTokenScopes returning pact.TokenScope{Name, Label, Description, Permissions, Methods}; boot fails loudly on a duplicate name (naming both plugins), a reserved name (`*`, admin, admin:…), an invalid name, empty permissions or methods, an unknown or lower-case method, a method list without GET, an unknown permission pattern, an empty label or description, or a label or description phrase key that does not resolve."
+    - "D-05 and D-06: GET /auth/me answers any valid token; PUT /account, POST and DELETE /account/avatar, the four /account/tokens routes, POST /auth/refresh and POST /auth/logout refuse every token, `*` included, with 403 forbidden details.reason interactive_only; GET /field-types and POST /markdown/preview are gated like Allows with an empty list (only `*`, and `admin:read` on GET, pass) with details.reason token_scope."
+    - "D-15 (framework half): cabana.ResolveBackend authenticates a request outside the backend middleware from the Authorization Bearer header only (admin JWT or g15_ token, never the admin cookie), applies the method filter and, for a token, requires a method-allowed scope that is full or matches every cover code; it returns cabana.ErrUnauthenticated or cabana.ErrTokenScope and uses the same lazyBackendUsers and compiled registry as the admin guard (code-declared role grants included); cabana.Activate publishes the resolver."
+    - "D-11: last_used_at is stamped at most once per minute per token (in-process gate plus a conditional UPDATE of last_used_at only); a failed stamp is logged and never fails authentication."
+    - "D-16, D-17 and D-18 (server half): GET /account/tokens lists the caller's own tokens newest first (revoked ones only with revoked=1), POST /account/tokens answers 201 with the plaintext exactly once and 422 validation_failed on name, expires or scopes (unknown, empty, or granting the caller nothing), normalizes a list containing `*` to [`*`], DELETE /account/tokens/{id} soft-revokes only the caller's own active token (404 otherwise), and GET /account/tokens/scopes lists `*`, admin:read and plugin scopes that overlap the caller's grants, with server-translated labels; all four carry swag annotations, appear in admin/openapi/admin.json and admin/src/api/schema.d.ts, and are in phase09Routes and conformCases."
+    - "D-19: admin:token:create <login|email> --name --scope (repeatable) [--expires] prints exactly the token and a newline on stdout, applies the D-17 overlap rule to the target user and refuses deactivated or deleted users; admin:token:list [<login|email>] [--revoked], admin:token:revoke <id> and admin:token:scopes work; party.Activate publishes party.Activated so the commands see plugin scopes while cabana.RuntimeCommands(app) keeps its signature; summer forwards the four commands to the app binary."
+    - "D-20 (framework half): the pact, bouncer, cabana, party and lagoon READMEs and docs/backend/users-and-permissions.md, docs/services/authentication.md, docs/console/setup-and-maintenance.md, docs/console/introduction.md and docs/plugins/registration.md describe the token API, scope registration, the framework scopes, interactive-only routes, ResolveBackend and the CLI with neutral names; TestDocsTree and summer docs:build --check pass."
+  artifacts:
+    - path: "modules/pact/capabilities.go"
+      provides: "TokenScope and HasTokenScopes"
+      contains: "HasTokenScopes"
+    - path: "modules/bouncer/context.go"
+      provides: "ScopeLimit and Principal.Scope"
+      contains: "ScopeLimit"
+    - path: "modules/lagoon/backend_admin_migrations.go"
+      provides: "backend_api_tokens migration"
+      contains: "202610110001_backend_api_tokens"
+    - path: "modules/cabana/api_tokens.go"
+      provides: "BackendAPIToken model, APITokenPrefix, mint, hash, issue, revoke, debounced stamp"
+      contains: "APITokenPrefix"
+    - path: "modules/cabana/token_scopes.go"
+      provides: "scope compile, framework scopes, scopeMatch, allowsUnderScope, overlap rule"
+      contains: "allowsUnderScope"
+    - path: "modules/cabana/token_guard.go"
+      provides: "composite backend guard, interactiveOnly, ResolveBackend, ErrUnauthenticated, ErrTokenScope"
+      contains: "func ResolveBackend"
+    - path: "modules/cabana/account_tokens.go"
+      provides: "the four account token handlers"
+      contains: "accountTokenCreate"
+    - path: "modules/cabana/token_commands.go"
+      provides: "admin:token:create, list, revoke, scopes"
+      contains: "admin:token:create"
+    - path: "modules/party/registry.go"
+      provides: "party.Activated published by Activate"
+      contains: "Activated"
+    - path: "docs/backend/users-and-permissions.md"
+      provides: "API tokens guide"
+      contains: "HasTokenScopes"
+  key_links:
+    - from: "modules/cabana/http.go Activate"
+      to: "modules/cabana/token_guard.go composite guard"
+      via: "guards.Register(\"summercms.cabana\", \"backend\", newCompositeGuard(...)) wrapping the unchanged NewBackendJWTGuard"
+      pattern: "newCompositeGuard"
+    - from: "modules/cabana/token_guard.go"
+      to: "bouncer.Principal.Scope"
+      via: "method-filtered scope limit set on the principal FindByID returned"
+      pattern: "ScopeLimit"
+    - from: "modules/cabana/contracts.go Allows"
+      to: "modules/cabana/token_scopes.go allowsUnderScope"
+      via: "scope branch evaluated before the IsSuperuser and empty-list shortcuts"
+      pattern: "allowsUnderScope"
+    - from: "modules/cabana/http.go Activate"
+      to: "backpack.App service registry"
+      via: "app.Publish of the backendResolver read by ResolveBackend per request"
+      pattern: "backendResolver"
+    - from: "modules/cabana/token_commands.go"
+      to: "modules/party/registry.go Activated"
+      via: "app.Lookup[party.Activated]() at Run time, compiled by compileTokenCatalog"
+      pattern: "party.Activated"
+    - from: "modules/cabana/account_tokens.go and token_commands.go"
+      to: "modules/cabana/api_tokens.go issueAPIToken"
+      via: "one validation and insert path (name, expiry, scopes, overlap) for the API and the CLI"
+      pattern: "issueAPIToken"
+  prohibitions:
+    - statement: "The plaintext token is never persisted, logged, put in an error detail or returned after the create response; logs carry token_id and admin_id only, never the Authorization value or the hash."
+      status: unresolved
+      verification: judgment
+    - statement: "A g15_ token is never accepted from a cookie or a query string, and ResolveBackend never reads the admin cookie."
+      status: unresolved
+      verification: judgment
+    - statement: "A token never grants more than its owner: no scope branch skips the owner check, and a superuser token is limited by its scope."
+      status: unresolved
+      verification: judgment
+    - statement: "The JWT verification path (audience, blacklist, tokens_valid_after, cookie fallback) is unchanged."
+      status: unresolved
+      verification: judgment
+    - statement: "No new Go or npm dependency; crypto is stdlib only (crypto/rand, crypto/sha256, crypto/subtle)."
+      status: unresolved
+      verification: judgment
+    - statement: "Framework READMEs and docs never name a consuming application; examples use acme and blog."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): backend users create personal API tokens with scopes picked at creation time, so an agent or integration calls the admin and plugin APIs as that backend user with no more access than the token's scope and the user's own permissions allow. Successor of Apparatus PersonalApiToken; reverses Phase 15 D-15.
+
+This plan's slice (user checkpoint, plan 1 of 4): the whole framework side in summercms.go: the scope capability, the principal scope limit, the `Allows` rewrite, the token table, the composite `backend` guard, the interactive-only marker, the explicit route gates, the published resolver, the account token API with OpenAPI and inventories, the `admin:token:*` CLI with the `summer` delegates, and the module READMEs and docs pages for every API this plan adds (CLAUDE.md: same change).
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". No SPEC.md exists. CONTEXT D-01 to D-20, the six ROADMAP success criteria and RESEARCH Patterns 1-7 / Pitfalls 1-12 are the source of truth. Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
+
+## Decisions taken in this plan
+
+Locked-decision readings and Claude's-discretion choices, so executors do not re-decide them:
+
+- **D-03 read literally (honoring the locked text; RESEARCH A2 suggested a per-code union).** A scoped request passes when one method-allowed scope matches every required code and the owner holds a required code inside that scope. For single-code checks (almost every call site) the two readings agree; for a multi-code list the literal reading is stricter. `bouncer.ScopeLimit` therefore keeps one pattern slice per scope, not a union.
+- **Scope match table** (`scopeMatch(pattern, required)`, written fresh; `granted()` is not reused for the scope side, RESEARCH Pattern 2):
+
+  | required | pattern | result |
+  |---|---|---|
+  | exact `a.b.c` | `a.b.c`, `a.b.*`, `a.*` | full |
+  | exact `a.b.c` | `a.x.*`, `a.b.d` | none |
+  | wildcard `a.b.*` | `a.b.*`, `a.*` (at least as broad) | full |
+  | wildcard `a.*` | `a.b.*` or exact `a.b.c` (narrower) | partial via the pattern |
+  | wildcard `a.b.*` | `a.x.*`, `x.*` | none |
+  | leading `*.manage` | exact `a.manage` | partial via the pattern |
+  | leading `*.manage` | any wildcard pattern | none (conservative) |
+
+  Owner side: full match needs `ownerHas(required)`, partial match needs `ownerHas(pattern)`, where `ownerHas(x) = IsSuperuser || granted(PermissionGrants, x)`.
+- **Overlap rule (D-17):** a plugin scope is offered to (and accepted for) a user when some registered catalog code `c` has a full match in the scope and `ownerHas(c)`. `*` is always offered. `admin:read` is offered when the user is a superuser or holds at least one catalog code (RESEARCH A6).
+- **Names (discretion):** `pact.TokenScope`, `pact.HasTokenScopes`; `bouncer.ScopeLimit{Full bool; Scopes [][]string}` and `bouncer.Principal.Scope`; `party.Activated`; `cabana.BackendAPIToken`, `cabana.APITokenPrefix`, `cabana.ResolveBackend`, `cabana.ErrUnauthenticated`, `cabana.ErrTokenScope`; table `backend_api_tokens`; route wrapper `interactiveOnly`; framework scope names `*` and `admin:read` (unexported constants).
+- **Storage (discretion):** `scopes` is TEXT holding a JSON array (`lagoon.Jsonable[[]string]`), as the user plugin's token table does. An unknown stored name grants nothing and is listed with `known: false`; a token whose stored scopes are all unknown answers 401 (RESEARCH A4).
+- **403 reporting (discretion):** the guard's method refusal and the explicit route gates answer `forbidden` with `details.reason = "token_scope"`; the interactive-only marker answers `forbidden` with `details.reason = "interactive_only"`. Allows-based 403s inside handlers keep today's body (no per-handler change, D-14).
+- **Methods must include GET (planner rule for D-05):** every registered scope can then identify itself through `GET /auth/me`, so "always allowed to any valid token" holds without a route exception in the guard.
+- **Throttle (discretion):** no new throttle bucket. The format check runs before the indexed lookup, a 160-bit secret cannot be guessed, and the admin API has no per-route throttle today (threat T-16.3-10, accepted).
+- **Debounce (discretion):** in-process `sync.Map` gate plus `UPDATE … SET last_used_at = ? WHERE id = ? AND (last_used_at IS NULL OR last_used_at < ?)`.
+- **Create contract (RESEARCH open question 3, user-confirmed defaults):** 201; `["*", …]` normalizes to `["*"]`; duplicates removed in order; name trimmed, 1 to 100 runes; `expires` one of `30d`, `90d`, `365d`, `never`, default `90d` when absent.
+- **Resolver is Bearer-only (new finding while planning):** the Journal write routes have no CSRF check because they are Bearer-only today; a resolver that also read the `summer_admin` cookie would let a cross-site form drive them. `ResolveBackend` therefore wraps a second, cookie-less `NewBackendJWTGuard`.
+- **CLI plugin access (user-confirmed Option A):** `party.Activate` publishes `party.Activated`; the token commands look it up at Run time; `cabana.RuntimeCommands(app)` keeps its signature; host apps only bump versions.
+- **Reserved vendor segment (RESEARCH Pitfall 10):** `account` joins `api`, `assets`, `login`, `settings`.
+- **OpenAPI regeneration lands here, not in plan 02:** `TestPhase09ContractInventory` reads the committed `admin/openapi/admin.json`, so the routes and the regenerated document must ship in the same change to keep `go test ./...` green; plan 02 consumes the regenerated `schema.d.ts`.
+- **Docs example:** scope registration is shown from compiled code, `docs/examples/blog/token_scopes.go` (scopes `blog` and `blog:read`), included by a `src=` fence (RESEARCH Pitfall 12); `plugin.go` is not touched, so the whole-file snippet in `docs/setup/porting-a-plugin.md` stays in sync.
+
+## Interfaces (exact shapes executors build and later plans consume)
+
+- `pact.TokenScope{Name, Label, Description string; Permissions, Methods []string}`; `pact.HasTokenScopes{ TokenScopes() []pact.TokenScope }`.
+- `bouncer.ScopeLimit{Full bool; Scopes [][]string}`; `bouncer.Principal` gains `Scope *ScopeLimit` tagged `json:"-"` (nil means unrestricted: a JWT session).
+- `party.Activated` is a named `[]party.Plugin` published by `party.Activate` in activation order; read with `app.Lookup[party.Activated]()`.
+- `cabana.APITokenPrefix = "g15_"`; `cabana.BackendAPIToken` (columns id, backend_user_id, name, token_hash `json:"-"`, token_hint, scopes, expires_at, last_used_at, revoked_at, revoked_by, created_at, updated_at; `TableName()` is `backend_api_tokens`).
+- `cabana.ResolveBackend(app *backpack.App, r *http.Request, cover ...string) (*http.Request, *bouncer.Principal, error)`; sentinel errors `cabana.ErrUnauthenticated`, `cabana.ErrTokenScope` (the internal scope error wraps `ErrTokenScope`, so `errors.Is` works).
+- Admin API (under `{backend.uri}/api/v1`, backend guard, all interactive-only, writes also `requireAjax`):
+  - `GET /account/tokens[?revoked=1]` → 200 `Envelope[[]AdminAPIToken]`
+  - `POST /account/tokens` body `AdminAPITokenRequest{name, expires, scopes}` → 201 `Envelope[AdminAPITokenCreated]`, 422 details keyed `name`, `expires`, `scopes`
+  - `DELETE /account/tokens/{id}` → 200 `Envelope[AdminAPIToken]`, 404 `not_found`
+  - `GET /account/tokens/scopes` → 200 `Envelope[[]AdminAPITokenScope]`
+  - JSON: `AdminAPITokenScope{name, label, description, read_only, known}`; `AdminAPIToken{id, name, hint (last four characters), scopes []AdminAPITokenScope, created_at, last_used_at|null, expires_at|null, revoked_at|null, expired}`; `AdminAPITokenCreated` = every `AdminAPIToken` field plus `token`.
+  - swag stubs: `AdminAccountTokens`, `AdminAccountTokenCreate`, `AdminAccountTokenRevoke`, `AdminAccountTokenScopes`.
+- Server-side phrase keys (backend::lang.api_tokens.*): `scope_all`, `scope_all_description`, `scope_admin_read`, `scope_admin_read_description`, `name_required`, `name_too_long`, `expires_invalid`, `scopes_required`, `scope_unavailable` (UI-SPEC copy for the six it names; `name_too_long` "The name may have at most 100 characters." / "Nazwa może mieć najwyżej 100 znaków."; `expires_invalid` "Choose a valid expiry." / "Wybierz poprawny termin ważności."). Plan 02 adds the SPA-only keys to the same block.
+- CLI: `admin:token:create <identifier> --name <text> --scope <name> [--scope …] [--expires 30d|90d|365d|never|YYYY-MM-DD]` (a date means 00:00 UTC on that day and must be in the future); `admin:token:list [<identifier>] [--revoked]`; `admin:token:revoke <id>`; `admin:token:scopes`.
+
+## Plan sizing note
+
+The user locked four plans and put the whole framework side here, with its READMEs and docs in the same change (CLAUDE.md). Four tasks: a tracer, then three expansions. After revision 1 the estimate is 170k tokens against `workflow.smart_zone_tokens` 100k (about 1.7x; confidence low, uncalibrated, since no completed phase carries actuals). The checker treats this as a warning, never a blocker.
+
+Load reductions (revision 1):
+- The context block no longer loads 16.3-RESEARCH.md and 16.3-UI-SPEC.md whole (about 26k tokens together by chars/4). Each task's read_first names the sections it needs, with line ranges, about 12k of reads in total.
+- **Seam after Task 2.** Tasks 1-2 are the framework core: scope capability, principal limit, Allows, table, composite guard, gates, resolver and stamp. Tasks 3-4 build the surfaces on top: account API and OpenAPI, CLI, READMEs and docs. Tasks 3 and 4 use Tasks 1-2 only through committed code and the Interfaces section above. Commit Task 2 before starting Task 3. At the start of Task 3, do not re-read the Task 1-2 files whole: list their as-built signatures with `grep -n "^func \|^type \|^var \|^const " modules/cabana/api_tokens.go modules/cabana/token_scopes.go modules/cabana/token_guard.go`, then read only the function bodies Task 3 or 4 changes (`issueAPIToken`, the catalog helpers). Record any name that differs from the Interfaces section for the SUMMARY.
+
+Residual risk, accepted by the user on 2026-10-11 at the plan-phase revision checkpoint (keep four plans, no mid-plan checkpoint):
+- One executor context still carries all four tasks. The executor and execute-phase honor only one kind of mid-plan context reset, a checkpoint task. Here that would raise this plan to five tasks, which is the plan checker's blocker threshold. Under this project's config (`human_verify_mode` end-of-phase, `auto_advance` false) it would also stop for a human mid-plan. Moving the docs, the CLI or the API out of this plan would break the user's plan lock and the CLAUDE.md same-change rule.
+- Failure mode: quality degrades late, in Task 4 (READMEs and docs pages, 21 files), or the run is interrupted after Task 2's commits.
+- Mitigations:
+  - Tracer-first ordering puts the security-critical core (Tasks 1-2) in the early context.
+  - Every task commits atomically and has its own verify.
+  - Task 4's checks are mechanical and catch an unknown identifier, command name or stale snippet: TestDocsTree, docs:build --check and TestDelegateCommandsHelp.
+  - Plan 03 Task 2 re-checks that every exported identifier this phase added is named in its module README.
+  - An interrupted run lands in execute-phase's safe_resume_gate (commits present, SUMMARY missing), which stops and offers a manual close-out instead of re-dispatching blindly.
+
+## Source coverage audit (phase-wide)
+
+| Source | ID | Item | Plan | Status |
+|---|---|---|---|---|
+| GOAL | — | Scoped personal tokens, owner ∩ scope, admin and plugin APIs | 01, 02, 03 | COVERED |
+| ROADMAP | SC-1 | backend guard accepts g15_ tokens and the JWT | 01 | COVERED |
+| ROADMAP | SC-2 | out-of-scope refused; never beyond owner | 01 (+03 Journal) | COVERED |
+| ROADMAP | SC-3 | SPA create/list/revoke, show once; CLI for any user | 01 (API, CLI), 02 (SPA) | COVERED |
+| ROADMAP | SC-4 | Journal accepts a Journal-scoped token for writes | 03 | COVERED |
+| ROADMAP | SC-5 | READMEs and docs cover token API, scopes, CLI | 01 (framework), 02 (My account), 03 (Journal) | COVERED |
+| ROADMAP | SC-6 | unit tests in the last plan | 04 | COVERED |
+| CONTEXT | D-01 | pact capability, fail-loud boot | 01 | COVERED |
+| CONTEXT | D-02 | read scopes GET/HEAD, 403 before handler | 01 | COVERED |
+| CONTEXT | D-03 | several scopes, any one passes, immutable | 01 | COVERED |
+| CONTEXT | D-04 | `*`, `admin:read`; Journal `journal`, `journal:read` | 01, 03 | COVERED |
+| CONTEXT | D-05 | deny by default; /auth/me always | 01 | COVERED |
+| CONTEXT | D-06 | interactive-only marker | 01 | COVERED |
+| CONTEXT | D-07 | g15_ + 40 hex, sha256, hint | 01 | COVERED |
+| CONTEXT | D-08 | expiry 30/90/365/never, default 90, CLI date | 01, 02 | COVERED |
+| CONTEXT | D-09 | soft revoke, hidden by default, no edits | 01, 02 | COVERED |
+| CONTEXT | D-10 | owner loaded fresh; reset does not invalidate | 01 | COVERED |
+| CONTEXT | D-11 | last_used debounce; list columns | 01, 02 | COVERED |
+| CONTEXT | D-12 | framework table in BackendAdminMigrations | 01 | COVERED |
+| CONTEXT | D-13 | composite guard, Bearer only, credential | 01 | COVERED |
+| CONTEXT | D-14 | scope in principal, Allows intersection | 01 | COVERED |
+| CONTEXT | D-15 | resolver; Journal switch; byte-identical bodies | 01, 03 | COVERED |
+| CONTEXT | D-16 | SPA panel, own tokens, show once | 02 | COVERED |
+| CONTEXT | D-17 | picker overlap rule, server 422 | 01, 02 | COVERED |
+| CONTEXT | D-18 | account endpoints, envelope, swag, interactive-only | 01 | COVERED |
+| CONTEXT | D-19 | admin:token:* CLI | 01 | COVERED |
+| CONTEXT | D-20 | READMEs and docs | 01, 02, 03 | COVERED |
+| RESEARCH | Pitfall 1 | superuser shortcut | 01 | COVERED |
+| RESEARCH | Pitfall 2 | non-Allows routes gated | 01 | COVERED |
+| RESEARCH | Pitfall 3 | ownership branches (Journal) | 03 | COVERED |
+| RESEARCH | Pitfall 4 | nil *cabana.Registry in Journal | 01, 03 | COVERED |
+| RESEARCH | Pitfall 5 | migration test pins last ID | 01 | COVERED |
+| RESEARCH | Pitfalls 6, 7 | CLI scope access, stdout purity | 01 | COVERED |
+| RESEARCH | Pitfall 8 | 201 documented | 01 | COVERED |
+| RESEARCH | Pitfall 9 | labels translated server-side | 01 | COVERED |
+| RESEARCH | Pitfall 10 | reserved `account` segment | 01 | COVERED |
+| RESEARCH | Pitfall 11 | Journal throttle keyed by IP (documented, unchanged) | 03 | COVERED |
+| RESEARCH | Pitfall 12 | docs snippets from compiled code | 01 | COVERED |
+| RESEARCH | Open Q2 | featured-image parity checked against frozen PHP | 03 | COVERED |
+| RESEARCH | Open Q5 | framework tag, Journal go.mod, host bumps | 03 | COVERED |
+
+Deferred (not gaps): backend-user management screen and superuser token view, `payment:read`, Fonoteka scopes, checksum token format.
+
+## Artifacts this phase produces (this plan)
+
+- pact: `TokenScope`, `HasTokenScopes`.
+- bouncer: `ScopeLimit`, `Principal.Scope`.
+- party: `Activated` (published by `Activate`).
+- lagoon: migration `202610110001_backend_api_tokens` (table `backend_api_tokens`) in `BackendAdminMigrations`.
+- cabana exported: `BackendAPIToken`, `APITokenPrefix`, `ResolveBackend`, `ErrUnauthenticated`, `ErrTokenScope`; OpenAPI types `AdminAPIToken`, `AdminAPITokenScope`, `AdminAPITokenCreated`, `AdminAPITokenRequest`; swag stubs `AdminAccountTokens`, `AdminAccountTokenCreate`, `AdminAccountTokenRevoke`, `AdminAccountTokenScopes`.
+- cabana internal: `mintAPIToken`, `hashAPIToken`, `wellFormedAPIToken`, `tokenStore` (interface) and `gormTokenStore`, `compositeGuard` and `newCompositeGuard`, `scopeError`, `tokenScopeCatalog`, `compileTokenScopes`, `compileTokenCatalog`, `scopeMatch`, `allowsUnderScope`, `scopeCoversAll`, `scopeOverlaps`, `validateTokenRequest`, `issueAPIToken`, `parseTokenExpiry`, `revokeAPIToken`, `stampLastUsed`, `interactiveOnly`, `tokenRouteGate`, `backendResolver`; handlers `accountTokensList`, `accountTokenCreate`, `accountTokenRevoke`, `accountTokenScopes`; CLI funcs `adminTokenCreate`, `adminTokenList`, `adminTokenRevoke`, `adminTokenScopes`.
+- Routes: `GET`/`POST /account/tokens`, `DELETE /account/tokens/{id}`, `GET /account/tokens/scopes`.
+- CLI commands: `admin:token:create`, `admin:token:list`, `admin:token:revoke`, `admin:token:scopes` (app binary) and their `summer` delegates.
+- Phrase keys `backend::lang.api_tokens.{scope_all, scope_all_description, scope_admin_read, scope_admin_read_description, name_required, name_too_long, expires_invalid, scopes_required, scope_unavailable}` (en, pl).
+- Smoke tests: `TestTokenTracerSmoke`, `TestTokenGatesSmoke` (Docker-free); `TestTokenTracerPostgres`, `TestAccountTokensSmoke`, `TestTokenCommandsSmoke` (Docker host); `TestActivatePublishesPlugins` (party).
+- Docs: `docs/examples/blog/token_scopes.go` (`blog`, `blog:read`), new sections in the five docs pages, README updates in five modules.
+
+<objective>
+Build the framework side of personal API tokens with scopes (D-01 to D-15, D-17 to D-20 server half): scope registration, the scope-limited principal and Allows, the token table and composite guard, interactive-only and route gates, the published resolver, the account token API with OpenAPI, the CLI, and the docs.
+
+Purpose: every backend-authenticated request can run as a token's owner, limited by the token's scopes, and plugins (plan 03) and the SPA (plan 02) build on these exact names.
+Output: the files above, regenerated admin OpenAPI and TS types, smoke tests, updated READMEs and docs pages.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-CONTEXT.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-PATTERNS.md
+
+16.3-RESEARCH.md and 16.3-UI-SPEC.md are not loaded whole (context budget, see Plan sizing note): each task's read_first names the sections it needs with line ranges; read only those ranges.
+
+Docker: the cabana auth, account, command and conformance suites, the lagoon migration suites and the Journal admin harness use testcontainers Postgres. When `docker info` fails, run the Docker-free verify lines, record every Postgres verify line as NOT RUN in the SUMMARY (they fail rather than skip by design), and plan 03's release gate lists them (16.2 pattern). Another session may edit `modules/` concurrently: stage files by explicit path and check `git status` before each commit. Commits: no co-author tags, one logical change per commit, code and planning docs in separate commits.
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: a g15_ token with a plugin scope reaches an admin controller as its owner, and an out-of-scope controller refuses it</name>
+  <reversibility rating="costly">D-07 (rated one-way in CONTEXT, format fixed by the human) becomes irreversible only when issued tokens reach agent configs after the release; that door is gated by the 16.3-03 release checkpoint, which carries the one-way rating. Until then a format change is a code edit across this phase.</reversibility>
+  <files>modules/pact/capabilities.go, modules/bouncer/context.go, modules/lagoon/backend_admin_migrations.go, modules/lagoon/backend_admin_migrations_test.go, modules/cabana/api_tokens.go, modules/cabana/token_scopes.go, modules/cabana/token_guard.go, modules/cabana/contracts.go, modules/cabana/registry.go, modules/cabana/messages.go, modules/cabana/http.go, modules/cabana/export_test.go, modules/cabana/token_smoke_test.go, modules/cabana/token_postgres_smoke_test.go</files>
+  <read_first>modules/pact/capabilities.go (Permission and HasPermissions, ~:495-506), modules/bouncer/context.go, modules/bouncer/guard.go, modules/bouncer/registry.go (Middleware :73-113), modules/bouncer/jwt.go (NewBackendJWTGuard :94, Authenticate :106, extractToken :273), modules/cabana/http.go (Activate :73-185, lazyBackendUsers, writeUnauthenticated), modules/cabana/auth.go (BackendUsers.FindByID :40-69, principalFrom, logAuth :374), modules/cabana/contracts.go (Allows :186, granted :203-235, BackendUser), modules/cabana/registry.go (compileContributions :168-288, permissionCode, validatePermissions, permissionExists, rolePermissions), modules/cabana/messages.go (validateMessageKeys :300-330), modules/lagoon/backend_admin_migrations.go, modules/lagoon/backend_admin_migrations_test.go (:516-600, rollbackBackendAdmin :443-452), modules/lagoon/jsonable.go, modules/wristband/crypto.go (:26-31), modules/cabana/export_test.go, modules/cabana/auth_test.go (adminGorm :321, adminHandler :367, insertAdmin, demoPlugin :433-470), ../sm-summercmsio-app/plugins/golem15/user/middleware/api_token.go, ../sm-summercmsio-app/plugins/golem15/user/classes/api_tokens.go, 16.3-RESEARCH.md Patterns 1, 2 and 6 (:216-316, :381-415), Pitfalls 1 and 5 (:460-464, :479-483) and the Code Examples (:505-589: mint and hash, debounced last_used_at, migration entry)</read_first>
+  <action>Wire one path through every layer: pact registration → boot compile → migration → token row → composite guard → scope-limited principal → Allows → handler.
+
+pact (per D-01): add `TokenScope` (Name, Label, Description, Permissions, Methods) and `HasTokenScopes` next to `Permission`/`HasPermissions`, with one-line doc comments in the same style; Label and Description are phrase keys or literal text.
+
+bouncer (per D-14): add `ScopeLimit` (`Full bool`, `Scopes [][]string`) and the `Scope *ScopeLimit` field on `Principal` tagged `json:"-"`; document that nil means unrestricted and that only a token guard sets it, already filtered by request method. Nothing else in bouncer changes.
+
+lagoon (per D-12): append migration `202610110001_backend_api_tokens` to `BackendAdminMigrations` with the DDL from RESEARCH "Migration entry" (CREATE TABLE IF NOT EXISTS, BIGSERIAL id, `backend_user_id INTEGER NOT NULL REFERENCES backend_users(id) ON DELETE CASCADE`, `token_hash CHAR(64) NOT NULL UNIQUE`, `token_hint TEXT NOT NULL`, `scopes TEXT NOT NULL`, nullable expires_at/last_used_at/revoked_at TIMESTAMPTZ, `revoked_by INTEGER REFERENCES backend_users(id) ON DELETE SET NULL`, created_at/updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), plus an index on backend_user_id; rollback drops the table). Extend the doc comment above `BackendAdminMigrations`. In the same commit fix `TestBackendAdminMetadataColumn` (RESEARCH Pitfall 5): assert the history ends with `202610110001_backend_api_tokens` and contains the metadata ID, and roll back both newest entries before checking that the metadata column is gone; add backend_api_tokens to the table list `TestPhase09MigrationsFreshRollback` checks after a full rollback.
+
+cabana model and crypto (api_tokens.go, per D-07): `APITokenPrefix`, `BackendAPIToken` (gorm tags as the user plugin's model, `Scopes lagoon.Jsonable[[]string]`, `TokenHash` tagged `json:"-"`), `mintAPIToken` (20 bytes from crypto/rand, lowercase hex, sha256 hex, last four characters as hint), `hashAPIToken`, `wellFormedAPIToken` (exactly g15_ plus 40 of 0-9a-f), and a minimal internal `issueAPIToken` that inserts a row for an owner with given scopes and expiry and returns the plaintext once (Task 3 adds name/expiry/overlap validation to this same function). Add a test-only exporter in export_test.go (for example `IssueTestAPIToken`) so external Postgres tests can mint a token before the HTTP API exists.
+
+cabana scopes (token_scopes.go, per D-01, D-03, D-04, D-05, D-14): `tokenScopeCatalog` holding the ordered compiled scopes (framework `*`: every method, full; `admin:read`: GET and HEAD, full; then plugin scopes in plugin activation order) and a by-name map; `compileTokenScopes(reg, plugins)` called in Activate right after `compileContributions`, storing the catalog on the Registry, failing boot with `cabana: …` errors for every rule in the D-01 truth above (name pattern `^[a-z][a-z0-9_-]*(:[a-z][a-z0-9_-]*)?$`, reserved `*`/`admin`/`admin:…`, duplicates naming both plugin IDs, empty lists, methods limited to GET, HEAD, POST, PUT, PATCH, DELETE in upper case and required to contain GET, permissions via `permissionCode(code, true)` and `reg.permissionExists`, non-empty label and description). Extend `validateMessageKeys` (or add a sibling called at the same place in Activate) so a label or description containing `::` must resolve in the published translator. Write `scopeMatch` exactly per the match table in this plan and `allowsUnderScope(p, required)` per the D-03 literal reading: empty list false; otherwise true when some slice in p.Scope.Scopes matches every required code (full or partial) and some required code is owner-held inside it (full match: ownerHas(code); partial: ownerHas(pattern)). Do not reuse `granted()` for the scope side.
+
+Allows (contracts.go, per D-14 and D-05, RESEARCH Pitfall 1): when `principal.Scope != nil && !principal.Scope.Full`, return `allowsUnderScope` before the IsSuperuser and empty-list shortcuts; the full and nil paths keep today's code byte for byte. Update the doc comment.
+
+Composite guard (token_guard.go, per D-13, D-02, D-08 to D-10): `compositeGuard` implements `bouncer.CredentialGuard` and `bouncer.UnauthorizedWriter` (compile-time assertions as in the user plugin's guard). It reads the Authorization header; only a `Bearer ` value starting with `APITokenPrefix` takes the token branch, every other request returns the wrapped JWT guard's `Authenticate` result unchanged. Token branch: refuse a value that is not well formed before touching the database; look the hash up through a small internal `tokenStore` interface (production `gormTokenStore` over the app's `*gorm.DB`: `revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now)`), compare the fetched hash with `crypto/subtle.ConstantTimeCompare`; load the owner through the same `bouncer.UserProvider` the JWT guard uses (`lazyBackendUsers{app, reg}`; nil principal → 401; tokens_valid_after is not consulted); method-filter the stored scopes through the catalog (unknown names ignored; no known scope → 401; known scopes but none allowing r.Method → a `scopeError` wrapping `ErrTokenScope`); set `principal.Scope` (Full when any allowed scope is full, else one pattern slice per allowed scope); return the token row as the credential. `WriteUnauthorized` answers 403 `forbidden` with `details.reason` token_scope for a `scopeError` and `writeUnauthenticated` (401) for anything else; say in a comment that this writer also answers 403. Log failures as `admin.auth` events with outcome and admin_id/token_id when known, never the header, plaintext or hash. Declare `ErrUnauthenticated` and `ErrTokenScope` here.
+
+Activate (http.go): build the existing JWT guard unchanged, wrap it with `newCompositeGuard(jwtGuard, store, users, reg)` and register the composite under `backend` (owner check unchanged).
+
+Tests (smoke only; full coverage is plan 04): `TestTokenTracerSmoke` (package cabana, Docker-free): a catalog with scopes `demo` (acme.demo.*, every method) and `demo:reports` (acme.demo.reports, GET and HEAD), an in-memory `tokenStore`, a stub `UserProvider` returning a developer principal granted acme.demo.access and acme.demo.reports, the composite guard registered in a `bouncer.Registry` and its middleware around a handler that answers 200 when `Allows(principal, ["acme.demo.access"])` and 403 otherwise: a `demo` token GET → 200; a `demo:reports` token GET → 403 (out of scope although the grants allow it); the same token POST → 403 with reason token_scope; a superuser principal with `demo:reports` → 403; a malformed `g15_x` → 401; a Bearer JWT string goes to the stub JWT guard untouched. `TestTokenTracerPostgres` (cabana_test, Docker host): the adminHandler harness with a test plugin that adds permission acme.demo.reports (developer role) and the two scopes; mint through the test exporter for a developer admin; GET the widgets list with a `demo` token → 200, with a `demo:reports` token → 403, POST with `demo:reports` → 403 token_scope; then soft-delete the admin and the `demo` token → 401.</action>
+  <verify>
+    <automated>go vet ./modules/pact ./modules/bouncer ./modules/lagoon ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestTokenTracerSmoke|TestPhase09PermissionMatrix|TestPhase09ContractInventory|TestPhase10ConformanceInventory)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 4</automated>
+    <fails_when>Non-zero exit: vet fails in one of the four packages, or fewer than four "--- PASS: Test" lines (the tracer smoke failed, or the existing route inventories broke).</fails_when>
+    <automated>docker info &gt;/dev/null 2&gt;&amp;1 &amp;&amp; go test -count=1 -run '^TestTokenTracerPostgres$' -v ./modules/cabana 2&gt;&amp;1 | grep -- '^--- PASS: TestTokenTracerPostgres' &amp;&amp; go test -count=1 -run '^(TestBackendAdminMetadataColumn|TestPhase09MigrationsFreshRollback)$' -v ./modules/lagoon 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 2</automated>
+    <fails_when>Non-zero exit: no Docker daemon (record NOT RUN in the SUMMARY), no "--- PASS: TestTokenTracerPostgres" line, or fewer than two passing lagoon migration tests (the migration or the updated last-ID test is wrong).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "HasTokenScopes interface" modules/pact/capabilities.go` and `grep -n "Scope \*ScopeLimit" modules/bouncer/context.go` each print one line.
+    - `grep -c "202610110001_backend_api_tokens" modules/lagoon/backend_admin_migrations.go modules/lagoon/backend_admin_migrations_test.go` reports at least 1 for each file.
+    - `grep -n "allowsUnderScope" modules/cabana/contracts.go` prints a line that comes before the line containing `principal.IsSuperuser || len(required) == 0` (scope first).
+    - `grep -n "ConstantTimeCompare" modules/cabana/token_guard.go modules/cabana/api_tokens.go` prints at least one line.
+    - The Docker-free verify passes; the Postgres verify passes on a Docker host or is recorded NOT RUN.
+  </acceptance_criteria>
+  <done>A g15_ token minted for a backend user authenticates through the composite backend guard, runs as its owner and is limited by its method-filtered scopes in Allows, with the JWT path unchanged.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Deny by default outside Allows: interactive-only marker, explicit route gates, the published ResolveBackend, and the debounced last_used_at stamp</name>
+  <reversibility rating="costly">D-13/D-14: every backend-authenticated route now passes through the composite guard and scope rules; undoing it touches every route classification.</reversibility>
+  <files>modules/cabana/token_guard.go, modules/cabana/api_tokens.go, modules/cabana/http.go, modules/cabana/auth.go, modules/cabana/field_type.go, modules/cabana/field_markdown.go, modules/cabana/registry.go, modules/cabana/token_smoke_test.go</files>
+  <read_first>modules/cabana/token_guard.go and modules/cabana/api_tokens.go (Task 1), modules/cabana/http.go (mount :222-345, Activate guard block), modules/cabana/csrf.go (requireAjax, csrfSafe), modules/cabana/auth.go (refresh :255, logout :295, sessionToken :323, me :338, bearerToken :362, adminBlacklist :395), modules/cabana/field_type.go (fieldTypesList :864), modules/cabana/field_markdown.go (markdownPreview :71), modules/cabana/registry.go (reservedVendorSegments :44, checkReservedSegments), modules/cabana/contracts.go (WriteErrorDetails), ../sm-journal-plugin/controllers/api/auth.go (the current Bearer-only guard the resolver replaces in plan 03), 16.3-RESEARCH.md Patterns 3 and 4 (:317-363), Pitfalls 2, 3, 4 and 10 (:465-478, :496-498), "Debounced last_used_at" (:535-553) and assumption A3 (:603)</read_first>
+  <action>Make D-05 and D-06 hold on routes that never call Allows, and publish the D-15 resolver.
+
+Interactive-only (per D-06): `interactiveOnly(next)` answers 403 `forbidden` with `details.reason` interactive_only when the request credential is a `*BackendAPIToken`, or when the raw Authorization Bearer value starts with `APITokenPrefix` (the routes outside the guard). In mount wrap PUT /account, POST and DELETE /account/avatar (outside requireAjax, so the refusal comes first) and POST /auth/refresh and POST /auth/logout, so a g15_ Bearer never reaches refresh or logout (no cookie expiry, no blacklist write). Task 3 wraps the four token routes the same way. GET /auth/me stays unwrapped (D-05).
+
+Route gates (per D-05, RESEARCH Pitfall 2 and assumption A3): `tokenRouteGate` refuses a principal whose Scope is non-nil and not Full with 403 `forbidden`, reason token_scope (the same answer as `Allows(principal, nil)` refusing); call it at the top of `fieldTypesList` and `markdownPreview` after the principal check. `/navigation` and `/settings` already filter every item through Allows and stay as they are.
+
+Reserved segment (RESEARCH Pitfall 10): add `account` to `reservedVendorSegments` and to the boot error's reserved list text.
+
+Resolver (per D-15, RESEARCH Pattern 3 and Pitfall 4): in Activate, after the backend guard is registered, build a second composite guard around a cookie-less `NewBackendJWTGuard(secret, users, bl, nil)` (same users, same blacklist, same registry and catalog) and publish it as `*backendResolver` with `app.Publish`, keeping an already-published one when Activate runs twice on one app (as the guard registration does). `ResolveBackend(app, r, cover...)`: no app, no published resolver or no Bearer value → `ErrUnauthenticated`; otherwise authenticate through the resolver's guard; a scope error → `ErrTokenScope`; any other failure → `ErrUnauthenticated`; for a token principal that is not Full, require `scopeCoversAll(principal.Scope, cover)` (some scope slice matches every cover code, full or partial) or return `ErrTokenScope`; on success return the request carrying `bouncer.WithUser` and, for a token, `bouncer.WithCredential`. The resolver never reads the admin cookie (Journal's write routes have no CSRF check). Document in the doc comment that routes registered before Activate must call it per request.
+
+last_used_at (per D-11): `stampLastUsed` as in RESEARCH "Debounced last_used_at" (process-wide sync.Map keyed by token id, one-minute window, UPDATE of last_used_at only with the conditional WHERE), called by the composite guard after a successful token authentication on both the guard and resolver paths; an error is logged with `slog.Default().WarnContext` and token_id and never fails the request.
+
+Smoke test `TestTokenGatesSmoke` (Docker-free, package cabana): with the Task 1 in-memory store and stub users, assert a `*` token gets 403 interactive_only from the wrapped PUT /account handler and from the refresh handler given a raw g15_ Bearer; a `demo` token gets 403 token_scope from fieldTypesList; an `admin:read` GET passes fieldTypesList; ResolveBackend on an app with a published resolver returns ErrTokenScope for a `demo:reports` POST and for cover acme.other.* , ErrUnauthenticated for no Bearer and for a malformed token, and a principal carrying the credential for a `demo` GET with cover acme.demo.*; two authentications within a minute call the store's stamp once.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestTokenTracerSmoke|TestTokenGatesSmoke|TestPhase09PermissionMatrix|TestPhase09ContractInventory|TestPhase10ConformanceInventory|TestPhase10CSRF)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 6</automated>
+    <fails_when>Non-zero exit or fewer than six "--- PASS: Test" lines: a gate, the interactive-only marker, the resolver or the stamp debounce misbehaves, or a wrapper broke the route inventory or CSRF tests.</fails_when>
+    <automated>docker info &gt;/dev/null 2&gt;&amp;1 &amp;&amp; go test -count=1 -run '^(TestTokenTracerPostgres|TestAdminAuthLifecycle|TestAdminLogoutRevokesExpiredRefreshableToken)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 3</automated>
+    <fails_when>Non-zero exit: no Docker daemon (record NOT RUN), or the tracer, the JWT login/refresh lifecycle or the logout test regressed after wrapping refresh and logout.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "interactiveOnly(" modules/cabana/http.go` prints at least five lines (account, two avatar, refresh, logout).
+    - `grep -n "tokenRouteGate" modules/cabana/field_type.go modules/cabana/field_markdown.go` prints one line per file.
+    - `grep -n "func ResolveBackend" modules/cabana/token_guard.go` prints one line, and `grep -n "app.Publish" modules/cabana/http.go` shows a publish of the resolver.
+    - `grep -n '"account"' modules/cabana/registry.go` prints a line in `reservedVendorSegments`.
+  </acceptance_criteria>
+  <done>Tokens are refused on every interactive-only route, unscoped routes outside Allows are gated, plugins can resolve a backend principal (JWT or token) with a scope cover check, and token use is stamped at most once a minute.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Account token API (list, create, revoke, scopes) with swag annotations, regenerated OpenAPI and TS types, route inventories and server-side phrase keys</name>
+  <files>modules/cabana/account_tokens.go, modules/cabana/api_tokens.go, modules/cabana/token_scopes.go, modules/cabana/http.go, modules/cabana/admin_openapi.go, modules/cabana/security_coverage_test.go, modules/cabana/openapi_conformance_test.go, modules/cabana/token_postgres_smoke_test.go, modules/phrasebook/backend/lang/en/lang.yaml, modules/phrasebook/backend/lang/pl/lang.yaml, admin/openapi/admin.json, admin/src/api/schema.d.ts</files>
+  <read_first>modules/cabana/account.go (accountPrincipal :216, backendMessage :246, accountUpdate :289, refusedAccountKeys :445, writeAccountError :495), modules/cabana/relation_child.go (decodeCappedObject :700), modules/cabana/field_file.go (fieldDetail :873), modules/cabana/crud.go (ValidationError :65, writeCRUDError :737), modules/cabana/http.go (translator :797), modules/cabana/form_schema.go (schemaLocale :361), modules/cabana/admin_openapi.go (header :1-12, AdminMe and AdminAccountUpdate :190-219), modules/cabana/security_coverage_test.go (phase09Routes), modules/cabana/phase09_contract_test.go, modules/cabana/openapi_conformance_test.go (conformCases :230, the /account/avatar cases :515-540, newConformEnv :765), scripts/check-admin-openapi.sh, modules/phrasebook/backend/lang/en/lang.yaml and pl/lang.yaml (myaccount block :234), 16.3-UI-SPEC.md Copywriting Contract (:131-206) and Component Contracts 3-5 (:221-281), 16.3-RESEARCH.md Pattern 5 (:364-380) and Pitfalls 8 and 9 (:490-495); for the Task 1-2 code, the as-built signatures only (see Plan sizing note, seam after Task 2)</read_first>
+  <action>Implement the D-16 to D-18 server half; the SPA (plan 02) relies on these exact shapes (Interfaces section of this plan).
+
+Validation and issue (api_tokens.go, per D-08, D-17): put the rules in a pure `validateTokenRequest` (no database: catalog, owner principal, raw name, expires and scopes, the clock and a CLI-mode flag in; cleaned values and field-keyed message keys out) and grow `issueAPIToken` into the single path used by the API and the CLI that calls it and then inserts: trim the name and require 1 to 100 runes (`api_tokens.name_required`, `api_tokens.name_too_long`); `parseTokenExpiry` accepts 30d, 90d, 365d and never (absent means 90d) for the API, and additionally YYYY-MM-DD (00:00 UTC, must be after now) for the CLI (`api_tokens.expires_invalid`); scopes: empty → `api_tokens.scopes_required`; a list containing `*` becomes exactly [`*`]; duplicates removed keeping order; each name must exist in the catalog and overlap the owner (`scopeOverlaps`, the D-17 rule in this plan) or the error is `api_tokens.scope_unavailable` with :name. Return field-keyed messages the handler turns into a `ValidationError`. `revokeAPIToken(db, ownerID, id, revokedBy)` updates revoked_at and revoked_by only where id, backend_user_id and revoked_at IS NULL match and reports not found otherwise.
+
+Handlers (account_tokens.go): `accountTokensList`, `accountTokenCreate`, `accountTokenRevoke`, `accountTokenScopes`, each starting with `accountPrincipal`, each using `s.db()` with the slog plus 500 tail of accountUpdate. Create decodes with `decodeCappedObject`, refuses keys other than name, expires and scopes as PUT /account does, answers 201 with the created row plus `token` (the only place the plaintext ever appears). List filters by the principal's id, hides revoked rows unless the query value revoked is 1 or true, orders by created_at DESC then id DESC, and maps each stored scope to `{name, label, description, read_only, known}`: labels and descriptions translated server-side in the request locale (RESEARCH Pitfall 9; `*` and `admin:read` from the api_tokens keys), read_only true when the scope's methods are only GET and HEAD, unknown names returned with known false and label equal to the name. `expired` is computed server-side. Scopes answers the picker list in catalog order filtered by `scopeOverlaps`, `*` always first. Revoke parses {id}, answers 404 `not_found` when nothing was revoked, else 200 with the row.
+
+Mount (http.go): GET and POST /account/tokens, GET /account/tokens/scopes and DELETE /account/tokens/{id} inside the backend group next to the account routes, each wrapped in `interactiveOnly`, writes also in `requireAjax` (per D-06, D-18).
+
+OpenAPI (admin_openapi.go): types `AdminAPIToken`, `AdminAPITokenScope`, `AdminAPITokenCreated`, `AdminAPITokenRequest` and stubs `AdminAccountTokens`, `AdminAccountTokenCreate` (documents @Success 201, RESEARCH Pitfall 8), `AdminAccountTokenRevoke`, `AdminAccountTokenScopes` in the AdminAccountUpdate style, each with @Failure 401, 403 (interactive_only) and 422/404 as they apply and a @Description naming the interactive-only rule. Change the BackendBearer description to say the header carries an admin access token or a personal API token (g15_…), and that account and token routes refuse personal tokens. Run `bash scripts/check-admin-openapi.sh` to regenerate admin/openapi/admin.json and admin/src/api/schema.d.ts and commit both with the routes (TestPhase09ContractInventory reads the committed document).
+
+Inventories: add the four route keys to `phase09Routes` and four `conformCases` (list after a create, create with scopes [`*`] expecting 201, revoke of a token created in the case, scopes) using the env's JWT.
+
+Phrase keys (per UI-SPEC copy): add an `api_tokens:` block next to `myaccount:` in en and pl with the nine server-side keys from the Interfaces section, Polish first as the design language and the UI-SPEC wording where it names the key.
+
+Smoke test `TestAccountTokensSmoke` (Postgres, cabana_test, adminHandler harness): log in a developer admin, GET /account/tokens/scopes includes `*` and `demo`, POST creates a `demo` token (201, token matches g15_ plus 40 hex, no token_hash key in the body), GET lists it with hint equal to the token's last four characters and no token key, the token itself is refused on GET /account/tokens with 403 interactive_only, DELETE revokes it (200) and a second DELETE is 404, and the revoked token now answers 401 on the widgets list.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestPhase09PermissionMatrix|TestPhase09ContractInventory|TestPhase10ConformanceInventory|TestTokenTracerSmoke|TestTokenGatesSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 5 &amp;&amp; bash scripts/check-admin-openapi.sh --check &amp;&amp; npm --prefix admin run typecheck</automated>
+    <fails_when>Non-zero exit: fewer than five "--- PASS: Test" lines (a new route is missing from phase09Routes, the committed OpenAPI or conformCases), check-admin-openapi reports admin.json or schema.d.ts stale, or the SPA no longer typechecks against the regenerated types.</fails_when>
+    <automated>docker info &gt;/dev/null 2&gt;&amp;1 &amp;&amp; go test -count=1 -run '^(TestAccountTokensSmoke|TestPhase10OpenAPIConformance)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 2</automated>
+    <fails_when>Non-zero exit: no Docker daemon (record NOT RUN), the account token smoke fails (plaintext leaked into a list, a token reached a token route, revoke not soft or not own-only), or a documented response schema does not match a real response.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c '"/account/tokens' admin/openapi/admin.json` reports at least 1, and `grep -n '"201"' admin/openapi/admin.json` includes the create operation.
+    - `grep -n "account/tokens" modules/cabana/security_coverage_test.go modules/cabana/openapi_conformance_test.go` prints four route lines in each file.
+    - `grep -c "api_tokens:" modules/phrasebook/backend/lang/en/lang.yaml modules/phrasebook/backend/lang/pl/lang.yaml` reports 1 for each file.
+    - In modules/cabana/account_tokens.go the only JSON key carrying the plaintext is set in the create handler: `grep -n '"token"' modules/cabana/account_tokens.go modules/cabana/admin_openapi.go` lines all belong to the create path or the AdminAPITokenCreated type.
+  </acceptance_criteria>
+  <done>A signed-in admin can list, create (plaintext once), revoke and pick scopes through the documented admin API, and the OpenAPI document, TS types and inventories cover the four routes.</done>
+</task>
+
+<task type="auto">
+  <name>Task 4: admin:token:* CLI with party.Activated, summer delegates, and the framework READMEs and docs pages</name>
+  <files>modules/party/registry.go, modules/party/registry_test.go, modules/party/README.md, modules/cabana/token_commands.go, modules/cabana/commands.go, modules/cabana/token_scopes.go, modules/cabana/registry.go, modules/cabana/token_postgres_smoke_test.go, modules/cabana/README.md, modules/pact/README.md, modules/bouncer/README.md, modules/lagoon/README.md, cmd/summer/runtime.go, cmd/summer/runtime_test.go, docs/examples/blog/token_scopes.go, docs/examples/blog/lang/en/lang.yaml, docs/backend/users-and-permissions.md, docs/services/authentication.md, docs/console/setup-and-maintenance.md, docs/console/introduction.md, docs/plugins/registration.md</files>
+  <read_first>modules/party/registry.go (activate, SetPlugins :107), modules/backpack/services.go (Publish duplicate rule), modules/cabana/commands.go (RuntimeCommands :18, adminCreate, adminResetPassword, flagValue :192, withAdminDB :200), modules/cabana/auth.go (findBackendLogin :417), modules/bonfire/command.go (Flag.Repeatable, Input.Flags), modules/bonfire/output.go (Println, Table), modules/bonfire/root.go, cmd/summer/runtime.go (delegateCommands), cmd/summer/runtime_test.go (TestDelegateCommandsHelp count 11), cmd/summer/docs.go (docsCommands), internal/build/build.go (generated main calls cabana.RuntimeCommands(app)), modules/cabana/commands_test.go (TestAdminCreateCommand, commandApp, flagInput), docs/examples/blog/plugin.go and lang/en/lang.yaml, docs/backend/users-and-permissions.md, docs/services/authentication.md, docs/console/setup-and-maintenance.md (Admin accounts), docs/console/introduction.md (delegate table), docs/plugins/registration.md (capability table), modules/pact/README.md, modules/bouncer/README.md, modules/cabana/README.md (Features, Admin API routes, API reference, CLI commands), modules/party/README.md, modules/lagoon/README.md (:129), CLAUDE.md Documentation section, 16.3-RESEARCH.md Pattern 7 (:416-433) and Pitfalls 6, 7 and 12 (:484-489, :502-504)</read_first>
+  <action>party (user-confirmed Option A, per D-19): declare `Activated` as the ordered `[]Plugin` and publish it with `app.Publish` right after `app.SetPlugins(orderedIDs)` (an error is returned as `party: …`); doc comment says commands read it at Run time. Smoke test `TestActivatePublishesPlugins` in modules/party: after activate, `app.Lookup[Activated]()` returns the plugins in activation order.
+
+Catalog for the CLI (token_scopes.go, registry.go): extract the permission and role-grant loop of `compileContributions` into a helper both paths call, and add `compileTokenCatalog(plugins)` returning a Registry holding only permissions, role grants and the token scope catalog (no controllers, settings or navigation, so plugins with navigation compile).
+
+Commands (token_commands.go; registered by RuntimeCommands, signature unchanged; constructors only capture app so docsCommands keeps working): `admin:token:create` (Arg identifier required; Flags name, scope Repeatable, expires default 90d) resolves the user with `findBackendLogin` (ambiguity rule unchanged), refuses deactivated or soft-deleted users, loads the owner principal with `BackendUsers{DB, Registry: catalog registry}.FindByID` so code-declared roles count, calls `issueAPIToken` (same rules as the API, D-17), and on success writes exactly the token and a newline with `out.Println` and nothing else on stdout (RESEARCH Pitfall 7; errors are returned, never printed). `admin:token:list` (optional identifier, Bare flag revoked) prints a `Table` with id, login, name, scopes, hint as g15_…last4, created, last used, expires and revoked, never the hash or plaintext. `admin:token:revoke` (Arg id) revokes any user's active token with revoked_by NULL; not found is an error, an already revoked token prints that it was already revoked and exits 0. `admin:token:scopes` prints name, label (translated with the app translator when published, otherwise the key), read-only and permissions. When `party.Activated` is not published the commands use the framework scopes only and say so on stderr-safe paths (create and scopes return an error naming the unknown scope as usual). Smoke test `TestTokenCommandsSmoke` (Postgres, cabana_test, commandApp plus a published party.Activated holding the demo test plugin): create prints exactly one line matching g15_ plus 40 hex, list shows the hint and not the token, revoke works, scopes lists `*`, admin:read and demo.
+
+summer (cmd/summer/runtime.go): four delegate rows for admin:token:create (hint: identifier, --name, --scope repeatable, --expires), admin:token:list, admin:token:revoke and admin:token:scopes; update `TestDelegateCommandsHelp` to 15 commands and add hints for admin:token:create.
+
+Docs example: docs/examples/blog/token_scopes.go with the compile-time assertion for `pact.HasTokenScopes` and `TokenScopes()` returning `blog` (acme.blog.*, GET, HEAD, POST, PUT, PATCH, DELETE) and `blog:read` (acme.blog.*, GET, HEAD) with phrase keys acme.blog::lang.scopes.*, and those keys in docs/examples/blog/lang/en/lang.yaml (the example activates through cabana, which now validates them).
+
+READMEs (CLAUDE.md, same change, neutral names): pact (Features line and API reference rows for TokenScope and HasTokenScopes), bouncer (ScopeLimit, Principal.Scope), cabana (Features: composite backend guard, personal API tokens, scopes and framework scopes, interactive-only routes, route gates; Admin API routes: the four account token routes; API reference: BackendAPIToken, APITokenPrefix, ResolveBackend, ErrUnauthenticated, ErrTokenScope and the four OpenAPI types; CLI commands table: the four admin:token commands with a pipe example `TOKEN=$(./bin/acme admin:token:create admin@example.com --name agent --scope blog)`), party (Activated in Features and API reference), lagoon (the BackendAdminMigrations row names backend_api_tokens).
+
+docs/ pages: users-and-permissions.md gets an "API tokens" section (format and storage, scopes and the framework scopes, owner ∩ scope with the multi-code rule, deny by default and the gated routes, interactive-only routes, expiry and revoke, the four account endpoints, a `src=docs/examples/blog/token_scopes.go#Plugin.TokenScopes` fence and the boot rules); authentication.md describes the composite backend guard under "Guards and middleware" and a subsection on accepting admin tokens on plugin routes with ResolveBackend (Bearer only, cover codes, the two sentinel errors); setup-and-maintenance.md adds the four commands to "Admin accounts"; introduction.md adds the four delegate rows; registration.md adds a capability row for `pact.HasTokenScopes`. Run `go run ./cmd/summer docs:sync` if a src= fence changed, then the checks.</action>
+  <verify>
+    <automated>go vet ./... &amp;&amp; go test -count=1 ./modules/party ./modules/pact &amp;&amp; go test -count=1 -run '^(TestDocsTree|TestDelegateCommandsHelp|TestDocsCommandsMirrorGeneratedMain)$' -v ./cmd/summer 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 3 &amp;&amp; go run ./cmd/summer docs:build --check &amp;&amp; go test -short -count=1 -run '^(TestPluginActivates|TestRoutesRegistered)$' ./docs/examples/blog</automated>
+    <fails_when>Non-zero exit: vet fails anywhere, the party or pact package fails (Activated not published), fewer than three passing cmd/summer tests (a docs identifier or command name is unknown, a delegate row or its hint is missing), docs:build --check reports a problem, or the blog example no longer activates (a scope label key is missing or a scope rule is broken).</fails_when>
+    <automated>docker info &gt;/dev/null 2&gt;&amp;1 &amp;&amp; go test -count=1 -run '^(TestTokenCommandsSmoke|TestAdminCreateCommand)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 2</automated>
+    <fails_when>Non-zero exit: no Docker daemon (record NOT RUN), create printed anything besides the token line, or the existing admin:create test regressed.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func RuntimeCommands(app \*backpack.App) \[\]bonfire.Command" modules/cabana/commands.go` prints one line (signature unchanged).
+    - `grep -c "admin:token:" cmd/summer/runtime.go` reports 4 and `grep -n "want 15" cmd/summer/runtime_test.go` prints one line.
+    - `grep -l "HasTokenScopes" modules/pact/README.md docs/backend/users-and-permissions.md docs/plugins/registration.md` lists all three files; `grep -l "ResolveBackend" modules/cabana/README.md docs/services/authentication.md` lists both; `grep -l "ScopeLimit" modules/bouncer/README.md` and `grep -l "Activated" modules/party/README.md` each list their file; `grep -c "admin:token:" modules/cabana/README.md docs/console/setup-and-maintenance.md` reports at least 4 for each.
+    - `grep -ciE "fonoteka|p[lł][yý]tarium|grzyby" docs/backend/users-and-permissions.md docs/services/authentication.md modules/cabana/README.md` reports 0 for each file.
+  </acceptance_criteria>
+  <done>Operators manage any user's tokens from the app binary (and through summer), plugin scopes are visible to the CLI without a host main change, and every new exported identifier, route and command is documented in its module README and the docs pages.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| client → admin API | Authorization header (JWT or g15_ token) and cookie cross here; untrusted |
+| client → plugin routes via ResolveBackend | Bearer value only; plugin routes have no CSRF check |
+| plugin code → cabana boot | plugins declare scopes and permissions compiled at boot |
+| operator → CLI | runs with database access; may mint for any user |
+| database → process | token rows; only hashes stored |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.3-01 | Spoofing | compositeGuard token branch | high | mitigate | 160-bit crypto/rand secret; wellFormedAPIToken refuses anything but g15_ plus 40 lowercase hex before the database; lookup by unique sha256 then crypto/subtle compare; expired, revoked and dead-owner tokens are 401 |
+| T-16.3-02 | Information Disclosure | backend_api_tokens | medium | mitigate | Only sha256 hex and a four-character hint are stored; TokenHash is json:"-"; list and CLI outputs never carry hash or plaintext |
+| T-16.3-03 | Information Disclosure | create response, logs | high | mitigate | Plaintext only in the 201 create body and the CLI stdout line; admin.auth logs carry outcome, admin_id and token_id only, never the Authorization value |
+| T-16.3-04 | Elevation of Privilege | cabana.Allows | high | mitigate | Scope branch before the IsSuperuser and empty-list shortcuts; per-scope every-code match plus owner-held code; superuser limited by the scope; smoke tests cover superuser and out-of-scope cases |
+| T-16.3-05 | Elevation of Privilege | account, token, refresh, logout routes | high | mitigate | interactiveOnly refuses any token credential or raw g15_ Bearer, `*` included, with 403 interactive_only before requireAjax and the handler |
+| T-16.3-06 | Spoofing / Tampering (CSRF) | token transport, ResolveBackend | high | mitigate | Token branch reads only the Authorization Bearer header; cookie values never reach it; ResolveBackend wraps a cookie-less JWT guard so plugin write routes cannot be driven by the admin cookie |
+| T-16.3-07 | Elevation of Privilege | owner loading | medium | mitigate | lazyBackendUsers.FindByID per request: deactivated or soft-deleted owners fail with 401; code-declared role grants come from the compiled registry |
+| T-16.3-08 | Elevation of Privilege | issueAPIToken (API and CLI) | medium | mitigate | Scope names validated against the catalog and the overlap rule; unknown stored names grant nothing; scopes immutable after creation |
+| T-16.3-09 | Denial of Service | last_used_at writes | low | mitigate | Per-token one-minute in-process gate plus conditional UPDATE; stamp failures never fail auth |
+| T-16.3-10 | Denial of Service | invalid token floods | low | accept | Format check precedes an indexed unique lookup; 160-bit secrets are not guessable; no new throttle bucket (the admin API has none beyond login) |
+| T-16.3-11 | Tampering | scope registration | medium | mitigate | Boot fails on duplicate, reserved (`*`, admin, admin:…) or invalid names, unknown permissions or methods, missing GET, unresolved phrase keys |
+| T-16.3-12 | Repudiation | revoke | low | mitigate | Soft revoke keeps revoked_at and revoked_by (NULL for the CLI); denials logged as admin.auth events |
+| T-16.3-13 | Elevation of Privilege | routes outside Allows | high | mitigate | tokenRouteGate on /field-types and /markdown/preview; /navigation and /settings filter per item through Allows; plan 04 classifies every mounted route in a test table |
+| T-16.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package is installed; swag runs pinned at v1.16.6 through the existing scripts/check-admin-openapi.sh; openapi-typescript comes from the committed admin lockfile |
+</threat_model>
+
+<verification>
+- Task 1: tracer smoke and inventories pass; Postgres tracer and lagoon migration tests pass on a Docker host.
+- Task 2: gates smoke, CSRF and inventories pass; JWT lifecycle tests still pass on a Docker host.
+- Task 3: inventories, OpenAPI drift gate and SPA typecheck pass; account token smoke and OpenAPI conformance pass on a Docker host.
+- Task 4: go vet ./..., party, pact, TestDocsTree, delegate help, docs:build --check and the blog example pass; command smoke passes on a Docker host.
+- Every Postgres line not run here is listed NOT RUN in the SUMMARY.
+</verification>
+
+<success_criteria>
+- SC-1 and SC-2 hold at the framework level: tokens authenticate as their owner and never exceed the owner or the scope, with deny-by-default outside Allows.
+- SC-3 server half: account token API and CLI work; SC-5 framework half: READMEs and docs updated in the same plan.
+- No new dependency; JWT behaviour unchanged.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-01-SUMMARY.md` when done, with the commit list, the exported API as built, any name that differs from this plan, and the Postgres tests run or NOT RUN.
+</output>

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-01-SUMMARY.md

@@ -0,0 +1,189 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+plan: 01
+subsystem: auth
+tags: [api-tokens, scopes, cabana, bouncer, pact, party, lagoon, admin-cli, openapi, g15]
+
+requires:
+  - phase: 16.2-plugin-provided-field-types-and-the-blog-editor-formwidget
+    provides: cabana Activate, admin OpenAPI inventories, BackendAdminMigrations, My account routes
+provides:
+  - "pact.TokenScope and pact.HasTokenScopes"
+  - "bouncer.ScopeLimit and Principal.Scope"
+  - "backend_api_tokens migration and cabana.BackendAPIToken / APITokenPrefix"
+  - "composite backend guard, interactiveOnly, tokenRouteGate, ResolveBackend, ErrUnauthenticated, ErrTokenScope"
+  - "account token API (list/create/revoke/scopes) with OpenAPI and phrase keys"
+  - "admin:token:* CLI via party.Activated and summer delegates"
+  - "framework READMEs and docs for tokens, scopes, ResolveBackend and CLI"
+affects: [16.3-02, 16.3-03, 16.3-04, sm-journal-plugin]
+
+actuals:
+  tokens: 40262
+  tasks: 4
+  commits: 5
+plan_head_before: 4d107f4ccb3ed00bf12b680b07c2e7874b345198
+plan_head_after: e24e03c47d84f854b6c66c1b317940492b60f441
+
+tech-stack:
+  added: []
+  patterns:
+    - "Composite backend guard: Bearer g15_ → token branch; else unchanged JWT+cookie path"
+    - "party.Activated published at Activate for CLI catalog without changing RuntimeCommands(app)"
+    - "Scope before superuser/empty-list in Allows; interactive_only and token_scope reasons"
+
+key-files:
+  created:
+    - modules/cabana/api_tokens.go
+    - modules/cabana/token_scopes.go
+    - modules/cabana/token_guard.go
+    - modules/cabana/account_tokens.go
+    - modules/cabana/token_commands.go
+    - modules/cabana/token_smoke_test.go
+    - modules/cabana/token_postgres_smoke_test.go
+    - docs/examples/blog/token_scopes.go
+  modified:
+    - modules/pact/capabilities.go
+    - modules/bouncer/context.go
+    - modules/lagoon/backend_admin_migrations.go
+    - modules/cabana/contracts.go
+    - modules/cabana/http.go
+    - modules/cabana/registry.go
+    - modules/cabana/admin_openapi.go
+    - modules/party/registry.go
+    - cmd/summer/runtime.go
+    - admin/openapi/admin.json
+    - admin/src/api/schema.d.ts
+    - modules/phrasebook/backend/lang/en/lang.yaml
+    - modules/phrasebook/backend/lang/pl/lang.yaml
+    - docs/backend/users-and-permissions.md
+    - docs/services/authentication.md
+    - docs/console/setup-and-maintenance.md
+    - docs/console/introduction.md
+    - docs/plugins/registration.md
+
+key-decisions:
+  - "D-03 literal: one method-allowed scope must match every required code; ScopeLimit keeps per-scope pattern slices"
+  - "CLI uses party.Activated at Run time; cabana.RuntimeCommands(app) signature unchanged (Option A)"
+  - "ResolveBackend is Bearer-only (cookie-less JWT guard) so plugin writes cannot be CSRF-driven by summer_admin"
+  - "Exported names match the plan Interfaces section; no as-built renames"
+
+patterns-established:
+  - "Personal API token: g15_+40 hex, sha256+hint stored, plaintext once on create/CLI stdout"
+  - "Plugin scopes via HasTokenScopes; framework * and admin:read; boot fails loud on bad registration"
+
+requirements-completed: [SC-1, SC-2, SC-3, SC-5]
+
+coverage:
+  - id: D1
+    description: "g15_ token authenticates through the composite backend guard as its owner, scoped by Allows"
+    requirement: SC-1
+    verification:
+      - kind: unit
+        ref: modules/cabana/token_smoke_test.go#TestTokenTracerSmoke
+        status: pass
+      - kind: integration
+        ref: modules/cabana/token_postgres_smoke_test.go#TestTokenTracerPostgres
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Out-of-scope and non-Allows routes refuse tokens; interactive-only routes refuse all personal tokens; ResolveBackend and last_used debounce work"
+    requirement: SC-2
+    verification:
+      - kind: unit
+        ref: modules/cabana/token_smoke_test.go#TestTokenGatesSmoke
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Account token API list/create/revoke/scopes with OpenAPI, inventories and phrase keys"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: modules/cabana/token_postgres_smoke_test.go#TestAccountTokensSmoke
+        status: pass
+      - kind: other
+        ref: bash scripts/check-admin-openapi.sh --check
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "admin:token:* CLI with party.Activated, summer delegates, READMEs and docs"
+    requirement: SC-5
+    verification:
+      - kind: integration
+        ref: modules/cabana/token_postgres_smoke_test.go#TestTokenCommandsSmoke
+        status: pass
+      - kind: unit
+        ref: cmd/summer/runtime_test.go#TestDelegateCommandsHelp
+        status: pass
+      - kind: other
+        ref: go run ./cmd/summer docs:build --check
+        status: pass
+    human_judgment: false
+
+duration: 95min
+completed: 2026-10-11
+status: complete
+---
+
+# Phase 16.3 Plan 01: Framework personal API tokens Summary
+
+**Scoped g15_ personal API tokens through a composite backend guard, account API, admin:token CLI and docs — owner ∩ scope, interactive-only gates, ResolveBackend for plugins.**
+
+## Performance
+
+- **Duration:** 95 min
+- **Started:** 2026-10-10T23:41:00Z
+- **Completed:** 2026-10-11T00:00:00Z
+- **Tasks:** 4
+- **Files modified:** 43
+
+## Accomplishments
+- Tracer path: mint → hash store → composite guard → ScopeLimit → Allows (scope before superuser)
+- Deny-by-default gates: interactiveOnly, field-types/markdown tokenRouteGate, published ResolveBackend, debounced last_used_at
+- Account token API with OpenAPI/TS types, inventories and backend::lang.api_tokens phrase keys
+- admin:token:* CLI via party.Activated, summer delegates, blog HasTokenScopes example, five module READMEs and five docs pages
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Tracer** - `b9273c1` (feat)
+2. **Task 2: Gates, ResolveBackend, stamp** - `183583e` (feat)
+3. **Task 3: Account token API + OpenAPI** - `ffdb5d0` (feat)
+4. **Task 4: CLI, party.Activated, READMEs/docs** - `e24e03c` (feat)
+
+**Plan metadata:** (this commit)
+
+## Exported API as built
+
+Matches the plan Interfaces section: `pact.TokenScope` / `HasTokenScopes`; `bouncer.ScopeLimit` / `Principal.Scope`; `party.Activated`; `cabana.BackendAPIToken`, `APITokenPrefix`, `ResolveBackend`, `ErrUnauthenticated`, `ErrTokenScope`; OpenAPI types and swag stubs; CLI `admin:token:create|list|revoke|scopes`. No name differs from the plan.
+
+## Decisions Made
+- Followed locked D-01–D-20 and Option A for CLI plugin access (`party.Activated`).
+- `validateTokenRequest` + `validateTokenScopes` helper; `compilePermissionCatalog` shared by `compileContributions` and `compileTokenCatalog`.
+
+## Deviations from Plan
+
+None - plan executed as written.
+
+## Issues Encountered
+None
+
+## Postgres verify status
+
+All Docker-host Postgres lines from this plan were **RUN** and passed on this host:
+
+- Task 1: `TestTokenTracerPostgres`, `TestBackendAdminMetadataColumn`, `TestPhase09MigrationsFreshRollback`
+- Task 2: `TestTokenTracerPostgres`, `TestAdminAuthLifecycle`, `TestAdminLogoutRevokesExpiredRefreshableToken`
+- Task 3: `TestAccountTokensSmoke`, `TestPhase10OpenAPIConformance`
+- Task 4: `TestTokenCommandsSmoke`, `TestAdminCreateCommand`
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+Ready for 16.3-02 (admin SPA API tokens card on My account). Framework half of SC-1/SC-2/SC-3/SC-5 is in place for Journal (16.3-03) and unit tests (16.3-04).
+
+---
+*Phase: 16.3-backend-admin-personal-api-tokens-with-scopes*
+*Completed: 2026-10-11*

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-02-PLAN.md

@@ -0,0 +1,245 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+plan: 02
+type: execute
+wave: 2
+depends_on: ["16.3-01"]
+files_modified:
+  - admin/src/components/account/ApiTokensPanel.vue
+  - admin/src/components/account/ApiTokenCreateDialog.vue
+  - admin/src/views/AccountView.vue
+  - admin/src/components/ui/ConfirmDialog.vue
+  - admin/tests/account/ApiTokensPanel.test.ts
+  - admin/tests/views/AccountView.test.ts
+  - modules/phrasebook/backend/lang/en/lang.yaml
+  - modules/phrasebook/backend/lang/pl/lang.yaml
+  - modules/boardwalk/dist
+  - docs/backend/users-and-permissions.md
+  - docs/backend/admin-spa.md
+autonomous: true
+requirements: [SC-3, SC-5]
+estimate:
+  tokens: 95000
+  raw_tokens: 95000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "D-16: the My account page (/account) shows an API tokens card after the profile and password form and outside it, listing, creating and revoking only the signed-in admin's own tokens; the page's footer Save never sends token data; there is no view of other users' tokens."
+    - "D-11 and UI-SPEC §3: each row shows the name (wrapped, never truncated), the mono hint g15_…last4 with the aria-label api_tokens.hint, one chip per stored scope in stored order (`*` labelled Full access, an unknown scope as a dashed mono chip with the unknown_scope_hint title), and the meta line created · last used or never used · expires, expired or no expiry (· revoked for revoked rows); rows are newest first; Revoke token shows on active and expired rows and never on revoked rows."
+    - "UI-SPEC §7: the list shows three skeleton rows with aria-busy while loading, the dashed empty block (api_tokens.empty_title and empty_body) when there are no tokens, and the api_tokens.load_failed alert block (role=alert) with the toggle hidden when the load fails; Create token is disabled only during the first load."
+    - "D-09: the Show revoked tokens checkbox reloads the list with revoked rows (muted, Revoked chip, no revoke button); its state lives only in the component."
+    - "D-08 and D-17 (dialog step 1): the create dialog has a name input (maxlength 100), the expiry segmented control 30d, 90d, 365d, never with 90d preselected and a local-date preview line, and a scope picker rendered from GET /account/tokens/scopes in server order with label, mono name, Read-only chip for GET/HEAD-only scopes and description; checking `*` unchecks and disables every other scope, shows api_tokens.scope_all_includes and sends exactly [\"*\"]; no scope is preselected; 422 messages render under the field with aria-invalid and focus moves to the first invalid control; while busy the fieldset, Discard token, close, Esc and overlay are inert and a second submit does nothing; a non-422 failure shows the create_failed toast and keeps the input."
+    - "D-16 (dialog step 2): a successful create swaps the same dialog to the show-once step: the bg-sel note api_tokens.created_notice, the full plaintext in a read-only mono input that selects on focus, Copy token with a two-second Copied state, and Done, hide token; overlay clicks never close step 2; the list reloads in the background."
+    - "UI-SPEC §6: Revoke token asks the shared ConfirmDialog (danger, api_tokens.revoke_confirm with the name, confirm label api_tokens.revoke_submit) and runs DELETE /account/tokens/{id} as the confirm action; success reloads the list and shows the revoked toast; 404 shows api_tokens.gone and reloads; other failures show api_tokens.revoke_failed and keep the row; ConfirmDialog's description wraps long names ([overflow-wrap:anywhere])."
+    - "UI-SPEC copy: every string comes from backend::lang.api_tokens.* (en and pl) or existing keys; myaccount.menu_description mentions API tokens; modules/boardwalk/dist is rebuilt and check-admin-dist.sh passes."
+    - statement: "Plaintext never retained: after Done, hide token and after an Esc-confirm close, the plaintext is absent from the DOM and from the panel and dialog state, reopening starts at step 1, and no toast text contains the token."
+      verification: backstop
+    - statement: "Copy and live-region flow: with a stubbed navigator.clipboard, a successful copy shows the copied state and announces api_tokens.copied_announce in a polite live region; a rejected writeText focuses and selects the input and shows api_tokens.copy_failed (role=alert); a manual copy event on the input counts as copied."
+      verification: backstop
+    - statement: "Close-without-copy guard: Esc or the close button on step 2 before any copy opens the danger confirm api_tokens.close_uncopied_confirm and cancel keeps the dialog on step 2; after a copy the dialog closes at once."
+      verification: backstop
+  artifacts:
+    - path: "admin/src/components/account/ApiTokensPanel.vue"
+      provides: "the API tokens card: list, states, toggle, revoke"
+      contains: "data-api-tokens"
+    - path: "admin/src/components/account/ApiTokenCreateDialog.vue"
+      provides: "two-step create dialog with show-once plaintext"
+      contains: "data-token-plaintext"
+    - path: "admin/tests/account/ApiTokensPanel.test.ts"
+      provides: "panel and dialog smoke tests (plan 04 completes coverage)"
+      contains: "ApiTokensPanel"
+  key_links:
+    - from: "admin/src/views/AccountView.vue"
+      to: "admin/src/components/account/ApiTokensPanel.vue"
+      via: "<ApiTokensPanel :confirm=\"confirm\" /> after the form, sharing the view's useConfirm() and its single ConfirmDialog"
+      pattern: "ApiTokensPanel"
+    - from: "admin/src/components/account/ApiTokensPanel.vue"
+      to: "GET/DELETE {api}/account/tokens"
+      via: "typed openapi-fetch calls from admin/src/api/client.ts using the plan 01 schema.d.ts"
+      pattern: "/account/tokens"
+    - from: "admin/src/components/account/ApiTokenCreateDialog.vue"
+      to: "GET /account/tokens/scopes and POST /account/tokens"
+      via: "typed api calls; the 201 data.token lives only in the dialog's local state"
+      pattern: "/account/tokens/scopes"
+  prohibitions:
+    - statement: "The plaintext is never written to localStorage, sessionStorage, the URL, router state, the console, a toast or the list rows."
+      status: unresolved
+      verification: judgment
+    - statement: "Token names, scope labels and descriptions render through text interpolation only; no v-html."
+      status: unresolved
+      verification: judgment
+    - statement: "No new npm dependency and no new design token, colour, font, radius or shadow (UI-SPEC)."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): backend users create personal API tokens with scopes picked at creation time, so an agent or integration calls the admin and plugin APIs as that backend user with no more access than the token's scope and the user's own permissions allow.
+
+This plan's slice (user checkpoint, plan 2 of 4): the admin SPA "API tokens" card on My account per 16.3-UI-SPEC.md, against the account token API and the regenerated TS types plan 01 committed, with the remaining `api_tokens.*` copy, the committed dist and the My account docs.
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". The UI-SPEC `## UI Considerations` table is lifted into must_haves: covered rows as truths, the three 🧪 backstop rows as `verification: backstop` truths, dismissed rows omitted. No unresolved rows exist.
+
+## Decisions taken in this plan
+
+- Component split (UI-SPEC planner's choice): `ApiTokensPanel.vue` (card, toolbar, list, revoke) and `ApiTokenCreateDialog.vue` (both steps, owns the plaintext). The panel receives the view's `useConfirm()` instance as a `confirm` prop; the dialog uses the same instance for the close-without-copy confirm (ConfirmDialog renders at z-[90], above the dialog's z-50).
+- The hint is rendered as `g15_…` plus the API's `hint` field (last four characters, plan 01 contract). Labels and the known flag come from each list row's scope entries (server-translated), so no client-side scope catalog is needed.
+- Dates reuse the list datetime cell's formatting (`CellValue.vue` / `admin/src/app/dateFormat.ts`): created, expires and expired as YYYY-MM-DD, last used and revoked as YYYY-MM-DD HH:mm, local time, tabular-nums. No new date format.
+- `expired` from the API decides the Expired chip (server clock), so client clock skew cannot mislabel a row.
+- Test location: `admin/tests/account/` (mirrors `src/components/account/`; `tests/components/` does not exist); 16.3-VALIDATION.md is updated to this path.
+- OpenAPI types were regenerated in plan 01 (the contract inventory test reads the committed document); this plan only re-checks them with `check-admin-openapi.sh --check`.
+
+## Artifacts this phase produces (this plan)
+
+- `admin/src/components/account/ApiTokensPanel.vue` (data attributes `data-api-tokens`, `data-token-list`, `data-token-row`, `data-token-scopes`, `data-tokens-empty`, `data-tokens-error`, `data-show-revoked`, `data-action="create-token"`, `data-action="revoke-token"`).
+- `admin/src/components/account/ApiTokenCreateDialog.vue` (`data-token-dialog`, `data-scope-picker`, `data-scope`, `data-token-notice`, `data-token-plaintext`, `data-action` values `create-token-submit`, `create-token-cancel`, `copy-token`, `hide-token`).
+- `admin/tests/account/ApiTokensPanel.test.ts` (smoke: `tracer: list, create, show once, hide`; list states; dialog rules).
+- SPA phrase keys `backend::lang.api_tokens.*` from the UI-SPEC Copywriting Contract not added by plan 01 (section, section_comment, create, create_submit, creating, done, empty_title, empty_body, load_failed, scopes_failed, create_failed, revoke_failed, gone, copy_failed, revoke, revoke_named, revoke_confirm, revoke_submit, revoked, close_uncopied_confirm, close_uncopied_submit, create_title, create_description, name, name_placeholder, name_comment, expires, expires_30, expires_90, expires_365, expires_never, expires_on, expires_never_note, scopes, read_only, scope_all_includes, created_title, created_notice, token_label, copy, copied, copied_announce, create_cancel, show_revoked, created_at, last_used, never_used, expires_at, expired_at, no_expiry, revoked_at, state_expired, state_revoked, unknown_scope, unknown_scope_hint, hint) and the changed `myaccount.menu_description`, en and pl.
+- One-class change to `ConfirmDialog.vue` (`[overflow-wrap:anywhere]` on the description).
+- Rebuilt `modules/boardwalk/dist`.
+- My account docs: the API tokens panel in docs/backend/users-and-permissions.md and docs/backend/admin-spa.md.
+
+<objective>
+Ship the API tokens card on My account (D-16, D-17, D-08, D-09, D-11) exactly as 16.3-UI-SPEC.md describes: list with all states, two-step create with show-once plaintext and copy, revoke through the shared confirm, and the copy in both languages.
+
+Purpose: SC-3, a backend user manages their own tokens in the admin SPA and sees the plaintext once.
+Output: two components, the AccountView wiring, phrase keys, smoke tests, rebuilt dist, docs.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-UI-SPEC.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-CONTEXT.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-01-SUMMARY.md
+
+Plan 01 contract (Interfaces section of 16.3-01-PLAN.md): `GET /account/tokens[?revoked=1]` → `AdminAPIToken[]`; `POST /account/tokens` `{name, expires, scopes}` → 201 `AdminAPITokenCreated` (row plus `token`); `DELETE /account/tokens/{id}` → row, 404 not_found; `GET /account/tokens/scopes` → `AdminAPITokenScope[]` (`name`, `label`, `description`, `read_only`, `known`). 422 details keyed `name`, `expires`, `scopes` with server messages. Commits: no co-author tags; stage by explicit path; rebuild and commit `modules/boardwalk/dist` with each SPA change (`npm --prefix admin run build`).
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: on /account an admin creates a scoped token in the dialog, sees the plaintext once, hides it, and the new row is in the list</name>
+  <files>admin/src/components/account/ApiTokensPanel.vue, admin/src/components/account/ApiTokenCreateDialog.vue, admin/src/views/AccountView.vue, admin/tests/account/ApiTokensPanel.test.ts, admin/tests/views/AccountView.test.ts, modules/phrasebook/backend/lang/en/lang.yaml, modules/phrasebook/backend/lang/pl/lang.yaml, modules/boardwalk/dist</files>
+  <read_first>16.3-UI-SPEC.md (Component Contracts 1-5, Copywriting Contract), admin/src/views/AccountView.vue (imports :2-14, confirm :92, card markup :247-262, form end and ConfirmDialog :395-420), admin/src/components/relation/RelationPickerModal.vue (Dialog shell :3-11 and :355-380), admin/src/components/ui/Button.vue, admin/src/components/ui/confirm.ts, admin/src/components/form/control.ts, admin/src/components/form/formState.ts (fieldErrors :267, focusField :288), admin/src/state/useToasts.ts, admin/src/app/i18n.ts, admin/src/api/client.ts, admin/src/api/schema.d.ts (the /account/tokens operations from plan 01), admin/tests/views/AccountView.test.ts, admin/tests/helpers.ts (mountApp, requestsTo), admin/tests/relation/RelationPickerModal.test.ts, modules/phrasebook/backend/lang/en/lang.yaml and pl/lang.yaml (myaccount and the plan 01 api_tokens block)</read_first>
+  <action>Build the thinnest complete path through the SPA: AccountView → panel → API list → dialog → POST → show-once step → hide → list.
+
+Per D-16 and UI-SPEC §1: render `<ApiTokensPanel :confirm="confirm" />` in AccountView after the `</form>` and before the existing ConfirmDialog, inside the `gap-5` section, never inside the form. The panel card uses `flex flex-col gap-4 rounded-card border border-border bg-surface p-7 shadow-card` with `data-api-tokens`, the header from UI-SPEC §2 (heading, comment, outline sm Create token button with Plus), and on mount loads `GET /account/tokens` through the typed `api` client; populated rows follow UI-SPEC §3 for name, hint, known-scope chips and the meta line (states and revoke come in Task 2).
+
+Per D-16, D-17, D-08 and UI-SPEC §4-5 (minimal for the tracer): `ApiTokenCreateDialog` uses the RelationPickerModal shell verbatim; step 1 has the name input, the expiry RadioGroup with 90d preselected, and the scope checkboxes from `GET /account/tokens/scopes` (rendered in server order); submit sends `POST /account/tokens` with name, expires and the checked scope names; a 201 switches to step 2 with the notice, the read-only plaintext input and Done, hide token; Done clears the plaintext from local state, closes, and the panel reloads the list. The plaintext lives only in a dialog-local ref; it is cleared on close and in onBeforeUnmount.
+
+Phrase keys: add every SPA key listed in this plan's Artifacts to the `api_tokens:` block in en and pl with the UI-SPEC wording, and change `myaccount.menu_description`. All strings go through `t()`; no literal UI text.
+
+Tests: update AccountView.test.ts so its routes answer `GET {API}/account/tokens` with an empty list (the panel now loads on mount). Create admin/tests/account/ApiTokensPanel.test.ts with the case "tracer: list, create, show once, hide": mount /account with one existing token and two scopes, open the dialog, type a name, check a scope, submit, assert the POST body {name, expires: "90d", scopes: [checked]}, assert the plaintext input shows the returned token, click Done, assert the token string is absent from the whole document and that the list was requested again.
+
+Rebuild `modules/boardwalk/dist` with `npm --prefix admin run build` and commit it with the code.</action>
+  <verify>
+    <automated>npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test -- tests/account/ApiTokensPanel.test.ts tests/views/AccountView.test.ts &amp;&amp; bash scripts/check-admin-openapi.sh --check &amp;&amp; bash scripts/check-admin-dist.sh</automated>
+    <fails_when>Non-zero exit: vue-tsc reports a type error against the plan 01 schema, a vitest case fails (the tracer or an AccountView case broken by the panel's mount request), the committed OpenAPI or TS types drifted, or modules/boardwalk/dist differs from a fresh build ("check-admin-dist: modules/boardwalk/dist is stale").</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "ApiTokensPanel" admin/src/views/AccountView.vue` prints the import and one usage, and the usage line number is greater than the line of `</form>`.
+    - `grep -n "tracer: list, create, show once, hide" admin/tests/account/ApiTokensPanel.test.ts` prints one line.
+    - `grep -c "api_tokens:" modules/phrasebook/backend/lang/en/lang.yaml modules/phrasebook/backend/lang/pl/lang.yaml` reports 1 per file and `grep -n "created_notice" modules/phrasebook/backend/lang/pl/lang.yaml` prints one line.
+    - `grep -rn "localStorage\|sessionStorage\|console\.\|v-html" admin/src/components/account/` prints nothing.
+  </acceptance_criteria>
+  <done>An admin can open My account, create a scoped token, read and hide the plaintext once, and see the new token in the list, with dist rebuilt.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: List states, show-revoked toggle, state and unknown-scope chips, and revoke through the shared confirm</name>
+  <files>admin/src/components/account/ApiTokensPanel.vue, admin/src/components/ui/ConfirmDialog.vue, admin/tests/account/ApiTokensPanel.test.ts, modules/boardwalk/dist</files>
+  <read_first>16.3-UI-SPEC.md (Component Contracts 2, 3, 6, 7; UI Considerations rows for the token list, toggle and revoke), admin/src/components/account/ApiTokensPanel.vue (Task 1), admin/src/components/ui/ConfirmDialog.vue (AlertDialogDescription :63), admin/src/components/ui/confirm.ts (ask with a run action), admin/src/components/list/CellValue.vue (datetime cell formatting), admin/src/app/dateFormat.ts, admin/src/state/useToasts.ts, admin/src/views/AccountView.vue (shared confirm)</read_first>
+  <action>Complete the list side per D-09, D-11 and UI-SPEC §2, §3, §6, §7.
+
+States: first load and toggle reloads show three skeleton rows (h-3 w-40 above h-3 w-64, rounded-[6px] bg-skel, aria-hidden) with aria-busy="true" on the container; Create token is disabled only during the first load. A failed load replaces the list with the alert block (`data-tokens-error`, role=alert, CircleAlert 16px, api_tokens.load_failed) and hides the toggle; Create token stays enabled. No rows (also with the toggle on) shows the dashed empty block (`data-tokens-empty`, KeyRound 20px in a 40px bg-subtle circle, empty_title, empty_body).
+
+Toggle (D-09): after a successful load, the `data-show-revoked` native checkbox with api_tokens.show_revoked reloads with `revoked=1`; its state is component-only.
+
+Rows (D-11): chips per UI-SPEC §3 table: known scope (`bg-subtle text-text`, label, title = mono name, `*` shows api_tokens.scope_all), unknown scope (dashed mono, api_tokens.unknown_scope with the name, title unknown_scope_hint), Expired chip (`bg-danger-soft text-danger`) when `expired`, Revoked chip when `revoked_at` is set; revoked rows render name and meta in text-muted with no line-through. Meta line joined with " · ": created_at, last_used or never_used, expires_at / expired_at / no_expiry, and revoked_at for revoked rows, formatted as this plan's Decisions say. Revoke token (`variant="danger" size="sm"`, Ban icon, aria-label api_tokens.revoke_named) on active and expired rows only; on max-sm it sits under the meta line.
+
+Revoke (UI-SPEC §6): `confirm.ask({message: t(revoke_confirm, {name}), confirmLabel: t(revoke_submit), danger: true}, run)` where run sends `DELETE /account/tokens/{id}`; success → list reload, success toast api_tokens.revoked, focus to Create token; 404 → danger toast api_tokens.gone and reload; other failure → danger toast api_tokens.revoke_failed, row unchanged.
+
+ConfirmDialog: add `[overflow-wrap:anywhere]` to the AlertDialogDescription class (UI-SPEC long-text row); nothing else changes in the shared component.
+
+Smoke cases in ApiTokensPanel.test.ts: "list states" (skeleton then empty block; failed load shows the alert and hides the toggle) and "revoke" (confirm runs DELETE, success toast; a 404 shows api_tokens.gone and reloads; the toggle requests revoked=1 and a revoked row has no revoke button). Rebuild and commit dist.</action>
+  <verify>
+    <automated>npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test -- tests/account/ApiTokensPanel.test.ts tests/views/AccountView.test.ts tests/ui/ui.test.ts &amp;&amp; bash scripts/check-admin-dist.sh</automated>
+    <fails_when>Non-zero exit: a type error, a failing panel, AccountView or shared-UI case (for example the ConfirmDialog class change broke a UI test, or revoke did not use the shared confirm), or dist is stale.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "overflow-wrap:anywhere" admin/src/components/ui/ConfirmDialog.vue` prints one line.
+    - `grep -c "data-tokens-empty\|data-tokens-error\|data-show-revoked" admin/src/components/account/ApiTokensPanel.vue` reports at least 3.
+    - `grep -n "list states\|revoke" admin/tests/account/ApiTokensPanel.test.ts` prints the two new describe or it lines.
+  </acceptance_criteria>
+  <done>The token list handles loading, empty, failure, populated and mixed states, revoked rows on demand, and revoke with the shared confirm and correct toasts.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Dialog rules: scope picker states and the `*` rule, expiry preview, 422 and busy handling, copy and clipboard fallback, close guards; My account docs</name>
+  <files>admin/src/components/account/ApiTokenCreateDialog.vue, admin/tests/account/ApiTokensPanel.test.ts, modules/boardwalk/dist, docs/backend/users-and-permissions.md, docs/backend/admin-spa.md</files>
+  <read_first>16.3-UI-SPEC.md (Component Contracts 4 and 5, UI Considerations rows for the scope picker, create form, create submit, show-once step and clipboard), admin/src/components/account/ApiTokenCreateDialog.vue (Task 1), admin/src/components/form/fields/PermissionEditorField.vue (segmented control classes), admin/src/components/form/fields/CheckboxField.vue (checkbox class), admin/src/views/AccountView.vue (422 error markup and focusField use), docs/backend/users-and-permissions.md (My account section and the API tokens section plan 01 wrote), docs/backend/admin-spa.md (:36)</read_first>
+  <action>Complete the dialog per D-08, D-16, D-17 and UI-SPEC §4-5.
+
+Step 1: scope picker skeleton (three 56px rows with a 20px square and an h-3 w-40 bar) while the scopes request is pending, submit disabled; a failed request or an empty answer shows the alert block api_tokens.scopes_failed with submit disabled. Rows use the UI-SPEC row classes, label (14/600), mono name, the Read-only chip when `read_only`, and the description. Checking `*` unchecks and disables every other row (`cursor-not-allowed opacity-60`) and shows the Info note api_tokens.scope_all_includes; unchecking `*` re-enables rows without restoring earlier picks; only [`*`] is sent then. Expiry preview under the segmented control: api_tokens.expires_on with today plus 30, 90 or 365 days as local YYYY-MM-DD, or api_tokens.expires_never_note. 422: map `error.details` through `fieldErrors`, render each field's messages like AccountView (CircleAlert 14px, aria-describedby, aria-invalid, `border-danger` on the scope group), and focus the name input, else the first scope checkbox, else the first segment. Busy: fieldset disabled, primary label api_tokens.creating with a spinning LoaderCircle, Discard token and close disabled, Esc and overlay ignored, repeated submit ignored. Non-422 failure: danger toast api_tokens.create_failed, input kept. Closing step 1 any way discards input without a confirm. Focus: name input on open, the card's Create token button on close.
+
+Step 2: overlay pointer-down and interact-outside are prevented; Copy token calls `navigator.clipboard.writeText` and on success shows Check plus api_tokens.copied for two seconds, announces api_tokens.copied_announce in an sr-only aria-live="polite" region and marks the token copied; a missing or rejecting Clipboard API focuses the input with its value selected and shows api_tokens.copy_failed (13px text-danger, role=alert); a `copy` event on the input also marks it copied. Esc and the close button close at once when copied, otherwise ask the shared confirm (`danger`, api_tokens.close_uncopied_confirm, confirm label close_uncopied_submit) and close only on confirm. Focus goes to Copy token on entering step 2. Reopening always starts at step 1 with a cleared plaintext.
+
+Smoke cases: "dialog rules": `*` disables other rows and sends [`*`]; a 422 on scopes renders the server message and focuses the first scope; a stubbed clipboard success shows Copied and a rejection shows copy_failed; Esc before copying opens the confirm and cancel keeps step 2. Plan 04 adds the full matrix.
+
+Docs (D-20, SPA half): in docs/backend/users-and-permissions.md "My account" describe the API tokens card (own tokens only, create with name, expiry and scopes, show once and copy, revoke, show revoked) and link to the API tokens section; in docs/backend/admin-spa.md extend the My account sentence. Rebuild and commit dist.</action>
+  <verify>
+    <automated>npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; go test -count=1 ./cmd/summer -run TestDocsTree</automated>
+    <fails_when>Non-zero exit: a type error, any vitest case in the full admin suite fails (including the dialog rules smoke), dist is stale, or TestDocsTree reports an unknown identifier, broken link or anchor in the edited docs pages.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "dialog rules" admin/tests/account/ApiTokensPanel.test.ts` prints one line.
+    - `grep -c "aria-live=\"polite\"\|pointer-down-outside\|scope_all_includes\|copy_failed" admin/src/components/account/ApiTokenCreateDialog.vue` reports at least 4.
+    - `grep -n "API tokens" docs/backend/users-and-permissions.md docs/backend/admin-spa.md` prints at least one line per file.
+  </acceptance_criteria>
+  <done>The create dialog follows every UI-SPEC rule for scopes, expiry, errors, busy, copy and closing, the full admin suite passes, dist is current and the My account docs describe the panel.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| server → SPA | the 201 create response carries the plaintext once |
+| SPA → browser storage, clipboard | the plaintext must stay in component memory; the clipboard is user-initiated |
+| server data → DOM | token names and plugin scope labels are rendered as text |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.3-14 | Information Disclosure | ApiTokenCreateDialog plaintext | high | mitigate | Plaintext only in a dialog-local ref, cleared on Done, on confirmed close and in onBeforeUnmount; never in toasts, storage, URL, router state, console or list rows; Task 1 acceptance greps the component folder for storage, console and v-html; plan 04 backstop tests assert DOM and state are clean |
+| T-16.3-15 | Information Disclosure | show-once step | low | accept | The full token is visible once by design (UI-SPEC §5) so the user can verify it; overlay clicks cannot close the step and closing before copying asks first |
+| T-16.3-16 | Tampering (XSS) | token names, scope labels and descriptions | medium | mitigate | Rendered with Vue text interpolation only (no v-html); plugin labels arrive as server-translated plain strings |
+| T-16.3-17 | Elevation of Privilege | scope picker | low | mitigate | The SPA renders only what GET /account/tokens/scopes returns; the server re-validates names and the overlap rule on create (plan 01, D-17) |
+| T-16.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package is installed; reka-ui, @lucide/vue and the build tools come from the committed admin lockfile |
+</threat_model>
+
+<verification>
+- Task 1: typecheck, tracer and AccountView tests, OpenAPI and dist drift gates pass.
+- Task 2: panel, AccountView and shared UI tests and the dist gate pass.
+- Task 3: full admin vitest suite, dist gate and TestDocsTree pass.
+</verification>
+
+<success_criteria>
+- SC-3 (SPA half): a backend user creates, lists and revokes their own tokens on /account, and the plaintext is shown once.
+- Every UI-SPEC state is implemented; the three backstops have smoke coverage here and full tests in plan 04.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-02-SUMMARY.md` when done, with the commit list, the component props and emitted events, and the smoke test names.
+</output>

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-02-SUMMARY.md

@@ -0,0 +1,190 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+plan: 02
+subsystem: ui
+tags: [admin-spa, api-tokens, account, vue, reka-ui, phrasebook, show-once]
+
+requires:
+  - phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+    provides: account token API, OpenAPI/TS types, plan 01 api_tokens phrase seeds
+provides:
+  - "ApiTokensPanel on /account after the profile form"
+  - "ApiTokenCreateDialog two-step create with show-once plaintext"
+  - "List states, show-revoked toggle, revoke via shared ConfirmDialog"
+  - "SPA api_tokens.* phrase keys (en/pl) and myaccount.menu_description"
+  - "Rebuilt modules/boardwalk/dist and My account docs"
+affects: [16.3-03, 16.3-04]
+
+actuals:
+  tokens: 17683
+  tasks: 3
+  commits: 4
+plan_head_before: 93a3112fb7a9c9d181607b473fde1f051eea778b
+plan_head_after: e17207a
+
+tech-stack:
+  added: []
+  patterns:
+    - "Account panel shares AccountView useConfirm(); ConfirmDialog stays at z-[90]"
+    - "Plaintext only in dialog-local ref; cleared on Done, confirmed close, onBeforeUnmount"
+
+key-files:
+  created:
+    - admin/src/components/account/ApiTokensPanel.vue
+    - admin/src/components/account/ApiTokenCreateDialog.vue
+    - admin/tests/account/ApiTokensPanel.test.ts
+  modified:
+    - admin/src/views/AccountView.vue
+    - admin/src/components/ui/ConfirmDialog.vue
+    - admin/src/api/types.ts
+    - admin/tests/views/AccountView.test.ts
+    - admin/tests/fixtures/lang.json
+    - modules/phrasebook/backend/lang/en/lang.yaml
+    - modules/phrasebook/backend/lang/pl/lang.yaml
+    - modules/boardwalk/dist
+    - docs/backend/users-and-permissions.md
+    - docs/backend/admin-spa.md
+
+key-decisions:
+  - "Panel/dialog split per plan: ApiTokensPanel owns list/revoke; ApiTokenCreateDialog owns plaintext"
+  - "Hint renders as g15_… plus API hint (last4); scope chips use server label/known"
+  - "expired from API drives Expired chip (server clock)"
+
+patterns-established:
+  - "My account cards outside the profile form share one ConfirmDialog"
+  - "Show-once secrets stay in dialog state only — never toasts, storage, URL or list rows"
+
+requirements-completed: [SC-3, SC-5]
+
+coverage:
+  - id: D1
+    description: "My account API tokens card lists, creates (show-once) and hides plaintext"
+    requirement: SC-3
+    verification:
+      - kind: unit
+        ref: admin/tests/account/ApiTokensPanel.test.ts#tracer: list, create, show once, hide
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "List loading/empty/error, show-revoked toggle, revoke via ConfirmDialog"
+    requirement: SC-3
+    verification:
+      - kind: unit
+        ref: admin/tests/account/ApiTokensPanel.test.ts#list states
+        status: pass
+      - kind: unit
+        ref: admin/tests/account/ApiTokensPanel.test.ts#revoke
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Create dialog scope *, 422 focus, clipboard copy/fallback, close-without-copy"
+    requirement: SC-3
+    verification:
+      - kind: unit
+        ref: admin/tests/account/ApiTokensPanel.test.ts#dialog rules
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "My account docs describe the API tokens SPA card"
+    requirement: SC-5
+    verification:
+      - kind: other
+        ref: go test -count=1 ./cmd/summer -run TestDocsTree
+        status: pass
+    human_judgment: false
+
+duration: 9min
+completed: 2026-10-11
+status: complete
+---
+
+# Phase 16.3 Plan 02: Admin SPA API tokens card Summary
+
+**My account API tokens card with list states, two-step show-once create/copy, revoke via shared ConfirmDialog, phrase keys, dist and docs.**
+
+## Performance
+
+- **Duration:** 9 min
+- **Started:** 2026-10-10T23:57:24Z
+- **Completed:** 2026-10-11T00:06:49Z
+- **Tasks:** 3
+- **Files modified:** 17
+
+## Accomplishments
+- `ApiTokensPanel` after the profile form on `/account`; Create token, list, show-revoked, revoke
+- `ApiTokenCreateDialog`: name/expiry/scopes → show-once plaintext, copy with clipboard fallback, close-without-copy confirm
+- Full `backend::lang.api_tokens.*` en/pl copy, Polish lang fixture, rebuilt `modules/boardwalk/dist`, My account docs
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Tracer — list, create, show once, hide** - `5a6a190` (feat)
+2. **Task 2: List states, show-revoked, revoke, ConfirmDialog wrap** - `1c930b6` (feat)
+3. **Task 3: Dialog rules smoke tests and My account docs** - `e17207a` (feat)
+
+**Plan metadata:** (this commit)
+
+## Component contracts
+
+| Component | Props | Emits |
+|-----------|-------|-------|
+| `ApiTokensPanel` | `confirm: ReturnType<typeof useConfirm>` | — |
+| `ApiTokenCreateDialog` | `open`, `confirm` | `update:open`, `created`, `closed` |
+
+## Smoke test names
+
+- `tracer: list, create, show once, hide`
+- `list states` (skeleton→empty; load failure)
+- `revoke` (DELETE confirm; 404 gone; show-revoked)
+- `dialog rules` (`*` posts `["*"]`; 422 scopes focus; clipboard; close-without-copy)
+
+## Files Created/Modified
+- `admin/src/components/account/ApiTokensPanel.vue` — card, list states, revoke
+- `admin/src/components/account/ApiTokenCreateDialog.vue` — two-step create dialog
+- `admin/src/views/AccountView.vue` — panel after `</form>`, shared confirm
+- `admin/src/components/ui/ConfirmDialog.vue` — `[overflow-wrap:anywhere]` on description
+- `admin/tests/account/ApiTokensPanel.test.ts` — tracer, list, revoke, dialog rules
+- `modules/phrasebook/backend/lang/{en,pl}/lang.yaml` — SPA api_tokens keys
+- `docs/backend/users-and-permissions.md`, `docs/backend/admin-spa.md` — My account tokens card
+
+## Decisions Made
+- Followed plan/UI-SPEC component split and date formatting (CellValue shapes).
+- `expired` from the API drives the Expired chip; client clock is not used for that label.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Polish lang fixture for new phrase keys**
+- **Found during:** Task 1 (AccountView / panel tests use `langFixture` Polish bundle)
+- **Issue:** Plan listed en/pl YAML only; without `admin/tests/fixtures/lang.json` keys, SPA strings fall back to key paths and assertions on Polish copy fail.
+- **Fix:** Injected all `backend::lang.api_tokens.*` Polish strings and updated `myaccount.menu_description` in the fixture.
+- **Files modified:** `admin/tests/fixtures/lang.json`
+- **Verification:** AccountView and ApiTokensPanel tests pass with Polish copy
+- **Committed in:** `5a6a190` (Task 1)
+
+---
+
+**Total deviations:** 1 auto-fixed (1 blocking)
+**Impact on plan:** Required for green admin tests; no scope creep.
+
+## Issues Encountered
+None
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+SPA half of SC-3 is in place. Ready for 16.3-03 (Journal scopes + ResolveBackend writes) and 16.3-04 (full unit/backstop matrix).
+
+## Self-Check: PASSED
+
+- Key files exist on disk
+- Commits grepped for 16.3-02: 3 task commits
+- Task acceptance greps and plan verification commands re-run green (typecheck, full admin vitest 1228, check-admin-dist, TestDocsTree)
+
+---
+*Phase: 16.3-backend-admin-personal-api-tokens-with-scopes*
+*Completed: 2026-10-11*

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-03-PLAN.md

@@ -0,0 +1,286 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+plan: 03
+type: execute
+wave: 3
+depends_on: ["16.3-01", "16.3-02"]
+files_modified:
+  - ../sm-journal-plugin/token_scopes.go
+  - ../sm-journal-plugin/lang/en/lang.yaml
+  - ../sm-journal-plugin/lang/pl/lang.yaml
+  - ../sm-journal-plugin/controllers/api/auth.go
+  - ../sm-journal-plugin/controllers/api/auth_test.go
+  - ../sm-journal-plugin/journal_api_token_smoke_test.go
+  - ../sm-journal-plugin/README.md
+  - ../sm-journal-plugin/go.mod
+  - modules/cabana/example_tokens_test.go
+  - docs/services/authentication.md
+  - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+autonomous: false
+requirements: [SC-2, SC-4, SC-5]
+estimate:
+  tokens: 75000
+  raw_tokens: 75000
+  tasks: 4
+  confidence: low
+must_haves:
+  truths:
+    - "D-04 and D-01 (Journal): the Journal plugin implements pact.HasTokenScopes with `journal` (golem15.journal.*, GET, HEAD, POST, PUT, PATCH, DELETE) and `journal:read` (golem15.journal.*, GET, HEAD), labels and descriptions as golem15.journal::lang.scopes.* phrase keys present in lang/en and lang/pl; cabana boot accepts them."
+    - "SC-4 and D-15: POST, PUT and DELETE /_journal/api/v1/posts, the featured-image routes and POST /_journal/api/v1/media/upload accept a Bearer g15_ token whose scope covers golem15.journal.* (journal or `*`), running as the token's owner with the owner's Journal permissions; the backend JWT keeps working exactly as before."
+    - "D-15 byte-identical bodies: a missing, invalid, expired or revoked token answers 401 {\"error\":\"Authentication required\"}; a journal:read token on a write route and a token whose scopes do not cover golem15.journal.* answer 403 {\"error\":\"Insufficient permissions\"}; every other status and body is unchanged."
+    - "D-15 optional auth: GET /_journal/api/v1/posts and /posts/{slug} with a valid journal or journal:read token unlock drafts exactly where the owner may see them; a token that fails or does not cover golem15.journal.* is treated as anonymous (no 401 on public reads)."
+    - "RESEARCH Pitfall 3: the Journal routes resolve their principal only through cabana.ResolveBackend with cover golem15.journal.*, so a token with an unrelated scope never reaches the ownership branches (Post.CanEdit, canViewDraft, featured images)."
+    - "RESEARCH Pitfall 4 (behaviour change, documented): the Journal API now honors code-declared role grants (pact.Permission.Roles) because it uses the admin guard's compiled registry instead of a nil one."
+    - "RESEARCH open question 2 resolved against the frozen PHP tree: PostApiController::uploadFeaturedImage and deleteFeaturedImage check only $post->canEdit($user), like update and destroy; the Go featured-image handlers keep that parity and gain no access_posts check; the token side is closed by the resolver's cover."
+    - "D-20 (Journal and remaining docs): the Journal README documents the two scopes, token auth on writes and optional-auth reads, the reversal of Phase 15 D-15, the code-declared-role change and that the journal-api throttle still keys by client IP; docs/services/authentication.md shows ResolveBackend from a compiled example (ExampleResolveBackend) with neutral names; TestDocsTree and summer docs:build --check pass."
+    - "Release (RESEARCH open question 5, user checkpoint): after a human approves at a blocking checkpoint, an annotated summercms tag (the next free v0.1.x after v0.1.20) containing plans 01 and 02 is on origin; sm-journal-plugin main requires that tag and is pushed; the sm-grzybyfunkcjonalne-app journal gitlink points at the pushed Journal head and is pushed; no pushed tag is moved."
+  artifacts:
+    - path: "../sm-journal-plugin/token_scopes.go"
+      provides: "journal and journal:read scopes"
+      contains: "TokenScopes"
+    - path: "../sm-journal-plugin/controllers/api/auth.go"
+      provides: "requireBackendPrincipal and optionalBackendPrincipal on cabana.ResolveBackend with cover golem15.journal.*"
+      contains: "cabana.ResolveBackend"
+    - path: "../sm-journal-plugin/journal_api_token_smoke_test.go"
+      provides: "Postgres tracer and expansion smoke for token writes"
+      contains: "TestJournalTokenTracer"
+    - path: "modules/cabana/example_tokens_test.go"
+      provides: "compiled ResolveBackend example for the docs"
+      contains: "ExampleResolveBackend"
+  key_links:
+    - from: "../sm-journal-plugin/controllers/api/auth.go requireBackendPrincipal"
+      to: "summercms modules/cabana/token_guard.go ResolveBackend"
+      via: "per-request lookup of the resolver cabana.Activate published (Journal routes register before Activate)"
+      pattern: "ResolveBackend"
+    - from: "../sm-journal-plugin/token_scopes.go"
+      to: "cabana compileTokenScopes at boot"
+      via: "pact.HasTokenScopes on the Journal plugin"
+      pattern: "HasTokenScopes"
+    - from: "summercms annotated tag"
+      to: "../sm-journal-plugin/go.mod require"
+      via: "go mod edit -require after the human-approved push"
+      pattern: "git.golem15.com/golem15/summercms v0.1."
+  prohibitions:
+    - statement: "Journal error bodies and status codes stay byte-identical to the PHP contract; response shapes are not improved during the port (CLAUDE.md rule 6)."
+      status: unresolved
+      verification: judgment
+    - statement: "The Journal API never authenticates from the admin cookie; its write routes stay Bearer-only."
+      status: unresolved
+      verification: judgment
+    - statement: "No tag, branch or gitlink is pushed before the human approves at the release checkpoint; no pushed tag is moved or deleted; no credential is requested, printed or committed."
+      status: unresolved
+      verification: judgment
+    - statement: "The PHP Journal and Apparatus originals are not changed; Apparatus token rows are not migrated."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): backend users create personal API tokens with scopes picked at creation time, so an agent or integration calls the admin and plugin APIs as that backend user with no more access than the token's scope and the user's own permissions allow. Reverses Phase 15 D-15.
+
+This plan's slice (user checkpoint, plan 3 of 4): the Journal plugin registers `journal` and `journal:read` and accepts tokens through the published cabana resolver (D-15), the remaining docs (Journal README, a compiled ResolveBackend example), and the release: summercms tag after v0.1.20, the Journal `go.mod` bump and the host gitlink bump, behind a blocking human checkpoint.
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
+
+## Decisions taken in this plan
+
+- **Featured images (RESEARCH open question 2), checked while planning:** the frozen PHP tree (`/media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/controllers/api/PostApiController.php` uploadFeaturedImage :416-430 and deleteFeaturedImage :459-470) authorizes only through `$post->canEdit($user)`, exactly like update and destroy, under the `token.auth` group in routes.php. The Go handlers already match; this plan adds no `access_posts` check there (API parity is the acceptance test). A `journal:read` token is refused by the method filter, and a token without Journal coverage by the resolver's cover check.
+- **Resolver errors to Journal bodies:** `cabana.ErrTokenScope` → 403 `errInsufficientPerms`; anything else → 401 `errAuthenticationRequired`; on optional-auth reads any error means anonymous.
+- **Cover:** every Journal call passes the cover `golem15.journal.*` (RESEARCH Pattern 3).
+- **Throttle (RESEARCH Pitfall 11):** the `journal-api` bucket still keys by client IP because it runs before the handler resolves the principal; documented, not changed.
+- **Hosts:** sm-grzybyfunkcjonalne-app is the host that ships the Journal plugin to UAT and gets the journal gitlink bump (16.2 pattern; its framework require is nominal because it builds from `../summercms.go` through a replace). sm-summercmsio-app also carries a Journal gitlink (f5cd5b1, pre-16.2); bumping it would also pull in Phase 16.2, so the release checkpoint asks whether to bump it too (default: no). A UAT redeploy is not part of this plan; the release sheet names it as a follow-up (DEPLOY.md; `migrate` creates backend_api_tokens).
+- **Tag:** the highest `v0.1.*` plus one (v0.1.21 unless someone tagged first), annotated, created only after the checkpoint.
+
+## Artifacts this phase produces (this plan)
+
+- `../sm-journal-plugin/token_scopes.go`: `(*Plugin).TokenScopes` with scopes `journal` and `journal:read`, compile-time assertion for `pact.HasTokenScopes`.
+- Phrase keys `golem15.journal::lang.scopes.{journal, journal_description, journal_read, journal_read_description}` (en, pl).
+- `../sm-journal-plugin/controllers/api/auth.go`: `requireBackendPrincipal` and `optionalBackendPrincipal` on `cabana.ResolveBackend`; the plugin's own guard constructor and its blacklist wiring removed; new helper `resolveError` mapping resolver errors to the PHP bodies.
+- Tests: `TestResolveErrorMapping` (controllers/api, Docker-free); `TestJournalTokenTracer`, `TestJournalTokenExpansion` (root, Postgres).
+- `modules/cabana/example_tokens_test.go`: `ExampleResolveBackend` (compile-only), included in docs/services/authentication.md.
+- Journal README sections on scopes and token auth.
+- Release: summercms annotated tag `v0.1.21` (or next free), Journal `go.mod` require of it, host journal gitlink bump; session values `RELEASE_TAG` and the pushed heads in the SUMMARY.
+
+<objective>
+Let an agent manage Journal posts as a backend author with a Journal-scoped token (SC-4), keep the Journal contract byte-identical, finish the docs (SC-5), and release the framework, the plugin and the host bump behind a human gate.
+
+Purpose: the phase's main use case (CONTEXT Specific Ideas) works end to end against the released framework.
+Output: Journal scope registration and resolver switch, smoke tests, README and docs, a pushed tag and bumps.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-CONTEXT.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-RESEARCH.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-01-SUMMARY.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-02-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-07-SUMMARY.md
+
+Repositories: ../sm-journal-plugin builds against ../summercms.go through its go.work replace, so the Journal code works before the tag; its go.mod require is nominal and is bumped after the tag. Release facts at planning time: summercms latest tag v0.1.20 (aba063f); sm-journal-plugin main 5eea57f (requires v0.1.20); sm-grzybyfunkcjonalne-app master f1d53af with journal gitlink 5eea57f. Docker: the Journal root package runs a testcontainers Postgres in TestMain; Docker-free runs use `-short` or the classes and controllers packages. Commits: no co-author tags, stage by explicit path in each repository, tests and code in separate commits where the plan says so.
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: a journal-scoped token created through the admin API creates a Journal post as its owner</name>
+  <files>../sm-journal-plugin/token_scopes.go, ../sm-journal-plugin/lang/en/lang.yaml, ../sm-journal-plugin/lang/pl/lang.yaml, ../sm-journal-plugin/controllers/api/auth.go, ../sm-journal-plugin/controllers/api/auth_test.go, ../sm-journal-plugin/journal_api_token_smoke_test.go</files>
+  <read_first>../sm-journal-plugin/controllers/api/auth.go (whole file), ../sm-journal-plugin/controllers/api/posts.go (Index :30, Show :119, Store :193, Update :238, Destroy :291, UploadFeaturedImage :323, DeleteFeaturedImage :391), ../sm-journal-plugin/controllers/api/media.go (UploadMedia :18), ../sm-journal-plugin/controllers/api/posts_helpers.go (canViewDraft :33), ../sm-journal-plugin/admin_permissions.go, ../sm-journal-plugin/plugin.go (capability assertions :25-33, Buckets), ../sm-journal-plugin/routes.go, ../sm-journal-plugin/lang/en/lang.yaml and pl/lang.yaml, ../sm-journal-plugin/admin_harness_test.go (TestMain :53, newPostsEnv, bootJournal, e.admin :241, e.call, adminAPI), ../sm-journal-plugin/journal_api_writes_test.go, summercms modules/cabana/token_guard.go (ResolveBackend, ErrUnauthenticated, ErrTokenScope) and 16.3-01-SUMMARY.md</read_first>
+  <action>Per D-04, D-01 and D-15, wire one Journal write through the framework token path.
+
+Scopes: token_scopes.go declares the compile-time assertion for `pact.HasTokenScopes` and `TokenScopes()` returning `journal` (Permissions golem15.journal.*, Methods GET, HEAD, POST, PUT, PATCH, DELETE) and `journal:read` (golem15.journal.*, GET, HEAD), Label and Description as golem15.journal::lang.scopes.journal, scopes.journal_description, scopes.journal_read and scopes.journal_read_description. Add a `scopes:` block to lang/en and lang/pl (EN: "Journal" / "Create, edit, publish and delete posts as you, within your Journal permissions."; "Journal, read-only" / "Read posts, including drafts you may see, without changing anything."; PL equivalents).
+
+Resolver switch (reverses Phase 15 D-15): in controllers/api/auth.go replace the plugin's own guard constructor (auth.go :58-81) and its blacklist and registry lookups with `cabana.ResolveBackend(app, r, "golem15.journal.*")`, looked up per request. `requireBackendPrincipal` keeps its signature and writes the existing bodies through a new `resolveError(w, err)`: `errors.Is(err, cabana.ErrTokenScope)` → `writeAPIError(w, 403, errInsufficientPerms)`, anything else → `writeAuthRequired`. `optionalBackendPrincipal` keeps the hasBearer short-cut for anonymous requests and treats every resolver error as anonymous. Remove imports and constants that become unused. No handler in posts.go or media.go changes.
+
+Tests: `TestResolveErrorMapping` (controllers/api/auth_test.go, Docker-free): ErrTokenScope (also wrapped) → 403 with body exactly {"error":"Insufficient permissions"}, ErrUnauthenticated and a generic error → 401 {"error":"Authentication required"}. `TestJournalTokenTracer` (root package, Postgres): `newPostsEnv`, an admin with golem15.journal.access_posts via `e.admin`, POST `adminAPI("/account/tokens")` with that JWT and {name, scopes:["journal"]} → 201 and a g15_ token; POST /_journal/api/v1/posts with Bearer token and a minimal valid body → 201 and the stored post's user_id equals the admin's id.</action>
+  <verify>
+    <automated>go -C ../sm-journal-plugin vet ./... &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^TestResolveErrorMapping$' -v ./controllers/api/ 2&gt;&amp;1 | grep -- '^--- PASS: TestResolveErrorMapping' &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/...</automated>
+    <fails_when>Non-zero exit: vet fails (an unused import or constant left behind), no "--- PASS: TestResolveErrorMapping" line (a resolver error maps to the wrong status or body), or a Journal classes or controllers test regressed.</fails_when>
+    <automated>docker info &gt;/dev/null 2&gt;&amp;1 &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^TestJournalTokenTracer$' -v . 2&gt;&amp;1 | grep -- '^--- PASS: TestJournalTokenTracer'</automated>
+    <fails_when>Non-zero exit: no Docker daemon (record NOT RUN in the SUMMARY), or the journal token could not be created through the admin API, the Journal write was refused, or the post's author is not the token's owner.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func (\*Plugin) TokenScopes\|func (p \*Plugin) TokenScopes" ../sm-journal-plugin/token_scopes.go` prints one line and `grep -c "journal_read_description" ../sm-journal-plugin/lang/en/lang.yaml ../sm-journal-plugin/lang/pl/lang.yaml` reports 1 per file.
+    - `grep -c "cabana.ResolveBackend" ../sm-journal-plugin/controllers/api/auth.go` reports at least 2.
+    - `grep -v '^\s*//' ../sm-journal-plugin/controllers/api/auth.go | grep -c "NewBackendJWTGuard\|NewPostgresBlacklist"` reports 0.
+    - `git -C ../sm-journal-plugin diff --stat 5eea57f -- controllers/api/posts.go controllers/api/media.go` prints nothing (5eea57f is the pre-phase Journal head; no handler edits).
+  </acceptance_criteria>
+  <done>A journal-scoped token minted on the admin API creates a Journal post as its owner, and the resolver errors map to the PHP bodies.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Journal token matrix (read scope, unrelated scope, optional-auth drafts, featured images, code-declared roles), Journal README, and the compiled ResolveBackend docs example</name>
+  <files>../sm-journal-plugin/journal_api_token_smoke_test.go, ../sm-journal-plugin/README.md, modules/cabana/example_tokens_test.go, docs/services/authentication.md</files>
+  <read_first>../sm-journal-plugin/journal_api_token_smoke_test.go (Task 1), ../sm-journal-plugin/journal_api_writes_test.go and journal_api_matrix_test.go (status and body assertions), ../sm-journal-plugin/admin_permissions.go (Roles developer), ../sm-journal-plugin/README.md (Features :19-28, Usage :30-150, API reference :231, Testing :303), /media/nvme/dev/golem15/fonoteka/plugins/golem15/journal/controllers/api/PostApiController.php (:313-330, :395-430, :459-470) and routes.php (:38-65), modules/cabana/example_test.go and example_controller_test.go (compile-only example style), docs/services/authentication.md (the plan 01 section on admin tokens on plugin routes), internal/docsite/snippet.go (src= rules)</read_first>
+  <action>Pin the rest of D-15 and RESEARCH Pitfalls 3 and 4 with one Postgres smoke, then document.
+
+`TestJournalTokenExpansion` (root package, Postgres, same harness): with tokens created through the admin API for an editor that has golem15.journal.access_posts but not access_other_posts: a `journal:read` token POST /posts → 403 {"error":"Insufficient permissions"}; a `journal:read` token GET /posts/{slug} of the editor's own draft → 200 while an anonymous GET → 404; a token for a scope that does not cover golem15.journal.* (register a second test scope or use the framework `admin:read` on a POST) on POST /posts → 403 and on GET /posts behaves as anonymous; a `journal` token uploads and deletes a featured image on the editor's own post (canEdit parity, no access_posts requirement added) and gets 403 on another author's post; a revoked token → 401 {"error":"Authentication required"}; an admin whose Journal access comes only from the code-declared developer role (no role or user grant rows) creates a post with a JWT (Pitfall 4 behaviour change). Compare bodies byte for byte with the existing constants.
+
+Journal README (D-20): Features line for writes ("a cabana backend JWT or a personal admin API token, g15_…, whose scope covers the Journal"); Usage: the two scopes (`journal`, `journal:read`), a token example request, optional-auth reads unlocking drafts, the error bodies, the reversal of Phase 15 D-15, the code-declared role change, the featured-image parity note and the IP-keyed journal-api throttle; API reference row for `journal.Plugin.TokenScopes`; Testing: the new tests.
+
+Framework docs (D-20, remaining): `modules/cabana/example_tokens_test.go` with a compile-only `ExampleResolveBackend` showing a plugin handler (acme names) that calls `cabana.ResolveBackend(app, r, "acme.blog.*")` and maps `cabana.ErrTokenScope` to 403 and other errors to 401; include it in docs/services/authentication.md with a `src=modules/cabana/example_tokens_test.go#ExampleResolveBackend` fence next to the prose plan 01 wrote, and say the resolver reads the Bearer header only. Then check that every exported identifier this phase added is named in its module README (pact TokenScope, HasTokenScopes; bouncer ScopeLimit; party Activated; cabana BackendAPIToken, APITokenPrefix, ResolveBackend, ErrUnauthenticated, ErrTokenScope) and every admin:token command in the cabana README and docs/console/setup-and-maintenance.md; fix any gap in the same commit.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^ExampleResolveBackend$|^TestDocsTree$' ./modules/cabana ./cmd/summer &amp;&amp; go run ./cmd/summer docs:build --check &amp;&amp; go -C ../sm-journal-plugin vet ./...</automated>
+    <fails_when>Non-zero exit: the example does not compile, TestDocsTree or docs:build --check reports an unknown identifier, a stale src= fence or a consuming-application name, or the Journal tests fail vet.</fails_when>
+    <automated>docker info &gt;/dev/null 2&gt;&amp;1 &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestJournalTokenTracer|TestJournalTokenExpansion|TestJournalWriteUnauthenticated|TestJournalFeaturedImageUnauthenticated)$' -v . 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 4</automated>
+    <fails_when>Non-zero exit: no Docker daemon (record NOT RUN), or fewer than four passing tests: a read or unrelated scope reached a write, a draft leaked or stayed hidden, a featured-image route changed its PHP behaviour, an existing unauthenticated contract test changed, or a body differs from the PHP constants.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "journal:read" ../sm-journal-plugin/README.md` prints at least one line and `grep -n "Phase 15" ../sm-journal-plugin/README.md` names the reversal.
+    - `grep -n "src=modules/cabana/example_tokens_test.go#ExampleResolveBackend" docs/services/authentication.md` prints one line.
+    - For each of TokenScope, HasTokenScopes, ScopeLimit, Activated, BackendAPIToken, APITokenPrefix, ResolveBackend, ErrUnauthenticated, ErrTokenScope, `grep -l` over modules/pact/README.md, modules/bouncer/README.md, modules/party/README.md and modules/cabana/README.md finds at least one file.
+  </acceptance_criteria>
+  <done>Read-only, unrelated and revoked tokens are refused with the PHP bodies, drafts unlock as the owner may see them, featured images keep PHP parity, and the Journal README and framework docs cover the token integration.</done>
+</task>
+
+<task type="checkpoint:decision" gate="blocking-human">
+  <name>Task 3: Release gate: local checks green, tag chosen, one-way surfaces listed, a human approves the tag and pushes</name>
+  <read_first>.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-07-SUMMARY.md (how the last release ran), 16.3-01-SUMMARY.md, 16.3-02-SUMMARY.md and this plan's Task 1-2 SUMMARY notes (commits per repository, Postgres tests NOT RUN), 16.3-REVIEW.md and 16.3-SECURITY.md when present, ../sm-journal-plugin/go.mod, ../sm-grzybyfunkcjonalne-app/.gitmodules</read_first>
+  <action>Do everything automatable, print a release sheet, then stop.
+
+Concurrency: in summercms.go `git status --porcelain -- modules admin docs scripts cmd` prints nothing, `git fetch origin --tags`, `git log --oneline HEAD..origin/master` prints nothing; the same clean and not-behind checks for ../sm-journal-plugin (main) and ../sm-grzybyfunkcjonalne-app (master). If an origin has commits this checkout lacks, stop and report; never merge or rebase on your own.
+
+Tag: if `git tag --contains` on the first plan 01 commit lists a tag, propose reusing it; otherwise propose the highest of `git tag -l 'v0.1.*' --sort=-v:refname` plus one (v0.1.21 if nobody tagged after v0.1.20) and confirm with `git ls-remote --tags origin` that it does not exist.
+
+Run the gate (verify command). Release sheet: the proposed tag; the one-way surfaces the tag publishes (pact.TokenScope and pact.HasTokenScopes; bouncer.ScopeLimit and Principal.Scope; party.Activated; cabana.BackendAPIToken, APITokenPrefix, ResolveBackend, ErrUnauthenticated, ErrTokenScope; the four account token routes; the g15_ format from D-07; table backend_api_tokens and migration 202610110001_backend_api_tokens); commits to push per repository; the Postgres suites recorded NOT RUN in plans 01 to 03; open high findings from 16.3-REVIEW.md or 16.3-SECURITY.md if they exist (an open high finding allows only docker-first or hold, per security_block_on high); whether sm-summercmsio-app's Journal gitlink should also move (it would pull in Phase 16.2; default no); and that a UAT redeploy is a separate follow-up. Stop for the human.</action>
+  <decision>Push summercms master and the proposed annotated tag, push the Journal go.mod bump, and push the host journal gitlink bump now?</decision>
+  <context>A pushed tag is read by other repositories' go.mod and the Go module proxy and publishes the pact scope capability and the cabana resolver; it cannot be moved, only superseded. Once a host deploys it, issued g15_ tokens live in agent configs (D-07 one-way). The unit-test plan (04) runs after this release, as in 16.2 (lean rule 3); its tests ship with the next tag.</context>
+  <options>
+    <option id="release-now">
+      <name>Release now with the proposed tag</name>
+      <pros>Hosts and the Journal plugin get scoped tokens immediately; the main use case is usable</pros>
+      <cons>Postgres suites recorded NOT RUN run later on a Docker host; a defect then needs the next tag</cons>
+    </option>
+    <option id="docker-first">
+      <name>Run the Docker-host suites first, then release</name>
+      <pros>The cabana token, account, command and conformance suites, the lagoon migration tests and the Journal token tests all run before the tag exists</pros>
+      <cons>Needs a Docker-enabled machine and delays the release</cons>
+    </option>
+    <option id="hold">
+      <name>Hold the release</name>
+      <pros>Nothing leaves this machine</pros>
+      <cons>Journal stays JWT-only for hosts; agents cannot use tokens yet</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "release vX" (release-now), "docker passed, release vX" (docker-first, after the human ran the suites), optionally adding "and summercmsio" to also bump sm-summercmsio-app, or "hold".</resume-signal>
+  <verify>
+    <automated>go vet ./... &amp;&amp; go -C ../sm-journal-plugin vet ./... &amp;&amp; go test -count=1 -run '^(TestTokenTracerSmoke|TestTokenGatesSmoke|TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestPhase10ConformanceInventory|TestPhase10CSRF)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 6 &amp;&amp; go -C ../sm-journal-plugin test -count=1 ./classes/ ./controllers/... &amp;&amp; go test -count=1 ./cmd/summer -run 'TestDocsTree|TestDelegateCommandsHelp' &amp;&amp; go run ./cmd/summer docs:build --check &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-admin-dist.sh &amp;&amp; bash scripts/check-admin-openapi.sh --check &amp;&amp; echo release-gate-ok</automated>
+    <fails_when>Non-zero exit or "release-gate-ok" absent: vet fails in either repository, fewer than six "--- PASS: Test" lines for the cabana token and inventory set, a Journal classes or controllers test fails, a docs check fails, an admin vitest case fails, or a dist or OpenAPI drift gate reports stale output.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The gate printed release-gate-ok and the three repositories were clean and not behind origin.
+    - The SUMMARY records the release sheet (tag, one-way surfaces, commits per repository, suites NOT RUN, review findings, the sm-summercmsio-app question) and the human's reply verbatim.
+  </acceptance_criteria>
+  <done>A human chose release-now or docker-first with a named tag, or hold (the plan stops).</done>
+</task>
+
+<task type="auto">
+  <name>Task 4: Release: annotated summercms tag, Journal go.mod bump, host journal gitlink bump, all pushed</name>
+  <reversibility rating="one-way">A pushed annotated summercms tag publishes pact.HasTokenScopes and cabana.ResolveBackend to other repositories' go.mod and the Go module proxy (only supersedable), and lets hosts issue g15_ tokens in the D-07 format that then live in agent configs.</reversibility>
+  <precondition>Task 3 was answered "release vX" or "docker passed, release vX"; RELEASE_TAG is that tag in the session; `git ls-remote --tags origin "refs/tags/$RELEASE_TAG"` prints nothing unless Task 3 recorded a reused tag.</precondition>
+  <files>../sm-journal-plugin/go.mod, ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal</files>
+  <read_first>this plan's Task 3 release sheet in the SUMMARY, ../sm-journal-plugin/go.mod, ../sm-journal-plugin/go.work, ../sm-grzybyfunkcjonalne-app/.gitmodules, .planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-07-SUMMARY.md (Release table)</read_first>
+  <action>Framework: unless Task 3 recorded a reused tag, re-run `git log --oneline HEAD..origin/master` (must print nothing), create the annotated tag on summercms.go master HEAD with message "$RELEASE_TAG: personal admin API tokens with scopes (pact.HasTokenScopes, cabana.ResolveBackend, admin:token commands, My account API tokens panel)", then push master and the tag.
+
+sm-journal-plugin: `go -C ../sm-journal-plugin mod edit -require=git.golem15.com/golem15/summercms@$RELEASE_TAG` (the go.work replace stays, so the require is nominal); `go -C ../sm-journal-plugin vet ./...`; commit go.mod alone as "chore(deps): require summercms $RELEASE_TAG"; push main (this publishes Tasks 1 and 2).
+
+Host ../sm-grzybyfunkcjonalne-app: in plugins/golem15/journal fetch origin and check out the sm-journal-plugin main just pushed; commit the gitlink alone as "chore: bump journal plugin (personal admin API tokens)" and push master. Only when the human's reply included "and summercmsio", do the same for ../sm-summercmsio-app/plugins/golem15/journal and report its build result. Record every pushed head and the tag object in the SUMMARY.</action>
+  <verify>
+    <automated>test -n "$(git ls-remote --tags origin "refs/tags/$RELEASE_TAG")" &amp;&amp; test "$(git -C ../sm-journal-plugin rev-parse main)" = "$(git -C ../sm-journal-plugin rev-parse origin/main)" &amp;&amp; grep -q "git.golem15.com/golem15/summercms $RELEASE_TAG" ../sm-journal-plugin/go.mod &amp;&amp; test "$(git -C ../sm-grzybyfunkcjonalne-app ls-files -s plugins/golem15/journal | cut -d' ' -f2)" = "$(git -C ../sm-journal-plugin rev-parse main)" &amp;&amp; test "$(git -C ../sm-grzybyfunkcjonalne-app rev-parse master)" = "$(git -C ../sm-grzybyfunkcjonalne-app rev-parse origin/master)" &amp;&amp; echo release-ok</automated>
+    <fails_when>Non-zero exit or "release-ok" absent: the tag is not on origin, Journal main is not pushed, go.mod does not require the tag, the host gitlink does not point at the pushed Journal head, or the host master is not pushed.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `git ls-remote --tags origin` lists the release tag (or the SUMMARY names the reused tag).
+    - The verify prints release-ok.
+    - The SUMMARY records the tag, every pushed head and the commit messages; no credential appears in it.
+  </acceptance_criteria>
+  <done>The framework tag, the Journal plugin requiring it and the host bump are on origin.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| agent → Journal API | Bearer JWT or g15_ token; untrusted |
+| Journal handlers → ownership checks | CanEdit and canViewDraft trust the principal the resolver returns |
+| executor → git origin | tags and branches are read by other repositories |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.3-18 | Elevation of Privilege | Journal ownership branches (CanEdit, canViewDraft, featured images) | high | mitigate | Every Journal principal comes from cabana.ResolveBackend with cover golem15.journal.*; a token without Journal coverage gets 403 on writes and is anonymous on reads; TestJournalTokenExpansion pins it |
+| T-16.3-19 | Elevation of Privilege | journal:read on write routes | high | mitigate | Method filter in the resolver refuses non-GET/HEAD before the handler; 403 Insufficient permissions |
+| T-16.3-20 | Spoofing / Tampering (CSRF) | Journal write routes | high | mitigate | The resolver reads only the Bearer header (plan 01), so the admin cookie cannot authenticate a Journal write; Journal keeps its Bearer-only contract |
+| T-16.3-21 | Information Disclosure | Journal error bodies | low | mitigate | Only the existing PHP constants are written; resolver error text never reaches the client |
+| T-16.3-22 | Tampering / Repudiation | tag and pushes | high | mitigate | Clean, not-behind trees and an absent tag checked at a blocking-human checkpoint; one-way surfaces and NOT RUN suites listed for the human; heads recorded in the SUMMARY; no pushed tag moved |
+| T-16.3-23 | Elevation of Privilege | code-declared role grants on the Journal API | low | accept | Intended fix (the admin API already honors them); documented in the Journal README as a behaviour change |
+| T-16.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package is installed; go mod edit changes only the nominal summercms require; builds use committed go.sum and lockfiles |
+</threat_model>
+
+<verification>
+- Task 1: Journal vet, resolver mapping test, classes and controllers tests; the Postgres tracer on a Docker host.
+- Task 2: example compiles, docs checks pass; the Journal token matrix on a Docker host.
+- Task 3: release-gate-ok and a human decision.
+- Task 4: release-ok.
+</verification>
+
+<success_criteria>
+- SC-4: an agent manages Journal posts with a journal-scoped token as a backend author.
+- SC-2 for plugin routes: read, unrelated and revoked tokens are refused with the PHP bodies.
+- SC-5: Journal README and the compiled ResolveBackend example are in place.
+- The release is pushed only after human approval.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-03-SUMMARY.md` when done, with the commits per repository, the release sheet, the human's reply, the tag and pushed heads, and the Postgres tests run or NOT RUN.
+</output>

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-03-SUMMARY.md

@@ -0,0 +1,221 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+plan: 03
+subsystem: auth
+tags: [api-tokens, journal, ResolveBackend, release, g15, scopes]
+
+requires:
+  - phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+    provides: cabana.ResolveBackend, account token API, admin SPA tokens card
+provides:
+  - "journal and journal:read token scopes on sm-journal-plugin"
+  - "Journal API auth via cabana.ResolveBackend with cover golem15.journal.*"
+  - "ExampleResolveBackend docs example and Journal README token docs"
+  - "summercms v0.1.21 release with Journal go.mod and host gitlink bumps"
+affects: [16.3-04, sm-journal-plugin, sm-grzybyfunkcjonalne-app]
+
+actuals:
+  tokens: 20568
+  tasks: 4
+  commits: 2
+plan_head_before: 611f98e33ba45b1f7718ead84cb8f8474e879f33
+plan_head_after: 2030fd881aa08347931c638a90548b16bc188f86
+
+tech-stack:
+  added: []
+  patterns:
+    - "Journal principals only via cabana.ResolveBackend(cover golem15.journal.*)"
+    - "ErrTokenScope → 403 Insufficient permissions; other resolver errors → 401 Authentication required"
+    - "Optional-auth reads treat cover/auth failure as anonymous"
+
+key-files:
+  created:
+    - ../sm-journal-plugin/token_scopes.go
+    - ../sm-journal-plugin/controllers/api/auth_test.go
+    - ../sm-journal-plugin/journal_api_token_smoke_test.go
+    - modules/cabana/example_tokens_test.go
+  modified:
+    - ../sm-journal-plugin/controllers/api/auth.go
+    - ../sm-journal-plugin/lang/en/lang.yaml
+    - ../sm-journal-plugin/lang/pl/lang.yaml
+    - ../sm-journal-plugin/README.md
+    - ../sm-journal-plugin/go.mod
+    - docs/services/authentication.md
+    - modules/cabana/phase10_csrf_test.go
+    - ../sm-grzybyfunkcjonalne-app/plugins/golem15/journal
+
+key-decisions:
+  - "Human resume: release v0.1.21 (release-now); no sm-summercmsio-app bump"
+  - "Probe test scope acme.probe registered for cover-failure cases because admin:read is Full on GET"
+  - "CSRF walk count updated 30→32 for account token create/revoke routes"
+
+patterns-established:
+  - "Plugin API writes: ResolveBackend + resolveError mapping to PHP bodies"
+  - "Release sheet at blocking-human gate before any tag/push"
+
+requirements-completed: [SC-2, SC-4, SC-5]
+
+coverage:
+  - id: D1
+    description: "journal-scoped token minted via admin API creates a Journal post as its owner"
+    requirement: SC-4
+    verification:
+      - kind: unit
+        ref: ../sm-journal-plugin/controllers/api/auth_test.go#TestResolveErrorMapping
+        status: pass
+      - kind: integration
+        ref: ../sm-journal-plugin/journal_api_token_smoke_test.go#TestJournalTokenTracer
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Read/unrelated/revoked tokens, optional draft unlock, featured-image canEdit parity, code-declared roles"
+    requirement: SC-2
+    verification:
+      - kind: integration
+        ref: ../sm-journal-plugin/journal_api_token_smoke_test.go#TestJournalTokenExpansion
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Journal README and ExampleResolveBackend docs"
+    requirement: SC-5
+    verification:
+      - kind: other
+        ref: go test ./cmd/summer -run TestDocsTree; go run ./cmd/summer docs:build --check
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Human-approved release v0.1.21 with Journal require and host gitlink"
+    verification:
+      - kind: other
+        ref: git ls-remote --tags origin refs/tags/v0.1.21; release-ok verify
+        status: pass
+    human_judgment: true
+    rationale: "Tag and push require human approval at blocking-human gate"
+
+duration: 658min
+completed: 2026-10-11
+status: complete
+---
+
+# Phase 16.3 Plan 03: Journal scopes, ResolveBackend and v0.1.21 release Summary
+
+**Journal registers `journal` / `journal:read`, authenticates writes through `cabana.ResolveBackend`, documents the path, and ships as summercms `v0.1.21` with plugin and host bumps.**
+
+## Performance
+
+- **Duration:** 658 min (includes overnight pause at the blocking-human release gate)
+- **Started:** 2026-10-11T00:09:06Z
+- **Completed:** 2026-10-11T11:07:50Z
+- **Tasks:** 4
+- **Files modified:** 12 (across summercms.go, sm-journal-plugin, sm-grzybyfunkcjonalne-app)
+
+## Accomplishments
+
+- Journal `TokenScopes` + lang keys; API auth switched to `cabana.ResolveBackend` with cover `golem15.journal.*`
+- Postgres tracer and expansion matrix (read scope, probe cover, drafts, featured images, revoke, developer role grants)
+- `ExampleResolveBackend` in cabana docs; Journal README scopes / Phase 15 D-15 reversal
+- Human-approved release: annotated tag `v0.1.21`, Journal `go.mod` require, host journal gitlink
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Tracer** — `4ec64a3` (sm-journal-plugin, feat)
+2. **Task 2: Matrix + docs** — `f2026c5` (sm-journal-plugin, feat); `60873a3` (summercms.go, docs)
+3. **Task 3: Release gate** — gate `release-gate-ok`; human reply `release v0.1.21`; CSRF inventory fix `2030fd8` (summercms.go, fix)
+4. **Task 4: Release** — tag `v0.1.21` object `dc181e6` on `2030fd8`; Journal bump `09308d9`; host gitlink `e44cfde`
+
+**Plan metadata:** (this commit)
+
+## Human reply (Task 3, verbatim)
+
+```
+release v0.1.21
+```
+
+No `and summercmsio` — sm-summercmsio-app was not bumped.
+
+## Release
+
+| Item | Value |
+|------|-------|
+| Proposed / shipped tag | `v0.1.21` |
+| Tag object | `dc181e6224389647ce378ac1420e5df48eea2e04` |
+| Tag points at | `2030fd881aa08347931c638a90548b16bc188f86` |
+| summercms.go master (pushed) | `2030fd8` |
+| sm-journal-plugin main (pushed) | `09308d9` (requires `summercms v0.1.21`) |
+| sm-grzybyfunkcjonalne-app master (pushed) | `e44cfde` (journal gitlink `09308d9`) |
+| sm-summercmsio-app | not bumped |
+| UAT redeploy | follow-up (not this plan) |
+
+### One-way surfaces published
+
+`pact.TokenScope` / `HasTokenScopes`; `bouncer.ScopeLimit` / `Principal.Scope`; `party.Activated`; `cabana.BackendAPIToken`, `APITokenPrefix`, `ResolveBackend`, `ErrUnauthenticated`, `ErrTokenScope`; account token routes; `g15_` format; `backend_api_tokens` / migration `202610110001_backend_api_tokens`.
+
+### Release sheet (pre-approval)
+
+- Trees clean and not behind origin; tag absent on origin before create
+- Gate printed `release-gate-ok` (after CSRF count 30→32)
+- Open high findings: none (`16.3-REVIEW.md` / `16.3-SECURITY.md` absent)
+
+## Postgres verify status
+
+| Suite | Status |
+|-------|--------|
+| 16.3-01 cabana/lagoon Postgres | **RUN** (prior SUMMARY) |
+| `TestJournalTokenTracer` | **RUN** pass |
+| `TestJournalTokenExpansion` | **RUN** pass |
+| NOT RUN | none on this host for 16.3-03 |
+
+## Decisions Made
+
+- Followed D-04/D-01/D-15 and featured-image PHP parity (CanEdit only).
+- Registered test-only `acme.probe` scope for unrelated-cover cases (`admin:read` is Full on GET).
+- Human chose release-now `v0.1.21` without summercmsio.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] CSRF state-changing route count stale after token API**
+- **Found during:** Task 3 release gate (`TestPhase10CSRF`)
+- **Issue:** Walk counted 32 routes (account token create/revoke) but expected 30
+- **Fix:** Updated expected count and comment to 32
+- **Files modified:** `modules/cabana/phase10_csrf_test.go`
+- **Verification:** Six cabana gate tests pass; `release-gate-ok`
+- **Committed in:** `2030fd8`
+
+**2. [Rule 3 - Blocking] Probe scope for cover-failure GET path**
+- **Found during:** Task 2 expansion (`admin:read` on GET is Full, unlocks drafts as owner)
+- **Issue:** Plan suggested `admin:read` for anonymous GET; Full scopes skip cover
+- **Fix:** Test plugin `acme.probe` with `acme.probe.*` scope for cover refuse → anonymous GET
+- **Files modified:** `journal_api_token_smoke_test.go`
+- **Verification:** `TestJournalTokenExpansion` pass
+- **Committed in:** `f2026c5`
+
+---
+
+**Total deviations:** 2 auto-fixed (1 bug, 1 blocking)
+**Impact on plan:** Required for green release gate and correct cover semantics; no scope creep.
+
+## Issues Encountered
+
+None beyond the deviations above. Overnight pause at Task 3 until human resume.
+
+## User Setup Required
+
+None - no external service configuration required. UAT redeploy remains a separate follow-up.
+
+## Next Phase Readiness
+
+Ready for 16.3-04 (unit/backstop matrix). Framework + Journal token path released; hosts can mint `journal`-scoped tokens after migrate/redeploy.
+
+## Self-Check: PASSED
+
+- Key files exist on disk
+- Tag `v0.1.21` on origin; Journal main = origin/main; host gitlink = Journal main; `release-ok`
+- Commits grepped for 16.3-03 present in both repos
+
+---
+*Phase: 16.3-backend-admin-personal-api-tokens-with-scopes*
+*Completed: 2026-10-11*

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-04-PLAN.md

@@ -0,0 +1,238 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+plan: 04
+type: execute
+wave: 4
+depends_on: ["16.3-01", "16.3-02", "16.3-03"]
+files_modified:
+  - modules/bouncer/context_test.go
+  - modules/party/registry_test.go
+  - modules/lagoon/backend_admin_migrations_test.go
+  - modules/cabana/token_scopes_test.go
+  - modules/cabana/api_tokens_test.go
+  - modules/cabana/token_guard_test.go
+  - modules/cabana/token_routes_test.go
+  - modules/cabana/token_postgres_test.go
+  - modules/cabana/account_tokens_test.go
+  - modules/cabana/token_commands_test.go
+  - admin/tests/account/ApiTokensPanel.test.ts
+  - admin/tests/account/ApiTokenCreateDialog.test.ts
+  - ../sm-journal-plugin/token_scopes_test.go
+  - ../sm-journal-plugin/journal_api_tokens_test.go
+  - scripts/check-phase16.3.sh
+  - .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-VALIDATION.md
+autonomous: true
+requirements: [SC-6, SC-1, SC-2, SC-3, SC-4]
+estimate:
+  tokens: 140000
+  raw_tokens: 140000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "CLAUDE.md lean rule 3 and SC-6: every piece of Phase 16.3 code has unit tests in this last plan: bouncer ScopeLimit, party Activated, the lagoon migration, cabana scope match, Allows, compile, overlap, mint, expiry, request validation, the composite guard, the debounce, ResolveBackend, interactive-only, the route gates and their classification, the account token API, the CLI, the SPA panel and dialog, and the Journal scopes and token matrix."
+    - "D-14, D-03 and D-05 pinned by table: TestAllowsScope covers JWT principals unchanged, full scopes (`*` every method, admin:read on GET/HEAD), a plugin scope with owner grant, without owner grant, superuser with a scoped token, empty requirement list, multi-code lists under the literal per-scope reading (one scope must match every code), two scopes each matching part of a list, and wildcard requirements against broader, equal and narrower patterns; TestScopeMatch covers every row of the plan 01 match table."
+    - "D-05 and D-06 for every route: TestTokenRouteGates walks every entry of phase09Routes and asserts its class (public, open to any token: GET /auth/me, interactive-only, explicitly gated, gated through Allows by protect, navigation or settings) and the answer a `*` token, an admin:read token and a plugin-scoped token get; adding a route without a class fails the test."
+    - "D-13, D-07 to D-11 pinned on the guard: well-formedness (length, prefix, upper-case hex, non-hex), prefix routing (JWT and cookie untouched, g15_ in a cookie or a query string never authenticates), unknown, expired, revoked, deactivated and soft-deleted owners → 401, all-unknown scopes → 401, method refusal → 403 token_scope, the credential is the token row, a failed stamp does not fail auth, and the stamp runs at most once per minute; on Postgres a password reset and a tokens_valid_after cutoff leave the token working."
+    - "D-16 to D-19 pinned: the account token API (list own newest first, revoked filter, scope entries with known false for unknown names, 201 with plaintext once and never again, 422 for every validation rule, `*` normalization, own-only soft revoke, scopes picker overlap) and the CLI (stdout of admin:token:create is exactly the token and a newline, overlap refusal, deactivated or deleted targets refused, list never prints hash or plaintext, revoke of another user's token, scopes listing with and without party.Activated) are tested on Postgres; request validation and expiry parsing are tested without a database."
+    - "D-15 and SC-4 pinned on Postgres for the Journal: every write route (store, update, destroy, both featured-image routes, media upload) with journal, `*`, journal:read, admin:read, an unrelated scope, revoked and malformed tokens, with byte-identical bodies; optional-auth reads; the JWT path unchanged; the publish permission still enforced under a token."
+    - "UI-SPEC backstops: the plaintext is absent from the DOM, component state and toasts after Done and after an Esc-confirm close and reopening starts at step 1; the copy flow announces and the clipboard failure selects and alerts; Esc before copying asks and cancel keeps step 2."
+    - "scripts/check-phase16.3.sh runs every runnable suite fail-closed (stages go, admin, docs, postgres; --self-test proves the detectors fail on planted output; --all ends with 'Phase 16.3 gate passed' and says NOT RUN postgres loudly without Docker); 16.3-VALIDATION.md has every row filled and nyquist_compliant true."
+  artifacts:
+    - path: "modules/cabana/token_scopes_test.go"
+      provides: "scope match, Allows, compile and overlap tables"
+      contains: "TestAllowsScope"
+    - path: "modules/cabana/token_routes_test.go"
+      provides: "route classification and interactive-only tests"
+      contains: "TestTokenRouteGates"
+    - path: "modules/cabana/account_tokens_test.go"
+      provides: "Postgres account token API tests"
+      contains: "TestAccountTokens"
+    - path: "../sm-journal-plugin/journal_api_tokens_test.go"
+      provides: "Postgres Journal token matrix"
+      contains: "TestJournalTokens"
+    - path: "scripts/check-phase16.3.sh"
+      provides: "phase gate"
+      contains: "Phase 16.3 gate passed"
+  key_links:
+    - from: "modules/cabana/token_routes_test.go"
+      to: "modules/cabana/security_coverage_test.go phase09Routes"
+      via: "every inventoried route must have a token class"
+      pattern: "phase09Routes"
+    - from: "scripts/check-phase16.3.sh"
+      to: "every suite named in 16.3-VALIDATION.md"
+      via: "fail-closed stages and required test name lists"
+      pattern: "check-phase16.3"
+  prohibitions:
+    - statement: "No test touches a shared database, a server, git origin or the network: pure tests use stubs and in-memory stores; Postgres tests use throwaway testcontainers databases."
+      status: unresolved
+      verification: judgment
+    - statement: "Tests are not weakened to pass: existing assertions in the cabana, lagoon, bouncer, party and Journal suites stay; production code changes only in separate fix(...) commits with their own test, named in the SUMMARY."
+      status: unresolved
+      verification: judgment
+    - statement: "No test prints or logs a real token outside the test process; fixtures never contain credentials beyond test secrets already used by the suites."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format): backend users create personal API tokens with scopes picked at creation time, so an agent or integration calls the admin and plugin APIs as that backend user with no more access than the token's scope and the user's own permissions allow.
+
+This plan's slice (CLAUDE.md lean rule 3, user checkpoint plan 4 of 4): full unit coverage of the phase across summercms.go (Go and admin SPA) and sm-journal-plugin, the Postgres tests for a Docker host, the phase gate `scripts/check-phase16.3.sh` following the 16.2 gate pattern, and the completed validation map. Tests only; any defect found is fixed in a separate `fix(...)` commit with its own test.
+
+## Spec-less probe fallback
+
+Visible skip: "spec-less probe fallback skipped: phase has no requirement IDs to probe". Prohibitions above are recalled in-prompt and descriptor-less (flagged-unverified).
+
+## Artifacts this phase produces (this plan)
+
+- Go tests, Docker-free: `TestPrincipalScopeNotSerialized` (bouncer); `TestActivatePublishesPlugins` extended (party); `TestScopeMatch`, `TestAllowsScope`, `TestTokenScopeCompile`, `TestScopeOverlap`, `TestScopeCoversAll` (cabana token_scopes_test.go); `TestAPITokenMint`, `TestParseTokenExpiry`, `TestValidateTokenRequest` (api_tokens_test.go); `TestBackendTokenGuard`, `TestTokenLastUsedDebounce`, `TestResolveBackend` (token_guard_test.go); `TestTokenRouteGates`, `TestInteractiveOnly` (token_routes_test.go); `TestTokenCommandsRegistered` (token_commands_test.go); `TestJournalTokenScopes` (Journal root, `-short`).
+- Go tests, Postgres (Docker host): `TestBackendAPITokensMigration` (lagoon); `TestBackendTokenPostgres` (token_postgres_test.go); `TestAccountTokens` (account_tokens_test.go); `TestTokenCommands` (token_commands_test.go); `TestJournalTokens` (Journal root).
+- Vitest: extended `admin/tests/account/ApiTokensPanel.test.ts`, new `admin/tests/account/ApiTokenCreateDialog.test.ts`.
+- `scripts/check-phase16.3.sh` (stages `go`, `admin`, `docs`, `postgres`; flags `--self-test`, `--all`; env `PHASE163_ROOT`, `JOURNAL`, `PHASE163_REQUIRE_POSTGRES`).
+- 16.3-VALIDATION.md completed.
+
+<objective>
+Bring full unit coverage to Phase 16.3 (lean rule 3), add the Postgres tests for a Docker host, write the fail-closed phase gate and complete the validation map.
+
+Purpose: every security rule the phase ships (owner ∩ scope, deny by default, interactive-only, show-once plaintext, Journal coverage) is pinned by a test that fails when it regresses.
+Output: the test files above, scripts/check-phase16.3.sh, an updated 16.3-VALIDATION.md.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-VALIDATION.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-01-SUMMARY.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-02-SUMMARY.md
+@.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-03-SUMMARY.md
+@.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-06-PLAN.md
+
+Without Docker run Go tests with explicit `-run` sets (and `-short` in packages whose TestMain starts Postgres: modules/lagoon, the Journal root package); the testcontainers tests are written to fail rather than skip without a database and are listed for the Docker host. Helpers to reuse: the in-memory token store and stub users from `TestTokenTracerSmoke`, `captureRouter` and `phase09Routes` (security_coverage_test.go), `adminGorm`, `adminHandler`, `insertAdmin`, `commandApp`, `flagInput`, `commandByName` (cabana_test), `newPostsEnv`, `e.admin`, `e.call`, `adminAPI` (Journal harness), `mountApp`, `requestsTo` (admin tests/helpers.ts). Commits: tests only, `test(16.3-04): …`, no co-author tags, stage by explicit path in each repository; VALIDATION.md in its own docs commit.
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: the deny-by-default contract pinned at every layer (scope rules, guard, every route, SPA plaintext, Journal coverage)</name>
+  <files>modules/cabana/token_scopes_test.go, modules/cabana/token_routes_test.go, admin/tests/account/ApiTokenCreateDialog.test.ts, ../sm-journal-plugin/token_scopes_test.go, modules/cabana/token_postgres_test.go</files>
+  <read_first>modules/cabana/token_scopes.go, modules/cabana/contracts.go (Allows, granted), modules/cabana/token_guard.go, modules/cabana/http.go (mount), modules/cabana/security_coverage_test.go (phase09Routes, captureRouter, TestPhase09PermissionMatrix), modules/cabana/token_smoke_test.go (in-memory store, stub users), 16.3-01-PLAN.md (Decisions: match table, D-03 literal reading, overlap rule), admin/src/components/account/ApiTokenCreateDialog.vue, admin/tests/account/ApiTokensPanel.test.ts, ../sm-journal-plugin/token_scopes.go, ../sm-journal-plugin/lang/en/lang.yaml and pl/lang.yaml, modules/cabana/auth_test.go (adminGorm, adminHandler, insertAdmin)</read_first>
+  <action>Write one test per layer for the phase's central promise (SC-2: never beyond the owner, never outside the scope).
+
+Scope rules (token_scopes_test.go): `TestScopeMatch` with one case per row of the plan 01 match table (full, partial, none, leading wildcard); `TestAllowsScope` table per the D-14/D-03/D-05 truth of this plan, including the literal multi-code reading and a superuser holding a plugin scope.
+
+Every route (token_routes_test.go, per D-05 and D-06): `TestTokenRouteGates` builds a class map for every phase09Routes key (public; open to any token; interactive-only; explicit gate; Allows through protect, navigation or settings) and fails for any inventoried route without a class; for each class it drives the real handler wrapper chain from `service.mount` with principals for a `*` token, an admin:read token on GET, and a plugin-scoped token, and asserts the status and details.reason (interactive_only or token_scope) the class requires.
+
+SPA (ApiTokenCreateDialog.test.ts, UI-SPEC backstop "plaintext never retained"): after Done, hide token and after an Esc-then-confirm close, the token string is absent from document.body.innerHTML, the dialog exposes no plaintext in its state, no toast text contains it, and reopening shows step 1.
+
+Journal (token_scopes_test.go, Docker-free with -short): `TestJournalTokenScopes` asserts the two scopes, their permissions and methods, and that every label and description key exists in lang/en and lang/pl.
+
+Postgres (token_postgres_test.go, Docker host): `TestBackendTokenPostgres` covers the D-10 owner lifecycle through the real admin API (deactivate → 401, reactivate → 200, soft-delete → 401), a password reset through admin:reset-password and a tokens_valid_after cutoff leaving the token valid, revoked and expired rows → 401, last_used_at set once within a minute for two requests.</action>
+  <verify>
+    <automated>go vet ./modules/cabana &amp;&amp; go test -count=1 -run '^(TestScopeMatch|TestAllowsScope|TestTokenRouteGates)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 3 &amp;&amp; npm --prefix admin test -- tests/account/ApiTokenCreateDialog.test.ts &amp;&amp; go -C ../sm-journal-plugin test -short -count=1 -run '^TestJournalTokenScopes$' -v . 2&gt;&amp;1 | grep -- '^--- PASS: TestJournalTokenScopes'</automated>
+    <fails_when>Non-zero exit: fewer than three passing cabana tests (a scope rule regressed or a mounted route has no class or the wrong answer), the plaintext backstop fails, or the Journal scope test fails (missing phrase key or changed scope).</fails_when>
+    <automated>docker info &gt;/dev/null 2&gt;&amp;1 &amp;&amp; go test -count=1 -run '^TestBackendTokenPostgres$' -v ./modules/cabana 2&gt;&amp;1 | grep -- '^--- PASS: TestBackendTokenPostgres'</automated>
+    <fails_when>Non-zero exit: no Docker daemon (record NOT RUN), or an owner lifecycle, reset, cutoff, revoke, expiry or stamp expectation fails.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func TestTokenRouteGates" modules/cabana/token_routes_test.go` prints one line and the test references `phase09Routes`.
+    - `grep -c "func Test" modules/cabana/token_scopes_test.go` reports at least 2 at this point.
+    - The three Docker-free checks pass; the Postgres test passes on a Docker host or is recorded NOT RUN.
+  </acceptance_criteria>
+  <done>The scope rules, every route's token behaviour, the SPA plaintext lifetime and the Journal scope registration are pinned, with the owner lifecycle on Postgres.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Full Go coverage: bouncer, party, lagoon migration, cabana compile, overlap, mint, expiry, validation, guard, debounce, resolver, interactive-only, account API, CLI; Journal token matrix</name>
+  <files>modules/bouncer/context_test.go, modules/party/registry_test.go, modules/lagoon/backend_admin_migrations_test.go, modules/cabana/token_scopes_test.go, modules/cabana/api_tokens_test.go, modules/cabana/token_guard_test.go, modules/cabana/token_routes_test.go, modules/cabana/account_tokens_test.go, modules/cabana/token_commands_test.go, ../sm-journal-plugin/journal_api_tokens_test.go</files>
+  <read_first>modules/bouncer/context.go and context_test.go, modules/party/registry.go and registry_test.go, modules/lagoon/backend_admin_migrations.go and backend_admin_migrations_test.go, modules/cabana/api_tokens.go, modules/cabana/token_scopes.go, modules/cabana/token_guard.go, modules/cabana/account_tokens.go, modules/cabana/token_commands.go, modules/cabana/registry.go (compileTokenCatalog), modules/cabana/commands_test.go (TestAdminCreateCommand, commandApp, flagInput), modules/cabana/auth_test.go (adminHandler, insertAdmin), modules/cabana/openapi_conformance_test.go, ../sm-journal-plugin/journal_api_token_smoke_test.go, ../sm-journal-plugin/journal_api_writes_test.go, ../sm-journal-plugin/admin_harness_test.go</read_first>
+  <behavior>
+    - bouncer: a Principal with a Scope marshals to JSON without any scope field; a nil Scope is the zero value.
+    - party: Activated is published in activation (dependency) order; a second Activate on the same app returns an error.
+    - lagoon (Postgres): the migration creates backend_api_tokens with a unique token_hash, the backend_user_id FK cascades on a hard user delete and revoked_by is set NULL when the revoker is deleted; rollback drops the table and leaves backend_users; a fresh full rollback and re-migrate works.
+    - compile: every boot rule fails with its message (bad name, reserved `*`/admin/admin:x, duplicate naming both plugins, empty permissions, empty methods, lower-case or unknown method, missing GET, unknown permission, empty label, unresolved phrase key) and valid plugin scopes follow the framework scopes in activation order.
+    - overlap and cover: scopeOverlaps true only with a catalog code the owner holds under a full match; `*` always; admin:read for superusers or any catalog grant; scopeCoversAll for full, partial and none.
+    - mint and expiry: 1000 minted tokens are well formed, distinct, hash to 64 hex and hint to the last four; parseTokenExpiry for 30d, 90d, 365d, never, absent (90d), a future date (00:00 UTC), today or a past date and garbage, in API and CLI mode.
+    - validateTokenRequest: blank and over-100-rune names, invalid expiry, empty scopes, unknown scope, non-overlapping scope, `*` normalization, duplicate removal in order.
+    - guard (stubs): the guard matrix in this plan's truths; the stamp error path logs and returns the principal; the debounce gate skips a second stamp within a minute and allows one after.
+    - ResolveBackend: no app, no resolver, no Bearer, cookie-only JWT (refused, Bearer only), Bearer JWT (cover ignored), token with full scope, token with matching and non-matching cover, method refusal; the returned request carries the user and, for a token, the credential.
+    - interactive-only: token credential and raw g15_ Bearer refused with reason interactive_only on each wrapped route; a JWT session passes.
+    - account API (Postgres): list ordering, revoked filter, scope entries (known label, `*` label, unknown with known false, read_only), 201 shape with plaintext only there, every 422 rule with the server message text, `*` normalization stored, revoke own (200), other user's (404), already revoked (404), scopes picker filtered per user (developer vs a user without Journal-like grants vs superuser).
+    - CLI (Postgres): create stdout is exactly one line g15_ plus 40 hex with nothing else, ambiguous identifier refused, deactivated and soft-deleted targets refused, non-overlapping scope refused, --expires date accepted; list without and with identifier and --revoked shows hints and never hash or plaintext; revoke another user's token (revoked_by NULL), unknown id errors, already revoked exits 0; scopes with and without a published party.Activated. Docker-free TestTokenCommandsRegistered: four commands, scope flag Repeatable, RuntimeCommands constructs with an empty app.
+    - Journal (Postgres): TestJournalTokens: every write route × {journal, `*`, journal:read, admin:read, unrelated scope, revoked, malformed} with exact bodies; published=true under a journal token without access_publish → 403 "You do not have permission to publish posts"; optional-auth Index and Show with each token; the JWT path unchanged.
+  </behavior>
+  <action>Write the tests in the behavior block (per D-01 to D-19), table-driven where cases share a shape, extending the plan 01 and plan 03 smoke files' fixtures instead of duplicating them. Docker-free tests use stubs, in-memory stores and httptest; Postgres tests reuse adminGorm/adminHandler/commandApp and the Journal harness and fail rather than skip without Docker. Do not change production code; a defect gets its own fix(...) commit with a test, recorded in the SUMMARY.</action>
+  <verify>
+    <automated>go vet ./modules/bouncer ./modules/party ./modules/lagoon ./modules/cabana &amp;&amp; go test -count=1 ./modules/party &amp;&amp; go test -count=1 -run '^TestPrincipalScopeNotSerialized$' -v ./modules/bouncer 2&gt;&amp;1 | grep -- '^--- PASS: TestPrincipalScopeNotSerialized' &amp;&amp; go test -count=1 -run '^(TestScopeMatch|TestAllowsScope|TestTokenScopeCompile|TestScopeOverlap|TestScopeCoversAll|TestAPITokenMint|TestParseTokenExpiry|TestValidateTokenRequest|TestBackendTokenGuard|TestTokenLastUsedDebounce|TestResolveBackend|TestTokenRouteGates|TestInteractiveOnly|TestTokenCommandsRegistered|TestTokenTracerSmoke|TestTokenGatesSmoke)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 16</automated>
+    <fails_when>Non-zero exit: vet fails, the party package fails, the bouncer serialization test is missing or fails, or fewer than sixteen "--- PASS: Test" lines for the named cabana Docker-free tests (one missing or failing).</fails_when>
+    <automated>docker info &gt;/dev/null 2&gt;&amp;1 &amp;&amp; go test -count=1 -run '^(TestBackendAPITokensMigration|TestBackendAdminMetadataColumn|TestPhase09MigrationsFreshRollback)$' -v ./modules/lagoon 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 3 &amp;&amp; go test -count=1 -run '^(TestAccountTokens|TestTokenCommands|TestBackendTokenPostgres|TestPhase10OpenAPIConformance)$' -v ./modules/cabana 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 4 &amp;&amp; go -C ../sm-journal-plugin test -count=1 -run '^(TestJournalTokens|TestJournalTokenTracer|TestJournalTokenExpansion)$' -v . 2&gt;&amp;1 | grep -c '^--- PASS: Test' | grep -qx 3</automated>
+    <fails_when>Non-zero exit: no Docker daemon (record NOT RUN), or a lagoon migration, account API, CLI, Postgres guard, OpenAPI conformance or Journal token test fails or is missing.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func TestAccountTokens(t" modules/cabana/account_tokens_test.go`, `grep -n "func TestTokenCommands(t" modules/cabana/token_commands_test.go`, `grep -n "func TestBackendAPITokensMigration" modules/lagoon/backend_admin_migrations_test.go` and `grep -n "func TestJournalTokens(" ../sm-journal-plugin/journal_api_tokens_test.go` each print one line, and those files pass go vet in their repositories.
+    - For each repository, `git diff --stat "$TASK2_START"..HEAD` (TASK2_START recorded in the SUMMARY before this task) lists only *_test.go files, except files of separate fix(...) commits the SUMMARY names.
+  </acceptance_criteria>
+  <done>Every Go behaviour of the phase has a passing unit test, and the database-backed paths have Postgres tests for the Docker host.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Full SPA coverage, the phase gate script, and the validation map</name>
+  <files>admin/tests/account/ApiTokensPanel.test.ts, admin/tests/account/ApiTokenCreateDialog.test.ts, scripts/check-phase16.3.sh, .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-VALIDATION.md</files>
+  <read_first>admin/src/components/account/ApiTokensPanel.vue, admin/src/components/account/ApiTokenCreateDialog.vue, admin/tests/account/ApiTokensPanel.test.ts, admin/tests/helpers.ts, 16.3-UI-SPEC.md (Component Contracts 2-7 and UI Considerations), scripts/check-phase16.2.sh (structure, detectors, --self-test, --all, NOT RUN postgres), .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-VALIDATION.md</read_first>
+  <behavior>
+    - Panel: skeleton with aria-busy on first load and on toggle; empty block (also with the toggle on); load failure alert hides the toggle and keeps Create enabled; row anatomy (name, hint aria-label, chips: known label with title, `*` Full access, unknown dashed with hint title, Expired, Revoked), meta line formats and order, revoke button visibility per state; revoke success toast and focus, 404 gone toast and reload, other failure keeps the row; ConfirmDialog message wraps.
+    - Dialog step 1: focus on open; scopes skeleton and submit disabled while pending; scopes failure and empty answer show the alert; `*` checked disables and unchecks others, shows the note and sends only [`*`]; unchecking restores enabled rows without picks; no scope preselected; 90d preselected and the preview date for 30, 90, 365 and the never note; 422 for name, expires and scopes renders messages with aria-invalid and focuses the first invalid control; busy disables fieldset, buttons, Esc and overlay and ignores a second submit; non-422 failure toast keeps input; any close discards input; focus returns to Create token.
+    - Dialog step 2 (backstops): copy success state for two seconds and the polite announcement; rejected or missing clipboard selects the input and shows the alert; manual copy event counts; overlay never closes; Esc and close before copy ask and cancel keeps step 2, confirm closes; after copy they close at once; Done closes without confirm; plaintext absent afterwards; focus on Copy token on entering step 2.
+    - Gate: stages go (vet in both repositories; the Docker-free framework, cmd/summer and Journal tests by required name, Journal root with -short), admin (typecheck and full vitest with required case names), docs (TestDocsTree, summer docs:build --check, check-admin-openapi.sh --check, check-admin-dist.sh), postgres (Docker host: lagoon, cabana and Journal suites by required name); fail-closed detectors for failures, skips, zero tests, "no tests to run" and missing names; --self-test plants each failure; --all ends with "Phase 16.3 gate passed" and prints NOT RUN postgres without Docker unless PHASE163_REQUIRE_POSTGRES=1.
+  </behavior>
+  <action>Write the vitest cases in the behavior block (per D-08, D-09, D-11, D-16, D-17 and the UI-SPEC) in the two admin/tests/account files with stubbed fetch routes and a stubbed navigator.clipboard. Write scripts/check-phase16.3.sh in the check-phase16.2.sh style (set -euo pipefail, unset FORCE_COLOR, ROOT from the script path, overridable JOURNAL, required-name lists per stage covering every test this phase added, the same go-json and vitest-json detectors, --self-test, --all, NOT RUN postgres). Update 16.3-VALIDATION.md: replace each planned row's status with the real result, fix test file paths that differ from the plan, tick Wave 0, set wave_0_complete and nyquist_compliant to true, keep the Manual-Only rows (real-browser clipboard; Postgres suites on a Docker host when NOT RUN). Commit the tests as test(16.3-04), the script as "test(16.3): phase gate", and VALIDATION.md separately as docs(16.3).</action>
+  <verify>
+    <automated>npm --prefix admin run typecheck &amp;&amp; npm --prefix admin test &amp;&amp; bash scripts/check-phase16.3.sh --self-test &amp;&amp; bash scripts/check-phase16.3.sh --all 2&gt;&amp;1 | tail -1 | grep -qx 'Phase 16.3 gate passed'</automated>
+    <fails_when>Non-zero exit: a type error or failing vitest case, a detector self-test that does not fail on planted output, or a --all run whose last line is not exactly "Phase 16.3 gate passed" (a stage failed or a required test is missing).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "Phase 16.3 gate passed" scripts/check-phase16.3.sh` prints at least one line and the --all run ends with that line.
+    - `grep -n "nyquist_compliant: true" .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-VALIDATION.md` prints one line and `grep -c "TBD" .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-VALIDATION.md` reports 0.
+    - The full admin suite passes.
+  </acceptance_criteria>
+  <done>The SPA is fully tested against the UI-SPEC, the phase gate passes here with the Docker suites named, and the validation map is complete.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| tests → databases | Postgres tests start throwaway containers; nothing else is dialled |
+| tests → network | no test reaches a server, a registry or git origin |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-16.3-24 | Repudiation (false green) | phase gate | medium | mitigate | Fail-closed detectors for failures, skips, zero tests, "no tests to run" and missing required names; --self-test plants each; Docker suites are named and reported NOT RUN instead of silently skipped |
+| T-16.3-25 | Tampering (security regression) | Allows, guard, route gates, plaintext lifetime | high | mitigate | Table tests for the scope rules, a classification test that fails for any unclassified route, guard and resolver matrices, the Journal token matrix and the SPA plaintext backstop all run in the gate; production changes only through separate fix commits |
+| T-16.3-26 | Tampering | test isolation | low | mitigate | Stubs, in-memory stores, httptest and happy-dom for unit tests; testcontainers for Postgres; no shared database or network |
+| T-16.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package is installed; every runner uses the committed lockfiles and go.sum |
+</threat_model>
+
+<verification>
+- Task 1: scope rules, route classification, SPA plaintext backstop and Journal scopes pass; the Postgres guard test on a Docker host.
+- Task 2: the named Docker-free Go tests pass; the Postgres suites on a Docker host.
+- Task 3: full admin suite, gate self-test and --all pass; VALIDATION.md complete.
+- Before /msd-verify-work, on a Docker host: `bash scripts/check-phase16.3.sh postgres`.
+</verification>
+
+<success_criteria>
+- SC-6: full unit coverage of the phase's code in the last plan, Postgres tests ready for a Docker host, a passing fail-closed phase gate and a complete validation map.
+</success_criteria>
+
+<output>
+Create `.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-04-SUMMARY.md` when done, with test counts per repository, any fix(...) commits, and the Docker-host command list.
+</output>

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-04-SUMMARY.md

@@ -0,0 +1,183 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+plan: 04
+subsystem: testing
+tags: [api-tokens, unit-tests, vitest, testcontainers, phase-gate, nyquist]
+
+requires:
+  - phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+    provides: token scopes, guard, account API, CLI, SPA card, Journal scopes
+provides:
+  - "Full unit coverage of Phase 16.3 (lean rule 3)"
+  - "Postgres token suites for Docker hosts"
+  - "scripts/check-phase16.3.sh fail-closed gate"
+  - "16.3-VALIDATION.md with nyquist_compliant true"
+affects: [verify-work, phase-16.3-close]
+
+actuals:
+  tokens: 34814
+  tasks: 3
+  commits: 7
+plan_head_before: 2030fd881aa08347931c638a90548b16bc188f86
+plan_head_after: 463541549f374c328b121433a4e884146f86d25c
+TASK2_START: 91830e506f5e61537ae6180c3ff282bf19b81583
+
+tech-stack:
+  added: []
+  patterns:
+    - "Phase gate stages go/admin/docs/postgres with detect_go and detect_vitest fail-closed"
+    - "Journal TestJournalTokens matrix: writes × scopes with published_at for public Show"
+    - "SPA plaintext lifetime asserted via DOM/toast absence after Done and Esc-confirm"
+
+key-files:
+  created:
+    - modules/cabana/api_tokens_test.go
+    - modules/cabana/token_guard_test.go
+    - modules/cabana/account_tokens_test.go
+    - modules/cabana/token_commands_test.go
+    - modules/cabana/token_postgres_test.go
+    - scripts/check-phase16.3.sh
+    - ../sm-journal-plugin/journal_api_tokens_test.go
+  modified:
+    - modules/cabana/token_scopes_test.go
+    - modules/cabana/token_routes_test.go
+    - modules/bouncer/context_test.go
+    - modules/party/registry_test.go
+    - modules/lagoon/backend_admin_migrations_test.go
+    - admin/tests/account/ApiTokensPanel.test.ts
+    - admin/tests/account/ApiTokenCreateDialog.test.ts
+    - ../sm-journal-plugin/token_scopes_test.go
+    - .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-VALIDATION.md
+
+key-decisions:
+  - "TASK2_START=91830e506f5e61537ae6180c3ff282bf19b81583 (framework Task 1 SHA); Task 2 diffs are *_test.go only"
+  - "Public Journal Show under optional-auth needs published_at in the past, not only published:true"
+  - "Phase gate --all ran postgres PASS on this Docker host (not NOT RUN)"
+
+patterns-established:
+  - "check-phase16.3.sh mirrors 16.2 detectors; PHASE163_REQUIRE_POSTGRES=1 fails --all without Docker"
+  - "Account SPA tests mount /account via helpers.mountApp with deferred fetch for loading skeletons"
+
+requirements-completed: [SC-6, SC-1, SC-2, SC-3, SC-4]
+
+coverage:
+  - id: D1
+    description: "Scope match, Allows, compile/overlap, route gates and SPA plaintext backstop"
+    requirement: SC-6
+    verification:
+      - kind: unit
+        ref: modules/cabana/token_scopes_test.go#TestScopeMatch
+        status: pass
+      - kind: unit
+        ref: modules/cabana/token_routes_test.go#TestTokenRouteGates
+        status: pass
+      - kind: automated_ui
+        ref: admin/tests/account/ApiTokenCreateDialog.test.ts#plaintext lifetime
+        status: pass
+      - kind: integration
+        ref: modules/cabana/token_postgres_test.go#TestBackendTokenPostgres
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Full Go coverage: bouncer, party, lagoon migration, guard, account API, CLI, Journal matrix"
+    requirement: SC-6
+    verification:
+      - kind: unit
+        ref: modules/cabana (16 Docker-free named tests)
+        status: pass
+      - kind: integration
+        ref: modules/lagoon + modules/cabana + sm-journal-plugin Postgres suites (3+4+3)
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "SPA UI-SPEC coverage, phase gate fail-closed, VALIDATION nyquist_compliant"
+    requirement: SC-6
+    verification:
+      - kind: automated_ui
+        ref: npm --prefix admin test (1251 passed)
+        status: pass
+      - kind: other
+        ref: bash scripts/check-phase16.3.sh --all → Phase 16.3 gate passed
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Real-browser clipboard (Manual-Only in VALIDATION)"
+    verification: []
+    human_judgment: true
+    rationale: "Clipboard API permissions differ from happy-dom; kept as Manual-Only row"
+
+duration: 30min
+completed: 2026-10-11
+status: complete
+---
+
+# Phase 16.3 Plan 04: Unit tests, Postgres suites and phase gate Summary
+
+**Phase-ending coverage: every token security rule has a unit test, Docker Postgres suites are green, and `scripts/check-phase16.3.sh --all` ends with `Phase 16.3 gate passed`.**
+
+## Performance
+
+- **Duration:** ~30 min (executor wall clock for plan 04)
+- **Started:** 2026-10-11T11:11:34Z
+- **Completed:** 2026-10-11T11:41:20Z
+- **Tasks:** 3
+- **Files modified:** 16 across summercms.go + sm-journal-plugin
+
+## Accomplishments
+
+- Docker-free Go suite: 16 named cabana tests, bouncer Scope serialization, party Activate order; Journal `TestJournalTokenScopes` with `-short`.
+- Postgres: lagoon migration (3), cabana account/CLI/guard/OpenAPI (4), Journal token matrix (3) — all PASS on this Docker host.
+- Admin SPA: 33 account-token vitest cases; full suite 1251 passed; gate self-test and `--all` green; VALIDATION `nyquist_compliant: true`.
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Tracer deny-by-default** — framework `91830e5`, Journal `7bbafcb` (`test(16.3-04)`)
+2. **Task 2: Full Go coverage** — framework `78124ab`, Journal `58851dd` (`test(16.3-04)`); `TASK2_START=91830e5`
+3. **Task 3: SPA + gate + VALIDATION** — SPA `55999b2`, gate `9b811f6` (`test(16.3): phase gate`), VALIDATION `4635415` (`docs(16.3)`)
+
+**Plan metadata:** (this SUMMARY commit)
+
+_Note: No `fix(...)` production commits were required; Journal create fixture needed `published_at` for public Show (test-only)._
+
+## Test counts
+
+| Repository | Notes |
+|------------|--------|
+| summercms.go | 16 Docker-free cabana named tests; + bouncer/party; Postgres lagoon 3 + cabana 4 |
+| admin SPA | 14 panel + 19 dialog cases; full vitest 1251 |
+| sm-journal-plugin | `TestJournalTokenScopes` (short); Postgres `TestJournalTokens` + tracer + expansion |
+
+## Docker-host commands
+
+```bash
+bash scripts/check-phase16.3.sh --self-test
+bash scripts/check-phase16.3.sh --all          # postgres PASS here
+# or, if NOT RUN postgres was printed:
+bash scripts/check-phase16.3.sh postgres
+```
+
+## Decisions Made
+
+- Public optional-auth Show asserts need `published_at` in the past alongside `published: true`.
+- Gate reports NOT RUN postgres only without Docker; this run executed postgres.
+
+## Deviations from Plan
+
+None material — plan executed as written. Journal Show fixture clarified with `published_at` inside the test file (not a production fix).
+
+## Issues Encountered
+
+None.
+
+## Next Phase Readiness
+
+- Phase 16.3 plans 4/4 complete; ready for `/msd-verify-work` (and optional real-browser clipboard Manual-Only).
+- No blockers.
+
+## Self-Check: PASSED
+
+- Acceptance greps for TestAccountTokens, TestTokenCommands, TestBackendAPITokensMigration, TestJournalTokens: one line each.
+- Task 2 Docker-free count 16; Postgres 3/4/3; gate `--all` last line `Phase 16.3 gate passed`.
+- VALIDATION: `nyquist_compliant: true`, zero TBD rows.

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-CONTEXT.md

@@ -0,0 +1,145 @@
+# Phase 16.3: Backend admin personal API tokens with scopes - Context
+
+**Gathered:** 2026-10-10
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+Backend users can create personal API tokens (`g15_…`) with one or more scopes picked at creation time. The framework `backend` guard accepts such a token as well as the admin JWT, and the request runs as the token's owner. Access is the intersection of the token's scopes and the owner's own permissions. Tokens are managed in the admin SPA (`/account`, own tokens) and through `summer admin:token:*` CLI commands (any user). The Journal plugin registers its scopes and accepts tokens on its write routes, so an agent can manage blog posts as a backend author.
+
+Repos: `summercms.go` (cabana/bouncer guard, token model and migration, scope registry, account API, admin SPA panel, CLI, READMEs and docs); `sm-journal-plugin` (scope registration, switch to the framework principal helper); host applications only for the version bump.
+
+Out of scope: a backend-user management screen, a superuser view of all tokens, migrating Apparatus tokens, Payment and Fonoteka scopes (they register through the same API when their phases need them).
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Scope model
+- **D-01:** Scopes are named and registered by plugins through a new pact capability (working name `pact.HasTokenScopes`). Each scope has a name, a label and description (phrasebook keys), a list of permission patterns (Winter `.*` wildcard semantics, Phase 9 D-03) and a list of allowed HTTP methods. The naming convention is `<plugin>` for full access and `<plugin>:read` for read-only, e.g. `journal` → `golem15.journal.*` with all methods. A duplicate scope name fails boot loudly. — **Reversibility:** costly — plugins implement the capability and stored tokens reference scope names.
+- **D-02:** Read-only is enforced by the scope's method list. A `:read` scope allows only `GET`/`HEAD`, and the framework refuses any other method with 403 before the handler runs. Plugins do not change their handlers for this. A POST that only reads (search) is not reachable with a read scope; that is accepted.
+- **D-03:** A token holds several scopes. A request passes if any one scope allows it, meaning its method list includes the request method and its patterns match every required permission. Scopes are immutable after creation.
+- **D-04:** Framework scopes:
+  - `*` means full access: all methods, and it behaves exactly like the owner.
+  - `admin:read` means system-wide read-only: `GET`/`HEAD` on everything the owner can see.
+
+  Journal registers `journal` and `journal:read`. Payment (`payment:read`) and Fonoteka scopes come with their own phases through the same API.
+- **D-05:** Deny by default. A token reaches a route only when a scope covers it. When `cabana.Allows` is called with an empty permission list under a token, only `*` (and `admin:read` for GET/HEAD) passes; other scoped tokens are refused. `GET /auth/me` is always allowed to any valid token, so an agent can see who it is.
+- **D-06:** An explicit "interactive only" marker covers account changes (`PUT /account`, password, email, avatar), token management (create, list, revoke) and logout/refresh. These routes refuse every token, including `*`, and need an admin JWT session. A leaked token cannot take over the account or mint new tokens. — **Reversibility:** reversible.
+
+### Token lifecycle
+- **D-07:** The format keeps the Apparatus shape: `g15_` + 40 lowercase hex chars (20 random bytes from `crypto/rand`, 160 bits). Only the sha256 hex is stored, in a unique indexed column, along with the last 4 characters as a display hint (`g15_…a1b2`). There is no checksum suffix. — **Reversibility:** one-way — issued tokens live in agent and integration configs.
+- **D-08:** Expiry is optional. The SPA picker offers 30 / 90 / 365 days / never, defaulting to 90 days. The CLI accepts `--expires=30d|90d|365d|never` or a date, also defaulting to 90 days. Expired tokens return 401.
+- **D-09:** Revoking is a soft revoke. It sets `revoked_at` and `revoked_by` and keeps the row for audit. Revoked tokens return 401 and are hidden from the default list, with an option to show them. Name, scopes and expiry cannot be edited: to change one, create a new token and revoke the old one.
+- **D-10:** The owner is loaded fresh on every request through the existing `BackendUsers.FindByID` path. Deactivating (`is_activated=false`) or soft-deleting the owner makes all their tokens fail with 401. A password reset and the JWT `tokens_valid_after` cutoff do **not** invalidate tokens, so routine password changes don't break agents.
+- **D-11:** `last_used_at` is stamped on use, at most once per minute per token, so every request isn't a write. Lists show name, scopes, hint, `created_at`, `last_used_at`, `expires_at`, and revoked state.
+- **D-12:** The table is framework-owned. It is appended to `BackendAdminMigrations` (history id `summercms.cabana`) as a raw-SQL migration with a dated ID. Columns are roughly: id, backend_user_id (FK), name, token_hash (unique), token_hint, scopes (JSON array of names), expires_at, last_used_at, revoked_at, revoked_by, timestamps. Apparatus `golem15_apparatus_personal_api_tokens` rows are **not** migrated.
+
+### Guard and Journal wiring
+- **D-13:** The cabana `backend` guard becomes composite. `Authorization: Bearer g15_…` goes to the token lookup; everything else (Bearer JWT or the admin cookie) goes to the existing `NewBackendJWTGuard` path unchanged. Tokens are accepted only in the Bearer header, never from a cookie or query string. The token row is returned as the bouncer credential (`CredentialGuard`). — **Reversibility:** costly — every backend-authenticated route goes through it.
+- **D-14:** The permission side of the scope check lives in the principal. A token-authenticated `Principal` carries its scopes' permission patterns and methods, and `cabana.Allows` requires **both** an owner grant and a matching scope pattern. Every existing check (admin CRUD `RequiredPermissions`, actions, Journal's direct `Allows` calls) is restricted with no per-route annotation. A superuser holding a scoped token is still limited to the scope. The method check runs once, in the guard or middleware. — **Reversibility:** costly — `Allows` semantics change for every caller.
+- **D-15:** Cabana exports a principal resolver, working name `cabana.BackendPrincipal(r)` or similar, that runs the composite guard plus the scope and method checks for routes that don't sit under the `backend` middleware. Journal's `controllers/api/auth.go` uses it instead of building its own `NewBackendJWTGuard`. Journal's error bodies and status codes stay byte-identical (`{"error":"Authentication required"}` 401, its existing 403). The public read routes stay optional-auth, so a valid token with `journal` or `journal:read` also unlocks drafts where the owner may see them. This reverses Phase 15 D-15. — **Reversibility:** reversible.
+
+### Admin SPA and CLI
+- **D-16:** The SPA panel is an "API tokens" section on `/account` (`AccountView.vue`). It lists, creates and revokes the current user's own tokens only. There is no superuser view of other users' tokens; superusers use the CLI. The plaintext is shown once after creation with a copy button and a clear "you won't see this again" notice, and is never retrievable afterwards.
+- **D-17:** The scope picker lists registered scopes with label and description. It hides scopes that grant the current user nothing (no overlap between the scope's patterns and their grants). `*` is always shown, labelled as full access ("everything you can do"). The server re-validates scope names and the overlap rule on create (422 on an unknown or empty scope).
+- **D-18:** Account token endpoints sit under the admin API (Phase 9 D-09/D-10 envelope), for example `GET/POST /_admin/api/v1/account/tokens`, `DELETE /account/tokens/{id}` (revoke) and `GET /account/tokens/scopes`. They carry swag annotations so the OpenAPI document and the SPA TS types cover them, and they are interactive-only (D-06).
+- **D-19:** CLI commands in cabana, beside `admin:create`:
+  - `admin:token:create <login|email> --name=… --scope=journal [--scope=payment:read] [--expires=90d|never]` prints only the plaintext token to stdout so it can be piped.
+  - `admin:token:list [<login|email>] [--revoked]`
+  - `admin:token:revoke <id>`
+  - `admin:token:scopes` lists registered scopes.
+
+  The CLI may create tokens for any backend user and applies the same overlap validation as D-17.
+- **D-20:** Module READMEs (cabana, bouncer if its API changes, pact for the new capability) and the `docs/` pages cover the token API, the scope registration capability, the framework scopes and the CLI commands, per the project documentation rules. The Journal README documents its scopes and token auth.
+
+### Claude's Discretion
+- Exact names: the pact capability, the scope struct, the principal resolver, the table (`backend_api_tokens` or similar), and the interactive-only marker.
+- How scopes are stored (JSON array vs `text[]`), and what an unknown scope name does at request time after a plugin drops it. Recommended: it grants nothing and is shown as unknown in lists.
+- How the 403 for a scope refusal is reported in the framework envelope (e.g. `details.reason = "token_scope"`).
+- Whether token requests get their own throttle bucket; reuse an existing throttle shape if cheap.
+- How `last_used_at` is debounced (in-memory per process is fine).
+
+</decisions>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Phase origin and prior decisions
+- `.planning/ROADMAP.md` § Phase 16.3 — goal, repos, explore constraints, success criteria
+- `.planning/todos/pending/backend-admin-api-tokens.md` — the todo this phase was promoted from
+- `.planning/notes/apparatus-dissolved-into-framework.md` — why tokens are a framework feature, not an Apparatus port
+- `.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-CONTEXT.md` — D-01..D-04 (backend users, `backend` guard, permission semantics, `admin:create`), D-09/D-10 (admin API paths and envelope)
+- `.planning/phases/15-journal-plugin/15-CONTEXT.md` — D-14/D-15 (Journal write API and the backend-JWT-only rule this phase reverses)
+
+### Reference implementation (behavioral, not ported 1:1)
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/apparatus/models/PersonalApiToken.php` — `g15_` + 40 hex, sha256 storage, expiry, last_used_at
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/apparatus/middleware/TokenAuthenticate.php` — Bearer lookup, expiry, owner check
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/apparatus/Plugin.php` (~lines 335-400) — My Account "API Tokens" tab and create/revoke handlers
+
+### Pattern to copy (Go)
+- `../sm-summercmsio-app/plugins/golem15/user/middleware/api_token.go` — `APITokenGuard`: prefix check, sha256 lookup, last_used stamp, `Scope()` middleware
+- `../sm-summercmsio-app/plugins/golem15/user/classes/api_tokens.go` — `MintAPIToken`, `HashAPIToken`
+- `../sm-summercmsio-app/plugins/golem15/user/models/api_token.go` — `HasScope`
+- `../sm-summercmsio-app/plugins/golem15/user/updates/202610040001_create_api_tokens.go` — token table migration
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- `modules/bouncer/guard.go`: `Guard`, `CredentialGuard`. `modules/bouncer/context.go`: `Principal` (`Backend`, `IsSuperuser`, `PermissionGrants`), `WithUser`, `WithCredential`.
+- `modules/bouncer/jwt.go`: `NewBackendJWTGuard` (:94), `Authenticate` (:106), `bearerToken` (:314). The JWT path stays as-is behind the composite guard.
+- `modules/cabana/auth.go`: `BackendUsers.FindByID` (:40) and `principalFrom` (:103). These are the owner-loading path, already merging role and user grants.
+- `modules/cabana/contracts.go`: `Allows` (:186) and `requiredOf` (:237). This is where scope intersection lands (D-14).
+- `modules/wristband/crypto.go:26-31`: `sha256Hex` and a constant-time compare.
+- `modules/cabana/commands.go`: `admin:create` (:18) and `admin:reset-password` (:107). The new `admin:token:*` commands go beside them.
+- `modules/cabana/account.go` plus `admin/src/views/AccountView.vue`: the existing account API and page that host the tokens panel.
+
+### Established Patterns
+- Plugin capabilities are optional pact interfaces compiled by cabana at boot (`modules/pact/capabilities.go:494` `HasPermissions`, compiled in `modules/cabana/registry.go:182-200`). `HasTokenScopes` follows the same path, including fail-loud validation.
+- Framework-owned migrations are raw-SQL entries appended to `BackendAdminMigrations` (`modules/lagoon/backend_admin_migrations.go:21`).
+- Admin API handlers carry swag annotations; SPA types are generated from OpenAPI.
+- Permission checks happen in handlers, not in route middleware, which is why the scope check belongs in `Allows` and not in per-route annotations.
+
+### Integration Points
+- `modules/cabana/http.go:145-159`: where the `backend` guard is built and registered. The composite guard wraps it here.
+- `modules/bouncer/registry.go:73-113`: `Registry.Middleware` already prefers `CredentialGuard`, so the token row arrives as the credential.
+- `modules/cabana/http.go:245-249`: `/auth/me` and the `/account` routes. The token endpoints and the interactive-only marker go here.
+- `../sm-journal-plugin/controllers/api/auth.go`: `newBackendGuard` (:58), `requireBackendPrincipal` (:99) and `requireAccessPosts` (:113) switch to the cabana resolver (D-15). `posts.go` Index/Show `optionalBackendPrincipal` (:32, :121) do the same.
+- `../sm-journal-plugin/admin_permissions.go:9`: the permission catalog the `journal` scopes map onto.
+
+### Noted during scouting (verify, don't assume)
+- Journal `UploadFeaturedImage` / `DeleteFeaturedImage` (`posts.go:325, :393`) authenticate, but a permission check was not confirmed. Check it while wiring tokens, because a `journal:read` token must not reach them (the method rule covers this, but the permission gap would be a separate bug).
+- Journal's per-user throttle key (`plugin.go:88`) reads `bouncer.User` before any guard runs and likely always falls back to the client IP.
+
+</code_context>
+
+<specifics>
+## Specific Ideas
+
+- Main use case: an agent manages Journal blog posts as a backend author using a `journal`-scoped token. Later, a reporting agent reads Payment Gateway data with `payment:read`.
+- The token panel follows the Apparatus/Winter "My Account → API Tokens" placement.
+- CLI `admin:token:create` output is pipe-friendly (only the token on stdout).
+
+</specifics>
+
+<deferred>
+## Deferred Ideas
+
+- Backend-user management screen, including a superuser view and revoke of other users' tokens: its own phase.
+- `payment:read` scope: registered by the Payment Gateway phase (18.x) through D-01.
+- Fonoteka scopes: when a Fonoteka integration needs token access.
+- Secret-scanner-friendly checksum token format: only if a scanner partnership is pursued.
+
+</deferred>
+
+---
+
+*Phase: 16.3-backend-admin-personal-api-tokens-with-scopes*
+*Context gathered: 2026-10-10*

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-DISCUSSION-LOG.md

@@ -0,0 +1,118 @@
+# Phase 16.3: Backend admin personal API tokens with scopes - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
+
+**Date:** 2026-10-10
+**Phase:** 16.3-backend-admin-personal-api-tokens-with-scopes
+**Areas discussed:** Scope model, Token lifecycle, Guard & Journal wiring, SPA panel & CLI
+
+---
+
+## Scope model
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Named scopes, plugin-registered | Plugins register scopes mapping to permission patterns; framework `*` | ✓ |
+| Scope = permission patterns | Token stores raw permission patterns | |
+| Coarse fixed set | read/write/* like user plugin tokens | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Scope declares methods + patterns | Read scopes allow GET/HEAD only, enforced before handler | ✓ |
+| Read-only permission subset | Read scope maps to view-type permissions | |
+| Both | Methods and permission subset | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Several | Token stores a list; any scope allowing passes | ✓ |
+| Exactly one | One scope per token | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Deny by default, except whoami | Only `/auth/me` open; account/token routes need interactive JWT even with `*` | ✓ |
+| `*` reaches everything | System-wide token can change account and mint tokens | |
+| Allow unchecked routes | Unguarded routes open to any token | |
+
+## Token lifecycle
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Optional, presets | 30/90/365/never, default 90 days | ✓ |
+| Required, capped | Must expire, max 1 year | |
+| Optional, no default | Apparatus as-is | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Owner deactivated or deleted | Password reset / tokens_valid_after do not kill tokens | ✓ |
+| Also on password reset / session cutoff | Tokens respect tokens_valid_after | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Soft revoke, immutable | revoked_at kept for audit; no edits | ✓ |
+| Hard delete, immutable | Apparatus behavior | |
+| Soft revoke, editable name/expiry | Rename and extend allowed | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Keep Apparatus shape + hint | g15_ + 40 hex, sha256, last-4 hint | ✓ |
+| Add checksum | GitHub-style base62 + CRC32 | |
+
+## Guard & Journal wiring
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Bearer header only | Composite guard; g15_ to token lookup, rest to JWT | ✓ |
+| Bearer + query param | Also ?token= | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Framework helper, keep Journal's envelope | cabana resolver replaces Journal's hand-built guard | ✓ |
+| Mount Journal writes under backend middleware | Changes Journal error shape | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Inside the principal / cabana.Allows | Allows intersects owner grants and scope patterns | ✓ |
+| Route middleware per scope | Routes declare RequireScope | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| `*` passes, scoped tokens denied | Empty permission list denied to scoped tokens; interactive-only marker | ✓ |
+| Scoped tokens pass too | Current Allows semantics | |
+
+## SPA panel & CLI
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| /account only, own tokens | Superusers use CLI for others | ✓ |
+| /account + superuser view | New admin screen | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| Only scopes their permissions intersect | Hide useless scopes; `*` always shown; server re-checks | ✓ |
+| All registered scopes | Simpler | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| admin:token:create/list/revoke (+scopes) | Plaintext to stdout once | ✓ |
+| Fewer commands | create and revoke only | |
+
+| Option | Description | Selected |
+|--------|-------------|----------|
+| `*`, journal, journal:read | payment:read later | |
+| Also a framework `admin:read` | System-wide read-only scope | ✓ |
+
+## Claude's Discretion
+
+- Names of the capability, scope struct, resolver, table and interactive-only marker
+- Scope storage type and unknown-scope behavior
+- Scope-refusal 403 details
+- Token throttle bucket
+- last_used_at debounce mechanism
+
+## Deferred Ideas
+
+- Backend-user management screen with superuser token view
+- payment:read scope (Payment Gateway phase)
+- Fonoteka scopes
+- Checksum token format

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-PATTERNS.md

@@ -0,0 +1,468 @@
+# Phase 16.3: Backend admin personal API tokens with scopes - Pattern Map
+
+**Mapped:** 2026-10-11
+**Files analyzed:** 22 (new + modified, across summercms.go and ../sm-journal-plugin)
+**Analogs found:** 21 / 22
+
+All analog paths are git-tracked source (user plugin analogs verified with `git ls-files` inside the `sm-user-plugin` submodule of `../sm-summercmsio-app`).
+
+## File Classification
+
+| New/Modified File | Role | Data Flow | Closest Analog | Match Quality |
+|---|---|---|---|---|
+| `modules/pact/capabilities.go` (+ `TokenScope`, `HasTokenScopes`) | contract/interface | config | `modules/pact/capabilities.go` `Permission`/`HasPermissions` (~:495-506) | exact |
+| `modules/bouncer/context.go` (+ `ScopeLimit`, `Principal.Scope`) | model (context value) | request-response | existing `Principal` fields `Backend`/`IsSuperuser`/`PermissionGrants` (`json:"-"`) | exact |
+| `modules/lagoon/backend_admin_migrations.go` (+ token table) | migration | batch/DDL | same file, entry `202610090001_backend_users_metadata` (:121-132) | exact |
+| `modules/lagoon/backend_admin_migrations_test.go` (fix last-ID test) | test | — | `TestBackendAdminMetadataColumn` (:561-575) | exact |
+| `modules/cabana/api_tokens.go` (model, mint, hash, revoke, debounce) | model/service | CRUD | `sm-user-plugin/classes/api_tokens.go` + `models/api_token.go` | exact |
+| `modules/cabana/token_scopes.go` (compile, cover, overlap) | service | transform | `modules/cabana/registry.go` `compileContributions` (:169-200), `validatePermissions` (:301-308) | role-match |
+| `modules/cabana/token_guard.go` (composite guard, resolver) | middleware/guard | request-response | `sm-user-plugin/middleware/api_token.go` `APITokenGuard` | exact |
+| `modules/cabana/contracts.go` (`Allows` rewrite) | utility | transform | itself (:186-235) | exact |
+| `modules/cabana/csrf.go` or `token_guard.go` (`interactiveOnly`) | middleware (route wrapper) | request-response | `requireAjax` (csrf.go:22-30) | exact |
+| `modules/cabana/account_tokens.go` (4 endpoints) | controller | CRUD | `modules/cabana/account.go` (`accountUpdate` :289, `accountPrincipal` :216, `writeAccountError` :495) | exact |
+| `modules/cabana/http.go` (guard registration :145-160, mount :243-260, Publish resolver) | config/route | request-response | itself | exact |
+| `modules/cabana/admin_openapi.go` (swag stubs) | config (docs) | — | `AdminAccountUpdate` / `AdminMe` stubs (:190-218) | exact |
+| `modules/cabana/commands.go` (`admin:token:*`) | command | CRUD | `admin:create` / `admin:reset-password` (:18-50, :52-104) | exact |
+| `modules/party/registry.go` (publish activated plugins, Option A) | config | — | `app.SetPlugins(orderedIDs)` (:107) + `app.Publish(guards)` in cabana http.go:139 | role-match |
+| `cmd/summer/runtime.go` (delegate rows) | config | — | rows for `admin:create`, `admin:reset-password` (:37-38) | exact |
+| `modules/phrasebook/backend/lang/{en,pl}/lang.yaml` (`api_tokens:` block) | config (i18n) | — | existing `myaccount:` block | exact |
+| `admin/src/components/account/ApiTokensPanel.vue` (+ `ApiTokenCreateDialog.vue`) | component | request-response | `admin/src/views/AccountView.vue` + `admin/src/components/relation/RelationPickerModal.vue` | role-match |
+| `admin/src/views/AccountView.vue` (render panel) | component | — | itself (:247 section, :411 ConfirmDialog) | exact |
+| `admin/src/components/ui/ConfirmDialog.vue` (`[overflow-wrap:anywhere]`) | component | — | itself | exact |
+| `../sm-journal-plugin/token_scopes.go` | config (capability impl) | — | `../sm-journal-plugin/admin_permissions.go` | exact |
+| `../sm-journal-plugin/controllers/api/auth.go` (resolver switch) | middleware helper | request-response | itself (:58-111) | exact |
+| Tests: `modules/cabana/token_*_test.go`, `account_tokens_test.go`, `commands_test.go`, `admin/tests/components/ApiTokensPanel.test.ts`, journal `journal_api_tokens_test.go`, `scripts/check-phase16.3.sh` | test | — | `commands_test.go` (`TestAdminCreateCommand` :24), `auth_test.go` `adminHandler` (:367), `admin/tests/views/AccountView.test.ts`, `admin/tests/relation/RelationPickerModal.test.ts`, `scripts/check-phase16.2.sh` | exact |
+| docs pages / READMEs (cabana, bouncer, pact, party, journal) | docs | — | existing module READMEs; `docs/services/authentication.md`, `docs/console/introduction.md` | role-match |
+
+## Pattern Assignments
+
+### `modules/cabana/token_guard.go` (guard, request-response)
+
+**Analog:** `../sm-summercmsio-app/plugins/golem15/user/middleware/api_token.go` (tracked in sm-user-plugin submodule)
+
+Interface assertions + struct (lines 21-33):
+```go
+type APITokenGuard struct {
+	App      *backpack.App
+	DB       func() *gorm.DB
+	Prefix   string
+	ClientIP func(*http.Request) string
+}
+var (
+	_ bouncer.CredentialGuard    = (*APITokenGuard)(nil)
+	_ bouncer.UnauthorizedWriter = (*APITokenGuard)(nil)
+)
+```
+
+Core lookup (lines 35-80) — copy shape, but: route by `g15_` prefix and delegate non-token requests to the wrapped `NewBackendJWTGuard.Authenticate(r)`; validate `^g15_[0-9a-f]{40}$` before DB; add `revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())`; owner via `lazyBackendUsers.FindByID`; **do not fail auth when the last_used write fails** (analog does — anti-pattern, research §Anti-Patterns):
+```go
+secret := BearerToken(r)
+if secret == "" || !strings.HasPrefix(secret, prefix) {
+	return nil, nil, errInvalidAPIToken
+}
+...
+db = db.WithContext(r.Context())
+var token models.APIToken
+result := db.Where("token_hash = ?", classes.HashAPIToken(secret)).Limit(1).Find(&token)
+now := time.Now()
+if result.Error != nil || result.RowsAffected == 0 || !token.IsUsableAt(now) {
+	return nil, nil, errInvalidAPIToken
+}
+principal, err := classes.PrincipalByID(r.Context(), db, token.UserID)
+...
+return principal, &token, nil
+```
+
+WriteUnauthorized (lines 84-86) — cabana version switches on `errors.As(err, *ScopeError)` → 403 `WriteErrorDetails(..., "forbidden", ..., {"reason":"token_scope"})`, else existing `writeUnauthenticated` 401 envelope:
+```go
+func (g *APITokenGuard) WriteUnauthorized(w http.ResponseWriter, _ error) {
+	wire.WriteJSON(w, http.StatusUnauthorized, map[string]any{"error": true, "message": "Invalid token."})
+}
+```
+
+Bearer extraction (lines 119-129):
+```go
+func BearerToken(r *http.Request) string {
+	if r == nil { return "" }
+	token, ok := strings.CutPrefix(strings.TrimSpace(r.Header.Get("Authorization")), "Bearer ")
+	if !ok { return "" }
+	return strings.TrimSpace(token)
+}
+```
+(cabana already has `bouncer/jwt.go` `bearerToken` :314 — export it or keep a local copy.)
+
+Credential consumption pattern for `interactiveOnly` (analog `Scope` middleware, lines 89-102):
+```go
+credential, _ := bouncer.Credential(r.Context())
+token, ok := credential.(*models.APIToken)
+if !ok || token == nil || !token.HasScope(scope) { ... 403 ... }
+```
+
+**Registration point** — `modules/cabana/http.go` lines 145-160 (replace `guard` with the composite wrapping it):
+```go
+bl := adminBlacklist(app)
+users := lazyBackendUsers{app: app, reg: reg}
+guard := bouncer.NewBackendJWTGuard(secret, users, bl, writeUnauthenticated, AdminCookieName)
+if owner, taken := guards.Owner("backend"); !taken {
+	if err := guards.Register("summercms.cabana", "backend", guard); err != nil {
+		return nil, fmt.Errorf("cabana: backend guard: %w", err)
+	}
+} else if owner != "summercms.cabana" { ... }
+```
+Publish the resolver next to `app.Publish(guards)` (http.go ~:139) — same idiom.
+
+---
+
+### `modules/cabana/api_tokens.go` (model/service, CRUD)
+
+**Analogs:** `sm-user-plugin/classes/api_tokens.go`, `sm-user-plugin/models/api_token.go`
+
+Model (models/api_token.go :11-27) — copy tag style; table `backend_api_tokens`, field `BackendUserID`, add `TokenHint`, `RevokedBy *uint`; `Scopes lagoon.Jsonable[[]string]`:
+```go
+type APIToken struct {
+	ID         uint                      `gorm:"column:id;primaryKey"`
+	UserID     uint                      `gorm:"column:user_id"`
+	Name       *string                   `gorm:"column:name"`
+	TokenHash  string                    `gorm:"column:token_hash" json:"-"`
+	Scopes     lagoon.Jsonable[[]string] `gorm:"column:scopes"`
+	ExpiresAt  *time.Time                `gorm:"column:expires_at"`
+	RevokedAt  *time.Time                `gorm:"column:revoked_at"`
+	LastUsedAt *time.Time                `gorm:"column:last_used_at"`
+	CreatedAt  time.Time                 `gorm:"column:created_at"`
+	UpdatedAt  time.Time                 `gorm:"column:updated_at"`
+}
+func (APIToken) TableName() string { return "user_api_tokens" }
+```
+
+Mint / hash / revoke (classes/api_tokens.go :47-112) — keep name trim + dedupe scopes; change secret to `g15_` + `hex(20 bytes)` (RESEARCH "Mint and hash"), name max 100:
+```go
+name = strings.TrimSpace(name)
+...
+seenScopes := make(map[string]bool, len(scopes))   // dedupe, keep order
+...
+token := &models.APIToken{
+	UserID: userID, Name: &name, TokenHash: HashAPIToken(secret),
+	Scopes: lagoon.Jsonable[[]string]{Data: scopes, Valid: true}, ExpiresAt: expiresAt,
+}
+
+func HashAPIToken(secret string) string {
+	sum := sha256.Sum256([]byte(secret))
+	return hex.EncodeToString(sum[:])
+}
+
+func RevokeAPIToken(db *gorm.DB, token *models.APIToken) error {
+	now := time.Now()
+	if err := db.Model(token).Update("revoked_at", now).Error; err != nil { return err }
+	token.RevokedAt = &now
+	return nil
+}
+```
+Constant-time compare: `modules/wristband/crypto.go:26-31`. Debounced stamp: RESEARCH "Debounced last_used_at" (sync.Map + conditional UPDATE, log on error via `slog.Default().WarnContext`).
+
+---
+
+### `modules/pact/capabilities.go` (+ `TokenScope`, `HasTokenScopes`)
+
+**Analog:** same file (~:495-506):
+```go
+// Permission is one registerPermissions() entry.
+type Permission struct {
+	Code  string
+	Tab   string
+	Label string
+	Roles []string
+}
+
+// HasPermissions is implemented by plugins that declare backend permissions.
+type HasPermissions interface {
+	Permissions() []Permission
+}
+```
+Add `TokenScope{Name, Label, Description, Permissions, Methods}` + `HasTokenScopes{ TokenScopes() []TokenScope }` with the same one-line doc-comment style; optional `TokenReadMethods = []string{"GET","HEAD"}`.
+
+---
+
+### `modules/cabana/token_scopes.go` (compile + cover, transform)
+
+**Analog:** `modules/cabana/registry.go` `compileContributions` (:169-200) — capability type-assert loop, fail-loud duplicate:
+```go
+for _, plugin := range plugins {
+	if plugin == nil { continue }
+	if src, ok := plugin.(pact.HasPermissions); ok && src != nil {
+		for _, permission := range src.Permissions() {
+			if !permissionCode(permission.Code, false) {
+				return fmt.Errorf("cabana: plugin %s registered invalid permission %q", plugin.ID(), permission.Code)
+			}
+			if _, exists := reg.permissions[permission.Code]; exists {
+				return fmt.Errorf("cabana: duplicate permission %s", permission.Code)
+			}
+			...
+```
+Validation reuse (:301-308):
+```go
+func (r *Registry) validatePermissions(owner string, permissions []string) error {
+	for _, code := range permissions {
+		if !permissionCode(code, true) || !r.permissionExists(code) {
+			return fmt.Errorf("cabana: %s references unknown permission %s", owner, code)
+		}
+	}
+	return nil
+}
+```
+Phrase-key existence: follow `validateMessageKeys` (messages.go:322-326), called from http.go ~:131 when a `*phrasebook.Translator` is published. Write `scopeCovers` fresh — do NOT reuse `granted()` (contracts.go:203-235), see RESEARCH Pattern 2.
+
+---
+
+### `modules/cabana/contracts.go` (`Allows`)
+
+**Analog:** itself (:186-199); target shape in RESEARCH Pattern 2 (scope evaluated before the `IsSuperuser` short-circuit).
+
+---
+
+### `interactiveOnly` route wrapper
+
+**Analog:** `modules/cabana/csrf.go:22-30`:
+```go
+func requireAjax(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !csrfSafe(r) {
+			WriteError(w, http.StatusForbidden, "forbidden", msgForbidden)
+			return
+		}
+		next(w, r)
+	}
+}
+```
+Apply in `mount` (http.go :243-249) composed as `interactiveOnly(requireAjax(s.accountUpdate))`:
+```go
+r.GroupRaw(api, []string{"backend"}, func(g pact.Router) {
+	g.Get("/auth/me", s.me)
+	g.Put("/account", requireAjax(s.accountUpdate))
+	g.Post("/account/avatar", requireAjax(s.avatarUpload))
+	g.Delete("/account/avatar", requireAjax(s.avatarRemove))
+	g.Get("/navigation", s.navigation)
+	g.Get("/field-types", s.fieldTypesList)              // needs explicit token gate (Pitfall 2)
+	g.Post("/markdown/preview", requireAjax(s.markdownPreview)) // same
+```
+`/auth/refresh` and `/auth/logout` are mounted outside the guard (:228-236) — add explicit `g15_` refusal + tests.
+
+---
+
+### `modules/cabana/account_tokens.go` (controller, CRUD)
+
+**Analog:** `modules/cabana/account.go`
+
+Principal (:216-224):
+```go
+func accountPrincipal(w http.ResponseWriter, r *http.Request) *bouncer.Principal {
+	principal, ok := bouncer.User(r.Context())
+	if !ok || principal == nil || !principal.Backend || principal.ID == 0 {
+		WriteError(w, http.StatusUnauthorized, "unauthenticated", msgUnauthenticated)
+		return nil
+	}
+	return principal
+}
+```
+Handler skeleton (:289-310): principal → `s.decodeCappedObject(w, r)` → `writeRelationError` on decode → `s.translator()` → `&ValidationError{Details: ...}` via `writeCRUDError` → `s.db()` with slog + 500:
+```go
+func (s *service) accountUpdate(w http.ResponseWriter, r *http.Request) {
+	principal := accountPrincipal(w, r)
+	if principal == nil { return }
+	body, err := s.decodeCappedObject(w, r)
+	if err != nil { writeRelationError(w, err); return }
+	tr := s.translator()
+	if details := refusedAccountKeys(r.Context(), tr, body); len(details) > 0 {
+		writeCRUDError(w, &ValidationError{Details: details})
+		return
+	}
+	db, err := s.db()
+	if err != nil {
+		slog.Default().ErrorContext(r.Context(), "cabana: account update without a database", "error", err)
+		WriteError(w, http.StatusInternalServerError, "error", msgServerError)
+		return
+	}
+```
+Messages: `backendMessage(ctx, tr, key, fallback)` (:246) for `api_tokens.name_required` etc.; `fieldDetail("scopes", msg)` for single-field 422. Error tail: copy `writeAccountError` (:495-507).
+
+---
+
+### `modules/cabana/admin_openapi.go` (swag stubs)
+
+**Analog:** `AdminAccountUpdate` (:204-219) / `AdminMe` (:190-202):
+```go
+// AdminAccountUpdate documents PUT /account.
+//
+// @Summary Update my account
+// @Description ...
+// @Tags admin
+// @Accept json
+// @Produce json
+// @Security BackendBearer
+// @Param body body AdminAccountRequest true "Profile and optional password change"
+// @Success 200 {object} Envelope[AdminProfile]
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 403 {object} ErrorEnvelope
+// @Failure 422 {object} ErrorEnvelope
+// @Router /account [put]
+func AdminAccountUpdate() {}
+```
+Also update the `BackendBearer` description at :10 (`Send "Bearer {access_token}"`) to mention `g15_` tokens. Create must document 201 (Pitfall 8). Regenerate via `scripts/check-admin-openapi.sh`; add routes to `phase09Routes` (security_coverage_test.go:34), `conformCases()` (openapi_conformance_test.go).
+
+---
+
+### `modules/lagoon/backend_admin_migrations.go` (migration)
+
+**Analog:** last entry (:121-132):
+```go
+{
+	// WinterCMS ...: a nullable jsonable column. It is TEXT, not JSONB ...
+	ID: "202610090001_backend_users_metadata",
+	Migrate: func(tx *gorm.DB) error {
+		return tx.Exec(`ALTER TABLE backend_users ADD COLUMN IF NOT EXISTS metadata TEXT`).Error
+	},
+	Rollback: func(tx *gorm.DB) error {
+		return tx.Exec(`ALTER TABLE backend_users DROP COLUMN IF EXISTS metadata`).Error
+	},
+},
+```
+Multi-statement `stmts := []string{...}` loop: first entry (:23-...). Full DDL in RESEARCH "Migration entry". Update the package doc comment above `BackendAdminMigrations` (:15-21) to mention the token table. Fix `TestBackendAdminMetadataColumn` (test :561-575) in the same commit.
+
+---
+
+### `modules/cabana/commands.go` (`admin:token:*`)
+
+**Analog:** same file :18-50 (command table) and :52-104 (`adminCreate`):
+```go
+{
+	Name:        "admin:reset-password",
+	Description: "Reset a backend administrator password and revoke existing tokens",
+	Args: []bonfire.Arg{{Name: "identifier", Description: "Login or email", Required: true}},
+	Flags: []bonfire.Flag{{Name: "password", Description: "..."}},
+	Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
+		return adminResetPassword(ctx, app, in, out)
+	},
+},
+```
+Body idiom: `flagValue(in, "...")`, `in.Argument("identifier")`, `withAdminDB(ctx, app, func(gdb *gorm.DB) error { return gdb.WithContext(ctx).Transaction(...) })`, errors prefixed `"cabana: ..."`. `--scope` uses `bonfire.Flag{Repeatable: true}` (bonfire/command.go:42-48). **Divergence:** `admin:token:create` must print only `out.Println(token)` — never `out.Success` (stdout == stderr in generated mains, Pitfall 7). Identifier resolution: reuse `findBackendLogin`. Plugin list: look up the party-published slice at Run time (Option A).
+
+Tests: copy `TestAdminCreateCommand` (commands_test.go:24) harness.
+
+---
+
+### `../sm-journal-plugin/token_scopes.go`
+
+**Analog:** `../sm-journal-plugin/admin_permissions.go` (:1-25):
+```go
+package journal
+
+import "git.golem15.com/golem15/summercms/modules/pact"
+
+const journalPermissionTab = "golem15.journal::lang.journal.tab"
+
+// Permissions is the plugin's Winter registerPermissions() catalog. ...
+func (*Plugin) Permissions() []pact.Permission {
+	return []pact.Permission{
+		{
+			Code:  "golem15.journal.manage_settings",
+			Tab:   journalPermissionTab,
+			Label: "golem15.journal::lang.journal.manage_settings",
+			Roles: []string{"developer"},
+		},
+```
+`func (*Plugin) TokenScopes() []pact.TokenScope` returning `journal` and `journal:read` (`golem15.journal.*`), labels under `golem15.journal::lang.scopes.*` in `lang/{en,pl}/lang.yaml`.
+
+---
+
+### `../sm-journal-plugin/controllers/api/auth.go` (resolver switch)
+
+**Analog:** itself. Replace `newBackendGuard` (:58-81, the nil-`*cabana.Registry` bug, Pitfall 4) with the cabana resolver looked up per request; keep bodies byte-identical:
+```go
+func writeAuthRequired(w http.ResponseWriter, _ error) {
+	writeAPIError(w, http.StatusUnauthorized, errAuthenticationRequired)
+}
+
+func optionalBackendPrincipal(app *backpack.App, r *http.Request) *http.Request {
+	if r == nil || !hasBearer(r) { return r }
+	pr, err := newBackendGuard(app, nil).Authenticate(r)
+	if err != nil || pr == nil { return r }
+	return r.WithContext(bouncer.WithUser(r.Context(), pr))
+}
+
+func requireBackendPrincipal(app *backpack.App, w http.ResponseWriter, r *http.Request) (*http.Request, *bouncer.Principal, bool) {
+	pr, err := newBackendGuard(app, writeAuthRequired).Authenticate(r)
+	if err != nil || pr == nil {
+		writeAuthRequired(w, err)
+		return r, nil, false
+	}
+	r = r.WithContext(bouncer.WithUser(r.Context(), pr))
+	return r, pr, true
+}
+```
+Map `ErrTokenScope` → `writeAPIError(w, 403, errInsufficientPerms)`; pass cover `"golem15.journal.*"`. Same for posts.go Index/Show (:32, :121) and featured-image handlers (:325, :393).
+
+---
+
+### `admin/src/components/account/ApiTokensPanel.vue` (+ `ApiTokenCreateDialog.vue`)
+
+**Analogs:** `admin/src/views/AccountView.vue`, `admin/src/components/relation/RelationPickerModal.vue`
+
+Imports (AccountView.vue :2-14):
+```ts
+import { computed, nextTick, ref } from 'vue'
+import { CircleAlert, ImageUp, Trash2 } from '@lucide/vue'
+import { api } from '../api/client'
+import type { AdminAccountRequest } from '../api/types'
+import { t } from '../app/i18n'
+import { controlClass } from '../components/form/control'
+import { fieldErrors, focusField } from '../components/form/formState'
+import Button from '../components/ui/Button.vue'
+import { useConfirm } from '../components/ui/confirm'
+import { showToast } from '../state/useToasts'
+```
+API + 422 handling (AccountView.vue :219-233):
+```ts
+const result = await api.PUT('/account', { body: payload() })
+...
+errors.value = fieldErrors(result.error?.error.details)
+...
+focusField(ID_PREFIX, first)
+```
+Card class: AccountView.vue :255 `flex flex-col gap-3 rounded-card border border-border bg-surface p-7 shadow-card` (UI-SPEC uses `gap-4`).
+Shared confirm: AccountView.vue :92 `const confirm = useConfirm()`, `confirm.ask({...}, run)` (confirm.ts:28), single `<ConfirmDialog>` at :411-419 — pass `confirm` to the panel as a prop.
+Dialog shell (RelationPickerModal.vue :3-11): `DialogRoot, DialogPortal, DialogOverlay, DialogContent, DialogTitle, DialogDescription, DialogClose` from `reka-ui`; classes verbatim per UI-SPEC §4. Segmented control classes: `PermissionEditorField.vue`. Date format: reuse the `CellValue.vue` datetime formatter.
+
+AccountView.vue edit: render `<ApiTokensPanel :confirm="confirm" />` after the `<form>` (ends ~:409), before `<ConfirmDialog>`.
+
+Tests: `admin/tests/views/AccountView.test.ts` and `admin/tests/relation/RelationPickerModal.test.ts` (note: `admin/tests/components/` does not exist yet — either create it or place the test under `admin/tests/views/` / a new `admin/tests/account/`).
+
+## Shared Patterns
+
+### Admin error envelope
+**Source:** `modules/cabana` `WriteError(w, status, code, msg)`, `WriteErrorDetails`, `writeCRUDError(w, &ValidationError{Details: ...})`, `fieldDetail`.
+**Apply to:** token guard 401/403, interactiveOnly, account token endpoints, route gates on `/field-types` and `/markdown/preview`.
+
+### Principal retrieval
+**Source:** `bouncer.User(r.Context())`, `bouncer.Credential(r.Context())`; `accountPrincipal` (account.go:216).
+**Apply to:** all account token handlers, `interactiveOnly`.
+
+### Fail-loud capability compile
+**Source:** `compileContributions` (registry.go:169), errors `fmt.Errorf("cabana: ...")`.
+**Apply to:** scope registration.
+
+### Logging
+`slog.Default().ErrorContext/WarnContext(ctx, "cabana: ...", "key", val)` — never log plaintext or Authorization.
+
+### Documentation
+Every exported identifier/CLI command change updates the module README and `docs/` (TestDocsTree). Add `admin:token:*` to `cmd/summer/runtime.go` delegate table (:37-38) and `docs/console/introduction.md`.
+
+## No Analog Found
+
+| File | Role | Data Flow | Reason |
+|---|---|---|---|
+| `scopeCovers` wildcard-vs-wildcard logic (in `token_scopes.go`) | utility | transform | `granted()` has different semantics; write fresh with table tests (RESEARCH Pattern 2) |
+
+## Metadata
+
+**Analog search scope:** `modules/{cabana,bouncer,pact,lagoon,party,bonfire}`, `admin/src`, `admin/tests`, `cmd/summer`, `../sm-journal-plugin`, `../sm-summercmsio-app/plugins/golem15/user`
+**Files scanned:** ~20
+**Pattern extraction date:** 2026-10-11

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-RESEARCH.md

@@ -0,0 +1,726 @@
+# Phase 16.3: Backend admin personal API tokens with scopes - Research
+
+**Researched:** 2026-10-11
+**Domain:** Go admin authentication (bouncer/cabana guard), permission/scope intersection, framework migration, admin SPA (Vue 3), bonfire CLI, Journal plugin wiring
+**Confidence:** HIGH (every finding below is read from this repo and its sibling repos this session; no new external packages)
+
+<user_constraints>
+## User Constraints (from CONTEXT.md)
+
+### Locked Decisions
+
+#### Scope model
+- **D-01:** Scopes are named and registered by plugins through a new pact capability (working name `pact.HasTokenScopes`). Each scope has a name, a label and description (phrasebook keys), a list of permission patterns (Winter `.*` wildcard semantics, Phase 9 D-03) and a list of allowed HTTP methods. The naming convention is `<plugin>` for full access and `<plugin>:read` for read-only, e.g. `journal` → `golem15.journal.*` with all methods. A duplicate scope name fails boot loudly. — **Reversibility:** costly — plugins implement the capability and stored tokens reference scope names.
+- **D-02:** Read-only is enforced by the scope's method list. A `:read` scope allows only `GET`/`HEAD`, and the framework refuses any other method with 403 before the handler runs. Plugins do not change their handlers for this. A POST that only reads (search) is not reachable with a read scope; that is accepted.
+- **D-03:** A token holds several scopes. A request passes if any one scope allows it, meaning its method list includes the request method and its patterns match every required permission. Scopes are immutable after creation.
+- **D-04:** Framework scopes:
+  - `*` means full access: all methods, and it behaves exactly like the owner.
+  - `admin:read` means system-wide read-only: `GET`/`HEAD` on everything the owner can see.
+
+  Journal registers `journal` and `journal:read`. Payment (`payment:read`) and Fonoteka scopes come with their own phases through the same API.
+- **D-05:** Deny by default. A token reaches a route only when a scope covers it. When `cabana.Allows` is called with an empty permission list under a token, only `*` (and `admin:read` for GET/HEAD) passes; other scoped tokens are refused. `GET /auth/me` is always allowed to any valid token, so an agent can see who it is.
+- **D-06:** An explicit "interactive only" marker covers account changes (`PUT /account`, password, email, avatar), token management (create, list, revoke) and logout/refresh. These routes refuse every token, including `*`, and need an admin JWT session. A leaked token cannot take over the account or mint new tokens. — **Reversibility:** reversible.
+
+#### Token lifecycle
+- **D-07:** The format keeps the Apparatus shape: `g15_` + 40 lowercase hex chars (20 random bytes from `crypto/rand`, 160 bits). Only the sha256 hex is stored, in a unique indexed column, along with the last 4 characters as a display hint (`g15_…a1b2`). There is no checksum suffix. — **Reversibility:** one-way — issued tokens live in agent and integration configs.
+- **D-08:** Expiry is optional. The SPA picker offers 30 / 90 / 365 days / never, defaulting to 90 days. The CLI accepts `--expires=30d|90d|365d|never` or a date, also defaulting to 90 days. Expired tokens return 401.
+- **D-09:** Revoking is a soft revoke. It sets `revoked_at` and `revoked_by` and keeps the row for audit. Revoked tokens return 401 and are hidden from the default list, with an option to show them. Name, scopes and expiry cannot be edited: to change one, create a new token and revoke the old one.
+- **D-10:** The owner is loaded fresh on every request through the existing `BackendUsers.FindByID` path. Deactivating (`is_activated=false`) or soft-deleting the owner makes all their tokens fail with 401. A password reset and the JWT `tokens_valid_after` cutoff do **not** invalidate tokens, so routine password changes don't break agents.
+- **D-11:** `last_used_at` is stamped on use, at most once per minute per token, so every request isn't a write. Lists show name, scopes, hint, `created_at`, `last_used_at`, `expires_at`, and revoked state.
+- **D-12:** The table is framework-owned. It is appended to `BackendAdminMigrations` (history id `summercms.cabana`) as a raw-SQL migration with a dated ID. Columns are roughly: id, backend_user_id (FK), name, token_hash (unique), token_hint, scopes (JSON array of names), expires_at, last_used_at, revoked_at, revoked_by, timestamps. Apparatus `golem15_apparatus_personal_api_tokens` rows are **not** migrated.
+
+#### Guard and Journal wiring
+- **D-13:** The cabana `backend` guard becomes composite. `Authorization: Bearer g15_…` goes to the token lookup; everything else (Bearer JWT or the admin cookie) goes to the existing `NewBackendJWTGuard` path unchanged. Tokens are accepted only in the Bearer header, never from a cookie or query string. The token row is returned as the bouncer credential (`CredentialGuard`). — **Reversibility:** costly — every backend-authenticated route goes through it.
+- **D-14:** The permission side of the scope check lives in the principal. A token-authenticated `Principal` carries its scopes' permission patterns and methods, and `cabana.Allows` requires **both** an owner grant and a matching scope pattern. Every existing check (admin CRUD `RequiredPermissions`, actions, Journal's direct `Allows` calls) is restricted with no per-route annotation. A superuser holding a scoped token is still limited to the scope. The method check runs once, in the guard or middleware. — **Reversibility:** costly — `Allows` semantics change for every caller.
+- **D-15:** Cabana exports a principal resolver, working name `cabana.BackendPrincipal(r)` or similar, that runs the composite guard plus the scope and method checks for routes that don't sit under the `backend` middleware. Journal's `controllers/api/auth.go` uses it instead of building its own `NewBackendJWTGuard`. Journal's error bodies and status codes stay byte-identical (`{"error":"Authentication required"}` 401, its existing 403). The public read routes stay optional-auth, so a valid token with `journal` or `journal:read` also unlocks drafts where the owner may see them. This reverses Phase 15 D-15. — **Reversibility:** reversible.
+
+#### Admin SPA and CLI
+- **D-16:** The SPA panel is an "API tokens" section on `/account` (`AccountView.vue`). It lists, creates and revokes the current user's own tokens only. There is no superuser view of other users' tokens; superusers use the CLI. The plaintext is shown once after creation with a copy button and a clear "you won't see this again" notice, and is never retrievable afterwards.
+- **D-17:** The scope picker lists registered scopes with label and description. It hides scopes that grant the current user nothing (no overlap between the scope's patterns and their grants). `*` is always shown, labelled as full access ("everything you can do"). The server re-validates scope names and the overlap rule on create (422 on an unknown or empty scope).
+- **D-18:** Account token endpoints sit under the admin API (Phase 9 D-09/D-10 envelope), for example `GET/POST /_admin/api/v1/account/tokens`, `DELETE /account/tokens/{id}` (revoke) and `GET /account/tokens/scopes`. They carry swag annotations so the OpenAPI document and the SPA TS types cover them, and they are interactive-only (D-06).
+- **D-19:** CLI commands in cabana, beside `admin:create`:
+  - `admin:token:create <login|email> --name=… --scope=journal [--scope=payment:read] [--expires=90d|never]` prints only the plaintext token to stdout so it can be piped.
+  - `admin:token:list [<login|email>] [--revoked]`
+  - `admin:token:revoke <id>`
+  - `admin:token:scopes` lists registered scopes.
+
+  The CLI may create tokens for any backend user and applies the same overlap validation as D-17.
+- **D-20:** Module READMEs (cabana, bouncer if its API changes, pact for the new capability) and the `docs/` pages cover the token API, the scope registration capability, the framework scopes and the CLI commands, per the project documentation rules. The Journal README documents its scopes and token auth.
+
+### Claude's Discretion
+- Exact names: the pact capability, the scope struct, the principal resolver, the table (`backend_api_tokens` or similar), and the interactive-only marker.
+- How scopes are stored (JSON array vs `text[]`), and what an unknown scope name does at request time after a plugin drops it. Recommended: it grants nothing and is shown as unknown in lists.
+- How the 403 for a scope refusal is reported in the framework envelope (e.g. `details.reason = "token_scope"`).
+- Whether token requests get their own throttle bucket; reuse an existing throttle shape if cheap.
+- How `last_used_at` is debounced (in-memory per process is fine).
+
+### Deferred Ideas (OUT OF SCOPE)
+- Backend-user management screen, including a superuser view and revoke of other users' tokens: its own phase.
+- `payment:read` scope: registered by the Payment Gateway phase (18.x) through D-01.
+- Fonoteka scopes: when a Fonoteka integration needs token access.
+- Secret-scanner-friendly checksum token format: only if a scanner partnership is pursued.
+</user_constraints>
+
+<phase_requirements>
+## Phase Requirements
+
+No requirement IDs are mapped (ROADMAP: "Requirements: TBD"). The success criteria are the coverage source.
+
+| ID | Description | Research Support |
+|----|-------------|------------------|
+| SC-1 | `backend` guard accepts a valid, unexpired, unrevoked `g15_` token as well as the backend JWT; request runs as the token's user | Composite guard (Pattern 1), registration point `http.go:145-160`, `Registry.Middleware` credential handling `registry.go:83-99` |
+| SC-2 | Out-of-scope requests refused even when the role allows; token never exceeds owner | `Allows` rewrite (Pattern 2), method filter in guard (Pattern 1), unchecked-route audit (Pitfall 2), owner-branch bypass in Journal (Pitfall 3) |
+| SC-3 | Create/list/revoke own tokens in SPA, plaintext shown once; CLI for any user | Account token API (Pattern 5), interactive-only marker (Pattern 4), SPA pipeline, CLI (Pattern 7, Pitfall 6/7) |
+| SC-4 | Journal accepts a Journal-scoped token for writes | Resolver (Pattern 3), Journal call sites, `*cabana.Registry` never published (Pitfall 4) |
+| SC-5 | READMEs and `docs/` cover token API, scopes, CLI | Docs tooling section, `docsCommands` and `delegateCommands` tables |
+| SC-6 | Unit tests in the last plan | Validation Architecture |
+</phase_requirements>
+
+## Project Constraints (from CLAUDE.md)
+
+- Lean planning: fewer, larger plans; **present the plan count with one-line scopes and wait for confirmation before writing PLAN.md files**.
+- Unit tests are always the **last plan** of the phase; earlier plans may carry smoke tests only.
+- Standard library first (`net/http`, `encoding/json`, `crypto/*`). A dependency is added only when a research doc or phase decision names it. This phase needs **no new Go or npm dependency**.
+- Compiled plugins; no runtime plugin loading.
+- `go vet` and `go test ./...` green at every commit.
+- Commits: no co-author tags; one logical change per commit; planning docs and code in separate commits.
+- Any change to a `modules/` package's exported API, config keys, CLI commands or dependencies updates that module's `README.md` **and** affected `docs/` pages in the same change. Framework READMEs never name a consuming application (say "host application"; examples use `blog`/`acme`).
+- Every identifier named in a README/docs page must exist; `go test ./cmd/summer -run TestDocsTree` and `summer docs:build --check` verify identifiers, links, anchors, `src=` snippets, command names and consuming-application names. Config keys are not checked automatically.
+- Core plugin contracts (user, blog, pages, payment) must be preserved.
+- Two repos are written in this phase: `summercms.go` (framework) and `../sm-journal-plugin`; host apps only bump versions.
+
+## Summary
+
+The framework already has every seam this phase needs, and none of them needs a new library. `bouncer.Registry.Middleware` already prefers a `CredentialGuard` and stores the returned credential on the context; `bouncer.UnauthorizedWriter` receives the guard's error, so one composite guard can answer 401 for bad tokens and 403 for a method refusal from the same hook. Cabana registers its own `backend` guard at one point (`http.go:145-160`), so wrapping it is a local change. All permission enforcement in cabana funnels through `cabana.Allows` (no handler reads `IsSuperuser` or `PermissionGrants` directly), which makes D-14's "restrict in `Allows`" approach sound — provided the principal carries a method-filtered scope limit and `Allows` stops short-circuiting on `IsSuperuser` for scoped principals.
+
+Four findings change the plan's shape. (1) `*cabana.Registry` is never published to the app, so Journal's `newBackendGuard` always builds `BackendUsers{Registry: nil}` and silently drops code-declared role grants; the D-15 resolver must be published by `cabana.Activate` and fixes this as a side effect. (2) Several cabana routes (`/field-types`, `/markdown/preview`) and two Journal handlers (`UploadFeaturedImage`, `DeleteFeaturedImage`, plus draft visibility via `canViewDraft`) authorize by ownership or authentication only, never through `Allows`; under a scoped token they would be reachable by an unrelated scope, so deny-by-default needs explicit gates there. (3) `cabana.RuntimeCommands(app)` takes no plugin list and is called from generated `main.go` files in every host app, so the CLI cannot see plugin scopes without either a signature change (forcing regenerated mains) or a published plugin list. (4) Appending to `BackendAdminMigrations` breaks `TestBackendAdminMetadataColumn`, which pins the last migration ID.
+
+**Primary recommendation:** Build a cabana-owned composite `backend` guard that routes `Bearer g15_…` to a sha256 lookup, loads the owner through the existing `lazyBackendUsers`, method-filters the token's scopes into a `bouncer.Principal` scope limit, and publishes a resolver for Journal; rewrite `Allows` as "owner grant AND scope cover, per code"; gate every non-`Allows` route explicitly; keep all crypto in stdlib.
+
+## Architectural Responsibility Map
+
+| Capability | Primary Tier | Secondary Tier | Rationale |
+|------------|-------------|----------------|-----------|
+| Token minting, hashing, lookup | API / Backend (cabana) | Database (token table) | Secret generation and hashing never leave the server; only sha256 is persisted |
+| Scope registry (plugin-declared) | API / Backend (cabana compile at boot, pact interface) | — | Same compile path as `HasPermissions`; fail-loud at boot |
+| Scope ∩ permission enforcement | API / Backend (`cabana.Allows`, guard method filter) | — | Handlers already call `Allows`; method filter needs request context |
+| Interactive-only refusal | API / Backend (route wrapper) | — | Must run before handler, per route |
+| Journal token acceptance | API / Backend (cabana resolver used by Journal handlers) | — | Journal routes are not under the `backend` middleware |
+| Token panel (list/create/revoke, show once) | Browser / Client (admin SPA) | API (account token endpoints) | Plaintext lives only in component state; server owns validation |
+| Scope label translation | API / Backend | Browser | Plugin phrase keys are outside the `backend::lang.` bundle the SPA loads |
+| CLI token management | API / Backend process (bonfire command in app binary) | Database | Runs without HTTP; needs plugin scope catalog |
+| Token table schema | Database / Storage | — | Framework-owned migration under `summercms.cabana` history |
+
+## Standard Stack
+
+### Core (all already in the repo — nothing to install)
+
+| Library | Version | Purpose | Why Standard |
+|---------|---------|---------|--------------|
+| `crypto/rand` (stdlib) | Go 1.27.0 | 20 random bytes per token | CSPRNG; D-07 |
+| `crypto/sha256` + `encoding/hex` (stdlib) | Go 1.27.0 | Stored token hash | Same transform as Apparatus `hash('sha256', …)` and the user plugin's `HashAPIToken` |
+| `crypto/subtle` (stdlib) | Go 1.27.0 | Constant-time compare after the row is fetched | Pattern already used in `wristband/crypto.go` |
+| `gorm.io/gorm` | v1.31.2 (pinned in go.mod) | Token model queries | Project standard |
+| `github.com/go-gormigrate/gormigrate/v2` | already pinned | Migration entry in `BackendAdminMigrations` | Project standard |
+| `lagoon.Jsonable[[]string]` | in-repo | `scopes` TEXT column as JSON array | Same shape as user plugin `user_api_tokens.scopes` |
+| `bonfire` (cobra wrapper) | in-repo | `admin:token:*` commands | `Flag.Repeatable` supports `--scope` repeated |
+| swaggo/swag | v1.16.6 (run via `go run` in `scripts/check-admin-openapi.sh`) | OpenAPI for the account token endpoints | Project standard |
+| openapi-typescript / openapi-fetch | 7.13.0 / 0.17.0 (admin/package.json) | SPA types and typed calls | Project standard |
+| reka-ui, @lucide/vue | 2.9.10 / 1.17.0 | Dialog, RadioGroup, icons | UI-SPEC locked |
+
+[VERIFIED: summercms.go/admin/package.json; go version → `go version go1.27.0-X:nodwarf5 linux/amd64`]
+
+### Alternatives Considered
+
+| Instead of | Could Use | Tradeoff |
+|------------|-----------|----------|
+| plain sha256 | HMAC-SHA256 with a server pepper | Protects against a DB-only leak being used for offline guessing, but 160-bit random secrets cannot be guessed anyway, and a pepper rotation would invalidate every token (D-07 is one-way). Not recommended. |
+| bcrypt/argon2 of token | — | Wrong tool: slow hashes defend low-entropy passwords; they also prevent an indexed equality lookup. Do not use. |
+| `scopes` as `text[]` | Postgres array | Needs a custom GORM type or `pq.StringArray`; TEXT JSON matches existing Winter-shaped jsonable columns. Use TEXT JSON. |
+
+**Installation:** none.
+
+## Package Legitimacy Audit
+
+This phase installs no external packages (Go or npm). Every library used is already pinned in `go.mod` or `admin/package.json`.
+
+| Package | Registry | Age | Downloads | Source Repo | Verdict | Disposition |
+|---------|----------|-----|-----------|-------------|---------|-------------|
+| (none added) | — | — | — | — | — | — |
+
+**Packages removed due to [SLOP] verdict:** none
+**Packages flagged as suspicious [SUS]:** none
+
+## Architecture Patterns
+
+### System Architecture Diagram
+
+```
+                      Authorization: Bearer <x>  |  summer_admin cookie
+                                       |
+            +--------------------------+---------------------------+
+            |                                                      |
+   admin API route (backend mw)                       Journal route (/_journal/api/v1, no backend mw)
+            |                                                      |
+            v                                                      v
+   bouncer.Registry.Middleware("backend")            cabana resolver (published by Activate)
+            |                                                      |
+            +-------------------> composite guard <----------------+
+                                       |
+                 x starts with "g15_"? |
+              +-------- yes -----------+---------- no ---------+
+              v                                                v
+   format check (g15_ + 40 hex)                  existing NewBackendJWTGuard path
+   sha256 -> SELECT token row                    (bearer JWT or cookie, aud=backend,
+   (not revoked, not expired)                     blacklist, tokens_valid_after)
+              |                                                |
+   owner = lazyBackendUsers.FindByID  (activated, not soft-deleted, role+user grants)
+              |                                                |
+   method filter: scopes whose Methods include r.Method        |
+     none left -> 403 (WriteUnauthorized sees *ScopeError)      |
+              |                                                |
+   principal.Scope = {Full | Patterns}   ; debounced last_used |
+              +---------------------> principal (+ token credential) on ctx
+                                       |
+                 route wrapper: interactiveOnly?  -- token credential --> 403
+                                       |
+                              handler: cabana.Allows(principal, required)
+                                 owner grant(code) AND scope covers(code)
+                                       |
+                                 200 / 403 (envelope or Journal body)
+```
+
+### Recommended Project Structure
+
+```
+modules/
+├── pact/capabilities.go        # + TokenScope struct, HasTokenScopes interface, method helpers
+├── bouncer/context.go          # + Principal scope-limit field (json:"-")
+├── bouncer/jwt.go              # optionally export BearerToken (or keep cabana's own copy)
+├── lagoon/backend_admin_migrations.go   # + dated backend_api_tokens migration
+└── cabana/
+    ├── api_tokens.go           # model, mint, hash, hint, lookup, revoke, debounce
+    ├── token_scopes.go         # compile scopes (framework + plugins), cover/overlap rules
+    ├── token_guard.go          # composite CredentialGuard + UnauthorizedWriter, resolver
+    ├── account_tokens.go       # GET/POST /account/tokens, DELETE /account/tokens/{id}, GET /account/tokens/scopes
+    ├── contracts.go            # Allows rewrite
+    ├── commands.go             # admin:token:create|list|revoke|scopes
+    └── admin_openapi.go        # swag stubs + types for the four endpoints
+admin/src/components/account/ApiTokensPanel.vue (+ ApiTokenCreateDialog.vue)
+../sm-journal-plugin/
+├── token_scopes.go             # journal, journal:read
+├── controllers/api/auth.go     # switch to cabana resolver
+└── lang/{en,pl}/lang.yaml      # scope labels/descriptions
+```
+
+### Pattern 1: Composite `backend` guard (D-13)
+
+**What:** One type implementing `bouncer.CredentialGuard` and `bouncer.UnauthorizedWriter`, registered by cabana under `backend` in place of the bare JWT guard.
+
+Current registration [VERIFIED: modules/cabana/http.go:145-160]:
+```go
+guard := bouncer.NewBackendJWTGuard(secret, users, bl, writeUnauthenticated, AdminCookieName)
+...
+if owner, taken := guards.Owner("backend"); !taken {
+	if err := guards.Register("summercms.cabana", "backend", guard); err != nil {
+```
+
+The bouncer interfaces [VERIFIED: modules/bouncer/guard.go:10-25]:
+```go
+type CredentialGuard interface {
+	AuthenticateCredential(r *http.Request) (*Principal, any, error)
+}
+type UnauthorizedWriter interface {
+	WriteUnauthorized(w http.ResponseWriter, err error)
+}
+```
+
+Middleware behaviour [VERIFIED: modules/bouncer/registry.go:83-99]: on `err != nil || principal == nil`, if the guard implements `UnauthorizedWriter` it calls `wtr.WriteUnauthorized(w, err)` and stops; on success it stores `WithUser` and, when `cred != nil`, `WithCredential`.
+
+**How:** `AuthenticateCredential(r)`:
+1. Read `Authorization`; if `strings.CutPrefix(h, "Bearer ")` yields a value starting with `g15_` → token branch. Otherwise delegate to the wrapped JWT guard's `Authenticate(r)` and return `(p, nil, err)`.
+2. Token branch: reject anything not matching `^g15_[0-9a-f]{40}$` **before** touching the DB (401). Hash, `SELECT … WHERE token_hash = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())`, constant-time compare the fetched hash.
+3. Owner via the same `lazyBackendUsers.FindByID` the JWT guard uses (D-10: activation + soft-delete honored; `tokens_valid_after` not consulted).
+4. Method filter → if no stored scope (known, registered) permits `r.Method`, return a typed `*ScopeError` so `WriteUnauthorized` answers **403** `forbidden` with `details.reason="token_scope"`; any other error answers the existing 401 `unauthenticated` envelope.
+5. Set the principal's scope limit, stamp `last_used_at` (debounced, never fails auth), return `(principal, *BackendAPIToken, nil)`.
+
+`WriteUnauthorized` receives `err`, so the 401/403 split needs no bouncer change. Name it clearly in a comment, because "unauthorized writer" writing 403 is surprising.
+
+### Pattern 2: `Allows` as owner ∩ scope, per code (D-14, D-05)
+
+Current [VERIFIED: modules/cabana/contracts.go:186-199]:
+```go
+func Allows(principal *bouncer.Principal, required []string) bool {
+	if principal == nil {
+		return false
+	}
+	if principal.IsSuperuser || len(required) == 0 {
+		return true
+	}
+	for _, code := range required {
+		if granted(principal.PermissionGrants, code) {
+			return true
+		}
+	}
+	return false
+}
+```
+
+Current `Principal` [VERIFIED: modules/bouncer/context.go:14-22]:
+```go
+type Principal struct {
+	ID                 uint
+	MustChangePassword bool
+	PreferredLocale    string
+	TokensValidAfter   time.Time
+	Backend            bool            `json:"-"`
+	IsSuperuser        bool            `json:"-"`
+	PermissionGrants   map[string]bool `json:"-"`
+}
+```
+
+**Recommended shape** (names are discretion):
+```go
+// bouncer: nil means unrestricted (JWT session). Set only by a token guard,
+// already filtered to the scopes whose methods include the request method.
+type ScopeLimit struct {
+	Full     bool     // "*" (any method) or "admin:read" (on GET/HEAD)
+	Patterns []string // union of the remaining scopes' permission patterns
+}
+// Principal gains:  Scope *ScopeLimit `json:"-"`
+
+// cabana
+func Allows(p *bouncer.Principal, required []string) bool {
+	if p == nil {
+		return false
+	}
+	if p.Scope != nil && !p.Scope.Full {
+		if len(required) == 0 {
+			return false // D-05
+		}
+		for _, code := range required {
+			if ownerHas(p, code) && scopeCovers(p.Scope.Patterns, code) {
+				return true
+			}
+		}
+		return false
+	}
+	// unchanged JWT / full-scope path
+}
+```
+`ownerHas` = `p.IsSuperuser || granted(p.PermissionGrants, code)` (superuser is still limited by the scope, D-14).
+
+**Why the union of patterns is correct:** `Allows` already has any-of semantics (Winter `hasAnyAccess`). With per-code evaluation, "some method-allowed scope covers code" equals "the union of method-allowed patterns covers code". D-03's "patterns match every required permission" reads as the single-code case; per-code any-of never grants more than either side. Flag for the planner (Assumptions A2).
+
+**Do not reuse `granted()` verbatim for scope cover.** `granted` (contracts.go:203-235) matches a wildcard *requirement* only against concrete keys with a longer prefix and skips wildcard keys shorter than 2 chars, so `scopeCovers(["golem15.*"], "golem15.journal.*")` returns false and pattern `*` never matches. Write `scopeCovers` with explicit cases (pattern wildcard covers code; pattern wildcard prefix ⊇ required wildcard prefix) and table tests.
+
+### Pattern 3: Published resolver for routes outside the `backend` middleware (D-15)
+
+Journal today builds its own guard [VERIFIED: ../sm-journal-plugin/controllers/api/auth.go:58-81]:
+```go
+reg, _ = app.Lookup[*cabana.Registry]()
+...
+return bouncer.NewBackendJWTGuard(secret, cabana.BackendUsers{DB: gdb, Registry: reg}, bl, write)
+```
+`cabana.Activate` publishes only the guard registry [VERIFIED: modules/cabana/http.go:136-142 — `if err := app.Publish(guards); err != nil {`]; no `Publish` of `*Registry` exists anywhere in `modules/cabana` (grep this session), so `reg` is always nil and `rolePermissions` returns an empty map for nil (registry.go:368-372). Code-declared role grants (`Roles: []string{"developer"}` in Journal's catalog) are therefore missing on Journal's API today.
+
+**Recommendation:** `Activate` publishes an exported resolver value (e.g. `*cabana.BackendAuth`) holding the composite guard and the compiled scope catalog. Export a function such as:
+```go
+// ResolveBackend authenticates r like the backend guard and requires, for a
+// token, that a method-allowed scope covers at least one of cover.
+func ResolveBackend(app *backpack.App, r *http.Request, cover ...string) (*http.Request, *bouncer.Principal, error)
+```
+with sentinel errors (`ErrUnauthenticated`, `ErrTokenScope`) so Journal maps them to its own byte-identical bodies (`{"error":"Authentication required"}` 401, `{"error":"Insufficient permissions"}` 403). Plugin routes are registered **before** `cabana.Activate` runs (surf router.go:540-548), so the resolver must be looked up per request, not captured at `Routes()` time. Journal's test harness uses `surf.Assemble` (admin_harness_test.go:228), so the published resolver is present in tests.
+
+The `cover` argument closes the ownership bypass (Pitfall 3): Journal passes `"golem15.journal.*"` on every call; an unrelated scope (e.g. a future `payment`) never resolves a principal for Journal routes.
+
+### Pattern 4: Interactive-only marker (D-06)
+
+Route wrapper next to `requireAjax`, applied in `mount`:
+```go
+func interactiveOnly(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if cred, _ := bouncer.Credential(r.Context()); isAPIToken(cred) {
+			WriteErrorDetails(w, http.StatusForbidden, "forbidden", msgForbidden,
+				map[string]any{"reason": "interactive_only"})
+			return
+		}
+		next(w, r)
+	}
+}
+```
+Current account routes [VERIFIED: modules/cabana/http.go:243-248]:
+```go
+r.GroupRaw(api, []string{"backend"}, func(g pact.Router) {
+	g.Get("/auth/me", s.me)
+	g.Put("/account", requireAjax(s.accountUpdate))
+	g.Post("/account/avatar", requireAjax(s.avatarUpload))
+	g.Delete("/account/avatar", requireAjax(s.avatarRemove))
+```
+`/auth/refresh` and `/auth/logout` are mounted outside the guard (http.go:229-238) and read `sessionToken(r)` (Bearer first). A `g15_` Bearer fails JWT verification there and already yields 401; add explicit tests so this stays true, and consider an explicit `g15_` refusal so the intent is visible.
+
+CSRF note [VERIFIED: modules/cabana/csrf.go `csrfSafe`]: any non-empty Bearer satisfies `requireAjax`, so token clients do not need `X-Requested-With`. Keep that.
+
+### Pattern 5: Account token API (D-16..D-18)
+
+Endpoints under `{prefix}/api/v1` inside the `backend` group, all wrapped in `interactiveOnly` (and `requireAjax` for writes):
+- `GET /account/tokens?revoked=1` → own tokens, newest first. Each row: id, name, hint, scopes as `[{name, label, read_only, known}]`, created_at, last_used_at, expires_at, revoked_at. Server translates labels (UI-SPEC §3 requires a label + known flag per scope).
+- `POST /account/tokens` `{name, expires: "30d"|"90d"|"365d"|"never", scopes: [...]}` → 201 (or 200 — see Pitfall 8) with the row plus `token` plaintext once. 422 `validation_failed` details keyed `name`, `expires`, `scopes` (UI-SPEC copy: `api_tokens.name_required`, `scopes_required`, `scope_unavailable`). Trim name, 1..100 chars. `["*", "journal"]` → normalize to `["*"]` or 422 (choose one; UI-SPEC sends only `["*"]`).
+- `DELETE /account/tokens/{id}` → revoke own token only (owner check in the WHERE clause, 404 otherwise); sets `revoked_at`, `revoked_by = principal.ID`.
+- `GET /account/tokens/scopes` → picker list in server order: `*`, `admin:read`, then plugin scopes; hidden when no overlap (D-17). `*` always.
+
+Overlap rule (D-17), recommended: a scope overlaps the user iff some **registered permission code** `c` satisfies `ownerHas(c) && scopeCovers(scope.Patterns, c)`; `*` always; `admin:read` iff superuser or any grant. Using the catalog avoids wildcard-vs-wildcard reasoning on user grants.
+
+Inventories that must list every new route (or tests fail):
+- `phase09Routes` [VERIFIED: modules/cabana/security_coverage_test.go:34] — mount/guard matrix (`TestPhase09PermissionMatrix`).
+- OpenAPI path presence and 200/201 response (`TestPhase09ContractInventory`, phase09_contract_test.go:15-80).
+- `conformCases()` vs `cabana.AdminAPIRoutes()` (`TestPhase10ConformanceInventory`, openapi_conformance_test.go:134).
+
+Swag stubs live in `admin_openapi.go` as exported no-op functions (e.g. `func AdminAccountUpdate() {}`); new ones follow that style and are therefore exported identifiers the docs checker can see. Update the `BackendBearer` security description, which currently says `Send "Bearer {access_token}"` (admin_openapi.go:10), to mention `g15_` tokens.
+
+### Pattern 6: Scope capability and compile (D-01, D-04)
+
+`HasPermissions` precedent [VERIFIED: modules/pact/capabilities.go:495-506]:
+```go
+type Permission struct {
+	Code  string
+	Tab   string
+	Label string
+	Roles []string
+}
+type HasPermissions interface {
+	Permissions() []Permission
+}
+```
+Compile precedent: `compileContributions` (registry.go:168-200) iterates plugins, validates, rejects duplicates with `fmt.Errorf("cabana: duplicate permission %s", …)`, then `validatePermissions(owner, codes)` (registry.go:301-308) checks `permissionCode(code, true)` and `permissionExists`.
+
+Recommended capability:
+```go
+type TokenScope struct {
+	Name        string   // "journal", "journal:read"
+	Label       string   // phrase key, e.g. "golem15.journal::lang.scopes.journal"
+	Description string   // phrase key
+	Permissions []string // non-empty; Winter patterns, validated against the catalog
+	Methods     []string // non-empty; e.g. pact.TokenReadMethods = {"GET","HEAD"}
+}
+type HasTokenScopes interface{ TokenScopes() []TokenScope }
+```
+Boot validation (fail loud): name syntax `^[a-z][a-z0-9_-]*(:[a-z][a-z0-9_-]*)?$`; reserved `*`, `admin`, `admin:*`; duplicates across plugins; empty permissions or methods; unknown HTTP method; permissions via `validatePermissions`; label/description containing `::` must exist in the translator (same rule as action labels in `validateMessageKeys`, messages.go:322-326).
+
+Journal registers [catalog VERIFIED: ../sm-journal-plugin/admin_permissions.go — codes `golem15.journal.manage_settings`, `golem15.journal.access_posts`, `golem15.journal.access_categories`, `golem15.journal.access_other_posts`, `golem15.journal.access_import_export`, `golem15.journal.access_publish`, `golem15.journal.access_tags`]:
+- `journal` → `golem15.journal.*`, all methods
+- `journal:read` → `golem15.journal.*`, GET/HEAD
+
+Unknown stored scope names (plugin removed): grant nothing, render as unknown (UI-SPEC §3). Tokens whose scopes are all unknown authenticate but cannot pass any method filter → 403; consider 401 instead so agents see a dead token (discretion).
+
+### Pattern 7: CLI (D-19)
+
+Current signature [VERIFIED: modules/cabana/commands.go:18 — `func RuntimeCommands(app *backpack.App) []bonfire.Command {`]; generated host `main.go` calls it [VERIFIED: ../sm-grzybyfunkcjonalne-app/main.go:44 — `commands = append(commands, cabana.RuntimeCommands(app)...)`, file header `// Code generated by summer build. DO NOT EDIT.`]; same line in `fonoteka.go/main.go`, `sm-summercmsio-app/main.go`, `sm-bm-app/main.go`, `internal/build/build.go:120`, `examples/hello/main.go:44`, `cmd/summer/docs.go:156`.
+
+`party.Activate` stores only plugin IDs on the app (`app.SetPlugins(orderedIDs)`, registry.go:107); the plugin objects are not published.
+
+Options:
+- **A (recommended, version-bump-only for hosts):** `party.Activate` publishes the ordered plugin slice under a named type (e.g. `party.Activated`); cabana's token commands look it up at `Run` time and compile the scope + permission catalog. `RuntimeCommands(app)` signature unchanged. Cost: a party README/API addition.
+- **B:** `RuntimeCommands(app *backpack.App, plugins ...party.Plugin)` (source compatible) plus a generator change. Old generated mains compile but pass no plugins, so `--scope=journal` would be "unknown" until each host re-runs `summer build`. Contradicts "host applications only for the version bump."
+
+bonfire facts:
+- Repeatable flags exist [VERIFIED: modules/bonfire/command.go:42-48 — `Repeatable bool`, read through `Input.Flags`]; cobra StringSlice also splits `--scope=a,b`.
+- **All Output methods except `Error` write to stdout, and `NewRoot` sets `errW = out`** [VERIFIED: modules/bonfire/root.go:12-14 — `return NewRootIO(name, commands, os.Stdin, out, out)`; output.go `Success`/`Warning`/`Info` call `c.Println`]. To keep `admin:token:create` pipe-clean, print exactly `out.Println(token)` and nothing else on success; return errors (the generated main prints them to stderr).
+
+`summer` forwards app commands through a fixed table [VERIFIED: cmd/summer/runtime.go:37-38 rows for `admin:create`, `admin:reset-password`]. Add `admin:token:*` rows if `summer admin:token:create …` should work from the app directory, and the `docs/console/introduction.md` delegate table with them. `docsCommands` (docs.go:146-163) already picks up anything `cabana.RuntimeCommands(app)` returns.
+
+Identifier resolution: reuse the `findBackendLogin` ambiguity rule (login OR lower(email), exactly one row). Refuse to mint for a deactivated or soft-deleted user (the token would 401 anyway). `revoked_by` is NULL for CLI revokes.
+
+### Anti-Patterns to Avoid
+- **Checking scope in per-route middleware annotations:** permission checks live in handlers (D-14); annotations would miss actions, relations and settings.
+- **Letting the token branch fall through to the JWT parser:** a `g15_` value must never be handed to `VerifyClaimsAudience`; route by prefix first.
+- **Accepting `g15_` from the `summer_admin` cookie or a query string:** D-13 forbids it; the JWT path's cookie fallback must stay JWT-only.
+- **Failing auth when the `last_used_at` write fails:** the user plugin's guard does this (api_token.go returns `errInvalidAPIToken` on update error); cabana should log and continue.
+- **Returning the plaintext anywhere after creation:** not in list rows, logs, slog attributes, or error details.
+
+## Don't Hand-Roll
+
+| Problem | Don't Build | Use Instead | Why |
+|---------|-------------|-------------|-----|
+| Random secret | math/rand, time-seeded IDs | `crypto/rand.Read` | CSPRNG required for bearer secrets |
+| Hash compare | `==` on secrets | `crypto/subtle.ConstantTimeCompare` on fixed-length hex | Removes a timing side channel |
+| JWT path | any change to JWT verification | wrap existing `NewBackendJWTGuard` unchanged | D-13; keeps audience, blacklist, cutoff behaviour |
+| Owner loading | a second user query | `lazyBackendUsers.FindByID` / `BackendUsers.FindByID` | Already merges role, code-declared and user grants (auth.go:40-69) |
+| Validation messages | ad-hoc strings | `ValidationError{Details: …}`, `lagoon`/`backendMessage` helpers as in account.go | Keeps the D-10 envelope and translations |
+| Plaintext display/copy | custom modal | Reka Dialog shell copied from `RelationPickerModal.vue`, shared `ConfirmDialog` | UI-SPEC binding |
+
+**Key insight:** every security-relevant primitive here is stdlib or already in cabana; the work is wiring and making the deny-by-default rule hold on routes that never called `Allows`.
+
+## Runtime State Inventory
+
+Not a rename/refactor phase. One related check: Apparatus `golem15_apparatus_personal_api_tokens` rows exist only in the PHP deployment and are explicitly **not migrated** (D-12). Nothing in the Go apps stores `g15_` tokens today.
+
+## Common Pitfalls
+
+### Pitfall 1: Superuser short-circuit survives the rewrite
+**What goes wrong:** `IsSuperuser || len(required) == 0` returns true before scope logic, so a superuser's `journal` token administers everything.
+**How to avoid:** Evaluate the scope limit first; superuser only replaces the owner-grant side. Table-test superuser × each scope.
+**Warning signs:** a test for "superuser + journal token on a non-journal controller" passes with 200.
+
+### Pitfall 2: Routes that never call `Allows`
+**What goes wrong:** D-05 deny-by-default only holds where `Allows` runs. Handlers that check only `principal.Backend`: `/auth/me` (intended open), `/navigation`, `/settings` (both filtered per item via `Allows`, so a scoped token sees only covered items — acceptable), `/field-types` (field_type.go:864-866) and `/markdown/preview` (field_markdown.go:71-73) — no permission gate at all.
+**How to avoid:** Add an explicit gate equivalent to `Allows(principal, nil)` on `/field-types` and `/markdown/preview` (only `*`, and `admin:read` on GET, pass). Document the classification of every route in `mount` in a test table.
+**Warning signs:** a `journal:read` token gets 200 from `/field-types`.
+
+### Pitfall 3: Ownership branches bypass `Allows`
+**What goes wrong:** Journal `UploadFeaturedImage`/`DeleteFeaturedImage` check only `post.CanEdit(pr)` (posts.go:323-341, 391-405; no `requireAccessPosts`), and `CanEdit` returns true for the post's author regardless of permissions (models/post.go:161-169). `canViewDraft` likewise passes the owner (posts_helpers.go:33-41). Any token whose scope permits the method would reach them for the owner's own posts.
+**How to avoid:** The resolver's `cover` argument (Pattern 3) refuses tokens whose scopes do not cover `golem15.journal.*`. Separately decide whether featured-image routes should also call `requireAccessPosts` (PHP parity check needed — the CONTEXT flags it as a possible pre-existing gap).
+**Warning signs:** a non-Journal scoped token uploads a featured image.
+
+### Pitfall 4: `*cabana.Registry` lookup is always nil
+**What goes wrong:** Journal's guard drops code-declared role grants today; if the resolver copies that pattern, tokens inherit the bug.
+**How to avoid:** The resolver uses the same `lazyBackendUsers{app, reg}` instance the admin guard uses. Add a Journal test where the role grant comes only from `Permission.Roles` (code-declared) and the API write succeeds. Note this as a behaviour change in the Journal README/changelog (users with code-declared grants gain access they lacked through the Journal API).
+
+### Pitfall 5: Migration tests pin the last ID
+**What goes wrong:** `TestBackendAdminMetadataColumn` asserts the last `BackendAdminMigrations` ID and the last history row equal `202610090001_backend_users_metadata` and then `RollbackLast()`s expecting the metadata column to disappear [VERIFIED: modules/lagoon/backend_admin_migrations_test.go:561-575].
+**How to avoid:** Update that test (roll back two, or assert by ID) in the same commit as the migration. `TestPhase09MigrationsFreshRollback` rolls back every entry newest-first (rollbackBackendAdmin, :445-452), which drops the token table before `backend_users` — keep the FK so that order works.
+Schema facts for the FK [VERIFIED: modules/lagoon/backend_admin_migrations.go:36-37 — `CREATE TABLE IF NOT EXISTS backend_users (` / `id SERIAL PRIMARY KEY,`]: use `backend_user_id INTEGER NOT NULL REFERENCES backend_users(id) ON DELETE CASCADE`, `revoked_by INTEGER NULL REFERENCES backend_users(id) ON DELETE SET NULL`. Use `CREATE TABLE IF NOT EXISTS` and `CREATE … INDEX IF NOT EXISTS` to match the re-runnable style.
+
+### Pitfall 6: CLI cannot see plugin scopes
+See Pattern 7. Without a plugin list, `admin:token:scopes` shows only `*` and `admin:read`, and `--scope=journal` is rejected.
+
+### Pitfall 7: CLI stdout pollution
+`out.Success`/`Warning`/`Info` go to stdout, and in generated mains stderr is stdout too. Any courtesy line breaks `TOKEN=$(./bin/app admin:token:create …)`. Test that stdout is exactly `g15_<40 hex>\n`.
+
+### Pitfall 8: OpenAPI inventory demands 200 or 201
+`TestPhase09ContractInventory` fails a route with neither 200 nor 201 documented. Document 201 for create if you return 201; the SPA openapi-fetch client handles both.
+
+### Pitfall 9: Scope labels are not in the SPA bundle
+The public bundle serves only `backend::lang.` keys [VERIFIED: modules/cabana/lang.go:8 — `const adminLangPrefix = "backend::lang."`]. Plugin scope labels must be translated server-side in `/account/tokens/scopes` and in the list rows; framework scope copy (`api_tokens.*`) goes in `modules/phrasebook/backend/lang/{en,pl}/lang.yaml`.
+
+### Pitfall 10: Route shadowing under the admin API
+`GET /account/tokens/scopes` (three literal segments) is more specific than `GET /{vendor}/{plugin}/{controller}`, so ServeMux accepts both, but a plugin with vendor `account`, plugin `tokens`, controller `scopes` would be shadowed. `reservedVendorSegments` holds only `api`, `assets`, `login`, `settings` [VERIFIED: modules/cabana/registry.go:44]. Consider adding `account` (low risk).
+
+### Pitfall 11: Journal throttle key runs before auth
+`journal-api` bucket key reads `bouncer.User(r.Context())` (plugin.go:118-123) before any guard has run, so it always keys by IP. Agents behind one IP share 120/min. Pre-existing; leave unless cheap, but document.
+
+### Pitfall 12: Docs snippets must compile
+Docs pages use `src=modules/bouncer/example_test.go#ExampleNewJWTGuard`-style snippets checked by `TestDocsTree`. New code samples in docs should come from `Example*` tests, and every identifier named must exist.
+
+## Code Examples
+
+### Mint and hash (stdlib only)
+```go
+// Source: D-07; transform matches Apparatus PersonalApiToken::generateToken/hashToken
+const tokenPrefix = "g15_"
+
+func mintToken() (plain, hash, hint string, err error) {
+	var b [20]byte
+	if _, err = rand.Read(b[:]); err != nil {
+		return "", "", "", err
+	}
+	plain = tokenPrefix + hex.EncodeToString(b[:]) // 4 + 40 chars, lowercase
+	sum := sha256.Sum256([]byte(plain))
+	return plain, hex.EncodeToString(sum[:]), plain[len(plain)-4:], nil
+}
+
+func wellFormed(v string) bool {
+	if len(v) != 44 || !strings.HasPrefix(v, tokenPrefix) {
+		return false
+	}
+	for _, c := range v[4:] {
+		if !(c >= '0' && c <= '9' || c >= 'a' && c <= 'f') {
+			return false
+		}
+	}
+	return true
+}
+```
+
+### Debounced last_used_at
+```go
+// In-memory gate (per process) + conditional UPDATE (safe across processes).
+var lastStamp sync.Map // token id -> time.Time
+
+func stamp(ctx context.Context, db *gorm.DB, id uint, now time.Time) {
+	if v, ok := lastStamp.Load(id); ok && now.Sub(v.(time.Time)) < time.Minute {
+		return
+	}
+	lastStamp.Store(id, now)
+	err := db.WithContext(ctx).Exec(`UPDATE backend_api_tokens SET last_used_at = ?
+		WHERE id = ? AND (last_used_at IS NULL OR last_used_at < ?)`, now, id, now.Add(-time.Minute)).Error
+	if err != nil {
+		slog.Default().WarnContext(ctx, "cabana: token last_used_at stamp failed", "token_id", id, "error", err)
+	}
+}
+```
+Use `UPDATE … SET last_used_at` only (not `updated_at`).
+
+### Migration entry
+```go
+// Appended to lagoon.BackendAdminMigrations; table name is discretion.
+{
+	ID: "202610110001_backend_api_tokens",
+	Migrate: func(tx *gorm.DB) error {
+		for _, stmt := range []string{
+			`CREATE TABLE IF NOT EXISTS backend_api_tokens (
+	id BIGSERIAL PRIMARY KEY,
+	backend_user_id INTEGER NOT NULL REFERENCES backend_users(id) ON DELETE CASCADE,
+	name TEXT NOT NULL,
+	token_hash CHAR(64) NOT NULL UNIQUE,
+	token_hint TEXT NOT NULL,
+	scopes TEXT NOT NULL,
+	expires_at TIMESTAMPTZ,
+	last_used_at TIMESTAMPTZ,
+	revoked_at TIMESTAMPTZ,
+	revoked_by INTEGER REFERENCES backend_users(id) ON DELETE SET NULL,
+	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+)`,
+			`CREATE INDEX IF NOT EXISTS backend_api_tokens_backend_user_id_index ON backend_api_tokens (backend_user_id)`,
+		} {
+			if err := tx.Exec(stmt).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	},
+	Rollback: func(tx *gorm.DB) error {
+		return tx.Exec(`DROP TABLE IF EXISTS backend_api_tokens`).Error
+	},
+},
+```
+The `UNIQUE` constraint creates the lookup index; no separate hash index is needed.
+
+## State of the Art
+
+| Old Approach | Current Approach | When Changed | Impact |
+|--------------|------------------|--------------|--------|
+| Apparatus `TokenAuthenticate` (no scopes, full owner access, stamp every request) | Scoped tokens ∩ owner permissions, method-limited read scopes, debounced stamp | This phase | Agents get least privilege |
+| Journal writes: backend JWT only (Phase 15 D-15) | Composite resolver: JWT or `journal`-scoped token | This phase | Reversal recorded in Journal README |
+
+## Assumptions Log
+
+| # | Claim | Section | Risk if Wrong |
+|---|-------|---------|---------------|
+| A1 | Publishing the activated plugin slice from `party.Activate` (Option A) is acceptable as a framework API addition | Pattern 7 | If rejected, Option B forces every host to regenerate `main.go` |
+| A2 | Per-code any-of evaluation (owner AND scope per code) is the intended reading of D-03 | Pattern 2 | If "every required permission" was meant literally for multi-code checks, some multi-permission actions would need all codes covered |
+| A3 | `/field-types` and `/markdown/preview` should be gated to `*`/`admin:read` under tokens | Pitfall 2 | A `journal` agent that wants markdown preview would be refused |
+| A4 | A token whose stored scopes are all unknown should 401 rather than 403 | Pattern 6 | Minor UX difference for agents |
+| A5 | Featured-image routes' missing `requireAccessPosts` may be PHP parity, not a bug | Pitfall 3 | Adding it could change Journal's contract for authors without `access_posts` |
+| A6 | `admin:read` is offered in the picker only when the user is superuser or has at least one grant | Pattern 5 | Picker differs slightly from user expectation |
+
+## Open Questions (RESOLVED)
+
+1. **CLI plugin access (Option A vs B).** Recommendation: A. Ask the user at the plan-count checkpoint since it touches `party`'s exported API. — RESOLVED: Option A, user-confirmed: `party.Activate` publishes `party.Activated` and the token commands read it at Run time, with `cabana.RuntimeCommands(app)` unchanged (16.3-01 Decisions, Task 4).
+2. **Featured-image permission gap.** Check the frozen PHP `routes.php`/controller for `access_posts` on featured images before adding it; the resolver's cover check closes the token-scope side either way. — RESOLVED: the frozen PHP `PostApiController` checks only `$post->canEdit($user)` on both featured-image actions, so no `access_posts` check is added (parity), and the resolver cover `golem15.journal.*` closes the token side (16.3-03 Decisions, Task 2 `TestJournalTokenExpansion`).
+3. **Create response status (200 vs 201).** Either passes the inventory if documented; 201 matches Journal's own create; the admin API mostly uses 200. Recommendation: 201. — RESOLVED: 201, user-locked, documented as `@Success 201` in the swag stub (16.3-01 Decisions "Create contract", Task 3).
+4. **Mixed `*` + other scopes on create.** Normalize to `["*"]` (simplest for clients) or 422. Recommendation: normalize. — RESOLVED: normalize to `["*"]`, user-locked, in the shared `validateTokenRequest`/`issueAPIToken` path used by the API and the CLI (16.3-01 Task 3).
+5. **Version release.** The Journal change requires a new framework tag (current latest `v0.1.20`) and a Journal `go.mod` bump; host apps then bump the journal submodule and framework version. Confirm the release step is in a plan. — RESOLVED: 16.3-03 Task 3 (blocking-human release gate) and Task 4 (annotated tag after `v0.1.20`, Journal `go.mod` require, `sm-grzybyfunkcjonalne-app` journal gitlink bump; the `sm-summercmsio-app` bump is asked at the gate).
+
+## Environment Availability
+
+| Dependency | Required By | Available | Version | Fallback |
+|------------|------------|-----------|---------|----------|
+| Go | all Go code | ✓ | go1.27.0 | — |
+| Node | admin SPA build/tests | ✓ | v22.23.2 (engines `>=22.6`) | — |
+| npm | admin deps | ✓ | 12.0.2 | — |
+| Docker daemon | testcontainers Postgres suites (cabana auth/account harness `adminHandler`, lagoon migration tests, Journal admin harness) | ✗ in this sandbox (`permission denied while trying to connect to the docker API at unix:///var/run/docker.sock`) | client 29.7.2 | Run Postgres stages on a Docker host; Docker-free unit tests (Allows, scope cover, mint/format, CLI arg parsing, inventories) run anywhere |
+
+**Missing dependencies with no fallback:** none for planning; executors need a Docker host for the Postgres stages (as in every earlier phase gate).
+
+## Validation Architecture
+
+### Test Framework
+| Property | Value |
+|----------|-------|
+| Framework | Go `testing` (+ testcontainers-go Postgres for DB suites); vitest 3.2.7 + @vue/test-utils + happy-dom for the SPA |
+| Config file | `admin/vitest.config.ts` (`include: ['tests/**/*.test.ts']`, setup `tests/setup.ts`) |
+| Quick run command | `go test ./modules/cabana ./modules/bouncer ./modules/pact -run 'Token|Scope|Allows' -count=1` |
+| Full suite command | `go vet ./... && go test ./... && npm --prefix admin test && (cd ../sm-journal-plugin && go vet ./... && go test ./...)` |
+
+### Phase Requirements → Test Map
+| Req ID | Behavior | Test Type | Automated Command | File Exists? |
+|--------|----------|-----------|-------------------|-------------|
+| SC-1 | `g15_` Bearer authenticates; JWT and cookie unchanged; malformed/expired/revoked/deactivated/soft-deleted → 401; cookie or query `g15_` ignored | unit + Postgres | `go test ./modules/cabana -run TestBackendToken -count=1` | ❌ Wave 0 |
+| SC-2 | `Allows` matrix: scope × owner × superuser × empty list × method; non-`Allows` route gates; interactive-only routes refuse `*` | unit (Docker-free) | `go test ./modules/cabana -run 'TestAllowsScope|TestTokenRouteGates|TestInteractiveOnly' -count=1` | ❌ Wave 0 |
+| SC-2 | scope cover incl. wildcard-vs-wildcard, overlap rule | unit | `go test ./modules/cabana -run TestScopeCover -count=1` | ❌ Wave 0 |
+| SC-2 | boot fails on duplicate/reserved/invalid scope, unknown permission, missing phrase key | unit | `go test ./modules/cabana -run TestTokenScopeCompile -count=1` | ❌ Wave 0 |
+| SC-3 | account token API: list/create/revoke/scopes, 422 details, own-only revoke, plaintext once | Postgres | `go test ./modules/cabana -run TestAccountTokens -count=1` | ❌ Wave 0 |
+| SC-3 | route inventories + OpenAPI | unit | `go test ./modules/cabana -run 'TestPhase09PermissionMatrix|TestPhase09ContractInventory|TestPhase10ConformanceInventory' -count=1` and `bash scripts/check-admin-openapi.sh --check` | ✅ (update) |
+| SC-3 | CLI: create stdout exactly the token; list; revoke; scopes; overlap 422-equivalent errors | Postgres | `go test ./modules/cabana -run TestTokenCommands -count=1` | ❌ Wave 0 |
+| SC-3 | SPA panel: states, show-once, clipboard fallback, close-without-copy, plaintext cleared | vitest | `npm --prefix admin test -- tests/components/ApiTokensPanel.test.ts` | ❌ Wave 0 |
+| SC-3 | migration up/down, last-ID test updated | Postgres | `go test ./modules/lagoon -run TestBackendAdmin -count=1` | ✅ (update) |
+| SC-4 | Journal: `journal` token writes; `journal:read` POST → 403 Journal body; unrelated scope → 403/anon; JWT path unchanged; code-declared role grant now honored | Postgres | `(cd ../sm-journal-plugin && go test . -run TestJournalToken -count=1)` | ❌ Wave 0 |
+| SC-5 | docs identifiers, commands, snippets | unit | `go test ./cmd/summer -run TestDocsTree -count=1` | ✅ |
+| SC-5 | SPA dist drift | script | `bash scripts/check-admin-dist.sh` | ✅ |
+
+### Sampling Rate
+- **Per task commit:** quick run command plus `go vet ./...`.
+- **Per wave merge:** full suite; Postgres suites on a Docker host.
+- **Phase gate:** a `scripts/check-phase16.3.sh` following the 16.2 gate's stage pattern (go, admin, docs, postgres; fail on skips or zero tests), green before `/msd-verify-work`.
+
+### Wave 0 Gaps
+- [ ] `modules/cabana/token_*_test.go` — Allows/scope cover/compile/guard/inventory classification (Docker-free)
+- [ ] `modules/cabana/account_tokens_test.go` — API via the existing `adminHandler(t, gdb, mutate)` harness (auth_test.go:367)
+- [ ] `modules/cabana/commands_test.go` additions — token commands (stdout purity)
+- [ ] `admin/tests/components/ApiTokensPanel.test.ts` — UI-SPEC backstops (plaintext never retained, clipboard flow, close guard)
+- [ ] `../sm-journal-plugin/journal_api_tokens_test.go` — via `newPostsEnv`
+- [ ] `scripts/check-phase16.3.sh`
+
+## Security Domain
+
+### Applicable ASVS Categories
+
+| ASVS Category | Applies | Standard Control |
+|---------------|---------|-----------------|
+| V2 Authentication | yes | 160-bit CSPRNG secret, sha256 at rest, format check before lookup, expiry, soft revoke, owner activation check |
+| V3 Session Management | yes | Tokens are not sessions: interactive-only routes (account, tokens, logout/refresh) refuse them; JWT cutoff unaffected (D-10) |
+| V4 Access Control | yes | Owner ∩ scope in `Allows`; method filter in guard; resolver cover check; superuser limited by scope |
+| V5 Input Validation | yes | Name trim/length, expiry enum or date, scope names against the compiled catalog (422) |
+| V6 Cryptography | yes | stdlib `crypto/rand`, `crypto/sha256`, `crypto/subtle`; nothing hand-rolled |
+| V7 Error Handling and Logging | yes | Never log plaintext or Authorization; log token id and admin id on denial via `logAuth` |
+
+### Known Threat Patterns for this stack
+
+| Pattern | STRIDE | Standard Mitigation |
+|---------|--------|---------------------|
+| Leaked token mints more tokens or changes password | Elevation of privilege | Interactive-only marker on account and token routes (D-06) |
+| Scoped token reaches unscoped route | Elevation of privilege | Deny-by-default in `Allows`; explicit gates on non-`Allows` routes; resolver cover |
+| Superuser token escapes scope | Elevation of privilege | Scope evaluated before the superuser shortcut |
+| Token via cookie/query (CSRF, referrer leak) | Spoofing / Info disclosure | Bearer header only (D-13) |
+| Timing oracle on hash compare | Info disclosure | Indexed equality on sha256 + constant-time compare after fetch |
+| Plaintext persisted in browser | Info disclosure | Component-local state only, cleared on close/unmount (UI-SPEC §5) |
+| DB dump reveals usable tokens | Info disclosure | Only sha256 stored; hint is 4 chars |
+| Write amplification (stamp per request) | DoS | Per-minute debounce |
+| Dead owner keeps access | Elevation of privilege | Fresh `FindByID` per request (D-10) |
+
+## Sources
+
+### Primary (HIGH confidence — read this session)
+- `modules/bouncer/{guard.go,context.go,registry.go,jwt.go}` — guard interfaces, Principal, middleware failure path, bearer extraction
+- `modules/cabana/{http.go,auth.go,contracts.go,account.go,csrf.go,commands.go,registry.go,lang.go,admin_openapi.go,field_type.go,field_markdown.go,messages.go}` — registration, mount, Allows/granted, account handlers, CSRF, CLI, scope-compile precedent
+- `modules/cabana/{security_coverage_test.go,phase09_contract_test.go,openapi_conformance_test.go,export_test.go}` — route inventories
+- `modules/lagoon/{backend_admin_migrations.go,backend_admin_migrations_test.go,migrations.go,jsonable.go}`
+- `modules/pact/capabilities.go`, `modules/party/registry.go`, `modules/bonfire/{command.go,output.go,root.go}`, `modules/surf/router.go`, `modules/wristband/crypto.go`
+- `cmd/summer/{runtime.go,docs.go}`, `internal/build/build.go`, `docs/services/authentication.md`, `docs/console/{introduction.md,setup-and-maintenance.md}`
+- `scripts/{check-admin-openapi.sh,check-admin-dist.sh,check-phase16.2.sh}`, `admin/{package.json,vitest.config.ts,src/api/client.ts}`
+- `../sm-journal-plugin/{controllers/api/auth.go,controllers/api/posts.go,controllers/api/posts_helpers.go,models/post.go,routes.go,admin_permissions.go,plugin.go,admin_harness_test.go,go.mod,go.work}`
+- `../sm-summercmsio-app/plugins/golem15/user/{middleware/api_token.go,classes/api_tokens.go,models/api_token.go,updates/202610040001_create_api_tokens.go}`
+- `/media/nvme/dev/golem15/fonoteka/plugins/golem15/apparatus/{models/PersonalApiToken.php,middleware/TokenAuthenticate.php}`
+- Host `main.go` files in `sm-grzybyfunkcjonalne-app`, `fonoteka.go` (generated, call `cabana.RuntimeCommands(app)`)
+
+### Secondary / Tertiary
+- None. No web sources were needed: the phase adds no external dependency and every decision is in-repo.
+
+## Metadata
+
+**Confidence breakdown:**
+- Standard stack: HIGH — stdlib plus already-pinned modules; nothing new.
+- Architecture: HIGH — every seam read in source; the open choices (CLI plugin access, multi-code reading) are flagged.
+- Pitfalls: HIGH — each one traced to a file and line this session.
+
+**Research date:** 2026-10-11
+**Valid until:** 2026-11-10 (in-repo findings; re-check if cabana auth or Journal auth changes first)
+
+### Suggested plan split (for the plan-count checkpoint; CLAUDE.md rule 2)
+1. Framework core: pact `HasTokenScopes`, scope compile + framework scopes, `bouncer.Principal` scope limit, `Allows` rewrite, token table migration (+ fixed migration test), composite guard, interactive-only marker, route gates, published resolver; smoke tests.
+2. Account token API + swag/OpenAPI regen + route inventories, CLI `admin:token:*` (+ plugin-list access), `summer` delegate rows; smoke tests.
+3. Admin SPA token panel per UI-SPEC, lang keys, `npm run build` dist commit.
+4. Journal: scopes + lang, resolver switch, README; framework READMEs (cabana, bouncer, pact, party if changed) and `docs/` pages; framework tag and Journal `go.mod` bump.
+5. Unit tests (last plan): full coverage across both repos, `scripts/check-phase16.3.sh`.

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-REVIEW-DISPOSITION.md

@@ -0,0 +1,39 @@
+---
+phase: 16.3
+review: 16.3-REVIEW.md
+titles: json
+findings:
+  - id: WR-01
+    severity: warning
+    disposition: fixed
+    title: "TestPhase10Coverage golden list omits account token routes"
+  - id: WR-02
+    severity: warning
+    disposition: fixed
+    title: "Create dialog Submit enabled with zero scopes selected"
+  - id: IN-01
+    severity: info
+    disposition: open
+    title: "last_used_at in-process debounce stores success before the DB write"
+  - id: IN-02
+    severity: info
+    disposition: open
+    title: "Create-dialog scope checkboxes lack associated accessible names beyond the wrapping label"
+open: 2
+total: 4
+recorded: 2026-10-11T11:48:56.057Z
+updated: 2026-10-11T11:53:00.000Z
+---
+
+# Phase 16.3: Code Review Disposition
+
+| Finding | Severity | Disposition | Source |
+|---------|----------|-------------|--------|
+| WR-01 | warning | fixed | a955d2a |
+| WR-02 | warning | fixed | cb4b0a9 |
+| IN-01 | info | open | - |
+| IN-02 | info | open | - |
+
+Dispositions: `open` (recorded, not yet triaged), `fixed`, `skipped`, `deferred`.
+Set `deferred` by hand and put the reason in the Source cell; both are preserved. A `|` in the reason is kept as prose and escaped on the next run.
+Re-running the gate keeps every row it can. A row the current review no longer reports is kept and its Source cell flagged, so a finding does not leave this record silently. ONE exception: when a finding id is REUSED by a different finding, the earlier decision cannot keep a row — the id is taken — and it is dropped. A RECORDED decision (anything but `open`) is named on the console when that happens; a row still at `open` is replaced silently, because `open` records no decision to lose.

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-REVIEW.md

@@ -0,0 +1,155 @@
+---
+phase: 16.3-backend-admin-personal-api-tokens-with-scopes
+reviewed: 2026-10-11T11:47:43Z
+depth: standard
+files_reviewed: 59
+files_reviewed_list:
+  - admin/openapi/admin.json
+  - admin/src/api/schema.d.ts
+  - admin/src/api/types.ts
+  - admin/src/components/account/ApiTokenCreateDialog.vue
+  - admin/src/components/account/ApiTokensPanel.vue
+  - admin/src/components/ui/ConfirmDialog.vue
+  - admin/src/views/AccountView.vue
+  - admin/tests/account/ApiTokenCreateDialog.test.ts
+  - admin/tests/account/ApiTokensPanel.test.ts
+  - admin/tests/fixtures/lang.json
+  - admin/tests/views/AccountView.test.ts
+  - cmd/summer/runtime.go
+  - docs/backend/admin-spa.md
+  - docs/backend/users-and-permissions.md
+  - docs/console/introduction.md
+  - docs/console/setup-and-maintenance.md
+  - docs/examples/blog/token_scopes.go
+  - docs/plugins/registration.md
+  - docs/services/authentication.md
+  - modules/bouncer/context.go
+  - modules/bouncer/context_test.go
+  - modules/cabana/account_tokens.go
+  - modules/cabana/account_tokens_test.go
+  - modules/cabana/admin_openapi.go
+  - modules/cabana/api_tokens.go
+  - modules/cabana/api_tokens_test.go
+  - modules/cabana/contracts.go
+  - modules/cabana/example_tokens_test.go
+  - modules/cabana/http.go
+  - modules/cabana/phase10_csrf_test.go
+  - modules/cabana/registry.go
+  - modules/cabana/token_commands.go
+  - modules/cabana/token_commands_test.go
+  - modules/cabana/token_guard.go
+  - modules/cabana/token_guard_test.go
+  - modules/cabana/token_postgres_smoke_test.go
+  - modules/cabana/token_postgres_test.go
+  - modules/cabana/token_routes_test.go
+  - modules/cabana/token_scopes.go
+  - modules/cabana/token_scopes_test.go
+  - modules/cabana/token_smoke_test.go
+  - modules/lagoon/backend_admin_migrations.go
+  - modules/lagoon/backend_admin_migrations_test.go
+  - modules/pact/capabilities.go
+  - modules/party/registry.go
+  - modules/party/registry_test.go
+  - modules/phrasebook/backend/lang/en/lang.yaml
+  - modules/phrasebook/backend/lang/pl/lang.yaml
+  - scripts/check-phase16.3.sh
+  - ../sm-journal-plugin/controllers/api/auth.go
+  - ../sm-journal-plugin/controllers/api/auth_test.go
+  - ../sm-journal-plugin/go.mod
+  - ../sm-journal-plugin/journal_api_token_smoke_test.go
+  - ../sm-journal-plugin/journal_api_tokens_test.go
+  - ../sm-journal-plugin/lang/en/lang.yaml
+  - ../sm-journal-plugin/lang/pl/lang.yaml
+  - ../sm-journal-plugin/README.md
+  - ../sm-journal-plugin/token_scopes.go
+  - ../sm-journal-plugin/token_scopes_test.go
+findings:
+  critical: 0
+  warning: 2
+  info: 2
+  total: 4
+status: issues_found
+---
+
+# Phase 16.3: Code Review Report
+
+**Reviewed:** 2026-10-11T11:47:43Z
+**Depth:** standard
+**Files Reviewed:** 59
+**Status:** issues_found
+
+## Summary
+
+Reviewed personal API token auth (cabana composite guard, scopes, account API, CLI), admin SPA tokens UI, Journal `ResolveBackend` integration, and phase unit/gate tests from plans 01–04 SUMMARY `key-files`.
+
+Token auth design is sound: plaintext never stored (sha256 + hint), Bearer `g15_` routed before JWT, `interactiveOnly` blocks token use on account/token/session routes, `ResolveBackend` is cookie-less, CSRF wraps token create/revoke, and Journal maps `ErrTokenScope` → 403. No Critical security defects found in the auth path.
+
+Two Warnings: a stale CSRF coverage golden leaves `go test ./modules/cabana` red while the phase gate stays green, and the create dialog enables Submit with no scope selected.
+
+## Warnings
+
+### WR-01: TestPhase10Coverage golden list omits account token routes
+
+**File:** `modules/cabana/phase10_coverage_test.go:90-124`
+**Issue:** Plan 01 added `POST /account/tokens` and `DELETE /account/tokens/{id}` and updated `TestPhase10CSRF` to expect 32 unsafe routes, but `TestPhase10Coverage/every_unsafe_mounted_route_is_CSRF-walked` still asserts the pre-token golden list (message still says "expects 30 besides login"). Confirmed failing:
+
+```text
+go test ./modules/cabana -run 'TestPhase10Coverage/every_unsafe' 
+# FAIL: missing DELETE /account/tokens/{id} and POST /account/tokens
+```
+
+`scripts/check-phase16.3.sh` does not require `TestPhase10Coverage`, so the phase gate can pass while `go test ./modules/cabana` (and the project “green at every commit” rule) fails. CSRF behavior for the new routes is covered dynamically by `TestPhase10CSRF`; the coverage golden is the regression.
+
+**Fix:** Add the two account-token routes to `want`, update the failure message to “32 besides login” (or count from `want`), and optionally add `TestPhase10Coverage` to `CABANA_RUN` / `CABANA_REQUIRE` in `scripts/check-phase16.3.sh`.
+
+```go
+want := []string{
+	"DELETE /account/avatar",
+	"DELETE /account/tokens/{id}",
+	// ...
+	"POST /account/avatar",
+	"POST /account/tokens",
+	"POST /auth/login",
+	// ...
+}
+```
+
+### WR-02: Create dialog Submit enabled with zero scopes selected
+
+**File:** `admin/src/components/account/ApiTokenCreateDialog.vue:63-64`
+**Issue:** `canSubmit` only requires that the picker finished loading with a non-empty catalog; it does not require `checked` to contain at least one scope. Users can click Create with nothing selected, hit a 422, then get focus moved to scopes. Server validation is correct; the client control still presents an enabled primary action for an invalid form.
+
+**Fix:** Include a selection check (and keep busy/loading/failure gates):
+
+```ts
+const canSubmit = computed(
+  () =>
+    !scopesLoading.value &&
+    !scopesFailed.value &&
+    scopes.value.length > 0 &&
+    selectedScopes().length > 0 &&
+    !busy.value,
+)
+```
+
+(Or derive from `checked.value.size` / `starChecked` equivalently.)
+
+## Info
+
+### IN-01: last_used_at in-process debounce stores success before the DB write
+
+**File:** `modules/cabana/api_tokens.go:277-289`
+**Issue:** `stampLastUsed` writes `lastStamp` before `StampLastUsed` returns. A failed UPDATE suppresses retries for up to a minute in that process (SQL also gates by minute; only the in-memory fast path is affected).
+**Fix:** Store into `lastStamp` only after a nil error, or delete the map entry on failure.
+
+### IN-02: Create-dialog scope checkboxes lack associated accessible names beyond the wrapping label
+
+**File:** `admin/src/components/account/ApiTokenCreateDialog.vue:491-517`
+**Issue:** Scope rows use a wrapping `<label>` (good) but the checkbox has no `aria-describedby` linking the description text; screen-reader users get the visible label text via the label association, which is acceptable. Optional improvement: wire description ids for longer scope blurbs.
+**Fix:** Optional only — add stable ids on description spans and `aria-describedby` on the inputs if UX audit wants richer announcements.
+
+---
+
+_Reviewed: 2026-10-11T11:47:43Z_
+_Reviewer: Claude (msd-code-reviewer)_
+_Depth: standard_

.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-SECURITY.md

@@ -0,0 +1,101 @@
+---
+phase: "16.3"
+slug: "backend-admin-personal-api-tokens-with-scopes"
+status: verified
+# threats_open = count of OPEN threats at or above workflow.security_block_on severity (the blocking gate)
+threats_open: 0
+asvs_level: 1
+created: "2026-10-12"
+---
+
+# Phase 16.3 — Security
+
+> Per-phase security contract: threat register, accepted risks, and audit trail.
+
+---
+
+## Trust Boundaries
+
+| Boundary | Description | Data Crossing |
+|----------|-------------|---------------|
+| client → admin API | Authorization header (JWT or g15_ token) and cookie; untrusted | credentials |
+| client → plugin routes via ResolveBackend | Bearer value only; plugin routes have no CSRF check | credentials |
+| plugin code → cabana boot | plugins declare token scopes and permissions compiled at boot | scope definitions |
+| operator → CLI | runs with database access; may mint for any user | plaintext token (stdout once) |
+| database → process | token rows; only hashes stored | sha256 hash, 4-char hint |
+| server → SPA | the 201 create response carries the plaintext once | plaintext token |
+| SPA → browser storage, clipboard | plaintext stays in component memory; clipboard is user-initiated | plaintext token |
+| server data → DOM | token names and plugin scope labels rendered as text | user/plugin strings |
+| agent → Journal API | Bearer JWT or g15_ token; untrusted | credentials |
+| executor → git origin | tags and branches read by other repositories | release refs |
+| tests → databases, network | throwaway containers only; no external servers | test data |
+
+---
+
+## Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation | Status |
+|-----------|----------|-----------|----------|-------------|------------|--------|
+| T-16.3-01 | Spoofing | compositeGuard token branch | high | mitigate | `wellFormedAPIToken` (cabana/api_tokens.go:59) before DB; crypto/rand mint; `subtle.ConstantTimeCompare` on hash (token_guard.go:93); owner reloaded per request | closed |
+| T-16.3-02 | Information Disclosure | backend_api_tokens | medium | mitigate | `TokenHash` is `json:"-"`, only `token_hint` exposed (api_tokens.go:29-30) | closed |
+| T-16.3-03 | Information Disclosure | create response, logs | high | mitigate | `logTokenAuth` logs outcome, method, path, remote, admin_id, token_id only — no Authorization value (token_guard.go:226-247) | closed |
+| T-16.3-04 | Elevation of Privilege | cabana.Allows | high | mitigate | Scoped branch runs before the IsSuperuser/empty shortcut (contracts.go:201-206); `allowsUnderScope` + `ownerHas` | closed |
+| T-16.3-05 | Elevation of Privilege | account, token, refresh, logout routes | high | mitigate | `interactiveOnly` 403 `interactive_only` (token_guard.go:151), wrapped outside `requireAjax` (http.go:254) | closed |
+| T-16.3-06 | Spoofing / Tampering (CSRF) | token transport, ResolveBackend | high | mitigate | Token branch reads only `Authorization: Bearer` (token_guard.go:141); `ResolveBackend` requires a Bearer and uses the cookie-less resolver (token_guard.go:196) | closed |
+| T-16.3-07 | Elevation of Privilege | owner loading | medium | mitigate | `g.users.FindByID` per request via `lazyBackendUsers` (token_guard.go:101, http.go:231) | closed |
+| T-16.3-08 | Elevation of Privilege | issueAPIToken (API and CLI) | medium | mitigate | `issueAPIToken` runs `validateTokenRequest` against the registry before insert (api_tokens.go:169) | closed |
+| T-16.3-09 | Denial of Service | last_used_at writes | low | mitigate | `stampThrottle` + conditional UPDATE (api_tokens.go:267-273) | closed |
+| T-16.3-10 | Denial of Service | invalid token floods | low | accept | See Accepted Risks AR-01 | closed |
+| T-16.3-11 | Tampering | scope registration | medium | mitigate | Boot refuses reserved, invalid-method and malformed scopes (token_scopes.go:114, :138) | closed |
+| T-16.3-12 | Repudiation | revoke | low | mitigate | Soft revoke stores `revoked_at`/`revoked_by` (api_tokens.go:220; CLI nil at token_commands.go:193); `admin.auth` events | closed |
+| T-16.3-13 | Elevation of Privilege | routes outside Allows | high | mitigate | `tokenRouteGate` on field types and markdown preview (field_type.go:870, field_markdown.go:77); route classification test token_routes_test.go | closed |
+| T-16.3-14 | Information Disclosure | ApiTokenCreateDialog plaintext | high | mitigate | Dialog-local `plaintext` ref cleared on close (line 87) and `onBeforeUnmount` (line 345); no storage/console/v-html/router use in components/account | closed |
+| T-16.3-15 | Information Disclosure | show-once step | low | accept | See Accepted Risks AR-02 | closed |
+| T-16.3-16 | Tampering (XSS) | token names, scope labels | medium | mitigate | No `v-html` in components/account; text interpolation only | closed |
+| T-16.3-17 | Elevation of Privilege | scope picker | low | mitigate | SPA reads `GET /account/tokens/scopes`; server re-validates on create (T-16.3-08) | closed |
+| T-16.3-18 | Elevation of Privilege | Journal ownership branches | high | mitigate | sm-journal-plugin controllers/api/auth.go: every principal from `cabana.ResolveBackend(app, r, "golem15.journal.*")`; journal_api_tokens_test.go matrix | closed |
+| T-16.3-19 | Elevation of Privilege | journal:read on write routes | high | mitigate | `journal:read` declares GET/HEAD only (journal token_scopes.go:23); guard `methodFilterScopes` on `r.Method` (token_guard.go:110, token_scopes.go:378) | closed |
+| T-16.3-20 | Spoofing / Tampering (CSRF) | Journal write routes | high | mitigate | Journal uses Bearer-only `ResolveBackend` (see T-16.3-06) | closed |
+| T-16.3-21 | Information Disclosure | Journal error bodies | low | mitigate | `resolveError` writes only the PHP constants (`Insufficient permissions` / auth required) | closed |
+| T-16.3-22 | Tampering / Repudiation | tag and pushes | high | mitigate | Human release checkpoint in 16.3-03; v0.1.21 tagged after v0.1.20, no moved tags | closed |
+| T-16.3-23 | Elevation of Privilege | code-declared role grants on Journal API | low | accept | See Accepted Risks AR-03 | closed |
+| T-16.3-24 | Repudiation (false green) | phase gate | medium | mitigate | scripts/check-phase16.3.sh fail-closed detectors, `--self-test`, NOT RUN postgres reporting | closed |
+| T-16.3-25 | Tampering (security regression) | Allows, guard, route gates, plaintext | high | mitigate | token_scopes/guard/routes/account/commands tests, SPA backstops, Journal token matrix in the gate | closed |
+| T-16.3-26 | Tampering | test isolation | low | mitigate | Stubs, httptest, happy-dom; testcontainers for Postgres | closed |
+| T-16.3-SC | Tampering | npm/pip/cargo installs | high | mitigate | No packages installed in any plan; committed lockfiles and go.sum; swag pinned v1.16.6 | closed |
+
+*Status: open · closed · open — below high threshold (non-blocking)*
+*Severity: critical > high > medium > low — only open threats at or above workflow.security_block_on count toward threats_open*
+*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*
+
+---
+
+## Accepted Risks Log
+
+| Risk ID | Threat Ref | Rationale | Accepted By | Date |
+|---------|------------|-----------|-------------|------|
+| AR-01 | T-16.3-10 | Format check precedes an indexed unique lookup; 160-bit secrets are not guessable; the admin API has no throttle bucket beyond login, so no new one is added | Plan 16.3-01 threat model (user-approved plan) | 2026-10-12 |
+| AR-02 | T-16.3-15 | Full token shown once by design (UI-SPEC §5) so the user can verify it; overlay clicks cannot close the step, closing before copying asks first | Plan 16.3-02 threat model (user-approved plan) | 2026-10-12 |
+| AR-03 | T-16.3-23 | Honouring code-declared role grants on the Journal API is the intended fix (the admin API already honours them); documented in the Journal README as a behaviour change | Plan 16.3-03 threat model (user-approved plan) | 2026-10-12 |
+
+*Accepted risks do not resurface in future audit runs.*
+
+---
+
+## Security Audit Trail
+
+| Audit Date | Threats Total | Closed | Open | Run By |
+|------------|---------------|--------|------|--------|
+| 2026-10-12 | 27 | 27 | 0 | msd-secure-phase (orchestrator, ASVS L1 grep-depth; auditor skipped per short-circuit rule) |
+| 2026-10-12 | 27 | 27 | 0 | msd-secure-phase re-audit (State A): no changes to guarded code since b519c9c; register unchanged |
+
+---
+
+## Sign-Off
+
+- [x] All threats have a disposition (mitigate / accept / transfer)
+- [x] Accepted risks documented in Accepted Risks Log
+- [x] `threats_open: 0` confirmed
+- [x] `status: verified` set in frontmatter
+
+**Approval:** verified 2026-10-12