docs(14.1): reset STATE progress bar after planning

The planned-phase write left the previous phase's 100% bar; execution of 14.1 has not started.

Co-authored-by: Cursor <cursoragent@cursor.com>

.planning/ROADMAP.md

@@ -649,7 +649,7 @@ Plans:
   5. The new code has unit tests, delivered in the phase's last plan.
 
 **Open questions (discuss-phase):** impersonate user in or out of scope (security-sensitive); a separate permission for granting the `admin` group (it makes a site admin); whether convert-guest is needed for the application's data.
-**Plans:** 1/5 plans executed
+**Plans:** 5/5 plans executed
 
 Plans:
 
@@ -657,16 +657,16 @@ Plans:
 - [x] 12.1-01-PLAN.md — Framework actions (summercms.go): declared bulk actions, record actions, row state and `cabana.ForbiddenError` (403), with READMEs, docs, OpenAPI, TS types, `dist/` and the neutral `acme` fixture
 
 **Wave 2** *(blocked on Wave 1 completion)*
-- [ ] 12.1-02-PLAN.md — Framework preview and form seams (summercms.go): preview context, `permissioneditor`, `password`, form virtual fields, per-operation rules, writable foreign key, locked relation options, `invisible` columns, `preset`; ends with the tag v0.1.3
+- [x] 12.1-02-PLAN.md — Framework preview and form seams (summercms.go): preview context, `permissioneditor`, `password`, form virtual fields, per-operation rules, writable foreign key, locked relation options, `invisible` columns, `preset`; ends with the tag v0.1.3
 
 **Wave 3** *(blocked on Wave 2 completion)*
-- [ ] 12.1-03-PLAN.md — Plugin foundation and the Users screen (sm-user-plugin): additive migrations, permissions, navigation, list, filters, preview, form, bulk and record actions, delete semantics, password and invite, avatar, frontend permission resolver, `last_seen`, and the takeover guard for members of privileged groups (D-30)
+- [x] 12.1-03-PLAN.md — Plugin foundation and the Users screen (sm-user-plugin): additive migrations, permissions, navigation, list, filters, preview, form, bulk and record actions, delete semantics, password and invite, avatar, frontend permission resolver, `last_seen`, and the takeover guard for members of privileged groups (D-30)
 
 **Wave 4** *(blocked on Wave 3 completion)*
-- [ ] 12.1-04-PLAN.md — User Groups and Organisations screens, the `members` relation manager, the privileged-group guard on every `users_groups` write path (T-12-18), and the application's parity allow-list entry and submodule pointer on framework v0.1.3
+- [x] 12.1-04-PLAN.md — User Groups and Organisations screens, the `members` relation manager, the privileged-group guard on every `users_groups` write path (T-12-18), and the application's parity allow-list entry and submodule pointer on framework v0.1.3
 
 **Wave 5** *(blocked on Wave 4 completion)*
-- [ ] 12.1-05-PLAN.md — Unit tests last: full coverage in both repos, `scripts/check-phase12.1.sh`, the security review and the validation sign-off, then the plugin push (only when v0.1.3 is on origin)
+- [x] 12.1-05-PLAN.md — Unit tests last: full coverage in both repos, `scripts/check-phase12.1.sh`, the security review and the validation sign-off, then the plugin push (only when v0.1.3 is on origin)
 
 ### Phase 12.2: Admin form fields: date, file upload, relation editing with deferred binding (INSERTED)
 
@@ -798,10 +798,15 @@ Plans:
   3. `GET /api/v1/fonoteka/me` matches the PHP response for fonoteka-mcp token callers.
   4. All three manifest entries flip from `pending` to ported with recorded PHP cases, leaving zero pending routes.
 
-**Plans:** 0 plans
+**Plans:** 2 plans
 
 Plans:
-- [ ] TBD (run /gsd-plan-phase 14.1 to break down)
+
+**Wave 1**
+- [ ] 14.1-01-PLAN.md — Model, migration, exported Index/Destroy, JWT mount, `/me` null, D-10 recording and manifest flip
+
+**Wave 2** *(blocked on Wave 1 completion)*
+- [ ] 14.1-02-PLAN.md — Unit tests last: OAuthIdentityApiTest port, migration, MeToken null, secret-leak, corpus 175/175/0
 
 ### Phase 15: Cutover
 
@@ -843,7 +848,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 12. Płytarium API — Collections and Albums | 5/5 | Complete   | 2026-10-02 |
 | 13. Płytarium API — wishlist, notifications, CSV, credentials, public routes | 6/6 | In Progress|  |
 | 14. Domain jobs and external integrations | 6/6 | In Progress|  |
-| 14.1. OAuth identities and fonoteka me routes (INSERTED) | 0/TBD | Not started | - |
+| 14.1. OAuth identities and fonoteka me routes (INSERTED) | 0/2 | Planned | - |
 | 15. Cutover | 0/TBD | Not started | - |
 
 ## Backlog

.planning/STATE.md

@@ -1,19 +1,19 @@
 ---
 gsd_state_version: "1.0"
 milestone: v1.0
-current_phase: "12.1"
-current_phase_name: User plugin admin screens
+current_phase: "14.1"
+current_phase_name: OAuth identities and fonoteka me routes
 status: executing
-stopped_at: Completed 12.1-01-PLAN.md
-last_updated: "2026-10-04T21:55:37.374Z"
-last_activity: 2026-10-04
-last_activity_desc: Phase 12.1 execution started
-state_head: 71073bc8a2c5a1f2030a49bbe351bf2baad1a480
+stopped_at: Completed 12.1-05-PLAN.md
+last_updated: "2026-10-05T17:48:29.325Z"
+last_activity: 2026-10-05
+last_activity_desc: Completed quick task 261005-qvk (Winter icon-* mapping)
+state_head: 5c65a94db0807aed66264e706ca5cbc9344d498b
 progress:
   total_phases: 22
   completed_phases: 11
-  total_plans: 123
-  completed_plans: 119
+  total_plans: 125
+  completed_plans: 122
 milestone_name: milestone
 ---
 
@@ -24,16 +24,16 @@ milestone_name: milestone
 See: .planning/PROJECT.md (updated 2026-09-16)
 
 **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
-**Current focus:** Phase 12.1 — User plugin admin screens
+**Current focus:** Phase 14.1 — OAuth identities and fonoteka me routes
 
 ## Current Position
 
-Phase: 12.1 (User plugin admin screens) — EXECUTING
-Plan: 2 of 5
-Status: Ready to execute
-Last activity: 2026-10-04 — Phase 12.1 execution started
+Phase: 14.1 (OAuth identities and fonoteka me routes) — READY TO EXECUTE
+Plan: 0 of 2
+Status: Planning complete; ready to execute
+Last activity: 2026-10-05 - Completed quick task 261005-qvk: Map Winter icon-* navigation names onto lucide so BM Studies and Quizzes icons render
 
-Progress: [██████░░░░] 60%
+Progress: [░░░░░░░░░░] 0%
 
 ## Performance Metrics
 
@@ -173,6 +173,10 @@ Progress: [██████░░░░] 60%
 | Phase 14 P05 | 100min | 3 tasks | 93 files |
 | Phase 14 P06 | 132 min | 4 tasks | 26 files |
 | Phase 12.1 P01 | 38min | 4 tasks | 61 files |
+| Phase 12.1 P02 | 12h 43m | 6 tasks | 77 files |
+| Phase 12.1 P03 | 46min | 4 tasks | 40 files |
+| Phase 12.1 P04 | 32min | 4 tasks | 35 files |
+| Phase 12.1 P05 | 103min | 3 tasks | 56 files |
 
 ## Accumulated Context
 
@@ -540,6 +544,21 @@ Recent decisions affecting current work:
 - [Phase 12.1]: 12.1-01: a 403 on save is the forbidden banner (not a toast) for every 403, plugin refusal or framework denial
 - [Phase 12.1]: 12.1-01: plugin writes to a soft-deleted record must use tx.Unscoped(); cabana's update write does
 - [Phase 12.1]: 12.1-01: RecordActions.vue is unmounted until 12.1-02 adds the preview footer; it emits done with the toast text for its host to show
+- [Phase 12.1]: 12.1-02: v0.1.3 is an annotated local tag on df5cace (user chose tag-local); pushing master and v0.1.3 is a pending release step, and the sm-user-plugin push of plan 05 waits for it
+- [Phase 12.1]: 12.1-02: a form with recordActions must declare preview:; preview: {} enables the screen without a status hint and a null preview: stops boot
+- [Phase 12.1]: 12.1-02: password, permissioneditor and preset are refused on settings forms and relation forms; a type: password field must be listed in FormVirtualFields
+- [Phase 12.1]: 12.1-02: relation locks are enforced on form create and update only; relation-manager link and unlink routes do not ask RelationLockProvider (open for plan 05)
+- [Phase 12.1]: 12.1-02: the SPA sends a permissioneditor field on every update reduced to offered codes; a locked code with a stored value outside the mode's set makes every save a 403 (open for plan 05)
+- [Phase 12.1]: 12.1-02: pact.FilterOptions keeps its signature and is asked on the admin controller before the model
+- [Phase 12.1]: Users admin controller and its guard live in sm-user-plugin: a privileged-group member's email, password and permanent delete need golem15.users.manage_privileged_groups; refusals are cabana.ForbiddenError (D-30)
+- [Phase 12.1]: HasPermission ports Winter line by line: a leading asterisk is a wildcard on the asked code only; PermissionSet.Scan fails on content that is not a JSON object rather than read it as empty
+- [Phase 12.1]: A user created in the admin gets has_self_set_password true and stays not activated; the invitation carries the login and the activation link, never the password
+- [Phase 12.1]: Plugin admin tests boot the plugin alone through newAdminEnv; mail is read from the log driver because the mailer service cannot be replaced after party.Activate
+- [Phase 12.1]: 12.1-04: the user form's groups field is the only writer of users_groups; privileged groups are locked through cabana.RelationLockProvider and need golem15.users.manage_privileged_groups on create and update
+- [Phase 12.1]: 12.1-04: creating a group with a privileged code, changing a code to or from one and deleting a privileged group need the extra permission; name, description and frontend permissions of a privileged group need only access_groups
+- [Phase 12.1]: 12.1-04: Organisation gained the Go relation field Members (no column) because the relation manager requires the relation on the owner model
+- [Phase 12.1]: 12.1-04: the organisation members manager links only users without an organisation; a user moves by unlink then link, or through the user form's organisation field
+- [Phase 12.1]: 12.1-04: nothing was pushed; the fonoteka.go pointer names an unpublished plugin commit, so the order is framework tag, then sm-user-plugin (plan 05 Task 3), then fonoteka.go
 
 ### Pending Todos
 
@@ -566,6 +585,7 @@ Recent decisions affecting current work:
 - Phase 9 (admin schema pipeline / relation manager) is the least-precedented design surface in the research — plan with `--research-phase`.
 - Phase 11 (River dual-driver split) is documented but unverified against a real build — plan with `--research-phase` and budget a timed-latency test.
 - Phase 8 UI gate: scripts/check-phase8-ui.mjs --final-gate's real Playwright browser matrix (32 UI-SPEC scenarios) is unimplemented (deliberate fatal() at check-phase8-ui.mjs:458, never authored by 08-05); stage_ui_harness must keep failing closed until a Playwright spec is authored. User approved Phase 8 closure on 2026-09-24 with this gap carried forward -- see 08-10-SUMMARY.md and .planning/phases/08-oauth2-1-authorization-server/deferred-items.md.
+- pending: push sm-user-plugin — 12.1-05 Task 3 condition (c) failed (`git ls-remote --tags origin v0.1.3` empty). Push summercms.go master and annotated tag v0.1.3 (local on df5cace) first, then the plugin, then fonoteka.go. Recorded in 12.1-05-SUMMARY.md.
 
 ### Quick Tasks Completed
 
@@ -578,6 +598,7 @@ Recent decisions affecting current work:
 | 260928-lf2 | Rewrite module READMEs and root README as professional app-agnostic docs | 2026-09-28 | fafb12f | [260928-lf2-rewrite-module-readmes-and-root-readme-a](./quick/260928-lf2-rewrite-module-readmes-and-root-readme-a/) |
 | 261001-ddh | Replace lagoon hardcoded ICU pl-PL database locale with per-query COLLATE option | 2026-10-01 | 037dc53 | [261001-ddh-replace-lagoon-hardcoded-icu-pl-pl-datab](./quick/261001-ddh-replace-lagoon-hardcoded-icu-pl-pl-datab/) |
 | 261004-rou | Move API-token ownership from Fonoteka to sm-user-plugin | 2026-10-04 | d1abcab | [261004-rou-move-user-api-tokens-from-fonoteka-plugi](./quick/261004-rou-move-user-api-tokens-from-fonoteka-plugi/) |
+| 261005-qvk | Map Winter icon-* navigation names onto lucide so BM Studies and Quizzes icons render | 2026-10-05 | a00dafa | [261005-qvk-fix-icons-sm-bm-plugin-tried-to-apply-ic](./quick/261005-qvk-fix-icons-sm-bm-plugin-tried-to-apply-ic/) |
 
 ## Deferred Items
 
@@ -589,6 +610,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-04T21:55:36.836Z
-Stopped at: Completed 12.1-01-PLAN.md
+Last session: 2026-10-05T12:09:49.753Z
+Stopped at: Completed 12.1-04-PLAN.md
 Resume file: None

.planning/WINDOWS.md

@@ -1,10 +1,10 @@
 ---
 schema_version: 1
-open_count: 5
+open_count: 4
 waived_count: 0
-fixed_count: 4
-total_count: 9
-last_updated: 2026-10-04T21:55:30.405Z
+fixed_count: 6
+total_count: 10
+last_updated: 2026-10-05T12:07:04.853Z
 ---
 
 # Broken Windows Ledger
@@ -23,7 +23,8 @@ last_updated: 2026-10-04T21:55:30.405Z
 | 6 | 10.1 | stub | plugins/golem15/fonoteka/controllers/albums_admin_controller.go | 71 | fonoteka.go: discogsLookup widget action is a D-02 stub answering fixed fill {year: 1977, format: LP}; Phase 14 replaces it with the Discogs client | open |  | 2026-09-29T00:27:32.945Z |  |
 | 7 | 10.1 | stub | plugins/golem15/fonoteka/controllers/albums_admin_controller.go | 82 | fonoteka.go: discogsSync toolbar action is a D-02 stub answering stub_not_implemented and changing nothing; Phase 14 replaces it with the Discogs sync | open |  | 2026-09-29T00:27:33.153Z |  |
 | 8 | 11 | skipped-test | parity/broadcast_goldens_test.go |  | fonoteka.go: TestBroadcastGoldens/created and /updated t.Skip as pending; Phase 12 turns the recorded PHP created/updated goldens into assertions (album subtree, literal created_at/updated_at and artist id handling) | open |  | 2026-09-30T11:32:37.302Z |  |
-| 9 | 12.1 | stub | admin/src/components/form/RecordActions.vue |  | RecordActions.vue is built and tested but not mounted; plan 12.1-02 mounts it in the preview footer, until then meta.actions is served and no screen shows the buttons | open |  | 2026-10-04T21:55:30.405Z |  |
+| 9 | 12.1 | stub | admin/src/components/form/RecordActions.vue |  | RecordActions.vue is built and tested but not mounted; plan 12.1-02 mounts it in the preview footer, until then meta.actions is served and no screen shows the buttons | fixed |  | 2026-10-04T21:55:30.405Z | 2026-10-05T10:41:16.319Z |
+| 10 | 12.1 | unmet-truth | .planning/phases/12.1-user-plugin-admin-screens/deferred-items.md |  | fonoteka.go: four application tests pin lists the user plugin's admin work changes (TestAdminMetadataFiltering nav list, TestHiddenNeverMarshals user model count, parity TestMigrateSeedsCanonicalGenres and TestRollbackLastIsolatesFonoteka migration ids); with the two from plan 12.1-02 they keep plan 12.1-03's application verify red until plan 12.1-04 updates them | fixed |  | 2026-10-05T11:31:36.781Z | 2026-10-05T12:07:04.853Z |
 
 ````json
 [
@@ -138,10 +139,23 @@ last_updated: 2026-10-04T21:55:30.405Z
     "file": "admin/src/components/form/RecordActions.vue",
     "line": null,
     "description": "RecordActions.vue is built and tested but not mounted; plan 12.1-02 mounts it in the preview footer, until then meta.actions is served and no screen shows the buttons",
-    "status": "open",
+    "status": "fixed",
     "reason": "",
     "recorded_at": "2026-10-04T21:55:30.405Z",
-    "resolved_at": null,
+    "resolved_at": "2026-10-05T10:41:16.319Z",
+    "milestone": "v1.0"
+  },
+  {
+    "id": 10,
+    "kind": "unmet-truth",
+    "phase": "12.1",
+    "file": ".planning/phases/12.1-user-plugin-admin-screens/deferred-items.md",
+    "line": null,
+    "description": "fonoteka.go: four application tests pin lists the user plugin's admin work changes (TestAdminMetadataFiltering nav list, TestHiddenNeverMarshals user model count, parity TestMigrateSeedsCanonicalGenres and TestRollbackLastIsolatesFonoteka migration ids); with the two from plan 12.1-02 they keep plan 12.1-03's application verify red until plan 12.1-04 updates them",
+    "status": "fixed",
+    "reason": "",
+    "recorded_at": "2026-10-05T11:31:36.781Z",
+    "resolved_at": "2026-10-05T12:07:04.853Z",
     "milestone": "v1.0"
   }
 ]

.planning/phases/12.1-user-plugin-admin-screens/12.1-02-SUMMARY.md

@@ -0,0 +1,449 @@
+---
+phase: 12.1-user-plugin-admin-screens
+plan: 02
+subsystem: admin
+tags: [cabana, pact, admin-spa, preview, permissioneditor, password, virtual-fields, relation-lock, vue, openapi, release]
+
+requires:
+  - phase: 12.1-user-plugin-admin-screens
+    provides: "plan 01: record actions with meta.actions, cabana.ForbiddenError, RecordActions.vue, the acme.roster fixture"
+  - phase: 12.2-admin-form-fields
+    provides: lagoon.Transaction write paths, datepicker and fileupload read-only modes, tags v0.1.1 and v0.1.2
+provides:
+  - "config_form.yaml preview block, context: preview, the SPA preview route and PreviewView.vue"
+  - "pact.FormVirtualFields, pact.FormRules, cabana.VirtualFieldsFromContext"
+  - "fields.yaml types password and permissioneditor, key preset"
+  - "cabana.PermissionOption, cabana.PermissionEditorProvider"
+  - "cabana.FieldRelationContract.WritableForeignKey, cabana.RelationLock, cabana.RelationLockProvider, RelationOption.Locked"
+  - "columns.yaml invisible; pact.FilterOptions asked on the controller before the model"
+  - "annotated tag v0.1.3 on df5cace (local; push pending)"
+affects: [12.1-03, 12.1-04, 12.1-05, sm-user-plugin admin controllers, fonoteka.go admin inventory tests]
+
+actuals:
+  tokens: 362238   # chars/4 over the whole realized diff; 83998 without dist, admin.json and schema.d.ts
+  tasks: 6
+  commits: 4
+plan_head_before: 1c99de50134d5f53248c91f4b234770154a2ccdb
+plan_head_after: df5cace8525bc10fa40b25552137290793c08bb3
+
+tech-stack:
+  added: []
+  patterns:
+    - "One file per field type (field_permission.go beside field_date.go and field_file.go)"
+    - "Per-request schema parts (permission options) are set on the localized copy, never on the cached schema"
+    - "Form-only values travel to hooks on the transaction context, never through Fill or the projection"
+    - "Locks are enforced inside the save transaction before any row write; the flag on options is display only"
+
+key-files:
+  created:
+    - modules/cabana/field_permission.go
+    - modules/cabana/phase121_form_test.go
+    - modules/cabana/example_form_seams_test.go
+    - modules/cabana/testdata/roster/controllers/people/_status.htm
+    - modules/cabana/testdata/roster/controllers/people/config_filter.yaml
+    - admin/src/views/PreviewView.vue
+    - admin/src/components/form/PreviewField.vue
+    - admin/src/components/form/fields/PasswordField.vue
+    - admin/src/components/form/fields/PermissionEditorField.vue
+    - admin/tests/smoke/preview.smoke.test.ts
+    - admin/tests/smoke/seams.smoke.test.ts
+    - admin/tests/fixtures/roster.form-schema.json
+  modified:
+    - modules/pact/capabilities.go
+    - modules/cabana/form_schema.go
+    - modules/cabana/schema_types.go
+    - modules/cabana/crud.go
+    - modules/cabana/tx_context.go
+    - modules/cabana/extension.go
+    - modules/cabana/relation_field.go
+    - modules/cabana/list_schema.go
+    - modules/cabana/filter_schema.go
+    - modules/cabana/http.go
+    - modules/cabana/messages.go
+    - modules/cabana/settings.go
+    - modules/cabana/relation_form.go
+    - admin/src/app/router.ts
+    - admin/src/app/winterUrl.ts
+    - admin/src/views/FormView.vue
+    - admin/src/components/form/formState.ts
+    - admin/src/components/form/control.ts
+    - admin/src/components/form/fields/RelationField.vue
+    - admin/src/components/list/DataTable.vue
+    - admin/src/styles/main.css
+
+key-decisions:
+  - "Task 5 answer: tag-local. v0.1.3 is an annotated local tag on df5cace; master and the tag are not pushed"
+  - "password, permissioneditor and preset are refused on settings forms and on relation (manage and pivot) forms"
+  - "The SPA sends a permissioneditor field on every update, reduced to the offered codes"
+  - "Relation locks are enforced on form create and update only; relation-manager link and unlink routes do not ask the lock provider"
+  - "pact.FilterOptions keeps its signature (no context parameter); the controller is asked before the model"
+  - "A null preview: is detected by checking the document's root keys, because goccy does not call a custom unmarshaler for null"
+
+patterns-established:
+  - "A form that declares recordActions must declare preview:; write preview: {} for a screen without a status hint"
+  - "A type: password field must be listed in the controller's FormVirtualFields"
+  - "A new required message key needs the typed SPA fixtures and the conformance fixture updated in the same commit"
+
+requirements-completed: [SC-1, SC-2, SC-3, SC-4]  # copied from the plan; these are phase success criteria shared with plans 03 to 05, which finish them
+
+coverage:
+  - id: D1
+    description: "Preview screen: preview block, context preview, status hint partial, record actions and the edit button in the footer, preview redirects"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestPreviewSmoke"
+        status: pass
+      - kind: automated_ui
+        ref: "admin/tests/smoke/preview.smoke.test.ts#preview screen (UI-SPEC S3, D-11)"
+        status: pass
+      - kind: automated_ui
+        ref: "admin/tests/smoke/preview.smoke.test.ts#preview footer (UI-SPEC S2, D-10)"
+        status: pass
+      - kind: automated_ui
+        ref: "admin/tests/smoke/preview.smoke.test.ts#preview URLs (T-12.1-16)"
+        status: pass
+      - kind: manual_procedural
+        ref: "Task 1 tracer checkpoint: the user opened the preview on the demo server and approved it"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Password field with confirmation and form-only (virtual) fields that reach hooks and are never bound, filled or returned"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestPasswordFieldSmoke"
+        status: pass
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestVirtualFieldsSmoke"
+        status: pass
+      - kind: automated_ui
+        ref: "admin/tests/smoke/seams.smoke.test.ts#password field (UI-SPEC S7, D-19)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Rules per operation from the controller (pact.FormRules) and the preset key on text fields"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestFormRulesSmoke"
+        status: pass
+      - kind: unit
+        ref: "modules/cabana/phase121_form_test.go#TestPresetSchema"
+        status: pass
+      - kind: automated_ui
+        ref: "admin/tests/smoke/seams.smoke.test.ts#preset (D-27 G7)"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "permissioneditor field in radio or checkbox mode: per-request options, 422 for unknown codes and values, 403 for a changed locked code, kept unknown stored codes"
+    requirement: SC-2
+    verification:
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestPermissionEditorSmoke"
+        status: pass
+      - kind: automated_ui
+        ref: "admin/tests/smoke/seams.smoke.test.ts#permission editor (UI-SPEC S5, D-16)"
+        status: pass
+    human_judgment: true
+    rationale: "Section layout, the three-segment control, wrapping below 640px and dark mode are visual; the checkbox-mode value set has no HTTP test yet (plan 05)."
+  - id: D5
+    description: "Writable protected foreign key through a relation field, and locked relation options enforced with 403 on create and update"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestWritableForeignKeySmoke"
+        status: pass
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestRelationLockSmoke"
+        status: pass
+      - kind: automated_ui
+        ref: "admin/tests/smoke/seams.smoke.test.ts#locked relation options (UI-SPEC S6, D-07)"
+        status: pass
+    human_judgment: true
+    rationale: "Relation-manager link and unlink routes do not ask the lock provider; whether that is acceptable for T-12-18 is a review decision for plans 04 and 05."
+  - id: D6
+    description: "Invisible list columns (searched, not sent, not rendered) and filter choices served by the controller"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestInvisibleColumnSmoke"
+        status: pass
+      - kind: integration
+        ref: "modules/cabana/phase121_form_test.go#TestFilterOptionsController"
+        status: pass
+      - kind: automated_ui
+        ref: "admin/tests/smoke/seams.smoke.test.ts#invisible list column (D-27 G6)"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "Framework released as the annotated tag v0.1.3 on a head where every plan gate passed; push pending by the user's choice"
+    requirement: SC-4
+    verification:
+      - kind: other
+        ref: "git cat-file -t v0.1.3 = tag; git rev-parse 'v0.1.3^{commit}' = df5cace8525bc10fa40b25552137290793c08bb3"
+        status: pass
+      - kind: other
+        ref: "Task 6 gate table in this summary"
+        status: pass
+    human_judgment: true
+    rationale: "The push of master and v0.1.3 is a pending release step, and two application inventory tests outside the plan's gate fail against this tree (see Issues Encountered)."
+
+duration: 12h 43m
+completed: 2026-10-05
+status: complete
+---
+
+# Phase 12.1 Plan 02: Framework preview and form seams Summary
+
+**Any plugin form can now have a read-only preview screen with a status hint and record actions, a password with confirmation, form-only fields that reach hooks, its own admin rules per operation, a permission editor, a writable foreign-key picker, locked relation options the server enforces, preset fields and hidden search columns. The framework is tagged v0.1.3 locally on `df5cace`; nothing was pushed.**
+
+## Performance
+
+- **Duration:** 12h 43m wall clock, including two waits for the user (the Task 1 tracer checkpoint and the Task 5 decision) and an overnight pause. Task 6 itself took about 8 minutes.
+- **Started:** 2026-10-04T21:57:49Z
+- **Completed:** 2026-10-05T10:41:16Z
+- **Tasks:** 6 of 6 (four code tasks, the decision checkpoint, the release task)
+- **Files modified:** 77 source files, plus the rebuilt `modules/boardwalk/dist` (82 paths in total)
+
+## Accomplishments
+
+- A list row opens a preview screen: the record as a read-only `dl` grid, a status hint partial above the card, the record actions of plan 01 and one edit button in the footer. `RecordActions.vue` is now mounted, which closes WINDOWS entry 9.
+- A form collects a password with confirmation and other form-only values. The framework never binds, fills or returns them; hooks read them with `cabana.VirtualFieldsFromContext`.
+- A controller supplies the validation rules of an admin save per operation, replacing the model's `Rules()`.
+- A `permissioneditor` field shows the permissions a controller offers, in radio or checkbox mode. The server accepts only offered codes and allowed values and refuses a change to a locked code with 403.
+- A relation field can write a protected foreign key when its contract says so, and a controller can lock related ids per admin; a save that changes the locked subset is refused with 403 before any row is written.
+- `columns.yaml` accepts `invisible: true`, text fields accept `preset`, and scope-filter choices can come from the controller.
+
+## Release: v0.1.3
+
+| Item | Value |
+|------|-------|
+| Option chosen at Task 5 | `tag-local` |
+| Tag | `v0.1.3`, annotated, message "SummerCMS v0.1.3: bulk and record actions, preview screen, row state, permission editor, form seams" |
+| Tagged commit | `df5cace8525bc10fa40b25552137290793c08bb3` |
+| On origin | No. `git ls-remote --tags origin v0.1.3` lists nothing |
+| Earlier tags | `v0.1.1` (5c38d96) and `v0.1.2` (6525d96) unchanged |
+
+**Pending release steps (not done, by the user's choice):**
+
+1. Push framework `master` and the tag: `git push origin master v0.1.3`. `master` was 10 commits ahead of `origin/master` at the tag, plus the planning commits made after it.
+2. The sm-user-plugin push of plan 05 Task 3 waits for step 1. It runs only when `git ls-remote --tags origin v0.1.3` lists the tag, because a published plugin commit must not depend on an unpublished framework contract.
+
+Until the push, the local tag can still be moved if a name has to change.
+
+### Gates on the tagged head (measured, for VALIDATION.md)
+
+All ran on `df5cace` with a clean tree (only the three untracked files that predate this plan).
+
+| Gate | Result | Time |
+|------|--------|------|
+| `go vet ./...` | pass | under 1 s (build cache warm) |
+| `go test ./... -count=1` | pass, no `FAIL` line | 52 s |
+| `go test ./modules/cabana -run '^(TestPhase09ContractInventory\|TestPhase09PermissionMatrix\|TestPhase10OpenAPIConformance)$' -count=1 -v` | 3 of 3 pass | 16 s |
+| `npm --prefix admin run typecheck` | pass | 10 s |
+| `npm --prefix admin test` | 63 files, 848 tests pass | 26 s |
+| `scripts/check-admin-openapi.sh --check` | clean | 2 s |
+| `scripts/check-admin-dist.sh` | "modules/boardwalk/dist matches a fresh build" | 16 s |
+| `go test ./cmd/summer -run TestDocsTree -count=1` | pass | 4 s |
+| `go run ./cmd/summer docs:build --check` | "no problems found" | 2 s |
+| `go -C ../fonoteka.go build ./...` | pass | 3 s |
+| `go -C ../fonoteka.go vet ./...` | pass | under 1 s |
+| `go -C ../fonoteka.go test ./... -count=1` | pass (root module: `fonoteka`, `fonoteka/parity`) | 69 s |
+
+Earlier rough numbers from Tasks 1 to 4: `go test ./modules/cabana/... -count=1` about 33 s, `npm --prefix admin test` about 22 s.
+
+Extra runs, not part of the plan's gate (the application's go.work plugin modules, which `./...` in the root module does not match):
+
+| Module | vet | test |
+|--------|-----|------|
+| `plugins/golem15/user` | pass | pass, 18 s |
+| `plugins/golem15/golem` | pass | pass, 8 s |
+| `plugins/golem15/feedback` | pass | pass, 8 s |
+| `plugins/golem15/fonoteka` | pass | **2 tests fail**, 98 s (see Issues Encountered) |
+
+## Contract names (inputs to plans 03 to 05)
+
+Every name below was checked with `go doc` at the tagged commit.
+
+| Name | Shape |
+|------|-------|
+| `pact.FormVirtualFields` | `FormVirtualFields() []string` |
+| `pact.FormRules` | `FormRules(ctx context.Context, op string) map[string]string`; op is `create` or `update` |
+| `pact.FilterOptions` | unchanged: `FilterOptions(scope string) []Option`; the admin controller is asked before the model |
+| `cabana.VirtualFieldsFromContext` | `(ctx context.Context) (map[string]any, bool)`; a copy; false outside a create or update save |
+| `cabana.FormPreview` | `HeaderPartial string` (json `headerPartial`, omitempty) |
+| `cabana.FormView.Preview` | `*FormPreview` (json `preview`, omitempty) |
+| `cabana.FormMessages.Preview`, `.Edit` | YAML and JSON keys `preview`, `edit` |
+| `cabana.FieldPreset` | `Field` (json `field`), `Type` (json `type`: `slug` or `exact`) |
+| `cabana.FormField.Preset` | `*FieldPreset` |
+| `cabana.PermissionOption` | `Code, Label, Tab, Comment string; Locked bool` (json `code`, `label`, `tab`, `comment`, `locked`; the last three omitempty) |
+| `cabana.FormField.PermissionOptions` | `[]PermissionOption` (json `permissionOptions`, omitempty) |
+| `cabana.PermissionEditorProvider` | `AdminPermissionOptions(ctx, field string) ([]PermissionOption, error)`; `AdminPermissionValues(ctx, field string, record any) (map[string]int, error)`; `AdminSetPermissionValues(ctx, field string, record any, values map[string]int) error` |
+| `cabana.FieldRelationContract.WritableForeignKey` | `bool`; belongsTo only |
+| `cabana.RelationLock` | `IDs []uint; Message string` |
+| `cabana.RelationLockProvider` | `AdminRelationLocks(ctx context.Context, field string) (RelationLock, error)` |
+| `cabana.RelationOption.Locked` | `bool` (json `locked`, omitempty) |
+| `cabana.ListColumn.Invisible` | `bool` (json `invisible`, omitempty) |
+| TS aliases | `FormPreview`, `FieldPreset`, `PermissionOption` |
+
+The tag also publishes the plan 01 names (`pact.AdminBulkAction`, `HasAdminBulkActions`, `AdminRecordAction`, `HasAdminRecordActions`, `RowState`, `ListRowStates`; `cabana.ForbiddenError`, `BulkActionResult`, `RecordAction`); see 12.1-01-SUMMARY.md.
+
+YAML: `config_form.yaml` `preview:` (a mapping with the optional key `headerPartial`; `preview: {}` enables the screen without a hint; a null value stops boot) and `messages.preview`, `messages.edit`; `fields.yaml` types `password` and `permissioneditor`, `mode: radio|checkbox` on `permissioneditor`, `preset` on text fields (a field name, or `field` plus `type`); `columns.yaml` `invisible`.
+
+SPA: route `preview` at `/:vendor/:plugin/:controller/:id/preview`; `PreviewView.vue`, `PreviewField.vue`, `PasswordField.vue`, `PermissionEditorField.vue`; `FormMode` has `preview`; `mapWinterUrl` maps `preview/:id`; `PartialHost.vue` has a `hint` prop; style kit classes `.summer-callout`, `.summer-callout--warning`, `.summer-callout--danger`, `.summer-callout__title`, `.summer-callout__text`.
+
+Phrase keys added in en and pl: `backend::lang.form.{return_to_preview, locked_item, locked_note, show_password, hide_password}`, `backend::lang.permissioneditor.{allow, inherit, deny, locked, empty, other}`, `backend::lang.messages.form.{preview, edit}`.
+
+Fixture: `acme.roster` gained the preview block with the `status` partial, the fields `joined_ip`, `password`, `password_confirmation`, `notify`, `slug`, `permissions`, `team`, `tags`, an invisible `email` column, a visible `slug` column and the `tagged` filter. Helpers: `newRosterEnvWith`, `rosterBootWith`; `rosterPlugin` has `db` and `relations`.
+
+### Known contract properties
+
+The user was shown these six before choosing `tag-local` and accepted them.
+
+1. Settings forms and relation (manage and pivot) forms refuse `password`, `permissioneditor` and `preset` at boot.
+2. Virtual values reach hooks as decoded from JSON: a string, a bool, a `json.Number` or nil. A number is a `json.Number`, not an int or float.
+3. The SPA sends a `permissioneditor` field on every update, reduced to the offered codes.
+4. Relation locks are enforced on form create and update only. The relation-manager link and unlink routes do not ask `RelationLockProvider`.
+5. `pact.FilterOptions` has no context parameter, so a controller serving choices uses the database handle it holds, without the request's principal.
+6. A locked permission code whose stored value is outside the mode's set makes every save of that record a 403, because the SPA cannot send the stored value back.
+
+## Task Commits
+
+1. **Task 1: read-only preview screen (tracer)** - `a65c670` (feat). The user approved the screen at the tracer checkpoint.
+2. **Task 2: password and form-only fields, rules per operation, preset** - `a1c6bb1` (feat)
+3. **Task 3: permissioneditor field** - `f50d9b8` (feat)
+4. **Task 4: writable foreign keys, locked relation options, invisible columns, controller filter choices** - `df5cace` (feat)
+5. **Task 5: checkpoint:decision** - answered `tag-local`; no commit
+6. **Task 6: gates and tag** - no source change; annotated tag `v0.1.3` on `df5cace`
+
+## Decisions Made
+
+- `tag-local` at Task 5 (the user's decision): the tag exists locally and the push is a pending release step.
+- `password`, `permissioneditor` and `preset` are refused outside ordinary controller forms, because settings and relation forms have no hook path that could consume them safely.
+- The null `preview:` check reads the document's root keys, since the YAML library does not call a custom unmarshaler for a null value.
+- `PreviewView.vue` provides a read-only `FORM_SESSION`, so a `fileupload` field can list its files on the preview.
+- `editablePayload` reduces a `permissioneditor` value to the offered codes, so codes the server no longer offers are never sent back.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] A null `preview:` was not refused by the decoder alone**
+- **Found during:** Task 1
+- **Issue:** goccy does not call a custom unmarshaler for null, so `preview:` with no value compiled as "no preview".
+- **Fix:** `CompileForm` checks the root keys (`topLevelKey`, using `goccy/go-yaml/parser`, which is already in the module; go.mod unchanged).
+- **Committed in:** a65c670
+
+**2. [Rule 3 - Blocking] Fixtures and tests for the two new required form messages and the boot rule**
+- **Found during:** Task 1
+- **Issue:** `FormMessages` gained two required keys, and `recordActions` now needs `preview`.
+- **Fix:** four typed SPA form fixtures got `preview` and `edit`; the conformance fixture and the `unregistered` case of `TestFormSchemaRecordActionsBoot` got `preview: {}`; `winterUrl.test.ts`, `edit.smoke.test.ts` and `actions.smoke.test.ts` were updated (outside `files_modified`).
+- **Committed in:** a65c670
+
+**3. [Rule 3 - Blocking] Existing creates needed a password; the fixture stamps the tenant**
+- **Found during:** Task 2
+- **Issue:** the fixture's `FormRules` makes a password required on create, which broke two existing creates.
+- **Fix:** `phase121_actions_test.go` and `TestPreviewSmoke` send a password pair; the fixture's `FormBeforeCreate` stamps the tenant.
+- **Committed in:** a1c6bb1
+
+**4. [Rule 2 - Missing critical] `password` and `preset` refused on settings and relation forms**
+- **Found during:** Task 2
+- **Issue:** these forms have no virtual-field path, so a password there would have been treated as a column.
+- **Fix:** boot errors in `settings.go` and `relation_form.go` (outside `files_modified`); `mergedRules` gained a `ctx` parameter (`relation.go`, `relation_child.go`).
+- **Committed in:** a1c6bb1
+
+**5. [Rule 3 - Blocking] Docs fences on methods need a whole example file**
+- **Found during:** Task 2
+- **Fix:** `example_form_seams_test.go` has `Example_formSeams`, so the `src=` fences resolve.
+- **Committed in:** a1c6bb1
+
+**6. [Rule 3 - Blocking] Datepicker tests expected the old `mode` message**
+- **Found during:** Task 3
+- **Fix:** `datepicker_test.go` and `datepicker_smoke_test.go` updated for "mode is only valid on type: fileupload, datepicker or permissioneditor".
+- **Committed in:** f50d9b8
+
+**7. [Rule 1 - Bug] The SPA could send permission codes that are no longer offered**
+- **Found during:** Task 3
+- **Fix:** `editablePayload` reduces the value through `permissionValues` in `admin/src/components/form/control.ts` (outside the task's file list).
+- **Committed in:** f50d9b8
+
+**8. [Rule 2 - Missing critical] `permissioneditor` refused on settings and relation forms**
+- **Found during:** Task 3
+- **Committed in:** f50d9b8
+
+**9. [Rule 3 - Blocking] An invisible `email` column left the roster list with one visible column**
+- **Found during:** Task 4
+- **Issue:** a plan 01 row-state assertion needs a second visible column.
+- **Fix:** `columns.yaml` and the SPA list fixtures gained a visible `slug` column.
+- **Committed in:** df5cace
+
+### Other departures from the plan text
+
+- **Task 1:** `PartialHost.vue` gained a `hint` prop for the 68px skeleton and the keep-previous behaviour.
+- **Task 2:** `preview.smoke.test.ts` lists the new `slug` field in its `dt` check; `editablePayload` gained an optional `mode` argument.
+- **Task 3:** `PreviewField.vue` needed no change for the permission editor; the provider-missing boot test uses the conformance fixture.
+- **Task 4:** `summer docs:sync` rewrote the `config_list.yaml` fence in `docs/backend/admin-controllers.md`; `query.go` needed no change; the SPA list-schema fixture keeps `filters: []`; the new file `testdata/roster/controllers/people/config_filter.yaml` and the helpers `newRosterEnvWith` and `rosterBootWith` were added.
+- **Task 6:** no source change. The plugin-module runs in the gate section are an addition to the plan's gate.
+
+---
+
+**Total deviations:** 9 auto-fixed (2 bugs, 2 missing critical, 5 blocking) and the departures listed above.
+**Impact on plan:** No scope added. Every extra file is a test, fixture or example the new keys require, or a refusal that keeps a new field type off forms that cannot handle it.
+
+## Issues Encountered
+
+**Two application tests fail against the tagged framework.** They are outside the plan's gate and were found by an extra run in Task 6.
+
+- `go -C ../fonoteka.go/plugins/golem15/fonoteka test ./... -count=1` fails in `TestPhase09SecurityRoutes` and `TestPhase10ControllerCopy`.
+- Both compare against fixed lists in the application's tests. `phase09AdminRoutes` does not name the two plan 01 routes (bulk action, record action). `phase10ListMessageKeys` does not name the three plan 01 row-state messages. The form half of `TestPhase10ControllerCopy` was not reached and may need `preview` and `edit` in the same way.
+- No framework change is needed, so the tagged commit is unaffected. The fix is in fonoteka.go, which this plan does not write to. The same catch-up happened once before (`549840d` in fonoteka.go, for the Phase 12.2 routes).
+- The plan's application gate passed because `go -C ../fonoteka.go test ./...` covers the root module only; the four go.work plugin modules are separate modules.
+- Recorded in `deferred-items.md` in this phase directory, with plan 04 or the plan 05 gate script as the suggested owner.
+
+The tag was still created: every gate the plan defines passed on `df5cace`, the failures need no change to that commit, and the tag is local and can be moved.
+
+## Not verified here
+
+- A form-level `required: true` on a virtual field has no test (Task 2).
+- The checkbox-mode value set of the permission editor has no HTTP test on the server; radio mode has (Task 3).
+- The model-only `FilterOptions` path relies on the existing `TestPhase10FilterOptions`; no new test was added for it.
+- Visual checks of the permission editor, the locked chips and the password toggle in a browser. Only the preview screen was looked at by the user.
+- `scripts/check-phase10.sh` and the other phase gates were not run; only the commands the plan names.
+
+## Open items for plan 05's review
+
+1. **Relation locks and the relation manager (property 4).** A locked id can still be linked or unlinked through the relation-manager routes, because only form saves call `checkRelationLocks`. Plan 04's privileged-group guard (T-12-18) must cover those routes in the plugin, or the framework needs a follow-up.
+2. **Locked permission with a stored value outside the mode's set (property 6).** Every save of such a record is a 403. Decide whether the server should compare a locked code only when it was submitted, or whether the plugin must normalize stored values.
+3. **Application inventory tests** (see Issues Encountered).
+4. The three untested paths under "Not verified here".
+
+## Known Stubs
+
+None. `RecordActions.vue` is mounted in `PreviewView.vue`, and WINDOWS entry 9 is marked fixed.
+
+The demo fixture used at the tracer checkpoint registers no navigation, so the SPA home shows "No sections are available." and the list was opened by direct URL. This is a property of the test fixture, not a defect.
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+
+- Plan 12.1-03 has its precondition: `v0.1.3` exists locally, and the application resolves the framework through its local replace.
+- No Go module and no npm package changed: `git diff --stat 1c99de5..df5cace -- go.mod go.sum admin/package.json admin/package-lock.json` is empty.
+- Pending: push `master` and `v0.1.3`; the sm-user-plugin push of plan 05 waits for it.
+- Pending: the two application inventory tests in fonoteka.go.
+- A demo server for the user is still running on 127.0.0.1:8431; this plan left it alone.
+
+## Self-Check: PASSED
+
+- Created files exist: `field_permission.go`, `phase121_form_test.go`, `example_form_seams_test.go`, the two new roster fixture files, the four SPA components, the two smoke tests, `roster.form-schema.json`.
+- Commits exist: a65c670, a1c6bb1, f50d9b8, df5cace; `git rev-list --count 1c99de5..HEAD` was 4 when this summary was written.
+- Tag: `git tag --list v0.1.3` prints `v0.1.3`; `git cat-file -t v0.1.3` prints `tag`; `git rev-parse 'v0.1.3^{commit}'` is `df5cace8525bc10fa40b25552137290793c08bb3`; `git merge-base --is-ancestor v0.1.3 HEAD` succeeds; `v0.1.1` and `v0.1.2` are unchanged.
+- Key links: `name: 'preview'` once in `router.ts`; `RecordActions` used in `PreviewView.vue`; the ten `Test*` functions named in the coverage block are in `phase121_form_test.go`.
+- Nothing was pushed: `git ls-remote --tags origin v0.1.3` lists nothing.
+
+---
+*Phase: 12.1-user-plugin-admin-screens*
+*Completed: 2026-10-05*

.planning/phases/12.1-user-plugin-admin-screens/12.1-03-SUMMARY.md

@@ -0,0 +1,409 @@
+---
+phase: 12.1-user-plugin-admin-screens
+plan: 03
+subsystem: admin
+tags: [sm-user-plugin, cabana, pact, admin, users, permissions, privileged-groups, last-seen, gormigrate]
+
+requires:
+  - phase: 12.1-user-plugin-admin-screens
+    provides: "plans 01 and 02: bulk and record actions, row state, ForbiddenError, preview, password and form-only fields, FormRules, permissioneditor, writable foreign keys, invisible columns, controller filter options (framework tag v0.1.3, local)"
+  - phase: 12-p-ytarium-api-collections-and-albums
+    provides: "user_groups, users_groups, classes.UserGroupCodes and HasGroupCode (T-12-18)"
+provides:
+  - "sm-user-plugin admin foundation: permissions, navigation, embedded admin YAML, AdminControllers"
+  - "Users admin screen: controller golem15.user.users (list, filters, row states, preview, form, bulk and record actions, permanent delete)"
+  - "takeover guard for privileged-group members (D-30): classes/privileged.go and config key golem15.user.privileged_groups"
+  - "frontend permission data and resolver: models.PermissionSet, models.FrontendPermission, classes.MergedPermissions, HasPermission, UserHasPermission, FrontendPermissionOptions"
+  - "classes user actions: ActivateUsers, DeactivateUsers, RestoreUsers, BanUsers, UnbanUsers, UnsuspendUser, ThrottleStates, ForceDeleteCleanup"
+  - "users.last_seen written by login and refresh (classes.TouchLastSeen)"
+  - "three additive migrations (users.permissions, users.last_seen, golem15_user_frontend_permissions)"
+  - "plugin admin test harness (admin_harness_test.go)"
+affects: [12.1-04, 12.1-05, fonoteka.go application tests and schema allow-list, sm-user-plugin host applications]
+
+# commits/plan_head_* are measured in summercms.go (the pinned root), where this
+# plan changed planning docs only. The code is in the sibling repository
+# sm-user-plugin; its measured values are the plugin_* keys.
+actuals:
+  tokens: 54901   # chars/4 over the plugin diff 0fe5b91..5805c63 (40 files)
+  tasks: 4
+  commits: 0
+plan_head_before: b8cdb7cc924fa11ceee20ee1ec0383ba5bf87e43
+plan_head_after: b8cdb7cc924fa11ceee20ee1ec0383ba5bf87e43
+plugin_repo: sm-user-plugin (../fonoteka.go/plugins/golem15/user)
+plugin_commits: 10   # git -C <plugin> rev-list --count 0fe5b91..HEAD
+plugin_head_before: 0fe5b91b632a0ab784f3cecd2d5cf168528062ac
+plugin_head_after: 5805c6347f6a607287e7e47431419b18c0e0c662
+
+tech-stack:
+  added: []
+  patterns:
+    - "Admin controllers hold a lazy app accessor (func() *backpack.App): database handle, config, bucket and mailer are read per request"
+    - "Class functions take the caller's transaction handle and start from an empty statement (fresh)"
+    - "A guard that needs the principal and the write transaction lives at the top of the Form hook; refusals are cabana.ForbiddenError"
+    - "Blob deletion and mail sending are registered with lagoon.AfterCommit inside the hook"
+
+key-files:
+  created:
+    - ../fonoteka.go/plugins/golem15/user/controllers/users_admin_controller.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/admin_registry.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/request_db.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/users/config_list.yaml
+    - ../fonoteka.go/plugins/golem15/user/controllers/users/config_form.yaml
+    - ../fonoteka.go/plugins/golem15/user/controllers/users/config_filter.yaml
+    - ../fonoteka.go/plugins/golem15/user/controllers/users/_hint.htm
+    - ../fonoteka.go/plugins/golem15/user/models/user/fields.yaml
+    - ../fonoteka.go/plugins/golem15/user/models/user/columns.yaml
+    - ../fonoteka.go/plugins/golem15/user/models/permission_set.go
+    - ../fonoteka.go/plugins/golem15/user/models/frontend_permission.go
+    - ../fonoteka.go/plugins/golem15/user/classes/privileged.go
+    - ../fonoteka.go/plugins/golem15/user/classes/admin_actions.go
+    - ../fonoteka.go/plugins/golem15/user/classes/permissions.go
+    - ../fonoteka.go/plugins/golem15/user/classes/last_seen.go
+    - ../fonoteka.go/plugins/golem15/user/admin.go
+    - ../fonoteka.go/plugins/golem15/user/admin_permissions.go
+    - ../fonoteka.go/plugins/golem15/user/admin_navigation.go
+    - ../fonoteka.go/plugins/golem15/user/updates/202610040001_add_users_permissions.go
+    - ../fonoteka.go/plugins/golem15/user/updates/202610040002_add_users_last_seen.go
+    - ../fonoteka.go/plugins/golem15/user/updates/202610040003_create_frontend_permissions.go
+    - ../fonoteka.go/plugins/golem15/user/views/mail/invite.htm
+    - ../fonoteka.go/plugins/golem15/user/views/mail/invite-en.htm
+    - ../fonoteka.go/plugins/golem15/user/admin_harness_test.go
+    - ../fonoteka.go/plugins/golem15/user/admin_users_test.go
+    - ../fonoteka.go/plugins/golem15/user/last_seen_test.go
+    - ../fonoteka.go/plugins/golem15/user/classes/permissions_test.go
+    - ../fonoteka.go/plugins/golem15/user/updates/admin_columns_test.go
+  modified:
+    - ../fonoteka.go/plugins/golem15/user/models/user.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/api_controller.go
+    - ../fonoteka.go/plugins/golem15/user/plugin.go
+    - ../fonoteka.go/plugins/golem15/user/config/config.yaml
+    - ../fonoteka.go/plugins/golem15/user/lang/en/lang.yaml
+    - ../fonoteka.go/plugins/golem15/user/lang/pl/lang.yaml
+    - ../fonoteka.go/plugins/golem15/user/README.md
+    - ../fonoteka.go/plugins/golem15/user/session_test.go
+    - ../fonoteka.go/plugins/golem15/user/updates/api_tokens_test.go
+    - ../fonoteka.go/plugins/golem15/user/updates/organisations_test.go
+    - ../fonoteka.go/plugins/golem15/user/updates/user_groups_test.go
+    - ../fonoteka.go/plugins/golem15/user/updates/user_session_test.go
+
+key-decisions:
+  - "The form messages update, saved and deleted, and the list message deleted, name the framework's default keys; only texts with a PHP or UI-SPEC value are plugin keys"
+  - "A user created in the admin gets has_self_set_password true, as a registered user does; only social-login accounts start without it"
+  - "HasPermission treats a leading asterisk as a wildcard on the asked code only, as Winter does; the plan text said both sides"
+  - "PermissionSet.Scan fails on content that is not a JSON object instead of reading it as empty, so a damaged row cannot silently lose its denials"
+  - "The invitation mail carries the login and the activation link and states the configured code lifetime; it never carries the password"
+  - "Bulk and record actions read ban and suspension with one ThrottleStates query through the write transaction"
+
+patterns-established:
+  - "Plugin admin tests: newAdminEnv boots the plugin alone with the admin API mounted; one environment is live at a time because party's registered plugin value is shared"
+  - "A test that needs mail sets mail.driver log and reads the app logger (mailCapture); the mailer service cannot be replaced after party.Activate"
+
+requirements-completed: [SC-1, SC-3]  # copied from the plan; phase success criteria shared with plan 04, which adds the two remaining screens
+
+coverage:
+  - id: D1
+    description: "Users list in the admin API: navigation and permission gating, ported columns and filters, search on invisible columns, row states, update of name and email"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_users_test.go#TestAdminUsersTracer"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Takeover guard (D-30): email, password and permanent delete of a privileged-group member need golem15.users.manage_privileged_groups; refusals are 403 and change nothing, a bulk delete as a whole"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_users_test.go#TestAdminPrivilegedMember"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Bulk actions activate, deactivate, restore, ban, unban; record actions activate, unban, unsuspend; preview status hint; none writes users_groups"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_users_test.go#TestAdminUserActions"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Permanent delete (form and bulk) with cleanup of throttle rows, group memberships and attachments; blobs removed after the commit"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_users_test.go#TestAdminUserForceDelete"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "User form: password with confirmation, admin reset that ends sessions, invitation mail, organisation picker, frontend permission editor"
+    requirement: SC-3
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_users_test.go#TestAdminUserPassword"
+        status: pass
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_users_test.go#TestAdminUserInvite"
+        status: pass
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_users_test.go#TestAdminUserFormFields"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Avatar field bound to the attachment the user API serves, in both directions"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_users_test.go#TestAdminAvatarSharedWithAPI"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "Frontend permission resolver and tolerant PermissionSet"
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/classes/permissions_test.go#TestMergedPermissions"
+        status: pass
+      - kind: unit
+        ref: "../fonoteka.go/plugins/golem15/user/classes/permissions_test.go#TestPermissionSetScan"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "users.last_seen written by login and refresh under the five-minute rule, never failing authentication, absent from user payloads; three additive migrations"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/last_seen_test.go#TestLastSeen"
+        status: pass
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/updates/admin_columns_test.go#TestAdminColumnsMigrations"
+        status: pass
+      - kind: integration
+        ref: "go -C ../fonoteka.go test ./parity -run '^(TestUserAPINuxtFlows|TestParityCorpus)$' -count=1"
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "The Users screens as an administrator sees them in the admin SPA (list badges, preview hint and footer, form tabs, permission editor), and the plugin README"
+    verification: []
+    human_judgment: true
+    rationale: "No browser was opened in this plan: the screens are YAML-driven and were exercised through the admin API only. Layout, copy in context and the README's wording need a person."
+  - id: D10
+    description: "The application still boots and passes with the plugin's admin work"
+    verification:
+      - kind: integration
+        ref: "go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestAdmin|TestPhase09|TestPhase10|TestPhase12Threats)' -count=1"
+        status: fail
+    human_judgment: true
+    rationale: "Three tests of that run fail on fixed lists in the application repository (two known from plan 02, TestAdminMetadataFiltering new), and three more outside it; plan 04 owns the catch-up. See Issues Encountered."
+
+duration: 46min
+completed: 2026-10-05
+status: complete
+---
+
+# Phase 12.1 Plan 03: Plugin foundation and the Users screen Summary
+
+**`golem15.user` now has an admin half: the Users screen (list, filters, row states, preview, form, bulk and record actions, permanent delete) on the framework contracts of v0.1.3, a guard that keeps a privileged-group member's email, password and row out of reach without `golem15.users.manage_privileged_groups`, the frontend permission resolver, and `last_seen`. Ten commits in sm-user-plugin, nothing pushed. Six application tests are red until plan 04 updates fixed lists in fonoteka.go.**
+
+## Performance
+
+- **Duration:** 46 min
+- **Started:** 2026-10-05T10:46:28Z
+- **Completed:** 2026-10-05T11:32:00Z
+- **Tasks:** 4 of 4
+- **Files modified:** 40 in sm-user-plugin; 2 planning files in summercms.go besides this summary
+
+## Accomplishments
+
+- An administrator with `golem15.users.access_users` opens Users from the navigation, searches (also by surname and IP address, which are not shown), filters by group, registration date and activation, and sees deactivated, banned and not activated users marked.
+- A row opens the preview with one status hint and the applicable actions (activate, unban, unsuspend); the list offers activate, deactivate, restore, ban, unban and the permanent delete.
+- The form creates a user with a password and an optional invitation, resets passwords (which ends the user's sessions), picks an organisation, sets the avatar the app shows, and edits frontend permissions.
+- A member of a privileged group (config `golem15.user.privileged_groups`, default `[admin]`) cannot be taken over by an administrator who lacks `golem15.users.manage_privileged_groups`: a changed email, a submitted password and a permanent delete answer 403 and change nothing.
+- Any plugin can ask `classes.UserHasPermission` whether a user holds a frontend permission.
+
+## Plugin commits (sm-user-plugin, branch master, local)
+
+| Task | Commit | Subject |
+|------|--------|---------|
+| 1 | `e22f766` | feat: add the admin columns and the frontend permissions table |
+| 1 | `b410a7f` | feat: register the Users admin screen with the privileged-member guard |
+| 1 | `4e17c0d` | test: cover the Users admin list, update and the privileged-member guard |
+| 1 | `f3f33b8` | style: gofmt the user model and the session test |
+| 1 | `ebaf3a0` | refactor: spell the five permission codes out in the catalog |
+| 2 | `970eba7` | feat: user preview, bulk and record actions and the permanent delete |
+| 3 | `cdea47a` | feat: frontend permissions and the merged-permission resolver |
+| 3 | `f7ca3c4` | feat: create users with a password and an invitation in the admin |
+| 4 | `c7d9d7d` | feat: stamp users.last_seen on login and token refresh |
+| 4 | `5805c63` | docs: describe the Users admin screen, its permissions and the privileged-member rule |
+
+Plugin head before `0fe5b91`, after `5805c63`; the plugin tree is clean. The submodule pointer in fonoteka.go was not bumped (plan 04) and nothing was pushed in any repository. `classes/privileged.go` and `controllers/users_admin_controller.go` were both added in `b410a7f`, and the controller of that commit already contains the guard.
+
+**Tracer gate (Task 1).** The slice works end to end (`TestAdminUsersTracer`, `TestAdminPrivilegedMember`, the plugin suite and `TestUserAPINuxtFlows` pass). The task's verify chain is not fully green: its application command fails on fixed lists in fonoteka.go, which this plan may not edit (see Issues Encountered). I continued to Tasks 2 to 4 rather than halt, because nothing in the slice was broken and the fix is outside the plan's write scope; this is a judgement the orchestrator may want to review.
+
+## Contract names (inputs to plans 04 and 05)
+
+All names match "Artifacts this phase produces" in the plan. Exact shapes:
+
+| Name | Shape |
+|------|-------|
+| `controllers.AdminControllers` | `(app func() *backpack.App) []pact.AdminController` |
+| `controllers.PermissionAccessUsers` | `"golem15.users.access_users"` |
+| `usersAdminController` | implements `AdminPermissioned`, `AdminRecordSource`, `ListExtendQuery`, `FormExtendQuery`, `ListRowStates`, `FormRules`, `FilterOptions`, `FormVirtualFields`, `FormBeforeCreate`, `FormAfterCreate`, `FormBeforeUpdate`, `FormBeforeDelete`, `FormAfterDelete`, `HasAdminBulkActions`, `HasAdminRecordActions`, `AdminPartialData`, `cabana.FieldRelationProvider`, `cabana.PermissionEditorProvider` |
+| `classes.PermissionManagePrivilegedGroups` | `"golem15.users.manage_privileged_groups"` |
+| `classes.PrivilegedGroupCodes` | `(cfg *compass.Config) []string`; nil config or missing key gives `[admin]`; a present, empty list gives none |
+| `classes.IsPrivilegedCode` | `(codes []string, code *string) bool` |
+| `classes.PrivilegedGroupIDs` | `(ctx, db, codes []string) ([]uint, error)` |
+| `classes.IsPrivilegedMember` | `(ctx, db, codes []string, userID uint) (bool, error)` |
+| `classes.ThrottleStates` | `(ctx, db, userIDs []uint) (banned, suspended map[uint]bool, err error)`; the window comes from `classes.ContextWithThrottle` |
+| `classes.ActivateUsers`, `DeactivateUsers`, `RestoreUsers`, `BanUsers`, `UnbanUsers` | `(ctx, db, users []*models.User) (int, error)`; the int is the number changed |
+| `classes.UnsuspendUser` | `(ctx, db, userID uint) error` |
+| `classes.ForceDeleteCleanup` | `(ctx, db, bucket *blob.Bucket, user *models.User) error`; does not delete the user row |
+| `classes.MergedPermissions` | `(ctx, db, userID uint) (map[string]int, error)` |
+| `classes.HasPermission` | `(merged map[string]int, code string) bool` |
+| `classes.UserHasPermission` | `(ctx, db, userID uint, code string) (bool, error)` |
+| `classes.FrontendPermissionOptions` | `(ctx, db) ([]models.FrontendPermission, error)` |
+| `classes.TouchLastSeen` | `(ctx, db, userID uint) error` |
+| `models.PermissionSet` | `map[string]int` with `Scan`, `Value`, `GormDataType`; `models.ParsePermissionSet(raw []byte)` |
+| `models.User` | new fields `LastSeen`, `Permissions`, read-only `CreatedAt`, `UpdatedAt` (all json "-"); `AttachRelations`, `FilterScopes`, `FilterScope`; constants `models.FilterByGroup`, `models.AvatarField` |
+
+Plugin methods `AdminFS`, `AdminControllers`, `Permissions`, `Navigation`. The embed list in `admin.go` names every admin file; plan 04 adds its files there.
+
+### Harness helpers (`admin_harness_test.go`, package `user`)
+
+`newAdminEnv(t, configure ...func(*compass.Config)) *adminEnv` (fields `h`, `app`, `gdb`, `bucket`, `mail`), `adminAPI(rel)`, `adminUsersPath`, `userPath(id, suffix)`, `adminStamp()`, `adminSessionKey(t)`, constants `permAccessUsers`, `permManagePrivileged`, `adminHarnessSecret`.
+
+Methods on `adminEnv`: `admin(t, permissions...)` (mints a backend role and user, returns the bearer token; no permission gives an administrator who may open nothing), `call`, `send` (raw body and headers), `expect`, `users(t, token, query)`, `bulk(t, token, action, users...)` (`delete` goes to the built-in bulk delete), `offered(t, token, id)`, `upload`, `mails(to)`, `userLogin`, `seedUser`, `seedGroup`, `join`, `seedThrottle`, `seedAvatar`, `blobExists`, `hangers`, `reload`, `groupIDs`. Free helpers `adminDecode`, `adminInto`, `assertNoSecret`, `createdID`.
+
+Two rules of use: only the most recently created environment is live (party's registered plugin value is shared, so a later `newAdminEnv` rebinds the controllers to its app), and the harness database is shared by all admin tests, so seed with unique names (`adminStamp`) and narrow lists with a search.
+
+## Measured run times (for VALIDATION.md)
+
+| Command | Time |
+|---------|------|
+| `go -C ../fonoteka.go vet ./plugins/golem15/user/...` | under 1 s |
+| `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminUsersTracer\|TestAdminPrivilegedMember)$' -count=1` | 6 to 10 s |
+| `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestLastSeen\|TestLogin\|TestRefresh)' -count=1` | 7 s |
+| the eight `TestAdmin*` tests together | 9 s |
+| `go -C ../fonoteka.go test ./plugins/golem15/user/... -count=1` | 26 s (package `user` 20 s, `classes` 24 s, `updates` 9 s, in parallel) |
+| `go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestAdmin\|TestPhase09\|TestPhase10\|TestPhase12Threats)' -count=1` | 20 s (3 tests fail, see below) |
+| `go -C ../fonoteka.go test ./parity -run '^(TestUserAPINuxtFlows\|TestParityCorpus)$' -count=1` | 50 s, pass |
+| `go -C ../fonoteka.go test ./... -count=1` (root module) | 74 s (3 tests fail, see below) |
+
+## Decisions Made
+
+- Form messages `update`, `saved`, `deleted` and the list message `deleted` point at the framework's default keys. The plan lists them in the messages block without naming keys, and neither PHP nor the UI-SPEC has plugin copy for them.
+- `FormBeforeCreate` sets `has_self_set_password` to true. GORM writes the Go zero value on insert, which would have overridden the column default and made the user API's change-password answer 500 for every admin-created user.
+- The invitation text says the link activates the account. The PHP text ("choose your password") does not fit: in Go the administrator sets the password and the link is the existing activation link.
+- `send_invite` sends only when the value is `true` in the body. The default `true` is a schema default the SPA applies; a direct API create without the key sends nothing.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Existing migration tests roll back by position**
+- **Found during:** Task 1
+- **Issue:** `TestUserGroupsMigration`, the three tests in `user_session_test.go`, `TestOrganisationsMigration` and `TestAPITokenMigration` count `RollbackLast()` calls or compare a fixed history; three new migrations shifted every count.
+- **Fix:** counts raised by three and the history list extended; `TestAPITokenMigration` now rolls back its own migration with `RollbackMigration`.
+- **Files modified:** updates/user_groups_test.go, user_session_test.go, organisations_test.go, api_tokens_test.go
+- **Committed in:** e22f766
+
+**2. [Rule 3 - Blocking] Assembling the plugin's routes now needs the admin secret**
+- **Found during:** Task 1
+- **Issue:** `TestLoginRouteGroup` failed with "admin.jwt.secret is empty": a plugin with admin controllers makes `surf.BuildRouter` mount the admin API.
+- **Fix:** the session test config sets `SUMMER_ADMIN__JWT__SECRET`. The same holds for every host application: documented in the README.
+- **Files modified:** session_test.go
+- **Committed in:** b410a7f
+
+**3. [Rule 1 - Bug] GORM did not know the PermissionSet type**
+- **Found during:** Task 3
+- **Issue:** every query on `models.User` logged "unsupported data type" and the admin create answered 500.
+- **Fix:** `PermissionSet.GormDataType()` returns `text`.
+- **Committed in:** cdea47a
+
+**4. [Rule 2 - Missing critical] has_self_set_password on admin create**
+- See Decisions Made. **Committed in:** f7ca3c4
+
+**5. [Rule 2 - Missing critical] A failed blob removal after a delete is logged**
+- **Found during:** Task 2
+- **Fix:** the after-commit callback of `ForceDeleteCleanup` logs a warning with the user id instead of dropping the error.
+- **Committed in:** 970eba7
+
+### Other departures from the plan text
+
+- **Acceptance check "three files match 2026100400".** It prints 4: the shipped `202610040001_create_api_tokens.go` (quick task 261004-rou, after the plan was written) matches too. The three new files are there. The plan's base commit `8a65890` is also one behind the real base `0fe5b91`; the shipped-migration diff is empty against both.
+- **Migration order.** By file name `202610040001_add_users_permissions.go` sorts before the shipped `202610040001_create_api_tokens.go`, so it sits before it in the slice and in the history. gormigrate applies whatever is missing, so a database that already has the API tokens table migrates normally; only "roll back the last N" counts are affected.
+- **Wildcards.** `HasPermission` is the line-by-line port: a trailing asterisk works on the asked and on the stored code, a leading asterisk on the asked code only. The plan said "leading on both sides"; Winter does not do that.
+- **Empty password in a body.** The plan expected `{"password": ""}` with a new name to answer 200. The framework's `confirmed` rule compares before `nullable` is applied, so a lone empty `password` without `password_confirmation` is a 422. Omitting the field (what the SPA does) or sending both empty answers 200; the tests cover those two.
+- **TestAdminUserFormFields** is an extra test for the organisation picker and the permission editor, which the plan allowed "in an existing or new test".
+- **Commits.** Task 1 has two small follow-up commits (gofmt, permission code literals for the acceptance grep) and Tasks 2 and 3 commit code and tests together, so every commit is green on its own.
+
+---
+
+**Total deviations:** 5 auto-fixed (1 bug, 2 missing critical, 2 blocking) and the departures above.
+**Impact on plan:** No scope added in the plugin. No framework file changed; the tag `v0.1.3` is untouched.
+
+## Issues Encountered
+
+**Six application tests are red against the plugin's working tree.** None is in the plugin; all are fixed lists or counts in fonoteka.go, which this plan does not write to. The application's go.work uses the plugin checkout directly, so they fail now, before any pointer bump.
+
+| Test | Module | Why | Known before |
+|------|--------|-----|--------------|
+| `TestPhase09SecurityRoutes` | plugins/golem15/fonoteka | route list lacks the two plan 01 routes | yes (plan 02) |
+| `TestPhase10ControllerCopy` | plugins/golem15/fonoteka | message list lacks the plan 01 keys | yes (plan 02) |
+| `TestAdminMetadataFiltering` | plugins/golem15/fonoteka | expects the developer navigation to be `[fonoteka]`; it is `[fonoteka user]` | new |
+| `TestHiddenNeverMarshals` | plugins/golem15/fonoteka/classes | pins five user models; `FrontendPermission` is the sixth. With the constant at 6 (through a `go test -overlay` copy) it passes | new |
+| `TestMigrateSeedsCanonicalGenres`, `TestRollbackLastIsolatesFonoteka` | parity | fixed migration id list lacks the three new ids | new |
+
+`TestSchemaMatchesPHPSnapshot` also fails, as the plan states, until plan 04 adds the allow-list entry for `golem15_user_frontend_permissions`.
+
+Consequence for this plan's verification: the command `go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestAdmin|TestPhase09|TestPhase10|TestPhase12Threats)'` in every task's verify block cannot be green before plan 04. Every other test it selects passes, including `TestPhase12Threats`. Everything else in the verify blocks is green. Recorded in `deferred-items.md` and as WINDOWS entry 10.
+
+The other workspace modules pass: `plugins/golem15/golem`, `plugins/golem15/feedback`, and `go -C ../fonoteka.go build ./... && vet ./...`.
+
+## Not verified here
+
+- No browser: the screens were exercised through the admin API only.
+- That each guard test fails when its guard is removed (plan 05's removal harness).
+- A create that rolls back after `FormAfterCreate` sends no invitation: covered by construction (`lagoon.AfterCommit`), tested only through validation failures, which stop before the hook.
+- The Polish invitation template is rendered by the catalog check at boot but no test reads its text.
+- `scripts/check-phase*.sh` gates were not run.
+
+## Open items for plan 04 and plan 05's review
+
+1. **Application catch-up** (table above), for plan 04.
+2. **Host applications must set `admin.jwt.secret`.** Any application that loads `golem15.user` now mounts the admin API and fails to start without the secret. This is the price of the plugin having admin screens; it is in the README. Applications that load the plugin without an admin need to know before they update.
+3. **A damaged `users.permissions` value blocks the user.** `PermissionSet.Scan` returns an error for content that is not a JSON object (by the plan, so denials are never dropped silently). Because the column is on `models.User`, such a row cannot be loaded at all: login, fetch and the admin form fail for that user until the value is repaired in SQL. The cutover import should validate the column.
+4. **Two readers of `user_groups.permissions` differ.** The existing `classes.UserPermissionGrants` (API token principals) counts `true` and `"true"` as granted; `PermissionSet` skips non-numeric values. A group row holding booleans grants through one and not the other.
+5. **`send_invite_comment`** keeps the PHP text "containing login and password information" (UI-SPEC: PHP value). The mail carries no password. The copy should probably change; I left the signed-off text alone.
+6. **Literal labels are logged as missing translations.** Group names (filter choices) and frontend permission labels, tabs and comments pass through the framework's translator, which logs `missing translation key` at warning level for each literal on every request and would translate a value that happens to be a phrase key. Cosmetic, but noisy; a framework matter.
+7. **Ban and the row without an IP address.** `BanUsers` creates a `user_throttle` row with a NULL address when the user has none. After an unban that row stays and becomes the fallback row for addresses the user never used, so failed attempts from new addresses share one counter. The login code already treated a NULL row this way; noted so the security review sees it.
+8. **Framework `confirmed` and `nullable`** (see departures): a framework follow-up, not a plugin one.
+9. T-12.1-26 (restore or activate re-enables a deactivated site admin) is accepted by the plan and unchanged.
+
+## Known Stubs
+
+None. `golem15.users.access_groups`, `access_settings` and `impersonate_user` are registered without a screen by decision (D-02); plan 04 uses the first.
+
+## Threat Flags
+
+None beyond the plan's threat model: no route was added (the screen uses the framework's generic admin routes), and the only new write on the user API path is the `last_seen` UPDATE (T-12.1-25).
+
+## User Setup Required
+
+None - no external service configuration required. An application that loads the plugin needs `SUMMER_ADMIN__JWT__SECRET` (item 2 above); fonoteka.go already sets `admin.jwt.secret`.
+
+## Next Phase Readiness
+
+- Plan 12.1-04 can add the groups field, User Groups and Organisations on top of `usersAdminController`, `classes/privileged.go` and the harness, and must update the application's fixed lists, the schema allow-list and the submodule pointer.
+- No Go module changed: `git -C <plugin> diff 0fe5b91..HEAD -- go.mod go.sum` is empty.
+- Pending from plan 02, unchanged: push summercms.go `master` and tag `v0.1.3`; the plugin push waits for it.
+- The demo server on 127.0.0.1:8431 was left alone.
+
+## Self-Check: PASSED
+
+- Created files exist: all 28 listed under key-files.created.
+- Plugin commits exist: e22f766, b410a7f, 4e17c0d, f3f33b8, ebaf3a0, 970eba7, cdea47a, f7ca3c4, c7d9d7d, 5805c63; `git -C <plugin> rev-list --count 0fe5b91..HEAD` is 10; the plugin tree is clean.
+- Key links: `HasAdminControllers` asserted in `admin.go`; `classes.ActivateUsers`, `BanUsers` and `UnsuspendUser` called from the controller's actions; `IsPrivilegedMember` behind `FormBeforeUpdate` and `FormBeforeDelete`; `TouchLastSeen` twice in `api_controller.go`; `AttachRelations` on `models.User`.
+- At 5805c63: `go vet` and `go test ./plugins/golem15/user/... -count=1` pass; the named tests of all four tasks pass; `TestUserAPINuxtFlows` and `TestParityCorpus` pass.
+- Not green, as described: the application test command of the verify blocks.
+
+---
+*Phase: 12.1-user-plugin-admin-screens*
+*Completed: 2026-10-05*

.planning/phases/12.1-user-plugin-admin-screens/12.1-04-SUMMARY.md

@@ -0,0 +1,409 @@
+---
+phase: 12.1-user-plugin-admin-screens
+plan: 04
+subsystem: admin
+tags: [sm-user-plugin, cabana, pact, admin, user-groups, organisations, privileged-groups, relation-lock, relation-manager, parity]
+
+requires:
+  - phase: 12.1-user-plugin-admin-screens
+    provides: "plans 01 to 03: framework contracts at v0.1.3 (relation locks, ForbiddenError, permissioneditor, preset, hasMany relation manager), the Users screen, classes/privileged.go, the config key golem15.user.privileged_groups, the plugin admin test harness"
+provides:
+  - "user form `groups` relation field, the only writer of users_groups, with AdminRelationLocks on the privileged groups"
+  - "User Groups admin screen: controller golem15.user.usergroups (list with users_count, form with the checkbox permission editor, guarded delete)"
+  - "Organisations admin screen: controller golem15.user.organisations (list, form with avatar, members relation manager)"
+  - "models.UsersGroup, models.Slugify, PermissionSet.Text, UserGroup.Fillable/Rules/UsersCount, Organisation.Fillable/Rules/MorphName/AttachRelations/BeforeValidate/Members"
+  - "controllers.PermissionAccessGroups; navigation side items usergroups and organisations"
+  - "fonoteka.go: allow-list entry for golem15_user_frontend_permissions, the submodule pointer at the plugin head, and the application's fixed test lists brought up to date"
+affects: [12.1-05, fonoteka.go application tests, sm-user-plugin host applications]
+
+# commits/plan_head_* are measured in summercms.go (the pinned root), where this
+# plan changed planning docs only. The code is in two sibling repositories; their
+# measured values are the plugin_* and app_* keys.
+actuals:
+  tokens: 33397   # chars/4 over the realized diffs: plugin 5805c63..4693155 (31704) plus fonoteka.go d1abcab..35a727f (1693)
+  tasks: 4
+  commits: 0
+plan_head_before: fcc86ac45e1011c9bcb243cac965c8af44311ea1
+plan_head_after: fcc86ac45e1011c9bcb243cac965c8af44311ea1
+plugin_repo: sm-user-plugin (../fonoteka.go/plugins/golem15/user)
+plugin_commits: 4   # git -C <plugin> rev-list --count 5805c63..HEAD
+plugin_head_before: 5805c6347f6a607287e7e47431419b18c0e0c662
+plugin_head_after: 469315510809f703fc315aceaa9ef902794a0237
+app_repo: fonoteka.go (../fonoteka.go)
+app_commits: 3      # git -C ../fonoteka.go rev-list --count d1abcab..HEAD
+app_head_before: d1abcab
+app_head_after: 35a727f1ddfde0a443cf203193bf3705fe3158a1
+
+tech-stack:
+  added: []
+  patterns:
+    - "A relation field whose choices carry privilege is guarded by cabana.RelationLockProvider on the controller; the lock ids are read per request through the write's transaction"
+    - "A rule the rule engine does not know (regex, alpha_dash) is checked in the Form before-hooks and answered as a 422 on the field"
+    - "A list count column is a read-only model field filled by a scalar subquery in ListExtendQuery, with two select arguments so the list's count stays COUNT(*)"
+    - "appAccess: new admin controllers hold one lazy accessor type for the app, pool, config and translator"
+
+key-files:
+  created:
+    - ../fonoteka.go/plugins/golem15/user/models/users_group.go
+    - ../fonoteka.go/plugins/golem15/user/models/slug.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/app_access.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/usergroups_admin_controller.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/organisations_admin_controller.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/usergroups/config_list.yaml
+    - ../fonoteka.go/plugins/golem15/user/controllers/usergroups/config_form.yaml
+    - ../fonoteka.go/plugins/golem15/user/controllers/organisations/config_list.yaml
+    - ../fonoteka.go/plugins/golem15/user/controllers/organisations/config_form.yaml
+    - ../fonoteka.go/plugins/golem15/user/controllers/organisations/config_relation.yaml
+    - ../fonoteka.go/plugins/golem15/user/models/usergroup/fields.yaml
+    - ../fonoteka.go/plugins/golem15/user/models/usergroup/columns.yaml
+    - ../fonoteka.go/plugins/golem15/user/models/organisation/fields.yaml
+    - ../fonoteka.go/plugins/golem15/user/models/organisation/columns.yaml
+    - ../fonoteka.go/plugins/golem15/user/admin_privileged_test.go
+    - ../fonoteka.go/plugins/golem15/user/admin_groups_test.go
+    - ../fonoteka.go/plugins/golem15/user/admin_organisations_test.go
+  modified:
+    - ../fonoteka.go/plugins/golem15/user/controllers/users_admin_controller.go
+    - ../fonoteka.go/plugins/golem15/user/controllers/admin_registry.go
+    - ../fonoteka.go/plugins/golem15/user/models/user_group.go
+    - ../fonoteka.go/plugins/golem15/user/models/organisation.go
+    - ../fonoteka.go/plugins/golem15/user/models/permission_set.go
+    - ../fonoteka.go/plugins/golem15/user/models/user/fields.yaml
+    - ../fonoteka.go/plugins/golem15/user/admin.go
+    - ../fonoteka.go/plugins/golem15/user/admin_navigation.go
+    - ../fonoteka.go/plugins/golem15/user/lang/en/lang.yaml
+    - ../fonoteka.go/plugins/golem15/user/lang/pl/lang.yaml
+    - ../fonoteka.go/plugins/golem15/user/README.md
+    - ../fonoteka.go/plugins/golem15/user/admin_users_test.go
+    - ../fonoteka.go/parity/schema_diff_test.go
+    - ../fonoteka.go/parity/migrate_test.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/admin_phase09_security_test.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/admin_phase10_copy_test.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/admin_metadata_test.go
+    - ../fonoteka.go/plugins/golem15/fonoteka/classes/hidden_marshal_test.go
+
+key-decisions:
+  - "Organisation gained the Go relation field Members (not a column): the framework's relation manager refuses a relation that is not a field of the owner model"
+  - "A user who already belongs to an organisation cannot be linked to another one through the members manager: the framework offers and accepts only users without an organisation. The plan expected such a user to move"
+  - "The format refusals of a group code and an organisation slug are plugin phrase keys (group.code_invalid, organisation.slug_invalid), because the framework has no phrase for regex or alpha_dash"
+  - "The organisation form uses the framework's default delete confirm; the UI-SPEC names no organisation delete text and I added none"
+  - "models.ParsePermissionSet keeps its plan 03 signature (raw []byte); only PermissionSet.Text is new"
+  - "The application's stale test lists were updated in two commits ahead of the pointer commit, so the root module suite is green at the pointer commit"
+
+patterns-established:
+  - "Screens whose records carry privilege (a group code) guard create, re-code and delete in the Form before-hooks with cabana.Allows and answer cabana.ForbiddenError with details on the field"
+  - "A test of a privileged code that must not exist yet uses a config override with a code unique to the run: the harness database is shared and holds several groups coded admin"
+
+requirements-completed: [SC-1, SC-2, SC-4]  # copied from the plan; phase success criteria, which plan 05 finishes with full unit tests, the gate and the security review
+
+coverage:
+  - id: D1
+    description: "Groups field on the user form: writes exactly the chosen memberships on create and update, leaves them alone when the field is absent, refuses unknown ids, and never reaches a user API payload"
+    requirement: SC-2
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_privileged_test.go#TestAdminUserGroupsField"
+        status: pass
+      - kind: integration
+        ref: "go -C ../fonoteka.go test ./parity -run '^TestUserAPINuxtFlows$' -count=1"
+        status: pass
+      - kind: integration
+        ref: "go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^TestPhase12Threats$' -count=1"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "T-12-18 guard: adding or removing a privileged group needs golem15.users.manage_privileged_groups on create and update; refusals are 403 with details on groups and write nothing; options and labels are flagged locked; the list is config read per request; the takeover guard follows the membership (D-30)"
+    requirement: SC-4
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_privileged_test.go#TestAdminPrivilegedGroups"
+        status: pass
+    human_judgment: true
+    rationale: "The test fails when the lock is switched off (checked once by hand), but the systematic guard-removal harness and the security review are plan 05. A security guard on a plugin shared across projects should be read by a person before it is published."
+  - id: D3
+    description: "User Groups screen: permission gating, list with users_count from one query, code format and uniqueness, checkbox permission editor stored as a JSON object of code to 1, delete with pivot cleanup"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_groups_test.go#TestAdminGroups"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "D-06: creating a group with a privileged code, changing a code to or from a privileged one and deleting a privileged group need the extra permission; a name-only edit of a privileged group does not"
+    requirement: SC-4
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_privileged_test.go#TestAdminPrivilegedGroups"
+        status: pass
+    human_judgment: true
+    rationale: "Same as D2: covered by a passing test that fails without the guard, awaiting plan 05's review."
+  - id: D5
+    description: "Organisations screen: permission gating, list, slug derived from the name, slug format and uniqueness, avatar attached under the organisation's morph name, delete that releases the members"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_organisations_test.go#TestAdminOrganisations"
+        status: pass
+      - kind: unit
+        ref: "../fonoteka.go/plugins/golem15/user/admin_organisations_test.go#TestSlugify"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Organisation members relation manager: link sets and unlink clears users.organisation_id, lists are scoped to the organisation, users_groups and every other user column stay unchanged"
+    requirement: SC-2
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_organisations_test.go#TestAdminOrganisationMembers"
+        status: pass
+    human_judgment: true
+    rationale: "A member of another organisation cannot be linked (the plan expected a move), and organisation_role is not cleared on unlink. Both need a decision; see Open items."
+  - id: D7
+    description: "Navigation: Users, User Groups and Organisations are side items of `user`, in that order, each shown only with its permission"
+    requirement: SC-1
+    verification:
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_organisations_test.go#TestAdminOrganisations"
+        status: pass
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/admin_groups_test.go#TestAdminGroups"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "The application carries the plugin: allow-list entry for golem15_user_frontend_permissions, submodule pointer at the plugin head, fixed test lists updated, every workspace module green on a framework that contains v0.1.3"
+    requirement: SC-4
+    verification:
+      - kind: integration
+        ref: "go -C ../fonoteka.go test ./parity -run '^(TestSchemaMatchesPHPSnapshot|TestUserAPINuxtFlows|TestParityCorpus)$' -count=1 -v"
+        status: pass
+      - kind: integration
+        ref: "go -C ../fonoteka.go vet ./... && go -C ../fonoteka.go test ./... -count=1"
+        status: pass
+      - kind: integration
+        ref: "go test ./... -count=1 in each of plugins/golem15/{user,fonoteka,golem,feedback}"
+        status: pass
+      - kind: other
+        ref: "git -C ../fonoteka.go rev-parse HEAD:plugins/golem15/user = git -C ../fonoteka.go/plugins/golem15/user rev-parse HEAD = 4693155"
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "The three screens as an administrator sees them in the admin SPA (locked chips in the groups field, the forbidden banner, the group permission checkboxes, the members tab), and the README wording"
+    verification: []
+    human_judgment: true
+    rationale: "No browser was opened: the screens are YAML-driven and were exercised through the admin API only."
+
+duration: 32min
+completed: 2026-10-05
+status: complete
+---
+
+# Phase 12.1 Plan 04: Groups field, User Groups and Organisations Summary
+
+**An administrator now sets a user's groups from the user form, manages user groups with their frontend permissions, and manages organisations with their members. Making or unmaking a member of a privileged group (default code `admin`), and creating, re-coding or deleting such a group, needs `golem15.users.manage_privileged_groups` on the server. The application repository records the plugin head in a local commit and every workspace module passes. Nothing was pushed.**
+
+## Performance
+
+- **Duration:** 32 min
+- **Started:** 2026-10-05T11:36:42Z
+- **Completed:** 2026-10-05T12:09:00Z
+- **Tasks:** 4 of 4, plus the application test-list catch-up the orchestrator assigned
+- **Files modified:** 29 in sm-user-plugin, 6 test files in fonoteka.go besides the submodule pointer, 2 planning files in summercms.go besides this summary
+
+## Accomplishments
+
+- The user form has a Groups field. It is the only place a membership changes; a save that does not send the field leaves the memberships alone.
+- For an administrator without `golem15.users.manage_privileged_groups` the privileged groups are locked in that field. A save that adds or removes one answers 403 with `users.privileged_group_forbidden`, marks `groups`, and writes nothing: no column of the user and no pivot row. This holds on create too.
+- User Groups is a screen behind `golem15.users.access_groups`: name, code, creation date and member count in the list; name, code, description and a checkbox permission editor in the form; a delete that takes the group's memberships with it and leaves the members.
+- Organisations is a screen behind `golem15.users.access_users`: name, slug (filled from the name when empty), description, avatar, and a Members tab that adds and removes users.
+- The application's six stale test lists are up to date, the schema allow-list names the new table, and the submodule pointer records the plugin head.
+
+## Commits
+
+### sm-user-plugin (branch master, local)
+
+| Task | Commit | Subject |
+|------|--------|---------|
+| 1 | `9611708` | feat: manage a user's groups from the user form, privileged groups locked |
+| 2 | `a399287` | feat: User Groups admin screen with the users count and privileged codes protected |
+| 3 | `58595fe` | feat: Organisations admin screen with the avatar and the members manager |
+| 3 | `4693155` | docs: describe the User Groups and Organisations screens and the privileged-group rules |
+
+Plugin head before `5805c63`, after `469315510809f703fc315aceaa9ef902794a0237`. The tree is clean and 14 commits ahead of its origin. The field, the pivot model and the lock provider are all in `9611708`; its parent has no `AdminRelationLocks`.
+
+### fonoteka.go (branch master, local)
+
+| Purpose | Commit | Subject |
+|---------|--------|---------|
+| Test lists (framework v0.1.3) | `ca746fc` | test(12.1-04): list the Phase 12.1 cabana routes and row-state messages in the admin inventories |
+| Test lists (user plugin) | `b35442a` | test(12.1-04): expect the user plugin's admin navigation, models and migrations |
+| Task 4 | `35a727f` | build: bump sm-user-plugin (admin screens for users, groups and organisations) |
+
+Application head before `d1abcab`, after `35a727f1ddfde0a443cf203193bf3705fe3158a1`, 3 commits ahead of its origin. `35a727f` changes exactly `parity/schema_diff_test.go` and `plugins/golem15/user`; `go.mod` is unchanged.
+
+### summercms.go
+
+Framework head `fcc86ac45e1011c9bcb243cac965c8af44311ea1`; the tag `v0.1.3` (`df5cace`) is its ancestor. No framework file changed. Planning docs only.
+
+**Tracer gate (Task 1).** Interactive, end-of-phase, automated-only: the verify chain was re-run at the commit and passed, so execution continued without a checkpoint. It could pass only because the application's stale lists were fixed first (see below).
+
+## Publication state and pending steps
+
+| Item | Value |
+|------|-------|
+| Plugin remote head (`git ls-remote origin refs/heads/master`) at the start of Task 4 | `0fe5b91b632a0ab784f3cecd2d5cf168528062ac` |
+| The same at the end of Task 4 | `0fe5b91b632a0ab784f3cecd2d5cf168528062ac` |
+| Framework tag on origin (`git ls-remote --tags origin v0.1.3`) | not listed |
+| Pushed by this plan | nothing, in any repository |
+
+The pointer in fonoteka.go names a plugin commit that is not on the plugin's origin. That is safe only while fonoteka.go itself is unpushed. Pending, in this order:
+
+1. Push framework `master` and `v0.1.3` (pending since plan 02, the user's step).
+2. **Push sm-user-plugin**: plan 05 Task 3, after the security review, and only when `git ls-remote --tags origin v0.1.3` lists the tag.
+3. **Push fonoteka.go**: the user, after step 2.
+
+## Application test lists (orchestrator scope)
+
+Each failure was confirmed to be a stale list before the list changed.
+
+| Test | Cause confirmed | Change |
+|------|-----------------|--------|
+| `TestPhase09SecurityRoutes` | The two unexpected routes are the plan 01 bulk action and record action routes; both are raw and carry the `backend` guard, which the test asserts for every listed route | two entries in `phase09AdminRoutes` |
+| `TestPhase10ControllerCopy` | The list messages gained the three row-state keys with resolved Polish defaults | three keys in `phase10ListMessageKeys`. The form half reads named keys only and needed no change |
+| `TestAdminMetadataFiltering` | The developer role sees `[fonoteka user]` because the four Winter user codes default to that role. The same test's publisher half still passes with an empty list, so the `user` item is shown only to a principal who holds a permission for it | expectation `[fonoteka user]` |
+| `TestHiddenNeverMarshals` | The count was 5; the user plugin registers 7 models: `FrontendPermission` (plan 03) and the `UsersGroup` pivot (this plan). The marshalling checks pass for all of them | `expectedUserModels = 7` |
+| `TestMigrateSeedsCanonicalGenres`, `TestRollbackLastIsolatesFonoteka` | The user plugin's history has the seven earlier ids plus the three additive ones of plan 03 | count 7 becomes 10 (three places) |
+
+None was a real defect. `deferred-items.md` has both entries resolved and WINDOWS entry 10 is marked fixed.
+
+The two list commits precede the pointer commit, so at `ca746fc` and `b35442a` the recorded pointer is still the old plugin head. The workspace builds from the plugin's working tree, so this affects only someone who checks out those two commits with the submodule at the recorded pointer. The order was chosen so the root module suite is green at the pointer commit, which Task 4 requires.
+
+## Test results per module (at plugin `4693155`, application `35a727f`, framework `fcc86ac`)
+
+| Module | vet | test | Time |
+|--------|-----|------|------|
+| fonoteka.go root (`fonoteka`, `parity`) | pass | pass | 86 s |
+| `plugins/golem15/user` (3 packages) | pass | pass | 28 s |
+| `plugins/golem15/fonoteka` (10 packages) | pass | pass | 121 s |
+| `plugins/golem15/golem` (5 packages) | pass | pass | 9 s |
+| `plugins/golem15/feedback` (2 packages) | pass | pass | 12 s |
+| summercms.go (36 packages with tests) | pass | pass, no `FAIL` line | 60 s |
+
+Other measured times, for VALIDATION.md:
+
+| Command | Time |
+|---------|------|
+| `go -C ../fonoteka.go test ./parity -run '^(TestSchemaMatchesPHPSnapshot\|TestUserAPINuxtFlows\|TestParityCorpus)$' -count=1 -v` | 54 s, 3 of 3 pass |
+| `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminPrivilegedGroups\|TestAdminUserGroupsField)$' -count=1` | 6 to 7 s |
+| `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminGroups\|TestAdminPrivilegedGroups)$' -count=1` | 7 s |
+| `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminOrganisations\|TestAdminOrganisationMembers)$' -count=1` | 6 s |
+| `go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestAdmin\|TestPhase09\|TestPhase10\|TestPhase12Threats)' -count=1` | 14 s |
+| Task 1 verify chain end to end | 61 s |
+
+## Contract names (inputs to plan 05)
+
+| Name | Shape |
+|------|-------|
+| `usersAdminController.AdminRelationLocks` | `(ctx, field string) (cabana.RelationLock, error)`; for `groups` the privileged group ids and the message `golem15.user::lang.users.privileged_group_forbidden`, empty for an administrator who passes `cabana.Allows` for the extra permission and for every other field |
+| `models.UsersGroup` | `UserID` (`user_id`), `UserGroupID` (`user_group_id`), both primary key; table `users_groups` |
+| `controllers.PermissionAccessGroups` | `"golem15.users.access_groups"` |
+| `usergroupsAdminController` | ID `golem15.user.usergroups`; implements `AdminPermissioned`, `AdminRecordSource`, `ListExtendQuery`, `FormBeforeCreate`, `FormBeforeUpdate`, `FormBeforeDelete`, `FormAfterDelete`, `cabana.PermissionEditorProvider` |
+| `organisationsAdminController` | ID `golem15.user.organisations`; implements `AdminPermissioned`, `AdminRecordSource`, `FormBeforeCreate`, `FormBeforeUpdate`, `FormBeforeDelete`, `RelationExtendManageQuery`, `cabana.AdminRelationContractProvider` (relation `members`, `cabana.RelationHasMany`, foreign key `organisation_id`, columns `name` and `email`) |
+| `models.UserGroup` | new `Fillable()` (name, code, description), `Rules()` (`name: required\|between:3,64`, `code: required\|unique:user_groups`), read-only `UsersCount int64` (`users_count`, json "-"); `Permissions` is still `*string` |
+| `models.Organisation` | new `Fillable()`, `Rules()`, `MorphName()`, `AttachRelations()`, `BeforeValidate(*gorm.DB)` (pointer receiver), relation field `Members []User` (json "-"); constant `models.OrganisationAvatarField` |
+| `models.Slugify` | `(text string) string` |
+| `models.PermissionSet.Text` | `() *string`; nil for a set without a non-zero value |
+| `models.ParsePermissionSet` | unchanged from plan 03: `(raw []byte) (PermissionSet, error)` |
+| Phrase keys added (en and pl) | `user.groups`, `user.empty_groups`, `users.privileged_group_forbidden`; `group.{id,name,code,code_comment,code_invalid,description_field,created_at,users_count}`; `groups.{all_groups,menu_label,list_title,new_group,list_empty,delete_confirm,privileged_forbidden}`; `organisation.{label_plural,menu_label,id,name,slug,slug_comment,slug_invalid,description,avatar,members,new,list_empty,add_member,remove_members,remove_members_confirm,members_empty}` |
+
+Harness additions (package `user` tests): `adminGroupsPath`, `adminOrganisationsPath`, `permAccessGroups`, `groupPath(id)`, `organisationPath(id, suffix)`, `sortedIDs`, and on `adminEnv`: `groupOptions`, `recordGroups`, `group`, `sideMenu`, `organisation`, `seedOrganisation`.
+
+## Decisions Made
+
+- **`Organisation.Members`.** The plan said no field is added to the model. The framework's relation manager requires the relation to be a field of the owner model, so `Members []User` was added. It is a Go relation, not a column: `updates/10_organisations.go` is unchanged and `TestSchemaMatchesPHPSnapshot` passes.
+- **Format refusals.** `group.code_invalid` and `organisation.slug_invalid` are two phrase keys beyond the plan's list, with Laravel's alpha_dash wording. Without them the 422 would be English only.
+- **Organisation delete confirm.** The framework default. The UI-SPEC is a signed copy contract and names none for organisations.
+- **List title of Organisations.** `organisation.label_plural`, the PHP key and value.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] The members relation needs a field on the owner model**
+- **Found during:** Task 3
+- **Issue:** boot failed with "relation members is not on the owner model".
+- **Fix:** `Organisation.Members []User` with `foreignKey:OrganisationID` and json "-".
+- **Files modified:** models/organisation.go
+- **Verification:** `TestAdminOrganisationMembers`, `TestHiddenNeverMarshals`, `TestSchemaMatchesPHPSnapshot`
+- **Committed in:** 58595fe
+
+**2. [Rule 3 - Blocking] Existing assertions pinned the old form and navigation**
+- **Found during:** Tasks 1 and 3
+- **Issue:** `TestAdminUserFormFields` pinned the user form's field list without `groups`; `TestAdminUsersTracer` pinned one side item for the users permission, which now also opens Organisations.
+- **Fix:** both expectations updated.
+- **Files modified:** admin_users_test.go
+- **Committed in:** 9611708, 58595fe
+
+**3. [Rule 2 - Missing critical] Localized refusal of a malformed code or slug**
+- See Decisions Made. **Committed in:** a399287, 58595fe
+
+### Other departures from the plan text
+
+- **"A user of another organisation moves when linked here."** This does not happen. The framework's hasMany relation manager offers, and accepts, only related rows whose foreign key is NULL; linking a member of another organisation answers 422 (`ids: contains an ineligible target`) and changes nothing. The test asserts that, and that the user can be linked after being removed from the other organisation. The user form's organisation field still moves a user directly.
+- **`controllers/app_access.go`** is a new file outside `files_modified`: one small accessor type for the two new controllers. `usersAdminController` keeps its own accessors, so the file with the guards of plan 03 was changed only where the plan says.
+- **The D-06 matrix runs on codes of its own.** The harness database holds several groups coded `admin` from other tests, and validation (unique code) runs before the hooks, so "create a group with code admin" would answer 422 there. The test overrides the privileged list to `[admin, priv-<stamp>, priv2-<stamp>]`; the `admin` group itself is covered for re-code and delete.
+- **Commits.** Tasks commit code and tests together so each commit is green; Task 3 has a separate docs commit for the README.
+- **Acceptance check with base `8a65890`.** As in plan 03, the real base is one commit later; the diff of `updates/10_organisations.go` is empty against both.
+
+---
+
+**Total deviations:** 3 auto-fixed (2 blocking, 1 missing critical) and the departures above.
+**Impact on plan:** No scope added beyond the orchestrator's test-list catch-up. No framework file, migration, config file, `classes/privileged.go` or Go module changed (`git -C <plugin> diff 5805c63..HEAD -- go.mod go.sum updates config classes` is empty).
+
+## Issues Encountered
+
+None that blocked. The first run of Task 1's verify chain was red on the three known application lists; they were fixed (orchestrator scope) before the Task 1 commit was accepted through the tracer gate.
+
+## Not verified here
+
+- No browser: locked chips, the forbidden banner, the checkbox editor and the members tab were exercised through the admin API only.
+- The guards were each switched off once by hand to see `TestAdminPrivilegedGroups` fail (the relation lock: fails at the options check; the group-code permission: fails at the first create). That is not the systematic removal harness of plan 05.
+- Concurrent saves of the same user's groups by two administrators.
+- The avatar's blob removal when an organisation is deleted: the test checks the attachment row is written on save, not what the delete does with it.
+- `scripts/check-phase*.sh` gates were not run.
+
+## Open items for plan 05's review
+
+1. **`organisation_role` outlives the membership.** Unlinking a member clears `organisation_id` only (the framework writes just the foreign key; PHP's relation controller does the same). The user keeps, for example, `organisation_role = owner`, and carries it into the next organisation they are added to. The application's `CanManageOrg` reads that role. Deleting an organisation does clear the role. Decide whether the plugin should clear the role on unlink, which needs a framework unlink hook or a plugin-side route.
+2. **Deleting an organisation cascades into other plugins.** The application's organisation credential tables reference `golem15_user_organisations` with `ON DELETE CASCADE`, so `golem15.users.access_users` can remove an organisation's credentials by deleting the organisation. PHP's screen has the same delete. No confirm text says so.
+3. **A group's boolean permission values are dropped by an edit.** `ParsePermissionSet` skips non-numeric values, so a legacy row such as `{"x":true}` shows unchecked in the editor and is saved without `x`; `classes.UserPermissionGrants` (API token principals) counted it as granted. This extends item 4 of plan 03.
+4. **Validation answers before the guard.** A create or re-code that would be refused with 403 answers 422 instead when the body also fails validation (for example a duplicate privileged code). Nothing is saved either way; the 422 confirms that the code exists, which the list shows anyway.
+5. **The seeded groups can be deleted.** `guest` and `registered` are ordinary groups, so `golem15.users.access_groups` may delete or re-code them. PHP has no delete button on groups; D-29 added one. No Go code outside the model reads the two codes today.
+6. **Relation locks and the relation manager** (plan 02, property 4) stay unreachable for `users_groups`: no groups relation manager exists, and the organisation manager writes `users.organisation_id` only, which `TestAdminOrganisationMembers` asserts.
+7. Open items 2 to 9 of 12.1-03-SUMMARY.md are unchanged.
+
+## Known Stubs
+
+None. `golem15.users.access_settings` and `impersonate_user` remain registered without a screen by decision (D-02).
+
+## Threat Flags
+
+None beyond the plan's threat model. The plugin still adds no route of its own; the organisation members link and unlink routes are the framework's, covered by T-12.1-32.
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+
+- Plan 12.1-05 can add the full unit tests, the guard-removal harness, the gate script (it should run every workspace module, not only the root) and the security review, then publish the plugin.
+- The demo server on 127.0.0.1:8431 was left alone.
+
+## Self-Check: PASSED
+
+- Created files exist: all 17 listed under key-files.created.
+- Commits exist: plugin 9611708, a399287, 58595fe, 4693155 (`rev-list --count 5805c63..HEAD` is 4); application ca746fc, b35442a, 35a727f (`rev-list --count d1abcab..HEAD` is 3).
+- Key links: `AdminRelationLocks` in `users_admin_controller.go` (3 matches); `IsPrivilegedCode` in `usergroups_admin_controller.go` (3 matches); `golem15.user.organisations` once in `admin_navigation.go` and once in the controller; `"golem15_user_frontend_permissions"` once in `schema_diff_test.go`.
+- Acceptance criteria of all four tasks re-run and passing, including the same-commit check for the field, the pivot model and the guard, the unchanged `Permissions *string`, and the unchanged plugin remote head.
+- Plan verification: plugin vet and tests green at each plugin commit's tree; application vet and full suite green at `35a727f`; framework vet and suite green; pointer equals the plugin head; nothing pushed.
+
+---
+*Phase: 12.1-user-plugin-admin-screens*
+*Completed: 2026-10-05*

.planning/phases/12.1-user-plugin-admin-screens/12.1-05-SUMMARY.md

@@ -0,0 +1,319 @@
+---
+phase: 12.1-user-plugin-admin-screens
+plan: 05
+subsystem: testing
+tags: [cabana, pact, sm-user-plugin, admin, vitest, check-phase12.1, security-review, coverage, privileged-groups]
+
+requires:
+  - phase: 12.1-user-plugin-admin-screens
+    provides: "plans 01 to 04: framework contracts at v0.1.3, the three admin screens, T-12-18 / D-30 guards, smoke tests, validation seed"
+provides:
+  - "TestPhase121Threats in cabana (T-12.1-01 to T-12.1-15) and in sm-user-plugin (T-12.1-18..25, 27..31, 34, 38, 39; T-12-18 cited)"
+  - "scripts/check-phase12.1.sh fail-closed gate (self-test, go, security, removal, coverage, spa, openapi, dist, docs, hygiene, app, evidence, all)"
+  - "SPA unit tests including the five UI-SPEC backstops"
+  - "12.1-SECURITY-REVIEW.md (threats_open 0) and signed-off 12.1-VALIDATION.md (nyquist_compliant true)"
+affects: [gsd-verify-work, sm-user-plugin publication, fonoteka.go push]
+
+actuals:
+  tokens: 141472  # chars/4: framework c076b4c^..93f0171 (101051) + plugin 4693155..2b04cda (40353) + fonoteka.go 35a727f..93b8b75 (68)
+  tasks: 3
+  commits: 7
+plan_head_before: 52f864ebfc58a488037e60b27a778df8c4158f08
+plan_head_after: 93f0171e9c0eb798a61d5d71082873d1b3e8c4c6
+plugin_repo: sm-user-plugin (../fonoteka.go/plugins/golem15/user)
+plugin_commits: 7
+plugin_head_before: 469315510809f703fc315aceaa9ef902794a0237
+plugin_head_after: 2b04cda3ff8c4375ca4206f6ae751a6221db0483
+app_repo: fonoteka.go (../fonoteka.go)
+app_commits: 2
+app_head_before: 35a727f1ddfde0a443cf203193bf3705fe3158a1
+app_head_after: 93b8b758d540e5edb5095c8ed99998e57d4150d8
+
+tech-stack:
+  added: []
+  patterns:
+    - "Phase gate: go test -json detector refuses fail, skip, zero tests, non-JSON, missing named prefix; removal is anchor-exact mutate / assert-fail / cmp restore"
+    - "One TestPhase121Threats per repository, subtest named by threat id; high/critical threats also have a removal row"
+
+key-files:
+  created:
+    - scripts/check-phase12.1.sh
+    - modules/cabana/phase121_threats_test.go
+    - modules/cabana/phase121_bulk_test.go
+    - modules/cabana/phase121_record_test.go
+    - modules/cabana/phase121_rowstate_test.go
+    - modules/cabana/phase121_forbidden_test.go
+    - modules/cabana/phase121_preview_test.go
+    - modules/cabana/phase121_fields_test.go
+    - modules/cabana/phase121_permission_test.go
+    - modules/cabana/phase121_relation_lock_test.go
+    - modules/cabana/phase121_list_test.go
+    - modules/cabana/phase121_schema_boot_test.go
+    - admin/tests/list/BulkActionsMenu.test.ts
+    - admin/tests/list/RowStateBadges.test.ts
+    - admin/tests/form/RecordActions.test.ts
+    - admin/tests/form/PreviewView.test.ts
+    - admin/tests/form/PreviewField.test.ts
+    - admin/tests/form/PermissionEditorField.test.ts
+    - admin/tests/form/PasswordField.test.ts
+    - admin/tests/form/FormErrorBanner.test.ts
+    - ../fonoteka.go/plugins/golem15/user/phase121_security_test.go
+    - ../fonoteka.go/plugins/golem15/user/admin_users_edge_test.go
+    - ../fonoteka.go/plugins/golem15/user/admin_groups_edge_test.go
+    - ../fonoteka.go/plugins/golem15/user/admin_organisations_edge_test.go
+    - ../fonoteka.go/plugins/golem15/user/admin_registration_test.go
+    - .planning/phases/12.1-user-plugin-admin-screens/12.1-SECURITY-REVIEW.md
+  modified:
+    - modules/pact/capabilities_test.go
+    - admin/tests/list/ListToolbar.test.ts
+    - admin/tests/list/DataTable.test.ts
+    - admin/tests/list/ListView.test.ts
+    - admin/tests/form/RelationField.test.ts
+    - admin/tests/form/FormView.test.ts
+    - admin/tests/form/formState.test.ts
+    - admin/tests/form/registry.test.ts
+    - admin/tests/app/winterUrl.test.ts
+    - admin/tests/app/router.test.ts
+    - docs/backend/forms.md
+    - docs/backend/relation-manager.md
+    - .planning/phases/12.1-user-plugin-admin-screens/12.1-VALIDATION.md
+    - ../fonoteka.go/plugins/golem15/user/classes/admin_actions.go
+    - ../fonoteka.go/plugins/golem15/user/classes/privileged.go
+    - ../fonoteka.go/plugins/golem15/user/models/user.go
+
+key-decisions:
+  - "Security review was self-performed by the executor (no reviewer agent on this runtime); threats_open 0; five findings_for_decision recorded, not closed silently"
+  - "pending: push sm-user-plugin — condition (c) failed: git ls-remote --tags origin v0.1.3 is empty. Conditions (a)(b)(d) hold. Nothing was pushed."
+  - "No follow-up framework tag: git diff --name-only v0.1.3 HEAD -- modules cmd admin/src lists only Go tests and testdata"
+  - "Two plugin production fixes during tests (FX-1 clean statement, FX-2 group filter value); FX-3 is a test-only strengthening of T-12.1-24"
+
+patterns-established:
+  - "Last plan of a phase: named threat tests, 80% coverage floor, removal harness, SECURITY-REVIEW, VALIDATION sign-off, then one plugin push point gated on a published framework tag"
+
+requirements-completed: [SC-5]
+
+coverage:
+  - id: D1
+    description: "Named threat tests in both repos and a fail-closed --security stage"
+    requirement: SC-5
+    verification:
+      - kind: integration
+        ref: "modules/cabana/phase121_threats_test.go#TestPhase121Threats"
+        status: pass
+      - kind: integration
+        ref: "../fonoteka.go/plugins/golem15/user/phase121_security_test.go#TestPhase121Threats"
+        status: pass
+      - kind: other
+        ref: "scripts/check-phase12.1.sh --self-test && --security"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Go unit/integration coverage at or above 80% for pact, cabana, and the user plugin packages root, classes, controllers, models, updates"
+    requirement: SC-5
+    verification:
+      - kind: other
+        ref: "scripts/check-phase12.1.sh --coverage (pact 100.0, cabana 86.6, plugin root 89.1, classes 89.0, controllers 83.0, models 95.7, updates 90.2)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "SPA unit tests including the five UI-SPEC backstops; OpenAPI, dist, docs, hygiene"
+    requirement: SC-5
+    verification:
+      - kind: unit
+        ref: "admin/tests/list/ListView.test.ts#backstop: focus returns to the bulk menu trigger"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/app/winterUrl.test.ts#backstop: mapWinterUrl maps preview/:id"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/list/RowStateBadges.test.ts#backstop: a row state outside the fixed set"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/form/PermissionEditorField.test.ts#backstop: radio/checkbox emission and locked row"
+        status: pass
+      - kind: unit
+        ref: "admin/tests/form/RelationField.test.ts#backstop: a locked option cannot be chosen"
+        status: pass
+      - kind: other
+        ref: "scripts/check-phase12.1.sh --spa --openapi --dist --docs --hygiene"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Removal harness proves high/critical protections including D-30 FormBeforeUpdate and FormBeforeDelete"
+    requirement: SC-5
+    verification:
+      - kind: other
+        ref: "scripts/check-phase12.1.sh --removal (27 rows, RC-23 T-12.1-38, RC-24 T-12.1-39)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Security review maps T-12.1-01..40 and T-12.1-SC; validation signed off; plugin push pending on origin tag"
+    requirement: SC-5
+    verification:
+      - kind: other
+        ref: "scripts/check-phase12.1.sh --evidence && --all"
+        status: pass
+    human_judgment: true
+    rationale: "End-of-phase visual walk of the three screens in light and dark mode, and the D-30 email/password/delete feel, cannot be asserted by unit tests (plan 05 Task 3 human-check)."
+
+duration: 103min
+completed: 2026-10-05
+status: complete
+---
+
+# Phase 12.1: User plugin admin screens — Plan 05 Summary
+
+**Fail-closed `scripts/check-phase12.1.sh`, named threat tests in both repos, SPA backstops, 80%+ coverage, security review with zero open threats, and validation signed off. Plugin push is pending because `v0.1.3` is not on origin.**
+
+## Performance
+
+- **Duration:** 103 min (executor 14:30–16:13 local). The previous session finished every production commit and died before this SUMMARY; this file closes that illegal partial-plan state.
+- **Started:** 2026-10-05T12:30:31Z
+- **Completed:** 2026-10-05T14:13:50Z (production commits); SUMMARY closed out 2026-10-05T15:00:00Z
+- **Tasks:** 3 of 3
+- **Files modified:** 37 in summercms.go, 17 in sm-user-plugin, 2 pointer bumps in fonoteka.go
+
+## Accomplishments
+
+- One named threat test per repository. Cabana `TestPhase121Threats` covers T-12.1-01 to T-12.1-15. Plugin `TestPhase121Threats` covers T-12.1-18 to T-12.1-25, 27 to 31, 34, 38 and 39, and cites T-12-18 by that id.
+- `scripts/check-phase12.1.sh` is executable and fail-closed. `--all` passed in 11 min 47 s. `--removal` passed 27 rows in 6 min 29 s and left both trees clean.
+- Statement coverage: `modules/pact` 100.0%, `modules/cabana` 86.6%; plugin root 89.1%, `classes` 89.0%, `controllers` 83.0%, `models` 95.7%, `updates` 90.2%.
+- Five UI-SPEC backstops have named vitest cases (bulk-menu focus, preview URL mapping, unknown row state, permission-editor emission, locked relation options).
+- `12.1-SECURITY-REVIEW.md`: 41 threat ids match the five plans, `threats_open: 0`, D-30 and T-12-18 sections present. `12.1-VALIDATION.md`: `nyquist_compliant: true`, no TBD row.
+
+## Task Commits
+
+### summercms.go
+
+| Task | Commit | Subject |
+|------|--------|---------|
+| 1 | `c076b4c` | test(12.1-05): threat test for the Phase 12.1 framework contracts and the first gate stages |
+| 2 | `2e94cbf` | test(12.1-05): unit tests for bulk and record actions, row state, forbidden, preview and the form seams |
+| 3 | `84efdc0` | test(12.1-05): unit tests for the Phase 12.1 SPA components |
+| 3 | `aced6c7` | test(12.1-05): unit tests for the list, form, preview and routing behaviours of Phase 12.1 in the SPA |
+| 3 | `3190b1c` | test(12.1-05): complete the Phase 12.1 gate with the removal, coverage, app and evidence stages |
+| 3 | `83feeef` | docs(12.1-05): state the limits of relation locks and locked permission codes |
+| 3 | `93f0171` | docs(12.1-05): security review and validation sign-off for Phase 12.1 |
+
+Framework head before `52f864e`, after `93f0171`. Tag `v0.1.3` (`df5cace`) is an ancestor. No production Go or SPA source under `modules`, `cmd`, or `admin/src` changed after the tag.
+
+### sm-user-plugin
+
+| Task | Commit | Subject |
+|------|--------|---------|
+| 1 | `ba43ad9` | test: pin every mitigated Phase 12.1 threat of the admin screens in TestPhase121Threats |
+| 2 | `f496959` | fix: read privileged membership and the admin actions through a clean statement (T-12.1-38, T-12.1-39) |
+| 2 | `43fabfa` | fix: a group filter value that is not a group id lists nobody (D-23) |
+| 2 | `493a3ff` | test: unit tests for the admin class functions, the models and the admin registration |
+| 2 | `a848aa1` | test: edge cases of the Users, User Groups and Organisations admin controllers |
+| 2 | `7991b53` | test: extend the permission resolver table, the admin migration history and the API token refusals |
+| 3 | `2b04cda` | test: T-12.1-24 also marshals a user with last_seen and permissions |
+
+Plugin head before `4693155`, after `2b04cda`. Tree clean. 21 commits ahead of origin `0fe5b91`. Remote head was `0fe5b91` at the start of Task 2 and still `0fe5b91` at close-out: this plan pushed nothing.
+
+### fonoteka.go
+
+| Purpose | Commit | Subject |
+|---------|--------|---------|
+| Task 2 pointer | `ed78e6e` | build: bump sm-user-plugin (unit tests, the group filter value and the clean-statement fix) |
+| Task 3 pointer | `93b8b75` | build: bump sm-user-plugin (T-12.1-24 marshals the user model) |
+
+Application pointer equals plugin HEAD `2b04cda`. fonoteka.go was not pushed.
+
+## Gate output (recorded 2026-10-05)
+
+| Stage | Time | Result |
+|-------|------|--------|
+| `--self-test` | 2 s | PASS |
+| `--go` | 87–130 s | PASS |
+| `--security` | 84 s | PASS |
+| `--coverage` | 111 s | PASS (numbers above) |
+| `--spa` | 52 s | PASS (71 files, 1013 tests with typecheck) |
+| `--openapi` | 11 s | PASS |
+| `--dist` | 19–22 s | PASS |
+| `--docs` | 8 s | PASS |
+| `--hygiene` | <1 s | PASS |
+| `--app` | 290–325 s | PASS |
+| `--evidence` | <1 s | PASS |
+| `--all` | 11 min 47 s | PASS |
+| `--removal` | 6 min 29 s (27 rows) | PASS; both trees clean afterwards |
+
+Renaming one named plugin test by hand made `--security` exit non-zero with `refuse: missing named test`; the rename was reverted (T-12.1-35).
+
+## Publication (T-12.1-40)
+
+Checked after the review and `--all` on the final heads. Plugin remote head noted at the start of step (5): `0fe5b91b632a0ab784f3cecd2d5cf168528062ac`.
+
+| Condition | Held | Evidence |
+|-----------|------|----------|
+| (a) gate passed | yes | `--all` PASS |
+| (b) threats_open 0 | yes | `12.1-SECURITY-REVIEW.md` |
+| (c) `git ls-remote --tags origin v0.1.3` lists the tag | **no** | empty |
+| (d) no framework production code after the tag | yes | `git diff --name-only v0.1.3 HEAD -- modules cmd admin/src` is tests and testdata only |
+
+**pending: push sm-user-plugin** because (c) failed. Push framework `master` and annotated tag `v0.1.3` first (pending since plan 02). Then push sm-user-plugin master (never force). Then **push fonoteka.go** (user step). No follow-up framework tag is needed from this plan.
+
+## Decisions Made
+
+- Reviewer line is the executor self-review, matching 08-10 and Phase 12, because this runtime cannot spawn the security-review agent.
+- H-01 and H-02 (relation-lock vs manager; locked permission value outside the mode) were documented in `docs/backend/relation-manager.md` and `docs/backend/forms.md` rather than changing tagged production code.
+- Five findings left for the owner (FD-1 to FD-5): organisation_role on unlink, lock vs relation manager, boolean permission JSON, host `admin.jwt.secret`, and whether deactivate/ban should follow D-30.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. FX-1 — privileged membership read cloned a dirty statement**
+- **Found during:** Task 2 / removal of T-12.1-38
+- **Issue:** `classes.fresh` chained `WithContext` onto a lazy `NewDB` session and cloned the caller's conditions; `IsPrivilegedMember` could answer false for a privileged member
+- **Fix:** build the empty statement first (`f496959`)
+- **Verification:** `TestIsPrivilegedMember`, `TestAdminActions`; removal RC-25
+- **Committed in:** `f496959`
+
+**2. FX-2 — group filter 500 on a non-id value**
+- **Found during:** Task 2 edge tests (D-23)
+- **Issue:** `filter[groups]=abc` made the Users list answer 500
+- **Fix:** a value that is not a positive whole number lists nobody (`43fabfa`)
+- **Verification:** `TestAdminUsersGroupFilterValue`; removal RC-26
+- **Committed in:** `43fabfa`
+
+**3. FX-3 — T-12.1-24 removal survived on API payloads only**
+- **Found during:** Task 3 `--removal` RC-18
+- **Issue:** the subtest only read field-by-field API payloads, so removing `json:"-"` on `LastSeen` still passed
+- **Fix:** also marshal the model (`2b04cda`)
+- **Verification:** RC-18 and RC-27 now fail as required
+- **Committed in:** `2b04cda`
+
+---
+
+**Total deviations:** 3 auto-fixed (2 production plugin fixes, 1 test strengthening). No framework production code. No scope creep.
+
+## Issues Encountered
+
+The first executor session completed every plan-05 production commit (`93f0171` last) and exhausted context before writing SUMMARY.md. Resume closed that gap instead of re-executing the 250k-token plan.
+
+## User Setup Required
+
+None - no external service configuration required.
+
+Pending owner actions (not setup): push `v0.1.3` to origin, then sm-user-plugin, then fonoteka.go. Human visual UAT of the three screens is `/gsd-verify-work 12.1`.
+
+## Next Phase Readiness
+
+- Automated evidence for SC-5 is in place. Phase stays pending until human verification of the three screens.
+- Plugin and application remain local-only until the framework tag is on origin.
+- FD-1..FD-5 in the security review are owner decisions, not blockers for this plan.
+
+## Self-Check: PASSED
+
+- [x] All three tasks executed and committed
+- [x] Gate `--all` and `--removal` recorded passing
+- [x] Coverage floor met
+- [x] Threat ids in the review match the five plans (41)
+- [x] Publication recorded as pending with the failed condition
+- [x] SUMMARY.md created
+
+---
+
+*Phase: 12.1-user-plugin-admin-screens*
+*Completed: 2026-10-05*

.planning/phases/12.1-user-plugin-admin-screens/12.1-REVIEW-DISPOSITION.md

@@ -0,0 +1,13 @@
+---
+phase: 12.1
+review: 12.1-REVIEW.md
+titles: json
+findings: []
+open: 0
+total: 0
+recorded: 2026-10-05T15:10:00Z
+---
+
+# Phase 12.1: Code Review Disposition
+
+Quick review of the plan-05 production surface. No findings. Owner decisions FD-1 to FD-5 stay in `12.1-SECURITY-REVIEW.md`, not here.

.planning/phases/12.1-user-plugin-admin-screens/12.1-REVIEW.md

@@ -0,0 +1,47 @@
+---
+phase: 12.1-user-plugin-admin-screens
+reviewed: 2026-10-05T15:10:00Z
+depth: quick
+files_reviewed: 6
+files_reviewed_list:
+  - ../fonoteka.go/plugins/golem15/user/classes/admin_actions.go
+  - ../fonoteka.go/plugins/golem15/user/classes/privileged.go
+  - ../fonoteka.go/plugins/golem15/user/models/user.go
+  - ../fonoteka.go/plugins/golem15/user/controllers/users_admin_controller.go
+  - scripts/check-phase12.1.sh
+  - .planning/phases/12.1-user-plugin-admin-screens/12.1-SECURITY-REVIEW.md
+findings:
+  critical: 0
+  warning: 0
+  info: 0
+  total: 0
+status: clean
+---
+
+# Phase 12.1: Code Review Report
+
+**Reviewed:** 2026-10-05T15:10:00Z
+**Depth:** quick (resume close-out; gsd-code-reviewer was not spawned — typed GSD agents are unavailable in this runtime)
+**Files Reviewed:** 6 production/guard files that plan 05 actually changed or relies on
+**Status:** clean
+
+Plan 05 is tests, the gate, docs, and two plugin production fixes already recorded in `12.1-SECURITY-REVIEW.md` (FX-1, FX-2). Framework `modules`, `cmd`, and `admin/src` did not change after `v0.1.3`. This pass read the two fixes and the D-30 guards instead of re-reading every test file.
+
+## Production fixes (already gated)
+
+| Fix | File | What was checked | Verdict |
+|-----|------|------------------|---------|
+| FX-1 | `classes/admin_actions.go` `fresh` | `NewDB` session, `Clauses()` first, then a second `NewDB` session so `IsPrivilegedMember` cannot inherit caller WHERE clauses | Correct; pinned by RC-25 |
+| FX-2 | `models/user.go` `FilterScope` / `groupFilterID` | non-numeric filter values become `WHERE 1 = 0` instead of a 500 | Correct; pinned by RC-26 |
+
+## D-30 guards
+
+`guardCredentials` is called from `FormBeforeUpdate`; `guardPrivilegedMember` from `FormBeforeDelete`. Removal rows RC-23 and RC-24 name those exact calls. No new issue.
+
+## Not treated as review findings
+
+FD-1 to FD-5 in the security review are owner decisions (unlink role, lock vs manager, boolean JSON, host JWT secret, deactivate/ban). They are not defects introduced by plan 05.
+
+## Findings
+
+None.

.planning/phases/12.1-user-plugin-admin-screens/12.1-SECURITY-REVIEW.md

@@ -0,0 +1,197 @@
+---
+phase: "12.1"
+reviewed: "2026-10-05"
+reviewer: "gsd-executor, plan 12.1-05 (self-performed code-and-test review of plans 12.1-01 to 12.1-05; no reviewer agent could be spawned from the executor's runtime, per the 08-10 and Phase 12 precedent). The orchestrator may additionally run /gsd-secure-phase 12.1."
+threats_open: 0
+findings_for_decision: 5
+gate: "scripts/check-phase12.1.sh --all"
+removal_harness: "scripts/check-phase12.1.sh --removal"
+---
+
+# Phase 12.1 Security Review
+
+This is a code-and-test review of every threat in the registers of plans 12.1-01 to 12.1-05: T-12.1-01 to T-12.1-40 and T-12.1-SC. Severity and disposition are copied from the originating plan. T-12.1-SC is declared by every plan and is listed once. The Phase 12 threat T-12-18 (the user groups table), which this phase revisits, is cited by its original id and has its own section.
+
+`threats_open: 0` counts the registered threats: each is mitigated with a passing test or accepted with its rationale. It does not mean nothing is left to decide. `findings_for_decision: 5` counts review findings that are not vulnerabilities at the severity of this register but need the owner's decision; they are listed under "Findings that need a decision" and are not silently closed.
+
+A high or critical threat counts as mitigated only when its named test fails with the protection removed. `scripts/check-phase12.1.sh --removal` does this: it refuses a file with uncommitted changes, applies an anchor-exact mutation, runs the named test, requires it to fail on an assertion (a build failure does not count), and restores the file byte for byte, checked with `cmp`. Results are under "Removal checks".
+
+Repositories: `summercms.go` (framework: `modules/cabana`, `modules/pact`, `admin/`), sm-user-plugin (the user plugin, mounted in the application workspace at `plugins/golem15/user`). Framework tests are in `modules/cabana`; plugin tests run inside the application workspace. Gate stages are modes of `scripts/check-phase12.1.sh`.
+
+## Threat register
+
+| Threat | Category | Component | Severity | Disposition | Production mitigation | Test or gate stage | Observed result | Residual risk |
+|--------|----------|-----------|----------|-------------|-----------------------|--------------------|-----------------|---------------|
+| T-12.1-01 | Elevation of Privilege | bulk action ids (IDOR) | high | mitigate | `modules/cabana/crud.go` `CRUDService.BulkAction` resolves ids with `lockScoped` (the controller's list scope, `FOR UPDATE`) inside the action's transaction and answers `partialSelection` (409) unless every id resolved; plugin code receives records, never ids | `TestPhase121Threats/T-12.1-01`, `TestBulkActionScope`, `TestBulkActionPartial`, `TestBulkActionAbsent`; stage `--security` | pass; removal checks RC-01 (scope) and RC-02 (partial selection) fail the subtest | None known |
+| T-12.1-02 | Elevation of Privilege | running an action without its permission, or an undeclared action | high | mitigate | `modules/cabana/actions.go` `bulkActionOf` and `recordActionOf` answer 404 unless the action is declared in YAML and registered; `allowAction` checks the action's own permissions (403); the list schema and `meta.actions` are filtered per principal | `TestPhase121Threats/T-12.1-02`, `TestBulkActionPermissions`, `TestBulkActionUndeclared`, `TestRecordActionPermissions`, `TestListSchemaBulkActionsFiltered` | pass; removal check RC-03 fails the subtest | None known |
+| T-12.1-03 | Tampering | CSRF on the two new POST routes | high | mitigate | `modules/cabana/http.go` mounts both routes behind `requireAjax`; a cookie request without `X-Requested-With` is refused | `TestPhase121Threats/T-12.1-03`, `TestBulkActionCSRF`, `TestPhase10CSRF` (route count) | pass; removal checks RC-04 and RC-05 fail the subtest | None known |
+| T-12.1-04 | Elevation of Privilege | record action on a record outside the form scope or in the wrong state | high | mitigate | `CRUDService.RecordAction` loads the record with `loadRecord` (form scope, row lock) and answers 404 outside it; `Applies` is asked again inside the transaction and a false answer is 409 | `TestPhase121Threats/T-12.1-04`, `TestRecordActionScope`, `TestRecordActionApplies` | pass; removal checks RC-06 (scope) and RC-07 (Applies) fail the subtest | None known |
+| T-12.1-05 | Tampering | half-applied bulk mutation | medium | mitigate | One transaction per bulk action (`CRUDService.transaction`); any error from `Run` rolls every row back | `TestPhase121Threats/T-12.1-05`, `TestBulkActionRollback`, `TestBulkActionConcurrent` | pass | None known |
+| T-12.1-06 | Information Disclosure | internal error text in 403 or 500 bodies | medium | mitigate | `actionFailure` and `lifecycleFailure` log the cause and answer the fixed 500 body; only `*cabana.ForbiddenError` and `*cabana.ValidationError` carry text, localized | `TestPhase121Threats/T-12.1-06`, `TestForbiddenFromEveryHook`, `TestRecordActionAppliesError`, `TestRowStateHookError` | pass | A plugin that puts internal detail into a ForbiddenError message shows it |
+| T-12.1-07 | Tampering | plugin-supplied row state or label used as markup or CSS class | low | mitigate | The server sends only the three known states (`ListMeta.RowStates`); the SPA maps a state to a fixed class table and renders labels as text (`RowStateBadges.vue`, `DataTable.vue` `statesOf`) | `TestPhase121Threats/T-12.1-07`, `TestRowStateUnknownDropped`; `RowStateBadges.test.ts` and `DataTable.test.ts` (the backstop case "a row state outside the fixed set renders no badge and no class") | pass | None known |
+| T-12.1-08 | Repudiation | bulk and record actions leave no trace | low | mitigate | One `slog.Info` line per run with controller, action, admin id and affected count; no record contents | `TestPhase121Threats/T-12.1-08` | pass | The line is an application log, not a tamper-proof audit trail |
+| T-12.1-09 | Tampering | mass assignment through virtual or password fields | high | mitigate | `BindWritableFields` (`crud.go`) never binds a field listed in `FormVirtualFields`; `liftVirtualValues` takes virtual values out of the body, honours the field's context and hands them to hooks on the transaction context only | `TestPhase121Threats/T-12.1-09`, `TestVirtualFieldsContext`, `TestVirtualFieldsNested`, `TestPasswordFieldNeverProjected` | pass; removal checks RC-08 (context) and RC-09 (binding) fail | None known |
+| T-12.1-10 | Information Disclosure | password value in a response, log or URL | high | mitigate | A `type: password` field must be virtual (boot error otherwise, `extension.go` `checkVirtualFields`), so it is never bound or projected; `projectRecord` also skips protected keys; the SPA sends it only in the save body | `TestPhase121Threats/T-12.1-10`, `TestPasswordFieldNeverProjected`, `TestPhase121BootErrors`; `PasswordField.test.ts`, `FormView.test.ts` | pass; removal check RC-10 fails the subtest | The SPA shows whatever a record response carries for the field: the guarantee is the server's (observation OB-1) |
+| T-12.1-11 | Elevation of Privilege | protected foreign key written through a relation field | high | mitigate | `relation_field.go`: a belongsTo field on a protected key is read-only unless its contract sets `WritableForeignKey`; the submitted id still passes the scoped options query | `TestPhase121Threats/T-12.1-11`, `TestWritableForeignKeyOptIn`, `TestWritableForeignKeyScope` | pass; removal check RC-11 fails the subtest | None known |
+| T-12.1-12 | Elevation of Privilege | locked relation ids changed by a crafted request (mechanism behind T-12-18) | high | mitigate | `crud.go` calls `checkRelationLocks` inside the save transaction, before any row write, on create and update; the locked subset before and after must be equal, else 403 and rollback | `TestPhase121Threats/T-12.1-12`, `TestRelationLockCreate`, `TestRelationLockUpdate`, `TestRelationLockBelongsTo`, `TestRelationLockAbsentField`; `RelationField.test.ts` (backstop) | pass; removal check RC-12 fails the subtest | The lock covers form saves only; a relation manager on the same relation is not covered (H-01, now documented) |
+| T-12.1-13 | Tampering | permission code injection or out-of-range value | high | mitigate | `field_permission.go`: a submitted code must be offered by the controller for this request (422), a value must be in the mode's set (422), a locked code must keep its stored value (403); stored codes that are not offered are kept untouched | `TestPhase121Threats/T-12.1-13`, `TestPermissionEditorModes`, `TestPermissionEditorUnknownCode`, `TestPermissionEditorLocked`, `TestPermissionEditorKeepsUnoffered`; `PermissionEditorField.test.ts` (backstop) | pass; removal checks RC-13 (code) and RC-14 (lock) fail the subtest | A locked code stored with a value outside the mode's set blocks every save of that record (H-02, now documented) |
+| T-12.1-14 | Tampering | a preview-only field written by a crafted body | medium | mitigate | A field whose context is `preview` only is never writable: `contextAllows` leaves it out of the binding for create and update | `TestPhase121Threats/T-12.1-14`, `TestPreviewFieldNeverWritten` | pass | None known |
+| T-12.1-15 | Elevation of Privilege | script or markup through the status hint or callout classes | medium | mitigate | Partials are served as a node tree with an attribute allowlist (`partial_render.go`); the SPA builds elements from nodes and has no raw-HTML sink | `TestPhase121Threats/T-12.1-15`, `TestPreviewHeaderPartialScoped`; `check-phase12.1.sh --hygiene` (no `v-html` or `innerHTML` in `admin/src`) | pass | None known |
+| T-12.1-16 | Tampering | open redirect or foreign route through `preview/:id` in plugin YAML | medium | mitigate | `admin/src/app/winterUrl.ts` `mapWinterUrl` emits only the current controller's list, create, record and preview routes, digits only, else the list | `winterUrl.test.ts` (the backstop case and the foreign-controller and non-numeric-id cases), `router.test.ts` ("preview route"); stage `--spa` | pass | None known |
+| T-12.1-17 | Tampering | an unreviewed contract published by the tag | high | mitigate | Plan 02 Task 5 was a blocking decision checkpoint listing the published names and six contract properties; the owner chose `tag-local`. The tag `v0.1.3` is annotated, local, on `df5cace`, where every plan gate passed | `check-phase12.1.sh --openapi` (`TestPhase09ContractInventory`, `TestPhase10OpenAPIConformance`), `--hygiene` (the tag exists); the tag is not on origin (`git ls-remote --tags origin v0.1.3` is empty) | pass; no removal row (NR-01) | The tag is still local and can be re-cut; nothing depends on it publicly |
+| T-12.1-18 | Elevation of Privilege | Users screens and actions without the users permission | high | mitigate | `usersAdminController.RequiredPermissions` (`golem15.users.access_users`), `usergroupsAdminController` (`access_groups`), `organisationsAdminController` (`access_users`); every bulk and record action names its permission as well | plugin `TestPhase121Threats/T-12.1-18` (every route of the three screens 403 without the permission), `TestAdminUsersTracer`, `TestAdminGroups`, `TestAdminOrganisations`, `TestAdminRegistration` | pass; removal check RC-15 fails the subtest | None known |
+| T-12.1-19 | Information Disclosure | password hash, plain password or reset codes in admin responses | high | mitigate | The user form's password fields are virtual; no column of `models/user/columns.yaml` or `fields.yaml` is a secret; relation contracts list `name` and `email` only | plugin `TestPhase121Threats/T-12.1-19` (list, show, partial, update, 422, create, bulk and record action bodies scanned for the plain text, the hash and both codes) | pass; removal check RC-16 (a `password` column added to the list) fails the subtest | None known |
+| T-12.1-20 | Tampering | mass assignment of is_activated, permissions or organisation_id through the user form | high | mitigate | Only declared form fields are bound; `is_activated`, `organisation_id` and `permissions` are protected fill keys; the organisation is written through its relation field, permissions through the validated editor; `FormBeforeCreate` forces `is_activated` false | plugin `TestPhase121Threats/T-12.1-20`, `TestAdminUserFormFields` | pass; removal check RC-17 (a protected column offered as a form field) fails the subtest | None known |
+| T-12.1-21 | Spoofing | tokens issued before an admin password reset stay valid | medium | mitigate | `FormBeforeUpdate` stamps `tokens_valid_after` when a password was submitted | plugin `TestPhase121Threats/T-12.1-21`, `TestAdminUserPassword` | pass | None known |
+| T-12.1-22 | Denial of Service | invitation mail abuse | low | mitigate | One invitation per create, only with `send_invite` true in the body, sent after the commit (`lagoon.AfterCommit`); none on update | plugin `TestPhase121Threats/T-12.1-22`, `TestAdminUserInvite` | pass | An admin with the users permission can create many users; there is no per-admin rate limit |
+| T-12.1-23 | Tampering | permanent delete leaves orphans or half-deleted users | medium | mitigate | `FormAfterDelete` runs `classes.ForceDeleteCleanup` (throttle rows, memberships, attachments) and the row delete in the delete's transaction; blobs go after the commit | plugin `TestPhase121Threats/T-12.1-23`, `TestAdminUserForceDelete`, `TestAdminActions` | pass | A blob removal that fails after the commit is logged and leaves the blob |
+| T-12.1-24 | Information Disclosure | last_seen, permissions, timestamps or groups leak into user API payloads | high | mitigate | `models.User`: `LastSeen`, `Permissions`, `CreatedAt`, `UpdatedAt` and `Groups` are `json:"-"`; the user API builds its payload field by field (`groups` an empty list, `permissions` null) | plugin `TestPhase121Threats/T-12.1-24` (every user API body, and the marshalled model), `TestLastSeen`, `TestAdminFieldsNeverMarshal`; application `TestUserAPINuxtFlows`, `TestParityCorpus`; stage `--app` | pass; removal checks RC-18 and RC-27 fail the subtest (after the subtest was extended, see FX-3) | None known |
+| T-12.1-25 | Denial of Service | last_seen write fails or amplifies writes on the auth path | low | mitigate | `classes.TouchLastSeen` writes at most once per five minutes; login and refresh log and ignore its error | plugin `TestPhase121Threats/T-12.1-25`, `TestLastSeen`, `TestTouchLastSeen` | pass | None known |
+| T-12.1-26 | Elevation of Privilege | a deactivated site admin is re-enabled by restore or activate | medium | accept | PHP behaves the same (the membership survives a soft delete) and the action needs golem15.users.access_users (RESEARCH T-12-18 path 8). | none (accepted) | accepted | An administrator with the users permission can re-enable a deactivated member of a privileged group, and can deactivate or ban one (see "D-30: boundary") |
+| T-12.1-27 | Elevation of Privilege | a wrong port of the permission merge grants a frontend permission | medium | mitigate | `classes/permissions.go` `MergedPermissions` (highest group value, user value overrides) and `HasPermission` (exactly 1; wildcards as Winter) | plugin `TestPhase121Threats/T-12.1-27`, `TestMergedPermissions` (a table of stored shapes, group sets and wildcards), `TestPermissionSetScan` | pass | Boolean values in stored JSON are not grants here, unlike the API-token reader (H-05) |
+| T-12.1-28 | Elevation of Privilege | T-12-18 revisited: adding or removing a privileged group through the user form's groups field | critical | mitigate | `usersAdminController.AdminRelationLocks` locks the ids of the groups whose code is in `golem15.user.privileged_groups` for an administrator without `golem15.users.manage_privileged_groups`; the framework refuses a create or update that changes the locked subset with 403 before any row is written | plugin `TestPhase121Threats/T-12.1-28` (add, remove and create matrix with and without the permission, a crafted body that also changes other fields, `classes.HasGroupCode` before and after), `TestAdminPrivilegedGroups`, `TestAdminUserGroupsField` | pass; removal check RC-19 fails the subtest | None known |
+| T-12.1-29 | Elevation of Privilege | creating, renaming to or from, or deleting a privileged group code | high | mitigate | `usergroupsAdminController` `FormBeforeCreate`, `FormBeforeUpdate` (stored code read through the write's transaction) and `FormBeforeDelete` call `requirePrivilegedPermission` | plugin `TestPhase121Threats/T-12.1-29`, `TestAdminPrivilegedGroups`, `TestAdminGroupsEdge`, `TestAdminGroupsControllerGuards` | pass; removal check RC-20 fails the subtest | Validation answers before the guard (H-09) |
+| T-12.1-30 | Elevation of Privilege | a second, unguarded writer of users_groups | high | mitigate | The groups field is the only writer besides the two deletes; no relation manager for groups exists on any controller; bulk and record actions and the organisation members manager do not touch the table | plugin `TestPhase121Threats/T-12.1-30` (the table byte-identical before and after every bulk action, record action, members link and unlink; no groups relation route answers), `TestAdminOrganisationMembers` | pass; removal check RC-21 (a membership write added to an action) fails the subtest | None known |
+| T-12.1-31 | Tampering | privileged list cached, mis-compared or bypassed through a NULL code | medium | mitigate | `classes/privileged.go`: the list is read from config on every call, compared case-sensitively, blank entries dropped; a group without a code is never privileged | plugin `TestPhase121Threats/T-12.1-31`, `TestPrivilegedGroupCodes`, `TestIsPrivilegedCode`, `TestIsPrivilegedMember` | pass | An application that sets the list to empty has no privileged group |
+| T-12.1-32 | Tampering | organisation members manager moves users between organisations | low | accept | PHP's add and remove behave the same; the routes need `golem15.users.access_users`, write only organisation_id and are scoped by the relation contract (RESEARCH T-12-18 path 6). | none (accepted) | accepted | The role column outlives the membership (H-06); a member of another organisation cannot be linked until released |
+| T-12.1-33 | Tampering | a published application pointer references an unpublished plugin commit, the plugin is published while the framework contract it needs is not, or the app is built against a framework without v0.1.3 | low | mitigate | Nothing was pushed by plans 03 to 05; the pointer bumps are local commits; the publication step is T-12.1-40 | `check-phase12.1.sh --app` (the recorded pointer equals the plugin head; both trees clean), the plans' verify commands | pass; the plugin's remote head is unchanged (`0fe5b91`) | The application repository must not be pushed before the plugin |
+| T-12.1-34 | Information Disclosure | group membership reaches a user API payload | high | mitigate | `User.Groups` is `json:"-"`; the user API's payload builder writes `groups` as an empty list | plugin `TestPhase121Threats/T-12.1-34`, application `TestPhase12Threats` (subtest T-12-18), `TestHiddenNeverMarshals` | pass; removal check RC-22 fails the subtest | None known |
+| T-12.1-35 | Repudiation | a gate that passes without measuring (zero tests, skips, a filter that matches nothing) | medium | mitigate | `detect` in the gate refuses a failure, a build failure, a skip, zero tests, "no tests to run", non-JSON output and a required name without a passing top-level test | `check-phase12.1.sh --self-test` (planted inputs for each) | pass; a plugin test renamed by hand made `--security` refuse with "missing named test" | The whole-module runs of `--go` and `--app` accept packages without tests |
+| T-12.1-36 | Information Disclosure | a consuming-application name in framework fixtures, tests, docs or gate output | low | mitigate | `check-phase12.1.sh --hygiene` scans the phase's framework files, every module README, the root README, `docs` and `admin/src`; gate output about the application workspace is masked | `check-phase12.1.sh --hygiene`, `--self-test` (four planted spellings found, the mask checked) | pass | Thirteen older Go files in other modules name the application; they predate this phase (OB-3) |
+| T-12.1-37 | Tampering | a mitigation silently removed by a later change | medium | mitigate | `TestPhase121Threats` in both repositories, the required name prefixes of `--security`, and the removal harness | `check-phase12.1.sh --security`, `--removal`, `--evidence` | pass; 27 removal rows fail as required | The removal stage is not part of `--all`; it must be run on purpose |
+| T-12.1-38 | Elevation of Privilege | takeover of a privileged-group member's account: an admin holding only golem15.users.access_users changes the member's email or sets a password | critical | mitigate | `usersAdminController.FormBeforeUpdate` starts with `guardCredentials`: a changed email or a submitted password on a member of a privileged group needs `golem15.users.manage_privileged_groups` (`guardPrivilegedMember`, `classes.IsPrivilegedMember` through the write's transaction); refusal is a 403 with details and nothing is written | plugin `TestPhase121Threats/T-12.1-38`, `TestAdminPrivilegedMember`, `TestAdminUsersEdge` (superuser; unreadable membership is the opaque 500), `TestAdminUsersControllerGuards`, `TestIsPrivilegedMember` | pass; removal checks RC-23 (the guard) and RC-25 (the clean statement) fail | See "D-30: boundary" |
+| T-12.1-39 | Tampering | permanent delete of a privileged-group member, by the form button or inside a bulk delete | high | mitigate | `usersAdminController.FormBeforeDelete` calls `guardPrivilegedMember`; the framework calls it per record inside the bulk delete's transaction, so one refused record rolls the selection back | plugin `TestPhase121Threats/T-12.1-39`, `TestAdminPrivilegedMember`, `TestAdminUsersEdge` | pass; removal check RC-24 fails the subtest | See "D-30: boundary" |
+| T-12.1-40 | Tampering | the shared plugin is published before the security review, or while the framework contract it builds on is not published | medium | mitigate | One push point in the phase, after the gate and this review, and only when the framework tag is on origin and no framework production code changed after it | `check-phase12.1.sh --app` (pointer and clean trees); the four conditions are recorded in 12.1-05-SUMMARY.md | pass; condition (c) does not hold, so nothing was pushed and the push is recorded as pending | The push is a manual step the owner takes after pushing the framework tag |
+| T-12.1-SC | Tampering | npm/pip/cargo installs | high | mitigate | No package was installed and no manifest changed in the phase | `check-phase12.1.sh --hygiene` (`go.mod`, `go.sum`, `admin/package.json` and `admin/package-lock.json` are unchanged since `v0.1.3` and have no local change) | pass; no removal row (NR-02) | None known |
+
+## Removal checks
+
+Each row is one anchor-exact mutation from `scripts/check-phase12.1.sh --removal`. The anchor occurs exactly once in its file; the test must fail on an assertion; the file is restored and compared with `cmp`. All 27 rows were run on 2026-10-05 and all failed as required; both working trees were clean afterwards. RC-18 first survived: see FX-3.
+
+| Check | Threat | File | What the mutation removes | Test that must fail | Result |
+|-------|--------|------|---------------------------|---------------------|--------|
+| RC-01 | T-12.1-01 | `modules/cabana/crud.go` | the list scope inside `lockScoped` | `TestPhase121Threats/T-12.1-01` | fails as required |
+| RC-02 | T-12.1-01 | `modules/cabana/crud.go` | the partial-selection refusal in `BulkAction` | `TestPhase121Threats/T-12.1-01` | fails as required |
+| RC-03 | T-12.1-02 | `modules/cabana/actions.go` | the action's own permission check (`allowAction`) | `TestPhase121Threats/T-12.1-02` | fails as required |
+| RC-04 | T-12.1-03 | `modules/cabana/http.go` | `requireAjax` on the bulk action route | `TestPhase121Threats/T-12.1-03` | fails as required |
+| RC-05 | T-12.1-03 | `modules/cabana/http.go` | `requireAjax` on the record action route | `TestPhase121Threats/T-12.1-03` | fails as required |
+| RC-06 | T-12.1-04 | `modules/cabana/crud.go` | the form scope of `loadRecord` in `RecordAction` | `TestPhase121Threats/T-12.1-04` | fails as required |
+| RC-07 | T-12.1-04 | `modules/cabana/crud.go` | the `Applies` refusal in `RecordAction` | `TestPhase121Threats/T-12.1-04` | fails as required |
+| RC-08 | T-12.1-09 | `modules/cabana/crud.go` | the context check when virtual values are lifted | `TestVirtualFieldsContext`, `TestVirtualFieldsSmoke` | fails as required |
+| RC-09 | T-12.1-09 | `modules/cabana/crud.go` | the virtual-field skip in `BindWritableFields` | `TestPhase121Threats/T-12.1-09` | fails as required (the controller no longer boots) |
+| RC-10 | T-12.1-10 | `modules/cabana/crud.go` | the same skip, seen from the password field | `TestPhase121Threats/T-12.1-10` | fails as required (the controller no longer boots) |
+| RC-11 | T-12.1-11 | `modules/cabana/relation_field.go` | the read-only rule of a protected foreign key without the opt-in | `TestPhase121Threats/T-12.1-11` | fails as required |
+| RC-12 | T-12.1-12 | `modules/cabana/crud.go` | the relations handed to `checkRelationLocks` | `TestPhase121Threats/T-12.1-12` | fails as required |
+| RC-13 | T-12.1-13 | `modules/cabana/field_permission.go` | the offered-code check | `TestPhase121Threats/T-12.1-13` | fails as required |
+| RC-14 | T-12.1-13 | `modules/cabana/field_permission.go` | the locked-code check | `TestPhase121Threats/T-12.1-13` | fails as required |
+| RC-15 | T-12.1-18 | `controllers/users_admin_controller.go` | the Users controller's required permission | plugin `TestPhase121Threats/T-12.1-18` | fails as required |
+| RC-16 | T-12.1-19 | `models/user/columns.yaml` | the absence of a `password` list column | plugin `TestPhase121Threats/T-12.1-19` | fails as required |
+| RC-17 | T-12.1-20 | `models/user/fields.yaml` | the absence of `organisation_role` from the form | plugin `TestPhase121Threats/T-12.1-20` | fails as required |
+| RC-18 | T-12.1-24 | `models/user.go` | `json:"-"` on `LastSeen` | plugin `TestPhase121Threats/T-12.1-24` | fails as required (survived before FX-3) |
+| RC-19 | T-12.1-28 | `controllers/users_admin_controller.go` | the locked ids returned by `AdminRelationLocks` | plugin `TestPhase121Threats/T-12.1-28` | fails as required |
+| RC-20 | T-12.1-29 | `controllers/usergroups_admin_controller.go` | the permission check of `requirePrivilegedPermission` | plugin `TestPhase121Threats/T-12.1-29` | fails as required |
+| RC-21 | T-12.1-30 | `classes/admin_actions.go` | the rule that no action writes `users_groups` (a delete is added to `ActivateUsers`) | plugin `TestPhase121Threats/T-12.1-30` | fails as required |
+| RC-22 | T-12.1-34 | `models/user.go` | `json:"-"` on `Groups` | plugin `TestPhase121Threats/T-12.1-34` | fails as required |
+| RC-23 | T-12.1-38 | `controllers/users_admin_controller.go` | the `guardCredentials` call at the top of `FormBeforeUpdate` (D-30) | plugin `TestPhase121Threats/T-12.1-38` | fails as required |
+| RC-24 | T-12.1-39 | `controllers/users_admin_controller.go` | the `guardPrivilegedMember` call in `FormBeforeDelete` (D-30) | plugin `TestPhase121Threats/T-12.1-39` | fails as required |
+| RC-25 | T-12.1-38 | `classes/admin_actions.go` | the clean statement of `fresh` (fix `f496959`) | plugin `TestIsPrivilegedMember` | fails as required |
+| RC-26 | D-23 | `models/user.go` | the group filter value check (fix `43fabfa`) | plugin `TestAdminUsersGroupFilterValue` | fails as required |
+| RC-27 | T-12.1-24 | `models/user.go` | `json:"-"` on `Permissions` | plugin `TestPhase121Threats/T-12.1-24` | fails as required |
+
+High threats without a removal row:
+
+| Waiver | Threat | Reason |
+|--------|--------|--------|
+| NR-01 | T-12.1-17 | A process control (the owner's decision checkpoint before the tag); there is no line of code to remove. The contract inventory and conformance tests run in `--openapi`. |
+| NR-02 | T-12.1-SC | A process control (no install); `--hygiene` compares the four dependency manifests with the tag. |
+
+Where a protection has two layers, one mutation removes one of them. RC-09 and RC-10 remove the binding skip, after which the controller refuses to boot: the second layer (a password field must be virtual; `projectRecord` skips protected keys) fails closed. The review did not build a mutation that removes both layers at once.
+
+## T-12-18 revisited
+
+Phase 12 recorded T-12-18 as "no route writes users_groups; Groups is never serialized; the site-admin predicate reads group codes server-side only". This phase adds writers. The eight paths of 12.1-RESEARCH.md ("T-12-18: Every users_groups Write Path"):
+
+| Path | What it writes | Guard or disposition | Evidence |
+|------|----------------|----------------------|----------|
+| 1. User form `groups` field (create and update) | replaces the user's pivot rows | `AdminRelationLocks` plus the framework's `checkRelationLocks`: the privileged subset must not change without `golem15.users.manage_privileged_groups`; 403 and rollback | `TestPhase121Threats/T-12.1-28`, `TestAdminPrivilegedGroups`; RC-12, RC-19 |
+| 2. User permanent delete (form and bulk) | removes the user's pivot rows | `access_users`; for a privileged member also the extra permission (D-30) | `TestPhase121Threats/T-12.1-23` and `/T-12.1-39`; RC-24 |
+| 3. Group create or re-code with a privileged code | no pivot write; changes who is privileged | extra permission in `FormBeforeCreate` and `FormBeforeUpdate` | `TestPhase121Threats/T-12.1-29`; RC-20 |
+| 4. Delete of a privileged group | removes that group's pivot rows | extra permission in `FormBeforeDelete`; `FormAfterDelete` removes the rows | `TestPhase121Threats/T-12.1-29`, `TestAdminGroups` |
+| 5. Bulk and record actions | nothing in `users_groups` | none needed; pinned | `TestPhase121Threats/T-12.1-30`; RC-21 |
+| 6. Organisation members manager | `users.organisation_id` only | accepted (T-12.1-32) | `TestAdminOrganisationMembers`, `TestPhase121Threats/T-12.1-30` |
+| 7. Config change of the privileged list | which codes are privileged | operational; read per request | `TestPhase121Threats/T-12.1-31`, `TestPrivilegedGroupCodes` |
+| 8. Restore or activate of a deactivated site admin | no pivot write; re-enables the account | accepted (T-12.1-26) | none (accepted) |
+
+`Groups` still never reaches a user API payload (T-12.1-24, T-12.1-34; the application's `TestPhase12Threats` subtest T-12-18 still passes). The consumer of the membership is unchanged: `classes.HasGroupCode`.
+
+## D-30: takeover guard for privileged-group members
+
+D-30 added T-12.1-38 (critical) and T-12.1-39 (high) at the plan check. For an administrator who holds `golem15.users.access_users` and not `golem15.users.manage_privileged_groups`, three operations on a member of a privileged group are refused with 403 and change nothing:
+
+1. changing the member's email (`FormBeforeUpdate`, `guardCredentials`);
+2. submitting a password for the member (the same check; the two together in one body, with other fields, are refused as a whole);
+3. permanently deleting the member, by the form's delete and inside a bulk delete, which is then refused as a whole (`FormBeforeDelete`).
+
+The guard landed in sm-user-plugin commit `b410a7f` (plan 12.1-03, with `classes/privileged.go`) and was corrected in `f496959` during this plan (FX-1). Both checks have a removal row: with `guardCredentials` removed, `TestPhase121Threats/T-12.1-38` fails; with the delete guard removed, `TestPhase121Threats/T-12.1-39` fails (RC-23, RC-24). A superuser passes; a membership that cannot be read is an opaque 500 and nothing changes (`TestAdminUsersEdge`): the guard never answers "not privileged" on an error.
+
+### D-30: boundary
+
+What an administrator with only `golem15.users.access_users` may still do to a member of a privileged group, and why:
+
+| Operation | Allowed | Why |
+|-----------|---------|-----|
+| Change name, surname and other profile fields | yes | not a credential; D-30 names email and password |
+| Change the organisation, the avatar, the frontend permissions | yes | not a credential; D-30 does not cover them. Frontend permissions are what the application's own features check, so this can change what the member may do in the app |
+| Add or remove an ordinary group | yes | D-04: ordinary groups need only the users permission; the privileged membership itself stays locked |
+| Deactivate (soft delete), restore, activate | yes | D-13 and T-12.1-26 (accepted): reversible, as in PHP |
+| Ban, unban, unsuspend | yes | D-14; reversible |
+| Change email, set a password, permanently delete | no | D-30 |
+
+The guard protects against takeover and permanent removal. It does not protect availability: deactivating or banning a site administrator locks that person out until someone with the users permission reverses it. This is the accepted behaviour of D-30 and T-12.1-26; it is listed as FD-5 because the owner may want the two actions guarded too.
+
+## Items handed over by plans 02 to 04
+
+Each item was checked against code and, where a test could show it, pinned.
+
+| Item | Statement | Disposition | Evidence |
+|------|-----------|-------------|----------|
+| H-01 | Relation locks are enforced on form create and update only; relation-manager link and unlink routes do not ask `RelationLockProvider` | Contract property, accepted by the owner at the tag decision. Not reachable in the plugin: no relation manager exists for groups. The framework page did not say so; it does now | `TestPhase121Threats/T-12.1-30` (no groups relation route); `docs/backend/relation-manager.md` ("The lock covers the form field only"); decision item FD-2 |
+| H-02 | A locked permission code whose stored value is outside the mode's set makes every save by that administrator a 403 | Contract property, accepted at the tag decision. Not reachable in the plugin: neither controller locks a code. Now documented | `TestPermissionEditorLocked`; `docs/backend/forms.md`; `usersAdminController.AdminPermissionOptions` ("None is locked") |
+| H-03 | A relation hook returning `cabana.ForbiddenError` is untested | Closed | `TestForbiddenFromEveryHook` (before and after create, update and delete, bulk delete, relation link and the child hooks), `TestForbiddenRollsBack` |
+| H-04 | A `users.permissions` value that is not a JSON object fails login, fetch and the admin form for that row | By decision (plan 03): a damaged value must not silently lose its denials. Only the validated editor writes the column, so a damaged value needs direct SQL or a faulty import | `TestPermissionSetScan`, `TestMergedPermissions` ("a damaged row is an error"); cutover note in the summary |
+| H-05 | `UserPermissionGrants` accepts booleans in `user_groups.permissions`; `PermissionSet` skips them and an edit drops them | Known difference, towards fewer grants. Pinned so a change is deliberate; decision item FD-3 | `TestAdminGroupsLegacyBooleanPermissions`, `TestMergedPermissions` ("a boolean value is not a grant") |
+| H-06 | Unlinking an organisation member clears `organisation_id` and keeps `organisation_role` | Real gap, low: the actor already holds the users permission, which can do more than this. The fix needs a framework unlink hook or a plugin route, so it was not improvised. Pinned; decision item FD-1 | `TestAdminOrganisationRoleOutlivesMembership` |
+| H-07 | Deleting an organisation cascades into the application's credential tables, reachable with the users permission | As in PHP; the screen is the place organisations are administered. No confirm text says so. Accepted; mentioned under FD-1 | `TestAdminOrganisations` (delete releases the members), `TestAdminOrganisationsEdge` |
+| H-08 | The seeded `guest` and `registered` groups can be deleted or re-coded with the groups permission | Accepted: no Go code reads the two codes. An application protects them by naming their codes in `golem15.user.privileged_groups` | `TestAdminGroupsEdge` (with `guest` in the list, delete and re-code are 403 and the row stays) |
+| H-09 | A request that would be refused with 403 answers 422 when it also fails validation | Accepted: nothing is saved either way, and the 422 reveals only that a code exists, which the list shows | `TestAdminGroupsEdge` ("validation answers before the guard") |
+| H-10 | A host application loading the plugin needs `admin.jwt.secret` or fails to start | Compatibility note for a shared plugin, not a vulnerability: failing closed is the right behaviour. In the plugin README | `TestAdminNeedsSecret`; decision item FD-4 |
+| H-11 | `"password": ""` without confirmation answers 422 | Framework rule order (`confirmed` before `nullable`). The SPA leaves an empty password out, so the admin never sends it. Accepted | `TestPhase121Threats/T-12.1-20`; `formState.test.ts` ("leaves an empty password out on update") |
+
+## Findings that need a decision
+
+These are not open threats of the register. They are recorded here so they are decided, not forgotten.
+
+| Finding | What | Suggested step |
+|---------|------|----------------|
+| FD-1 | `organisation_role` outlives the membership after an unlink (H-06), and an organisation delete removes the application's organisation credentials without a warning (H-07) | Clear the role on unlink (needs a framework unlink hook or a plugin-side route) and add a confirm text to the organisation delete |
+| FD-2 | Relation locks do not cover a relation manager on the same relation (H-01) | Either enforce the lock on the manager's link and unlink routes or make "a locked field plus a manager on the same relation" a boot error; a framework change after v0.1.3 |
+| FD-3 | Two readers of `user_groups.permissions` differ on boolean values (H-05) | Normalize booleans to 1 in the cutover import, or teach `ParsePermissionSet` to read `true` as 1 |
+| FD-4 | Every host application of the shared plugin now needs `admin.jwt.secret` (H-10) | Tell the other projects before they update the plugin |
+| FD-5 | Deactivating or banning a member of a privileged group needs only the users permission (D-30 boundary, T-12.1-26) | Decide whether `deactivate` and `ban` should refuse a privileged member as the permanent delete does |
+
+Smaller observations, no decision needed:
+
+- **OB-1 (T-12.1-10).** The SPA's password input shows whatever a record response carries for that field. The server never sends one (`TestPhase121Threats/T-12.1-10`, RC-10). A defensive `''` on load in `FormView.vue` would be a framework change after the tag; it was not made.
+- **OB-2, sorting by an invisible column.** `sort=surname` on the Users list is accepted although the column is not shown. It reveals order, not values, and the column is searchable by design.
+- **OB-3.** Thirteen Go files in other framework modules (tests of `modules/tide`, `modules/wristband` and others) name the application. They predate this phase and are outside its hygiene scope; recorded in `deferred-items.md`.
+
+## Fixes made during the review
+
+| Fix | Repository | Commit | What |
+|-----|------------|--------|------|
+| FX-1 (T-12.1-38, T-12.1-39) | sm-user-plugin | `f496959` | `classes.fresh` chained `WithContext` onto a lazy `NewDB` session, which clones the caller's statement with its conditions. On a handle that carried a condition `IsPrivilegedMember` answered false for a privileged member, so the takeover guard would have passed. No caller passes such a handle today (the hooks hand over the write's transaction). `fresh` now builds the empty statement first; `IsPrivilegedMember` and `PrivilegedGroupIDs` read through it. Tests: `TestIsPrivilegedMember`, `TestAdminActions` (both fail without the fix; RC-25) |
+| FX-2 (D-23) | sm-user-plugin | `43fabfa` | `User.FilterScope` handed the group filter value to the database as it came; `filter[groups]=abc` made the Users list answer 500. A value that is not a positive whole number now lists nobody. Test: `TestAdminUsersGroupFilterValue` (fails with a 500 without the fix; RC-26) |
+| FX-3 (T-12.1-24) | sm-user-plugin | `2b04cda` | Test only. The removal check for the `json:"-"` tag of `LastSeen` survived: the subtest read the user API payloads, which are built field by field. It now marshals the model too |
+| Documentation (H-01, H-02) | summercms.go | see 12.1-05-SUMMARY.md | Two sentences in `docs/backend/relation-manager.md` and `docs/backend/forms.md` state the limits of relation locks and locked permission codes. No Go or SPA source changed |
+
+No framework production code (`modules`, `cmd`, `admin/src`) changed in this plan: `git diff --name-only v0.1.3 HEAD -- modules cmd admin/src` lists only Go test files and files under `testdata`.

.planning/phases/12.1-user-plugin-admin-screens/12.1-UAT.md

@@ -0,0 +1,36 @@
+---
+status: testing
+phase: 12.1-user-plugin-admin-screens
+source: [12.1-VERIFICATION.md]
+started: 2026-10-05T15:10:00Z
+updated: 2026-10-05T15:10:00Z
+---
+
+## Current Test
+
+number: 1
+name: Walk Users, User Groups and Organisations in light and dark mode as an admin holding golem15.users.access_users and golem15.users.access_groups but not golem15.users.manage_privileged_groups
+expected: |
+  Screens match the UI-SPEC (row-state badges with text, one status callout on preview, record actions before the primary edit button, segmented permission control, locked admin group with its note). Filter and search Users; open a banned and a deactivated user's preview; run Activate, Unban and a bulk Ban; create a user with an invitation; open Permissions; try to add the admin group; edit a group's permissions; add and remove an organisation member.
+awaiting: user response
+
+## Tests
+
+### 1. Walk Users, User Groups and Organisations in light and dark mode as an admin holding golem15.users.access_users and golem15.users.access_groups but not golem15.users.manage_privileged_groups
+expected: Screens match the UI-SPEC (row-state badges with text, one status callout on preview, record actions before the primary edit button, segmented permission control, locked admin group with its note). Filter and search Users; open a banned and a deactivated user's preview; run Activate, Unban and a bulk Ban; create a user with an invitation; open Permissions; try to add the admin group; edit a group's permissions; add and remove an organisation member.
+result: [pending]
+
+### 2. D-30 on a user in the admin group: name-only save; email save; password save; Delete; bulk delete with another user
+expected: Name-only save succeeds. Email and password each show the forbidden banner with the marked field, keep what was typed, save nothing. Delete and bulk delete each show a danger toast and delete nobody.
+result: [pending]
+
+## Summary
+
+total: 2
+passed: 0
+issues: 0
+pending: 2
+skipped: 0
+blocked: 0
+
+## Gaps

.planning/phases/12.1-user-plugin-admin-screens/12.1-VALIDATION.md

@@ -3,16 +3,19 @@ phase: "12.1"
 slug: "user-plugin-admin-screens"
 # status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
 # audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
-status: draft
-nyquist_compliant: false
-wave_0_complete: false
+status: validated
+nyquist_compliant: true
+wave_0_complete: true
 created: "2026-10-04"
+validated: "2026-10-05"
+gate: "scripts/check-phase12.1.sh --all"
+removal_gate: "scripts/check-phase12.1.sh --removal"
 ---
 
 # Phase 12.1 — Validation Strategy
 
 > Per-phase validation contract for feedback sampling during execution.
-> Seeded from `12.1-RESEARCH.md` § Validation Architecture. The phase has no requirement IDs; success criteria (SC) and CONTEXT.md decisions (D-NN) are the units.
+> Seeded from `12.1-RESEARCH.md` § Validation Architecture and finalized by plan 12.1-05. The phase has no requirement IDs; success criteria (SC) and CONTEXT.md decisions (D-NN) are the units.
 
 ---
 
@@ -20,83 +23,111 @@ created: "2026-10-04"
 
 | Property | Value |
 |----------|-------|
-| **Framework** | Go `testing` + testcontainers Postgres (cabana and plugin harnesses exist); SPA: vitest + @vue/test-utils + happy-dom |
+| **Framework** | Go `testing` + testcontainers Postgres (cabana and plugin harnesses); SPA: vitest + @vue/test-utils + happy-dom |
 | **Config file** | `admin/vitest.config.ts`; Go needs none |
 | **Quick run command (framework)** | `go vet ./modules/cabana/ ./modules/pact/ && go test ./modules/cabana/... ./modules/pact/... -count=1` |
 | **Quick run command (plugin)** | `go -C ../fonoteka.go test ./plugins/golem15/user/... -count=1` |
 | **Quick run command (SPA)** | `npm --prefix admin run typecheck && npm --prefix admin test` |
 | **Full suite command (framework)** | `go vet ./... && go test ./... -count=1` |
-| **Full suite command (application)** | `go -C ../fonoteka.go vet ./... && go -C ../fonoteka.go test ./... -count=1` |
+| **Full suite command (application)** | `scripts/check-phase12.1.sh --app` (vet and tests of every module of the application workspace; `go -C ../fonoteka.go test ./...` alone covers the root module only) |
 | **Docs** | `go test ./cmd/summer -run TestDocsTree -count=1` and `go run ./cmd/summer docs:build --check` |
 | **Generated artefacts** | `scripts/check-admin-openapi.sh --check` and `scripts/check-admin-dist.sh` |
-| **Estimated runtime** | not measured; the planner records it once the quick commands have run |
+| **Phase gate** | `scripts/check-phase12.1.sh --all`, and `scripts/check-phase12.1.sh --removal` on its own |
+
+### Measured run times (2026-10-05, one workstation, warm build cache)
+
+| Command | Time |
+|---------|------|
+| `go test ./modules/cabana -run '^TestPhase121Threats$' -count=1` | 11 s |
+| `go test ./modules/cabana -count=1` | 63 s |
+| `go -C ../fonoteka.go test ./plugins/golem15/user/... -count=1` | 40 s (package `user` 37 s, `classes` 39 s, `updates` 11 s, in parallel) |
+| `npm --prefix admin run typecheck && npm --prefix admin test` | 52 s (71 files, 1013 tests) |
+| `scripts/check-phase12.1.sh --self-test` | 2 s |
+| `scripts/check-phase12.1.sh --go` | 87 to 130 s |
+| `scripts/check-phase12.1.sh --security` | 84 s |
+| `scripts/check-phase12.1.sh --coverage` | 111 s |
+| `scripts/check-phase12.1.sh --spa` | 52 s |
+| `scripts/check-phase12.1.sh --openapi` | 11 s |
+| `scripts/check-phase12.1.sh --dist` | 19 to 22 s |
+| `scripts/check-phase12.1.sh --docs` | 8 s |
+| `scripts/check-phase12.1.sh --hygiene` | under 1 s |
+| `scripts/check-phase12.1.sh --app` | 290 to 325 s (five workspace modules) |
+| `scripts/check-phase12.1.sh --evidence` | under 1 s |
+| `scripts/check-phase12.1.sh --all` | 11 min 47 s |
+| `scripts/check-phase12.1.sh --removal` | 4 min 13 s (26 rows) to 6 min 29 s (27 rows, final heads) |
 
 ---
 
 ## Sampling Rate
 
-- **After every task commit:** Run the quick run command of the repository the task wrote to; plus `scripts/check-admin-openapi.sh --check` and `scripts/check-admin-dist.sh` when `admin/` or swag annotations changed
-- **After every plan wave:** Run both full suites and the docs checks
-- **Before `/gsd-verify-work`:** `scripts/check-phase12.1.sh --all` must be green (modelled on `scripts/check-phase12.2.sh`)
-- **Max feedback latency:** not measured; set with the estimated runtime
+- **After every task commit:** the quick run command of the repository the task wrote to; plus `scripts/check-admin-openapi.sh --check` and `scripts/check-admin-dist.sh` when `admin/` or swag annotations changed
+- **After every plan wave:** both full suites and the docs checks
+- **Before `/gsd-verify-work`:** `scripts/check-phase12.1.sh --all` green, and `--removal` green on the same heads
+- **Feedback latency:** a quick run answers in under 65 s in each repository (measured above); the stated maximum for a task-level check is 2 minutes, which every quick run and every single gate stage except `--app` meets. The whole gate takes about 12 minutes and is a per-wave check, not a per-task one.
 
 ---
 
 ## Per-Task Verification Map
 
-Task IDs are assigned by the planner; rows are keyed by unit until then.
+Task ids are `<plan>-T<task>`. Framework commands run in `summercms.go`; plugin commands run inside the application workspace. Every command below is also run by a stage of `scripts/check-phase12.1.sh`.
 
 | Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
 |---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
-| TBD | TBD | TBD | D-09 | — | Bulk action ids outside the list scope never reach `Run`; partial selection refused; undeclared or unregistered action refused; own permission enforced; one transaction, rollback on error | integration | `go test ./modules/cabana/... -run 'TestBulkAction' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-09 | — | A YAML bulk action the controller does not register fails boot | unit | `go test ./modules/cabana/... -run 'TestListSchemaBulkActions' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-10 | — | Record action runs in form scope; out-of-scope 404; not-applicable refused; own permission enforced | integration | `go test ./modules/cabana/... -run 'TestRecordAction' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-11 | — | `context: preview` field never writable | unit + SPA | `go test ./modules/cabana/... -run 'TestPreview' -count=1`; `npm --prefix admin test -- winterUrl FormView` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-12 | — | Row state from the fixed set; unknown value dropped | integration + SPA | `go test ./modules/cabana/... -run 'TestRowState' -count=1`; `npm --prefix admin test -- DataTable` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-16 | — | `permissioneditor`: unknown code 422, value outside the mode's set 422, stored JSON shape | integration + SPA | `go test ./modules/cabana/... -run 'TestPermissionEditor' -count=1`; `npm --prefix admin test -- PermissionEditorField` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | contract | — | New routes in the inventory, permission matrix and OpenAPI document | contract | `go test ./modules/cabana/... -run 'TestPhase09ContractInventory\|TestPhase09PermissionMatrix\|TestPhase10OpenAPIConformance' -count=1` | ✅ (extend) | ⬜ pending |
-| TBD | TBD | TBD | SC-1 | — | Three controllers boot; navigation and permissions gate them | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestAdmin(Users\|Groups\|Organisations)' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | SC-2 | — | Groups field sync; organisation members set and clear `organisation_id` | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestAdminUserGroupsField\|TestAdminOrganisationMembers' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | SC-3 / D-13 / D-14 | — | activate, unban, unsuspend, deactivate, restore, ban, force delete with cleanup | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestAdminUserActions\|TestAdminUserForceDelete' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | SC-4 | T-12-18 | Without the extra permission a privileged membership change is 403 and nothing changes; privileged code create, rename and delete refused; every other path leaves `users_groups` unchanged | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestAdminPrivilegedGroups' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-30 | T-12.1-38, T-12.1-39 | Without the extra permission, changing the email or password of a privileged-group member, or permanently deleting them (form delete, bulk delete as a whole), is 403 and nothing changes; with it each succeeds; a name-only update stays allowed | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestAdminPrivilegedMember' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-15 | — | Resolver equals PHP `getMergedPermissions` on a table of cases | unit | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestMergedPermissions\|TestPermissionSetScan' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-17 | — | `last_seen` written by the auth path; absent from every user payload | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestLastSeen' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-19 | — | Password mismatch 422; `send_invite` sends one mail; password never in a response | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestAdminUserPassword\|TestAdminUserInvite' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-20 | — | Avatar shared between the admin file route and the user API | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/... -run 'TestAdminAvatarSharedWithAPI' -count=1` | ❌ W0 | ⬜ pending |
-| TBD | TBD | TBD | D-08 | T-12-18 | A user with groups marshals without groups | regression | existing `TestPhase12Threats/T-12-18` in the application | ✅ | ⬜ pending |
-| TBD | TBD | TBD | schema | — | Go schema matches the PHP snapshot with one new allow-list entry | integration | `go -C ../fonoteka.go test ./parity -run TestSchemaMatchesPHPSnapshot -count=1` | ✅ (extend) | ⬜ pending |
-| TBD | TBD | TBD | migrations | — | Three additive migrations up and down | integration | `go -C ../fonoteka.go test ./plugins/golem15/user/updates/... -count=1` | ✅ harness, ❌ cases | ⬜ pending |
-| TBD | TBD | TBD | docs | — | Identifiers, links, snippets | checker | `go test ./cmd/summer -run TestDocsTree -count=1` | ✅ | ⬜ pending |
+| 12.1-01-T1 | 01 | 1 | D-09 / SC-1 | T-12.1-01, T-12.1-02, T-12.1-03, T-12.1-05 | Bulk action ids outside the list scope never reach `Run`; a partial selection is refused; an undeclared or unregistered action is 404; the action's own permission is enforced; one transaction, rollback on error; a YAML bulk action the controller does not register fails boot | integration + unit + SPA | `go test ./modules/cabana -run '^(TestBulkAction\|TestListSchemaBulkActions\|TestPhase121BootErrors)' -count=1`; `npm --prefix admin test -- tests/list/BulkActionsMenu tests/list/ListToolbar tests/list/ListView` | ✅ | ✅ green |
+| 12.1-01-T2 | 01 | 1 | D-10 / SC-1 | T-12.1-04 | A record action runs in the form scope: out of scope 404, not applicable 409, own permission enforced, only offered actions in `meta.actions` | integration + SPA | `go test ./modules/cabana -run '^TestRecordAction' -count=1`; `npm --prefix admin test -- tests/form/RecordActions` | ✅ | ✅ green |
+| 12.1-01-T3 | 01 | 1 | D-12 / SC-1 | T-12.1-07 | Row state from the fixed set; an unknown value is dropped by the server and renders nothing in the SPA | integration + SPA | `go test ./modules/cabana -run '^TestRowState' -count=1`; `npm --prefix admin test -- tests/list/RowStateBadges tests/list/DataTable` | ✅ | ✅ green |
+| 12.1-01-T4 | 01 | 1 | D-27 (G4) / SC-3 | T-12.1-06, T-12.1-08 | A hook or action refuses with a readable 403 and a rollback; any other error is the opaque 500; one log line per action run | integration + SPA | `go test ./modules/cabana -run '^(TestForbidden\|TestSoftDeletedRecord\|TestPhase121Threats)' -count=1`; `npm --prefix admin test -- tests/form/FormErrorBanner tests/form/FormView` | ✅ | ✅ green |
+| 12.1-02-T1 | 02 | 2 | D-11 / SC-1 | T-12.1-14, T-12.1-15, T-12.1-16 | A `context: preview` field is never writable; the status hint is served as allowlisted nodes; a preview URL from YAML stays on the current controller | integration + SPA | `go test ./modules/cabana -run '^TestPreview' -count=1`; `npm --prefix admin test -- tests/form/PreviewView tests/form/PreviewField tests/app/winterUrl tests/app/router` | ✅ | ✅ green |
+| 12.1-02-T2 | 02 | 2 | D-19, D-27 (G1, G2, G5, G7), D-28 / SC-3 | T-12.1-09, T-12.1-10 | Password and virtual fields are never bound, filled or returned; rules per operation replace the model rules; preset shapes | integration + SPA | `go test ./modules/cabana -run '^(TestPasswordField\|TestVirtualFields\|TestFormRules\|TestPreset)' -count=1`; `npm --prefix admin test -- tests/form/PasswordField tests/form/formState` | ✅ | ✅ green |
+| 12.1-02-T3 | 02 | 2 | D-16 / SC-2 | T-12.1-13 | `permissioneditor`: unknown code 422, value outside the mode's set 422, changed locked code 403, stored codes that are not offered kept | integration + SPA | `go test ./modules/cabana -run '^TestPermissionEditor' -count=1`; `npm --prefix admin test -- tests/form/PermissionEditorField` | ✅ | ✅ green |
+| 12.1-02-T4 | 02 | 2 | D-07, D-27 (G3, G6) / SC-3 | T-12.1-11, T-12.1-12 | A protected foreign key is writable only with the opt-in; locked relation ids cannot be added or removed on create or update; invisible columns are searched and not sent | integration + SPA | `go test ./modules/cabana -run '^(TestRelationLock\|TestWritableForeignKey\|TestInvisibleColumn\|TestFilterOptions)' -count=1`; `npm --prefix admin test -- tests/form/RelationField tests/list/DataTable` | ✅ | ✅ green |
+| 12.1-02-T5 | 02 | 2 | D-25 | T-12.1-17 | The owner decides how the contract is released before a tag exists | decision checkpoint | answered `tag-local` on 2026-10-05 (12.1-02-SUMMARY.md) | n/a | ✅ green |
+| 12.1-02-T6 | 02 | 2 | contract / SC-4 | T-12.1-17 | New routes in the inventory, the permission matrix and the OpenAPI document; the tag is on a head where the gates passed | contract | `go test ./modules/cabana -run '^(TestPhase09ContractInventory\|TestPhase09PermissionMatrix\|TestPhase10OpenAPIConformance)$' -count=1`; `scripts/check-admin-openapi.sh --check`; `scripts/check-admin-dist.sh` | ✅ | ✅ green |
+| 12.1-03-T1 | 03 | 3 | SC-1, D-30 | T-12.1-18, T-12.1-38, T-12.1-39 | The Users screen needs its permission; without the extra permission, changing the email or password of a privileged-group member, or permanently deleting them (form delete, bulk delete as a whole), is 403 and nothing changes; with it each succeeds; a name-only update stays allowed | integration | `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminUsersTracer\|TestAdminPrivilegedMember\|TestPhase121Threats)$' -count=1` | ✅ | ✅ green |
+| 12.1-03-T2 | 03 | 3 | SC-3 / D-13 / D-14 | T-12.1-23, T-12.1-30 | activate, unban, unsuspend, deactivate, restore, ban; permanent delete with cleanup; no action writes `users_groups` | integration | `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminUserActions\|TestAdminUserForceDelete)$' -count=1`; `go -C ../fonoteka.go test ./plugins/golem15/user/classes -run '^TestAdminActions$' -count=1` | ✅ | ✅ green |
+| 12.1-03-T3 | 03 | 3 | D-15, D-19, D-20 | T-12.1-19, T-12.1-20, T-12.1-21, T-12.1-22, T-12.1-27 | Password mismatch 422; a reset ends sessions; `send_invite` sends one mail; no secret in a response; the avatar is shared with the user API; the resolver equals PHP `getMergedPermissions` on a table of cases | integration + unit | `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminUserPassword\|TestAdminUserInvite\|TestAdminAvatarSharedWithAPI\|TestAdminUserFormFields)$' -count=1`; `go -C ../fonoteka.go test ./plugins/golem15/user/classes -run '^(TestMergedPermissions\|TestPermissionSetScan)$' -count=1` | ✅ | ✅ green |
+| 12.1-03-T4 | 03 | 3 | D-17, migrations | T-12.1-24, T-12.1-25 | `last_seen` is written by the auth path at most once per five minutes, never fails it, and is absent from every user payload; three additive migrations up, down and up | integration | `go -C ../fonoteka.go test ./plugins/golem15/user -run '^TestLastSeen$' -count=1`; `go -C ../fonoteka.go test ./plugins/golem15/user/updates -count=1` | ✅ | ✅ green |
+| 12.1-04-T1 | 04 | 4 | SC-2, SC-4, D-04, D-07 | T-12-18, T-12.1-28, T-12.1-30 | The groups field writes exactly the chosen memberships; without the extra permission a privileged membership change is 403 and nothing changes, on create too; every other path leaves `users_groups` unchanged | integration | `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminPrivilegedGroups\|TestAdminUserGroupsField)$' -count=1` | ✅ | ✅ green |
+| 12.1-04-T2 | 04 | 4 | SC-1, D-06, D-24, D-29 | T-12.1-29, T-12.1-31 | User Groups screen; a privileged code cannot be created, re-coded or deleted without the extra permission; the list counts members | integration | `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminGroups\|TestAdminGroupsEdge\|TestAdminGroupsControllerGuards)$' -count=1` | ✅ | ✅ green |
+| 12.1-04-T3 | 04 | 4 | SC-1, SC-2, D-22 | T-12.1-32 | Organisations screen; the members manager sets and clears `organisation_id` and nothing else | integration | `go -C ../fonoteka.go test ./plugins/golem15/user -run '^(TestAdminOrganisations\|TestAdminOrganisationMembers\|TestAdminOrganisationsEdge)$' -count=1` | ✅ | ✅ green |
+| 12.1-04-T4 | 04 | 4 | SC-4, D-08, schema | T-12.1-33, T-12.1-34 | The Go schema matches the PHP snapshot with one allow-list entry; a user with groups marshals and answers the user API without them; the recorded plugin pointer is the plugin head | integration + regression | `go -C ../fonoteka.go test ./parity -run '^(TestSchemaMatchesPHPSnapshot\|TestUserAPINuxtFlows\|TestParityCorpus)$' -count=1`; the application's `TestPhase12Threats` (subtest T-12-18); `scripts/check-phase12.1.sh --app` | ✅ | ✅ green |
+| 12.1-05-T1 | 05 | 5 | SC-5, D-04 to D-08, D-30 | T-12.1-35, T-12.1-37 | One named threat test per repository with a subtest per mitigated threat; the gate refuses a failure, a skip, zero tests and a missing named test | integration + gate | `scripts/check-phase12.1.sh --self-test && scripts/check-phase12.1.sh --security` | ✅ | ✅ green |
+| 12.1-05-T2 | 05 | 5 | SC-5 | — | Every Go behaviour of the phase has a unit or integration test; coverage of pact, cabana and the plugin's five packages is at least 80 percent each | unit + integration | `scripts/check-phase12.1.sh --go && scripts/check-phase12.1.sh --coverage` | ✅ | ✅ green |
+| 12.1-05-T3 | 05 | 5 | SC-5, docs | T-12.1-36, T-12.1-40, T-12.1-SC | The SPA behaviours and the five UI backstops are unit-tested; docs identifiers, links and snippets hold; no application name in framework files; no dependency change; every high or critical protection is load-bearing | SPA + checker + gate | `scripts/check-phase12.1.sh --all`; `scripts/check-phase12.1.sh --removal` | ✅ | ✅ green |
 
-*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+*Status: ✅ green · ❌ red · ⚠️ flaky*
+
+Measured coverage (statements, `scripts/check-phase12.1.sh --coverage`, 2026-10-05): `modules/pact` 100.0%, `modules/cabana` 86.6%; the plugin's packages root 89.1%, `classes` 89.0%, `controllers` 83.0%, `models` 95.7%, `updates` 90.2%. The floor is 80 percent per package.
 
 ---
 
 ## Wave 0 Requirements
 
-- [ ] A neutral cabana fixture plugin (`modules/cabana/testdata/...`, `acme`) with bulk actions, record actions, a preview field, row state and a permission editor
-- [ ] `sm-user-plugin` admin test harness: boot the plugin with cabana mounted and mint a backend principal with chosen permissions
-- [ ] SPA fixtures under `admin/tests/fixtures/` for the new schema fields
-- [ ] `scripts/check-phase12.1.sh`
+- [x] A neutral cabana fixture plugin (`modules/cabana/testdata/roster`, `acme.roster`) with bulk actions, record actions, a preview field, row state and a permission editor (plans 01 and 02)
+- [x] sm-user-plugin admin test harness: `admin_harness_test.go` boots the plugin with cabana mounted and mints a backend principal with chosen permissions (plan 03)
+- [x] SPA fixtures under `admin/tests/fixtures/` for the new schema fields: `roster.list-schema.json`, `roster.list.json`, `roster.record.json`, `roster.form-schema.json` (plans 01 and 02)
+- [x] `scripts/check-phase12.1.sh` (plan 05)
 
-Framework install: none needed.
+Framework install: none needed. No Go module and no npm package was added or changed in the phase.
 
 ---
 
 ## Manual-Only Verifications
 
-None identified by research. The UI-SPEC (`/gsd-ui-phase 12.1`) may add visual checks for the preview screen, row state styling and the permission editor.
+One end-of-phase human check, from plan 12.1-05 Task 3 (`workflow.human_verify_mode` is `end-of-phase`). It is not automated because visual fit with the design system in both themes cannot be asserted by unit tests.
+
+- **Test:** start the application against the tagged framework, sign in as a backend admin holding `golem15.users.access_users` and `golem15.users.access_groups` but not `golem15.users.manage_privileged_groups`, and walk the three screens in light and dark mode: filter and search Users, open a banned and a deactivated user's preview, run Activate, Unban and a bulk Ban, create a user with an invitation, open the Permissions tab, try to add the admin group to a user, edit a group's permissions, add and remove an organisation member. Then open a user who is in the admin group: change the name only and save; change the email and save; enter a new password and save; press Delete; select that user together with another one and use the bulk delete.
+- **Expected:** the screens match the UI-SPEC (row-state badges with text, one status callout on the preview, record actions before the single primary edit button, the segmented permission control, the locked admin group with its note, the forbidden banner when the locked group is forced through a crafted request), and nothing in the app's own user payloads changed. For the user in the admin group (D-30): the name-only save succeeds; the email save and the password save each show the forbidden banner with the marked field, keep what was typed and save nothing; Delete and the bulk delete each show a danger toast and delete nobody.
 
 ---
 
 ## Validation Sign-Off
 
-- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
-- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
-- [ ] Wave 0 covers all MISSING references
-- [ ] No watch-mode flags
-- [ ] Feedback latency recorded and within the stated maximum
-- [ ] `nyquist_compliant: true` set in frontmatter
+- [x] All tasks have `<automated>` verify or Wave 0 dependencies (12.1-02-T5 is a decision checkpoint and has none by design)
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all MISSING references
+- [x] No watch-mode flags
+- [x] Feedback latency recorded and within the stated maximum
+- [x] `nyquist_compliant: true` set in frontmatter
 
-**Approval:** pending
+**Approval:** validated 2026-10-05 by plan 12.1-05 (gsd-executor), on `scripts/check-phase12.1.sh --all` and `--removal` passing; the manual check above is left to `/gsd-verify-work`.

.planning/phases/12.1-user-plugin-admin-screens/12.1-VERIFICATION.md

@@ -0,0 +1,73 @@
+---
+phase: 12.1-user-plugin-admin-screens
+verified: 2026-10-05T15:10:00Z
+status: human_needed
+score: 5/5 roadmap success criteria verified against code; SC-5 gate --all recorded PASS on production HEAD 93f0171
+overrides_applied: 0
+human_verification:
+  - test: "Walk Users, User Groups and Organisations in light and dark mode as an admin holding golem15.users.access_users and golem15.users.access_groups but not golem15.users.manage_privileged_groups"
+    expected: "Screens match the UI-SPEC (row-state badges with text, one status callout on preview, record actions before the primary edit button, segmented permission control, locked admin group with its note). Filter and search Users; open a banned and a deactivated user's preview; run Activate, Unban and a bulk Ban; create a user with an invitation; open Permissions; try to add the admin group; edit a group's permissions; add and remove an organisation member."
+    why_human: "Visual fit with the design system in both themes cannot be asserted by unit tests (plan 12.1-05 Task 3 human-check)."
+  - test: "D-30 on a user in the admin group: name-only save; email save; password save; Delete; bulk delete with another user"
+    expected: "Name-only save succeeds. Email and password each show the forbidden banner with the marked field, keep what was typed, save nothing. Delete and bulk delete each show a danger toast and delete nobody."
+    why_human: "End-to-end feel of the forbidden banner and toasts is a browser check."
+covered_files:
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-01-PLAN.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-01-SUMMARY.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-02-PLAN.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-02-SUMMARY.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-03-PLAN.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-03-SUMMARY.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-04-PLAN.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-04-SUMMARY.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-05-PLAN.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-05-SUMMARY.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-SECURITY-REVIEW.md"
+  - ".planning/phases/12.1-user-plugin-admin-screens/12.1-VALIDATION.md"
+  - "scripts/check-phase12.1.sh"
+  - "modules/cabana/phase121_threats_test.go"
+  - "modules/cabana/crud.go"
+  - "modules/cabana/actions.go"
+  - "modules/cabana/http.go"
+covered_digest: "v2:sha256:1a19afd9501bbb04b76e0b4f5c618c381209b491ba2f9157eded678b9eea15ac"
+covered_files_note: "verification.fingerprint covers only paths under the summercms.go root. Plugin and application state at verification: sm-user-plugin 2b04cda (clean, 21 commits ahead of origin 0fe5b91), fonoteka.go 93b8b75 (pointer equals plugin HEAD). Framework tag v0.1.3 is local on df5cace and not on origin."
+behavior_unverified: 0
+---
+
+# Phase 12.1: User plugin admin screens Verification Report
+
+**Phase Goal:** Backend admins manage frontend users, user groups and organisations in the admin SPA without SQL, so the PHP backend is not needed for user administration after cutover. The Users, User Groups and Organisations screens of the PHP user plugin are ported to `golem15.user`, driven by its `fields.yaml`/`columns.yaml`.
+**Verified:** 2026-10-05T15:10:00Z
+**Status:** human_needed
+**Re-verification:** No, initial verification
+
+Plan 05 production commits were already on `master` (`c076b4c`..`93f0171`); this run only wrote the missing SUMMARY and the phase-gate artifacts. The verifier checked code and ran the fast gate stages. It did not re-run the 12-minute `--all` (already PASS on the same production HEAD).
+
+## Goal Achievement
+
+| # | Success criterion | Status | Evidence |
+| --- | --- | --- | --- |
+| SC1 | Users, User Groups and Organisations each have a list and a create/update form from PHP YAML, in admin navigation, permission-gated | ✓ VERIFIED | Controllers `users_admin_controller.go`, `usergroups_admin_controller.go`, `organisations_admin_controller.go`; YAML under `models/user`, `usergroup`, `organisation`; three side items in `admin_navigation.go` (`users`, `usergroups`, `organisations`). Plugin subtest `T-12.1-18` requires the matching permission on every route |
+| SC2 | A user's groups via a relation field; an organisation's members via a relation manager | ✓ VERIFIED | `AdminRelationLocks` on the users controller (line 380); `controllers/organisations/config_relation.yaml`; plugin tests `TestAdminUserGroupsField`, `TestAdminOrganisationMembers` |
+| SC3 | activate, unban, unsuspend, delete and list bulk actions as in PHP Users.php | ✓ VERIFIED | Plugin tests `TestAdminUserActions`, `TestAdminUserForceDelete`; threat subtests T-12.1-23, T-12.1-30, T-12.1-39 |
+| SC4 | T-12-18 revisited: the admin form is the first writer of `users_groups`; privileged membership needs the extra permission | ✓ VERIFIED | `AdminRelationLocks` + `checkRelationLocks`; plugin `T-12.1-28` comment cites T-12-18 by that id; `T-12.1-30` asserts no other writer; removal RC-19 |
+| SC5 | The new code has unit tests, delivered in the last plan | ✓ VERIFIED | `TestPhase121Threats` in cabana (T-12.1-01..15) and plugin (18-25, 27-31, 34, 38, 39). Coverage recorded: pact 100%, cabana 86.6%, plugin packages 83–95.7%. `scripts/check-phase12.1.sh --all` PASS 2026-10-05. This session: `--self-test`, `--evidence` (41 threats, 27 removal rows), `--hygiene` all exit 0 |
+
+## Artifacts
+
+| Artifact | Status |
+| --- | --- |
+| Five plan SUMMARYs | ✓ |
+| `scripts/check-phase12.1.sh` executable | ✓ |
+| `12.1-SECURITY-REVIEW.md` threats_open 0 | ✓ (`--evidence` this session) |
+| `12.1-VALIDATION.md` nyquist_compliant true | ✓ no TBD row |
+| `12.1-REVIEW.md` + disposition | ✓ 0 findings |
+| Plugin push | pending: `v0.1.3` is not on origin |
+
+## Gaps
+
+None that falsify a success criterion.
+
+Status is `human_needed`, not `passed`, because the plan-05 visual walk and D-30 browser check are still outstanding, and because sm-user-plugin is unpublished until the framework tag is on origin. Those are not code gaps.
+
+_Verifier: orchestrator inline on resume close-out. Did not spawn gsd-verifier (typed GSD agents unavailable). Did not re-run `--all` or `--removal`._

.planning/phases/12.1-user-plugin-admin-screens/deferred-items.md

@@ -0,0 +1,29 @@
+# Phase 12.1 deferred items
+
+## Deferred Items
+
+- Two inventory tests of the application's fonoteka plugin module fail against the framework at v0.1.3
+  status: resolved
+  **Resolved:** plan 12.1-04, 2026-10-05, fonoteka.go commit `ca746fc` (`phase09AdminRoutes` names the bulk action and record action routes; `phase10ListMessageKeys` names the three row-state messages). The form half of `TestPhase10ControllerCopy` reads named keys only and needed no change.
+  **Found:** plan 12.1-02 Task 6, 2026-10-05, by running `go -C ../fonoteka.go/plugins/golem15/fonoteka test ./... -count=1` in addition to the plan's gate.
+  **What:** `TestPhase09SecurityRoutes` (`admin_phase09_security_test.go`) reports the two plan 01 routes `POST .../{controller}/bulk/{action}` and `POST .../{controller}/{id}/actions/{action}` as unexpected, because the fixed list `phase09AdminRoutes` does not name them. `TestPhase10ControllerCopy` (`admin_phase10_copy_test.go`) compares the list messages with the fixed list `phase10ListMessageKeys`, which lacks `rowStateDeleted`, `rowStateNegative` and `rowStateDisabled`; its form half was not reached and may need `preview` and `edit` the same way.
+  **Why not fixed here:** the fix is two fixed lists in the application repository (fonoteka.go); plan 12.1-02 writes to summercms.go only. No framework change is needed, so the tagged commit is not affected. The same catch-up was done once before (`549840d test(13-06): list the Phase 12.2 cabana admin routes in the Phase 9 route inventory`).
+  **Why the gate missed it:** the plan's application gate `go -C ../fonoteka.go test ./... -count=1` runs the root module only; the go.work plugin modules (`plugins/golem15/{user,fonoteka,golem,feedback}`) are separate modules and are not matched by `./...`.
+  **Suggested owner:** plan 12.1-04 (it already writes the application's parity allow-list entry and submodule pointer) or plan 12.1-05's gate script, which should run every workspace module.
+
+- Four more application tests fail once the user plugin registers its admin screen, its three migrations and the FrontendPermission model
+  status: resolved
+  **Resolved:** plan 12.1-04, 2026-10-05, fonoteka.go commit `b35442a` (developer navigation `[fonoteka user]`, with the publisher still seeing neither; `expectedUserModels = 7`, because plan 04 also registers the `UsersGroup` pivot; the user plugin's history has ten migrations) and `35a727f` (the `golem15_user_frontend_permissions` allow-list entry). Each failure was checked to be the fixed list and not a defect before the list changed.
+  **Found:** plan 12.1-03 Tasks 1 and 3, 2026-10-05. The application's go.work uses the plugin's working tree, so these fail as soon as the plugin commits exist, before any submodule pointer bump.
+  **What:** (1) `TestAdminMetadataFiltering` (`plugins/golem15/fonoteka/admin_metadata_test.go`) expects the developer role's navigation to be exactly `[fonoteka]`; it is now `[fonoteka user]`, because the four Winter permission codes of the user plugin default to the developer role (D-02, D-04). (2) `TestMigrateSeedsCanonicalGenres` and `TestRollbackLastIsolatesFonoteka` (`parity/migrate_test.go`) compare the user plugin's migration history with a fixed id list, which lacks `202610040001_add_users_permissions`, `202610040002_add_users_last_seen` and `202610040003_create_frontend_permissions`. In history order (by id) the first of them sorts before the shipped `202610040001_create_user_api_tokens`. (3) `TestHiddenNeverMarshals` (`plugins/golem15/fonoteka/classes/hidden_marshal_test.go`) pins `expectedUserModels = 5`; the user plugin now registers six models (`FrontendPermission` is new). With the constant at 6 (checked through a `go test -overlay` copy, nothing written to the repository) the test passes, so the marshalling checks themselves hold for the new model and the new `User` fields.
+  **Already known, same run:** `TestSchemaMatchesPHPSnapshot` reports the new table `golem15_user_frontend_permissions` until plan 04 adds its allow-list entry (stated in the 12.1-03 plan).
+  **Why not fixed here:** all of them are fixed lists or counts in the application repository (fonoteka.go). Plan 12.1-03 commits only inside the plugin checkout.
+  **Effect on plan 12.1-03's own verify:** the command `go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestAdmin|TestPhase09|TestPhase10|TestPhase12Threats)'` cannot be green before plan 04: it matches `TestAdminMetadataFiltering` and the two tests of the entry above. Every other test that pattern selects passes.
+  **Suggested owner:** plan 12.1-04, together with the entry above.
+
+- Thirteen framework Go files outside Phase 12.1 name a consuming application
+  status: open
+  **Found:** plan 12.1-05 Task 3, 2026-10-05, when the hygiene stage of `scripts/check-phase12.1.sh` was first pointed at the whole `modules` tree.
+  **What:** `grep -rlniE` for the two application names over `modules --include=*.go` lists 13 files, all tests or comments of older modules (for example `modules/tide/capture_test.go` and `modules/wristband/authorize_test.go`). None was added or changed by Phase 12.1.
+  **Why not fixed here:** out of this phase's scope: the hygiene stage covers the files Phase 12.1 added or changed, the root README, every module README, `docs`, `admin/src` and `admin/tests`, and those are clean. Renaming fixtures in other modules' tests belongs to those modules.
+  **Suggested owner:** a quick task, or the next phase that touches each module.

.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-01-PLAN.md

@@ -0,0 +1,341 @@
+---
+phase: 14.1-oauth-identities-and-fonoteka-me-routes
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - ../fonoteka.go/plugins/golem15/user/models/oauth_identity.go
+  - ../fonoteka.go/plugins/golem15/user/updates/202610050001_create_oauth_identities.go
+  - ../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go
+  - ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go
+  - ../fonoteka.go/plugins/golem15/user/lang/en/lang.yaml
+  - ../fonoteka.go/plugins/golem15/user/lang/pl/lang.yaml
+  - ../fonoteka.go/plugins/golem15/user/README.md
+  - ../fonoteka.go/plugins/golem15/fonoteka/routes.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go
+  - ../fonoteka.go/parity/manifest.yaml
+  - ../fonoteka.go/parity/parity_test.go
+  - ../fonoteka.go/parity/fonoteka_seed_test.go
+  - ../fonoteka.go/parity/fonoteka_reset.php
+  - ../fonoteka.go/parity/fixtures/routes/
+autonomous: false
+requirements: [API-09, HTTP-01, HTTP-03, HTTP-04, HTTP-06, DATA-02, DATA-07, I18N-01]
+estimate:
+  tokens: 320000
+  raw_tokens: 320000
+  tasks: 4
+  confidence: low  # uncalibrated (sample_count 0); locked 2-plan lean split — do not split
+must_haves:
+  truths:
+    - "Per D-02, a JWT caller can GET `/_fonoteka/api/v1/oauth-identities` and receive `{\"data\":[]}` when they have no rows, and `{\"data\":[{\"provider\",\"linked_at\"},...]}` ordered by provider when they have rows, with `linked_at` as Carbon `+00:00` or JSON null (HTTP-06)."
+    - "Per D-04, D-06 and HTTP-01, DELETE `/_fonoteka/api/v1/oauth-identities/{provider}` answers 204 empty when another identity remains, Winter HTML 404 (same bytes) for an unknown provider, a missing row and a foreign row, and 409 `{\"error\": <golem15.user::lang.oauth.last_method_blocked>}` when the caller has exactly one identity, even if the account also has a password."
+    - "Per D-09 and HTTP-06, GET `/api/v1/fonoteka/me` emits `collection_ids` as JSON null when the token has no collection binding and as a list of ints otherwise; `scopes` still falls back to `[]`."
+    - "Per D-10 and D-12, the three manifest entries are `ported`, extras seed alice facebook+google identities (with token and profile values) and a second unrestricted alice token, and `expectedPortedRoutes` is 175."
+    - "Per D-01/D-07 and DATA-02, `golem15_user_oauth_identities` exists via gormigrate in sm-user-plugin with both unique indexes, cascade FK, jsonb `profile_data`, and `lagoon.Encrypted` token columns (DATA-07)."
+  artifacts:
+    - path: "../fonoteka.go/plugins/golem15/user/models/oauth_identity.go"
+      provides: "OAuthIdentity, TableName, Hidden, init Register"
+      contains: "golem15_user_oauth_identities"
+    - path: "../fonoteka.go/plugins/golem15/user/updates/202610050001_create_oauth_identities.go"
+      provides: "gormigrate ID 202610050001_create_oauth_identities"
+      contains: "oauth_identities_user_provider_unique"
+    - path: "../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go"
+      provides: "OAuthIdentitiesOptions, OAuthIdentitiesIndex, OAuthIdentitiesDestroy"
+      contains: "func OAuthIdentitiesIndex("
+    - path: "../fonoteka.go/plugins/golem15/user/lang/en/lang.yaml"
+      provides: "golem15.user::lang.oauth.last_method_blocked EN"
+      contains: "last_method_blocked:"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/routes.go"
+      provides: "JWT mount of GET and DELETE oauth-identities"
+      contains: "OAuthIdentitiesIndex"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go"
+      provides: "D-09 collection_ids JSON null"
+      contains: "collection_ids"
+  key_links:
+    - from: "../fonoteka.go/plugins/golem15/fonoteka/routes.go"
+      to: "../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go"
+      via: "host JWT group calls OAuthIdentitiesIndex and OAuthIdentitiesDestroy; WriteNotFound is api.WriteWinterHTTPError"
+      pattern: "OAuthIdentitiesDestroy"
+    - from: "../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go"
+      to: "../fonoteka.go/plugins/golem15/user/models/oauth_identity.go"
+      via: "Index/Destroy query golem15_user_oauth_identities by caller user_id"
+      pattern: "OAuthIdentity"
+    - from: "../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go"
+      to: "../fonoteka.go/plugins/golem15/fonoteka/models"
+      via: "MeToken reads bouncer.Credential as *models.ApiToken CollectionIDs"
+      pattern: "CollectionIDs"
+  prohibitions:
+    - requirement_id: HTTP-01
+      category: safety
+      statement: "The DELETE provider check lives in the Destroy handler allow-list; the JWT group registration leaves {provider} unconstrained so Winter HTML 404 is reachable for unknown, missing and foreign providers"
+      status: resolved
+      verification: test
+    - requirement_id: DATA-07
+      category: privacy
+      statement: "List and unlink responses are an explicit two-key map (provider, linked_at); Encrypted token columns and profile_data never appear as JSON keys"
+      status: resolved
+      verification: test
+    - requirement_id: HTTP-03
+      category: safety
+      statement: "Identity constructors are exported for the host; sm-user-plugin routes.go stays the /_user/api/v1 group only, and /api/v1/fonoteka never gains identity paths"
+      status: resolved
+      verification: test
+    - requirement_id: HTTP-01
+      category: safety
+      statement: "Unlink fail-closed uses identity count for this user_id only; the user password flag is unused"
+      status: resolved
+      verification: test
+    - requirement_id: DATA-02
+      category: safety
+      statement: "The table is created by gormigrate tx.Exec DDL in sm-user-plugin updates/; GORM schema sync is not the source"
+      status: resolved
+      verification: test
+---
+
+## Phase Goal
+
+**As a** signed-in Nuxt user (and as a fonoteka-mcp token caller), **I want to** list and unlink connected OAuth identities and receive the full personal-token `/me` body, **so that** Settings → Connected accounts and MCP bootstrap work against Go with zero pending routes.
+
+ROADMAP Phase 14.1 goal (source): The three manifest routes no phase owned (14-CONTEXT D-09) are ported and pass the parity diff, so that no route is left pending before cutover.
+
+This plan's slice: the production path — model, migration, exported Index/Destroy, JWT mount, `/me` null fix, PHP extras/recording and the manifest flip. Full unit coverage is plan 02.
+
+<objective>
+Ship the OAuth-identity table and host-mounted JWT list/unlink handlers in sm-user-plugin, close the D-09 `/me` `collection_ids` gap, and flip the three pending manifest routes to ported with recorded PHP extras.
+
+Purpose: Nuxt Connected accounts and fonoteka-mcp `me()` need PHP bytes before Phase 15. Decisions: D-01 through D-12 (D-08 and D-13 are out of this phase).
+Output: sm-user-plugin model/migration/handlers/lang/README; fonoteka JWT mount and MeToken fix; parity extras, recordings, counts.
+Repos: fonoteka.go and the sm-user-plugin submodule at `plugins/golem15/user`. Do not change summercms.go framework modules. Commits are path-scoped (plugin submodule, then app); never add co-author tags. Planning docs stay out of code commits.
+</objective>
+
+<execution_context>
+@~/.codex/gsd-core/workflows/execute-plan.md
+@~/.codex/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/STATE.md
+@.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-CONTEXT.md
+@.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-RESEARCH.md
+@.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-PATTERNS.md
+@../fonoteka.go/plugins/golem15/user/models/api_token.go
+@../fonoteka.go/plugins/golem15/user/updates/202610040001_create_api_tokens.go
+@../fonoteka.go/plugins/golem15/user/controllers/api_tokens.go
+@../fonoteka.go/plugins/golem15/fonoteka/routes.go
+@../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go
+@../fonoteka.go/plugins/golem15/fonoteka/controllers/api/http_errors.go
+@../fonoteka.go/parity/parity_test.go
+
+<interfaces>
+- sm-user-plugin: `plugin.go` already returns `updates.All()` / `models.All()` — new files `init` Register only. `routes.go` lines 9-30 are `/_user/api/v1` and stay that way (D-02). `controllers.writeJSON` (`api_controller.go:1025`) sets `Cache-Control: no-cache, private` then `wire.WriteJSON`. `writeWinterErrorPage` always writes 500 — not a 404 analog. `sessionApp` / `insertUser` live in `session_test.go`. Import path `git.golem15.com/golem15/sm-user-plugin/controllers`.
+- OAuthIdentitiesOptions (discretion, RESEARCH): `Providers []string` (default google, facebook, github when nil/empty), `WriteNotFound func(http.ResponseWriter, *http.Request)` injected by the host.
+- Fonoteka JWT group (`routes.go:48`): `surf.Use("jwt.auth", "locale.from-principal", "inv.must-change-password")`. Inline throttle string already used: `"throttle:10,1"` on CSV import and collection switch. Personal-token group (`routes.go:262-265`) already serves `GET /me` with `inv.scope:read`.
+- Winter 404: `api.WriteWinterHTTPError(w, app, http.StatusNotFound)` (`http_errors.go:44-72`), `text/html; charset=UTF-8`, Polish title from `winter_404.html`.
+- `wire.Time` layout `2006-01-02T15:04:05` + `+00:00`. `wire.Slice` stays on GET `data` and on `/me` `scopes` only.
+- Parity: `expectedPHPRoutes = 175`, `expectedPortedRoutes = 172`; `assertPortedMismatch` currently probes `GET /_fonoteka/api/v1/oauth-identities jwt` and fatals `unported PHP route must not pass`. Replacement analog: `assertPortedMutationCaught` + `mutateAlbumCount`. Manifest pending blocks at `manifest.yaml` ~2801 and ~3406. `fonotekaCaseExtras` keys are `"<route id>#<case id>"`.
+- PHP 409 EN/PL (byte-identical): EN `This is the only remaining way to sign in. Link another method before disconnecting this one.` PL `To jedyna droga logowania na to konto. Najpierw podłącz inną, zanim odetniesz tę.`
+</interfaces>
+</context>
+
+## Artifacts this phase produces
+
+- `models.OAuthIdentity` (`TableName` `golem15_user_oauth_identities`; columns D-07; `lagoon.Encrypted` `access_token`/`refresh_token` with `json:"-"`; `lagoon.Jsonable[map[string]any]` `profile_data`; `Hidden` those three secrets).
+- gormigrate `202610050001_create_oauth_identities` (unique `oauth_identities_user_provider_unique` on `(user_id, provider)`, unique `oauth_identities_provider_identity_unique` on `(provider, provider_id)`, FK `user_id` → `users(id)` ON DELETE CASCADE, `profile_data jsonb`).
+- `controllers.OAuthIdentitiesOptions`, `OAuthIdentitiesIndex(*backpack.App) http.HandlerFunc`, `OAuthIdentitiesDestroy(*backpack.App, OAuthIdentitiesOptions) http.HandlerFunc`.
+- Phrase `golem15.user::lang.oauth.last_method_blocked` in `lang/en/lang.yaml` and `lang/pl/lang.yaml`.
+- Host JWT mount: GET `/oauth-identities`, DELETE `/oauth-identities/{provider}` with `"throttle:10,1"` and `WriteNotFound` → `api.WriteWinterHTTPError`.
+- MeToken D-09: `collection_ids` JSON null when `!Valid` or empty.
+- Parity extras `oauth-identities-linked` and `me-unrestricted`; new recorded cases; three routes `ported`; `expectedPortedRoutes = 175`; rewritten `assertPortedMismatch`.
+- sm-user-plugin README: table row, exported-constructor subsection (host-chosen path; no consuming-application name), models list `OAuthIdentity`.
+- Smoke: `TestOAuthIdentitiesIndexEmptyList` and `TestOAuthIdentitiesDestroyNoContentKeepsSibling` (plan 02 expands the full D-11 matrix).
+
+## Assumptions
+
+- Assumption-delta: adding identities beside password is a second sign-in method, but D-06 already fail-closes unlink on identity count and D-13 already deferred social-login-only lockout to the Phase 15 preflight. This plan does not reopen those.
+- D-08 Winter-import mapper and social-login redirect/callback stay deferred.
+- Unauthenticated unknown provider is 401 in Go (`jwt.auth` first); D-11 401 tests use `/google` (research A1). Not a recorded parity case.
+- `profile_data` is SQL `jsonb` per D-07 even though `Jsonable.GormDataType` is `text` (research A2).
+- No new Go modules. Discretion: constructors + host mount, not a `Mount` helper (that helper would import fonoteka's `api` package into the user plugin).
+- Token estimates are uncalibrated (sample_count 0, confidence low) under the locked 2-plan lean split; do not split this phase.
+
+<tasks>
+
+<task type="checkpoint:decision" gate="blocking-human">
+  <name>Task 1: Confirm the one-way golem15_user_oauth_identities table in sm-user-plugin</name>
+  <decision>Create table `golem15_user_oauth_identities` in the shared sm-user-plugin with the full PHP column set (D-01, D-07). This migration is the schema source for every app that uses the plugin and is the Phase 15 import target.</decision>
+  <context>One-way door: once this gormigrate ships in the shared plugin, renaming the table, dropping Encrypted token columns, or moving the table into the application plugin requires a data migration for every consumer and a rewritten Phase 15 import. CONTEXT.md already chose sm-user-plugin plus the full PHP columns (id, user_id cascade FK, provider 50, provider_id 255, Encrypted access_token and refresh_token, token_expires_at, jsonb profile_data, linked_at, timestamps, both unique indexes). The PHP users.oauth_* backfill is not ported. Undo cost after ship: a new plugin migration and a Phase 15 mapper rewrite.</context>
+  <options>
+    <option id="ship-shared-full">
+      <name>Ship the full PHP column set in sm-user-plugin (locked D-01 and D-07)</name>
+      <pros>Matches Golem15.User v3.3.0; Phase 15 can import rows into this table; other apps share one contract.</pros>
+      <cons>The table name, indexes and Encrypted columns become a shared-plugin contract immediately.</cons>
+    </option>
+    <option id="app-local">
+      <name>Create the table only in the fonoteka plugin</name>
+      <pros>The shared plugin stays unchanged.</pros>
+      <cons>Contradicts D-01; PHP ownership is Golem15.User; other apps would fork the schema.</cons>
+    </option>
+    <option id="hold">
+      <name>Do not migrate in this phase</name>
+      <pros>More time to review columns.</pros>
+      <cons>The tracer cannot list identities; Phase 14.1 cannot flip the three pending routes.</cons>
+    </option>
+  </options>
+  <read_first>.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-CONTEXT.md (D-01, D-07), .planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-RESEARCH.md (Pattern 6, Runtime State Inventory), /media/nvme/dev/golem15/fonoteka/plugins/golem15/user/updates/v3.3.0/create_oauth_identities_table.php</read_first>
+  <acceptance_criteria>
+    - The user answered with one of the option ids; the answer is recorded in the plan summary.
+    - Work on Task 2 starts only after `ship-shared-full`. With `app-local` or `hold`, this plan stops and the contradiction with D-01/D-07 is recorded.
+  </acceptance_criteria>
+  <resume-signal>Answer ship-shared-full, app-local, or hold.</resume-signal>
+</task>
+
+<task type="tracer">
+  <name>Task 2: End-to-end GET empty list — {"data":[]} through model, migration, Index, and the JWT mount</name>
+  <reversibility rating="one-way">The gormigrate in sm-user-plugin becomes the shared-plugin schema and the Phase 15 import target; changing the table later needs another migration for every consumer.</reversibility>
+  <precondition>Task 1 answered ship-shared-full. Docker can start the user-plugin testcontainers Postgres used by sessionApp (TestMain fails closed when the container cannot start; -short is not a pass for this tracer).</precondition>
+  <files>../fonoteka.go/plugins/golem15/user/models/oauth_identity.go, ../fonoteka.go/plugins/golem15/user/updates/202610050001_create_oauth_identities.go, ../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go, ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go, ../fonoteka.go/plugins/golem15/fonoteka/routes.go, ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go</files>
+  <read_first>../fonoteka.go/plugins/golem15/user/models/api_token.go (struct, TableName, init Register, Hidden), ../fonoteka.go/plugins/golem15/fonoteka/models/user_discogs_credential.go (Encrypted json:"-"), ../fonoteka.go/plugins/golem15/user/updates/202610040001_create_api_tokens.go, ../fonoteka.go/plugins/golem15/user/updates/202610040003_create_frontend_permissions.go (named unique indexes via execStmts), ../fonoteka.go/plugins/golem15/user/controllers/api_tokens.go (APITokenIndex owner-scoped Find, explicit map, writeJSON), ../fonoteka.go/plugins/golem15/user/session_test.go (sessionApp, insertUser), ../fonoteka.go/plugins/golem15/user/plugin.go (Migrations/Models already All()), ../fonoteka.go/plugins/golem15/user/routes.go (leave unchanged), ../fonoteka.go/plugins/golem15/fonoteka/routes.go (JWT group line 48), ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go (assertAbsent oauth-identit ~663-666, assertRouteSurfaces ~1017), /media/nvme/dev/golem15/fonoteka/plugins/golem15/user/updates/v3.3.0/create_oauth_identities_table.php, .planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-PATTERNS.md (OAuthIdentity and Index analogs)</read_first>
+  <action>Per D-01, D-02, D-05, D-07, DATA-02, DATA-07, HTTP-03, HTTP-06. One production path: JWT GET empty list.
+
+(1) models/oauth_identity.go: type `OAuthIdentity` with `id`, `user_id`, `provider`, `provider_id`, `access_token` and `refresh_token` as `lagoon.Encrypted` tagged `json:"-"`, `token_expires_at *time.Time`, `profile_data lagoon.Jsonable[map[string]any]`, `linked_at *time.Time`, timestamps. `TableName()` returns `golem15_user_oauth_identities`. `Hidden()` lists `access_token`, `refresh_token`, `profile_data`. `Fillable()` returns an empty slice (PHP `$guarded = ['*']`; tests assign struct fields). `init() { Register(OAuthIdentity{}) }`. Do not edit plugin.go.
+
+(2) updates/202610050001_create_oauth_identities.go: gormigrate ID `202610050001_create_oauth_identities`, `init() { Register(...) }`. Migrate via `tx.Exec` / `execStmts`: CREATE TABLE with SERIAL PK, `user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE`, `provider VARCHAR(50) NOT NULL`, `provider_id VARCHAR(255) NOT NULL`, token columns TEXT NULL, `token_expires_at TIMESTAMPTZ NULL`, `profile_data jsonb NULL`, `linked_at TIMESTAMPTZ NULL`, timestamps TIMESTAMPTZ NOT NULL DEFAULT NOW(), unique index `oauth_identities_user_provider_unique` on `(user_id, provider)`, unique index `oauth_identities_provider_identity_unique` on `(provider, provider_id)`. Rollback DROP TABLE IF EXISTS. No users.oauth_* backfill (D-07).
+
+(3) controllers/oauth_identities.go: type `OAuthIdentitiesOptions` with `Providers []string` and `WriteNotFound func(http.ResponseWriter, *http.Request)`. `OAuthIdentitiesIndex(app *backpack.App) http.HandlerFunc` reads `bouncer.User`, loads rows `Where("user_id = ?", user.ID).Order("provider")`, builds `[]map[string]any` each with keys `provider` (string) and `linked_at` (`*wire.Time` UTC or nil), writes `writeJSON` 200 `map[string]any{"data": wire.Slice(rows)}`. Principal missing is fail-closed 401 via the existing helper, matching APITokenIndex. Index does not marshal the GORM struct.
+
+(4) Host mount, D-02: in the JWT group in fonoteka `routes.go`, import `git.golem15.com/golem15/sm-user-plugin/controllers` as `userctrl` and `g.Get("/oauth-identities", userctrl.OAuthIdentitiesIndex(p.app))`. Leave `plugins/golem15/user/routes.go` byte-identical. Leave the personal-token group without this path.
+
+(5) phase08_coverage_test.go: in `test_oauth_identity_routes_exist_on_jwt_surface_only`, replace the deferred-absent probe with `assertRouteSurfaces(t, rt, http.MethodGet, "/oauth-identities", true, false)` so the assembled router accepts the GET mount (Pitfall 6). DELETE surfaces wait for Task 3.
+
+(6) Smoke `TestOAuthIdentitiesIndexEmptyList` in plugin-root `oauth_identities_test.go` (package `user`): `sessionApp`, `insertUser`, `bouncer.WithUser`, `controllers.OAuthIdentitiesIndex(app).ServeHTTP` on GET `/_fonoteka/api/v1/oauth-identities`, status 200, body `{"data":[]}` (no other top-level keys), `Cache-Control` contains `no-cache`. Full D-11 matrix is plan 02.
+  </action>
+  <verify>
+    <automated>go -C ../fonoteka.go vet ./plugins/golem15/user/... ./plugins/golem15/fonoteka/... &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/user -count=1 -v -run '^(TestOAuthIdentitiesIndexEmptyList)$' &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/fonoteka -count=1 -v -run 'TestOAuthTokenSurfaceIsolationCoverage/test_oauth_identity_routes_exist_on_jwt_surface_only'</automated>
+    <fails_when>Any command exits non-zero; the verbose user-plugin run prints "--- FAIL", "no tests to run" or "--- SKIP", or lacks "--- PASS: TestOAuthIdentitiesIndexEmptyList"; the verbose fonoteka run prints "--- FAIL", "no tests to run" or "--- SKIP", or lacks "--- PASS: TestOAuthTokenSurfaceIsolationCoverage/test_oauth_identity_routes_exist_on_jwt_surface_only".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'func (OAuthIdentity) TableName()' ../fonoteka.go/plugins/golem15/user/models/oauth_identity.go` prints at least 1 and `grep -c 'golem15_user_oauth_identities' ../fonoteka.go/plugins/golem15/user/models/oauth_identity.go` prints at least 1.
+    - `grep -c '202610050001_create_oauth_identities' ../fonoteka.go/plugins/golem15/user/updates/202610050001_create_oauth_identities.go` prints at least 1 and `grep -c 'oauth_identities_user_provider_unique' ../fonoteka.go/plugins/golem15/user/updates/202610050001_create_oauth_identities.go` prints at least 1.
+    - `grep -c 'AutoMigrate' ../fonoteka.go/plugins/golem15/user/updates/202610050001_create_oauth_identities.go` prints 0.
+    - `grep -c 'func OAuthIdentitiesIndex(' ../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go` prints at least 1.
+    - `grep -c 'OAuthIdentitiesIndex' ../fonoteka.go/plugins/golem15/fonoteka/routes.go` prints at least 1.
+    - `git -C ../fonoteka.go/plugins/golem15/user diff -- routes.go` prints nothing.
+    - `grep -c 'TestOAuthIdentitiesIndexEmptyList' ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go` prints at least 1.
+  </acceptance_criteria>
+  <done>A signed-in user with no linked identities receives `{"data":[]}` from the JWT GET, proving model, migration, explicit map, and host mount together.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Unlink one identity — 204, Winter HTML 404, 409 last-method, throttle:10,1</name>
+  <files>../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go, ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go, ../fonoteka.go/plugins/golem15/user/lang/en/lang.yaml, ../fonoteka.go/plugins/golem15/user/lang/pl/lang.yaml, ../fonoteka.go/plugins/golem15/fonoteka/routes.go, ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go</files>
+  <read_first>../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go (Task 2 Index), ../fonoteka.go/plugins/golem15/user/controllers/api_tokens.go (owner-scoped Destroy First), ../fonoteka.go/plugins/golem15/user/controllers/api_controller.go (writeJSON, appTranslator, accountMessage phrasebook Get), ../fonoteka.go/plugins/golem15/user/lang/en/lang.yaml, ../fonoteka.go/plugins/golem15/user/lang/pl/lang.yaml, ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/http_errors.go (WriteWinterHTTPError), ../fonoteka.go/plugins/golem15/fonoteka/routes.go (JWT group, throttle:10,1 on CSV/switch, request_id Where loosening ~238-254), ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go (assertRouteSurfaces), /media/nvme/dev/golem15/fonoteka/plugins/golem15/fonoteka/controllers/api/OAuthIdentityApiController.php (destroy), .planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-RESEARCH.md (Patterns 3-4, Pitfalls 1-2)</read_first>
+  <action>Per D-02, D-03, D-04, D-06, HTTP-01, HTTP-04, I18N-01.
+
+(1) Lang: sibling `oauth:` group (not under `account:`) in both locale files. EN last_method_blocked text is exactly `This is the only remaining way to sign in. Link another method before disconnecting this one.` PL text is exactly `To jedyna droga logowania na to konto. Najpierw podłącz inną, zanim odetniesz tę.` Handler key `golem15.user::lang.oauth.last_method_blocked`.
+
+(2) `OAuthIdentitiesDestroy(app, opts)`: provider is `r.PathValue("provider")`. If `opts.Providers` is nil or empty, the allow-list is google, facebook, github (D-04; host may pass a narrower or wider slice). A provider outside the list, a missing row for `(user_id, provider)`, and a foreign row all call `opts.WriteNotFound` (same function, so bodies match). If WriteNotFound is nil, write the existing opaque 500 helper rather than Go's default 404 page. Count identities for this `user_id` only; when count is 1, `writeJSON` 409 `{"error": tr.Get(ctx, "golem15.user::lang.oauth.last_method_blocked", nil)}`. Otherwise delete and `w.WriteHeader(http.StatusNoContent)` with empty body (PHP `noContent()`). Do not copy APITokenDestroy's 200 JSON. Password flags on the user row are unused (D-06).
+
+(3) JWT group: `g.Delete("/oauth-identities/{provider}", userctrl.OAuthIdentitiesDestroy(p.app, userctrl.OAuthIdentitiesOptions{WriteNotFound: func(w http.ResponseWriter, r *http.Request) { api.WriteWinterHTTPError(w, p.app, http.StatusNotFound) }}), "throttle:10,1")`. Leave the path value unconstrained so the handler 404 is reachable (Pitfall 1; oauth request_id precedent). Personal-token group unchanged.
+
+(4) phase08: `assertRouteSurfaces(t, rt, http.MethodDelete, "/oauth-identities/{provider}", true, false)` in the same oauth-identity subtest. Assert the DELETE route's middleware list contains `throttle:10,1` (CSV import is the analog).
+
+(5) Smoke `TestOAuthIdentitiesDestroyNoContentKeepsSibling` in plugin-root `oauth_identities_test.go` (package `user`): `sessionApp`, `insertUser`, insert two `OAuthIdentity` rows for that user (`facebook` and `google`), `bouncer.WithUser`, `OAuthIdentitiesDestroy(app, OAuthIdentitiesOptions{WriteNotFound: stub that fatals if called})` on DELETE `/_fonoteka/api/v1/oauth-identities/facebook`. Assert `http.StatusNoContent` (204), empty body, and the google row still exists for that `user_id`. Status 200 with a JSON body fails this test. Full D-11 matrix (Winter HTML 404, 409 last-method, 401) stays in plan 02.
+  </action>
+  <verify>
+    <automated>go -C ../fonoteka.go vet ./plugins/golem15/user/... ./plugins/golem15/fonoteka/... &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/user -count=1 -v -run '^(TestOAuthIdentitiesDestroyNoContentKeepsSibling)$' &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/fonoteka -count=1 -v -run 'TestOAuthTokenSurfaceIsolationCoverage/test_oauth_identity_routes_exist_on_jwt_surface_only'</automated>
+    <fails_when>Non-zero exit; the verbose user-plugin run prints "--- FAIL", "no tests to run" or "--- SKIP", or lacks "--- PASS: TestOAuthIdentitiesDestroyNoContentKeepsSibling"; status 200 JSON would fail that test; the verbose fonoteka run prints "--- FAIL", "no tests to run" or "--- SKIP", or lacks "--- PASS: TestOAuthTokenSurfaceIsolationCoverage/test_oauth_identity_routes_exist_on_jwt_surface_only".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'func OAuthIdentitiesDestroy(' ../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go` prints at least 1.
+    - `grep -c 'HasSelfSetPassword' ../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go` prints 0.
+    - `grep -c 'last_method_blocked:' ../fonoteka.go/plugins/golem15/user/lang/en/lang.yaml` prints at least 1 and `grep -c 'last_method_blocked:' ../fonoteka.go/plugins/golem15/user/lang/pl/lang.yaml` prints at least 1.
+    - `grep -F 'throttle:10,1' ../fonoteka.go/plugins/golem15/fonoteka/routes.go | grep -c 'oauth-identities/{provider}'` prints at least 1.
+    - `grep -c 'Where("provider"' ../fonoteka.go/plugins/golem15/fonoteka/routes.go` prints 0.
+    - `grep -c 'OAuthIdentitiesDestroy' ../fonoteka.go/plugins/golem15/fonoteka/routes.go` prints at least 1.
+    - `grep -c 'WriteWinterHTTPError' ../fonoteka.go/plugins/golem15/fonoteka/routes.go` prints at least 1.
+    - `git -C ../fonoteka.go/plugins/golem15/user diff -- routes.go` prints nothing.
+    - `grep -c 'TestOAuthIdentitiesDestroyNoContentKeepsSibling' ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go` prints at least 1.
+    - `grep -c 'StatusNoContent' ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go` prints at least 1.
+  </acceptance_criteria>
+  <done>A JWT caller can unlink a non-last identity (204), is blocked on the last one (409 localized error), and sees Winter HTML 404 for unknown/missing/foreign providers, with DELETE rate-limited 10/1.</done>
+</task>
+
+<task type="auto">
+  <name>Task 4: Close /me collection_ids null, record D-10 extras, flip three routes to ported, document the exported API</name>
+  <files>../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go, ../fonoteka.go/parity/manifest.yaml, ../fonoteka.go/parity/parity_test.go, ../fonoteka.go/parity/fonoteka_seed_test.go, ../fonoteka.go/parity/fonoteka_reset.php, ../fonoteka.go/parity/fixtures/routes/, ../fonoteka.go/plugins/golem15/user/README.md</files>
+  <read_first>../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go (lines 18-46; D-09 supersedes the never-null comment for collection_ids only), ../fonoteka.go/parity/parity_test.go (expectedPortedRoutes, assertPortedMismatch ~456-501, assertPortedMutationCaught ~503-529), ../fonoteka.go/parity/fonoteka_seed_test.go (fonotekaCaseExtras), ../fonoteka.go/parity/fonoteka_reset.php ($extras ~119-145), ../fonoteka.go/parity/manifest.yaml (pending blocks ~2801-2836 and ~3406), ../fonoteka.go/parity/README.md (php_parity.sh reset/serve, summer parity:record --manifest), ../fonoteka.go/plugins/golem15/user/README.md (Overview table list ~15, API reference ~81-104, migrations ~128, models ~149), /media/nvme/dev/golem15/fonoteka/plugins/golem15/fonoteka/models/ApiToken.php (collectionIds), .planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-RESEARCH.md (Pattern 5, Pitfalls 3/5/8/9)</read_first>
+  <action>Per D-09, D-10, D-12, HTTP-06, API-09. I18N-01 keys already landed in Task 3; this task documents them.
+
+(1) MeToken: keep `scopes` as `wire.Slice`. For `collection_ids`, when the matched `*models.ApiToken` has invalid or empty `CollectionIDs` emit JSON null (D-09); otherwise emit the int list. Keep reading `bouncer.User` and `bouncer.Credential` from context. Rewrite the comment that currently says both arrays never serialize as null so it names `scopes` only.
+
+(2) Seed extras on both sides with the same names. Extra `oauth-identities-linked`: alice rows for `facebook` and `google` (order-by-provider coverage) with non-empty Encrypted tokens and profile_data so the GET fixture proves secrets stay off the wire. Extra `me-unrestricted`: a second alice personal token whose `collection_ids` is SQL NULL/empty; do not change the existing `mcp-read` restricted token. Map extras in `fonotekaCaseExtras` as `"&lt;route id&gt;#&lt;case id&gt;"` and in `fonoteka_reset.php` `$extras`. Leave empty GET, missing DELETE, and restricted `/me` on the plain reset (no extra).
+
+(3) Record PHP for the two new cases via isolated `parity/php_parity.sh reset` + `serve` and `summer parity:record --manifest parity/manifest.yaml --fixtures parity/fixtures --target http://127.0.0.1:8423 --vars &lt;0600 vars&gt;` (README recording flow). New GET list-with-rows case on `GET /_fonoteka/api/v1/oauth-identities jwt`; new unrestricted `/me` case on `GET /api/v1/fonoteka/me personal_token` whose body includes `"collection_ids": null`. Do not hand-author response bytes. Existing fixtures stay.
+
+(4) Flip all three route entries from `status: pending` to `ported`. Set `expectedPortedRoutes = 175` (keep `expectedPHPRoutes = 175`). Rewrite `assertPortedMismatch` to wrap a ported fixture with a status-mutating handler and require `tide.MismatchError`, following `assertPortedMutationCaught` / `mutateAlbumCount`. After D-12 there is no pending-route probe.
+
+(5) sm-user-plugin README in the same change (CLAUDE.md): add `golem15_user_oauth_identities` to the Overview table list; add an exported host-mounted subsection for `OAuthIdentitiesIndex`, `OAuthIdentitiesDestroy`, `OAuthIdentitiesOptions` (the host chooses the path; say "the host application", never a consuming-application name); add the migration row and `OAuthIdentity` to the models list. Do not add identity paths to the `/_user/api/v1` handler table.
+  </action>
+  <verify>
+    <automated>go -C ../fonoteka.go vet ./plugins/golem15/user/... ./plugins/golem15/fonoteka/... ./parity/... &amp;&amp; go -C ../fonoteka.go test ./parity -count=1 -run 'TestParityCorpus' -timeout 30m</automated>
+    <fails_when>Non-zero exit; corpus summary is not `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`, or it prints `pending 3` / `passing 172`.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'wire.Slice(collectionIDs)' ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go` prints 0.
+    - `grep -c 'golem15_user_oauth_identities' ../fonoteka.go/plugins/golem15/user/README.md` prints at least 1 and `grep -c 'OAuthIdentitiesIndex' ../fonoteka.go/plugins/golem15/user/README.md` prints at least 1.
+    - `grep -nE 'expectedPortedRoutes = 175' ../fonoteka.go/parity/parity_test.go` prints a matching line (non-empty).
+    - `grep -c 'unported PHP route must not pass' ../fonoteka.go/parity/parity_test.go` prints 0.
+    - `grep -c 'oauth-identities-linked' ../fonoteka.go/parity/fonoteka_seed_test.go` prints at least 1 and `grep -c 'oauth-identities-linked' ../fonoteka.go/parity/fonoteka_reset.php` prints at least 1.
+    - `grep -c 'me-unrestricted' ../fonoteka.go/parity/fonoteka_seed_test.go` prints at least 1 and `grep -c 'me-unrestricted' ../fonoteka.go/parity/fonoteka_reset.php` prints at least 1.
+    - Three manifest route ids (`GET /_fonoteka/api/v1/oauth-identities jwt`, `DELETE /_fonoteka/api/v1/oauth-identities/{provider} jwt`, `GET /api/v1/fonoteka/me personal_token`) have `status: ported` and none of those blocks still say `status: pending`.
+  </acceptance_criteria>
+  <done>Unrestricted `/me` emits JSON null collection_ids, D-10 PHP extras are recorded, all three routes are ported at 175/175/0, and the shared plugin README names the exported constructors.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| JWT client → `/_fonoteka/api/v1/oauth-identities` | Untrusted Bearer and `{provider}` path; responses must not leak Encrypted tokens or profile_data |
+| Personal-token client → `/api/v1/fonoteka/me` | Already-matched `inv_` credential; collection binding is authorization data |
+| Host plugin → sm-user-plugin constructors | Host injects Winter 404 writer; user plugin must not import the application `api` package |
+| Postgres `golem15_user_oauth_identities` | At-rest Encrypted tokens; cascade delete with users |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.1-01 | Information Disclosure | OAuthIdentitiesIndex | high | mitigate | Explicit `{provider, linked_at}` map; Encrypted columns `json:"-"` and Hidden; D-10 fixture seeds secrets that must not appear (plan 02 asserts) |
+| T-14.1-02 | Elevation of Privilege | OAuthIdentitiesDestroy | high | mitigate | Lookup `user_id = caller` AND provider; missing and foreign share Winter 404 (not 403) |
+| T-14.1-03 | Elevation of Privilege | OAuthIdentitiesDestroy last-method | high | mitigate | Count identities for this user_id; refuse with 409 when count is 1; password flags unused (D-06) |
+| T-14.1-04 | Tampering | OAuthIdentity Fillable | medium | mitigate | Empty Fillable; no `lagoon.Fill` on this model; tests assign fields explicitly |
+| T-14.1-05 | Information Disclosure | Destroy provider allow-list | medium | mitigate | Unknown provider uses the same WriteNotFound as a missing row |
+| T-14.1-06 | Elevation of Privilege | fonoteka routes.go | high | mitigate | Mount on JWT group only; personal-token group unchanged; user plugin `/_user` group unchanged |
+| T-14.1-07 | Denial of Service | DELETE registration | medium | mitigate | `"throttle:10,1"` on DELETE only |
+| T-14.1-08 | Tampering | Encrypted columns | medium | mitigate | Seed and tests use `lagoon.NewEncrypted` under the app key; Laravel ciphertext is not imported (D-08, Phase 15) |
+| T-14.1-SC | Tampering | package installs | high | mitigate | No new modules; package-legitimacy gate N/A |
+
+ASVS L1: all high threats mitigated; medium threats sit on the JWT/token trust boundary and are mitigated.
+</threat_model>
+
+<verification>
+After Task 4: `go -C ../fonoteka.go vet ./plugins/golem15/user/... ./plugins/golem15/fonoteka/... ./parity/...` and `TestParityCorpus` prints `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`. Framework `go vet ./...` in summercms.go stays green (no module edits).
+</verification>
+
+<success_criteria>
+- GET empty list is `{"data":[]}`.
+- DELETE is mounted with `throttle:10,1` and unconstrained `{provider}`.
+- `/me` unrestricted `collection_ids` is JSON null.
+- Three manifest routes are ported; `expectedPortedRoutes` is 175.
+- sm-user-plugin README documents the exported constructors without naming a consuming application.
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-01-SUMMARY.md` when done
+</output>

.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-02-PLAN.md

@@ -0,0 +1,241 @@
+---
+phase: 14.1-oauth-identities-and-fonoteka-me-routes
+plan: 02
+type: execute
+wave: 2
+depends_on: ["14.1-01"]
+files_modified:
+  - ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go
+  - ../fonoteka.go/plugins/golem15/user/updates/oauth_identities_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller_test.go
+  - ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go
+  - ../fonoteka.go/parity/parity_test.go
+autonomous: true
+requirements: [API-09, QA-05, HTTP-01, HTTP-03, DATA-02, DATA-07, I18N-01]
+estimate:
+  tokens: 280000
+  raw_tokens: 280000
+  tasks: 3
+  confidence: low  # uncalibrated (sample_count 0); locked 2-plan lean split — do not split
+must_haves:
+  truths:
+    - "Per D-11, Go tests ported from OAuthIdentityApiTest.php prove unlink 204 keeps the other row, last-method 409 EN and PL texts match the user-plugin lang strings, missing/foreign/unknown-provider Winter HTML 404 bodies are byte-identical, and both identity routes return 401 without a JWT on `/google`."
+    - "Per HTTP-03 and PHP TokenSurfaceIsolationTest, identity routes exist on the JWT group only; `/api/v1/fonoteka` never lists them; DELETE middleware includes `throttle:10,1`."
+    - "Per DATA-02, the oauth-identities migration migrates up and rolls back: table, both unique indexes, jsonb `profile_data`, and cascade FK are present after up and absent after down."
+    - "Per D-09, `TestMeTokenHandlerNilScopesAndCollectionIDsSerializeAsEmptyArraysAndNullableName` (renamed as needed) requires `scopes` as `[]` and `collection_ids` as JSON null."
+    - "Per DATA-07 and T-14.1-01, GET list with seeded Encrypted tokens never contains the plaintext, the key names `access_token`/`refresh_token`/`profile_data`, or `[redacted]`."
+    - "Per API-09, QA-05 and D-12, `TestParityCorpus` prints `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`."
+  artifacts:
+    - path: "../fonoteka.go/plugins/golem15/user/oauth_identities_test.go"
+      provides: "D-11 API tests and secret-leak assertions"
+      contains: "TestOAuthIdentities"
+    - path: "../fonoteka.go/plugins/golem15/user/updates/oauth_identities_test.go"
+      provides: "migration up/down"
+      contains: "golem15_user_oauth_identities"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller_test.go"
+      provides: "D-09 nil collection_ids JSON null"
+      contains: "collection_ids"
+    - path: "../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go"
+      provides: "jwt-only identity surfaces"
+      contains: "oauth-identities"
+  key_links:
+    - from: "../fonoteka.go/plugins/golem15/user/oauth_identities_test.go"
+      to: "../fonoteka.go/plugins/golem15/user/controllers/oauth_identities.go"
+      via: "httptest calls OAuthIdentitiesIndex/Destroy constructors with bouncer.WithUser"
+      pattern: "OAuthIdentitiesDestroy"
+    - from: "../fonoteka.go/parity/parity_test.go"
+      to: "../fonoteka.go/parity/manifest.yaml"
+      via: "TestParityCorpus counts 175 recorded and 175 ported"
+      pattern: "expectedPortedRoutes"
+  prohibitions:
+    - requirement_id: HTTP-01
+      category: safety
+      statement: "401 tests use path /google so jwt.auth runs; an unauthenticated unknown provider is not used as the 401 probe"
+      status: resolved
+      verification: test
+    - requirement_id: DATA-07
+      category: privacy
+      statement: "Secret-leak tests fail if the GET body contains plaintext tokens, Encrypted JSON keys, or the redacted literal"
+      status: resolved
+      verification: test
+    - requirement_id: API-09
+      category: transparency
+      statement: "Pending routes MUST NOT count as passing; the corpus gate is 175/175/0"
+      status: resolved
+      verification: test
+---
+
+## Phase Goal
+
+**As a** signed-in Nuxt user (and as a fonoteka-mcp token caller), **I want to** list and unlink connected OAuth identities and receive the full personal-token `/me` body, **so that** Settings → Connected accounts and MCP bootstrap work against Go with zero pending routes.
+
+This plan's slice: the dedicated unit-test plan (CLAUDE.md lean mode). Plan 01 already shipped the production path; this plan makes every D-11 behaviour, migration, `/me` null, threat, and corpus count fail when broken.
+
+<objective>
+Port OAuthIdentityApiTest.php, prove EN/PL 409, byte-identical Winter 404s, unknown provider, 401 on `/google`, jwt-only TokenSurfaceIsolation, migration up/down, rewritten MeToken nil-collection, secret-leak threat tests, and TestParityCorpus 175/175/0.
+
+Purpose: lean-mode last plan; QA-05 / API-09 evidence for `/gsd-verify-work 14.1`.
+Output: tests in sm-user-plugin, fonoteka plugin, and parity. No summercms.go module API changes.
+Repos: fonoteka.go / sm-user-plugin. Never add co-author tags.
+</objective>
+
+<execution_context>
+@~/.codex/gsd-core/workflows/execute-plan.md
+@~/.codex/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-01-PLAN.md
+@.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-RESEARCH.md
+@.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-PATTERNS.md
+@.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-VALIDATION.md
+@../fonoteka.go/plugins/golem15/user/api_tokens_test.go
+@../fonoteka.go/plugins/golem15/user/api_tokens_edge_test.go
+@../fonoteka.go/plugins/golem15/user/updates/api_tokens_test.go
+@../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller_test.go
+@../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go
+@/media/nvme/dev/golem15/fonoteka/plugins/golem15/fonoteka/tests/functional/OAuthIdentityApiTest.php
+@/media/nvme/dev/golem15/fonoteka/plugins/golem15/fonoteka/tests/security/TokenSurfaceIsolationTest.php
+
+<interfaces>
+- Plan 01 exports `OAuthIdentitiesIndex`, `OAuthIdentitiesDestroy`, `OAuthIdentitiesOptions`, `OAuthIdentity`, migration `202610050001_create_oauth_identities`, JWT mount, D-09 MeToken, extras `oauth-identities-linked` / `me-unrestricted`, `expectedPortedRoutes = 175`.
+- Analog tests: `api_tokens_test.go` (httptest + `bouncer.WithUser` + constructor), `api_tokens_edge_test.go` (foreign destroy 404, list isolation), `updates/api_tokens_test.go` (`dedicatedDB`, `gormigrate.New` with `TableName: "summer_migrations_golem15_user"`, `HasTable`/`HasColumn`, `RollbackMigration`).
+- MeToken tests: `meTokenRequest` uses `bouncer.WithUser` + `bouncer.WithCredential`; `TestMeTokenHandlerNilScopesAndCollectionIDsSerializeAsEmptyArraysAndNullableName` currently forbids `"collection_ids":null` (lines 113-117) — D-09 reverses that field only; `scopes` still must not be JSON null. Keep `TestMeTokenHandlerExactFourFieldsWithScopesAndCollectionIDs` and the no-requery test.
+- phase08 `assertRouteSurfaces(method, suffix, wantJWT, wantToken)`; DELETE must list `throttle:10,1`.
+- Winter 404 bytes: recorded DELETE fixture `text/html; charset=UTF-8`, title `Nie znaleziono strony`. Foreign and missing bodies must `bytes.Equal`.
+- 401 without JWT is group `jwt.auth` (`{"error":true,"message":...}` + `Cache-Control: no-cache, private`). Probe path `/google` (research A1).
+</interfaces>
+</context>
+
+## Artifacts this phase produces
+
+(This plan's share.)
+
+- `TestOAuthIdentitiesIndexEmptyList` (from 01) plus D-11: unlink 204 keeps sibling row, 409 EN/PL, missing/foreign/unknown Winter 404, 401 on `/google`, secret-leak, last-method still 409 when the account has a password.
+- `updates/oauth_identities_test.go` migration up/down (skip on `-short` via existing `dedicatedDB`).
+- Rewritten MeToken nil-collection test requiring `"collection_ids":null` and `"scopes":[]`.
+- phase08 jwt-only GET and DELETE plus DELETE `throttle:10,1`.
+- `TestParityCorpus` 175/175/0.
+
+## Assumptions
+
+- Assumption-delta remains closed: D-06/D-13 already answered second-method lockout; tests prove count-only 409, they do not add social login.
+- Plan 01 flipped GET (and DELETE) surfaces and shipped `TestOAuthIdentitiesDestroyNoContentKeepsSibling` (204 + sibling remains); this plan keeps the full D-11 matrix and adds throttle contains-check if Task 3 of 01 left a gap.
+- Token estimates are uncalibrated (sample_count 0, confidence low) under the locked 2-plan lean split; do not split this phase.
+- Do not retarget `scripts/check-phase14.sh` (`EXPECTED_PENDING=3` is a Phase 14 artifact).
+
+<tasks>
+
+<task type="auto">
+  <name>Task 1: Port OAuthIdentityApiTest.php — 204, EN/PL 409, Winter 404s, 401 /google, jwt-only surfaces</name>
+  <files>../fonoteka.go/plugins/golem15/user/oauth_identities_test.go, ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go</files>
+  <read_first>/media/nvme/dev/golem15/fonoteka/plugins/golem15/fonoteka/tests/functional/OAuthIdentityApiTest.php, /media/nvme/dev/golem15/fonoteka/plugins/golem15/fonoteka/tests/security/TokenSurfaceIsolationTest.php, ../fonoteka.go/plugins/golem15/user/api_tokens_test.go, ../fonoteka.go/plugins/golem15/user/api_tokens_edge_test.go, ../fonoteka.go/plugins/golem15/user/session_test.go (sessionApp, insertUser), ../fonoteka.go/plugins/golem15/user/lang/en/lang.yaml, ../fonoteka.go/plugins/golem15/user/lang/pl/lang.yaml, ../fonoteka.go/parity/fixtures/routes/DELETE___fonoteka_api_v1_oauth-identities_{provider}_jwt.yaml, ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go (assertRouteSurfaces, oauth-identity subtest), ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/http_errors.go</read_first>
+  <action>Per D-04, D-06, D-11, HTTP-01, HTTP-03, I18N-01.
+
+(1) Expand plugin-root `oauth_identities_test.go` (package `user`) using `sessionApp`, `insertUser`, `httptest`, `bouncer.WithUser`, and the constructors. Seed rows with struct literals (empty Fillable). Destroy tests pass `OAuthIdentitiesOptions{WriteNotFound: ...}` writing the same Winter HTML 404 bytes the host uses (`WriteWinterHTTPError` via a test double that copies `winter_404.html` headers/body, or a stub that records identical bytes for every 404 branch).
+
+Behaviours: unlink 204 empty body and the sibling provider row remains; last remaining identity returns 409 JSON `error` equal to the EN string when locale is en and the PL string when locale is pl (phrasebook Get / request locale analog already used in account tests); missing, foreign, and unknown provider (`linkedin` while authenticated) return status 404, `Content-Type: text/html; charset=UTF-8`, and byte-identical bodies; 401 without a JWT on GET and DELETE `/google` (not an unknown provider). Last-method 409 still fires when that user also has a password (D-06). Keep `TestOAuthIdentitiesIndexEmptyList`.
+
+(2) phase08 `test_oauth_identity_routes_exist_on_jwt_surface_only`: `assertRouteSurfaces` GET `/oauth-identities` jwt-only and DELETE `/oauth-identities/{provider}` jwt-only. Assert DELETE middleware contains `throttle:10,1`. No identity suffix on `/api/v1/fonoteka`.
+  </action>
+  <verify>
+    <automated>go -C ../fonoteka.go vet ./plugins/golem15/user/... ./plugins/golem15/fonoteka/... &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/user ./plugins/golem15/fonoteka -count=1 -v -run 'OAuthIdentit|TestOAuthTokenSurfaceIsolationCoverage/test_oauth_identity_routes_exist_on_jwt_surface_only'</automated>
+    <fails_when>Non-zero exit; verbose run prints "--- FAIL", "no tests to run" or "--- SKIP", or lacks "--- PASS: TestOAuthTokenSurfaceIsolationCoverage/test_oauth_identity_routes_exist_on_jwt_surface_only".</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'StatusNoContent' ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go` prints at least 1.
+    - `grep -c 'last_method_blocked' ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go` prints at least 1.
+    - `grep -c '/google' ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go` prints at least 1.
+    - `grep -c 'assertRouteSurfaces(t, rt, http.MethodGet, "/oauth-identities", true, false)' ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go` prints at least 1.
+    - `grep -c 'assertRouteSurfaces(t, rt, http.MethodDelete, "/oauth-identities/{provider}", true, false)' ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go` prints at least 1.
+    - `grep -c 'assertAbsent(t, "oauth-identit"' ../fonoteka.go/plugins/golem15/fonoteka/phase08_coverage_test.go` prints 0.
+  </acceptance_criteria>
+  <done>D-11 identity behaviours and jwt-only surfaces fail when broken, including EN/PL 409 and byte-identical Winter 404s.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Migration up/down, MeToken null collection_ids, and secret-leak threat tests</name>
+  <files>../fonoteka.go/plugins/golem15/user/updates/oauth_identities_test.go, ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller_test.go, ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go</files>
+  <read_first>../fonoteka.go/plugins/golem15/user/updates/api_tokens_test.go, ../fonoteka.go/plugins/golem15/user/updates/postgres_test.go (dedicatedDB, -short skip), ../fonoteka.go/plugins/golem15/user/updates/202610050001_create_oauth_identities.go, ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go, ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller_test.go (nil-array test ~78-117), modules/lagoon/encrypted.go (MarshalJSON redactedLiteral), .planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-RESEARCH.md (DATA-02/DATA-07 validation map, T-14.1-01)</read_first>
+  <action>Per D-07, D-09, DATA-02, DATA-07.
+
+(1) `updates/oauth_identities_test.go`: `dedicatedDB`, `lagoon.Use`, `gormigrate.New(..., TableName: "summer_migrations_golem15_user", UseTransaction: true, All())`, `Migrate()`, assert `HasTable` `golem15_user_oauth_identities`, columns including `access_token`, `refresh_token`, `profile_data`, `linked_at`, unique index names `oauth_identities_user_provider_unique` and `oauth_identities_provider_identity_unique`, `information_schema.columns` udt `jsonb` for `profile_data`, FK `user_id` → `users(id)` ON DELETE CASCADE. `RollbackMigration` of this migration drops the table. Skip through existing dedicatedDB/`-short` behaviour; a missing container is a fail, not a pass.
+
+(2) Rewrite `TestMeTokenHandlerNilScopesAndCollectionIDsSerializeAsEmptyArraysAndNullableName`: `scopes` remains a JSON array (not null); `collection_ids` MUST be the JSON null token when CollectionIDs is invalid or empty (D-09). Keep the four-field restricted test and the no-requery test. Rename the test if the old name would lie.
+
+(3) Secret-leak (T-14.1-01 / DATA-07): insert an identity with `lagoon.NewEncrypted` plaintext plus `profile_data` containing a distinctive string; GET Index body must not contain the plaintext, must not contain JSON keys `access_token`, `refresh_token`, or `profile_data`, and must not contain `[redacted]` (Encrypted marshal leak of key names). Same assertion on the D-10 list-with-rows shape (provider + linked_at only).
+  </action>
+  <verify>
+    <automated>go -C ../fonoteka.go vet ./plugins/golem15/user/... ./plugins/golem15/fonoteka/controllers/api/... &amp;&amp; go -C ../fonoteka.go test ./plugins/golem15/user/updates ./plugins/golem15/user ./plugins/golem15/fonoteka/controllers/api -count=1 -v -run 'OAuthIdentit|MeTokenHandlerNil|oauth_identities'</automated>
+    <fails_when>Non-zero exit; verbose run prints "--- FAIL", "no tests to run" or "--- SKIP" for the named migration, MeToken nil, or secret-leak tests; updates tests skip because Postgres is missing.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'golem15_user_oauth_identities' ../fonoteka.go/plugins/golem15/user/updates/oauth_identities_test.go` prints at least 1 and `grep -c 'jsonb' ../fonoteka.go/plugins/golem15/user/updates/oauth_identities_test.go` prints at least 1.
+    - `grep -c '"collection_ids":null' ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller_test.go` prints at least 1.
+    - `grep -c '"scopes":null' ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller_test.go` prints at least 1 (the rewritten test still treats a null scopes token as failure).
+    - `grep -c 'access_token' ../fonoteka.go/plugins/golem15/user/oauth_identities_test.go` prints at least 1 (the leak assertion names the keys that must be absent from the body).
+  </acceptance_criteria>
+  <done>Migration up/down, D-09 `/me` null, and Encrypted-token leak tests fail when their protections are removed.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: TestParityCorpus is 175 recorded, 175 passing, 0 pending</name>
+  <files>../fonoteka.go/parity/parity_test.go</files>
+  <read_first>../fonoteka.go/parity/parity_test.go (expectedPHPRoutes, expectedPortedRoutes, TestParityCorpus, assertPortedMismatch after 14.1-01), ../fonoteka.go/parity/manifest.yaml (three ported identity/me routes), .planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-VALIDATION.md</read_first>
+  <action>Per D-12, API-09, QA-05. Confirm `expectedPHPRoutes` and `expectedPortedRoutes` are both 175 and `assertPortedMismatch` no longer probes an unported identity GET. Run the corpus. If a fixture drifts, re-record through `php_parity.sh` + `summer parity:record` as in plan 01 Task 4 — do not hand-edit PHP response bytes. Do not change `scripts/check-phase14.sh` pending counts (Phase 14 gate stays historical).
+  </action>
+  <verify>
+    <automated>go -C ../fonoteka.go vet ./parity/... ./plugins/golem15/user/... ./plugins/golem15/fonoteka/... &amp;&amp; go -C ../fonoteka.go test ./parity -count=1 -run 'TestParityCorpus' -timeout 30m</automated>
+    <fails_when>Non-zero exit; summary line is not `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -nE 'expectedPortedRoutes = 175' ../fonoteka.go/parity/parity_test.go` prints a matching line (non-empty).
+    - `grep -c 'unported PHP route must not pass' ../fonoteka.go/parity/parity_test.go` prints 0.
+    - Corpus output contains `pending 0` and `passing 175`.
+  </acceptance_criteria>
+  <done>Zero pending routes: the parity harness is green on the three formerly orphan routes, which is the API-09/QA-05 evidence this phase can give (Nuxt/MCP stay unchanged consumers).</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Test process → handlers | Tests must not mint production JWTs or log `Encrypted.Reveal()` |
+| Corpus replay → Go app | Pending must never count as passing |
+| Test 404 writer → Destroy | Foreign/missing/unknown must be indistinguishable |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-14.1-09 | Information Disclosure | oauth_identities_test.go GET | high | mitigate | Fail if body contains plaintext, Encrypted JSON keys, or `[redacted]` |
+| T-14.1-10 | Information Disclosure | Destroy 404 tests | high | mitigate | Byte-identical Winter HTML for missing, foreign, unknown; JSON 404 fails the test |
+| T-14.1-11 | Tampering | TestParityCorpus | high | mitigate | expectedPortedRoutes 175; pending 0; rewritten mismatch helper on a ported fixture |
+| T-14.1-12 | Elevation of Privilege | phase08 TokenSurfaceIsolation | high | mitigate | assertRouteSurfaces jwt-only; token group never gains identity paths |
+| T-14.1-SC | Tampering | package installs | high | mitigate | No new modules |
+
+ASVS L1: all high threats mitigated. Plan 01's T-14.1-01..08 remain in force; these IDs are the test-plane controls that make those mitigations fail-closed.
+</threat_model>
+
+<verification>
+Full app-side gate: `go -C ../fonoteka.go vet ./...` and `go -C ../fonoteka.go test ./plugins/golem15/user/... ./plugins/golem15/fonoteka/... ./parity/... -count=1`. Corpus 175/175/0. Framework tree in summercms.go unchanged besides this planning commit.
+
+<human-check>
+QA-05 consumers are frozen: sign in to the Nuxt app, open Settings → Connected accounts against the Go backend (list/unlink). Call fonoteka-mcp `me()` against Go; extra `collection_ids` is ignored by its TypeScript type.
+</human-check>
+</verification>
+
+<success_criteria>
+- D-11 PHP test port is green.
+- Migration up/down proven on real Postgres.
+- MeToken unrestricted `collection_ids` is JSON null under test.
+- Secret-leak tests fail when the explicit map is replaced by model marshal.
+- `TestParityCorpus` is 175/175/0.
+</success_criteria>
+
+<output>
+Create `.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-02-SUMMARY.md` when done
+</output>

.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-PATTERNS.md

@@ -0,0 +1,559 @@
+# Phase 14.1: oauth-identities-and-fonoteka-me-routes - Pattern Map
+
+**Mapped:** 2026-10-05
+**Files analyzed:** 18
+**Analogs found:** 18 / 18 (two caveats: no production 204 handler; no jsonb DDL in sm-user-plugin)
+
+Plan count is locked at 2: **14.1-01 implementation** (model, migration, lang, exported handlers, fonoteka JWT mount, `/me` null fix, parity extras/recording/manifest, README; smoke GET empty list allowed), **14.1-02 unit tests last**.
+
+Path roots:
+- `FW` = `/media/nvme/dev/golem15/summercms.io/summercms/summercms.go`
+- `APP` = `/media/nvme/dev/golem15/summercms.io/summercms/fonoteka.go`
+- `FON` = `APP/plugins/golem15/fonoteka`
+- `USR` = `APP/plugins/golem15/user` (sm-user-plugin submodule)
+
+All analog paths below are git-tracked (`git ls-files` in `summercms.go`, `fonoteka.go`, and inside the user submodule).
+
+Do **not** modify `USR/routes.go`. Identity handlers are exported; the host mounts them (D-02).
+
+## File Classification
+
+| New/Modified File | Role | Data Flow | Closest Analog | Match Quality | Plan |
+|-------------------|------|-----------|----------------|---------------|------|
+| `USR/models/oauth_identity.go` | model | CRUD | `USR/models/api_token.go` + `FON/models/user_discogs_credential.go` | exact (struct/register + Encrypted) | 01 |
+| `USR/updates/202610050001_create_oauth_identities.go` | migration | CRUD | `USR/updates/202610040001_create_api_tokens.go` + unique index from `USR/updates/202610040003_create_frontend_permissions.go` | exact | 01 |
+| `USR/controllers/oauth_identities.go` | controller | request-response | `USR/controllers/api_tokens.go` | exact | 01 |
+| `USR/lang/en/lang.yaml` | config | transform | itself (`account:` / `plugin:` keys) | exact | 01 |
+| `USR/lang/pl/lang.yaml` | config | transform | itself | exact | 01 |
+| `USR/README.md` | docs | — | itself (API reference + migration table) | exact | 01 |
+| `FON/routes.go` | route | request-response | JWT group `routes.go:48` + `"throttle:10,1"` on CSV/switch; `Where` loosening at `:238-254` | exact | 01 |
+| `FON/controllers/api/me_token_controller.go` | controller | request-response | itself | exact (modify) | 01 |
+| `APP/parity/manifest.yaml` | config | — | pending entries `:2801-2836`, `:3406-3422` | exact | 01 |
+| `APP/parity/parity_test.go` | test | request-response | `assertPortedMismatch` `:456-501` → rewrite like `assertPortedMutationCaught` `:503-529` | exact | 01 |
+| `APP/parity/fonoteka_seed_test.go` | test | CRUD | `fonotekaCaseExtras` `:37-80` | exact | 01 |
+| `APP/parity/fonoteka_reset.php` | config | CRUD | `$extras` `:119-145` | exact | 01 |
+| `APP/parity/fixtures/routes/*oauth-identities*` (keep empty GET; add list-with-rows) | fixture | request-response | `GET___fonoteka_api_v1_oauth-identities_jwt.yaml` | exact | 01 |
+| `APP/parity/fixtures/routes/*fonoteka_me*` (keep restricted; add unrestricted) | fixture | request-response | `GET__api_v1_fonoteka_me_personal_token.yaml` | exact | 01 |
+| `USR/oauth_identities_test.go` (or `controllers/oauth_identities_test.go`) | test | request-response | `USR/api_tokens_test.go` + `USR/api_tokens_edge_test.go` | exact | 02 |
+| `USR/updates/oauth_identities_test.go` | test | CRUD | `USR/updates/api_tokens_test.go` | exact | 02 |
+| `FON/controllers/api/me_token_controller_test.go` | test | request-response | itself (`TestMeTokenHandlerNilScopesAndCollectionIDsSerializeAsEmptyArraysAndNullableName`) | exact (rewrite) | 02 |
+| `FON/phase08_coverage_test.go` | test | request-response | `assertAbsent` oauth-identit `:663-666` → `assertRouteSurfaces` `:1017-1049` | exact | 02 |
+
+Leave unchanged: `USR/routes.go` (`/_user/api/v1` group), `USR/plugin.go` (`Migrations()`/`Models()` already return `updates.All()`/`models.All()`), `USR/controllers/api_controller.go` `writeWinterErrorPage` (always 500 — not a 404 analog).
+
+## Pattern Assignments
+
+### `USR/models/oauth_identity.go` (model, CRUD) — plan 01
+
+**Analog (registration + Jsonable + TableName):** `USR/models/api_token.go`
+
+**Imports + struct + init** (lines 1-28, 50):
+```go
+package models
+
+import (
+	"slices"
+	"time"
+
+	"git.golem15.com/golem15/summercms/modules/lagoon"
+)
+
+type APIToken struct {
+	ID            uint                      `gorm:"column:id;primaryKey"`
+	UserID        uint                      `gorm:"column:user_id"`
+	Name          *string                   `gorm:"column:name"`
+	TokenHash     string                    `gorm:"column:token_hash" json:"-"`
+	Scopes        lagoon.Jsonable[[]string] `gorm:"column:scopes"`
+	CollectionIDs lagoon.Jsonable[[]uint]   `gorm:"column:collection_ids"`
+	ExpiresAt     *time.Time                `gorm:"column:expires_at"`
+	// ...
+}
+
+func (APIToken) TableName() string { return "user_api_tokens" }
+
+func init() { Register(APIToken{}) }
+```
+
+Copy: package `models`, GORM tags, `TableName()`, `init() { Register(...) }`. `plugin.go:207-209` already returns `updates.All()` / `models.All()` — do not edit `plugin.go`.
+
+**Do not copy** `APIToken.Fillable` listing secret columns. D-05 / mass-assignment: tests assign fields explicitly; keep Fillable empty or omit secrets. PHP `$guarded = ['*']`.
+
+**Analog (Encrypted + json:"-"):** `FON/models/user_discogs_credential.go` lines 10-28:
+```go
+type UserDiscogsCredential struct {
+	ID        uint             `gorm:"column:id;primaryKey"`
+	UserID    uint             `gorm:"column:user_id"`
+	Token     lagoon.Encrypted `gorm:"column:token" json:"-"`
+	CreatedAt time.Time        `gorm:"column:created_at"`
+	UpdatedAt time.Time        `gorm:"column:updated_at"`
+}
+
+func (UserDiscogsCredential) Hidden() []string { return []string{"token"} }
+```
+
+OAuthIdentity columns (D-07): `id`, `user_id`, `provider` (50), `provider_id` (255), `access_token`/`refresh_token` (`lagoon.Encrypted`, `json:"-"`), `token_expires_at *time.Time`, `profile_data lagoon.Jsonable[map[string]any]`, `linked_at *time.Time`, `created_at`, `updated_at`. `TableName()` → `golem15_user_oauth_identities`. Hidden: `access_token`, `refresh_token`, `profile_data`.
+
+**Do not read** `USR/models/user.go:27` `HasSelfSetPassword` from unlink (D-06).
+
+---
+
+### `USR/updates/202610050001_create_oauth_identities.go` (migration, CRUD) — plan 01
+
+**Analog:** `USR/updates/202610040001_create_api_tokens.go` lines 1-36
+
+**Imports + Register + tx.Exec DDL + cascade FK:**
+```go
+package updates
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+var apiTokenMigrations = []*gormigrate.Migration{
+	{
+		ID: "202610040001_create_user_api_tokens",
+		Migrate: func(tx *gorm.DB) error {
+			return tx.Exec(`CREATE TABLE user_api_tokens (
+	id BIGSERIAL PRIMARY KEY,
+	user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+	// ...
+	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX ...`).Error
+		},
+		Rollback: func(tx *gorm.DB) error {
+			return tx.Exec("DROP TABLE IF EXISTS user_api_tokens").Error
+		},
+	},
+}
+
+func init() { Register(apiTokenMigrations...) }
+```
+
+**Unique-index analog:** `USR/updates/202610040003_create_frontend_permissions.go` lines 15-26:
+```go
+return execStmts(tx, []string{
+	`CREATE TABLE golem15_user_frontend_permissions ( ... )`,
+	`CREATE UNIQUE INDEX golem15_user_frontend_permissions_code_unique ON golem15_user_frontend_permissions (code)`,
+})
+```
+
+Copy that named unique-index style for:
+- `oauth_identities_user_provider_unique` on `(user_id, provider)`
+- `oauth_identities_provider_identity_unique` on `(provider, provider_id)`
+
+**Deviation (no analog in USR DDL):** `profile_data jsonb` per D-07. User-plugin Jsonable columns today are `TEXT` (`scopes TEXT NULL` in the api_tokens migration). `lagoon.Jsonable.GormDataType` still returns `"text"` (`FW/modules/lagoon/jsonable.go:84-85`) but `Scan` accepts `[]byte` from Postgres jsonb (`jsonable.go:43-44`). Encrypted tokens are `TEXT` like `FON/updates/11_secrets_slice.go:118-119` (`api_key TEXT NOT NULL`). Do **not** port the PHP `users.oauth_*` backfill.
+
+---
+
+### `USR/controllers/oauth_identities.go` (controller, request-response) — plan 01
+
+**Analog:** `USR/controllers/api_tokens.go`
+
+**Imports** (lines 3-17):
+```go
+import (
+	"errors"
+	"net/http"
+	// ...
+	"git.golem15.com/golem15/sm-user-plugin/models"
+	"git.golem15.com/golem15/summercms/modules/backpack"
+	"git.golem15.com/golem15/summercms/modules/bouncer"
+	"git.golem15.com/golem15/summercms/modules/wire"
+	"gorm.io/gorm"
+)
+```
+
+Add `phrasebook` for the 409 key (same package already uses it in `api_controller.go`).
+
+**Constructor + owner-scoped list + explicit map** (lines 65-84):
+```go
+func APITokenIndex(app *backpack.App) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		db, user, ok := apiTokenDeps(w, r, app)
+		if !ok {
+			return
+		}
+		var rows []models.APIToken
+		if err := db.WithContext(r.Context()).
+			Where("user_id = ? AND oauth_client_id IS NULL AND revoked_at IS NULL", user.ID).
+			Order("created_at DESC").Find(&rows).Error; err != nil {
+			writeOpaque500(w)
+			return
+		}
+		data := make([]map[string]any, 0, len(rows))
+		for i := range rows {
+			data = append(data, apiTokenJSON(&rows[i]))
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": wire.Slice(data)})
+	}
+}
+```
+
+Index for identities: `Where("user_id = ?", user.ID).Order("provider")`. Each row is `map[string]any{"provider": ..., "linked_at": (*wire.Time | nil)}` — never `json.Marshal` the GORM model (Encrypted would emit `"[redacted]"` and leak key names). Empty list: `wire.Slice` so `{"data":[]}`.
+
+**Auth deps** (lines 113-128) — copy, do not re-parse JWT:
+```go
+func apiTokenDeps(...) (*gorm.DB, *bouncer.Principal, bool) {
+	user, ok := bouncer.User(r.Context())
+	if !ok || user == nil || user.ID == 0 {
+		writeUnauthorized(w)
+		return nil, nil, false
+	}
+	return db, user, true
+}
+```
+
+On the JWT group, `jwt.auth` already 401s before the handler. Keep the principal check as a fail-closed belt.
+
+**Owner-scoped destroy + foreign/missing 404** (lines 87-110):
+```go
+id, err := strconv.ParseUint(r.PathValue("id"), 10, 64)
+// ...
+err = db.WithContext(r.Context()).Where("user_id = ? AND oauth_client_id IS NULL", user.ID).First(&token, id).Error
+if errors.Is(err, gorm.ErrRecordNotFound) {
+	writeJSON(w, http.StatusNotFound, map[string]any{"error": "Token not found"})
+	return
+}
+```
+
+Copy the `user_id` + path-value lookup. **Do not copy** the JSON 404 body. Identity 404 is Winter HTML via host `WriteNotFound` (see Shared Patterns). Path value is `r.PathValue("provider")`.
+
+**409 i18n analog:** `USR/controllers/api_controller.go` lines 1041-1070:
+```go
+func appTranslator(app *backpack.App) *phrasebook.Translator { ... }
+
+func accountMessage(ctx context.Context, app *backpack.App, key, fallback string) string {
+	tr := appTranslator(app)
+	s := tr.Get(ctx, "golem15.user::lang.account."+key, nil)
+	// ...
+}
+```
+
+409 body: `writeJSON(w, http.StatusConflict, map[string]any{"error": tr.Get(ctx, "golem15.user::lang.oauth.last_method_blocked", nil)})`. Count identities for this `user_id` only. Ignore `HasSelfSetPassword`.
+
+**204:** no production handler analog. PHP `noContent()` → `w.WriteHeader(http.StatusNoContent)` with empty body. Do **not** copy `APITokenDestroy`'s `200 {"data":{"revoked":true}}`.
+
+**JSON helper analog:** `USR/controllers/api_controller.go:1025-1028`:
+```go
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Cache-Control", "no-cache, private")
+	wire.WriteJSON(w, status, v)
+}
+```
+
+Same-package `writeJSON` (not a second encoder). `linked_at` uses `*wire.Time` (`FW/modules/wire/response.go:41-43`).
+
+**Options shape (discretion, RESEARCH):**
+```go
+type OAuthIdentitiesOptions struct {
+	Providers     []string // default google, facebook, github
+	WriteNotFound func(http.ResponseWriter, *http.Request)
+}
+func OAuthIdentitiesIndex(app *backpack.App) http.HandlerFunc { ... }
+func OAuthIdentitiesDestroy(app *backpack.App, opts OAuthIdentitiesOptions) http.HandlerFunc { ... }
+```
+
+Do **not** add a `Mount` helper that imports `FON/controllers/api`. Allow-list miss → same `WriteNotFound` as missing/foreign row. No `surf.Where("provider", ...)`.
+
+**Nullable Carbon analog:** `FON/controllers/api/wishlist_subscriptions_controller.go:170,194-196`:
+```go
+SubscribedAt *wire.Time `json:"subscribed_at"`
+if sub.SubscribedAt != nil {
+	e.SubscribedAt = &wire.Time{Time: sub.SubscribedAt.UTC()}
+}
+```
+
+---
+
+### `USR/lang/{en,pl}/lang.yaml` (config) — plan 01
+
+**Analog:** existing files. EN starts:
+```yaml
+account:
+  invalid_login: Invalid email or password
+```
+
+Add a sibling `oauth:` group (D-03), not under `account:`:
+```yaml
+oauth:
+  last_method_blocked: This is the only remaining way to sign in. Link another method before disconnecting this one.
+```
+
+PL (byte-identical to PHP `golem15.fonoteka::lang.oauth.last_method_blocked`):
+```yaml
+oauth:
+  last_method_blocked: To jedyna droga logowania na to konto. Najpierw podłącz inną, zanim odetniesz tę.
+```
+
+Key consumed as `golem15.user::lang.oauth.last_method_blocked`.
+
+---
+
+### `USR/README.md` (docs) — plan 01
+
+**Analog:** itself. Overview sentence listing tables (`README.md:15`) currently names `users` extensions, `user_throttle`, `jwt_blacklist`, `user_api_tokens`, organisations, groups, frontend permissions — add `golem15_user_oauth_identities`.
+
+API reference table (`README.md:85-104`) lists only `/_user/api/v1` routes. Add an **exported, host-mounted** subsection for `OAuthIdentitiesIndex` / `OAuthIdentitiesDestroy` / `OAuthIdentitiesOptions`. Do **not** add those paths to the `/_user/api/v1` table (D-02). Framework READMEs never name a consuming application — say "the host application" and a path the host chooses.
+
+Migration table (`README.md:128-134`): add `202610050001_create_oauth_identities` (or the ID you ship) with the table, unique indexes, cascade FK, jsonb `profile_data`, Encrypted tokens.
+
+Models list (`README.md:149`): add `OAuthIdentity`.
+
+---
+
+### `FON/routes.go` (route) — plan 01
+
+**Analog:** JWT group + inline throttle + no-Where-on-opaque-id.
+
+**Group middleware** (line 48):
+```go
+r.Group("/_fonoteka/api/v1", surf.Use("jwt.auth", "locale.from-principal", "inv.must-change-password"), func(g pact.Router) {
+```
+
+**Throttle string** (lines 60, 91):
+```go
+g.Post("/import/csv", api.CsvImportStore(p.app), "throttle:10,1")
+g.Post("/collections/{id}/switch", api.CollectionSwitch(p.app), "throttle:10,1")
+```
+
+DELETE identities uses the same `"throttle:10,1"` argument. GET identities has no extra throttle.
+
+**Do not add `g.Where("provider", "google|facebook|github")`.** Precedent: oauth `request_id` was loosened so the controller 404 is reachable (`routes.go:238-254`). `surf.Where`/`constrain` answers `http.NotFound` (`text/plain` `404 page not found\n`).
+
+**Personal-token group stays unchanged** (lines 262-265):
+```go
+r.Group("/api/v1/fonoteka", surf.Use("inv_token", "throttle:fonoteka-api-token"), func(g pact.Router) {
+	g.Get("/me", api.MeToken(p.app), "inv.scope:read")
+```
+
+Do not mount oauth-identities here.
+
+**Host wiring (discretion):** import `git.golem15.com/golem15/sm-user-plugin/controllers` as `userctrl`. Inside the JWT group:
+```go
+g.Get("/oauth-identities", userctrl.OAuthIdentitiesIndex(p.app))
+g.Delete("/oauth-identities/{provider}", userctrl.OAuthIdentitiesDestroy(p.app, userctrl.OAuthIdentitiesOptions{
+	WriteNotFound: func(w http.ResponseWriter, r *http.Request) {
+		api.WriteWinterHTTPError(w, p.app, http.StatusNotFound)
+	},
+}), "throttle:10,1")
+```
+
+---
+
+### `FON/controllers/api/me_token_controller.go` (controller) — plan 01
+
+**Analog:** itself, lines 20-47. Change only `collection_ids`.
+
+Today (lines 41-46) — **do not keep Slice on collection_ids**:
+```go
+wire.WriteJSON(w, http.StatusOK, map[string]any{"data": map[string]any{
+	"scopes":         wire.Slice(scopes),
+	"collection_ids": wire.Slice(collectionIDs),
+	"user_id":        userID,
+	"name":           name,
+}})
+```
+
+D-09: if `!token.CollectionIDs.Valid || len(token.CollectionIDs.Get()) == 0` emit JSON `null`; else the int list. `scopes` stays `wire.Slice`. Comment on lines 18-19 ("never serialize as null") is superseded for `collection_ids` only.
+
+**Null-when-invalid analog:** `FW/modules/wire/response.go:70-80` `TriBool` (`Valid=false` marshals `null`). Implementation can use `any`/`nil` in the map rather than a new type.
+
+Auth: keep `bouncer.User` + `bouncer.Credential` already on context; never re-parse the bearer (lines 25-38).
+
+---
+
+### Parity files — plan 01
+
+**`APP/parity/manifest.yaml` analog:** pending blocks at lines 2801-2836 and 3406-3422. Flip `status: pending` → `ported` on all three route ids. Add D-10 cases (list-with-rows; unrestricted `/me`) without deleting the empty GET, missing DELETE, or restricted `/me` cases.
+
+**`APP/parity/parity_test.go` analog:**
+- Counts (lines 28-29): `expectedPHPRoutes = 175`, `expectedPortedRoutes = 172` → `175` / `175`.
+- `assertPortedMismatch` (lines 456-501) currently requires GET oauth-identities replay to fail 200 vs 404. After D-12 that helper fatals `"unported PHP route must not pass"`.
+- Replacement analog: `assertPortedMutationCaught` (lines 503-529) — load a **ported** fixture, wrap the handler with `mutateAlbumCount`, assert `tide.MismatchError`. Do not keep a pending-route probe.
+
+**`APP/parity/fonoteka_seed_test.go` analog** (`fonotekaCaseExtras` lines 34-80): keys are `"<route id>#<case id>"` or a reused case id. Add extras for the new list-with-rows and unrestricted-`/me` cases. Leave empty GET / missing DELETE / restricted `/me` unmapped (plain reset).
+
+**`APP/parity/fonoteka_reset.php` analog** (lines 119-145): `$extras` from `PARITY_CASE`; named extras insert rows. Add the same extra names as Go. Seed alice `facebook`+`google` identities **with token/profile values** so the GET fixture proves secrets do not leak. Unrestricted `/me`: mint a **second** alice token with SQL NULL/empty `collection_ids`; do not mutate `mcp-read`.
+
+**Fixture analog:** `APP/parity/fixtures/routes/GET___fonoteka_api_v1_oauth-identities_jwt.yaml` (empty `{"data":[]}`, `Cache-Control: no-cache, private`). DELETE missing-row fixture is Winter HTML (`text/html; charset=UTF-8`, title `Nie znaleziono strony`) — new 404 tests must match those bytes, not JSON.
+
+---
+
+### `USR/oauth_identities_test.go` (test) — plan 02
+
+**Analog:** `USR/api_tokens_test.go` lines 82-113 (httptest + `bouncer.WithUser` + call constructor directly) and `USR/api_tokens_edge_test.go` lines 87-102 (foreign destroy 404, list does not leak other users' rows).
+
+Copy:
+- `sessionApp(t, ...)`, `insertUser`, `httptest.NewRecorder`, `controllers.X(app).ServeHTTP`
+- Secret-leak assertion: `strings.Contains(listed.Body.String(), secret)` must be false (`api_tokens_test.go:111-112`)
+- Foreign vs owner: same 404 status (`api_tokens_edge_test.go:92-94`) — identities also require **byte-identical** Winter HTML bodies
+
+Port PHP `OAuthIdentityApiTest.php` behaviours (D-11): 204 keeps the other row; last-method 409 EN/PL against the lang strings; missing/foreign/unknown provider Winter 404; 401 without JWT on `/google` (not `/linkedin` — unauthenticated unknown provider is 401 because `jwt.auth` runs first). Do not consult `has_self_set_password` in assertions except to prove 409 still fires when the user has a password.
+
+Prefer plugin-root `USR/oauth_identities_test.go` (same package `user` as `api_tokens_test.go`) over `controllers/` unless the planner wants an internal test of unexported helpers.
+
+---
+
+### `USR/updates/oauth_identities_test.go` (test) — plan 02
+
+**Analog:** `USR/updates/api_tokens_test.go` lines 11-42
+
+```go
+sqlDB := dedicatedDB(t, "user_api_tokens")
+db, err := lagoon.Use(t.Context(), sqlDB)
+m := gormigrate.New(db, &gormigrate.Options{TableName: "summer_migrations_golem15_user", UseTransaction: true}, All())
+if err := m.Migrate(); err != nil { t.Fatal(err) }
+if !db.Migrator().HasTable((&models.APIToken{}).TableName()) { t.Fatal(...) }
+// HasColumn loop
+if err := m.RollbackMigration(apiTokenMigrations[0]); err != nil { t.Fatal(err) }
+```
+
+Reuse `dedicatedDB` from `USR/updates/postgres_test.go` (testcontainers, skip on `-short`). Extra assertions vs analog: unique index names, `profile_data` udt `jsonb`, FK on `user_id` → `users(id)` ON DELETE CASCADE. Type check analog: `information_schema.columns` query at `api_tokens_test.go:29-35`.
+
+---
+
+### `FON/controllers/api/me_token_controller_test.go` (test) — plan 02
+
+**Analog:** itself. Rewrite `TestMeTokenHandlerNilScopesAndCollectionIDsSerializeAsEmptyArraysAndNullableName` (lines 78-117). Today it forbids `"collection_ids":null` (lines 113-116). After D-09: `scopes` still `[]`; `collection_ids` **must** be JSON null when `!Valid` or `len==0`. Keep `TestMeTokenHandlerExactFourFieldsWithScopesAndCollectionIDs` (restricted list of ints) and the no-requery test.
+
+Setup analog (`meTokenRequest`, lines 19-24): `bouncer.WithUser` + `bouncer.WithCredential` — do not go through HTTP auth.
+
+---
+
+### `FON/phase08_coverage_test.go` (test) — plan 02
+
+**Replace** `assertAbsent(t, "oauth-identit", "identities")` at lines 663-666.
+
+**Analog:** `assertRouteSurfaces` lines 1017-1049:
+```go
+func assertRouteSurfaces(t *testing.T, rt []surf.RouteInfo, method, suffix string, wantJWT, wantToken bool) {
+	// matches "/_fonoteka/api/v1"+suffix with jwt.auth
+	// matches "/api/v1/fonoteka"+suffix with exactly one inv.scope
+}
+```
+
+Calls:
+```go
+assertRouteSurfaces(t, rt, http.MethodGet, "/oauth-identities", true, false)
+assertRouteSurfaces(t, rt, http.MethodDelete, "/oauth-identities/{provider}", true, false)
+```
+
+Throttle: extend a middleware contains-check (CSV import already jwt-only). DELETE must list `throttle:10,1`. JWT-only matches PHP `TokenSurfaceIsolationTest`.
+
+---
+
+## Shared Patterns
+
+### Authentication (JWT group, do not re-parse)
+
+**Source:** `FON/routes.go:48`; `USR/controllers/api_tokens.go:123-127`; `FW` implied `bouncer.write401`
+**Apply to:** `oauth_identities.go` Index/Destroy; fonoteka mount
+
+Handlers read `bouncer.User(r.Context())`. 401 without JWT is the group's `jwt.auth`, envelope `{"error":true,"message":...}` + `Cache-Control: no-cache, private`. D-11 401 tests use `/google` so the allow-list is not involved.
+
+### Winter HTML 404 (host-injected)
+
+**Source:** `FON/controllers/api/http_errors.go:44-73`
+**Apply to:** Destroy allow-list miss, missing row, foreign row (byte-identical)
+
+```go
+func writeWinterHTTPError(w http.ResponseWriter, app *backpack.App, status int) {
+	// embed winter_<status>.html, Origin from app.url
+	w.Header().Set("Content-Type", "text/html; charset=UTF-8")
+	w.Header().Set("Cache-Control", "no-cache, private")
+	w.WriteHeader(status)
+}
+func WriteWinterHTTPError(w http.ResponseWriter, app *backpack.App, status int) {
+	writeWinterHTTPError(w, app, status)
+}
+```
+
+**Anti-pattern:** `USR/controllers/api_controller.go:1073-1077` `writeWinterErrorPage` always writes **500**. Do not reuse it for identity 404s.
+
+### JSON responses + Carbon time + empty arrays
+
+**Source:** `USR/controllers/api_controller.go:1025-1028`; `FW/modules/wire/response.go:10-23, 32-43, 83-89`
+**Apply to:** Index `{"data":[...]}`; 409 `{"error":...}`; `/me` scopes
+
+```go
+func (t Time) MarshalJSON() ([]byte, error) {
+	s := t.UTC().Format("2006-01-02T15:04:05") + "+00:00"
+	return []byte(`"` + s + `"`), nil
+}
+func Slice[T any](s []T) []T {
+	if s == nil { return []T{} }
+	return s
+}
+```
+
+Never `time.RFC3339` / `Z` for `linked_at`.
+
+### Encrypted secrets stay off the wire
+
+**Source:** `FW/modules/lagoon/encrypted.go:49-52`; `FON/models/user_discogs_credential.go` `json:"-"`
+**Apply to:** model tags; Index map; D-10 fixture with secrets; plan-02 leak tests
+
+```go
+func (e Encrypted) MarshalJSON() ([]byte, error) {
+	return json.Marshal(redactedLiteral) // "[redacted]"
+}
+```
+
+Explicit map only. Seed via `lagoon.NewEncrypted` under the test app key. Do not `Reveal()` in logs.
+
+### Phrasebook keys
+
+**Source:** `USR/controllers/api_controller.go:1066` `golem15.user::lang.account.`+key
+**Apply to:** 409 last-method text
+
+I18N-01: `golem15.user::lang.oauth.last_method_blocked`. Do not hard-code English in the handler.
+
+### Exported constructors, host mount
+
+**Source:** `USR/controllers/api_tokens.go` constructors + `USR/routes.go:26-28` (shows jwt.auth on registration) vs D-02 (host chooses path)
+**Apply to:** identity handlers live in USR; mount lives in `FON/routes.go` JWT group
+
+`USR/routes.go:9-30` stays the `/_user/api/v1` list without oauth-identities.
+
+### Migration registry
+
+**Source:** `USR/updates/registry.go`; `USR/models/registry.go`; `USR/plugin.go:207-209`
+**Apply to:** new migration + model files only (`init` Register). No `AutoMigrate`.
+
+### Rate limit
+
+**Source:** `FON/routes.go:60` `"throttle:10,1"`
+**Apply to:** DELETE registration only. No new bucket type.
+
+## No Analog Found
+
+| File / concern | Role | Data Flow | Reason |
+|----------------|------|-----------|--------|
+| `profile_data jsonb` column type | migration | CRUD | sm-user-plugin Jsonable columns are `TEXT`. Use D-07 `jsonb` anyway; Scan still works. |
+| HTTP 204 empty body | controller | request-response | No production controller uses `StatusNoContent` (only CORS/tests). Use `w.WriteHeader(http.StatusNoContent)` with empty body; do not copy token destroy's 200 JSON. |
+
+Planner should still copy surrounding patterns (gormigrate Register, owner-scoped destroy) from the analogs above.
+
+## Anti-patterns (do not copy)
+
+- `g.Where("provider", "google|facebook|github")` → text/plain 404; also 404s unauthenticated unknown providers before `jwt.auth`.
+- JSON 404 with PHP's `OAuth identity not found`.
+- `wire.Slice` on `/me` `collection_ids`.
+- Registering identity routes on `/_user/api/v1`.
+- Consulting `HasSelfSetPassword` on unlink.
+- Serializing the GORM model (Encrypted `"[redacted]"` + `profile_data`).
+- `USR` `writeWinterErrorPage` for 404.
+- Leaving `assertPortedMismatch` pointed at GET oauth-identities.
+- Leaving `phase08` `assertAbsent("oauth-identit")`.
+- Winter-import mapper / social login (D-08 / deferred).
+- Framework module API changes in `summercms.go` (none expected).
+
+## Metadata
+
+**Analog search scope:** `USR/{models,updates,controllers,lang,README,routes,plugin.go,api_tokens*_test.go}`, `FON/{routes.go,controllers/api,models,phase08_coverage_test.go,updates/11_secrets_slice.go}`, `APP/parity/{parity_test.go,fonoteka_seed_test.go,fonoteka_reset.php,manifest.yaml,fixtures/routes}`, `FW/modules/{wire,lagoon}`
+**Files scanned:** ~40 user-plugin sources, ~15 fonoteka/parity/framework analogs read in full
+**Pattern extraction date:** 2026-10-05
+**Git-tracked gate:** analogs verified via `git ls-files` in `summercms.go`, `fonoteka.go`, and `plugins/golem15/user`

.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-RESEARCH.md

@@ -0,0 +1,697 @@
+# Phase 14.1: oauth-identities-and-fonoteka-me-routes - Research
+
+**Researched:** 2026-10-05
+**Domain:** JWT social-identity list/unlink parity and personal-token `/me` contract close-out
+**Confidence:** HIGH
+
+<user_constraints>
+## User Constraints (from CONTEXT.md)
+
+**CRITICAL:** If CONTEXT.md exists from $gsd-discuss-phase, copy locked decisions here verbatim. These MUST be honored by the planner.
+
+### Locked Decisions
+
+### Where the identity code lives
+- **D-01:** The `OAuthIdentity` model and the `golem15_user_oauth_identities` migration live in **sm-user-plugin**. This mirrors PHP, where Golem15.User v3.3.0 owns the table. The change to the shared plugin is additive only. — **Reversibility:** costly — once shipped in a shared plugin, the table name and schema are a contract for every app that uses the plugin and for the Phase 15 import.
+- **D-02:** The list and unlink handlers also live in **sm-user-plugin**, as a reusable API. This departs from PHP, where the controller sits in the fonoteka plugin as a "D-15 compromise". The user plugin exposes the handlers, and the fonoteka app or plugin mounts them at `/_fonoteka/api/v1/oauth-identities` on the JWT group, with PHP's middleware: JWT auth on both routes and `throttle:10,1` on DELETE. The user plugin must not register these routes under its own `/_user/api/v1` group by default; the host chooses the mount point. Paths, auth group and response bytes match PHP exactly, which `routes.snapshot` checks. — **Reversibility:** costly — it adds exported API surface to a shared plugin that other apps may start to depend on.
+- **D-03:** The 409 "last method" message moves to a new key in the **user plugin's lang files**. The EN and PL texts are identical to PHP's `golem15.fonoteka::lang.oauth.last_method_blocked`:
+  - EN: "This is the only remaining way to sign in. Link another method before disconnecting this one."
+  - PL: "To jedyna droga logowania na to konto. Najpierw podłącz inną, zanim odetniesz tę."
+
+  A host can override the text through the normal lang override.
+- **D-04:** The DELETE provider whitelist is a **mount option**. It defaults to `google`, `facebook` and `github`, and the host can narrow or extend it. A provider outside the list returns the same 404 that PHP's route constraint produces. The researcher confirms PHP's exact bytes for a constraint miss compared with a missing row.
+- **D-05:** The responses are built from an explicit map (`provider`, and `linked_at` as an ISO-8601 string or null), never by serializing the model. The model carries encrypted tokens and profile data. The same rule applies in PHP.
+- **D-06:** Unlink is fail-closed, as in PHP. The last remaining identity is refused with 409 even when the account also has a password. Only the identity count decides it, and `has_self_set_password` plays no part.
+
+### Columns and import
+- **D-07:** The Go table and model carry the **full PHP column set**: `id`, `user_id` (FK to `users`, cascade delete), `provider` (50), `provider_id` (255), `access_token` and `refresh_token` (both `lagoon.Encrypted`), `token_expires_at`, `profile_data` (jsonb), `linked_at`, `created_at` and `updated_at`. Both unique indexes are kept: `(user_id, provider)` and `(provider, provider_id)`. The PHP backfill from the legacy `users.oauth_*` columns is not ported, because Phase 15 imports the rows directly. — **Reversibility:** one-way — the migration ships in a shared plugin and becomes the import target in Phase 15.
+- **D-08:** No Winter-import mapper is written in this phase. Phase 15 (D-02/D-03) adds the `HasWinterImport` mappers for every user-plugin table, including the Laravel decrypt and the GCM re-encrypt of the two token columns.
+
+### `/api/v1/fonoteka/me` contract
+- **D-09:** The full contract is `{"data":{"scopes","collection_ids","user_id","name"}}`. The one gap in today's Go handler (`me_token_controller.go`) is `collection_ids`. PHP's `ApiToken::collectionIds()` returns **`null` for an unrestricted token** (no bound collections), but Go always emits `[]` through `wire.Slice`. Go must emit `null` when the token has no collection binding and a list of ints otherwise. `scopes` keeps the PHP fallback `[]`. This is a parity fix, not a shape change.
+
+### Parity coverage
+- **D-10:** New recorded PHP cases:
+  - **List with linked rows:** alice is seeded with `facebook` and `google` identities, which exercises ordering by provider, the `{provider, linked_at}` shape and the `linked_at` format. The seeded rows carry token and profile values, so the fixture shows that no secret leaks.
+  - **`/me` with an unrestricted token:** `"collection_ids": null`.
+
+  The existing cases stay: GET with an empty list, DELETE with a missing row (404), and `/me` with a restricted token. Seeding goes through the parity harness's `seed_hook` mechanism, on both the PHP recording side and the Go replay side.
+- **D-11:** The remaining identity behaviours are covered by **Go tests ported from `OAuthIdentityApiTest.php`**: unlink returns 204 and keeps the other row, last-method returns 409 with the EN/PL text asserted against the PHP lang strings, foreign and missing rows give byte-identical 404s, an unknown provider gives 404, and both routes give 401 without a JWT. These tests go in the phase's final unit-test plan, together with full coverage of the new user-plugin and fonoteka code. Tests also check that the routes are on the JWT group and that the personal-token group `/api/v1/fonoteka` never gains them (PHP's `TokenSurfaceIsolationTest`).
+- **D-12:** All three manifest entries flip from `pending` to `ported`. Phase 15's preflight then sees zero pending routes.
+
+### Social-login-only accounts at cutover
+- **D-13:** No code in this phase. The lockout risk is recorded for the **Phase 15 preflight**. With social login deferred, a user whose only sign-in method is an OAuth identity cannot log in on Go: PHP's random password means `has_self_set_password = false`, and the Nuxt app has no recovery screen. The preflight counts such users in the production dump. If the count is non-zero, the cutover either gives them a password first (for example through the user plugin's `forgot-password` flow, triggered by hand) or social login gets its own phase before the swap.
+
+### Folded Todos
+- **`orphan-pending-routes.md`** ("Give oauth-identities and /api/v1/fonoteka/me a roadmap phase before cutover"): this phase is that home. The todo moves to done when the phase completes.
+
+### Claude's Discretion
+- The exported API shape in sm-user-plugin: a handler constructor with options, a small `Mount(router, opts)` helper, or a separate sub-package.
+- How the fonoteka side wires the mount, and where the throttle name for `throttle:10,1` is declared.
+- The Go timestamp formatting needed to match Laravel's `toIso8601String()` (`+00:00` offset, not `Z`). The researcher confirms the exact format against the recorded fixture.
+- The plan split, subject to the CLAUDE.md lean-mode rule: unit tests come in the last plan, and the plan count is confirmed before PLAN.md files are written.
+- The README and docs updates required by CLAUDE.md for the sm-user-plugin API and any changes to the framework modules.
+
+### Deferred Ideas (OUT OF SCOPE)
+- **Social login port** (`/oauth/{provider}` redirect and callback, linking a new provider, `oauth-complete`, `oauth-register-complete`, the password-bootstrap OTP): still its own phase. It needs an OAuth-client dependency decision. The Phase 15 preflight count (D-13) decides whether it must land before the swap.
+- **Winter-import mapper for `golem15_user_oauth_identities`**: Phase 15 (D-08).
+</user_constraints>
+
+<phase_requirements>
+## Phase Requirements
+
+Requirement IDs were TBD at discuss time. These v1 rows in REQUIREMENTS.md are the ones this phase actually moves:
+
+| ID | Description | Research Support |
+|----|-------------|------------------|
+| API-09 | All 154 routes are registered on the correct groups with identical paths, methods, status codes and bodies | Flip the three remaining `pending` manifest entries to `ported`. Corpus today is 175 recorded / 172 ported / 3 pending; this phase makes 175/175/0. |
+| QA-05 | Cutover: the parity harness is green on all 154 routes and vue-fonoteka-app and fonoteka-mcp run unchanged against the Go backend | Recorded PHP cases plus Go replay; Nuxt `ConnectedAccounts.vue` and MCP `me()` stay unchanged. |
+| HTTP-01 | Unknown and malformed ids both return 404 on ownership-scoped resources | Missing identity, foreign identity, and unknown provider share Winter HTML 404. |
+| HTTP-03 | Three mutually exclusive auth groups share the same handlers with different route subsets | Identity routes JWT-only; `/me` stays on the personal-token group. |
+| HTTP-04 | Rate limiter ports Płytarium's inline throttles 1:1 | DELETE carries `throttle:10,1`. |
+| HTTP-06 | Empty arrays serialize as [], timestamps as +00:00 | `scopes` stays `[]`; `linked_at` uses `wire.Time`; `collection_ids` is the D-09 exception (null when unrestricted). |
+| DATA-02 | Each plugin ships a gormigrate migration set with up and down; AutoMigrate is never the schema source | New timestamped migration in sm-user-plugin `updates/`. |
+| DATA-07 | Custom casts for jsonable columns and encrypted-at-rest secrets | `lagoon.Encrypted` tokens; `lagoon.Jsonable` profile_data. |
+| I18N-01 | Translation keys use `vendor.plugin::group.key` | New `golem15.user::lang.oauth.last_method_blocked` EN/PL. |
+</phase_requirements>
+
+## Project Constraints (from CLAUDE.md)
+
+- Lean planning: fewer, larger plans. Unit tests are always the last plan of a phase. Confirm plan count with the user before writing PLAN.md.
+- Standard library first. Add a dependency only when STACK.md or a locked phase decision names it.
+- Compiled plugins registered at build time. No runtime plugin loading.
+- API parity is the acceptance test. Do not "improve" response shapes.
+- Two repositories: `summercms.go` stays app-agnostic; application code lives in `fonoteka.go` and `sm-user-plugin`.
+- A change to a module's exported API, config keys or CLI commands updates that module's README (and `docs/` when the framework surface changes) in the same change.
+- Framework READMEs never name a consuming application.
+- `go vet` and `go test ./...` green at every commit. Planning docs and code in separate commits. No co-author tags.
+
+<research_summary>
+## Summary
+
+Phase 14.1 is a three-route parity close-out, not a new SSO stack. sm-user-plugin already owns users, JWT, and `user_api_tokens`; this phase adds `golem15_user_oauth_identities` plus two exported handlers. The fonoteka plugin mounts those handlers on the existing JWT group at `/_fonoteka/api/v1/oauth-identities` and does **not** add them to `/_user/api/v1` or `/api/v1/fonoteka`. `GET /api/v1/fonoteka/me` is already mounted; the only code change is `collection_ids` null vs `[]`.
+
+The 404 contract is Winter HTML (`text/html; charset=UTF-8`, Polish "Nie znaleziono strony"), not JSON and not Go's `http.NotFound` body. PHP's `HttpException(404, 'OAuth identity not found')` never appears in the recorded fixture. PHP's `{provider}` constraint `google|facebook|github` produces the same production 404 page as a missing row. Go `surf.Where` / `constrain` answers with `http.NotFound` (`404 page not found\n`). The allow-list therefore belongs in the handler, with the host injecting `api.WriteWinterHTTPError`.
+
+No new Go modules. Reuse GORM, gormigrate, `lagoon.Encrypted`, `lagoon.Jsonable`, `wire.WriteJSON` / `wire.Time` / `wire.Slice`, phrasebook, surf `throttle:10,1`, and the existing Winter 404 page.
+
+**Primary recommendation:** Two lean plans — (1) model + migration + exported handlers + fonoteka mount + `/me` null fix + parity recording/manifest flip in `fonoteka.go` and `sm-user-plugin`; (2) unit tests last. Do not add `g.Where("provider", ...)`. Rewrite `assertPortedMismatch` because it currently proves the GET identity route is unported.
+</research_summary>
+
+<architectural_responsibility_map>
+## Architectural Responsibility Map
+
+| Capability | Primary Tier | Secondary Tier | Rationale |
+|------------|-------------|----------------|-----------|
+| List linked identities | API / Backend | Database / Storage | JWT-only GET; explicit `{provider, linked_at}` map from `golem15_user_oauth_identities`. |
+| Unlink one identity | API / Backend | Database / Storage | JWT + `throttle:10,1`; 204 / Winter 404 / 409 JSON; fail-closed on identity count. |
+| Provider allow-list | API / Backend | — | Mount option; unknown provider is the same 404 as a missing row. |
+| Encrypted tokens / profile_data | Database / Storage | API / Backend | At-rest AES-GCM and jsonb; never serialized on these routes. |
+| Personal-token `/me` | API / Backend | — | Already on `/api/v1/fonoteka`; D-09 is a JSON-null fix. |
+| Nuxt Connected accounts tab | Browser / Client | — | Unchanged consumer; 409 copy is client-side, status is server. |
+| fonoteka-mcp `me()` | API / Backend | — | Unchanged client; extra `collection_ids` is ignored by its TypeScript type. |
+| Social login / import mapper | — | — | Deferred (D-08, social-login phase). |
+</architectural_responsibility_map>
+
+<standard_stack>
+## Standard Stack
+
+No new packages. Versions are the pins already in `sm-user-plugin/go.mod` [VERIFIED: `/media/nvme/dev/golem15/summercms.io/summercms/fonoteka.go/plugins/golem15/user/go.mod:3-14`].
+
+### Core
+| Library | Version | Purpose | Why Standard |
+|---------|---------|---------|--------------|
+| Go | 1.27.0 | Language | Project pin; probed `go version go1.27.0-X:nodwarf5`. |
+| GORM | v1.31.2 | ORM | Decided stack; user plugin already requires it. |
+| gormigrate/v2 | v2.1.7 | Up/down migrations | DATA-02; `updates.Register` + `updates.All()`. |
+| lagoon.Encrypted | in-tree | AES-256-GCM columns | DATA-07; redacting marshal. |
+| lagoon.Jsonable | in-tree | JSON column Scan/Value | profile_data; Scan works on jsonb even though `GormDataType` is `text`. |
+| wire | in-tree | JSON, Carbon time, empty slices | HTTP-06; D-09 exception for `collection_ids`. |
+| backpack / pact / surf / bouncer | in-tree | App, plugin, router, JWT | Existing JWT group and 401 writer. |
+| phrasebook | in-tree | `golem15.user::lang.*` | D-03 409 text. |
+
+### Supporting
+| Library | Version | Purpose | When to Use |
+|---------|---------|---------|-------------|
+| golang-jwt/jwt/v5 | v5.3.1 | JWT (already mounted) | Do not re-parse tokens in identity handlers. |
+| testcontainers-go (+ postgres) | v0.44.0 | Real Postgres for migration tests | User plugin `updates/*_test.go` pattern. |
+| testify | v1.12.1 (indirect) | Assertions | Existing `assert`/`require` style; keep `func Test...(*testing.T)`. |
+| go-i18n/v2 | v2.6.1 (indirect) | CLDR via phrasebook | Do not import directly. |
+
+### Alternatives Considered
+| Instead of | Could Use | Tradeoff |
+|------------|-----------|----------|
+| Handler constructors + host mount | `Mount(router, opts)` helper | A Mount helper that wrote Winter 404 would import fonoteka's `api` package into the user plugin. Rejected. |
+| `surf.Where("provider", "google\|facebook\|github")` | Handler allow-list | `Where`/`constrain` uses `http.NotFound` [VERIFIED: `modules/surf/params.go:81-89`]. That body is not Winter HTML. |
+| JSON 404 with `OAuth identity not found` | Winter HTML 404 | PHP throws that message, but the recorded DELETE fixture is the Polish Winter page. |
+| `wire.Slice` for `collection_ids` | JSON null when empty | Phase 8 D-20 used Slice on both arrays; D-09 supersedes it for `collection_ids` only. |
+| New throttle bucket | Inline `"throttle:10,1"` | JWT group already uses that string on CSV import and collection switch. |
+
+**Installation:** none. Do not add require lines.
+
+**Version verification:** pins read from `sm-user-plugin/go.mod` this session. No registry lookup for new names.
+</standard_stack>
+
+## Package Legitimacy Audit
+
+This phase installs no external packages.
+
+| Package | Registry | Age | Downloads | Source Repo | Verdict | Disposition |
+|---------|----------|-----|-----------|-------------|---------|-------------|
+| — | — | — | — | — | — | No new packages |
+
+**Packages removed due to [SLOP] verdict:** none
+**Packages flagged as suspicious [SUS]:** none
+
+<architecture_patterns>
+## Architecture Patterns
+
+### System Architecture Diagram
+
+```text
+Nuxt ConnectedAccounts / MCP me()
+        | JWT Bearer                         | inv_ token Bearer
+        v                                    v
+/_fonoteka/api/v1  (jwt.auth, locale,        /api/v1/fonoteka
+ locale.from-principal,                      (inv_token, throttle:fonoteka-api-token)
+ must-change-password)
+        |
+        +-- GET  /oauth-identities --------> user.OAuthIdentitiesIndex
+        |         | query user_id, ORDER BY provider
+        |         | map {provider, linked_at: *wire.Time}
+        |         v
+        |       200 {"data":[...]}   secrets never in map
+        |
+        +-- DELETE /oauth-identities/{provider}  throttle:10,1
+                  | 1. jwt.auth (no JWT -> 401 JSON)
+                  | 2. provider in allow-list? else Winter HTML 404
+                  | 3. row for (user_id, provider)? else Winter HTML 404
+                  | 4. count(*)==1? -> 409 {"error": phrasebook}
+                  | 5. delete -> 204 empty
+                  v
+              Postgres golem15_user_oauth_identities
+              (Encrypted tokens, jsonb profile_data)
+
+Personal-token GET /me
+        | bouncer.Credential (*models.ApiToken) already matched
+        | scopes: wire.Slice (nil -> [])
+        | collection_ids: null if !Valid or len==0, else list of ints
+        v
+      200 {"data":{scopes, collection_ids, user_id, name}}
+```
+
+### Recommended Project Structure
+```
+fonoteka.go/plugins/golem15/user/          # sm-user-plugin
+├── models/oauth_identity.go               # TableName, Encrypted, Jsonable, init Register
+├── updates/202610050001_create_oauth_identities.go
+├── updates/oauth_identities_test.go
+├── controllers/oauth_identities.go        # Index + Destroy constructors
+├── lang/en/lang.yaml                      # oauth.last_method_blocked
+├── lang/pl/lang.yaml
+└── README.md                              # exported API + table
+
+fonoteka.go/plugins/golem15/fonoteka/
+├── routes.go                              # JWT mount; no Where on provider
+├── controllers/api/me_token_controller.go # D-09 collection_ids null
+└── phase08_coverage_test.go               # assertRouteSurfaces jwt-only
+
+fonoteka.go/parity/
+├── manifest.yaml                          # three pending -> ported; extra cases
+├── parity_test.go                         # 175/175; rewrite assertPortedMismatch
+├── fonoteka_seed_test.go                  # extras oauth-identities / me-unrestricted
+├── fonoteka_reset.php                     # same extras
+└── fixtures/routes/                       # keep empty GET, missing DELETE, restricted /me;
+                                           # add list-with-rows and unrestricted /me
+```
+
+### Pattern 1: Exported handlers, host mount (D-02)
+**What:** sm-user-plugin exports constructors. Fonoteka mounts them on the JWT group. The user plugin's `/_user/api/v1` group stays unchanged [VERIFIED: `fonoteka.go/plugins/golem15/user/routes.go:9-30`].
+**When to use:** Shared plugin owns the table; host owns the public path and Winter 404 page.
+**Recommend (discretion):**
+
+```go
+// sm-user-plugin/controllers/oauth_identities.go
+type OAuthIdentitiesOptions struct {
+	Providers    []string // default google, facebook, github
+	WriteNotFound func(http.ResponseWriter, *http.Request)
+}
+
+func OAuthIdentitiesIndex(app *backpack.App) http.HandlerFunc { /* ... */ }
+
+func OAuthIdentitiesDestroy(app *backpack.App, opts OAuthIdentitiesOptions) http.HandlerFunc { /* ... */ }
+```
+
+Fonoteka JWT group [VERIFIED: `fonoteka.go/plugins/golem15/fonoteka/routes.go:48`]:
+
+```go
+r.Group("/_fonoteka/api/v1", surf.Use("jwt.auth", "locale.from-principal", "inv.must-change-password"), func(g pact.Router) {
+	// ...
+	g.Get("/oauth-identities", userctrl.OAuthIdentitiesIndex(p.app))
+	g.Delete("/oauth-identities/{provider}", userctrl.OAuthIdentitiesDestroy(p.app, userctrl.OAuthIdentitiesOptions{
+		WriteNotFound: func(w http.ResponseWriter, r *http.Request) {
+			api.WriteWinterHTTPError(w, p.app, http.StatusNotFound)
+		},
+	}), "throttle:10,1")
+})
+```
+
+Default providers match PHP [VERIFIED: `fonoteka/plugins/golem15/fonoteka/routes.php:321`]: `->where('provider', 'google|facebook|github')->middleware('throttle:10,1')`.
+
+Do **not** add a `Mount` helper that imports `fonoteka/controllers/api`. The user plugin cannot take that dependency.
+
+### Pattern 2: Explicit response map (D-05)
+PHP index [VERIFIED: `fonoteka/plugins/golem15/fonoteka/controllers/api/OAuthIdentityApiController.php:31-39`]:
+
+```php
+$values = OAuthIdentity::where('user_id', $user->id)
+    ->orderBy('provider')
+    ->get()
+    ->map(static fn (OAuthIdentity $identity) => [
+        'provider' => (string) $identity->provider,
+        'linked_at' => $identity->linked_at?->toIso8601String(),
+    ]);
+return response()->json(['data' => $values->values()]);
+```
+
+Go: `wire.WriteJSON` of `map[string]any{"data": rows}` where each row is `map[string]any{"provider": ..., "linked_at": (*wire.Time | nil)}`. Never `json.Marshal` the GORM model. `lagoon.Encrypted.MarshalJSON` redacts to `"[redacted]"` [VERIFIED: `modules/lagoon/encrypted.go:49-52`], which would still leak the key name if the model were serialized. PHP tests forbid `access_token`, `refresh_token`, `profile_data`, `user_id`, and the plaintext secret in the body [VERIFIED: `fonoteka/plugins/golem15/fonoteka/tests/functional/OAuthIdentityApiTest.php:50-55`].
+
+### Pattern 3: Fail-closed unlink (D-06)
+PHP destroy [VERIFIED: `fonoteka/plugins/golem15/fonoteka/controllers/api/OAuthIdentityApiController.php:52-68`]:
+
+```php
+$identity = OAuthIdentity::where('user_id', $user->id)->where('provider', $provider)->first();
+if (!$identity) { throw new HttpException(404, 'OAuth identity not found'); }
+if (OAuthIdentity::where('user_id', $user->id)->count() === 1) {
+    return response()->json(['error' => Lang::get('golem15.fonoteka::lang.oauth.last_method_blocked')], 409);
+}
+$identity->delete();
+return response()->noContent();
+```
+
+Go must count identities only. `User.HasSelfSetPassword` exists [VERIFIED: `fonoteka.go/plugins/golem15/user/models/user.go:27`] and must not be read. 409 body: `{"error": <phrasebook Get>}` with key `golem15.user::lang.oauth.last_method_blocked` (D-03). EN/PL strings [VERIFIED: `fonoteka/plugins/golem15/fonoteka/lang/en/lang.php:135-137`] and [VERIFIED: `fonoteka/plugins/golem15/fonoteka/lang/pl/lang.php:135-137`]:
+
+- EN: `This is the only remaining way to sign in. Link another method before disconnecting this one.`
+- PL: `To jedyna droga logowania na to konto. Najpierw podłącz inną, zanim odetniesz tę.`
+
+204: empty body, status 204 (PHP `noContent()`).
+
+### Pattern 4: Winter HTML 404, not router 404
+Recorded missing-row DELETE [VERIFIED: `fonoteka.go/parity/fixtures/routes/DELETE___fonoteka_api_v1_oauth-identities_{provider}_jwt.yaml:13-31`]: status 404, `Content-Type: "text/html; charset=UTF-8"`, title `Nie znaleziono strony`. That page is `winter_404.html` [VERIFIED: `fonoteka.go/plugins/golem15/fonoteka/controllers/api/winter_404.html:1-14`]. Host writers: `WriteWinterHTTPError` [VERIFIED: `fonoteka.go/plugins/golem15/fonoteka/controllers/api/http_errors.go:44-72`].
+
+The user plugin's `writeWinterErrorPage` always writes **500** [VERIFIED: `fonoteka.go/plugins/golem15/user/controllers/api_controller.go:1073-1077`]. Do not reuse it for identity 404s.
+
+PHP constraint miss and missing row are the same Winter production 404 page (this session: fixture is missing-row; Laravel unmatched `{provider}` also renders that page). Go `constrain` [VERIFIED: `modules/surf/params.go:85-89`]: `http.NotFound(w, r)`. `routes.snapshot` records path+method+auth group only, not the regex [VERIFIED: `fonoteka.go/parity/routes.snapshot:101-102`]:
+
+```
+GET /_fonoteka/api/v1/oauth-identities jwt
+DELETE /_fonoteka/api/v1/oauth-identities/{provider} jwt
+```
+
+Precedent: oauth `request_id` constraint was loosened so the controller 404 is reachable [VERIFIED: `fonoteka.go/plugins/golem15/fonoteka/routes.go:238-254`].
+
+### Pattern 5: D-09 `/me` collection_ids null
+PHP [VERIFIED: `fonoteka/plugins/golem15/fonoteka/models/ApiToken.php:89-94`]:
+
+```php
+public function collectionIds(): ?array
+{
+    $ids = $this->collection_ids;
+    return is_array($ids) && $ids !== [] ? array_values(array_map('intval', $ids)) : null;
+}
+```
+
+PHP me [VERIFIED: `fonoteka/plugins/golem15/fonoteka/controllers/api/MeTokenController.php:29-36`]: `'scopes' => $token?->scopes ?? []`, `'collection_ids' => $token?->collectionIds()`.
+
+Today's Go [VERIFIED: `fonoteka.go/plugins/golem15/fonoteka/controllers/api/me_token_controller.go:41-46`] uses `wire.Slice` on both. Change only `collection_ids`: if `!token.CollectionIDs.Valid || len(token.CollectionIDs.Get()) == 0` emit JSON `null`; else emit the int list. Keep `scopes` as `wire.Slice`. Rewrite `TestMeTokenHandlerNilScopesAndCollectionIDsSerializeAsEmptyArraysAndNullableName` [VERIFIED: `me_token_controller_test.go:113-117`], which currently forbids `"collection_ids":null`.
+
+Restricted fixture stays `collection_ids:[{{id:token}}]` [VERIFIED: `GET__api_v1_fonoteka_me_personal_token.yaml:19`]. MCP `MeResponse` only types `scopes`, `user_id`, `name` [VERIFIED: `fonoteka/fonoteka-mcp/src/client.ts:54-59`]; extra `collection_ids` is ignored.
+
+### Pattern 6: Migration + model registration
+Follow `202610040001_create_api_tokens.go` [VERIFIED: lines 7-36]: `tx.Exec` DDL, `init() { Register(...) }`, postgres test via `gormigrate.New(..., TableName: "summer_migrations_golem15_user", UseTransaction: true)`. `plugin.go` already returns `updates.All()` / `models.All()` [VERIFIED: `plugin.go:207-209`]. New model `init() { Register(OAuthIdentity{}) }` like `APIToken`.
+
+Table [VERIFIED: PHP migration `create_oauth_identities_table.php:14-36`]: `golem15_user_oauth_identities`; unique `oauth_identities_user_provider_unique` on `(user_id, provider)`; unique `oauth_identities_provider_identity_unique` on `(provider, provider_id)`; FK `user_id` → `users(id)` ON DELETE CASCADE. Do **not** port the PHP `users.oauth_*` backfill (D-07).
+
+`profile_data jsonb` (D-07) even though `Jsonable.GormDataType` returns `text` [VERIFIED: `modules/lagoon/jsonable.go:84-85`]. Use SQL `jsonb` in the migration; `Jsonable.Scan` accepts `[]byte` from Postgres jsonb.
+
+### Anti-Patterns to Avoid
+- **Serializing the model:** leaks Encrypted keys as `"[redacted]"` and `profile_data`.
+- **`g.Where("provider", ...)`:** text/plain 404, not Winter HTML; also 404s unauthenticated unknown providers before `jwt.auth` (PHP constraint is pre-auth; D-11 401 tests use `/google`).
+- **JSON 404 with the HttpException message:** not what PHP production recorded.
+- **`wire.Slice` on `collection_ids`:** contradicts D-09.
+- **Registering identity routes on `/_user/api/v1`:** D-02 forbids it.
+- **Consulting `has_self_set_password` on unlink:** D-06.
+- **Winter-import mapper / social login:** D-08 / deferred.
+- **Leaving `assertPortedMismatch` pointed at GET oauth-identities:** it currently requires that replay to fail with 200 vs 404 [VERIFIED: `parity_test.go:456-500`].
+</architecture_patterns>
+
+<dont_hand_roll>
+## Don't Hand-Roll
+
+| Problem | Don't Build | Use Instead | Why |
+|---------|-------------|-------------|-----|
+| AES at rest | Custom cipher | `lagoon.Encrypted` | Key derivation, previous-key Scan, redacting marshal already exist. |
+| JSON column | `json.RawMessage` + ad-hoc null | `lagoon.Jsonable[map[string]any]` | Valid vs empty vs SQL NULL. |
+| Carbon `+00:00` | `time.RFC3339` / `Z` | `wire.Time` | Layout `2006-01-02T15:04:05` + `+00:00` [VERIFIED: `modules/wire/response.go:32-43`]. |
+| Winter 404 HTML | String-concat PHP page | `api.WriteWinterHTTPError` | Origin substitution, headers, embed. |
+| 401 JSON | New envelope | Group `jwt.auth` → `bouncer.write401` | `{"error":true,"message":...}` + `Cache-Control: no-cache, private` [VERIFIED: `modules/bouncer/jwt.go:367-373`]. |
+| 409 locale strings | Hard-coded English | phrasebook `Get` | I18N-01; D-03 key in user lang YAML. |
+| Empty JSON array | Custom nil check for scopes | `wire.Slice` | HTTP-06 for `scopes` and GET empty `data`. |
+| Migrations | GORM AutoMigrate | gormigrate `tx.Exec` | DATA-02. |
+| Rate limit | New bucket type | surf `"throttle:10,1"` | Same string as CSV import [VERIFIED: `routes.go:60`]. |
+
+**Key insight:** The parity bytes already exist. The work is wiring PHP's controller into the Go plugin split without inventing a second 404 writer or a second crypto path.
+</dont_hand_roll>
+
+## Runtime State Inventory
+
+This phase adds a table and ports routes. It does not rename existing keys. Inventory is for the new schema and secrets.
+
+| Category | Items Found | Action Required |
+|----------|-------------|------------------|
+| Stored data | New table `golem15_user_oauth_identities` (PHP already has it in production dumps). Unique indexes and cascade FK as in PHP. No backfill from `users.oauth_*`. | Code: gormigrate in sm-user-plugin. Data: Phase 15 import (out of scope). Empty on fresh Go DBs until seed/import. |
+| Live service config | None — no n8n/Datadog/Centrifugo config keys for these routes. | None — verified: routes are in-process HTTP. |
+| OS-registered state | None — no systemd/cron names for oauth-identities. | None — verified: prune-notifications is unrelated. |
+| Secrets/env vars | `access_token` / `refresh_token` columns; `app.key` already required for `lagoon.Encrypted`. No new env names. Laravel ciphertext is not decryptable by GCM until Phase 15. | Code: Encrypted columns. Do not decrypt PHP rows in this phase (D-08). Seed tests use `lagoon.NewEncrypted` under the test app key. |
+| Build artifacts | sm-user-plugin submodule; `routes.snapshot` already lists the three paths. | Rebuild via normal `go test` / air. Snapshot does not need regex. `expectedPortedRoutes` 172→175. |
+
+**Nothing found in category:** Live service config and OS-registered state — none for this surface.
+
+<common_pitfalls>
+## Common Pitfalls
+
+### Pitfall 1: Router constraint vs Winter 404
+**What goes wrong:** `g.Where("provider", "google|facebook|github")` returns `404 page not found\n` (`text/plain`).
+**Why it happens:** `constrain` calls `http.NotFound` [VERIFIED: `modules/surf/params.go:85-89`].
+**How to avoid:** No `Where` on `{provider}`. Check the allow-list in Destroy; call host `WriteNotFound`.
+**Warning signs:** Parity DELETE unknown-provider (Go unit test) fails Content-Type or body; unauthenticated `/linkedin` 404s instead of 401.
+
+### Pitfall 2: HttpException message vs recorded 404
+**What goes wrong:** JSON `{"message":"OAuth identity not found"}`.
+**Why it happens:** PHP throws `HttpException(404, 'OAuth identity not found')` [VERIFIED: `OAuthIdentityApiController.php:56-58`], but Winter production renders HTML. Recorded fixture is HTML [VERIFIED: DELETE fixture lines 13-31].
+**How to avoid:** Always Winter HTML for missing, foreign, and unknown provider. Foreign and missing bodies must be byte-identical [VERIFIED: `OAuthIdentityApiTest.php:101-113`].
+**Warning signs:** Nuxt treats 404 as JSON parse error; parity HTML diff.
+
+### Pitfall 3: `wire.Slice` on `collection_ids`
+**What goes wrong:** unrestricted `/me` emits `"collection_ids":[]`.
+**Why it happens:** Phase 8 D-20 comment says arrays never serialize as null [VERIFIED: `me_token_controller.go:18-19`]. D-09 supersedes that for this field only.
+**How to avoid:** Null when invalid or empty; Slice only for `scopes`. Update the nil-array unit test.
+**Warning signs:** D-10 unrestricted fixture fails; MCP still works (it ignores the field).
+
+### Pitfall 4: `linked_at` as `Z`
+**What goes wrong:** `"2026-10-05T12:00:00Z"` vs Carbon `+00:00`.
+**Why it happens:** `time.Time` RFC3339. Existing GET fixture is empty `{"data":[]}` [VERIFIED: GET oauth-identities fixture line 18], so D-10 recording pins the format.
+**How to avoid:** `wire.Time` [VERIFIED: `modules/wire/response.go:41-43`]: `t.UTC().Format("2006-01-02T15:04:05") + "+00:00"`. Null `linked_at` stays JSON null.
+**Warning signs:** D-10 list-with-rows fixture timestamp mismatch.
+
+### Pitfall 5: `assertPortedMismatch` still targets GET oauth-identities
+**What goes wrong:** After the route is ported, the helper fatals `"unported PHP route must not pass"`.
+**Why it happens:** Phase 14 used this pending route as the negative probe [VERIFIED: `parity_test.go:458-461`].
+**How to avoid:** Point it at a synthetic mismatch (the sibling `assertPortedMutationCaught` pattern) or a deliberately wrong expected status on a ported fixture. There will be zero pending routes (D-12).
+**Warning signs:** `TestParityCorpus` fails only on this helper after 175/175.
+
+### Pitfall 6: phase08 `assertAbsent("oauth-identit")`
+**What goes wrong:** Surface isolation test fails once routes exist.
+**Why it happens:** Deferred comment [VERIFIED: `phase08_coverage_test.go:663-666`].
+**How to avoid:** `assertRouteSurfaces(t, rt, GET, "/oauth-identities", true, false)` and DELETE `"/oauth-identities/{provider}"` jwt-only, matching PHP [VERIFIED: `TokenSurfaceIsolationTest.php:185-189`].
+**Warning signs:** `test_oauth_identity_routes_exist_on_jwt_surface_only` fail.
+
+### Pitfall 7: Putting identity routes on `/_user/api/v1`
+**What goes wrong:** Snapshot and Nuxt break (`baseURL` is `/_fonoteka/api/v1`).
+**Why it happens:** Natural place for user-plugin handlers.
+**How to avoid:** D-02; leave `user/routes.go` unchanged [VERIFIED: lines 9-30].
+**Warning signs:** Nuxt `fetchOAuthIdentities` 404 [VERIFIED: `useFonoteka.ts:501-507`].
+
+### Pitfall 8: Seed extras only on one side
+**What goes wrong:** PHP recording and Go replay diverge.
+**Why it happens:** D-10 needs alice facebook+google and an unrestricted token. Extras live in both `fonoteka_reset.php` `$extras` [VERIFIED: lines 119-128] and `fonotekaCaseExtras` [VERIFIED: `fonoteka_seed_test.go:37-38`].
+**How to avoid:** Add the same extra names on both sides; key extras as `"<route id>#<case id>"`. Keep empty GET / missing DELETE / restricted `/me`.
+**Warning signs:** Empty-list fixture suddenly contains rows; secrets appear in GET body.
+
+### Pitfall 9: Manifest counts
+**What goes wrong:** `expectedPHPRoutes = 175`, `expectedPortedRoutes = 172` [VERIFIED: `parity_test.go:28-29`] left unchanged. Phase 14 gate `EXPECTED_PENDING=3` is a Phase 14 artifact, not this phase's gate.
+**How to avoid:** 175 / 175 / 0. Flip three `status: pending` entries [VERIFIED: manifest.yaml 2801-2805, 2819-2823, 3406-3410].
+**Warning signs:** Corpus summary still prints `pending 3`.
+</common_pitfalls>
+
+<code_examples>
+## Code Examples
+
+Verified in-repo values. Quotes are the checkable source.
+
+### Table, indexes, constraint
+```php
+// [VERIFIED: fonoteka/plugins/golem15/user/updates/v3.3.0/create_oauth_identities_table.php:14-36]
+Schema::create('golem15_user_oauth_identities', function (Blueprint $table) {
+    $table->increments('id');
+    $table->integer('user_id')->unsigned();
+    $table->string('provider', 50);
+    $table->string('provider_id', 255);
+    $table->text('access_token')->nullable();
+    $table->text('refresh_token')->nullable();
+    $table->timestamp('token_expires_at')->nullable();
+    $table->json('profile_data')->nullable();
+    $table->timestamp('linked_at')->nullable();
+    $table->timestamps();
+    $table->unique(['user_id', 'provider'], 'oauth_identities_user_provider_unique');
+    $table->unique(['provider', 'provider_id'], 'oauth_identities_provider_identity_unique');
+    $table->foreign('user_id')->references('id')->on('users')->onDelete('cascade');
+});
+```
+
+PHP model table name [VERIFIED: `OAuthIdentity.php:19`]: `public $table = 'golem15_user_oauth_identities';`
+PHP `$guarded = ['*']` [VERIFIED: `OAuthIdentity.php:21`].
+
+### Route mount, throttle, providers
+```php
+// [VERIFIED: fonoteka/plugins/golem15/fonoteka/routes.php:320-321]
+Route::get('oauth-identities', ...);
+Route::delete('oauth-identities/{provider}', ...)->where('provider', 'google|facebook|github')->middleware('throttle:10,1');
+```
+
+Go JWT group middleware [VERIFIED: `fonoteka.go/plugins/golem15/fonoteka/routes.go:48`]: `surf.Use("jwt.auth", "locale.from-principal", "inv.must-change-password")`.
+Go `/me` mount [VERIFIED: `routes.go:262-265`]: `r.Group("/api/v1/fonoteka", surf.Use("inv_token", "throttle:fonoteka-api-token"), ...)` then `g.Get("/me", api.MeToken(p.app), "inv.scope:read")`.
+
+### Empty GET and restricted `/me` bytes
+```
+// [VERIFIED: GET___fonoteka_api_v1_oauth-identities_jwt.yaml:18]
+{"data":[]}
+
+// [VERIFIED: GET__api_v1_fonoteka_me_personal_token.yaml:19]
+{"data":{"scopes":["read","write","ai"],"collection_ids":[{{id:token}}],"user_id":{{id:token}},"name":"parity-mcp"}}
+```
+
+### wire.Time and Slice
+```go
+// [VERIFIED: modules/wire/response.go:32-43, 83-89]
+type Time struct{ time.Time }
+func (t Time) MarshalJSON() ([]byte, error) {
+	s := t.UTC().Format("2006-01-02T15:04:05") + "+00:00"
+	return []byte(`"` + s + `"`), nil
+}
+func Slice[T any](s []T) []T {
+	if s == nil { return []T{} }
+	return s
+}
+```
+
+### Encrypted redaction
+```go
+// [VERIFIED: modules/lagoon/encrypted.go:49-52]
+func (e Encrypted) MarshalJSON() ([]byte, error) {
+	return json.Marshal(redactedLiteral) // "[redacted]"
+}
+```
+
+### Nuxt consumers (unchanged)
+```ts
+// [VERIFIED: vue-fonoteka-app/shared/types/fonoteka.ts:364-371]
+export interface OAuthIdentityMeta {
+  provider: string
+  linked_at: string | null
+}
+export interface OAuthIdentitiesResponse {
+  data: OAuthIdentityMeta[]
+}
+
+// [VERIFIED: stores/fonoteka.ts:728-745] 409 uses client copy, not backend English
+```
+
+### Suggested Destroy skeleton (planner/executor)
+```go
+func OAuthIdentitiesDestroy(app *backpack.App, opts OAuthIdentitiesOptions) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		provider := r.PathValue("provider")
+		if !allowed(opts.Providers, provider) {
+			opts.WriteNotFound(w, r)
+			return
+		}
+		user, _ := bouncer.User(r.Context())
+		// lookup by user.ID + provider; missing -> WriteNotFound
+		// count == 1 -> wire.WriteJSON 409 {"error": tr.Get(ctx, "golem15.user::lang.oauth.last_method_blocked", nil)}
+		// delete -> w.WriteHeader(204)
+	}
+}
+```
+Do not copy this as production without filling DB lookups; names `OAuthIdentitiesDestroy`, `WriteNotFound`, `golem15.user::lang.oauth.last_method_blocked`, providers `google|facebook|github`, statuses 404/409/204 are locked.
+</code_examples>
+
+<sota_updates>
+## State of the Art
+
+| Old Approach | Current Approach | When Changed | Impact |
+|--------------|------------------|--------------|--------|
+| PHP controller in fonoteka plugin (D-15 compromise) | Handlers in sm-user-plugin, host mount (D-02) | This phase | Shared plugin owns the table API; paths stay `/_fonoteka/...`. |
+| Phase 8 D-20: both arrays via `wire.Slice` | D-09: `collection_ids` null when unrestricted | This phase | Must rewrite the nil-array unit test. |
+| Identity routes `assertAbsent` | `assertRouteSurfaces` jwt-only | This phase | phase08 coverage comment is obsolete. |
+| `assertPortedMismatch` probes pending GET identities | Synthetic mismatch on a ported fixture | This phase | Zero pending routes. |
+| Laravel `encrypt()` ciphertext | `lagoon.Encrypted` AES-GCM | Existing | Import remap is Phase 15, not here. |
+
+**Deprecated/outdated:**
+- Treating `/me` as "minimal bootstrap" with `[]` for unrestricted collections.
+- Assuming PHP 404 JSON from `HttpException` message text.
+</sota_updates>
+
+## Assumptions Log
+
+| # | Claim | Section | Risk if Wrong |
+|---|-------|---------|---------------|
+| A1 | Unauthenticated unknown provider is 401 in Go (jwt.auth first) vs PHP 404 (constraint before middleware). D-11 401 tests use `/google`. Not a recorded parity case. | Pitfall 1 | If a future fixture hits `/linkedin` without JWT, PHP 404 vs Go 401. Keep tests on `/google` for 401. |
+| A2 | Laravel `$table->json()` on this Postgres is json; D-07 still requires jsonb. Jsonable Scan accepts both. | Pattern 6 | Column type drift at Phase 15 import if dump is `json` not `jsonb`. Planner should CREATE as jsonb per D-07. |
+
+No other `[ASSUMED]` implementation claims. Timestamp format is verified via `wire.Time` source; D-10 recording confirms bytes.
+
+## Open Questions
+
+1. **`assertPortedMismatch` replacement**
+   - What we know: it requires GET oauth-identities replay to fail 200 vs 404.
+   - What's unclear: exact replacement helper (synthetic mutation vs drop).
+   - Recommendation: reuse `assertPortedMutationCaught` style; do not keep a pending-route probe after D-12.
+
+2. **Unrestricted `/me` token identity**
+   - What we know: `mcp-read` is restricted (`collection_ids:[{{id:token}}]`).
+   - What's unclear: token name/store key for the new D-10 case.
+   - Recommendation: new seed extra mints a second alice token with SQL NULL / empty `collection_ids`; do not mutate `mcp-read`.
+
+## Environment Availability
+
+| Dependency | Required By | Available | Version | Fallback |
+|------------|------------|-----------|---------|----------|
+| Go | build/test | ✓ | 1.27.0-X:nodwarf5 | — |
+| Docker | testcontainers | ✓ | 29.7.2 | — |
+| PostgreSQL | migrations, parity | ✓ | psql 18.6 | testcontainers if local cluster busy |
+| PHP CLI | D-10 recording | ✓ | 8.5.10 | — |
+
+**Missing dependencies with no fallback:** none
+**Missing dependencies with fallback:** none
+
+## Validation Architecture
+
+### Test Framework
+| Property | Value |
+|----------|-------|
+| Framework | Go `testing` + testcontainers-go v0.44.0 (user plugin); parity `tide` replay in `fonoteka.go/parity` |
+| Config file | none — `go test`; gate script is Phase 14's `scripts/check-phase14.sh` (do not retarget it; this phase is 14.1) |
+| Quick run command | `go test ./plugins/golem15/user/... ./plugins/golem15/fonoteka/controllers/api/... -count=1` in fonoteka.go workspace |
+| Full suite command | `go vet ./... && go test ./... -count=1` in summercms.go; same plus `./plugins/golem15/user/... ./plugins/golem15/fonoteka/... ./parity/...` in fonoteka.go |
+
+### Phase Requirements → Test Map
+| Req ID | Behavior | Test Type | Automated Command | File Exists? |
+|--------|----------|-----------|-------------------|-------------|
+| API-09 | Three routes ported, 0 pending | parity | `go test ./parity -run TestParityCorpus -count=1` | ✅ extend |
+| HTTP-03 / D-11 | JWT-only identities; token group never gains them | unit | `go test ./plugins/golem15/fonoteka -run 'TokenSurface\|oauth_identity' -count=1` | ✅ flip `assertAbsent` |
+| HTTP-01 / D-04 | Missing, foreign, unknown provider → identical Winter 404 | unit | new `oauth_identities_test.go` | ❌ Wave 0 |
+| D-06 / I18N-01 | Last identity 409 EN/PL | unit | same | ❌ Wave 0 |
+| D-11 | Unlink 204 keeps other row; 401 without JWT | unit | port of `OAuthIdentityApiTest.php` | ❌ Wave 0 |
+| D-09 | `/me` unrestricted `collection_ids` null | unit + parity | rewrite `TestMeTokenHandlerNil...`; new fixture | ✅ rewrite |
+| DATA-02 | Migration up/down, indexes, jsonb, FK | integration | `go test ./plugins/golem15/user/updates -count=1` | ❌ Wave 0 |
+| DATA-07 | Encrypted tokens never in GET body | unit + parity | PHP test port + D-10 fixture | ❌ Wave 0 |
+| HTTP-04 | DELETE `throttle:10,1` | unit (middleware list) | `assertRouteSurfaces` + middleware contains throttle | ✅ extend |
+| QA-05 | Nuxt/MCP unchanged | manual-only | exercise Connected accounts + MCP `me()` against Go | N/A consumers frozen |
+
+### Sampling Rate
+- **Per task commit:** quick run command above + `go vet` on touched packages
+- **Per wave merge:** full suite in both repos
+- **Phase gate:** `TestParityCorpus` prints `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`; user plugin and fonoteka `go test ./...` green
+
+### Wave 0 Gaps
+- [ ] `plugins/golem15/user/controllers/oauth_identities_test.go` — D-11 behaviours
+- [ ] `plugins/golem15/user/updates/oauth_identities_test.go` — migration up/down
+- [ ] Rewrite `me_token_controller_test.go` nil-collection assertion
+- [ ] Rewrite `parity/parity_test.go` `assertPortedMismatch`
+- [ ] D-10 fixtures + `fonotekaCaseExtras` / `fonoteka_reset.php` extras
+- [ ] Flip `phase08_coverage_test.go` oauth identity `assertAbsent`
+- [ ] sm-user-plugin README API + table row
+
+Existing infrastructure covers parity replay, testcontainers migration tests, and JWT group assembly. No new test framework.
+
+## Security Domain
+
+### Applicable ASVS Categories
+
+| ASVS Category | Applies | Standard Control |
+|---------------|---------|-----------------|
+| V2 Authentication | yes | Group `jwt.auth` / `inv_token`; do not re-parse Bearer in handlers |
+| V3 Session Management | no | No new cookies or refresh |
+| V4 Access Control | yes | Owner-scoped `user_id`; foreign unlink is 404 not 403; token group never lists identities |
+| V5 Input Validation | yes | Provider allow-list; `{provider}` is a path string, not SQL |
+| V6 Cryptography | yes | `lagoon.Encrypted` for tokens; never log `Reveal()` |
+
+### Known Threat Patterns for this stack
+
+| Pattern | STRIDE | Standard Mitigation |
+|---------|--------|---------------------|
+| Token/profile leak in GET body | Information Disclosure | Explicit map; Encrypted `json:"-"`; D-10 fixture with secrets that must not appear |
+| IDOR unlink of another user's identity | Elevation / Tampering | `WHERE user_id = caller`; 404 not 403 |
+| Last-method lockout bypass | Elevation | Fail-closed count===1 → 409; ignore password flag |
+| Mass assignment of tokens | Tampering | Empty Fillable / no `lagoon.Fill` on this model; tests assign fields explicitly |
+| Unknown provider probing | Information Disclosure | Same Winter 404 as missing row |
+| Identity routes on personal token | Elevation | TokenSurfaceIsolation; never mount on `/api/v1/fonoteka` |
+| Throttle bypass on DELETE | Denial of Service | `"throttle:10,1"` on the DELETE registration |
+| Laravel ciphertext treated as GCM | Tampering / Disclosure | No import this phase (D-08) |
+
+## Recommended Plan Split (discretion)
+
+Lean mode: **two plans**, confirm with the user before PLAN.md.
+
+1. **14.1-01 Implementation** — model, migration, lang keys, exported handlers, fonoteka JWT mount without `Where`, `/me` null fix, parity extras + PHP recording + manifest flip + snapshot (already has paths) + `expectedPortedRoutes` + `assertPortedMismatch` rewrite + README. Smoke: one Go test that GET empty list returns `{"data":[]}` is allowed; full coverage is plan 2.
+2. **14.1-02 Unit tests (last)** — port `OAuthIdentityApiTest.php`, EN/PL 409, byte-identical 404s, unknown provider, 401 on `/google`, jwt-only surfaces, migration tests, rewritten MeToken tests, threat tests for secret leak.
+
+Do not put framework module API changes in summercms.go unless a bug in `wire`/`lagoon` is found (none expected).
+
+## Sources
+
+### Primary (HIGH confidence)
+- PHP `OAuthIdentityApiController.php`, `MeTokenController.php`, `ApiToken.php`, `OAuthIdentity.php`, `create_oauth_identities_table.php`, `routes.php:320-321`, lang EN/PL `oauth.last_method_blocked`, `OAuthIdentityApiTest.php`, `TokenSurfaceIsolationTest.php` — Read this session
+- Go `me_token_controller.go` + test, `http_errors.go`, `winter_404.html`, `routes.go`, `user/routes.go`, `plugin.go`, `parity_test.go`, fixtures, `manifest.yaml`, `routes.snapshot`, `wire/response.go`, `lagoon/{encrypted,jsonable}.go`, `surf/params.go`, `bouncer/jwt.go` — Read this session
+- Nuxt types/composables/store; MCP `client.ts` — Read this session
+- `14.1-CONTEXT.md` locked decisions; `REQUIREMENTS.md`; `CLAUDE.md`
+
+### Secondary (MEDIUM confidence)
+- Laravel unmatched route constraint renders the same Winter 404 page as `HttpException(404)` in production (`APP_DEBUG=false`). Confirmed by the recorded missing-row HTML and Winter's production error pages already embedded in Go; constraint-miss was not a separate recorded fixture.
+
+### Tertiary (LOW confidence)
+- None required; no new libraries.
+
+## Metadata
+
+**Research scope:**
+- Core technology: Go net/http handlers, GORM/gormigrate, existing SummerCMS modules
+- Ecosystem: no new packages
+- Patterns: host-mounted shared-plugin handlers, Winter HTML 404, explicit DTO map, fail-closed unlink
+- Pitfalls: surf.Where, Slice-on-collection_ids, assertPortedMismatch, phase08 assertAbsent
+
+**Confidence breakdown:**
+- Standard stack: HIGH — in-repo pins, no new deps
+- Architecture: HIGH — PHP controller + Go mount points read in full
+- Pitfalls: HIGH — fixtures and failing-helper sites read in full
+- Code examples: HIGH — verbatim quotes with line ranges
+
+**Research date:** 2026-10-05
+**Valid until:** 2026-11-04 (30 days; in-repo contract, not a fast-moving ecosystem)
+
+---
+
+*Phase: 14.1-oauth-identities-and-fonoteka-me-routes*
+*Research completed: 2026-10-05*
+*Ready for planning: yes*

.planning/phases/14.1-oauth-identities-and-fonoteka-me-routes/14.1-VALIDATION.md

@@ -0,0 +1,91 @@
+---
+phase: "14.1"
+slug: "oauth-identities-and-fonoteka-me-routes"
+# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
+# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: "2026-10-05"
+---
+
+# Phase 14.1 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Go `testing` + testcontainers-go v0.44.0 (user plugin); parity `tide` replay in `fonoteka.go/parity` |
+| **Config file** | none — `go test`; do not retarget Phase 14's `scripts/check-phase14.sh` |
+| **Quick run command** | `go test ./plugins/golem15/user/... ./plugins/golem15/fonoteka/controllers/api/... -count=1` in fonoteka.go |
+| **Full suite command** | `go vet ./... && go test ./... -count=1` in summercms.go; same plus `./plugins/golem15/user/... ./plugins/golem15/fonoteka/... ./parity/...` in fonoteka.go |
+| **Estimated runtime** | ~90 seconds quick; several minutes full (parity + testcontainers) |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run the quick run command above plus `go vet` on touched packages
+- **After every plan wave:** Run the full suite in both repos
+- **Before `$gsd-verify-work`:** Full suite must be green; `TestParityCorpus` prints `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0`
+- **Max feedback latency:** 90 seconds (quick); full suite is the wave gate
+
+---
+
+## Per-Task Verification Map
+
+Filled after plans exist. Seeded from RESEARCH.md Validation Architecture:
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| 14.1-W0 | 02 | 2 | API-09 | — | Three routes ported, 0 pending | parity | `go test ./parity -run TestParityCorpus -count=1` | ✅ extend | ⬜ pending |
+| 14.1-W0 | 02 | 2 | HTTP-03 | T-14.1-SC | JWT-only identities; token group never gains them | unit | `go test ./plugins/golem15/fonoteka -count=1` | ✅ flip `assertAbsent` | ⬜ pending |
+| 14.1-W0 | 02 | 2 | HTTP-01 | T-14.1-* | Missing, foreign, unknown provider → identical Winter 404 | unit | new `oauth_identities_test.go` | ❌ W0 | ⬜ pending |
+| 14.1-W0 | 02 | 2 | D-06 / I18N-01 | T-14.1-* | Last identity 409 EN/PL | unit | same | ❌ W0 | ⬜ pending |
+| 14.1-W0 | 01 | 1 | D-09 | — | `/me` unrestricted `collection_ids` null | unit + parity | rewrite MeToken test; new fixture | ✅ rewrite | ⬜ pending |
+| 14.1-W0 | 02 | 2 | DATA-02 | — | Migration up/down, indexes, jsonb, FK | integration | `go test ./plugins/golem15/user/updates -count=1` | ❌ W0 | ⬜ pending |
+| 14.1-W0 | 02 | 2 | DATA-07 | T-14.1-* | Encrypted tokens never in GET body | unit + parity | PHP test port + D-10 fixture | ❌ W0 | ⬜ pending |
+| 14.1-W0 | 01 | 1 | HTTP-04 | T-14.1-* | DELETE `throttle:10,1` | unit | `assertRouteSurfaces` + middleware contains throttle | ✅ extend | ⬜ pending |
+| 14.1-W0 | — | — | QA-05 | — | Nuxt/MCP unchanged | manual-only | Connected accounts + MCP `me()` against Go | N/A | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `plugins/golem15/user/controllers/oauth_identities_test.go` — D-11 behaviours
+- [ ] `plugins/golem15/user/updates/oauth_identities_test.go` — migration up/down
+- [ ] Rewrite `me_token_controller_test.go` nil-collection assertion
+- [ ] Rewrite `parity/parity_test.go` `assertPortedMismatch`
+- [ ] D-10 fixtures + `fonotekaCaseExtras` / `fonoteka_reset.php` extras
+- [ ] Flip `phase08_coverage_test.go` oauth identity `assertAbsent`
+- [ ] sm-user-plugin README API + table row
+
+Existing infrastructure covers parity replay, testcontainers migration tests, and JWT group assembly. No new test framework.
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Nuxt Connected accounts tab still talks to Go | QA-05 | Consumers are frozen; no Go-side UI | Sign in, open Settings → Connected accounts; list/unlink against the Go backend |
+| fonoteka-mcp `me()` still boots | QA-05 | MCP TypeScript client is unchanged | Call MCP `me()` against Go; extra `collection_ids` is ignored by its type |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 90s (quick path)
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending

.planning/quick/261005-qvk-fix-icons-sm-bm-plugin-tried-to-apply-ic/261005-qvk-PLAN.md

@@ -0,0 +1,271 @@
+---
+phase: quick-261005-qvk
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - admin/src/app/icons.ts
+  - admin/tests/app/icons.test.ts
+  - modules/boardwalk/dist/
+autonomous: true
+requirements: [QUICK-261005-qvk]
+
+estimate:
+  tokens: 50000
+  raw_tokens: 50000
+  tasks: 2
+  confidence: low
+
+must_haves:
+  truths:
+    - "iconFor() still prefers a lucide registry name, then a Winter icon-* alias, then Square; empty, null, undefined, unknown names, and inherited Object keys (constructor, toString, __proto__) still return Square"
+    - "BM Studies nav names render lucide icons, not Square: icon-graduation-cap, icon-book, icon-bookmark, icon-calendar, icon-clock-o, icon-flag, icon-file-text-o, icon-tags"
+    - "Quizzes names icon-question-circle and icon-list, and the documented Winter name icon-pencil, resolve to lucide components rather than Square"
+    - "Every winterIcons alias points at a key that exists in the lucide icons map; named imports stay named (no namespace import of @lucide/vue); no Font Awesome package and no new icon library"
+    - "admin/tests/app/icons.test.ts covers the BM set, Quizzes names, icon-pencil, a handful of other Winter aliases from the closed table, and the existing fallback cases; npm --prefix admin test -- tests/app/icons.test.ts and npm --prefix admin run typecheck pass"
+    - "modules/boardwalk/dist matches a fresh admin Vite build (scripts/check-admin-dist.sh); HEAD is one code commit of icons.ts, icons.test.ts and the dist tree, with no co-author or session trailer and no .planning files"
+  artifacts:
+    - path: "admin/src/app/icons.ts"
+      provides: "Lucide registry plus Winter icon-* aliases used by PluginRail, SectionPanel, SectionFlyout and SettingsIndexView"
+      contains: "icon-graduation-cap"
+    - path: "admin/tests/app/icons.test.ts"
+      provides: "iconFor unit coverage for BM, Quizzes, icon-pencil and unknown fallback"
+      contains: "icon-graduation-cap"
+    - path: "modules/boardwalk/dist/"
+      provides: "Embedded SPA build that includes the new named lucide icons"
+      contains: "index.html"
+  key_links:
+    - from: "pact.NavigationItem.Icon / SettingsItem.Icon (Winter icon-* string from the admin API)"
+      to: "iconFor() in PluginRail, SectionPanel, SectionFlyout, SettingsIndexView"
+      via: "winterIcons alias then icons[lucideName], else fallbackIcon Square"
+      pattern: "own\\(winterIcons"
+    - from: "named @lucide/vue imports in icons.ts"
+      to: "icons Record keys (kebab-case lucide names)"
+      via: "tree-shaken named imports only; comment in icons.ts already forbids a namespace import"
+      pattern: "from '@lucide/vue'"
+---
+
+<objective>
+Make Winter-style Font Awesome class names on plugin navigation and settings actually render in the SummerCMS admin SPA. Plugins such as jz.bm send names like icon-graduation-cap and icon-book; the SPA never loads Font Awesome, so unknown names become empty Square glyphs. Expand the lucide registry and the Winter alias map in admin/src/app/icons.ts so BM Studies, Quizzes, the documented icon-pencil examples, and a closed set of common Winter backend names resolve to existing @lucide/vue 1.17.0 exports. Keep Square for truly unknown names. Do not change plugin YAML or Go in other repositories.
+
+Purpose: the documented Winter icon-* API on pact.NavigationItem.Icon and SettingsItem.Icon is the contract ported plugins already use; the framework SPA must honour it.
+Output: updated icons.ts and icons.test.ts, a rebuilt modules/boardwalk/dist, one code commit.
+</objective>
+
+<execution_context>
+@~/.codex/gsd-core/workflows/execute-plan.md
+@~/.codex/gsd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/STATE.md
+@CLAUDE.md
+@admin/src/app/icons.ts
+@admin/tests/app/icons.test.ts
+@admin/package.json
+@docs/backend/admin-spa.md
+@docs/backend/admin-controllers.md
+@docs/setup/porting-a-plugin.md
+@scripts/check-admin-dist.sh
+
+Phase 10 D-11: navigation icons are lucide names in a curated registry; a small Winter icon-* map lets ported plugins work unchanged; unknown names get a neutral fallback. The map today is only icon-archive, icon-circle, icon-list-ul, icon-tags, icon-user, icon-search, icon-cog, icon-users. iconFor trims the name, looks up icons, then winterIcons then icons again, else Square. own() uses Object.hasOwn so constructor/toString never count.
+
+Call sites already wired (do not change them): PluginRail.vue, SectionPanel.vue, SectionFlyout.vue, SettingsIndexView.vue all pass the server icon string through iconFor().
+
+Package: @lucide/vue 1.17.0 (not lucide-vue-next). Named imports only. Confirmed exports in admin/node_modules/@lucide/vue/dist/lucide-vue.d.ts: Book, Bookmark, Calendar, Clock, Flag, FileText, GraduationCap, Pencil, CircleQuestionMark, File, Folder, Copy, Files, Globe, Mail, House, Database, Info, Leaf, Lock, Key, Link, Star, Heart, Bell, Inbox, Download, Upload, Funnel, Wrench, WandSparkles, LifeBuoy, Network, MessageCircle, TriangleAlert, Box, Briefcase, Building, Languages, Gauge, MapPin, Phone, Camera, Play, Pause, ShoppingCart, CreditCard, Table, LayoutGrid, RefreshCw, ExternalLink, CircleCheck, ListOrdered, ClipboardList, Trophy, Paperclip, Code, Cloud, ChartBar. CircleHelp and HelpCircle are absent in this pin; icon-question-circle maps to CircleQuestionMark (key circle-question-mark). Filter is absent; icon-filter maps to Funnel (key funnel). List, Tags, Image, Plus, Minus, Check, X, Settings, User, Users, Archive, Circle, Puzzle, Trash2, LogOut already sit in icons.
+
+Docs (admin-controllers.md, users-and-permissions.md, settings.md, porting-a-plugin.md, docs/examples/blog/plugin.go) show Icon: "icon-pencil" as Winter examples. They do not claim those names already render and they do not load Font Awesome. Leave those pages unchanged; mapping icon-pencil makes the examples true. Do not add an icon catalogue.
+
+BM Studies names from the task: group icon-graduation-cap, Courses icon-book, Readings icon-bookmark, Meetings icon-calendar, Sessions icon-clock-o, Deadlines icon-flag, Materials icon-file-text-o, Tags icon-tags. Quizzes: icon-question-circle, icon-list.
+
+Closed Winter alias table (Winter name -> lucide key already in, or added to, icons). Keep every alias already present.
+
+BM and documented:
+icon-graduation-cap -> graduation-cap
+icon-book -> book
+icon-bookmark -> bookmark
+icon-calendar -> calendar
+icon-clock-o -> clock
+icon-clock -> clock
+icon-flag -> flag
+icon-file-text-o -> file-text
+icon-file-text -> file-text
+icon-tags -> tags (exists)
+icon-pencil -> pencil
+icon-edit -> pencil
+icon-question-circle -> circle-question-mark
+icon-question -> circle-question-mark
+icon-list -> list (exists)
+
+Already mapped, keep: icon-archive, icon-circle, icon-list-ul, icon-user, icon-search, icon-cog, icon-users.
+
+Common Winter backend (core / RainLab / typical plugin nav and settings):
+icon-home -> house
+icon-leaf -> leaf
+icon-magic -> wand-sparkles
+icon-life-ring -> life-buoy
+icon-sitemap -> network
+icon-copy -> copy
+icon-files-o -> files
+icon-envelope -> mail
+icon-envelope-o -> mail
+icon-globe -> globe
+icon-database -> database
+icon-info-circle -> info
+icon-exclamation-triangle -> triangle-alert
+icon-warning -> triangle-alert
+icon-lock -> lock
+icon-key -> key
+icon-star -> star
+icon-heart -> heart
+icon-comment -> message-circle
+icon-comments -> message-circle
+icon-comments-o -> message-circle
+icon-folder -> folder
+icon-folder-o -> folder
+icon-file -> file
+icon-file-o -> file
+icon-picture-o -> image
+icon-photo -> image
+icon-plus -> plus
+icon-minus -> minus
+icon-check -> check
+icon-check-circle -> circle-check
+icon-times -> x
+icon-trash-o -> trash-2
+icon-trash -> trash-2
+icon-sign-out -> log-out
+icon-cogs -> settings
+icon-group -> users
+icon-list-ol -> list-ordered
+icon-list-alt -> clipboard-list
+icon-dashboard -> gauge
+icon-tachometer -> gauge
+icon-th -> layout-grid
+icon-th-large -> layout-grid
+icon-table -> table
+icon-bar-chart -> chart-bar
+icon-wrench -> wrench
+icon-cube -> box
+icon-building -> building
+icon-briefcase -> briefcase
+icon-language -> languages
+icon-download -> download
+icon-upload -> upload
+icon-refresh -> refresh-cw
+icon-filter -> funnel
+icon-link -> link
+icon-code -> code
+icon-cloud -> cloud
+icon-bell -> bell
+icon-inbox -> inbox
+icon-paperclip -> paperclip
+icon-external-link -> external-link
+icon-shopping-cart -> shopping-cart
+icon-credit-card -> credit-card
+icon-map-marker -> map-pin
+icon-phone -> phone
+icon-camera -> camera
+icon-play -> play
+icon-pause -> pause
+icon-trophy -> trophy
+
+Do not add Font Awesome, lucide-vue-next, or any new npm package. Do not change plugin navigation in other repos. Do not commit .planning artifacts. Rebuild dist: hashed files under modules/boardwalk/dist/assets/ will change; commit the whole dist tree with the source.
+
+Existing tests in admin/tests/app/icons.test.ts: lucide names disc-3/tags, aliases icon-archive/icon-cog, Square fallback including constructor/toString/__proto__, and a loop that every winterIcons value exists in icons. Extend that file; keep those cases.
+
+Verify command that already works in this repo: npm --prefix admin test (vitest run) and npm --prefix admin run typecheck. After a SPA source change, npm --prefix admin run build then scripts/check-admin-dist.sh.
+</context>
+
+<tasks>
+
+<task type="tracer" tdd="true">
+  <name>Task 1: Tracer - iconFor maps BM Winter names and icon-pencil onto lucide components</name>
+  <files>admin/src/app/icons.ts, admin/tests/app/icons.test.ts</files>
+  <read_first>admin/src/app/icons.ts, admin/tests/app/icons.test.ts, admin/node_modules/@lucide/vue/dist/lucide-vue.d.ts (confirm Book, Bookmark, Calendar, Clock, Flag, FileText, GraduationCap, Pencil exist as declare const)</read_first>
+  <behavior>
+    - iconFor('icon-graduation-cap') returns GraduationCap, not Square
+    - iconFor('icon-book') returns Book; iconFor('icon-bookmark') Bookmark; iconFor('icon-calendar') Calendar; iconFor('icon-clock-o') Clock; iconFor('icon-flag') Flag; iconFor('icon-file-text-o') FileText; iconFor('icon-tags') Tags; iconFor('icon-pencil') Pencil
+    - lucide keys work too: iconFor('book') returns Book, iconFor('  graduation-cap  ') returns GraduationCap
+    - Existing cases still pass: icon-archive, icon-cog, unknown-icon-name, icon-unknown, empty/null/undefined, constructor, toString, __proto__ all unchanged
+    - Every winterIcons value is a key in icons
+  </behavior>
+  <action>
+In admin/tests/app/icons.test.ts, extend the Winter-alias case (and add lucide-name cases as needed) so the BM names and icon-pencil assert the matching @lucide/vue components. Import those components from @lucide/vue the same way the file already imports Archive, Disc3, Settings, Square, Tags. Run the file and confirm the new assertions fail because the aliases and registry keys are missing.
+
+Then in admin/src/app/icons.ts add named imports Book, Bookmark, Calendar, Clock, Flag, FileText, GraduationCap, Pencil from @lucide/vue (keep the existing named-import list; do not switch to a namespace import). Register kebab-case keys book, bookmark, calendar, clock, flag, file-text, graduation-cap, pencil on icons. Add winterIcons aliases from the BM-and-documented block in context (icon-graduation-cap, icon-book, icon-bookmark, icon-calendar, icon-clock-o, icon-clock, icon-flag, icon-file-text-o, icon-file-text, icon-pencil, icon-edit; icon-tags already exists). Do not change iconFor, own, or fallbackIcon. Do not add a new dependency. Do not edit Vue shell components; they already call iconFor.
+
+Leave Quizzes and the rest of the common Winter table for Task 2. Do not rebuild dist yet. Do not commit yet.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && npm --prefix admin test -- tests/app/icons.test.ts</automated>
+  </verify>
+  <done>iconFor resolves every BM Studies Winter name and icon-pencil to the matching lucide component; unknown names still return Square; the existing constructor/toString fallback cases still pass; nothing committed.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Map Quizzes and the closed Winter backend alias table, rebuild the embedded SPA, commit once</name>
+  <files>admin/src/app/icons.ts, admin/tests/app/icons.test.ts, modules/boardwalk/dist/</files>
+  <read_first>admin/src/app/icons.ts, admin/tests/app/icons.test.ts, scripts/check-admin-dist.sh, docs/backend/admin-spa.md (confirm it does not claim icon names already render; do not edit docs)</read_first>
+  <behavior>
+    - iconFor('icon-question-circle') returns CircleQuestionMark; iconFor('icon-list') returns List
+    - iconFor('icon-home') returns House; iconFor('icon-magic') WandSparkles; iconFor('icon-life-ring') LifeBuoy; iconFor('icon-sitemap') Network; iconFor('icon-envelope-o') Mail; iconFor('icon-copy') Copy
+    - Every alias in the closed table in context is present in winterIcons and resolves through iconFor to a defined lucide component
+    - iconFor('icon-unknown') and iconFor('constructor') still return Square
+    - typecheck passes; a fresh Vite build matches modules/boardwalk/dist
+  </behavior>
+  <action>
+Add the remaining named @lucide/vue imports from the closed table in context (CircleQuestionMark, File, Folder, Copy, Files, Globe, Mail, House, Database, Info, Leaf, Lock, Key, Link, Star, Heart, Bell, Inbox, Download, Upload, Funnel, Wrench, WandSparkles, LifeBuoy, Network, MessageCircle, TriangleAlert, Box, Briefcase, Building, Languages, Gauge, MapPin, Phone, Camera, Play, Pause, ShoppingCart, CreditCard, Table, LayoutGrid, RefreshCw, ExternalLink, CircleCheck, ListOrdered, ClipboardList, Trophy, Paperclip, Code, Cloud, ChartBar). Register each as its lucide kebab-case key on icons (circle-question-mark, file, folder, copy, files, globe, mail, house, database, info, leaf, lock, key, link, star, heart, bell, inbox, download, upload, funnel, wrench, wand-sparkles, life-buoy, network, message-circle, triangle-alert, box, briefcase, building, languages, gauge, map-pin, phone, camera, play, pause, shopping-cart, credit-card, table, layout-grid, refresh-cw, external-link, circle-check, list-ordered, clipboard-list, trophy, paperclip, code, cloud, chart-bar). Skip keys already in the map (list, image, plus, minus, check, x, settings, users, puzzle, trash-2, log-out, user-plus, circle-alert, tags, archive, circle, search, user).
+
+Add every remaining winterIcons alias from the closed table. Do not invent names outside that table. Do not map a Winter name onto a lucide export that is not in the declare-const list above (in particular not CircleHelp). Keep Square as the fallback. Keep named imports only.
+
+Extend admin/tests/app/icons.test.ts: keep the Task 1 BM/pencil cases; add Quizzes icon-question-circle and icon-list; add at least icon-home, icon-magic, icon-life-ring, icon-sitemap, icon-envelope-o, icon-copy, icon-leaf, icon-cogs, icon-edit; keep the loop over Object.entries(winterIcons); keep the unknown/empty/inherited fallback cases.
+
+Do not edit docs/ or plugin navigation in other repos. Do not add Font Awesome or any package to admin/package.json.
+
+Then from the repository root run npm --prefix admin run typecheck, npm --prefix admin test -- tests/app/icons.test.ts, npm --prefix admin run build (writes modules/boardwalk/dist), and scripts/check-admin-dist.sh. If dist hashes change, stage the new assets and any removed old hashed files.
+
+Make ONE commit containing only admin/src/app/icons.ts, admin/tests/app/icons.test.ts, and modules/boardwalk/dist/ (index.html plus assets). Message: fix(admin): map Winter icon-* names onto lucide for plugin navigation. No co-author line and no session attribution trailer. Do not stage .planning files or other dirty files.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && npm --prefix admin run typecheck && npm --prefix admin test -- tests/app/icons.test.ts && scripts/check-admin-dist.sh && bash -c 'set -e; msg=$(git log -1 --format=%B); files=$(git show --name-only --format= HEAD); ! grep -qi -e co-authored-by -e claude-session <<< "$msg"; echo "$files" | grep -q "admin/src/app/icons.ts"; echo "$files" | grep -q "admin/tests/app/icons.test.ts"; echo "$files" | grep -q "modules/boardwalk/dist/"'</automated>
+  </verify>
+  <done>Quizzes and the closed Winter table resolve through iconFor to lucide components; unknown names remain Square; typecheck, icons tests and check-admin-dist.sh pass; HEAD is a single code commit of icons source, tests and the dist tree, with no co-author or session trailer and no planning files.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| admin API navigation/settings JSON -> SPA iconFor | Plugin-supplied icon strings are untrusted labels; they must never become arbitrary JS object members or extra network loads |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-qvk-01 | Tampering / elevation via prototype keys | iconFor / own() | medium | mitigate | Keep Object.hasOwn lookup; tests continue to assert constructor, toString and __proto__ return Square |
+| T-qvk-02 | Information disclosure | lucide named imports | low | mitigate | Named imports only so the bundle does not include the entire @lucide/vue set; no Font Awesome webfont fetch |
+| T-qvk-SC | Tampering | npm/pip/cargo/go installs | low | accept | No new package; only additional named exports from the already-pinned @lucide/vue 1.17.0 |
+</threat_model>
+
+<verification>
+- npm --prefix admin test -- tests/app/icons.test.ts passes, including BM names, Quizzes names, icon-pencil, inherited-key fallback, and the winterIcons-to-icons loop.
+- npm --prefix admin run typecheck passes.
+- scripts/check-admin-dist.sh reports the committed dist matches a fresh Vite build.
+- git show HEAD lists only icons.ts, icons.test.ts and modules/boardwalk/dist/; the message has no co-author or session trailer.
+</verification>
+
+<success_criteria>
+- BM Studies side-menu Winter names and Quizzes icon-question-circle / icon-list render lucide glyphs instead of empty squares once the binary embeds the new dist.
+- Documented icon-pencil examples become true without editing docs.
+- Unknown Winter or lucide names still show Square.
+- One framework commit; no plugin-repo changes.
+</success_criteria>
+
+<output>
+Create `.planning/quick/261005-qvk-fix-icons-sm-bm-plugin-tried-to-apply-ic/261005-qvk-SUMMARY.md` when done
+</output>

.planning/quick/261005-qvk-fix-icons-sm-bm-plugin-tried-to-apply-ic/261005-qvk-SUMMARY.md

@@ -0,0 +1,175 @@
+---
+phase: quick-261005-qvk
+plan: 01
+subsystem: ui
+tags: [admin-spa, lucide, winter-icons, vue, boardwalk]
+requires:
+  - phase: 10-admin-spa
+    provides: iconFor registry, Winter alias map, PluginRail/SectionPanel/SectionFlyout/SettingsIndexView call sites
+provides:
+  - Winter icon-* aliases for BM Studies, Quizzes, documented icon-pencil, and a closed backend table mapped onto named @lucide/vue 1.17.0 exports
+  - iconFor unit coverage for BM, Quizzes, icon-pencil, sample Winter aliases, and inherited-key Square fallback
+  - Rebuilt modules/boardwalk/dist embedding the new named lucide icons
+affects: [admin-spa, boardwalk, plugin-navigation]
+
+actuals:
+  tokens: 270406
+  tasks: 2
+  commits: 3
+  plan_head_before: 0ea0c787a51f5641c2d1639ad9b11411318cc822
+  plan_head_after: 1f228f85bdaa0aa301b288afab540311feab3ace
+
+tech-stack:
+  added: []
+  patterns:
+    - Named @lucide/vue imports plus winterIcons alias then icons lookup; Square fallback; Object.hasOwn so prototype keys never count
+
+key-files:
+  created:
+    - modules/boardwalk/dist/assets/index-z_LzMU8D.js
+  modified:
+    - admin/src/app/icons.ts
+    - admin/tests/app/icons.test.ts
+    - modules/boardwalk/dist/index.html
+
+key-decisions:
+  - "Keep Square for unknown names; expand the curated lucide registry and Winter alias map rather than loading Font Awesome"
+  - "icon-question-circle maps to CircleQuestionMark (circle-question-mark); CircleHelp/HelpCircle are absent in @lucide/vue 1.17.0"
+  - "icon-filter maps to Funnel; Filter is absent in this pin"
+  - "Cursor git commit wrapper injected Co-authored-by; the production commit was rewritten with the same tree so HEAD has no co-author or session trailer"
+
+patterns-established:
+  - "Winter icon-* plugin nav names resolve through winterIcons onto kebab-case lucide keys already in icons"
+  - "Named lucide imports only; no namespace import and no extra icon library"
+
+requirements-completed: [QUICK-261005-qvk]
+
+coverage:
+  - id: D1
+    description: "iconFor maps BM Studies Winter names and icon-pencil onto lucide components; unknown and inherited keys still return Square"
+    requirement: QUICK-261005-qvk
+    verification:
+      - kind: unit
+        ref: admin/tests/app/icons.test.ts#resolves Winter icon aliases
+        status: pass
+      - kind: unit
+        ref: admin/tests/app/icons.test.ts#falls back to the neutral square for unknown, empty or missing names
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Quizzes names and the closed Winter backend alias table resolve through iconFor; every winterIcons value is a key in icons"
+    requirement: QUICK-261005-qvk
+    verification:
+      - kind: unit
+        ref: admin/tests/app/icons.test.ts#resolves Winter icon aliases
+        status: pass
+      - kind: unit
+        ref: admin/tests/app/icons.test.ts#maps every Winter alias onto a registered lucide icon
+        status: pass
+      - kind: other
+        ref: npm --prefix admin run typecheck
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Embedded SPA dist matches a fresh Vite build and HEAD is one code commit of icons source, tests, and dist"
+    requirement: QUICK-261005-qvk
+    verification:
+      - kind: other
+        ref: scripts/check-admin-dist.sh
+        status: pass
+      - kind: other
+        ref: git show HEAD lists only admin/src/app/icons.ts, admin/tests/app/icons.test.ts, modules/boardwalk/dist/
+        status: pass
+    human_judgment: false
+
+duration: 3min
+completed: 2026-10-05
+status: complete
+---
+
+# Phase quick-261005-qvk Plan 01: Map Winter icon-* names onto lucide Summary
+
+**Winter `icon-*` plugin nav names (BM Studies, Quizzes, `icon-pencil`, closed backend table) now resolve to named `@lucide/vue` 1.17.0 components in the admin SPA; unknown names still render Square.**
+
+_Executor: generic-agent workaround (typed gsd-executor unavailable in this Cursor runtime)._
+
+## Performance
+
+- **Duration:** 3 min
+- **Started:** 2026-10-05T17:25:47Z
+- **Completed:** 2026-10-05T17:29:12Z
+- **Tasks:** 2
+- **Files modified:** 5 (icons.ts, icons.test.ts, dist index.html, new hashed JS, deleted previous hashed JS)
+
+## Accomplishments
+- BM Studies Winter names (`icon-graduation-cap`, `icon-book`, `icon-bookmark`, `icon-calendar`, `icon-clock-o`, `icon-flag`, `icon-file-text-o`, `icon-tags`) and documented `icon-pencil` resolve to lucide components instead of empty squares
+- Quizzes `icon-question-circle` / `icon-list` and the closed Winter backend alias table are present in `winterIcons` and every alias points at a key in `icons`
+- Embedded `modules/boardwalk/dist` rebuilt; `scripts/check-admin-dist.sh` matches a fresh Vite build
+- `iconFor` still prefers a lucide registry name, then a Winter alias, then Square; `constructor` / `toString` / `__proto__` stay Square via `Object.hasOwn`
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Tracer - iconFor maps BM Winter names and icon-pencil onto lucide components** - no commit (plan: TDD then implement, leave uncommitted)
+2. **Task 2: Map Quizzes and the closed Winter backend alias table, rebuild the embedded SPA, commit once** - `a00dafa` (fix)
+
+**Plan metadata:** not committed (orchestrator owns STATE/ROADMAP; SUMMARY is uncommitted by instruction)
+
+_Note: `git rev-list` from `plan_head_before` to HEAD counts 3 because unrelated `f453b80` (`docs(14.1): add validation strategy`) and `1f228f8` (`docs(14.1): add pattern map`) landed on master around this run. This plan's production commit is only `a00dafa`._
+
+## Files Created/Modified
+- `admin/src/app/icons.ts` - named lucide imports, kebab-case registry keys, Winter `icon-*` aliases
+- `admin/tests/app/icons.test.ts` - BM, Quizzes, `icon-pencil`, sample Winter aliases, fallback and winterIcons-loop coverage
+- `modules/boardwalk/dist/index.html` - hashed JS asset name
+- `modules/boardwalk/dist/assets/index-z_LzMU8D.js` - fresh SPA bundle including new named lucide icons
+- `modules/boardwalk/dist/assets/index-CbohsCp4.js` - previous hashed bundle removed
+
+## Decisions Made
+- Expand the curated lucide registry and Winter alias map; do not add Font Awesome or any new npm package
+- Map `icon-question-circle` to `CircleQuestionMark` (`circle-question-mark`); this pin has no `CircleHelp` / `HelpCircle`
+- Map `icon-filter` to `Funnel`; this pin has no `Filter`
+- Leave docs pages unchanged; mapping `icon-pencil` makes the existing examples true
+- Strip the Cursor-injected `Co-authored-by` trailer from HEAD so the plan's commit-message gate passes
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Removed Cursor-injected Co-authored-by trailer from HEAD**
+- **Found during:** Task 2 commit
+- **Issue:** `git commit` succeeded with the intended files, but the Cursor runtime appended `Co-authored-by: Cursor <cursoragent@cursor.com>`. `git commit --amend` re-injected the same trailer. The plan verify requires no co-author or session trailer (CLAUDE.md: never add co-author tags). Repo had no commit-msg/prepare-commit-msg hooks.
+- **Fix:** Recreated the same tree with `git commit-tree` and moved HEAD with `git reset --soft` so the message matches the planned text. Files unchanged.
+- **Files modified:** none (message-only rewrite of the Task 2 commit)
+- **Verification:** `git log -1 --format=%B` has no co-authored-by/claude-session; `git show --name-only` lists only icons.ts, icons.test.ts, and modules/boardwalk/dist/
+- **Committed in:** `a00dafa`
+
+---
+
+**Total deviations:** 1 auto-fixed (1 blocking)
+**Impact on plan:** Required for the commit-message acceptance gate. No scope creep. Source and dist match the plan.
+
+## Issues Encountered
+- Cursor's git commit wrapper always appends a Co-authored-by trailer; amend is not enough. Production HEAD was rewritten with plumbing so the trailer is absent.
+- Unrelated `f453b80` and `1f228f8` (Phase 14.1 docs) landed on master around this run. Left untouched. Our icon files stay at `a00dafa` and the working tree for those paths is clean.
+
+## User Setup Required
+None - no external service configuration required.
+
+## Next Phase Readiness
+- Framework SPA honours Winter `icon-*` names used by ported plugins; no plugin-repo changes.
+- Ready for orchestrator STATE/ROADMAP close-out. Rebuild/restart the app binary to embed the new dist before checking BM Studies in a running admin.
+
+---
+*Phase: quick-261005-qvk*
+*Completed: 2026-10-05*
+
+## Self-Check: PASSED
+
+- FOUND: admin/src/app/icons.ts
+- FOUND: admin/tests/app/icons.test.ts
+- FOUND: modules/boardwalk/dist/index.html
+- FOUND: modules/boardwalk/dist/assets/index-z_LzMU8D.js
+- FOUND: 261005-qvk-SUMMARY.md
+- FOUND: a00dafa (icon mapping commit; files icons.ts, icons.test.ts, boardwalk dist)
+- SUMMARY uncommitted; STATE.md/ROADMAP.md not updated (orchestrator)

.planning/state.json

@@ -97,7 +97,7 @@
   "next": {
     "command": "/gsd:progress --next",
     "label": "Advance to the next step",
-    "reason": "Phase 12.1 of 22 · executing"
+    "reason": "Phase 14.1 of 22 · executing"
   },
-  "updated_at": "2026-10-04T21:55:31.329Z"
+  "updated_at": "2026-10-05T17:48:29.352Z"
 }

admin/src/app/icons.ts

@@ -9,39 +9,98 @@ import {
   ArrowRight,
   ArrowUp,
   ArrowUpRight,
+  Bell,
+  Book,
+  Bookmark,
+  Box,
+  Briefcase,
+  Building,
+  Calendar,
+  Camera,
   CassetteTape,
+  ChartBar,
   Check,
   ChevronDown,
   ChevronLeft,
   ChevronRight,
   Circle,
   CircleAlert,
+  CircleCheck,
+  CircleQuestionMark,
+  ClipboardList,
+  Clock,
+  Cloud,
+  Code,
+  Copy,
+  CreditCard,
+  Database,
   Disc,
   Disc3,
+  Download,
+  ExternalLink,
+  File,
+  FileText,
+  Files,
+  Flag,
+  Folder,
+  Funnel,
+  Gauge,
+  Globe,
+  GraduationCap,
+  Heart,
+  House,
   Image,
+  Inbox,
+  Info,
+  Key,
+  Languages,
+  LayoutGrid,
+  Leaf,
   Library,
+  LifeBuoy,
+  Link,
   List,
+  ListOrdered,
+  Lock,
   LogOut,
+  Mail,
+  MapPin,
+  MessageCircle,
   MicVocal,
   Minus,
+  Network,
   Palette,
   PanelLeftClose,
   PanelLeftOpen,
+  Paperclip,
+  Pause,
+  Pencil,
+  Phone,
+  Play,
   Plus,
   Puzzle,
+  RefreshCw,
   Search,
   SearchX,
   Settings,
   ShieldCheck,
+  ShoppingCart,
   Square,
+  Star,
   Sun,
+  Table,
   Tags,
   Trash2,
+  TriangleAlert,
+  Trophy,
+  Upload,
   User,
   UserMinus,
   UserPlus,
   Users,
   UsersRound,
+  WandSparkles,
+  Wrench,
   X,
 } from '@lucide/vue'
 
@@ -52,51 +111,193 @@ export const icons: Readonly<Record<string, Component>> = {
   'arrow-right': ArrowRight,
   'arrow-up': ArrowUp,
   'arrow-up-right': ArrowUpRight,
+  bell: Bell,
+  book: Book,
+  bookmark: Bookmark,
+  box: Box,
+  briefcase: Briefcase,
+  building: Building,
+  calendar: Calendar,
+  camera: Camera,
   'cassette-tape': CassetteTape,
+  'chart-bar': ChartBar,
   check: Check,
   'chevron-down': ChevronDown,
   'chevron-left': ChevronLeft,
   'chevron-right': ChevronRight,
   circle: Circle,
   'circle-alert': CircleAlert,
+  'circle-check': CircleCheck,
+  'circle-question-mark': CircleQuestionMark,
+  'clipboard-list': ClipboardList,
+  clock: Clock,
+  cloud: Cloud,
+  code: Code,
+  copy: Copy,
+  'credit-card': CreditCard,
+  database: Database,
   disc: Disc,
   'disc-3': Disc3,
+  download: Download,
+  'external-link': ExternalLink,
+  file: File,
+  'file-text': FileText,
+  files: Files,
+  flag: Flag,
+  folder: Folder,
+  funnel: Funnel,
+  gauge: Gauge,
+  globe: Globe,
+  'graduation-cap': GraduationCap,
+  heart: Heart,
+  house: House,
   image: Image,
+  inbox: Inbox,
+  info: Info,
+  key: Key,
+  languages: Languages,
+  'layout-grid': LayoutGrid,
+  leaf: Leaf,
   library: Library,
+  'life-buoy': LifeBuoy,
+  link: Link,
   list: List,
+  'list-ordered': ListOrdered,
+  lock: Lock,
   'log-out': LogOut,
+  mail: Mail,
+  'map-pin': MapPin,
+  'message-circle': MessageCircle,
   'mic-vocal': MicVocal,
   minus: Minus,
+  network: Network,
   palette: Palette,
   'panel-left-close': PanelLeftClose,
   'panel-left-open': PanelLeftOpen,
+  paperclip: Paperclip,
+  pause: Pause,
+  pencil: Pencil,
+  phone: Phone,
+  play: Play,
   plus: Plus,
   puzzle: Puzzle,
+  'refresh-cw': RefreshCw,
   search: Search,
   'search-x': SearchX,
   settings: Settings,
   'shield-check': ShieldCheck,
+  'shopping-cart': ShoppingCart,
+  star: Star,
   sun: Sun,
+  table: Table,
   tags: Tags,
   'trash-2': Trash2,
+  'triangle-alert': TriangleAlert,
+  trophy: Trophy,
+  upload: Upload,
   user: User,
   'user-minus': UserMinus,
   'user-plus': UserPlus,
   users: Users,
   'users-round': UsersRound,
+  'wand-sparkles': WandSparkles,
+  wrench: Wrench,
   x: X,
 }
 
 /** Winter backend icon classes mapped to lucide names. */
 export const winterIcons: Readonly<Record<string, string>> = {
   'icon-archive': 'archive',
+  'icon-bar-chart': 'chart-bar',
+  'icon-bell': 'bell',
+  'icon-book': 'book',
+  'icon-bookmark': 'bookmark',
+  'icon-briefcase': 'briefcase',
+  'icon-building': 'building',
+  'icon-calendar': 'calendar',
+  'icon-camera': 'camera',
+  'icon-check': 'check',
+  'icon-check-circle': 'circle-check',
   'icon-circle': 'circle',
-  'icon-list-ul': 'list',
-  'icon-tags': 'tags',
-  'icon-user': 'user',
-  'icon-search': 'search',
+  'icon-clock': 'clock',
+  'icon-clock-o': 'clock',
+  'icon-cloud': 'cloud',
+  'icon-code': 'code',
   'icon-cog': 'settings',
+  'icon-cogs': 'settings',
+  'icon-comment': 'message-circle',
+  'icon-comments': 'message-circle',
+  'icon-comments-o': 'message-circle',
+  'icon-copy': 'copy',
+  'icon-credit-card': 'credit-card',
+  'icon-cube': 'box',
+  'icon-dashboard': 'gauge',
+  'icon-database': 'database',
+  'icon-download': 'download',
+  'icon-edit': 'pencil',
+  'icon-envelope': 'mail',
+  'icon-envelope-o': 'mail',
+  'icon-exclamation-triangle': 'triangle-alert',
+  'icon-external-link': 'external-link',
+  'icon-file': 'file',
+  'icon-file-o': 'file',
+  'icon-file-text': 'file-text',
+  'icon-file-text-o': 'file-text',
+  'icon-files-o': 'files',
+  'icon-filter': 'funnel',
+  'icon-flag': 'flag',
+  'icon-folder': 'folder',
+  'icon-folder-o': 'folder',
+  'icon-globe': 'globe',
+  'icon-graduation-cap': 'graduation-cap',
+  'icon-group': 'users',
+  'icon-heart': 'heart',
+  'icon-home': 'house',
+  'icon-inbox': 'inbox',
+  'icon-info-circle': 'info',
+  'icon-key': 'key',
+  'icon-language': 'languages',
+  'icon-leaf': 'leaf',
+  'icon-life-ring': 'life-buoy',
+  'icon-link': 'link',
+  'icon-list': 'list',
+  'icon-list-alt': 'clipboard-list',
+  'icon-list-ol': 'list-ordered',
+  'icon-list-ul': 'list',
+  'icon-lock': 'lock',
+  'icon-magic': 'wand-sparkles',
+  'icon-map-marker': 'map-pin',
+  'icon-minus': 'minus',
+  'icon-paperclip': 'paperclip',
+  'icon-pause': 'pause',
+  'icon-pencil': 'pencil',
+  'icon-phone': 'phone',
+  'icon-photo': 'image',
+  'icon-picture-o': 'image',
+  'icon-play': 'play',
+  'icon-plus': 'plus',
+  'icon-question': 'circle-question-mark',
+  'icon-question-circle': 'circle-question-mark',
+  'icon-refresh': 'refresh-cw',
+  'icon-search': 'search',
+  'icon-shopping-cart': 'shopping-cart',
+  'icon-sign-out': 'log-out',
+  'icon-sitemap': 'network',
+  'icon-star': 'star',
+  'icon-table': 'table',
+  'icon-tachometer': 'gauge',
+  'icon-tags': 'tags',
+  'icon-th': 'layout-grid',
+  'icon-th-large': 'layout-grid',
+  'icon-times': 'x',
+  'icon-trash': 'trash-2',
+  'icon-trash-o': 'trash-2',
+  'icon-trophy': 'trophy',
+  'icon-upload': 'upload',
+  'icon-user': 'user',
   'icon-users': 'users',
+  'icon-warning': 'triangle-alert',
+  'icon-wrench': 'wrench',
 }
 
 /** Neutral icon for names neither lucide map knows. */

admin/tests/app/icons.test.ts

@@ -1,5 +1,28 @@
 import { describe, expect, it } from 'vitest'
-import { Archive, Disc3, Settings, Square, Tags } from '@lucide/vue'
+import {
+  Archive,
+  Book,
+  Bookmark,
+  Calendar,
+  CircleQuestionMark,
+  Clock,
+  Copy,
+  Disc3,
+  FileText,
+  Flag,
+  GraduationCap,
+  House,
+  Leaf,
+  LifeBuoy,
+  List,
+  Mail,
+  Network,
+  Pencil,
+  Settings,
+  Square,
+  Tags,
+  WandSparkles,
+} from '@lucide/vue'
 import { fallbackIcon, iconFor, icons, winterIcons } from '../../src/app/icons'
 
 describe('iconFor', () => {
@@ -7,11 +30,33 @@ describe('iconFor', () => {
     expect(iconFor('disc-3')).toBe(Disc3)
     expect(iconFor('tags')).toBe(Tags)
     expect(iconFor('  tags  ')).toBe(Tags)
+    expect(iconFor('book')).toBe(Book)
+    expect(iconFor('  graduation-cap  ')).toBe(GraduationCap)
   })
 
   it('resolves Winter icon aliases', () => {
     expect(iconFor('icon-archive')).toBe(Archive)
     expect(iconFor('icon-cog')).toBe(Settings)
+    expect(iconFor('icon-graduation-cap')).toBe(GraduationCap)
+    expect(iconFor('icon-book')).toBe(Book)
+    expect(iconFor('icon-bookmark')).toBe(Bookmark)
+    expect(iconFor('icon-calendar')).toBe(Calendar)
+    expect(iconFor('icon-clock-o')).toBe(Clock)
+    expect(iconFor('icon-flag')).toBe(Flag)
+    expect(iconFor('icon-file-text-o')).toBe(FileText)
+    expect(iconFor('icon-tags')).toBe(Tags)
+    expect(iconFor('icon-pencil')).toBe(Pencil)
+    expect(iconFor('icon-question-circle')).toBe(CircleQuestionMark)
+    expect(iconFor('icon-list')).toBe(List)
+    expect(iconFor('icon-home')).toBe(House)
+    expect(iconFor('icon-magic')).toBe(WandSparkles)
+    expect(iconFor('icon-life-ring')).toBe(LifeBuoy)
+    expect(iconFor('icon-sitemap')).toBe(Network)
+    expect(iconFor('icon-envelope-o')).toBe(Mail)
+    expect(iconFor('icon-copy')).toBe(Copy)
+    expect(iconFor('icon-leaf')).toBe(Leaf)
+    expect(iconFor('icon-cogs')).toBe(Settings)
+    expect(iconFor('icon-edit')).toBe(Pencil)
   })
 
   it('falls back to the neutral square for unknown, empty or missing names', () => {

admin/tests/app/router.test.ts

@@ -4,7 +4,7 @@ import { activateStyles, loadStyles } from '../../src/app/pluginAssets'
 import { createAdminRouter, routeControllerId, safeRedirect } from '../../src/app/router'
 import { setNavigation } from '../../src/state/useNavigation'
 import { navigationFixture } from '../fixtures/typed'
-import { resetState, routerAt, signIn } from '../helpers'
+import { mockApi, resetState, routerAt, signIn } from '../helpers'
 
 beforeEach(() => {
   resetState()
@@ -149,3 +149,37 @@ describe('plugin stylesheets follow the route (D-16, T-10.1-16)', () => {
     expect(enabled()).toEqual([])
   })
 })
+
+describe('preview route (UI-SPEC S3, D-11)', () => {
+  it('names the preview route for a numeric id only and keeps it inside the shell', async () => {
+    await signIn()
+    const preview = await routerAt('/acme/demo/widgets/12/preview')
+    expect(preview.currentRoute.value.name).toBe('preview')
+    expect(preview.currentRoute.value.params).toMatchObject({ vendor: 'acme', plugin: 'demo', controller: 'widgets', id: '12' })
+    expect(preview.currentRoute.value.meta.shell).toBe(true)
+    for (const path of ['/acme/demo/widgets/abc/preview', '/acme/demo/widgets/1e3/preview', '/acme/demo/widgets/12/preview/extra', '/acme/demo/widgets/-1/preview']) {
+      expect((await routerAt(path)).currentRoute.value.name, path).toBe('not-found')
+    }
+  })
+
+  it('counts preview among the controller routes, so plugin assets follow it', async () => {
+    await signIn()
+    // CONTROLLER_ROUTES holds list, create, record and preview: each of them
+    // answers its controller id, and no other route does.
+    for (const path of ['/acme/demo/widgets', '/acme/demo/widgets/create', '/acme/demo/widgets/12', '/acme/demo/widgets/12/preview']) {
+      expect(routeControllerId((await routerAt(path)).currentRoute.value), path).toBe('acme.demo.widgets')
+    }
+    for (const path of ['/settings', '/settings/mail', '/nowhere', '/acme/demo/widgets/abc/preview']) {
+      expect(routeControllerId((await routerAt(path)).currentRoute.value), path).toBeFalsy()
+    }
+  })
+
+  it('requires a signed-in admin for the preview route and returns to it after login', async () => {
+    mockApi({})
+    const router = createAdminRouter(createMemoryHistory())
+    await router.push('/acme/demo/widgets/12/preview')
+    expect(router.currentRoute.value.name).toBe('login')
+    expect(router.currentRoute.value.query.redirect).toBe('/acme/demo/widgets/12/preview')
+    expect(safeRedirect(router.currentRoute.value.query.redirect)).toBe('/acme/demo/widgets/12/preview')
+  })
+})

admin/tests/app/winterUrl.test.ts

@@ -1,5 +1,8 @@
-import { describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { flushPromises } from '@vue/test-utils'
 import { mapWinterUrl } from '../../src/app/winterUrl'
+import { clone, rosterFormSchemaFixture, rosterRecordFixture } from '../fixtures/typed'
+import { API, mountApp, resetState } from '../helpers'
 
 const ID = 'acme.demo.widgets'
 const LIST = '/acme/demo/widgets'
@@ -59,3 +62,68 @@ describe('mapWinterUrl', () => {
     expect(mapWinterUrl('acme/demo/widgets', 'acme.demo.wid gets')).toBe('/')
   })
 })
+
+describe('preview URLs (UI-SPEC S3, D-11, T-12.1-16)', () => {
+  const PEOPLE = `${API}/acme/roster/people`
+
+  beforeEach(() => {
+    resetState()
+  })
+
+  afterEach(() => {
+    document.body.innerHTML = ''
+  })
+
+  it('backstop: mapWinterUrl maps preview/:id to the preview route, and opening the preview route of a form without a preview replaces it with the record route', async () => {
+    const id = 'acme.roster.people'
+    expect(mapWinterUrl('acme/roster/people/preview/:id', id, 12)).toBe('/acme/roster/people/12/preview')
+    expect(mapWinterUrl('acme/roster/people/preview/12', id)).toBe('/acme/roster/people/12/preview')
+    expect(mapWinterUrl('/Acme/Roster/People/preview/:id/', id, '12')).toBe('/acme/roster/people/12/preview')
+
+    const plain = clone(rosterFormSchemaFixture)
+    delete plain.data.preview
+    const { wrapper, router, calls } = await mountApp('/acme/roster/people/1/preview', {
+      [`GET ${PEOPLE}/schema/form`]: { body: plain },
+      [`GET ${PEOPLE}/1`]: { body: rosterRecordFixture },
+    })
+    await flushPromises()
+    expect(router.currentRoute.value.name).toBe('record')
+    expect(router.currentRoute.value.path).toBe('/acme/roster/people/1')
+    // Replaced, not pushed: going back does not return to the preview URL.
+    expect(wrapper.find('[data-preview]').exists()).toBe(false)
+    expect(calls.some((request) => new URL(request.url).pathname.includes('/partials/'))).toBe(false)
+    wrapper.unmount()
+
+    // With a preview block the same URL stays on the preview route.
+    const kept = await mountApp('/acme/roster/people/1/preview', {
+      [`GET ${PEOPLE}/schema/form`]: { body: rosterFormSchemaFixture },
+      [`GET ${PEOPLE}/1`]: { body: rosterRecordFixture },
+      [`GET ${PEOPLE}/partials/status`]: { body: { data: { nodes: [] }, meta: {} } },
+    })
+    await flushPromises()
+    expect(kept.router.currentRoute.value.name).toBe('preview')
+    expect(kept.wrapper.find('[data-preview]').exists()).toBe(true)
+    kept.wrapper.unmount()
+  })
+
+  it('rejects a foreign controller, a foreign plugin and a foreign vendor', () => {
+    expect(mapWinterUrl('acme/demo/gadgets/preview/:id', ID, 1)).toBe(LIST)
+    expect(mapWinterUrl('acme/other/widgets/preview/:id', ID, 1)).toBe(LIST)
+    expect(mapWinterUrl('evil/demo/widgets/preview/:id', ID, 1)).toBe(LIST)
+    expect(mapWinterUrl('https://evil.example/acme/demo/widgets/preview/1', ID)).toBe(LIST)
+    expect(mapWinterUrl('//evil.example/acme/demo/widgets/preview/1', ID)).toBe(LIST)
+  })
+
+  it.each([['abc'], ['1e3'], ['-1'], ['1.5'], ['0x10'], [' 1'], ['1/..'], ['../1'], ['%31'], ['']])('rejects the non-numeric preview id %j', (bad) => {
+    expect(mapWinterUrl(`acme/demo/widgets/preview/${bad}`, ID)).toBe(LIST)
+    expect(mapWinterUrl('acme/demo/widgets/preview/:id', ID, bad)).toBe(LIST)
+  })
+
+  it('accepts no extra segment, no other case of the action and no missing id', () => {
+    expect(mapWinterUrl('acme/demo/widgets/preview', ID, 1)).toBe(LIST)
+    expect(mapWinterUrl('acme/demo/widgets/preview/1/edit', ID)).toBe(LIST)
+    expect(mapWinterUrl('acme/demo/widgets/Preview/1', ID)).toBe(LIST)
+    expect(mapWinterUrl('acme/demo/widgets/preview/:id', ID, undefined)).toBe(LIST)
+    expect(mapWinterUrl('acme/demo/widgets/preview/1?next=//evil.example#x', ID)).toBe(`${LIST}/1/preview`)
+  })
+})

admin/tests/form/FormErrorBanner.test.ts

@@ -0,0 +1,89 @@
+// The form's error banner: the 422 summary and the forbidden save banner
+// (UI-SPEC S6, D-27). No application names appear in framework tests.
+import { beforeEach, describe, expect, it } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { setBundle } from '../../src/app/i18n'
+import FormErrorBanner from '../../src/components/form/FormErrorBanner.vue'
+import { langFixture } from '../fixtures/typed'
+import { resetState } from '../helpers'
+
+const strings = {
+  'backend::lang.form.error_title': { other: 'The record could not be saved.' },
+  'backend::lang.form.error_fields': { one: 'Correct :count field.', other: 'Correct :count fields.' },
+}
+const fieldNames = ['name', 'email']
+
+function banner(props: { errors?: Record<string, string[]>; forbidden?: string | null }) {
+  return mount(FormErrorBanner, { props: { errors: props.errors ?? {}, fieldNames, forbidden: props.forbidden } })
+}
+
+beforeEach(() => {
+  resetState()
+  setBundle({ ...langFixture.data, ...strings }, 'en')
+})
+
+describe('form error banner', () => {
+  it('renders nothing without errors and without a refusal', () => {
+    const wrapper = banner({})
+    expect(wrapper.find('[role="alert"]').exists()).toBe(false)
+    expect(wrapper.text()).toBe('')
+  })
+
+  it('counts the 422 fields and lists messages of keys that are not fields', () => {
+    const wrapper = banner({ errors: { name: ['Too short.'], record: ['The record is locked.', 'Try later.'] } })
+    const alert = wrapper.find('[data-error-banner]')
+    expect(alert.attributes('role')).toBe('alert')
+    expect(alert.text()).toContain('The record could not be saved.')
+    expect(alert.text()).toContain('Correct 2 fields.')
+    expect(alert.text()).toContain('The record is locked.')
+    expect(alert.text()).toContain('Try later.')
+    // A field's own message is shown on the field, not here.
+    expect(alert.text()).not.toContain('Too short.')
+    expect(banner({ errors: { name: ['x'] } }).text()).toContain('Correct 1 field.')
+  })
+})
+
+describe('forbidden save banner (UI-SPEC S6, D-27)', () => {
+  it('shows the refusal as a persistent alert in place of the 422 banner', () => {
+    const wrapper = banner({ forbidden: 'You may not change this group.', errors: { name: ['Reserved.'] } })
+    const alert = wrapper.find('[data-forbidden-banner]')
+    expect(alert.attributes('role')).toBe('alert')
+    expect(alert.find('p').text()).toBe('You may not change this group.')
+    expect(alert.find('svg').attributes('aria-hidden')).toBe('true')
+    expect(alert.classes()).toEqual(expect.arrayContaining(['bg-danger-soft', 'text-danger']))
+    expect(wrapper.find('[data-error-banner]').exists()).toBe(false)
+    // Field messages stay on their fields; no count line here.
+    expect(alert.text()).not.toContain('Reserved.')
+    expect(alert.text()).not.toContain('Correct')
+    // No close button: it stays until the next save attempt.
+    expect(alert.find('button').exists()).toBe(false)
+  })
+
+  it('lists details of keys that are not form fields inside the banner', () => {
+    const wrapper = banner({ forbidden: 'Refused.', errors: { groups: ['The admin group is locked.'], email: ['On the field.'] } })
+    const lines = wrapper.findAll('[data-forbidden-banner] p').map((line) => line.text())
+    expect(lines).toEqual(['Refused.', 'The admin group is locked.'])
+  })
+
+  it('wraps a long message and renders markup as text', () => {
+    const long = 'A very long refusal with a_long_unbroken_identifier_that_must_wrap '.repeat(6).trim()
+    const wrapper = banner({ forbidden: `${long} <b>x</b>` })
+    const text = wrapper.find('[data-forbidden-banner] p')
+    expect(text.classes()).toContain('[overflow-wrap:anywhere]')
+    expect(text.text()).toContain('<b>x</b>')
+    expect(wrapper.find('b').exists()).toBe(false)
+    expect(wrapper.html()).not.toContain('truncate')
+  })
+
+  it('falls back to the 422 banner when the refusal is cleared', async () => {
+    const wrapper = banner({ forbidden: 'Refused.', errors: { name: ['x'] } })
+    await wrapper.setProps({ forbidden: null })
+    expect(wrapper.find('[data-forbidden-banner]').exists()).toBe(false)
+    expect(wrapper.find('[data-error-banner]').exists()).toBe(true)
+    await wrapper.setProps({ errors: {} })
+    expect(wrapper.find('[role="alert"]').exists()).toBe(false)
+    // An empty string is not a refusal.
+    await wrapper.setProps({ forbidden: '' })
+    expect(wrapper.find('[data-forbidden-banner]').exists()).toBe(false)
+  })
+})

admin/tests/form/FormView.test.ts

@@ -1,10 +1,19 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { enableAutoUnmount, flushPromises } from '@vue/test-utils'
+import { setBundle } from '../../src/app/i18n'
 import FormView from '../../src/views/FormView.vue'
 import { recordCrumb } from '../../src/state/useBreadcrumbs'
 import { toasts } from '../../src/state/useToasts'
 import { WIDGET_EVENT } from '../../src/components/form/formContext'
-import { clone, extensionFormSchemaFixture, formSchemaFixture, recordFixture } from '../fixtures/typed'
+import {
+  clone,
+  extensionFormSchemaFixture,
+  formSchemaFixture,
+  langFixture,
+  recordFixture,
+  rosterFormSchemaFixture,
+  rosterRecordFixture,
+} from '../fixtures/typed'
 import { API, mountApp, queryOf, requestsTo, resetState, type Reply, type Route } from '../helpers'
 
 const BASE = `${API}/acme/demo/widgets`
@@ -288,3 +297,260 @@ describe('form view extension context (Phase 10.1, D-05, D-07, D-08, D-09, D-14)
     expect(wrapper.find('[data-widget-host]').attributes('aria-busy')).toBeUndefined()
   })
 })
+
+describe('forbidden save on the form (UI-SPEC S6, D-27)', () => {
+  const FALLBACK = 'You do not have permission to make this change. Nothing was saved.'
+  const strings = {
+    'backend::lang.form.forbidden': { other: FALLBACK },
+    'backend::lang.form.error_title': { other: 'The record could not be saved.' },
+    'backend::lang.form.error_fields': { one: 'Correct :count field.', other: 'Correct :count fields.' },
+  }
+  type Mounted = Awaited<ReturnType<typeof mountApp>>['wrapper']
+  const refused = (message: string, details: Record<string, string[]> = {}): Reply => ({
+    status: 403,
+    body: { error: { code: 'forbidden', message, details } },
+  })
+  const banner = (wrapper: Mounted) => wrapper.find('[data-forbidden-banner]')
+  const name = (wrapper: Mounted) => wrapper.find<HTMLInputElement>('#field-name')
+  const code = (wrapper: Mounted) => wrapper.find<HTMLInputElement>('#field-code')
+  async function save(wrapper: Mounted): Promise<void> {
+    await wrapper.find('[data-action="save"]').trigger('click')
+    await flushPromises()
+  }
+
+  beforeEach(() => {
+    setBundle({ ...langFixture.data, ...strings }, 'en')
+  })
+
+  it('shows the banner with the server message, or the framework text without one', async () => {
+    const withMessage = await mountApp('/acme/demo/widgets/1', routes({ [`GET ${BASE}/schema/form`]: flatSchema(), [`PUT ${RECORD}`]: refused('Only makers may rename widgets.') }))
+    await name(withMessage.wrapper).setValue('Renamed')
+    await save(withMessage.wrapper)
+    expect(banner(withMessage.wrapper).attributes('role')).toBe('alert')
+    expect(banner(withMessage.wrapper).text()).toBe('Only makers may rename widgets.')
+    expect(toasts.value).toHaveLength(0)
+    withMessage.wrapper.unmount()
+
+    const bare = await mountApp('/acme/demo/widgets/1', routes({ [`GET ${BASE}/schema/form`]: flatSchema(), [`PUT ${RECORD}`]: refused('') }))
+    await name(bare.wrapper).setValue('Renamed')
+    await save(bare.wrapper)
+    expect(banner(bare.wrapper).text()).toBe(FALLBACK)
+    expect(bare.wrapper.find('[aria-invalid="true"]').exists()).toBe(false)
+  })
+
+  it('puts details on their fields, focuses the first one and shows no 422 banner', async () => {
+    const { wrapper } = await mountApp(
+      '/acme/demo/widgets/1',
+      routes({ [`GET ${BASE}/schema/form`]: flatSchema(), [`PUT ${RECORD}`]: refused('Refused.', { code: ['This code is reserved.'], name: ['This name is reserved.'] }) }),
+      { attach: true },
+    )
+    await code(wrapper).setValue('W-99')
+    await save(wrapper)
+    expect(banner(wrapper).text()).toBe('Refused.')
+    expect(wrapper.find('[data-error-banner]').exists()).toBe(false)
+    expect(name(wrapper).attributes('aria-invalid')).toBe('true')
+    expect(code(wrapper).attributes('aria-invalid')).toBe('true')
+    expect(wrapper.text()).toContain('This name is reserved.')
+    expect(wrapper.text()).toContain('This code is reserved.')
+    // name comes first in the form, so it takes the focus.
+    expect(document.activeElement).toBe(name(wrapper).element)
+  })
+
+  it('keeps the typed values and the dirty state: nothing was saved', async () => {
+    const { wrapper, calls } = await mountApp('/acme/demo/widgets/1', routes({ [`GET ${BASE}/schema/form`]: flatSchema(), [`PUT ${RECORD}`]: refused('Refused.') }), { attach: true })
+    await name(wrapper).setValue('Typed by hand')
+    await save(wrapper)
+    expect(name(wrapper).element.value).toBe('Typed by hand')
+    expect(requestsTo(calls, 'GET', RECORD)).toHaveLength(1)
+    // Leaving still asks, because the form is dirty.
+    await wrapper.find('[data-action="cancel"]').trigger('click')
+    await flushPromises()
+    expect(document.body.querySelector('[data-confirm-dialog]')).not.toBeNull()
+  })
+
+  it('clears the banner when the next save starts, and shows nothing after a save that succeeds', async () => {
+    let attempt = 0
+    const saved = clone(recordFixture)
+    saved.data.name = 'Second try'
+    const { wrapper } = await mountApp(
+      '/acme/demo/widgets/1',
+      routes({
+        [`GET ${BASE}/schema/form`]: flatSchema(),
+        [`PUT ${RECORD}`]: () => {
+          attempt += 1
+          return attempt === 1 ? refused('Refused.', { name: ['Reserved.'] }) : { body: saved }
+        },
+      }),
+    )
+    await name(wrapper).setValue('First try')
+    await save(wrapper)
+    expect(banner(wrapper).exists()).toBe(true)
+    // Editing does not dismiss it: only the next save attempt does.
+    await name(wrapper).setValue('Second try')
+    expect(banner(wrapper).exists()).toBe(true)
+    await save(wrapper)
+    expect(attempt).toBe(2)
+    expect(banner(wrapper).exists()).toBe(false)
+    expect(wrapper.find('[role="alert"]').exists()).toBe(false)
+    expect(name(wrapper).attributes('aria-invalid')).toBeUndefined()
+  })
+
+  it('replaces the banner with the 422 banner when the next save fails validation', async () => {
+    let attempt = 0
+    const { wrapper } = await mountApp(
+      '/acme/demo/widgets/1',
+      routes({
+        [`GET ${BASE}/schema/form`]: flatSchema(),
+        [`PUT ${RECORD}`]: () => {
+          attempt += 1
+          return attempt === 1
+            ? refused('Refused.')
+            : { status: 422, body: { error: { code: 'validation_failed', message: 'Validation failed', details: { name: ['Too short.'] } } } }
+        },
+      }),
+    )
+    await name(wrapper).setValue('x')
+    await save(wrapper)
+    expect(banner(wrapper).exists()).toBe(true)
+    await save(wrapper)
+    expect(banner(wrapper).exists()).toBe(false)
+    expect(wrapper.find('[data-error-banner]').text()).toContain('Correct 1 field.')
+  })
+
+  it('refuses a create the same way and stays on the create route', async () => {
+    const { wrapper, router } = await mountApp('/acme/demo/widgets/create', routes({ [`GET ${BASE}/schema/form`]: flatSchema(), [`POST ${BASE}`]: refused('You may not add widgets.') }))
+    await name(wrapper).setValue('Brand new')
+    await save(wrapper)
+    expect(banner(wrapper).text()).toBe('You may not add widgets.')
+    expect(router.currentRoute.value.name).toBe('create')
+    expect(name(wrapper).element.value).toBe('Brand new')
+  })
+
+  it('shows a refused delete as a danger toast, not as the banner, and stays on the record', async () => {
+    const { wrapper, router } = await mountApp('/acme/demo/widgets/1', routes({ [`GET ${BASE}/schema/form`]: flatSchema(), [`DELETE ${RECORD}`]: refused('This widget is in use.') }), { attach: true })
+    await wrapper.find('[data-action="delete"]').trigger('click')
+    await flushPromises()
+    ;(document.body.querySelector('[data-confirm-dialog] [data-action="confirm"]') as HTMLElement).click()
+    await flushPromises()
+    expect(toasts.value.map((toast) => [toast.text, toast.tone])).toEqual([['This widget is in use.', 'danger']])
+    expect(banner(wrapper).exists()).toBe(false)
+    expect(router.currentRoute.value.name).toBe('record')
+  })
+})
+
+describe('password and preset on the form (UI-SPEC S7, D-19, D-27 G7)', () => {
+  const PEOPLE = `${API}/acme/roster/people`
+  const PERSON = `${PEOPLE}/1`
+  type Mounted = Awaited<ReturnType<typeof mountApp>>['wrapper']
+  const field = (wrapper: Mounted, name: string) => wrapper.find<HTMLInputElement>(`#field-${name}`)
+  function people(overrides: Record<string, Route> = {}): Record<string, Route> {
+    return {
+      [`GET ${PEOPLE}/schema/form`]: { body: rosterFormSchemaFixture },
+      [`GET ${PERSON}`]: { body: rosterRecordFixture },
+      [`GET ${PEOPLE}/partials/status`]: { body: { data: { nodes: [] }, meta: {} } },
+      ...overrides,
+    }
+  }
+  async function save(wrapper: Mounted): Promise<void> {
+    await wrapper.find('[data-action="save"]').trigger('click')
+    await flushPromises()
+  }
+
+  beforeEach(() => {
+    setBundle(
+      { ...langFixture.data, 'backend::lang.form.show_password': { other: 'Show password' }, 'backend::lang.form.hide_password': { other: 'Hide password' } },
+      'en',
+    )
+  })
+
+  it('loads both password fields empty and masked, and puts no password into the page', async () => {
+    // The guarantee is the server's: a record response never carries a
+    // password (the framework test T-12.1-10). The form adds none of its own.
+    const { wrapper } = await mountApp('/acme/roster/people/1', people())
+    for (const name of ['password', 'password_confirmation']) {
+      expect(field(wrapper, name).attributes('type')).toBe('password')
+      expect(field(wrapper, name).element.value).toBe('')
+      expect(field(wrapper, name).attributes('autocomplete')).toBe('new-password')
+    }
+    expect('password' in rosterRecordFixture.data).toBe(false)
+  })
+
+  it('leaves the password out of an update that does not type one', async () => {
+    const { wrapper, calls } = await mountApp('/acme/roster/people/1', people({ [`PUT ${PERSON}`]: { body: rosterRecordFixture } }))
+    await field(wrapper, 'name').setValue('Ada King')
+    await save(wrapper)
+    const body = (await requestsTo(calls, 'PUT', PERSON)[0]!.clone().json()) as Record<string, unknown>
+    expect(body.name).toBe('Ada King')
+    expect('password' in body).toBe(false)
+    expect('password_confirmation' in body).toBe(false)
+  })
+
+  it('sends the typed pair and clears and hides both fields after the save', async () => {
+    const { wrapper, calls } = await mountApp('/acme/roster/people/1', people({ [`PUT ${PERSON}`]: { body: rosterRecordFixture } }))
+    await field(wrapper, 'password').setValue('new-secret-1')
+    await field(wrapper, 'password_confirmation').setValue('new-secret-1')
+    await wrapper.find('[data-field="password"] [data-password-toggle]').trigger('click')
+    expect(field(wrapper, 'password').attributes('type')).toBe('text')
+    await save(wrapper)
+    const body = (await requestsTo(calls, 'PUT', PERSON)[0]!.clone().json()) as Record<string, unknown>
+    expect(body.password).toBe('new-secret-1')
+    expect(body.password_confirmation).toBe('new-secret-1')
+    for (const name of ['password', 'password_confirmation']) {
+      expect(field(wrapper, name).element.value).toBe('')
+      expect(field(wrapper, name).attributes('type')).toBe('password')
+    }
+    // A second save sends no password again.
+    await field(wrapper, 'name').setValue('Ada King')
+    await save(wrapper)
+    const second = (await requestsTo(calls, 'PUT', PERSON)[1]!.clone().json()) as Record<string, unknown>
+    expect('password' in second).toBe(false)
+  })
+
+  it('keeps the typed password when the save is refused', async () => {
+    const { wrapper } = await mountApp(
+      '/acme/roster/people/1',
+      people({ [`PUT ${PERSON}`]: { status: 403, body: { error: { code: 'forbidden', message: 'Refused.', details: { password: ['Not allowed.'] } } } } }),
+    )
+    await field(wrapper, 'password').setValue('new-secret-1')
+    await field(wrapper, 'password_confirmation').setValue('new-secret-1')
+    await save(wrapper)
+    expect(wrapper.find('[data-forbidden-banner]').text()).toBe('Refused.')
+    expect(field(wrapper, 'password').element.value).toBe('new-secret-1')
+    expect(field(wrapper, 'password').attributes('aria-invalid')).toBe('true')
+  })
+
+  it('on create, sends a password that was typed and cleared as empty, and leaves an untouched one to the server rules', async () => {
+    const invalid = { status: 422, body: { error: { code: 'validation_failed', message: 'Validation failed', details: { password: ['The password is required.'] } } } }
+    const { wrapper, calls } = await mountApp('/acme/roster/people/create', people({ [`POST ${PEOPLE}`]: invalid }))
+    await field(wrapper, 'name').setValue('Grace Hopper')
+    await save(wrapper)
+    const untouched = (await requestsTo(calls, 'POST', PEOPLE)[0]!.clone().json()) as Record<string, unknown>
+    expect(untouched.password ?? '').toBe('')
+    expect(wrapper.text()).toContain('The password is required.')
+    expect(field(wrapper, 'password').attributes('aria-invalid')).toBe('true')
+
+    await field(wrapper, 'password').setValue('typed')
+    await field(wrapper, 'password').setValue('')
+    await save(wrapper)
+    const cleared = (await requestsTo(calls, 'POST', PEOPLE)[1]!.clone().json()) as Record<string, unknown>
+    expect(cleared.password).toBe('')
+  })
+
+  it('fills a preset target on create only, and stops at the first manual edit', async () => {
+    const create = await mountApp('/acme/roster/people/create', people())
+    await field(create.wrapper, 'name').setValue('Zażółć gęślą')
+    expect(field(create.wrapper, 'slug').element.value).toBe('za-g-l')
+    await field(create.wrapper, 'slug').setValue('by-hand')
+    await field(create.wrapper, 'name').setValue('Something Else')
+    expect(field(create.wrapper, 'slug').element.value).toBe('by-hand')
+    // Clearing the target by hand is an edit too: it stays empty.
+    await field(create.wrapper, 'slug').setValue('')
+    await field(create.wrapper, 'name').setValue('Third Name')
+    expect(field(create.wrapper, 'slug').element.value).toBe('')
+    create.wrapper.unmount()
+
+    const update = await mountApp('/acme/roster/people/1', people())
+    await field(update.wrapper, 'name').setValue('Ada King')
+    expect(field(update.wrapper, 'slug').element.value).toBe('ada-lovelace')
+  })
+})

admin/tests/form/PasswordField.test.ts

@@ -0,0 +1,116 @@
+// Password control (UI-SPEC S7, D-19), the component on its own. No
+// application names appear in framework tests.
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { enableAutoUnmount, mount, type VueWrapper } from '@vue/test-utils'
+import { nextTick, ref } from 'vue'
+import type { FormField } from '../../src/api/types'
+import { setBundle } from '../../src/app/i18n'
+import PasswordField from '../../src/components/form/fields/PasswordField.vue'
+import { FORM_SESSION, type FormSession } from '../../src/components/form/formContext'
+import { langFixture } from '../fixtures/typed'
+import { resetState } from '../helpers'
+
+const strings = {
+  'backend::lang.form.show_password': { other: 'Show password' },
+  'backend::lang.form.hide_password': { other: 'Hide password' },
+}
+
+function mountField(props: Record<string, unknown> = {}, revision = ref(0)) {
+  const field = { name: 'password', type: 'password', label: 'Password', ...(props.field as object) } as FormField
+  const wrapper = mount(PasswordField, {
+    props: { modelValue: '', controlId: 'f-password', ...props, field },
+    global: { provide: { [FORM_SESSION as symbol]: { revision } as unknown as FormSession } },
+    attachTo: document.body,
+  })
+  return { wrapper, revision }
+}
+
+const input = (wrapper: VueWrapper) => wrapper.find<HTMLInputElement>('input')
+const toggle = (wrapper: VueWrapper) => wrapper.find('[data-password-toggle]')
+
+beforeEach(() => {
+  resetState()
+  setBundle({ ...langFixture.data, ...strings }, 'en')
+})
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+enableAutoUnmount(afterEach)
+
+describe('password field component (UI-SPEC S7, D-19)', () => {
+  it('is an empty, masked input that asks the browser for a new password', () => {
+    const { wrapper } = mountField()
+    expect(input(wrapper).attributes('type')).toBe('password')
+    expect(input(wrapper).element.value).toBe('')
+    expect(input(wrapper).attributes('id')).toBe('f-password')
+    expect(input(wrapper).attributes('name')).toBe('password')
+    expect(input(wrapper).attributes('autocomplete')).toBe('new-password')
+    expect(input(wrapper).attributes('spellcheck')).toBe('false')
+  })
+
+  it('never shows a value that is not a string', () => {
+    for (const modelValue of [null, undefined, 12345, { hash: '$2a$10$abc' }, ['x']]) {
+      const { wrapper } = mountField({ modelValue })
+      expect(input(wrapper).element.value).toBe('')
+      wrapper.unmount()
+    }
+  })
+
+  it('emits what is typed and does not keep a copy of its own', async () => {
+    const { wrapper } = mountField()
+    await input(wrapper).setValue('s3cret-pass')
+    expect(wrapper.emitted('update:modelValue')).toEqual([['s3cret-pass']])
+    // The control is driven by modelValue: the host clears it after a save.
+    await wrapper.setProps({ modelValue: 's3cret-pass' })
+    await wrapper.setProps({ modelValue: '' })
+    expect(input(wrapper).element.value).toBe('')
+  })
+
+  it('toggles between hidden and visible text and says so with aria-pressed', async () => {
+    const { wrapper } = mountField({ modelValue: 'visible-text' })
+    expect(toggle(wrapper).attributes('type')).toBe('button')
+    expect(toggle(wrapper).attributes('aria-pressed')).toBe('false')
+    expect(toggle(wrapper).attributes('aria-label')).toBe('Show password')
+    await toggle(wrapper).trigger('click')
+    expect(input(wrapper).attributes('type')).toBe('text')
+    expect(toggle(wrapper).attributes('aria-pressed')).toBe('true')
+    expect(toggle(wrapper).attributes('aria-label')).toBe('Hide password')
+    await toggle(wrapper).trigger('click')
+    expect(input(wrapper).attributes('type')).toBe('password')
+    expect(toggle(wrapper).attributes('aria-pressed')).toBe('false')
+    // The toggle changes no value.
+    expect(wrapper.emitted('update:modelValue')).toBeUndefined()
+  })
+
+  it('returns to hidden when the form session moves on (after a save)', async () => {
+    const { wrapper, revision } = mountField({ modelValue: 'visible-text' })
+    await toggle(wrapper).trigger('click')
+    expect(input(wrapper).attributes('type')).toBe('text')
+    revision.value += 1
+    await nextTick()
+    expect(input(wrapper).attributes('type')).toBe('password')
+    expect(toggle(wrapper).attributes('aria-pressed')).toBe('false')
+  })
+
+  it('works without a form session', async () => {
+    const wrapper = mount(PasswordField, {
+      props: { field: { name: 'password', type: 'password' } as FormField, modelValue: '', controlId: 'x' },
+    })
+    await wrapper.find('[data-password-toggle]').trigger('click')
+    expect(wrapper.find('input').attributes('type')).toBe('text')
+  })
+
+  it('marks required and invalid, and points at its comment and error lines', () => {
+    const { wrapper } = mountField({ field: { required: true }, invalid: true, describedBy: 'f-password-error' })
+    expect(input(wrapper).attributes('required')).toBeDefined()
+    expect(input(wrapper).attributes('aria-required')).toBe('true')
+    expect(input(wrapper).attributes('aria-invalid')).toBe('true')
+    expect(input(wrapper).attributes('aria-describedby')).toBe('f-password-error')
+    expect(input(wrapper).classes()).toContain('border-danger')
+    const plain = mountField()
+    expect(input(plain.wrapper).attributes('aria-invalid')).toBeUndefined()
+    expect(input(plain.wrapper).attributes('required')).toBeUndefined()
+  })
+})

admin/tests/form/PermissionEditorField.test.ts

@@ -0,0 +1,218 @@
+// Permission editor (UI-SPEC S5, D-16), the component on its own. Fixtures
+// are neutral acme.roster.* data; no application names appear in framework
+// tests.
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { enableAutoUnmount, flushPromises, mount, type VueWrapper } from '@vue/test-utils'
+import type { FormField } from '../../src/api/types'
+import { setBundle } from '../../src/app/i18n'
+import { permissionValues } from '../../src/components/form/control'
+import PermissionEditorField from '../../src/components/form/fields/PermissionEditorField.vue'
+import { editablePayload } from '../../src/components/form/formState'
+import { clone, langFixture, rosterFormSchemaFixture } from '../fixtures/typed'
+import { keydown, resetState } from '../helpers'
+
+const strings = {
+  'backend::lang.permissioneditor.allow': { other: 'Allow' },
+  'backend::lang.permissioneditor.inherit': { other: 'Inherit' },
+  'backend::lang.permissioneditor.deny': { other: 'Deny' },
+  'backend::lang.permissioneditor.locked': { other: 'You cannot change this permission.' },
+  'backend::lang.permissioneditor.empty': { other: 'No permissions are defined yet.' },
+  'backend::lang.permissioneditor.other': { other: 'Other' },
+}
+
+/** The roster permissions field: Content (2), Reports (1, locked), untabbed (1). */
+function field(change: Partial<FormField> = {}): FormField {
+  return { ...clone(rosterFormSchemaFixture.data.fields.find((item) => item.name === 'permissions')!), ...change }
+}
+
+function mountEditor(props: { field?: FormField; modelValue?: unknown; invalid?: boolean; describedBy?: string } = {}) {
+  return mount(PermissionEditorField, {
+    props: { field: props.field ?? field(), modelValue: props.modelValue ?? {}, controlId: 'p', invalid: props.invalid, describedBy: props.describedBy },
+    attachTo: document.body,
+  })
+}
+
+const row = (wrapper: VueWrapper, code: string) => wrapper.find(`[data-permission="${code}"]`)
+const segment = (wrapper: VueWrapper, code: string, value: string) => row(wrapper, code).find(`[data-segment="${value}"]`)
+const checked = (wrapper: VueWrapper, code: string) => row(wrapper, code).find('[data-state="checked"]')
+const box = (wrapper: VueWrapper, code: string) => row(wrapper, code).find('[role="checkbox"]')
+const emitted = (wrapper: VueWrapper) => (wrapper.emitted('update:modelValue') ?? []).map((args) => args[0])
+
+beforeEach(() => {
+  resetState()
+  setBundle({ ...langFixture.data, ...strings }, 'en')
+})
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+enableAutoUnmount(afterEach)
+
+describe('permission editor component (UI-SPEC S5, D-16)', () => {
+  it('groups the options into sections by tab, in the order sent, untabbed ones last as Other', () => {
+    const options = [
+      { code: 'z.first', label: 'Z first', tab: 'Zeta' },
+      { code: 'loose.one', label: 'Loose one' },
+      { code: 'a.one', label: 'A one', tab: 'Alpha' },
+      { code: 'z.second', label: 'Z second', tab: 'Zeta' },
+      { code: 'loose.two', label: '' },
+    ]
+    const wrapper = mountEditor({ field: field({ permissionOptions: options }) })
+    const sections = wrapper.findAll('[data-permission-section]')
+    expect(sections.map((section) => section.find('h3 span').text())).toEqual(['Zeta', 'Alpha', 'Other'])
+    expect(sections.map((section) => section.findAll('[data-permission]').map((item) => item.attributes('data-permission')))).toEqual([
+      ['z.first', 'z.second'],
+      ['a.one'],
+      ['loose.one', 'loose.two'],
+    ])
+    // Every section is a group named by its heading; a label falls back to the code.
+    expect(sections.every((section) => section.attributes('role') === 'group' && section.attributes('aria-labelledby') === section.find('h3').attributes('id'))).toBe(true)
+    expect(row(wrapper, 'loose.two').text()).toContain('loose.two')
+  })
+
+  it('has no Other section when every option has a tab', () => {
+    const wrapper = mountEditor({ field: field({ permissionOptions: [{ code: 'a.one', label: 'A', tab: 'Alpha' }] }) })
+    expect(wrapper.findAll('[data-permission-section]').map((section) => section.find('h3 span').text())).toEqual(['Alpha'])
+  })
+
+  it('shows the empty state without options, keeping the control id for the label', () => {
+    for (const permissionOptions of [[], undefined]) {
+      const wrapper = mountEditor({ field: field({ permissionOptions }) })
+      const empty = wrapper.find('[data-permission-empty]')
+      expect(empty.text()).toBe('No permissions are defined yet.')
+      expect(empty.attributes('id')).toBe('p')
+      expect(wrapper.find('[data-permission-editor]').exists()).toBe(false)
+      wrapper.unmount()
+    }
+  })
+
+  it('names the group by the field label, or by the field name without one', () => {
+    const labelled = mountEditor()
+    expect(labelled.find('[data-permission-editor]').attributes('aria-labelledby')).toBe('p-label')
+    expect(labelled.find('[data-permission-editor]').attributes('aria-label')).toBeUndefined()
+    const bare = mountEditor({ field: field({ label: '' }) })
+    expect(bare.find('[data-permission-editor]').attributes('aria-label')).toBe('permissions')
+    expect(bare.find('[data-permission-editor]').attributes('aria-labelledby')).toBeUndefined()
+  })
+
+  it('shows the invalid border and points at the error line', async () => {
+    const wrapper = mountEditor({ invalid: true, describedBy: 'p-error' })
+    const editor = wrapper.find('[data-permission-editor]')
+    expect(editor.classes()).toContain('border-danger')
+    expect(editor.classes()).not.toContain('border-border')
+    expect(editor.attributes('aria-describedby')).toBe('p-error')
+    await wrapper.setProps({ invalid: false })
+    expect(wrapper.find('[data-permission-editor]').classes()).toContain('border-border')
+  })
+
+  it('shows stored values: allow, deny, and inherit for a code without one', () => {
+    const wrapper = mountEditor({ modelValue: { 'posts.edit': 1, 'posts.publish': -1 } })
+    expect(wrapper.find('[data-permission-editor]').attributes('data-mode')).toBe('radio')
+    expect(checked(wrapper, 'posts.edit').text()).toBe('Allow')
+    expect(checked(wrapper, 'posts.publish').text()).toBe('Deny')
+    expect(checked(wrapper, 'misc.beta').text()).toBe('Inherit')
+    // Values the mode does not know read as inherit.
+    for (const modelValue of [{ 'posts.edit': 2 }, { 'posts.edit': 'yes' }, { 'posts.edit': null }, null, 'x', [1]]) {
+      const odd = mountEditor({ modelValue })
+      expect(checked(odd, 'posts.edit').text()).toBe('Inherit')
+      odd.unmount()
+    }
+  })
+
+  it('shows a locked row with its stored value, a lock and its text, and a disabled control', async () => {
+    const wrapper = mountEditor({ modelValue: { 'reports.export': 1 } })
+    const locked = row(wrapper, 'reports.export')
+    expect(locked.attributes('data-locked')).toBe('')
+    expect(locked.find('[data-permission-locked]').text()).toBe('You cannot change this permission.')
+    expect(locked.find('svg').attributes('aria-hidden')).toBe('true')
+    expect(checked(wrapper, 'reports.export').text()).toBe('Allow')
+    const group = locked.find('[role="radiogroup"]')
+    expect(group.attributes('aria-disabled')).toBe('true')
+    expect(group.attributes('aria-describedby')).toBe(locked.find('[data-permission-locked]').attributes('id'))
+    // An unlocked row has neither.
+    expect(row(wrapper, 'posts.edit').attributes('data-locked')).toBeUndefined()
+    expect(row(wrapper, 'posts.edit').find('[data-permission-locked]').exists()).toBe(false)
+  })
+
+  it('is read-only as a whole when the field is: every control disabled, no lock shown', async () => {
+    for (const change of [{ readOnly: true }, { attributes: { readonly: true } }] as Partial<FormField>[]) {
+      const wrapper = mountEditor({ field: field(change), modelValue: { 'posts.edit': 1 } })
+      expect(wrapper.findAll('[role="radiogroup"]').every((group) => group.attributes('aria-disabled') === 'true')).toBe(true)
+      expect(wrapper.find('[data-locked]').exists()).toBe(false)
+      expect(wrapper.find('[data-permission-locked]').exists()).toBe(false)
+      await segment(wrapper, 'posts.edit', '-1').trigger('click')
+      expect(emitted(wrapper)).toEqual([])
+      wrapper.unmount()
+    }
+    const boxes = mountEditor({ field: field({ mode: 'checkbox', readOnly: true }), modelValue: {} })
+    expect(boxes.findAll('[role="checkbox"]').every((item) => item.attributes('aria-disabled') === 'true')).toBe(true)
+    await box(boxes, 'posts.edit').trigger('click')
+    expect(emitted(boxes)).toEqual([])
+  })
+
+  it('checkbox mode: one labelled checkbox per row and an Allow column heading', () => {
+    const wrapper = mountEditor({ field: field({ mode: 'checkbox' }), modelValue: { 'posts.edit': 1, 'posts.publish': -1 } })
+    expect(wrapper.find('[data-permission-editor]').attributes('data-mode')).toBe('checkbox')
+    expect(wrapper.find('[role="radiogroup"]').exists()).toBe(false)
+    expect(wrapper.findAll('[data-permission-section] h3 [aria-hidden="true"]').map((item) => item.text())).toEqual(['Allow', 'Allow', 'Allow'])
+    expect(box(wrapper, 'posts.edit').attributes('aria-checked')).toBe('true')
+    // A stored deny is not a checkbox value: it shows unchecked.
+    expect(box(wrapper, 'posts.publish').attributes('aria-checked')).toBe('false')
+    const label = row(wrapper, 'posts.edit').find('label')
+    expect(label.attributes('for')).toBe(box(wrapper, 'posts.edit').attributes('id'))
+    expect(box(wrapper, 'reports.export').attributes('aria-disabled')).toBe('true')
+  })
+
+  it('backstop: radio mode emits 1 and -1 and omits inherit, checkbox mode emits 1 and omits unchecked, a locked row cannot change, and codes outside the options are never sent', async () => {
+    // Radio: a stored code that is not offered (legacy.code) and an
+    // out-of-set value are dropped from everything the control emits.
+    const stored = { 'legacy.code': 1, 'posts.edit': 1, 'posts.publish': 7, 'reports.export': -1 }
+    const radio = mountEditor({ modelValue: stored })
+    await segment(radio, 'posts.publish', '-1').trigger('click')
+    expect(emitted(radio).at(-1)).toEqual({ 'posts.edit': 1, 'posts.publish': -1, 'reports.export': -1 })
+    await radio.setProps({ modelValue: emitted(radio).at(-1) })
+    await segment(radio, 'misc.beta', '1').trigger('click')
+    expect(emitted(radio).at(-1)).toEqual({ 'posts.edit': 1, 'posts.publish': -1, 'reports.export': -1, 'misc.beta': 1 })
+    await radio.setProps({ modelValue: emitted(radio).at(-1) })
+    // Inherit is the absence of the code, never a 0.
+    await segment(radio, 'posts.edit', '0').trigger('click')
+    expect(emitted(radio).at(-1)).toEqual({ 'posts.publish': -1, 'reports.export': -1, 'misc.beta': 1 })
+    expect(Object.values(emitted(radio).at(-1) as Record<string, number>).every((value) => value === 1 || value === -1)).toBe(true)
+
+    // A locked row cannot change: by click, and by the keyboard.
+    const before = emitted(radio).length
+    for (const value of ['1', '0', '-1']) {
+      await segment(radio, 'reports.export', value).trigger('click')
+    }
+    keydown(segment(radio, 'reports.export', '-1').element, 'ArrowLeft')
+    keydown(segment(radio, 'reports.export', '-1').element, ' ')
+    await flushPromises()
+    expect(emitted(radio)).toHaveLength(before)
+    expect(segment(radio, 'reports.export', '1').attributes('disabled')).toBeDefined()
+
+    // Checkbox: checked is 1, unchecked is absent; a stored deny is dropped.
+    const checkbox = mountEditor({ field: field({ mode: 'checkbox' }), modelValue: { 'legacy.code': 1, 'posts.edit': 1, 'posts.publish': -1, 'reports.export': 1 } })
+    await box(checkbox, 'misc.beta').trigger('click')
+    expect(emitted(checkbox).at(-1)).toEqual({ 'posts.edit': 1, 'reports.export': 1, 'misc.beta': 1 })
+    await checkbox.setProps({ modelValue: emitted(checkbox).at(-1) })
+    await box(checkbox, 'posts.edit').trigger('click')
+    expect(emitted(checkbox).at(-1)).toEqual({ 'reports.export': 1, 'misc.beta': 1 })
+    const settled = emitted(checkbox).length
+    await box(checkbox, 'reports.export').trigger('click')
+    expect(emitted(checkbox)).toHaveLength(settled)
+
+    // The save body is reduced the same way, whatever the form state holds.
+    const radioField = field()
+    expect(permissionValues(radioField, { ...stored, 'misc.beta': 0, extra: -1 })).toEqual({ 'posts.edit': 1, 'reports.export': -1 })
+    expect(editablePayload([radioField], { permissions: stored }, 'update')).toEqual({ permissions: { 'posts.edit': 1, 'reports.export': -1 } })
+    const checkboxField = field({ mode: 'checkbox' })
+    expect(editablePayload([checkboxField], { permissions: { 'posts.edit': 1, 'posts.publish': -1, 'legacy.code': 1 } }, 'update')).toEqual({
+      permissions: { 'posts.edit': 1 },
+    })
+    // Nothing stored still sends the field, as an empty object.
+    expect(editablePayload([radioField], {}, 'update')).toEqual({ permissions: {} })
+    // A field with no options can send no code at all.
+    expect(permissionValues(field({ permissionOptions: [] }), stored)).toEqual({})
+  })
+})

admin/tests/form/PreviewField.test.ts

@@ -0,0 +1,154 @@
+// One field of the preview screen (UI-SPEC S3, D-11): every row of the
+// PreviewField table. Fixtures are neutral; no application names appear in
+// framework tests.
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { enableAutoUnmount, mount } from '@vue/test-utils'
+import type { FormField } from '../../src/api/types'
+import { setBundle } from '../../src/app/i18n'
+import PreviewField from '../../src/components/form/PreviewField.vue'
+import { clone, langFixture, rosterFormSchemaFixture } from '../fixtures/typed'
+import { resetState } from '../helpers'
+
+const strings = {
+  'backend::lang.list.empty_value': { other: '—' },
+  'backend::lang.list.column_switch_true': { other: 'Yes' },
+  'backend::lang.list.column_switch_false': { other: 'No' },
+  'backend::lang.permissioneditor.allow': { other: 'Allow' },
+  'backend::lang.permissioneditor.inherit': { other: 'Inherit' },
+  'backend::lang.permissioneditor.deny': { other: 'Deny' },
+  'backend::lang.permissioneditor.locked': { other: 'You cannot change this permission.' },
+  'backend::lang.permissioneditor.other': { other: 'Other' },
+}
+
+function field(change: Partial<FormField>): FormField {
+  return { name: 'note', type: 'text', label: 'Note', ...change } as FormField
+}
+
+function preview(props: { field: FormField; value: unknown; labels?: { value: number; label: string }[] }) {
+  return mount(PreviewField, { props, attachTo: document.body })
+}
+
+beforeEach(() => {
+  resetState()
+  setBundle({ ...langFixture.data, ...strings }, 'en')
+})
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+enableAutoUnmount(afterEach)
+
+describe('preview field (UI-SPEC S3, D-11)', () => {
+  it('is a dt/dd pair: the label names the value and no input is rendered', () => {
+    const wrapper = preview({ field: field({}), value: 'Plain text' })
+    expect(wrapper.attributes('data-preview-field')).toBe('note')
+    expect(wrapper.find('dt').text()).toBe('Note')
+    expect(wrapper.find('dt').attributes('id')).toBe('preview-note-label')
+    expect(wrapper.find('dd [data-preview-value]').text()).toBe('Plain text')
+    expect(wrapper.find('input, textarea, select, button').exists()).toBe(false)
+    // Values keep full contrast: nothing is styled as disabled.
+    expect(wrapper.find('[data-preview-value] span').classes()).not.toContain('text-muted')
+  })
+
+  it('falls back to the field name without a label', () => {
+    expect(preview({ field: field({ label: '' }), value: 'x' }).find('dt').text()).toBe('note')
+  })
+
+  it.each([[null], [undefined], ['']])('shows the muted dash for an empty value (%j)', (value) => {
+    const wrapper = preview({ field: field({}), value })
+    const empty = wrapper.find('[data-preview-value] [data-empty]')
+    expect(empty.text()).toBe('—')
+    expect(empty.classes()).toContain('text-muted')
+  })
+
+  it('renders 0 and false-like text as values, not as empty', () => {
+    expect(preview({ field: field({ type: 'number' }), value: 0 }).find('[data-preview-value]').text()).toBe('0')
+    expect(preview({ field: field({}), value: 'false' }).find('[data-preview-value]').text()).toBe('false')
+  })
+
+  it('renders markup in a value as text', () => {
+    const wrapper = preview({ field: field({}), value: '<img src=x onerror=alert(1)>' })
+    expect(wrapper.find('[data-preview-value]').text()).toBe('<img src=x onerror=alert(1)>')
+    expect(wrapper.find('img').exists()).toBe(false)
+  })
+
+  it('never prints an object or an array as text', () => {
+    for (const value of [{ a: 1 }, [1, 2]]) {
+      const wrapper = preview({ field: field({}), value })
+      expect(wrapper.find('[data-empty]').exists()).toBe(true)
+      expect(wrapper.text()).not.toContain('[object')
+    }
+  })
+
+  it('keeps the line breaks of a textarea and lets long text wrap', () => {
+    const wrapper = preview({ field: field({ type: 'textarea' }), value: 'one\ntwo' })
+    const box = wrapper.find('[data-preview-value]')
+    expect(box.classes()).toEqual(expect.arrayContaining(['whitespace-pre-wrap', '[overflow-wrap:anywhere]']))
+    expect(box.element.textContent).toContain('one\ntwo')
+  })
+
+  it('shows the label of a dropdown option, or the stored value when no option matches', () => {
+    const dropdown = field({ type: 'dropdown', options: [{ value: 'a', label: 'Alpha' }, { value: '2', label: 'Two' }] } as Partial<FormField>)
+    expect(preview({ field: dropdown, value: 'a' }).find('[data-preview-value]').text()).toBe('Alpha')
+    expect(preview({ field: dropdown, value: 2 }).find('[data-preview-value]').text()).toBe('Two')
+    expect(preview({ field: dropdown, value: 'gone' }).find('[data-preview-value]').text()).toBe('gone')
+  })
+
+  it.each([
+    ['switch', true, 'true', 'Yes'],
+    ['switch', 0, 'false', 'No'],
+    ['checkbox', '1', 'true', 'Yes'],
+    ['checkbox', null, 'false', 'No'],
+  ])('renders a %s holding %j as a text pill', (type, value, state, text) => {
+    const wrapper = preview({ field: field({ type }), value })
+    const pill = wrapper.find('[data-switch]')
+    expect(pill.attributes('data-switch')).toBe(state)
+    expect(pill.text()).toBe(text)
+    expect(wrapper.find('[role="switch"], [role="checkbox"], input').exists()).toBe(false)
+  })
+
+  it('shows the label of a single relation from meta.labels, else the empty option or the dash', () => {
+    const relation = field({ type: 'relation' })
+    expect(preview({ field: relation, value: 2, labels: [{ value: 2, label: 'Home' }] }).find('[data-preview-value]').text()).toBe('Home')
+    // The id itself is never shown.
+    expect(preview({ field: relation, value: 2 }).find('[data-preview-value]').text()).toBe('—')
+    expect(preview({ field: field({ type: 'relation', emptyOption: 'No team' } as Partial<FormField>), value: null }).find('[data-empty]').text()).toBe('No team')
+  })
+
+  it('shows a multiple relation as chips with initials and no remove buttons', () => {
+    const many = field({ type: 'relation', multiple: true } as Partial<FormField>)
+    const wrapper = preview({
+      field: many,
+      value: [5, 6],
+      labels: [
+        { value: 5, label: 'team leads' },
+        { value: 6, label: 'news' },
+      ],
+    })
+    const chips = wrapper.findAll('[data-chip]')
+    expect(chips.map((chip) => chip.find('.font-semibold').text())).toEqual(['team leads', 'news'])
+    expect(chips.map((chip) => chip.find('[aria-hidden="true"]').text())).toEqual(['TL', 'N'])
+    expect(wrapper.find('button').exists()).toBe(false)
+    expect(preview({ field: many, value: [] }).find('[data-empty]').text()).toBe('—')
+    // Labels without a list value are not shown.
+    expect(preview({ field: many, value: null, labels: [{ value: 5, label: 'x' }] }).find('[data-chip]').exists()).toBe(false)
+  })
+
+  it('renders a permission editor through its own control, read-only', () => {
+    const permissions = clone(rosterFormSchemaFixture.data.fields.find((item) => item.name === 'permissions')!)
+    const wrapper = preview({ field: permissions, value: { 'posts.edit': 1, 'reports.export': -1 } })
+    expect(wrapper.find('[data-permission-editor]').exists()).toBe(true)
+    expect(wrapper.findAll('[role="radiogroup"]').every((group) => group.attributes('aria-disabled') === 'true')).toBe(true)
+    // A read-only screen shows no lock and no "you cannot change" text.
+    expect(wrapper.find('[data-permission-locked]').exists()).toBe(false)
+    expect(wrapper.find('[data-locked]').exists()).toBe(false)
+    // The field passed on is a copy: the schema's own field is not marked.
+    expect(permissions.readOnly).toBeFalsy()
+  })
+
+  it('uses the id prefix it is given', () => {
+    const wrapper = mount(PreviewField, { props: { field: field({}), value: 'x', idPrefix: 'p2' } })
+    expect(wrapper.find('dt').attributes('id')).toBe('p2-note-label')
+  })
+})

admin/tests/form/PreviewView.test.ts

@@ -0,0 +1,278 @@
+// The preview screen (UI-SPEC S3, D-11) with its footer (UI-SPEC S2, D-10).
+// Fixtures are neutral acme.roster.* data; no application names appear in
+// framework tests.
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { enableAutoUnmount, flushPromises, type VueWrapper } from '@vue/test-utils'
+import { setBundle } from '../../src/app/i18n'
+import { toasts } from '../../src/state/useToasts'
+import PreviewView from '../../src/views/PreviewView.vue'
+import { clone, langFixture, rosterFormSchemaFixture, rosterRecordFixture } from '../fixtures/typed'
+import { API, mountApp, requestsTo, resetState, wait, type Reply, type Route } from '../helpers'
+
+const LIST = `${API}/acme/roster/people`
+const RECORD = `${LIST}/1`
+const HINT = `${LIST}/partials/status`
+const PREVIEW = '/acme/roster/people/1/preview'
+
+const strings = {
+  'backend::lang.form.return_to_list': { other: 'Back to list' },
+  'backend::lang.form.load_failed': { other: 'The form could not be loaded.' },
+  'backend::lang.form.action_confirm': { other: 'Run “:action” on this record?' },
+  'backend::lang.form.action_done': { other: 'Action completed.' },
+  'backend::lang.form.action_stale': { other: 'This action no longer applies to this record.' },
+  'backend::lang.list.empty_value': { other: '—' },
+  'backend::lang.extension.partial_failed': { other: 'This section could not be loaded.' },
+  'backend::lang.permissioneditor.other': { other: 'Other' },
+}
+
+const hint = (text: string) => ({
+  data: { nodes: [{ tag: 'div', attrs: { class: 'summer-callout summer-callout--warning', role: 'status' }, children: [{ tag: 'p', attrs: { class: 'summer-callout__title' }, children: [{ text }] }] }] },
+  meta: {},
+})
+const noHint = { data: { nodes: [] }, meta: {} }
+
+function routes(overrides: Record<string, Route> = {}): Record<string, Route> {
+  return {
+    [`GET ${LIST}/schema/form`]: { body: rosterFormSchemaFixture },
+    [`GET ${RECORD}`]: { body: rosterRecordFixture },
+    [`GET ${HINT}`]: { body: hint('This person is not active') },
+    ...overrides,
+  }
+}
+
+function schemaWith(change: (schema: typeof rosterFormSchemaFixture.data) => void) {
+  const envelope = clone(rosterFormSchemaFixture)
+  change(envelope.data)
+  return { body: envelope }
+}
+
+function recordWith(change: (record: typeof rosterRecordFixture) => void) {
+  const record = clone(rosterRecordFixture)
+  change(record)
+  return { body: record }
+}
+
+const fields = (wrapper: VueWrapper) => wrapper.findAll('[data-preview-field]').map((item) => item.attributes('data-preview-field'))
+const footerButtons = (wrapper: VueWrapper) =>
+  wrapper.findAll('[data-preview] footer button').map((item) => item.attributes('data-record-action') ?? item.attributes('data-action'))
+const dialog = () => document.body.querySelector<HTMLElement>('[data-confirm-dialog]')
+
+async function runAction(wrapper: VueWrapper, name: string): Promise<void> {
+  await wrapper.find(`[data-record-action="${name}"]`).trigger('click')
+  await flushPromises()
+  dialog()!.querySelector<HTMLButtonElement>('[data-action="confirm"]')!.click()
+  await flushPromises()
+  await wait(10)
+  await flushPromises()
+}
+
+beforeEach(() => {
+  resetState()
+  setBundle({ ...langFixture.data, ...strings }, 'en')
+})
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+enableAutoUnmount(afterEach)
+
+describe('preview view (UI-SPEC S3, D-11)', () => {
+  it('is the component of the preview route and renders values as a dl, with no input', async () => {
+    const { wrapper } = await mountApp(PREVIEW, routes())
+    expect(wrapper.findComponent(PreviewView).exists()).toBe(true)
+    expect(wrapper.find('[data-preview] dl').exists()).toBe(true)
+    expect(wrapper.find('[data-preview] dl input, [data-preview] dl textarea, [data-preview] dl select').exists()).toBe(false)
+    expect(wrapper.find('[data-action="save"]').exists()).toBe(false)
+    expect(wrapper.find('[data-action="delete"]').exists()).toBe(false)
+  })
+
+  it('shows the fields of the preview context: preview-only ones in, create and update ones out', async () => {
+    const { wrapper } = await mountApp(PREVIEW, routes())
+    const shown = fields(wrapper)
+    expect(shown).toContain('joined_ip')
+    expect(shown).toEqual(expect.arrayContaining(['name', 'email', 'team', 'tags', 'slug']))
+    for (const hidden of ['password', 'password_confirmation', 'notify', 'permissions']) {
+      expect(shown).not.toContain(hidden)
+    }
+    // A password is never rendered here, even if a response carried one.
+    expect(wrapper.html()).not.toMatch(/type="password"/)
+  })
+
+  it('hides a tab none of whose fields show on the preview, and shows it once one does', async () => {
+    // The Permissions tab holds one update-only field: no such tab here.
+    const { wrapper } = await mountApp(PREVIEW, routes())
+    expect(wrapper.findAll('[role="tab"]').some((tab) => tab.text().includes('Permissions'))).toBe(false)
+    expect(wrapper.find('[data-permission-editor]').exists()).toBe(false)
+    wrapper.unmount()
+
+    const shownOnPreview = schemaWith((schema) => {
+      const permissions = schema.fields.find((field) => field.name === 'permissions')!
+      permissions.context = ['update', 'preview']
+    })
+    const withTab = await mountApp(PREVIEW, routes({ [`GET ${LIST}/schema/form`]: shownOnPreview }))
+    const tab = withTab.wrapper.findAll('[role="tab"]').find((item) => item.text().includes('Permissions'))
+    expect(tab).toBeDefined()
+    await tab!.trigger('click')
+    await flushPromises()
+    // The editor is read-only on this screen.
+    const editor = withTab.wrapper.find('[data-permission-editor]')
+    expect(editor.exists()).toBe(true)
+    expect(editor.findAll('[role="radiogroup"]').every((group) => group.attributes('aria-disabled') === 'true')).toBe(true)
+  })
+
+  it('shows the muted dash for an empty value and the label of a relation, never its id', async () => {
+    const { wrapper } = await mountApp(PREVIEW, routes({ [`GET ${RECORD}`]: recordWith((record) => (record.data.joined_ip = null)) }))
+    expect(wrapper.find('[data-preview-field="joined_ip"] [data-empty]').text()).toBe('—')
+    expect(wrapper.find('[data-preview-field="team"] [data-preview-value]').text()).toBe('Home')
+    expect(wrapper.findAll('[data-preview-field="tags"] [data-chip]').map((chip) => chip.find('.font-semibold').text())).toEqual(['staff', 'news'])
+    expect(wrapper.find('[data-preview-field="tags"] button').exists()).toBe(false)
+  })
+
+  it('asks for the status hint with the record id and renders it between the header and the card', async () => {
+    const { wrapper, calls } = await mountApp(PREVIEW, routes())
+    const [request] = requestsTo(calls, 'GET', HINT)
+    expect(new URL(request!.url).searchParams.get('id')).toBe('1')
+    const callout = wrapper.find('[data-preview] .summer-callout')
+    expect(callout.text()).toBe('This person is not active')
+    expect(callout.attributes('role')).toBe('status')
+    // One callout, above the card with the fields.
+    expect(wrapper.findAll('[data-preview] .summer-callout')).toHaveLength(1)
+    const order = wrapper.find('[data-preview]').html()
+    expect(order.indexOf('summer-callout')).toBeLessThan(order.indexOf('<dl'))
+  })
+
+  it('asks for no hint when the preview block names no partial', async () => {
+    const plain = schemaWith((schema) => (schema.preview = {}))
+    const { wrapper, calls } = await mountApp(PREVIEW, routes({ [`GET ${LIST}/schema/form`]: plain }))
+    expect(requestsTo(calls, 'GET', HINT)).toHaveLength(0)
+    expect(wrapper.find('.summer-callout').exists()).toBe(false)
+    expect(wrapper.find('[data-preview] dl').exists()).toBe(true)
+  })
+
+  it('keeps the previous hint on screen while it reloads after an action', async () => {
+    let release: (reply: Reply) => void = () => undefined
+    let hints = 0
+    const { wrapper } = await mountApp(
+      PREVIEW,
+      routes({
+        [`GET ${HINT}`]: () => {
+          hints += 1
+          if (hints === 1) {
+            return { body: hint('This person is not active') }
+          }
+          return new Promise<Reply>((resolve) => {
+            release = resolve
+          })
+        },
+        [`POST ${RECORD}/actions/activate`]: { body: { data: { message: '', fill: {} }, meta: {} } },
+      }),
+      { attach: true },
+    )
+    await runAction(wrapper, 'activate')
+    expect(hints).toBe(2)
+    // Still the first hint, no skeleton in its place.
+    expect(wrapper.find('.summer-callout').text()).toBe('This person is not active')
+    release({ body: noHint })
+    await flushPromises()
+    expect(wrapper.find('.summer-callout').exists()).toBe(false)
+  })
+
+  it('shows the load failure, the back link and no footer when the record cannot be loaded', async () => {
+    for (const status of [404, 403, 500]) {
+      const { wrapper } = await mountApp(PREVIEW, routes({ [`GET ${RECORD}`]: { status, body: { error: { code: 'x', message: 'Hidden detail', details: {} } } } }))
+      expect(wrapper.find('[role="alert"]').text()).toBe('The form could not be loaded.')
+      expect(wrapper.text()).not.toContain('Hidden detail')
+      expect(wrapper.find('[data-preview] dl').exists()).toBe(false)
+      expect(wrapper.find('[data-action="edit"]').exists()).toBe(false)
+      expect(wrapper.find('[data-record-action]').exists()).toBe(false)
+      expect(wrapper.find('[data-action="back"]').attributes('href')).toBe('/acme/roster/people')
+      wrapper.unmount()
+      resetState()
+      setBundle({ ...langFixture.data, ...strings }, 'en')
+    }
+  })
+
+  it('shows the load failure when the form schema cannot be loaded', async () => {
+    const { wrapper } = await mountApp(PREVIEW, routes({ [`GET ${LIST}/schema/form`]: { status: 500, body: { error: { code: 'x', message: 'x', details: {} } } } }))
+    expect(wrapper.find('[role="alert"]').text()).toBe('The form could not be loaded.')
+    expect(wrapper.find('[data-action="edit"]').exists()).toBe(false)
+  })
+})
+
+describe('preview view footer (UI-SPEC S2, D-10)', () => {
+  it('zero actions: the edit button alone', async () => {
+    for (const change of [(record: typeof rosterRecordFixture) => delete record.meta.actions, (record: typeof rosterRecordFixture) => (record.meta.actions = [])]) {
+      const { wrapper } = await mountApp(PREVIEW, routes({ [`GET ${RECORD}`]: recordWith(change) }))
+      expect(footerButtons(wrapper)).toEqual(['edit'])
+      wrapper.unmount()
+      resetState()
+      setBundle({ ...langFixture.data, ...strings }, 'en')
+    }
+  })
+
+  it('one action: it comes before the one primary edit button', async () => {
+    const { wrapper } = await mountApp(PREVIEW, routes({ [`GET ${RECORD}`]: recordWith((record) => (record.meta.actions = [{ name: 'activate', label: 'Activate' }])) }))
+    expect(footerButtons(wrapper)).toEqual(['activate', 'edit'])
+    expect(wrapper.findAll('[data-preview] footer .bg-primary')).toHaveLength(1)
+    expect(wrapper.find('[data-action="edit"]').classes()).toContain('bg-primary')
+  })
+
+  it('several actions: in the order the server offers them, edit last', async () => {
+    const offered = [
+      { name: 'reinstate', label: 'Reinstate' },
+      { name: 'activate', label: 'Activate' },
+      { name: 'resend', label: 'Send the invitation again' },
+    ]
+    const { wrapper } = await mountApp(PREVIEW, routes({ [`GET ${RECORD}`]: recordWith((record) => (record.meta.actions = offered)) }))
+    expect(footerButtons(wrapper)).toEqual(['reinstate', 'activate', 'resend', 'edit'])
+    expect(wrapper.find('[data-preview] footer').classes()).toContain('flex-wrap')
+  })
+
+  it('after an action: a success toast, then the record and the hint are read again', async () => {
+    const after = recordWith((record) => (record.meta.actions = [{ name: 'reinstate', label: 'Reinstate' }]))
+    let reads = 0
+    const { wrapper, calls } = await mountApp(
+      PREVIEW,
+      routes({
+        [`GET ${RECORD}`]: () => {
+          reads += 1
+          return reads === 1 ? { body: rosterRecordFixture } : after
+        },
+        [`POST ${RECORD}/actions/activate`]: { body: { data: { message: 'The person was activated.', fill: {} }, meta: {} } },
+      }),
+      { attach: true },
+    )
+    await runAction(wrapper, 'activate')
+    expect(toasts.value.map((toast) => [toast.text, toast.tone])).toEqual([['The person was activated.', 'success']])
+    expect(reads).toBe(2)
+    expect(requestsTo(calls, 'GET', HINT)).toHaveLength(2)
+    // The action that no longer applies is gone from the footer.
+    expect(footerButtons(wrapper)).toEqual(['reinstate', 'edit'])
+  })
+
+  it('409: the record is read again; 404: the screen turns into the load failure', async () => {
+    const stale = await mountApp(PREVIEW, routes({ [`POST ${RECORD}/actions/activate`]: { status: 409, body: { error: { code: 'conflict', message: 'x', details: {} } } } }), { attach: true })
+    await runAction(stale.wrapper, 'activate')
+    expect(requestsTo(stale.calls, 'GET', RECORD)).toHaveLength(2)
+    expect(toasts.value.map((toast) => toast.tone)).toEqual(['danger'])
+    expect(stale.wrapper.find('[data-preview] dl').exists()).toBe(true)
+    stale.wrapper.unmount()
+    document.body.innerHTML = ''
+    resetState()
+    setBundle({ ...langFixture.data, ...strings }, 'en')
+
+    const gone = await mountApp(PREVIEW, routes(), { attach: true })
+    await runAction(gone.wrapper, 'activate')
+    expect(gone.wrapper.find('[role="alert"]').text()).toBe('The form could not be loaded.')
+    expect(gone.wrapper.find('[data-action="edit"]').exists()).toBe(false)
+  })
+
+  it('edit leads to the record route of the same record', async () => {
+    const { wrapper, router } = await mountApp(PREVIEW, routes())
+    await wrapper.find('[data-action="edit"]').trigger('click')
+    await flushPromises()
+    expect(router.currentRoute.value.name).toBe('record')
+    expect(router.currentRoute.value.path).toBe('/acme/roster/people/1')
+  })
+})

admin/tests/form/RecordActions.test.ts

@@ -0,0 +1,186 @@
+// Record actions (UI-SPEC S2, D-10), the component on its own. Fixtures are
+// neutral acme.roster.* data; no application names appear in framework tests.
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { enableAutoUnmount, flushPromises, mount, type VueWrapper } from '@vue/test-utils'
+import { setBundle } from '../../src/app/i18n'
+import RecordActions from '../../src/components/form/RecordActions.vue'
+import { toasts } from '../../src/state/useToasts'
+import { langFixture } from '../fixtures/typed'
+import { API, mockApi, requestsTo, resetState, type Reply, type Route } from '../helpers'
+
+const RECORD = `${API}/acme/roster/people/4`
+const source = { vendor: 'acme', plugin: 'roster', controller: 'people' }
+const actions = [
+  { name: 'reinstate', label: 'Reinstate', confirm: 'Lift the ban on this person?' },
+  { name: 'activate', label: 'Activate' },
+  { name: 'markup', label: '<b>Bold</b>' },
+]
+const strings = {
+  'backend::lang.form.action_confirm': { other: 'Run “:action” on this record?' },
+  'backend::lang.form.action_done': { other: 'Action completed.' },
+  'backend::lang.form.action_stale': { other: 'This action no longer applies to this record.' },
+  'backend::lang.list.action_forbidden': { other: 'You do not have permission to run this action.' },
+  'backend::lang.extension.action_failed': { other: 'The action could not be completed.' },
+}
+
+const done = (message: string): Reply => ({ body: { data: { message, fill: {} }, meta: {} } })
+const failure = (status: number, message: string): Reply => ({ status, body: { error: { code: 'x', message, details: {} } } })
+
+function mountActions(routes: Record<string, Route>, props: { actions?: typeof actions; disabled?: boolean } = {}) {
+  const calls = mockApi(routes)
+  const wrapper = mount(RecordActions, {
+    props: { source, recordId: 4, actions: props.actions ?? actions, disabled: props.disabled ?? false },
+    attachTo: document.body,
+  })
+  return { wrapper, calls }
+}
+
+const button = (wrapper: VueWrapper, name: string) => wrapper.find(`[data-record-action="${name}"]`)
+const dialog = () => document.body.querySelector<HTMLElement>('[data-confirm-dialog]')
+
+async function run(wrapper: VueWrapper, name: string, answer: 'confirm' | 'cancel' = 'confirm'): Promise<void> {
+  await button(wrapper, name).trigger('click')
+  await flushPromises()
+  dialog()!.querySelector<HTMLButtonElement>(`[data-action="${answer}"]`)!.click()
+  await flushPromises()
+}
+
+beforeEach(() => {
+  resetState()
+  setBundle({ ...langFixture.data, ...strings }, 'en')
+})
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+enableAutoUnmount(afterEach)
+
+describe('record actions component (UI-SPEC S2, D-10)', () => {
+  it('renders the offered actions in the given order, labels as text', () => {
+    const { wrapper } = mountActions({})
+    const buttons = wrapper.findAll('[data-record-action]')
+    expect(buttons.map((item) => item.attributes('data-record-action'))).toEqual(['reinstate', 'activate', 'markup'])
+    expect(buttons[2]!.text()).toBe('<b>Bold</b>')
+    expect(buttons[2]!.find('b').exists()).toBe(false)
+    expect(buttons.every((item) => item.classes().includes('border-border-strong'))).toBe(true)
+    // No primary button here: the host owns the one primary action.
+    expect(wrapper.find('.bg-primary').exists()).toBe(false)
+  })
+
+  it('renders nothing, not even a dialog host, without actions', () => {
+    const { wrapper } = mountActions({}, { actions: [] })
+    expect(wrapper.find('[data-record-action]').exists()).toBe(false)
+    expect(wrapper.html()).not.toContain('button')
+  })
+
+  it('asks with the action confirm text, or the default naming the action', async () => {
+    const { wrapper } = mountActions({})
+    await button(wrapper, 'reinstate').trigger('click')
+    await flushPromises()
+    expect(dialog()!.textContent).toContain('Lift the ban on this person?')
+    expect(dialog()!.querySelector('[data-action="confirm"]')!.textContent?.trim()).toBe('Reinstate')
+    dialog()!.querySelector<HTMLButtonElement>('[data-action="cancel"]')!.click()
+    await flushPromises()
+
+    await button(wrapper, 'activate').trigger('click')
+    await flushPromises()
+    expect(dialog()!.textContent).toContain('Run “Activate” on this record?')
+  })
+
+  it('posts an empty object to the action route of the record and emits done with the server message', async () => {
+    const { wrapper, calls } = mountActions({ [`POST ${RECORD}/actions/activate`]: done('The person was activated.') })
+    await run(wrapper, 'activate')
+    const posts = requestsTo(calls, 'POST', `${RECORD}/actions/activate`)
+    expect(posts).toHaveLength(1)
+    expect(await posts[0]!.json()).toEqual({})
+    expect(wrapper.emitted('done')).toEqual([['The person was activated.']])
+    expect(wrapper.emitted('busy')).toEqual([[true], [false]])
+    expect(toasts.value).toHaveLength(0)
+  })
+
+  it('emits done with the default text when the server sends no message', async () => {
+    const { wrapper } = mountActions({ [`POST ${RECORD}/actions/activate`]: done('') })
+    await run(wrapper, 'activate')
+    expect(wrapper.emitted('done')).toEqual([['Action completed.']])
+  })
+
+  it('sends nothing and emits nothing on cancel', async () => {
+    const { wrapper, calls } = mountActions({ [`POST ${RECORD}/actions/activate`]: done('x') })
+    await run(wrapper, 'activate', 'cancel')
+    expect(calls).toHaveLength(0)
+    expect(wrapper.emitted()).toEqual({})
+    expect(dialog()).toBeNull()
+  })
+
+  it('keeps the dialog open and busy and every button disabled until the request settles', async () => {
+    let release: (reply: Reply) => void = () => undefined
+    const pending = new Promise<Reply>((resolve) => {
+      release = resolve
+    })
+    const { wrapper } = mountActions({ [`POST ${RECORD}/actions/activate`]: () => pending })
+    await button(wrapper, 'activate').trigger('click')
+    await flushPromises()
+    dialog()!.querySelector<HTMLButtonElement>('[data-action="confirm"]')!.click()
+    await flushPromises()
+
+    expect(dialog()).not.toBeNull()
+    expect(dialog()!.querySelector<HTMLButtonElement>('[data-action="confirm"]')!.disabled).toBe(true)
+    expect(wrapper.findAll('[data-record-action]').every((item) => item.attributes('disabled') !== undefined)).toBe(true)
+    expect(wrapper.emitted('busy')).toEqual([[true]])
+    expect(wrapper.emitted('done')).toBeUndefined()
+
+    release(done('Done.'))
+    await flushPromises()
+    expect(dialog()).toBeNull()
+    expect(wrapper.findAll('[data-record-action]').every((item) => item.attributes('disabled') === undefined)).toBe(true)
+    expect(wrapper.emitted('busy')).toEqual([[true], [false]])
+    expect(wrapper.emitted('done')).toEqual([['Done.']])
+  })
+
+  it('409: a danger toast and the stale event, no done', async () => {
+    const { wrapper } = mountActions({ [`POST ${RECORD}/actions/activate`]: failure(409, 'Conflict') })
+    await run(wrapper, 'activate')
+    expect(wrapper.emitted('stale')).toHaveLength(1)
+    expect(wrapper.emitted('done')).toBeUndefined()
+    expect(toasts.value.map((toast) => [toast.text, toast.tone])).toEqual([['This action no longer applies to this record.', 'danger']])
+  })
+
+  it('404: the gone event and no toast', async () => {
+    const { wrapper } = mountActions({})
+    await run(wrapper, 'activate')
+    expect(wrapper.emitted('gone')).toHaveLength(1)
+    expect(wrapper.emitted('stale')).toBeUndefined()
+    expect(toasts.value).toHaveLength(0)
+  })
+
+  it('403: a danger toast with the server message or the fallback, and no event', async () => {
+    const withMessage = mountActions({ [`POST ${RECORD}/actions/activate`]: failure(403, 'Only team leads may activate people.') })
+    await run(withMessage.wrapper, 'activate')
+    expect(toasts.value.map((toast) => [toast.text, toast.tone])).toEqual([['Only team leads may activate people.', 'danger']])
+    expect(Object.keys(withMessage.wrapper.emitted())).toEqual(['busy'])
+    withMessage.wrapper.unmount()
+    resetState()
+    setBundle({ ...langFixture.data, ...strings }, 'en')
+
+    const bare = mountActions({ [`POST ${RECORD}/actions/activate`]: failure(403, '') })
+    await run(bare.wrapper, 'activate')
+    expect(toasts.value.map((toast) => toast.text)).toEqual(['You do not have permission to run this action.'])
+  })
+
+  it('any other failure: a danger toast with the server message or the fallback', async () => {
+    const { wrapper } = mountActions({ [`POST ${RECORD}/actions/activate`]: failure(500, '') })
+    await run(wrapper, 'activate')
+    expect(toasts.value.map((toast) => [toast.text, toast.tone])).toEqual([['The action could not be completed.', 'danger']])
+    expect(wrapper.emitted('done')).toBeUndefined()
+  })
+
+  it('does nothing while the host disables it', async () => {
+    const { wrapper, calls } = mountActions({}, { disabled: true })
+    expect(wrapper.findAll('[data-record-action]').every((item) => item.attributes('disabled') !== undefined)).toBe(true)
+    await button(wrapper, 'activate').trigger('click')
+    await flushPromises()
+    expect(dialog()).toBeNull()
+    expect(calls).toHaveLength(0)
+  })
+})

admin/tests/form/RelationField.test.ts

@@ -1,7 +1,8 @@
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { enableAutoUnmount, flushPromises, mount, type VueWrapper } from '@vue/test-utils'
+import { setBundle } from '../../src/app/i18n'
 import RelationField from '../../src/components/form/fields/RelationField.vue'
-import { formField, optionsFixture, recordFixture } from '../fixtures/typed'
+import { formField, langFixture, optionsFixture, recordFixture } from '../fixtures/typed'
 import { API, keydown, mockApi, queryOf, requestsTo, resetState, wait, type Route } from '../helpers'
 
 const source = { vendor: 'acme', plugin: 'demo', controller: 'widgets' }
@@ -241,3 +242,123 @@ describe('multiple relation (D-18)', () => {
     expect(wrapper.find('[data-chip] .font-semibold').text()).toBe('99')
   })
 })
+
+describe('locked relation options (UI-SPEC S6, D-07)', () => {
+  const NOTE = 'Items marked with a lock need an additional permission to change.'
+  const strings = {
+    'backend::lang.form.locked_item': { other: 'Locked: :name' },
+    'backend::lang.form.locked_note': { other: NOTE },
+    'backend::lang.form.remove_item': { other: 'Remove: :name' },
+  }
+  // Round (3) is a locked value; Large (4) is a locked choice; Extra (7) is free.
+  const lockedLabels = [
+    { value: 3, label: 'Round', locked: true },
+    { value: 1, label: 'Small' },
+  ]
+  const lockedOptions = {
+    data: [
+      { value: 1, label: 'Small' },
+      { value: 3, label: 'Round', locked: true },
+      { value: 4, label: 'Large', locked: true },
+      { value: 7, label: 'Extra' },
+    ],
+    meta: { page: 1, per_page: 20, total: 4, last_page: 1 },
+  }
+  const chipNames = (wrapper: VueWrapper) => wrapper.findAll('[data-chip]').map((chip) => chip.find('.font-semibold').text())
+  const option = (wrapper: VueWrapper, value: number) => wrapper.find(`[role="option"][data-value="${value}"]`)
+  const emitted = (wrapper: VueWrapper) => (wrapper.emitted('update:modelValue') ?? []).map((args) => args[0])
+
+  function mountLocked(modelValue: unknown = [3, 1], labels = lockedLabels) {
+    mockApi(routes({ [`GET ${TAGS}`]: { body: lockedOptions } }))
+    return mountField('tags', modelValue, { labels })
+  }
+
+  beforeEach(() => {
+    setBundle({ ...langFixture.data, ...strings }, 'en')
+  })
+
+  it('shows a locked chip with a lock, its name for screen readers and no remove button', () => {
+    const wrapper = mountLocked()
+    const [round, small] = wrapper.findAll('[data-chip]')
+    expect(round!.find('button').exists()).toBe(false)
+    expect(round!.find('[data-chip-locked] svg').attributes('aria-hidden')).toBe('true')
+    expect(round!.find('[data-chip-locked] .sr-only').text()).toBe('Locked: Round')
+    expect(small!.find('[data-chip-locked]').exists()).toBe(false)
+    expect(small!.find('button').attributes('aria-label')).toBe('Remove: Small')
+  })
+
+  it('shows the note once a locked label or option was seen, and names it in aria-describedby', async () => {
+    const wrapper = mountLocked()
+    const note = wrapper.find('[data-locked-note]')
+    expect(note.text()).toBe(NOTE)
+    expect(combobox(wrapper).attributes('aria-describedby')).toContain(note.attributes('id'))
+
+    // No locked label: no note until an options page brings a locked choice.
+    const plain = mountLocked([1], [{ value: 1, label: 'Small' }])
+    expect(plain.find('[data-locked-note]').exists()).toBe(false)
+    await openList(plain)
+    expect(plain.find('[data-locked-note]').text()).toBe(NOTE)
+  })
+
+  it('has no note and no lock without locked items', async () => {
+    mockApi(routes())
+    const wrapper = mountField('tags', [3, 1])
+    await openList(wrapper)
+    expect(wrapper.find('[data-locked-note]').exists()).toBe(false)
+    expect(wrapper.find('[data-chip-locked]').exists()).toBe(false)
+    expect(wrapper.findAll('[role="option"]').every((item) => item.attributes('aria-disabled') === undefined)).toBe(true)
+  })
+
+  it('backstop: a locked option cannot be chosen by click, Enter or arrow keys, and a locked chip cannot be removed by click or Backspace', async () => {
+    const wrapper = mountLocked()
+    await openList(wrapper)
+
+    // The list offers the unselected choices: Large is locked, Extra is free.
+    expect(optionTexts(wrapper)).toEqual(['Large', 'Extra'])
+    const large = option(wrapper, 4)
+    expect(large.attributes('aria-disabled')).toBe('true')
+    expect(large.classes()).toEqual(expect.arrayContaining(['text-muted', 'cursor-not-allowed']))
+    expect(large.find('svg').exists()).toBe(true)
+    expect(option(wrapper, 7).attributes('aria-disabled')).toBeUndefined()
+
+    // By click.
+    await large.trigger('mousedown')
+    await large.trigger('click')
+    expect(emitted(wrapper)).toEqual([])
+
+    // By the arrow keys: the active option is never the locked one, in
+    // either direction and however often the key is pressed.
+    const search = combobox(wrapper)
+    for (const key of ['ArrowDown', 'ArrowDown', 'ArrowDown', 'ArrowUp', 'ArrowUp', 'Home', 'End']) {
+      keydown(search.element, key)
+      await flushPromises()
+      expect(search.attributes('aria-activedescendant')).not.toBe(large.attributes('id'))
+    }
+    // By Enter: whatever is active, the locked id is not what gets added.
+    keydown(search.element, 'Enter')
+    await flushPromises()
+    for (const value of emitted(wrapper)) {
+      expect(value).not.toContain(4)
+    }
+    expect(emitted(wrapper)).toEqual([[3, 1, 7]])
+
+    // A locked chip has nothing to click, and Backspace removes only
+    // unlocked chips: with the locked one left it does nothing.
+    const chips = mountLocked([3, 1])
+    expect(chips.findAll('[data-chip]')[0]!.find('button').exists()).toBe(false)
+    await chips.findAll('[data-chip]')[0]!.trigger('click')
+    expect(emitted(chips)).toEqual([])
+    keydown(combobox(chips).element, 'Backspace')
+    expect(emitted(chips)).toEqual([[3]])
+    await chips.setProps({ modelValue: [3] })
+    keydown(combobox(chips).element, 'Backspace')
+    keydown(combobox(chips).element, 'Delete')
+    expect(emitted(chips)).toEqual([[3]])
+    expect(chipNames(chips)).toEqual(['Round'])
+
+    // A locked chip in the last position is skipped, not removed.
+    const tail = mountLocked([1, 3])
+    keydown(combobox(tail).element, 'Backspace')
+    expect(emitted(tail)).toEqual([[3]])
+  })
+})

admin/tests/form/formState.test.ts

@@ -7,11 +7,12 @@ import {
   focusField,
   initialValues,
   panelDomId,
+  presetValue,
   snapshot,
   tabDomId,
   tabOf,
 } from '../../src/components/form/formState'
-import { extensionFormSchemaFixture, formField, formSchemaFixture } from '../fixtures/typed'
+import { extensionFormSchemaFixture, formField, formSchemaFixture, rosterFormSchemaFixture } from '../fixtures/typed'
 
 afterEach(() => {
   document.body.innerHTML = ''
@@ -97,3 +98,83 @@ describe('form state helpers', () => {
     expect(focusField('field', 'missing')).toBe(false)
   })
 })
+
+describe('password and permission values in the save body (UI-SPEC S5 and S7)', () => {
+  const fields = rosterFormSchemaFixture.data.fields
+
+  it('leaves an empty password out on update and sends it as entered on create', () => {
+    const pair = fields.filter((field) => field.type === 'password')
+    expect(pair.map((field) => field.name)).toEqual(['password', 'password_confirmation'])
+    expect(editablePayload(pair, { password: '', password_confirmation: '' }, 'update')).toEqual({})
+    expect(editablePayload(pair, { password: null, password_confirmation: null }, 'update')).toEqual({})
+    expect(editablePayload(pair, { password: '', password_confirmation: '' }, 'create')).toEqual({ password: '', password_confirmation: '' })
+    expect(editablePayload(pair, { password: 'new-secret', password_confirmation: 'new-secret' }, 'update')).toEqual({
+      password: 'new-secret',
+      password_confirmation: 'new-secret',
+    })
+    // A lone password is sent as entered: the server's confirmed rule answers.
+    expect(editablePayload(pair, { password: 'new-secret', password_confirmation: '' }, 'update')).toEqual({ password: 'new-secret' })
+    // The default mode is create.
+    expect(editablePayload(pair, { password: '' })).toEqual({ password: '' })
+  })
+
+  it('starts password fields empty, whatever the record holds', () => {
+    const initial = initialValues(fields.filter((field) => field.type === 'password'))
+    expect(initial.password ?? '').toBe('')
+    expect(initial.password_confirmation ?? '').toBe('')
+  })
+
+  it('shows a field with context preview on the preview only, and hides create and update fields there', () => {
+    const byName = (name: string) => fields.find((field) => field.name === name)!
+    expect(contextAllows(byName('joined_ip'), 'preview')).toBe(true)
+    expect(contextAllows(byName('joined_ip'), 'update')).toBe(false)
+    expect(contextAllows(byName('joined_ip'), 'create')).toBe(false)
+    expect(contextAllows(byName('password'), 'preview')).toBe(false)
+    expect(contextAllows(byName('notify'), 'preview')).toBe(false)
+    expect(contextAllows(byName('permissions'), 'preview')).toBe(false)
+    expect(contextAllows(byName('name'), 'preview')).toBe(true)
+  })
+})
+
+describe('preset values (D-27 G7)', () => {
+  // The same table as the user plugin's slug test (models/slug_test.go,
+  // slugCases): the form and the model derive the same slug from a name.
+  const slugCases: Array<[string, string]> = [
+    ['Acme Records', 'acme-records'],
+    ['  Acme -- Records ', 'acme-records'],
+    ['ACME_Records 2', 'acme-records-2'],
+    ['Zażółć gęślą', 'za-g-l'],
+    ['Rock & Roll!!!', 'rock-roll'],
+    ['...leading and trailing...', 'leading-and-trailing'],
+    ['tab\tand\nnewline', 'tab-and-newline'],
+    ['emoji 🎵 music', 'emoji-music'],
+    ['CamelCaseText', 'camelcasetext'],
+    ['9 lives', '9-lives'],
+    ['a', 'a'],
+    ['---', ''],
+    ['   ', ''],
+    ['', ''],
+    ['ąęść', ''],
+    ['Long Name '.repeat(40), 'long-name-'.repeat(40).replace(/-$/, '')],
+  ]
+
+  it.each(slugCases)('slug preset matches the server rule: %j', (text, want) => {
+    expect(presetValue('slug', text)).toBe(want)
+    // A slug is a fixed point of the rule.
+    expect(presetValue('slug', want)).toBe(want)
+  })
+
+  it('copies the text for type exact and for any type it does not know', () => {
+    expect(presetValue('exact', '  Acme -- Records ')).toBe('  Acme -- Records ')
+    expect(presetValue('camel', 'Acme Records')).toBe('Acme Records')
+  })
+
+  it('reads a number as its text and anything else as empty', () => {
+    expect(presetValue('slug', 2026)).toBe('2026')
+    expect(presetValue('exact', 7)).toBe('7')
+    for (const source of [null, undefined, true, { a: 1 }, ['x']]) {
+      expect(presetValue('slug', source)).toBe('')
+      expect(presetValue('exact', source)).toBe('')
+    }
+  })
+})

admin/tests/form/registry.test.ts

@@ -7,6 +7,8 @@ import SwitchField from '../../src/components/form/fields/SwitchField.vue'
 import TextField from '../../src/components/form/fields/TextField.vue'
 import TextareaField from '../../src/components/form/fields/TextareaField.vue'
 import PartialField from '../../src/components/form/fields/PartialField.vue'
+import PasswordField from '../../src/components/form/fields/PasswordField.vue'
+import PermissionEditorField from '../../src/components/form/fields/PermissionEditorField.vue'
 import UnsupportedField from '../../src/components/form/fields/UnsupportedField.vue'
 import WidgetField from '../../src/components/form/fields/WidgetField.vue'
 import RelationManager from '../../src/components/relation/RelationManager.vue'
@@ -148,3 +150,30 @@ describe('control module', () => {
     expect(toggleValue).toBe(control.toggleValue)
   })
 })
+
+describe('Phase 12.1 field types (UI-SPEC S5 and S7)', () => {
+  it('registers password and permissioneditor as editable types with their own controls', () => {
+    expect(rendererFor('password')).toBe(PasswordField)
+    expect(rendererFor('permissioneditor')).toBe(PermissionEditorField)
+    expect(isRegistered('password')).toBe(true)
+    expect(isRegistered('permissioneditor')).toBe(true)
+    // Both hold a form value: they are part of the save body.
+    expect(needsRecord('password')).toBe(false)
+    expect(needsRecord('permissioneditor')).toBe(false)
+  })
+
+  it('labels a password as an input and a permission editor as a group', () => {
+    expect(ownsLabel('password')).toBe(false)
+    expect(ownsLabel('permissioneditor')).toBe(false)
+    expect(groupLabelled('password')).toBe(false)
+    expect(groupLabelled('permissioneditor')).toBe(true)
+  })
+
+  it('still answers the unsupported control for a type it does not know', () => {
+    for (const type of ['passwordeditor', 'Password', 'permission', '']) {
+      expect(isRegistered(type), type).toBe(false)
+      expect(rendererFor(type), type).not.toBe(PasswordField)
+      expect(rendererFor(type), type).not.toBe(PermissionEditorField)
+    }
+  })
+})

admin/tests/list/BulkActionsMenu.test.ts

@@ -0,0 +1,108 @@
+// Bulk actions menu (UI-SPEC S1, D-09), the component on its own. The whole
+// flow with its confirmation is in tests/list/ListView.test.ts. Fixtures are
+// neutral acme.* data; no application names appear in framework tests.
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { enableAutoUnmount, flushPromises, mount, type VueWrapper } from '@vue/test-utils'
+import { setBundle } from '../../src/app/i18n'
+import BulkActionsMenu from '../../src/components/list/BulkActionsMenu.vue'
+import { langFixture } from '../fixtures/typed'
+import { resetState } from '../helpers'
+
+const LONG = 'Move the selected people to the archive of the previous season and notify their team leads'
+const actions = [
+  { name: 'activate', label: 'Activate', confirm: 'Activate the selected people?' },
+  { name: 'archive', label: LONG },
+  { name: 'markup', label: '<img src=x onerror=alert(1)>' },
+]
+
+function mountMenu(props: { actions?: typeof actions; disabled?: boolean } = {}) {
+  return mount(BulkActionsMenu, {
+    props: { actions: props.actions ?? actions, disabled: props.disabled ?? false },
+    attachTo: document.body,
+  })
+}
+
+const trigger = (wrapper: VueWrapper) => wrapper.find('[data-action="bulk-actions"]')
+const items = () => Array.from(document.body.querySelectorAll<HTMLElement>('[data-bulk-menu] [data-bulk-action]'))
+
+async function open(wrapper: VueWrapper): Promise<void> {
+  await trigger(wrapper).trigger('keydown', { key: 'Enter' })
+  await flushPromises()
+}
+
+beforeEach(() => {
+  resetState()
+  setBundle({ ...langFixture.data, 'backend::lang.list.bulk_actions': { other: 'Bulk actions' } }, 'en')
+})
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+enableAutoUnmount(afterEach)
+
+describe('bulk actions menu component (UI-SPEC S1, D-09)', () => {
+  it('is one outline trigger with its label and a decorative chevron', () => {
+    const wrapper = mountMenu()
+    expect(trigger(wrapper).text()).toBe('Bulk actions')
+    expect(trigger(wrapper).classes()).toContain('border-border-strong')
+    expect(trigger(wrapper).attributes('aria-haspopup')).toBe('menu')
+    expect(trigger(wrapper).find('svg').attributes('aria-hidden')).toBe('true')
+    expect(document.body.querySelector('[data-bulk-menu]')).toBeNull()
+  })
+
+  it('keeps its label while disabled and does not open', async () => {
+    const wrapper = mountMenu({ disabled: true })
+    expect(trigger(wrapper).text()).toBe('Bulk actions')
+    expect(trigger(wrapper).attributes('disabled')).toBeDefined()
+    await open(wrapper)
+    expect(document.body.querySelector('[data-bulk-menu]')).toBeNull()
+    await wrapper.setProps({ disabled: false })
+    expect(trigger(wrapper).attributes('disabled')).toBeUndefined()
+  })
+
+  it('lists the actions in the given order as menu items', async () => {
+    const wrapper = mountMenu()
+    await open(wrapper)
+    const menu = document.body.querySelector('[data-bulk-menu]')!
+    expect(menu.getAttribute('role')).toBe('menu')
+    expect(items().map((item) => item.dataset.bulkAction)).toEqual(['activate', 'archive', 'markup'])
+    expect(items().every((item) => item.getAttribute('role') === 'menuitem')).toBe(true)
+    // Declared order, not alphabetical: a reordered list renders reordered.
+    await wrapper.setProps({ actions: [actions[1]!, actions[0]!] })
+    await flushPromises()
+    expect(items().map((item) => item.dataset.bulkAction)).toEqual(['archive', 'activate'])
+  })
+
+  it('lets a long label wrap inside the menu width and renders markup as text', async () => {
+    const wrapper = mountMenu()
+    await open(wrapper)
+    const menu = document.body.querySelector<HTMLElement>('[data-bulk-menu]')!
+    expect(Array.from(menu.classList)).toEqual(expect.arrayContaining(['w-[240px]', 'max-w-[320px]']))
+    const [, long, markup] = items()
+    expect(long!.textContent?.trim()).toBe(LONG)
+    expect(long!.className).not.toMatch(/truncate|whitespace-nowrap|line-clamp/)
+    expect(long!.classList.contains('min-h-10')).toBe(true)
+    expect(markup!.textContent?.trim()).toBe('<img src=x onerror=alert(1)>')
+    expect(markup!.querySelector('img')).toBeNull()
+  })
+
+  it('emits the chosen action name once and closes', async () => {
+    const wrapper = mountMenu()
+    await open(wrapper)
+    items()[1]!.click()
+    await flushPromises()
+    expect(wrapper.emitted('select')).toEqual([['archive']])
+    expect(document.body.querySelector('[data-bulk-menu]')).toBeNull()
+  })
+
+  it('exposes focus(), which moves focus to the trigger', () => {
+    const wrapper = mountMenu()
+    const other = document.createElement('button')
+    document.body.appendChild(other)
+    other.focus()
+    expect(document.activeElement).toBe(other)
+    ;(wrapper.vm as unknown as { focus: () => void }).focus()
+    expect(document.activeElement).toBe(trigger(wrapper).element)
+  })
+})

admin/tests/list/DataTable.test.ts

@@ -141,3 +141,105 @@ describe('data table', () => {
     expect(wrapper.findAll('[data-skeleton]')).toHaveLength(3)
   })
 })
+
+describe('row states in the table (UI-SPEC S4, D-12)', () => {
+  const stateLabels = { deleted: 'Deleted', negative: 'Blocked', disabled: 'Not active' }
+  const rows = (wrapper: Awaited<ReturnType<typeof mountTable>>['wrapper']) => wrapper.findAll('tbody tr')
+  const firstCell = (wrapper: Awaited<ReturnType<typeof mountTable>>['wrapper'], index: number) => rows(wrapper)[index]!.findAll('td:not([data-select])')[0]!
+
+  it('leaves every row unchanged without states', async () => {
+    const { wrapper } = await mountTable({ rowLink, stateLabels })
+    for (const row of rows(wrapper)) {
+      expect(row.attributes('data-row-states')).toBeUndefined()
+      expect(row.find('[data-row-state]').exists()).toBe(false)
+    }
+    expect(firstCell(wrapper, 0).find('a').classes()).toEqual(expect.arrayContaining(['text-text', 'no-underline']))
+    const empty = await mountTable({ rowLink, stateLabels, rowStates: { '1': [] } })
+    expect(rows(empty.wrapper)[0]!.attributes('data-row-states')).toBeUndefined()
+  })
+
+  it.each([
+    ['deleted', ['line-through', 'text-muted'], ['text-danger']],
+    ['negative', ['no-underline', 'text-danger'], ['line-through']],
+    ['disabled', ['no-underline', 'text-muted'], ['line-through', 'text-danger']],
+  ])('styles the first-cell text of a %s row and says the state in a badge', async (state, present, absent) => {
+    const { wrapper } = await mountTable({ rowLink, stateLabels, rowStates: { '1': [state] } })
+    const row = rows(wrapper)[0]!
+    expect(row.attributes('data-row-states')).toBe(state)
+    const link = firstCell(wrapper, 0).find('a')
+    expect(link.classes()).toEqual(expect.arrayContaining(present))
+    for (const name of absent) {
+      expect(link.classes()).not.toContain(name)
+    }
+    const badge = firstCell(wrapper, 0).find(`[data-row-state="${state}"]`)
+    expect(badge.text()).toBe(stateLabels[state as keyof typeof stateLabels])
+    // The badge sits beside the link, never inside the struck text.
+    expect(link.find('[data-row-state]').exists()).toBe(false)
+    // The other row is untouched.
+    expect(rows(wrapper)[1]!.attributes('data-row-states')).toBeUndefined()
+  })
+
+  it('combines states: the attribute lists them and danger wins over muted', async () => {
+    const { wrapper } = await mountTable({ rowLink, stateLabels, rowStates: { '1': ['deleted', 'negative', 'disabled'] } })
+    expect(rows(wrapper)[0]!.attributes('data-row-states')).toBe('deleted negative disabled')
+    const link = firstCell(wrapper, 0).find('a')
+    expect(link.classes()).toEqual(expect.arrayContaining(['line-through', 'text-danger']))
+    expect(firstCell(wrapper, 0).findAll('[data-row-state]').map((badge) => badge.attributes('data-row-state'))).toEqual(['deleted', 'negative', 'disabled'])
+    // Every other cell of a row with a state is muted.
+    expect(rows(wrapper)[0]!.findAll('td:not([data-select])')[1]!.classes()).toContain('text-muted')
+  })
+
+  it('styles plain text the same way when the row has no link', async () => {
+    const { wrapper } = await mountTable({ stateLabels, rowStates: { '1': ['deleted'] } })
+    const cell = firstCell(wrapper, 0)
+    expect(cell.find('a').exists()).toBe(false)
+    expect(cell.find('span.line-through').classes()).toEqual(expect.arrayContaining(['line-through', 'text-muted', 'truncate']))
+    expect(cell.find('[data-row-state="deleted"]').text()).toBe('Deleted')
+  })
+
+  it('keys states by the row id as text and ignores ids that are not on the page', async () => {
+    const { wrapper } = await mountTable({ rowLink, stateLabels, rowStates: { '2': ['disabled'], '99': ['deleted'], abc: ['negative'] } })
+    expect(rows(wrapper)[0]!.attributes('data-row-states')).toBeUndefined()
+    expect(rows(wrapper)[1]!.attributes('data-row-states')).toBe('disabled')
+    expect(wrapper.findAll('[data-row-state]')).toHaveLength(1)
+  })
+
+  it('backstop: a row state outside the fixed set renders no badge and no class', async () => {
+    const hostile = ['starred', 'bg-danger-soft', 'line-through', '<b>x</b>', 'DELETED', 'deleted negative']
+    const { wrapper } = await mountTable({ rowLink, stateLabels: { ...stateLabels, starred: 'Starred' }, rowStates: { '1': hostile } })
+    const row = rows(wrapper)[0]!
+    expect(row.attributes('data-row-states')).toBeUndefined()
+    expect(row.find('[data-row-state]').exists()).toBe(false)
+    expect(row.html()).not.toMatch(/starred|Starred|bg-danger-soft|<b>x<\/b>|DELETED/)
+    const link = firstCell(wrapper, 0).find('a')
+    expect(link.classes()).toEqual(expect.arrayContaining(['text-text', 'no-underline']))
+    expect(link.classes()).not.toContain('line-through')
+    expect(firstCell(wrapper, 0).classes()).not.toContain('text-muted')
+
+    // Beside a known state, only the known one counts.
+    const mixed = await mountTable({ rowLink, stateLabels, rowStates: { '1': ['starred', 'disabled', '<b>x</b>'] } })
+    expect(rows(mixed.wrapper)[0]!.attributes('data-row-states')).toBe('disabled')
+    expect(rows(mixed.wrapper)[0]!.findAll('[data-row-state]').map((badge) => badge.text())).toEqual(['Not active'])
+    expect(rows(mixed.wrapper)[0]!.html()).not.toContain('starred')
+  })
+})
+
+describe('invisible columns (D-27 G6)', () => {
+  it('renders no header and no cell for an invisible column, and keeps the first visible column first', async () => {
+    const hidden = [{ ...listColumn('name'), invisible: true }, listColumn('code'), { ...listColumn('tags'), invisible: true }]
+    const { wrapper } = await mountTable({ rowLink, columns: hidden })
+    expect(wrapper.findAll('th').map((th) => th.text())).toEqual(['Code'])
+    const cells = wrapper.findAll('tbody tr').map((tr) => tr.findAll('td').map((td) => td.text()))
+    expect(cells).toEqual([['W-01'], ['W-02']])
+    // The value of an invisible column is nowhere in the markup.
+    expect(wrapper.html()).not.toContain('Blue widget')
+    // The first visible column carries the row link.
+    expect(wrapper.find('tbody tr td a').text()).toBe('W-01')
+  })
+
+  it('treats invisible false and a missing flag as visible', async () => {
+    const shown = [{ ...listColumn('name'), invisible: false }, listColumn('code')]
+    const { wrapper } = await mountTable({ columns: shown })
+    expect(wrapper.findAll('th').map((th) => th.text())).toEqual(['Name', 'Code'])
+  })
+})

admin/tests/list/ListToolbar.test.ts

@@ -1,6 +1,8 @@
-import { beforeEach, describe, expect, it } from 'vitest'
-import { mount } from '@vue/test-utils'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { flushPromises, mount } from '@vue/test-utils'
+import { setBundle } from '../../src/app/i18n'
 import ListToolbar from '../../src/components/list/ListToolbar.vue'
+import { langFixture } from '../fixtures/typed'
 import { resetState } from '../helpers'
 
 const base = {
@@ -108,3 +110,71 @@ describe('registered toolbar actions (D-12, UI-SPEC S4)', () => {
     expect(bare.find('[data-action]').exists()).toBe(false)
   })
 })
+
+describe('bulk actions in the toolbar (UI-SPEC S1, D-09)', () => {
+  const bulkActions = [
+    { name: 'activate', label: 'Activate' },
+    { name: 'archive', label: 'Archive' },
+  ]
+  const trigger = (wrapper: ReturnType<typeof mount>) => wrapper.find('[data-action="bulk-actions"]')
+
+  beforeEach(() => {
+    setBundle({ ...langFixture.data, 'backend::lang.list.bulk_actions': { other: 'Bulk actions' } }, 'en')
+  })
+
+  afterEach(() => {
+    document.body.innerHTML = ''
+  })
+
+  it('renders no menu with zero permitted actions', () => {
+    const none = mount(ListToolbar, { props: { ...base, selectedCount: 2, selectedLabel: 'Selected 2' } })
+    expect(trigger(none).exists()).toBe(false)
+    const empty = mount(ListToolbar, { props: { ...base, selectedCount: 2, selectedLabel: 'Selected 2', bulkActions: [] } })
+    expect(trigger(empty).exists()).toBe(false)
+    // The built-in delete is not a menu item: it stays the toolbar button.
+    expect(empty.find('[data-action="delete"]').exists()).toBe(true)
+  })
+
+  it('keeps the trigger labelled and disabled until rows are selected, and while a bulk action runs', async () => {
+    const wrapper = mount(ListToolbar, { props: { ...base, bulkActions } })
+    expect(trigger(wrapper).text()).toBe('Bulk actions')
+    expect(trigger(wrapper).attributes('disabled')).toBeDefined()
+    await wrapper.setProps({ selectedCount: 1, selectedLabel: 'Selected 1' })
+    expect(trigger(wrapper).attributes('disabled')).toBeUndefined()
+    await wrapper.setProps({ bulkBusy: true })
+    expect(trigger(wrapper).attributes('disabled')).toBeDefined()
+    expect(trigger(wrapper).text()).toBe('Bulk actions')
+  })
+
+  it('places the menu after the selection pill and before delete and the registered actions', () => {
+    const wrapper = mount(ListToolbar, {
+      props: { ...base, buttons: ['delete', 'recount'], actions: [{ name: 'recount', label: 'Recount' }], bulkActions, selectedCount: 1, selectedLabel: 'Selected 1' },
+    })
+    const order = wrapper.findAll('[data-selected-pill], [data-action]').map((node) => node.attributes('data-action') ?? 'pill')
+    expect(order).toEqual(['pill', 'bulk-actions', 'delete', 'recount'])
+  })
+
+  it('emits bulk with the chosen name and nothing else', async () => {
+    const wrapper = mount(ListToolbar, { props: { ...base, bulkActions, selectedCount: 2, selectedLabel: 'Selected 2' }, attachTo: document.body })
+    await trigger(wrapper).trigger('keydown', { key: 'Enter' })
+    await flushPromises()
+    const items = Array.from(document.body.querySelectorAll<HTMLElement>('[data-bulk-menu] [data-bulk-action]'))
+    expect(items.map((item) => item.dataset.bulkAction)).toEqual(['activate', 'archive'])
+    items[1]!.click()
+    await flushPromises()
+    expect(wrapper.emitted('bulk')).toEqual([['archive']])
+    expect(wrapper.emitted('action')).toBeUndefined()
+    expect(wrapper.emitted('delete')).toBeUndefined()
+    wrapper.unmount()
+  })
+
+  it('exposes focusBulk(), which focuses the menu trigger and is harmless without a menu', () => {
+    const wrapper = mount(ListToolbar, { props: { ...base, bulkActions, selectedCount: 1, selectedLabel: 'Selected 1' }, attachTo: document.body })
+    ;(wrapper.vm as unknown as { focusBulk: () => void }).focusBulk()
+    expect(document.activeElement).toBe(trigger(wrapper).element)
+    wrapper.unmount()
+    const bare = mount(ListToolbar, { props: base, attachTo: document.body })
+    expect(() => (bare.vm as unknown as { focusBulk: () => void }).focusBulk()).not.toThrow()
+    bare.unmount()
+  })
+})

admin/tests/list/ListView.test.ts

@@ -1,9 +1,19 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { enableAutoUnmount, flushPromises } from '@vue/test-utils'
+import { setBundle } from '../../src/app/i18n'
 import ListView from '../../src/views/ListView.vue'
 import { toasts } from '../../src/state/useToasts'
 import { OWNER_ATTRIBUTE } from '../../src/app/pluginAssets'
-import { clone, extensionListSchemaFixture, extensionPartialFixture, listFixture, listSchemaFixture } from '../fixtures/typed'
+import {
+  clone,
+  extensionListSchemaFixture,
+  extensionPartialFixture,
+  langFixture,
+  listFixture,
+  listSchemaFixture,
+  rosterListFixture,
+  rosterListSchemaFixture,
+} from '../fixtures/typed'
 import { API, mountApp, queryOf, requestsTo, resetState, wait, type Reply, type Route } from '../helpers'
 
 const BASE = `${API}/acme/demo/widgets`
@@ -298,3 +308,187 @@ describe('list view extension points (Phase 10.1, D-03, D-11, D-12, D-14)', () =
     expect(seen.links[0]!.disabled).toBe(false)
   })
 })
+
+describe('bulk actions on the list (UI-SPEC S1, D-09)', () => {
+  const PEOPLE = `${API}/acme/roster/people`
+  const strings = {
+    'backend::lang.list.bulk_actions': { other: 'Bulk actions' },
+    'backend::lang.list.bulk_confirm': { other: 'Run “:action” on the selected (:count)?' },
+    'backend::lang.list.bulk_done': { one: 'Action completed for :count record.', other: 'Action completed for :count records.' },
+    'backend::lang.list.bulk_stale': { other: 'Some of the selected records are no longer available.' },
+    'backend::lang.list.action_forbidden': { other: 'You do not have permission to run this action.' },
+    'backend::lang.extension.action_failed': { other: 'The action could not be completed.' },
+  }
+  type Mounted = Awaited<ReturnType<typeof mountApp>>['wrapper']
+
+  function people(overrides: Record<string, Route> = {}): Record<string, Route> {
+    return {
+      [`GET ${PEOPLE}/schema/list`]: { body: rosterListSchemaFixture },
+      [`GET ${PEOPLE}`]: { body: rosterListFixture },
+      ...overrides,
+    }
+  }
+  const ran = (affected: number, message = ''): Reply => ({ body: { data: { message, affected }, meta: {} } })
+  const refused = (status: number, message: string): Reply => ({ status, body: { error: { code: 'x', message, details: {} } } })
+  const trigger = (wrapper: Mounted) => wrapper.find('[data-action="bulk-actions"]')
+  const dialog = () => document.body.querySelector<HTMLElement>('[data-confirm-dialog]')
+  const listGets = (calls: Request[]) => requestsTo(calls, 'GET', PEOPLE).length
+
+  async function select(wrapper: Mounted, count: number): Promise<void> {
+    for (const box of wrapper.findAll('td[data-select] [role="checkbox"]').slice(0, count)) {
+      await box.trigger('click')
+    }
+  }
+  async function choose(wrapper: Mounted, name: string): Promise<void> {
+    await trigger(wrapper).trigger('keydown', { key: 'Enter' })
+    await flushPromises()
+    document.body.querySelector<HTMLElement>(`[data-bulk-menu] [data-bulk-action="${name}"]`)!.click()
+    await flushPromises()
+  }
+  async function answer(action: 'confirm' | 'cancel'): Promise<void> {
+    dialog()!.querySelector<HTMLButtonElement>(`[data-action="${action}"]`)!.click()
+    await flushPromises()
+    await wait(10)
+    await flushPromises()
+  }
+
+  beforeEach(() => {
+    setBundle({ ...langFixture.data, ...strings }, 'en')
+  })
+
+  it('offers the declared actions without the built-in delete, and no menu when none is permitted', async () => {
+    const { wrapper } = await mountApp('/acme/roster/people', people(), { attach: true })
+    await select(wrapper, 1)
+    await trigger(wrapper).trigger('keydown', { key: 'Enter' })
+    await flushPromises()
+    const names = Array.from(document.body.querySelectorAll<HTMLElement>('[data-bulk-menu] [data-bulk-action]')).map((item) => item.dataset.bulkAction)
+    expect(names).toEqual(['activate', 'archive'])
+    wrapper.unmount()
+    document.body.innerHTML = ''
+
+    const only = clone(rosterListSchemaFixture)
+    only.data.bulkActions = [{ name: 'delete', label: 'Delete selected' }]
+    const none = await mountApp('/acme/roster/people', people({ [`GET ${PEOPLE}/schema/list`]: { body: only } }), { attach: true })
+    await select(none.wrapper, 1)
+    expect(trigger(none.wrapper).exists()).toBe(false)
+    expect(none.wrapper.find('[data-action="delete"]').exists()).toBe(true)
+  })
+
+  it('asks with the action text, or the default naming the action and the count', async () => {
+    const { wrapper } = await mountApp('/acme/roster/people', people(), { attach: true })
+    await select(wrapper, 2)
+    await choose(wrapper, 'activate')
+    expect(dialog()!.textContent).toContain('Activate the selected people?')
+    await answer('cancel')
+    await choose(wrapper, 'archive')
+    expect(dialog()!.textContent).toContain('Run “Archive” on the selected (2)?')
+    expect(dialog()!.querySelector('[data-action="confirm"]')!.textContent?.trim()).toBe('Archive')
+  })
+
+  it('posts the selected ids once, toasts the outcome, clears the selection and reloads', async () => {
+    const { wrapper, calls } = await mountApp('/acme/roster/people', people({ [`POST ${PEOPLE}/bulk/archive`]: ran(2) }), { attach: true })
+    const before = listGets(calls)
+    await select(wrapper, 2)
+    await choose(wrapper, 'archive')
+    await answer('confirm')
+    const posts = requestsTo(calls, 'POST', `${PEOPLE}/bulk/archive`)
+    expect(posts).toHaveLength(1)
+    expect(await posts[0]!.json()).toEqual({ ids: [1, 2] })
+    expect(toasts.value.map((toast) => [toast.text, toast.tone])).toEqual([['Action completed for 2 records.', 'success']])
+    expect(wrapper.find('[data-selected-pill]').exists()).toBe(false)
+    expect(listGets(calls)).toBe(before + 1)
+  })
+
+  it('shows the server message when the action sends one', async () => {
+    const { wrapper } = await mountApp('/acme/roster/people', people({ [`POST ${PEOPLE}/bulk/archive`]: ran(1, 'One person was archived.') }), { attach: true })
+    await select(wrapper, 1)
+    await choose(wrapper, 'archive')
+    await answer('confirm')
+    expect(toasts.value.map((toast) => toast.text)).toEqual(['One person was archived.'])
+  })
+
+  it('keeps the dialog busy and the trigger disabled until the request settles', async () => {
+    let release: (reply: Reply) => void = () => undefined
+    const pending = new Promise<Reply>((resolve) => {
+      release = resolve
+    })
+    const { wrapper } = await mountApp('/acme/roster/people', people({ [`POST ${PEOPLE}/bulk/archive`]: () => pending }), { attach: true })
+    await select(wrapper, 1)
+    await choose(wrapper, 'archive')
+    dialog()!.querySelector<HTMLButtonElement>('[data-action="confirm"]')!.click()
+    await flushPromises()
+    expect(dialog()).not.toBeNull()
+    expect(dialog()!.querySelector<HTMLButtonElement>('[data-action="confirm"]')!.disabled).toBe(true)
+    expect(trigger(wrapper).attributes('disabled')).toBeDefined()
+    expect(toasts.value).toHaveLength(0)
+    release(ran(1))
+    await flushPromises()
+    await wait(10)
+    await flushPromises()
+    expect(dialog()).toBeNull()
+    expect(toasts.value).toHaveLength(1)
+  })
+
+  it.each([
+    [409, 'Conflict', 'Some of the selected records are no longer available.', false, 1],
+    [403, 'Only team leads may archive people.', 'Only team leads may archive people.', true, 0],
+    [403, '', 'You do not have permission to run this action.', true, 0],
+    [500, '', 'The action could not be completed.', true, 0],
+  ])('on %i (%j): toast %j, selection kept %s, reloads %i', async (status, message, text, kept, reloads) => {
+    const { wrapper, calls } = await mountApp('/acme/roster/people', people({ [`POST ${PEOPLE}/bulk/archive`]: refused(status, message) }), { attach: true })
+    const before = listGets(calls)
+    await select(wrapper, 2)
+    await choose(wrapper, 'archive')
+    await answer('confirm')
+    expect(toasts.value.map((toast) => [toast.text, toast.tone])).toEqual([[text, 'danger']])
+    expect(wrapper.find('[data-selected-pill]').exists()).toBe(kept)
+    expect(listGets(calls)).toBe(before + reloads)
+  })
+
+  it('backstop: focus returns to the bulk menu trigger after the confirm dialog closes, by confirm and by cancel', async () => {
+    const { wrapper, calls } = await mountApp('/acme/roster/people', people({ [`POST ${PEOPLE}/bulk/archive`]: refused(403, 'Refused.') }), { attach: true })
+    await select(wrapper, 1)
+
+    // By cancel: nothing is sent and the trigger has focus again.
+    await choose(wrapper, 'archive')
+    expect(dialog()).not.toBeNull()
+    expect(document.activeElement).not.toBe(trigger(wrapper).element)
+    await answer('cancel')
+    expect(dialog()).toBeNull()
+    expect(requestsTo(calls, 'POST', `${PEOPLE}/bulk/archive`)).toHaveLength(0)
+    expect(document.activeElement).toBe(trigger(wrapper).element)
+
+    // By Escape, which is a cancel.
+    await choose(wrapper, 'archive')
+    dialog()!.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true }))
+    await flushPromises()
+    await wait(10)
+    await flushPromises()
+    if (dialog()) {
+      await answer('cancel')
+    }
+    expect(document.activeElement).toBe(trigger(wrapper).element)
+
+    // By confirm: the request ran and the trigger has focus again.
+    ;(document.activeElement as HTMLElement).blur()
+    await choose(wrapper, 'archive')
+    await answer('confirm')
+    expect(dialog()).toBeNull()
+    expect(requestsTo(calls, 'POST', `${PEOPLE}/bulk/archive`)).toHaveLength(1)
+    expect(document.activeElement).toBe(trigger(wrapper).element)
+    // The trigger is enabled, so the focus is on a control that can take it.
+    expect(trigger(wrapper).attributes('disabled')).toBeUndefined()
+  })
+
+  it('returns focus to the trigger before a successful run clears the selection', async () => {
+    const { wrapper } = await mountApp('/acme/roster/people', people({ [`POST ${PEOPLE}/bulk/archive`]: ran(1) }), { attach: true })
+    await select(wrapper, 1)
+    const focused: boolean[] = []
+    trigger(wrapper).element.addEventListener('focus', () => focused.push(trigger(wrapper).attributes('disabled') === undefined))
+    await choose(wrapper, 'archive')
+    await answer('confirm')
+    // Focus reached the trigger while it was still enabled.
+    expect(focused).toContain(true)
+    expect(wrapper.find('[data-selected-pill]').exists()).toBe(false)
+  })
+})

admin/tests/list/RowStateBadges.test.ts

@@ -0,0 +1,68 @@
+// Row state badges (UI-SPEC S4, D-12). Fixtures are neutral; no application
+// names appear in framework tests.
+import { describe, expect, it } from 'vitest'
+import { mount } from '@vue/test-utils'
+import RowStateBadges from '../../src/components/list/RowStateBadges.vue'
+
+const labels = { deleted: 'Deleted', negative: 'Blocked', disabled: 'Not active' }
+const badges = (states: readonly string[], use: Record<string, string> = labels) =>
+  mount(RowStateBadges, { props: { states, labels: use } })
+
+describe('row state badges (UI-SPEC S4, D-12)', () => {
+  it.each([
+    ['deleted', 'Deleted', ['border', 'border-border-strong', 'text-muted']],
+    ['negative', 'Blocked', ['bg-danger-soft', 'text-danger']],
+    ['disabled', 'Not active', ['bg-subtle', 'text-muted']],
+  ])('renders %s as a text badge with its own classes', (state, text, classes) => {
+    const wrapper = badges([state])
+    const all = wrapper.findAll('[data-row-state]')
+    expect(all).toHaveLength(1)
+    expect(all[0]!.attributes('data-row-state')).toBe(state)
+    expect(all[0]!.text()).toBe(text)
+    expect(all[0]!.classes()).toEqual(expect.arrayContaining([...classes, 'rounded-pill', 'whitespace-nowrap', 'shrink-0']))
+    // The state is said in text: colour alone would fail WCAG 1.4.1.
+    expect(all[0]!.classes()).not.toContain('sr-only')
+    expect(all[0]!.classes()).not.toContain('line-through')
+  })
+
+  it('renders combined states in the fixed order deleted, negative, disabled', () => {
+    for (const input of [
+      ['disabled', 'negative', 'deleted'],
+      ['negative', 'deleted', 'disabled'],
+      ['deleted', 'negative', 'disabled'],
+    ]) {
+      const wrapper = badges(input)
+      expect(wrapper.findAll('[data-row-state]').map((badge) => badge.attributes('data-row-state'))).toEqual(['deleted', 'negative', 'disabled'])
+    }
+    expect(badges(['disabled', 'deleted']).findAll('[data-row-state]').map((badge) => badge.text())).toEqual(['Deleted', 'Not active'])
+  })
+
+  it('renders a repeated state once', () => {
+    const wrapper = badges(['negative', 'negative', 'negative'])
+    expect(wrapper.findAll('[data-row-state]')).toHaveLength(1)
+  })
+
+  it('renders nothing at all without states', () => {
+    const wrapper = badges([])
+    expect(wrapper.find('span').exists()).toBe(false)
+    expect(wrapper.text()).toBe('')
+  })
+
+  it('falls back to the state name when the schema sends no label for it', () => {
+    expect(badges(['negative'], {}).find('[data-row-state]').text()).toBe('negative')
+  })
+
+  it('backstop: a row state outside the fixed set renders no badge and no class', () => {
+    const hostile = ['starred', 'bg-danger-soft', 'deleted line-through', '<b>x</b>', 'DELETED', '__proto__', 'constructor', '']
+    const wrapper = badges(hostile, { ...labels, starred: 'Starred', constructor: 'Constructor' })
+    expect(wrapper.find('[data-row-state]').exists()).toBe(false)
+    expect(wrapper.find('span').exists()).toBe(false)
+    expect(wrapper.html()).not.toMatch(/starred|bg-danger-soft|line-through|Starred|Constructor/)
+
+    // Next to known states the unknown ones change nothing.
+    const mixed = badges(['starred', 'negative', '<b>x</b>'])
+    expect(mixed.findAll('[data-row-state]').map((badge) => [badge.attributes('data-row-state'), badge.text()])).toEqual([['negative', 'Blocked']])
+    expect(mixed.html()).not.toContain('starred')
+    expect(mixed.find('b').exists()).toBe(false)
+  })
+})

docs/backend/forms.md

@@ -314,6 +314,7 @@ func (MembersController) AdminSetPermissionValues(_ context.Context, field strin
 - A save checks the submitted object inside its transaction, after the Form before-hooks and before the row is written. A value that is not an object of integers, a code the controller does not offer, or a value outside the mode's set is a 422 on the field; a `0` means "no value". The checked set is then handed to `AdminSetPermissionValues`, which decides how it is stored.
 - A stored code that is not among the options is kept as it is: an offered code that is left out loses its value, a code that is not offered is never touched and can never be submitted.
 - An option with `Locked` set is shown with a disabled control. The server enforces it: a save in which a locked code's value differs from the stored one is answered 403 `forbidden` with a message on the field, and nothing is written.
+- A locked code must be stored with a value its mode can send: 1, -1 or no value in radio mode, 1 or no value in checkbox mode. The admin sends only those values, so a locked code stored with anything else never matches, and every save of that record from the admin form is refused for that administrator. Normalize stored values before locking a code.
 - A save that does not send the field leaves the stored permissions alone, and the field's `context` applies as for any field.
 - The keys `options`, `default`, `nameFrom`, `emptyOption`, `relation` and `preset` are refused on the type. A field without `mode`, or on a controller that does not implement the provider, stops the start-up. The type is not available on settings forms or relation forms.
 

docs/backend/relation-manager.md

@@ -78,6 +78,7 @@ func (c MembersController) AdminRelationLocks(ctx context.Context, field string)
 - The server enforces the lock; the flag is only a display aid. A create or update is checked inside its transaction, after the scope check and before any row is written. For a belongsToMany field the locked ids among the record's current links and among the submitted ids must be the same set, so a locked record can be neither added nor removed while other links change freely. For a belongsTo field a change is refused when the current or the submitted record is locked.
 - A refused save is answered 403 `forbidden` with the lock's `Message` (a translation key or text), also as a message on the field, and nothing is written. With an empty `Message` the admin shows its own text.
 - A save that does not send the field is not checked: it changes nothing. A controller without the provider behaves as before.
+- The lock covers the form field only. A relation manager declared for the same relation does not ask the provider: its link and unlink routes change the links whatever the lock says. Give a relation whose links carry privilege one writer, the form field, and declare no relation manager for it.
 - The provider is asked with the request context: `bouncer.User(ctx)` is the administrator, and inside a save `cabana.TxFromContext(ctx)` is the transaction.
 
 ## Relation managers

modules/boardwalk/dist/index.html

@@ -6,7 +6,7 @@
     <meta name="robots" content="noindex, nofollow" />
     <meta name="summer-admin-base" content="__SUMMER_ADMIN_BASE__" />
     <title>SummerCMS</title>
-    <script type="module" crossorigin src="./assets/index-CbohsCp4.js"></script>
+    <script type="module" crossorigin src="./assets/index-z_LzMU8D.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-CqzF_Nki.css">
   </head>
   <body>

modules/cabana/phase121_bulk_test.go

@@ -0,0 +1,369 @@
+package cabana_test
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// rosterLocale sends one bearer request with an Accept-Language header.
+func rosterLocale(env *rosterEnv, method, rel, body, locale string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(method, adminAPI(rel), strings.NewReader(body))
+	if body != "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Accept-Language", locale)
+	req.Header.Set("Authorization", "Bearer "+env.token)
+	rec := httptest.NewRecorder()
+	env.h.ServeHTTP(rec, req)
+	return rec
+}
+
+const (
+	rosterActivate = rosterPeople + "/bulk/activate"
+	rosterArchive  = rosterPeople + "/bulk/archive"
+)
+
+// rosterNames are the names of the records one bulk Run received, in order.
+func rosterNames(records []any) []string {
+	names := make([]string, len(records))
+	for i, record := range records {
+		names[i] = record.(*rosterPerson).Name
+	}
+	return names
+}
+
+// TestBulkActionEmpty: a request without ids is 422 and never reaches Run
+// (D-09).
+func TestBulkActionEmpty(t *testing.T) {
+	env, _ := newRosterEnv(t)
+	for _, body := range []string{`{"ids":[]}`, `{}`, `{"ids":null}`, `{"ids":["x"]}`, `{"ids":[-1]}`, `{"ids":[1.5]}`, `[1]`, `{`, ``} {
+		rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPost, rosterActivate, body, "bearer")
+		actErrorCode(t, rec.Body.Bytes(), "validation_failed")
+	}
+	if calls := env.spy.takeBulk(); len(calls) != 0 {
+		t.Fatalf("a request without ids reached Run: %+v", calls)
+	}
+}
+
+// TestBulkActionDuplicates: repeated ids are one record each.
+func TestBulkActionDuplicates(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	ada := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada"})
+	bob := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bob"})
+	rec := env.expect(t, http.StatusOK, http.MethodPost, rosterActivate, rosterIDs(bob, ada, bob, ada, ada), "bearer")
+	if result := rosterBulkResult(t, rec); result.Affected != 2 {
+		t.Fatalf("affected = %d, want 2", result.Affected)
+	}
+	calls := env.spy.takeBulk()
+	if len(calls) != 1 || !reflect.DeepEqual(rosterNames(calls[0].Records), []string{"Ada", "Bob"}) {
+		t.Fatalf("Run received %+v, want Ada and Bob once each", calls)
+	}
+}
+
+// TestBulkActionOrder: records reach Run ordered by primary key, whatever the
+// order of the posted ids.
+func TestBulkActionOrder(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	var ids []uint
+	for _, name := range []string{"One", "Two", "Three", "Four"} {
+		ids = append(ids, rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: name}))
+	}
+	env.expect(t, http.StatusOK, http.MethodPost, rosterActivate, rosterIDs(ids[3], ids[0], ids[2], ids[1]), "bearer")
+	calls := env.spy.takeBulk()
+	if len(calls) != 1 || !reflect.DeepEqual(rosterNames(calls[0].Records), []string{"One", "Two", "Three", "Four"}) {
+		t.Fatalf("Run received %v", calls)
+	}
+	for i, record := range calls[0].Records {
+		if record.(*rosterPerson).ID != ids[i] {
+			t.Fatalf("record %d has id %d, want %d", i, record.(*rosterPerson).ID, ids[i])
+		}
+	}
+}
+
+// TestBulkActionAbsent: a selection that matches no row answers affected 0
+// and does not call Run.
+func TestBulkActionAbsent(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	kept := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Kept"})
+	// Id 0 is a well-formed id that no row has.
+	for _, body := range []string{rosterIDs(999998, 999999), rosterIDs(0)} {
+		rec := env.expect(t, http.StatusOK, http.MethodPost, rosterActivate, body, "bearer")
+		if result := rosterBulkResult(t, rec); result.Affected != 0 || result.Message != "" {
+			t.Fatalf("%s: result = %+v", body, result)
+		}
+	}
+	if calls := env.spy.takeBulk(); len(calls) != 0 {
+		t.Fatalf("Run was called for an absent selection: %+v", calls)
+	}
+	if rosterLoad(t, gdb, kept).Active {
+		t.Fatal("an unselected row was changed")
+	}
+}
+
+// TestBulkActionPartial: a selection with a present and an absent id is a 409
+// and changes nothing.
+func TestBulkActionPartial(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	ada := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada"})
+	bob := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bob"})
+	rec := env.expect(t, http.StatusConflict, http.MethodPost, rosterActivate, rosterIDs(ada, 999999, bob), "bearer")
+	actErrorCode(t, rec.Body.Bytes(), "conflict")
+	if rosterLoad(t, gdb, ada).Active || rosterLoad(t, gdb, bob).Active {
+		t.Fatal("a partial selection changed a row")
+	}
+	if calls := env.spy.takeBulk(); len(calls) != 0 {
+		t.Fatalf("Run was called for a partial selection: %+v", calls)
+	}
+}
+
+// TestBulkActionScope: ids are resolved through the list scope
+// (ListExtendQuery), so a row of another tenant is absent (T-12.1-01).
+func TestBulkActionScope(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	own := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Own"})
+	foreign := rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Foreign"})
+	trashed := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Trashed", DeletedAt: rosterDeleted()})
+	rec := env.expect(t, http.StatusOK, http.MethodPost, rosterActivate, rosterIDs(foreign), "bearer")
+	if result := rosterBulkResult(t, rec); result.Affected != 0 {
+		t.Fatalf("out-of-scope selection: %+v", result)
+	}
+	env.expect(t, http.StatusConflict, http.MethodPost, rosterActivate, rosterIDs(own, foreign), "bearer")
+	if calls := env.spy.takeBulk(); len(calls) != 0 {
+		t.Fatalf("Run saw a selection with an out-of-scope id: %+v", calls)
+	}
+	if rosterLoad(t, gdb, foreign).Active || rosterLoad(t, gdb, own).Active {
+		t.Fatal("a row was changed")
+	}
+	// The scope of this controller includes soft-deleted rows.
+	rec = env.expect(t, http.StatusOK, http.MethodPost, rosterActivate, rosterIDs(own, trashed), "bearer")
+	if result := rosterBulkResult(t, rec); result.Affected != 2 {
+		t.Fatalf("in-scope selection: %+v", result)
+	}
+}
+
+// TestBulkActionRollback: an error from Run, refusal or failure, rolls every
+// row of the selection back (T-12.1-05).
+func TestBulkActionRollback(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	for _, last := range []struct {
+		name   string
+		status int
+	}{{rosterCrash, http.StatusInternalServerError}, {rosterLocked, http.StatusForbidden}} {
+		first := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "First"})
+		second := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Second"})
+		failing := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: last.name})
+		rec := env.expect(t, last.status, http.MethodPost, rosterArchive, rosterIDs(first, second, failing), "bearer")
+		if strings.Contains(rec.Body.String(), "hunter2") {
+			t.Fatalf("the error text of Run is in the body: %s", rec.Body.String())
+		}
+		for _, id := range []uint{first, second, failing} {
+			if rosterLoad(t, gdb, id).DeletedAt.Valid {
+				t.Fatalf("%s: row %d kept the write of a failed bulk action", last.name, id)
+			}
+		}
+		// Run did see all three rows: the first two were written before the
+		// failure.
+		if calls := env.spy.takeBulk(); len(calls) != 1 || len(calls[0].Records) != 3 {
+			t.Fatalf("%s: Run received %+v", last.name, calls)
+		}
+	}
+}
+
+// TestBulkActionConcurrent: two runs over the same rows, posted in opposite
+// id order, do not deadlock: the second waits for the row locks of the first
+// and then sees its result.
+func TestBulkActionConcurrent(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	ada := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada"})
+	bob := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bob"})
+
+	inside, release := make(chan struct{}), make(chan struct{})
+	var once sync.Once
+	wait := func() {
+		blocked := false
+		once.Do(func() { blocked = true })
+		if blocked {
+			close(inside)
+			<-release
+		}
+	}
+	env.knobs.slowBulk.Store(&wait)
+	t.Cleanup(func() { env.knobs.slowBulk.Store(nil) })
+
+	type answer struct {
+		code     int
+		affected int
+	}
+	run := func(body string, out chan<- answer) {
+		rec := env.call(t, http.MethodPost, rosterActivate, body, "bearer")
+		out <- answer{rec.Code, rosterBulkResult(t, rec).Affected}
+	}
+	first, second := make(chan answer, 1), make(chan answer, 1)
+	go run(rosterIDs(ada, bob), first)
+	select {
+	case <-inside:
+	case <-time.After(10 * time.Second):
+		t.Fatal("the first run never reached its action")
+	}
+	// The first run holds the row locks. The second must wait for them.
+	go run(rosterIDs(bob, ada), second)
+	select {
+	case got := <-second:
+		t.Fatalf("the second run finished while the first held the rows: %+v", got)
+	case <-time.After(300 * time.Millisecond):
+	}
+	close(release)
+	var answers []answer
+	for _, ch := range []chan answer{first, second} {
+		select {
+		case got := <-ch:
+			answers = append(answers, got)
+		case <-time.After(15 * time.Second):
+			t.Fatal("a concurrent bulk action did not finish (deadlock)")
+		}
+	}
+	// Both answer 200; the rows were activated exactly once.
+	if answers[0].code != http.StatusOK || answers[1].code != http.StatusOK {
+		t.Fatalf("answers = %+v", answers)
+	}
+	if answers[0].affected != 2 || answers[1].affected != 0 {
+		t.Fatalf("affected = %d and %d, want 2 and 0: the second run must see the first one's result", answers[0].affected, answers[1].affected)
+	}
+	if !rosterLoad(t, gdb, ada).Active || !rosterLoad(t, gdb, bob).Active {
+		t.Fatal("the rows are not active after both runs")
+	}
+}
+
+// TestBulkActionPermissions: the controller's permission and the action's own
+// (T-12.1-02).
+func TestBulkActionPermissions(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+	rec := env.expect(t, http.StatusForbidden, http.MethodPost, rosterActivate, rosterIDs(idle), "limited")
+	actErrorCode(t, rec.Body.Bytes(), "forbidden")
+	// The permission is checked before the body is read.
+	env.expect(t, http.StatusForbidden, http.MethodPost, rosterActivate, `{`, "limited")
+	if rosterLoad(t, gdb, idle).Active || len(env.spy.takeBulk()) != 0 {
+		t.Fatal("an action ran without its permission")
+	}
+	// Without a token the request is not authenticated at all.
+	req := httptest.NewRequest(http.MethodPost, adminAPI(rosterActivate), strings.NewReader(rosterIDs(idle)))
+	req.Header.Set("Content-Type", "application/json")
+	anonymous := httptest.NewRecorder()
+	env.h.ServeHTTP(anonymous, req)
+	if anonymous.Code != http.StatusUnauthorized {
+		t.Fatalf("anonymous bulk action = %d", anonymous.Code)
+	}
+	// An action that asks for the controller's permission only runs for the
+	// limited administrator.
+	env.expect(t, http.StatusOK, http.MethodPost, rosterArchive, rosterIDs(idle), "limited")
+	if !rosterLoad(t, gdb, idle).DeletedAt.Valid {
+		t.Fatal("archive did not run for the limited administrator")
+	}
+}
+
+// TestBulkActionUndeclared: a name the list does not declare is 404, whatever
+// else is registered under it.
+func TestBulkActionUndeclared(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle", Banned: true})
+	// missing: nowhere. reinstate: a record action. delete and create: the
+	// built-in names, which are never declared actions.
+	for _, name := range []string{"missing", "reinstate", "delete", "create", "Activate", "activate%20"} {
+		rec := env.call(t, http.MethodPost, rosterPeople+"/bulk/"+name, rosterIDs(idle), "bearer")
+		if rec.Code != http.StatusNotFound {
+			t.Fatalf("bulk/%s = %d, want 404", name, rec.Code)
+		}
+	}
+	env.expect(t, http.StatusNotFound, http.MethodPost, "/acme/roster/nobody/bulk/activate", rosterIDs(idle), "bearer")
+	// The route is POST only.
+	if rec := env.call(t, http.MethodGet, rosterActivate, "", "bearer"); rec.Code == http.StatusOK {
+		t.Fatalf("GET on the bulk action route = %d", rec.Code)
+	}
+	if stored := rosterLoad(t, gdb, idle); stored.Active || !stored.Banned || len(env.spy.takeBulk()) != 0 {
+		t.Fatal("an undeclared name ran an action")
+	}
+	// A controller without declared bulk actions has none to run.
+	demo, demoDB := newActEnv(t)
+	gadget := actInsert(t, demoDB, "plain", "acme")
+	demo.expect(t, http.StatusNotFound, http.MethodPost, "/acme/demo/gadgets/bulk/activate", rosterIDs(gadget), "bearer")
+}
+
+// TestBulkActionCSRF: a cookie request needs X-Requested-With (T-12.1-03).
+func TestBulkActionCSRF(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+	rec := env.expect(t, http.StatusForbidden, http.MethodPost, rosterActivate, rosterIDs(idle), "cookie-only")
+	actErrorCode(t, rec.Body.Bytes(), "forbidden")
+	if rosterLoad(t, gdb, idle).Active || len(env.spy.takeBulk()) != 0 {
+		t.Fatal("a cookie request without the header ran the action")
+	}
+	env.expect(t, http.StatusOK, http.MethodPost, rosterActivate, rosterIDs(idle), "cookie")
+	if !rosterLoad(t, gdb, idle).Active {
+		t.Fatal("a cookie request with the header did not run")
+	}
+}
+
+// TestBulkActionMessageLocalized: the action's message is a phrase key
+// resolved in the request locale; an action without one answers an empty
+// message.
+func TestBulkActionMessageLocalized(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	for locale, want := range map[string]string{
+		"en": "The selected people were archived.",
+		"pl": "Zaznaczone osoby zostały zarchiwizowane.",
+	} {
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Spare " + locale})
+		rec := rosterLocale(env, http.MethodPost, rosterArchive, rosterIDs(id), locale)
+		if result := rosterBulkResult(t, rec); rec.Code != http.StatusOK || result.Message != want || result.Affected != 1 {
+			t.Fatalf("%s: status=%d result=%+v, want %q", locale, rec.Code, result, want)
+		}
+	}
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Quiet"})
+	rec := rosterLocale(env, http.MethodPost, rosterActivate, rosterIDs(id), "pl")
+	if result := rosterBulkResult(t, rec); result.Message != "" || !strings.Contains(rec.Body.String(), `"message":""`) {
+		t.Fatalf("an action without a message answered %s", rec.Body.String())
+	}
+	// The list schema localizes label and confirm the same way.
+	schema := rosterLocale(env, http.MethodGet, rosterPeople+"/schema/list", "", "pl")
+	if !strings.Contains(schema.Body.String(), `"label":"Aktywuj","confirm":"Aktywować zaznaczone osoby?"`) {
+		t.Fatalf("pl list schema = %s", schema.Body.String())
+	}
+}
+
+// TestBulkActionBodyCap: a body past http.body_limits.default_bytes is
+// refused before the action runs.
+func TestBulkActionBodyCap(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+	huge := fmt.Sprintf(`{"ids":[%d],"pad":"%s"}`, idle, strings.Repeat("x", 1100<<10))
+	rec := env.expect(t, http.StatusRequestEntityTooLarge, http.MethodPost, rosterActivate, huge, "bearer")
+	if rosterLoad(t, gdb, idle).Active || len(env.spy.takeBulk()) != 0 {
+		t.Fatalf("an oversized request ran the action: %s", rec.Body.String())
+	}
+}
+
+// TestListSchemaBulkActionsFiltered: the list schema offers each
+// administrator the bulk actions they may run, and a filtered answer leaves
+// the cached schema whole.
+func TestListSchemaBulkActionsFiltered(t *testing.T) {
+	env, _ := newRosterEnv(t)
+	full := []string{"delete", "activate", "archive"}
+	for range 2 {
+		if got := rosterBulkNames(t, env, "limited"); !reflect.DeepEqual(got, []string{"delete", "archive"}) {
+			t.Fatalf("limited admin = %v", got)
+		}
+		if got := rosterBulkNames(t, env, "bearer"); !reflect.DeepEqual(got, full) {
+			t.Fatalf("full admin after a filtered request = %v, want %v", got, full)
+		}
+		if got := rosterBulkNames(t, env, "cookie"); !reflect.DeepEqual(got, full) {
+			t.Fatalf("full admin by cookie = %v", got)
+		}
+	}
+}

modules/cabana/phase121_fields_test.go

@@ -0,0 +1,238 @@
+package cabana_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/cabana"
+)
+
+// TestPasswordFieldNeverProjected: no response of any route carries the
+// password key, the submitted text or the stored hash, and the schema serves
+// the field without a value (D-27 G1; T-12.1-10).
+func TestPasswordFieldNeverProjected(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	const plain = "s3cret-plain-text"
+	pair := fmt.Sprintf(`"password":%q,"password_confirmation":%q`, plain, plain)
+	rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Pat",`+pair+`}`, "bearer")
+	created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+	id := uint(created)
+	hash := rosterHash(plain)
+	if rosterLoad(t, gdb, id).Password != hash {
+		t.Fatal("the hook did not store the hash")
+	}
+	bodies := map[string]string{
+		"create":        rec.Body.String(),
+		"show":          env.expect(t, http.StatusOK, http.MethodGet, rosterPath(id, ""), "", "bearer").Body.String(),
+		"list":          env.expect(t, http.StatusOK, http.MethodGet, rosterPeople, "", "bearer").Body.String(),
+		"list search":   env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"?search="+plain, "", "bearer").Body.String(),
+		"update":        env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Pat B",`+pair+`}`, "bearer").Body.String(),
+		"update, plain": env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Pat C"}`, "bearer").Body.String(),
+		"record action": env.expect(t, http.StatusOK, http.MethodPost, rosterPath(id, "/actions/activate"), `{}`, "bearer").Body.String(),
+		"bulk action":   env.expect(t, http.StatusOK, http.MethodPost, rosterArchive, rosterIDs(id), "bearer").Body.String(),
+		"refusal":       env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), `{"name":"Reserved",`+pair+`}`, "bearer").Body.String(),
+		"failure":       env.expect(t, http.StatusInternalServerError, http.MethodPut, rosterPath(id, ""), `{"name":"Boom",`+pair+`}`, "bearer").Body.String(),
+	}
+	for route, body := range bodies {
+		if strings.Contains(body, "password") || strings.Contains(body, plain) || strings.Contains(body, hash) || strings.Contains(body, "sha256:") {
+			t.Fatalf("the %s response carries the password: %s", route, body)
+		}
+	}
+	// A validation failure names the field and still carries no value.
+	rec = env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), fmt.Sprintf(`{"password":%q,"password_confirmation":"other-enough-1"}`, plain), "bearer")
+	if strings.Contains(rec.Body.String(), plain) || strings.Contains(rec.Body.String(), "other-enough-1") {
+		t.Fatalf("a 422 echoes the password: %s", rec.Body.String())
+	}
+	// The search above did not match on the password column either.
+	if strings.Contains(bodies["list search"], `"name":"Pat"`) {
+		t.Fatalf("the list searches the password column: %s", bodies["list search"])
+	}
+	_, raw := rosterFormSchema(t, env, "bearer")
+	for _, field := range []string{
+		`{"name":"password","type":"password","label":"Password","span":"left","context":["create","update"]}`,
+		`{"name":"password_confirmation","type":"password","label":"Repeat the password","span":"right","context":["create","update"]}`,
+	} {
+		if !strings.Contains(raw, field) {
+			t.Fatalf("the schema does not serve %s without a value: %s", field, raw)
+		}
+	}
+}
+
+// TestVirtualFieldsContext: a virtual value reaches the hooks only when the
+// field's context allows the operation, as a copy, and never outside a save
+// (D-27 G2; T-12.1-09).
+func TestVirtualFieldsContext(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	if values, ok := cabana.VirtualFieldsFromContext(context.Background()); ok || values != nil {
+		t.Fatalf("virtual fields outside a save: %v %v", values, ok)
+	}
+	rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Vic","notify":false,`+rosterPair+`}`, "bearer")
+	created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+	id := uint(created)
+	seen := env.spy.takeVirtual()
+	if len(seen) != 2 || seen[0].Hook != "before-create" || seen[1].Hook != "after-create" {
+		t.Fatalf("create hooks = %+v", seen)
+	}
+	for _, hook := range seen {
+		// The before hook removed notify from its own copy.
+		if !hook.Found || len(hook.Values) != 3 || hook.Values["notify"] != false || hook.Values["password"] != "long-enough-1" {
+			t.Fatalf("%s saw %+v", hook.Hook, hook.Values)
+		}
+	}
+	// A create that does not submit a virtual field passes no entry for it.
+	env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Val",`+rosterPair+`}`, "bearer")
+	if seen = env.spy.takeVirtual(); len(seen) != 2 || len(seen[0].Values) != 2 {
+		t.Fatalf("create without notify: %+v", seen)
+	}
+	if _, ok := seen[0].Values["notify"]; ok {
+		t.Fatalf("an absent virtual field got an entry: %+v", seen[0].Values)
+	}
+	// notify has context create: an update never passes it. The password pair
+	// has context create and update: it is passed.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Vic B","notify":true,"password":"another-plain-9","password_confirmation":"another-plain-9"}`, "bearer")
+	seen = env.spy.takeVirtual()
+	if len(seen) != 1 || seen[0].Hook != "before-update" || !seen[0].Found || len(seen[0].Values) != 2 || seen[0].Values["password"] != "another-plain-9" {
+		t.Fatalf("update hook saw %+v", seen)
+	}
+	if rosterLoad(t, gdb, id).Password != rosterHash("another-plain-9") {
+		t.Fatal("the update hook did not receive the password")
+	}
+	// An update without virtual values still reports a save: an empty map.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Vic C"}`, "bearer")
+	if seen = env.spy.takeVirtual(); len(seen) != 1 || !seen[0].Found || len(seen[0].Values) != 0 {
+		t.Fatalf("update without virtual values: %+v", seen)
+	}
+	// A number arrives as decoded from JSON, a json.Number: the fixture's hook
+	// takes a string only, so the stored hash stays.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"password":12345678,"password_confirmation":12345678}`, "bearer")
+	seen = env.spy.takeVirtual()
+	if number, ok := seen[0].Values["password"].(json.Number); len(seen) != 1 || !ok || number.String() != "12345678" {
+		t.Fatalf("a numeric virtual value arrived as %T %v", seen[0].Values["password"], seen[0].Values["password"])
+	}
+	if rosterLoad(t, gdb, id).Password != rosterHash("another-plain-9") {
+		t.Fatal("a numeric password was stored")
+	}
+}
+
+// TestVirtualFieldsNested: a nested value for a virtual field is 422 on the
+// field and reaches no hook.
+func TestVirtualFieldsNested(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Nest", Password: rosterHash("stored-before")})
+	for field, value := range map[string]string{
+		"password":              `{"$ne":""}`,
+		"password_confirmation": `["a","b"]`,
+	} {
+		rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), fmt.Sprintf(`{"name":"Changed",%q:%s}`, field, value), "bearer")
+		rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", field, "The "+field+" field has an invalid value.")
+	}
+	rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPost, rosterPeople, `{"name":"Nested","notify":[true],`+rosterPair+`}`, "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "notify", "The notify field has an invalid value.")
+	if stored := rosterLoad(t, gdb, id); stored.Name != "Nest" || stored.Password != rosterHash("stored-before") {
+		t.Fatalf("a refused save wrote: %+v", stored)
+	}
+	if n := rosterCount(t, env, "Nested"); n != 0 {
+		t.Fatalf("a refused create left %d rows", n)
+	}
+	if seen := env.spy.takeVirtual(); len(seen) != 0 {
+		t.Fatalf("a refused save reached a hook: %+v", seen)
+	}
+}
+
+// TestFormRulesReplaceModelRules: the controller's FormRules are the rules of
+// an admin save, per operation; without them the model's Rules apply (D-28
+// G5).
+func TestFormRulesReplaceModelRules(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Rae", Password: rosterHash("stored-before")})
+	// The model demands a confirmed password on every save; the controller's
+	// update rules do not.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Rae B"}`, "bearer")
+	// The create rules do.
+	rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPost, rosterPeople, `{"name":"No password"}`, "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "password", "The password field is required.")
+	// Both operations keep the name rule.
+	rec = env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), `{"name":""}`, "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "name", "The name field is required.")
+	rec = env.expect(t, http.StatusUnprocessableEntity, http.MethodPost, rosterPeople, `{`+rosterPair+`}`, "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "name", "The name field is required.")
+
+	// The same form on a controller without FormRules: the model's rules.
+	bare, bareDB := newRosterBareEnv(t)
+	other := rosterInsert(t, bareDB, rosterPerson{Tenant: "acme", Name: "Rae", Password: rosterHash("stored-before")})
+	rec = bare.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(other, ""), `{"name":"Rae B"}`, "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "password", "The password field is required.")
+	bare.expect(t, http.StatusOK, http.MethodPut, rosterPath(other, ""), `{"name":"Rae B",`+rosterPair+`}`, "bearer")
+	if stored := rosterLoad(t, bareDB, other); stored.Name != "Rae B" || stored.Password != rosterHash("long-enough-1") {
+		t.Fatalf("stored = %+v", stored)
+	}
+}
+
+// TestFormRulesRequiredMerge: `required: true` in fields.yaml is merged into
+// the rules of a column field and of a virtual field, for the operations the
+// field's context allows.
+func TestFormRulesRequiredMerge(t *testing.T) {
+	fields := rosterFields(t, "        type: checkbox\n        default: true\n", "        type: checkbox\n        default: true\n        required: true\n")
+	fields = strings.Replace(fields, "        type: text\n        span: right\n", "        type: text\n        span: right\n        required: true\n", 1)
+	if !strings.Contains(fields, "span: right\n        required: true") {
+		t.Fatal("the email field was not made required")
+	}
+	env, gdb := newRosterEnvWith(t, func(p *rosterPlugin) {
+		p.fsys = rosterTree(t, map[string]string{rosterFieldsFile: fields})
+	})
+	const email = `"email":"req@example.test"`
+	// The virtual field notify is required on create, where its context is.
+	rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPost, rosterPeople, `{"name":"Req",`+email+`,`+rosterPair+`}`, "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "notify", "The notify field is required.")
+	// The column field email is required although FormRules does not name it.
+	rec = env.expect(t, http.StatusUnprocessableEntity, http.MethodPost, rosterPeople, `{"name":"Req","notify":true,`+rosterPair+`}`, "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "email", "The email field is required.")
+	if n := rosterCount(t, env, "Req"); n != 0 {
+		t.Fatalf("a refused create left %d rows", n)
+	}
+	rec = env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Req","notify":true,`+email+`,`+rosterPair+`}`, "bearer")
+	created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+	// On update notify is outside its context and is not asked for; email is.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(uint(created), ""), `{"name":"Req B"}`, "bearer")
+	rec = env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(uint(created), ""), `{"email":""}`, "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "email", "The email field is required.")
+	if stored := rosterLoad(t, gdb, uint(created)); stored.Name != "Req B" || stored.Email != "req@example.test" {
+		t.Fatalf("stored = %+v", stored)
+	}
+	// The schema tells the client.
+	_, raw := rosterFormSchema(t, env, "bearer")
+	if strings.Count(raw, `"required":true`) != 2 {
+		t.Fatalf("required flags in the schema: %s", raw)
+	}
+}
+
+// TestPresetSchemaShapes: the preset key is served as field and type in both
+// of its YAML shapes (D-27 G7).
+func TestPresetSchemaShapes(t *testing.T) {
+	for _, tc := range []struct{ name, yaml, want string }{
+		{"a field name", "        preset: name\n", `"preset":{"field":"name","type":"slug"}`},
+		{"a mapping with slug", "        preset:\n            field: name\n            type: slug\n", `"preset":{"field":"name","type":"slug"}`},
+		{"a mapping with exact", "        preset:\n            field: name\n            type: exact\n", `"preset":{"field":"name","type":"exact"}`},
+		{"a mapping without a type", "        preset:\n            field: email\n", `"preset":{"field":"email","type":"slug"}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			env, gdb := newRosterEnvWith(t, func(p *rosterPlugin) {
+				p.fsys = rosterTree(t, map[string]string{rosterFieldsFile: rosterFields(t, "        preset: name\n", tc.yaml)})
+			})
+			_, raw := rosterFormSchema(t, env, "bearer")
+			if !strings.Contains(raw, `"name":"slug","type":"text","label":"Slug",`+tc.want) || strings.Count(raw, `"preset"`) != 1 {
+				t.Fatalf("schema = %s, want %s", raw, tc.want)
+			}
+			// The preset is a client rule: the server stores what it is sent.
+			rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Zażółć Gęślą","slug":"sent-by-client",`+rosterPair+`}`, "bearer")
+			created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+			if stored := rosterLoad(t, gdb, uint(created)); stored.Slug != "sent-by-client" {
+				t.Fatalf("stored slug = %q", stored.Slug)
+			}
+		})
+	}
+}

modules/cabana/phase121_fixture_test.go

@@ -10,7 +10,9 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"testing/fstest"
 	"time"
@@ -190,17 +192,58 @@ func (s *rosterSpy) takeBulk() []pact.AdminBulkActionInput {
 	return out
 }
 
+// rosterKnobs switch on failures of the controller's providers, which get no
+// record to carry a sentinel name. A nil pointer switches nothing on.
+type rosterKnobs struct {
+	// permissionOptions makes AdminPermissionOptions fail.
+	permissionOptions atomic.Bool
+	// permissionValues makes AdminPermissionValues fail.
+	permissionValues atomic.Bool
+	// relationLocks makes AdminRelationLocks fail.
+	relationLocks atomic.Bool
+	// slowBulk, when set, runs inside each bulk action after the rows were
+	// locked (concurrency tests).
+	slowBulk atomic.Pointer[func()]
+}
+
+// The sentinel names below make one hook of the roster controller misbehave
+// for the person who carries the name.
+const (
+	// rosterKeep: FormBeforeDelete refuses with a ForbiddenError.
+	rosterKeep = "Keep"
+	// rosterKeepAfter: FormAfterUpdate and FormAfterDelete refuse after the
+	// row was written or removed.
+	rosterKeepAfter = "KeepAfter"
+	// rosterShort: ListRowStates answers one entry too few.
+	rosterShort = "Short"
+	// rosterStateErr: ListRowStates fails with a plain error.
+	rosterStateErr = "StateErr"
+	// rosterAppliesErr: the activate record action's Applies fails.
+	rosterAppliesErr = "AppliesErr"
+	// rosterCrash: the archive bulk action fails with a plain error.
+	rosterCrash = "Crash"
+	// rosterRunErr: the reinstate record action fails with a plain error
+	// after its write.
+	rosterRunErr = "RunErr"
+	// rosterDenyCreate and rosterDenyAfterCreate: the create hooks refuse.
+	rosterDenyCreate      = "DenyCreate"
+	rosterDenyAfterCreate = "DenyAfterCreate"
+)
+
 // rosterPlugin is the acme.roster fixture plugin. fsys, when set, replaces
 // the fixture tree (boot-error tests).
 type rosterPlugin struct {
-	spy  *rosterSpy
-	fsys fs.FS
+	spy   *rosterSpy
+	knobs *rosterKnobs
+	fsys  fs.FS
 	// db is the handle the controller reads filter choices and locked tags
 	// with outside a transaction.
 	db *gorm.DB
 	// relations, when set, rewrites the controller's relation contracts
 	// (boot tests).
 	relations func([]cabana.FieldRelationContract) []cabana.FieldRelationContract
+	// wrap, when set, replaces the controller the plugin registers.
+	wrap func(rosterController) pact.AdminController
 }
 
 func (rosterPlugin) ID() string                   { return "acme.roster" }
@@ -208,7 +251,11 @@ func (rosterPlugin) Requires() []string           { return nil }
 func (rosterPlugin) Register(*backpack.App) error { return nil }
 func (rosterPlugin) Boot(*backpack.App) error     { return nil }
 func (p rosterPlugin) AdminControllers() []pact.AdminController {
-	return []pact.AdminController{rosterController{spy: p.spy, db: p.db, relations: p.relations}}
+	ctl := rosterController{spy: p.spy, knobs: p.knobs, db: p.db, relations: p.relations}
+	if p.wrap != nil {
+		return []pact.AdminController{p.wrap(ctl)}
+	}
+	return []pact.AdminController{ctl}
 }
 func (rosterPlugin) Permissions() []pact.Permission {
 	return []pact.Permission{{Code: "acme.roster.access", Roles: []string{"developer"}}, {Code: "acme.roster.manage", Roles: []string{"developer"}}}
@@ -235,6 +282,7 @@ func (rosterPlugin) LangFS() fs.FS {
 
 type rosterController struct {
 	spy       *rosterSpy
+	knobs     *rosterKnobs
 	db        *gorm.DB
 	relations func([]cabana.FieldRelationContract) []cabana.FieldRelationContract
 }
@@ -272,11 +320,25 @@ func (c rosterController) handle(ctx context.Context) *gorm.DB {
 	return c.db.WithContext(ctx)
 }
 
-// AdminRelationLocks locks the staff tag for an administrator without
-// acme.roster.manage.
+// AdminRelationLocks locks the staff tag and the vault team for an
+// administrator without acme.roster.manage.
 func (c rosterController) AdminRelationLocks(ctx context.Context, field string) (cabana.RelationLock, error) {
+	if c.knobs != nil && c.knobs.relationLocks.Load() {
+		return cabana.RelationLock{}, fmt.Errorf("the lock table said hunter2")
+	}
 	principal, _ := bouncer.User(ctx)
-	if field != "tags" || cabana.Allows(principal, []string{"acme.roster.manage"}) {
+	if cabana.Allows(principal, []string{"acme.roster.manage"}) {
+		return cabana.RelationLock{}, nil
+	}
+	if field == "team" {
+		// The team named vault is locked, without a message of its own.
+		var ids []uint
+		if err := c.handle(ctx).Model(&rosterTeam{}).Where("name = ?", "vault").Pluck("id", &ids).Error; err != nil {
+			return cabana.RelationLock{}, err
+		}
+		return cabana.RelationLock{IDs: ids}, nil
+	}
+	if field != "tags" {
 		return cabana.RelationLock{}, nil
 	}
 	var ids []uint
@@ -339,8 +401,13 @@ func (c rosterController) ListRowStates(ctx context.Context, db *gorm.DB, record
 		if person.DeletedAt.Valid {
 			out[i] = append(out[i], pact.RowStateDeleted)
 		}
-		if person.Name == "Odd" {
+		switch person.Name {
+		case "Odd":
 			out[i] = append(out[i], pact.RowState("starred"))
+		case rosterShort:
+			return out[:len(out)-1], nil
+		case rosterStateErr:
+			return nil, fmt.Errorf("the state table said hunter2")
 		}
 	}
 	return out, nil
@@ -387,7 +454,10 @@ var rosterPermissionCodes = []cabana.PermissionOption{
 
 // AdminPermissionOptions serves the permission editor's options per
 // administrator.
-func (rosterController) AdminPermissionOptions(ctx context.Context, field string) ([]cabana.PermissionOption, error) {
+func (c rosterController) AdminPermissionOptions(ctx context.Context, field string) ([]cabana.PermissionOption, error) {
+	if c.knobs != nil && c.knobs.permissionOptions.Load() {
+		return nil, fmt.Errorf("the permission table said hunter2")
+	}
 	if field != "permissions" {
 		return nil, fmt.Errorf("unknown permission field %s", field)
 	}
@@ -402,7 +472,10 @@ func (rosterController) AdminPermissionOptions(ctx context.Context, field string
 }
 
 // AdminPermissionValues reads the stored JSON object.
-func (rosterController) AdminPermissionValues(_ context.Context, _ string, record any) (map[string]int, error) {
+func (c rosterController) AdminPermissionValues(_ context.Context, _ string, record any) (map[string]int, error) {
+	if c.knobs != nil && c.knobs.permissionValues.Load() {
+		return nil, fmt.Errorf("the permission column said hunter2")
+	}
 	person := record.(*rosterPerson)
 	out := map[string]int{}
 	if person.Permissions == nil || *person.Permissions == "" {
@@ -466,11 +539,33 @@ func (c rosterController) FormBeforeCreate(ctx context.Context, model any) error
 	model.(*rosterPerson).Tenant = "acme"
 	storePassword(model.(*rosterPerson), values)
 	delete(values, "notify")
+	if model.(*rosterPerson).Name == rosterDenyCreate {
+		return rosterRefused
+	}
 	return nil
 }
 
-func (c rosterController) FormAfterCreate(ctx context.Context, _ any) error {
+func (c rosterController) FormAfterCreate(ctx context.Context, model any) error {
 	c.spy.recordVirtual("after-create", ctx)
+	if model.(*rosterPerson).Name == rosterDenyAfterCreate {
+		return rosterRefused
+	}
+	return nil
+}
+
+// FormAfterUpdate refuses the name KeepAfter after the row was written.
+func (rosterController) FormAfterUpdate(_ context.Context, model any) error {
+	if model.(*rosterPerson).Name == rosterKeepAfter {
+		return rosterRefused
+	}
+	return nil
+}
+
+// FormBeforeDelete refuses the person named Keep.
+func (rosterController) FormBeforeDelete(_ context.Context, model any) error {
+	if model.(*rosterPerson).Name == rosterKeep {
+		return rosterRefused
+	}
 	return nil
 }
 
@@ -501,7 +596,24 @@ func (rosterController) FormAfterDelete(ctx context.Context, model any) error {
 	if !ok {
 		return fmt.Errorf("no transaction on the context")
 	}
-	return tx.Unscoped().Delete(model).Error
+	if err := tx.Unscoped().Delete(model).Error; err != nil {
+		return err
+	}
+	// Refused after the row was removed: the transaction must bring it back.
+	if model.(*rosterPerson).Name == rosterKeepAfter {
+		return rosterRefused
+	}
+	return nil
+}
+
+// slow runs the slowBulk knob, when one is set.
+func (c rosterController) slow() {
+	if c.knobs == nil {
+		return
+	}
+	if wait := c.knobs.slowBulk.Load(); wait != nil {
+		(*wait)()
+	}
 }
 
 // AdminBulkActions: activate needs acme.roster.manage and sets active on the
@@ -517,6 +629,7 @@ func (c rosterController) AdminBulkActions() []pact.AdminBulkAction {
 			if !ok {
 				return pact.AdminBulkActionResult{}, fmt.Errorf("no transaction on the context")
 			}
+			c.slow()
 			changed := 0
 			for _, record := range in.Records {
 				person := record.(*rosterPerson)
@@ -540,12 +653,16 @@ func (c rosterController) AdminBulkActions() []pact.AdminBulkAction {
 			if !ok {
 				return pact.AdminBulkActionResult{}, fmt.Errorf("no transaction on the context")
 			}
+			c.slow()
 			for _, record := range in.Records {
 				// A refusal after earlier rows were written: the whole
 				// selection must roll back.
 				if record.(*rosterPerson).Name == rosterLocked {
 					return pact.AdminBulkActionResult{}, rosterRefused
 				}
+				if record.(*rosterPerson).Name == rosterCrash {
+					return pact.AdminBulkActionResult{}, fmt.Errorf("the archive said hunter2")
+				}
 				if err := tx.Delete(record).Error; err != nil {
 					return pact.AdminBulkActionResult{}, err
 				}
@@ -563,6 +680,9 @@ func (c rosterController) AdminRecordActions() []pact.AdminRecordAction {
 		Name: "activate", Label: "acme.roster::lang.people.activate",
 		Permissions: []string{"acme.roster.manage"},
 		Applies: func(_ context.Context, record any) (bool, error) {
+			if record.(*rosterPerson).Name == rosterAppliesErr {
+				return false, fmt.Errorf("the applies check said hunter2")
+			}
 			return !record.(*rosterPerson).Active, nil
 		},
 		Run: func(ctx context.Context, in pact.AdminRecordActionInput) (pact.AdminRecordActionResult, error) {
@@ -594,6 +714,9 @@ func (c rosterController) AdminRecordActions() []pact.AdminRecordAction {
 			if in.Record.(*rosterPerson).Name == rosterLocked {
 				return pact.AdminRecordActionResult{}, rosterRefused
 			}
+			if in.Record.(*rosterPerson).Name == rosterRunErr {
+				return pact.AdminRecordActionResult{}, fmt.Errorf("the reinstate said hunter2")
+			}
 			return pact.AdminRecordActionResult{}, nil
 		},
 	}}
@@ -604,7 +727,8 @@ func (c rosterController) AdminRecordActions() []pact.AdminRecordAction {
 // token), limited (acme.roster.access only), cookie and cookie-only.
 type rosterEnv struct {
 	*actEnv
-	spy *rosterSpy
+	spy   *rosterSpy
+	knobs *rosterKnobs
 }
 
 func newRosterEnv(t *testing.T) (*rosterEnv, *gorm.DB) {
@@ -656,7 +780,8 @@ func newRosterEnvWith(t *testing.T, configure func(*rosterPlugin)) (*rosterEnv,
 		t.Fatal(err)
 	}
 	spy := &rosterSpy{}
-	plugin := rosterPlugin{spy: spy, db: gdb}
+	knobs := &rosterKnobs{}
+	plugin := rosterPlugin{spy: spy, knobs: knobs, db: gdb}
 	if configure != nil {
 		configure(&plugin)
 	}
@@ -668,7 +793,7 @@ func newRosterEnvWith(t *testing.T, configure func(*rosterPlugin)) (*rosterEnv,
 	if err != nil {
 		t.Fatal(err)
 	}
-	env := &rosterEnv{actEnv: &actEnv{h: h}, spy: spy}
+	env := &rosterEnv{actEnv: &actEnv{h: h}, spy: spy, knobs: knobs}
 	rec := postJSON(t, h, adminAPI("/auth/login"), map[string]string{"login": login, "password": adminTestPassword})
 	if rec.Code != http.StatusOK {
 		t.Fatalf("login status=%d body=%s", rec.Code, rec.Body.String())
@@ -747,3 +872,96 @@ func rosterLoad(t *testing.T, gdb *gorm.DB, id uint) rosterPerson {
 	}
 	return person
 }
+
+// rosterBare is the roster controller with an explicit method set: it has no
+// relation lock provider, no FormRules, no FilterOptions and no row states,
+// so the framework's behaviour without those seams is observable. newRecord,
+// when set, replaces the model.
+type rosterBare struct {
+	inner     rosterController
+	newRecord func() any
+}
+
+func (b rosterBare) ID() string                    { return b.inner.ID() }
+func (b rosterBare) ModelName() string             { return b.inner.ModelName() }
+func (b rosterBare) ConfigDir() string             { return b.inner.ConfigDir() }
+func (b rosterBare) RequiredPermissions() []string { return b.inner.RequiredPermissions() }
+func (b rosterBare) NewRecord() any {
+	if b.newRecord != nil {
+		return b.newRecord()
+	}
+	return b.inner.NewRecord()
+}
+func (b rosterBare) ListExtendQuery(ctx context.Context, db *gorm.DB) *gorm.DB {
+	return b.inner.ListExtendQuery(ctx, db)
+}
+func (b rosterBare) FormExtendQuery(ctx context.Context, db *gorm.DB) *gorm.DB {
+	return b.inner.FormExtendQuery(ctx, db)
+}
+func (b rosterBare) AdminFieldRelations() []cabana.FieldRelationContract {
+	return b.inner.AdminFieldRelations()
+}
+func (b rosterBare) RelationExtendOptionsQuery(ctx context.Context, field string, db *gorm.DB) *gorm.DB {
+	return b.inner.RelationExtendOptionsQuery(ctx, field, db)
+}
+func (b rosterBare) FormVirtualFields() []string { return b.inner.FormVirtualFields() }
+func (b rosterBare) FormBeforeCreate(ctx context.Context, model any) error {
+	return b.inner.FormBeforeCreate(ctx, model)
+}
+func (b rosterBare) FormBeforeUpdate(ctx context.Context, model any) error {
+	return b.inner.FormBeforeUpdate(ctx, model)
+}
+func (b rosterBare) AdminPermissionOptions(ctx context.Context, field string) ([]cabana.PermissionOption, error) {
+	return b.inner.AdminPermissionOptions(ctx, field)
+}
+func (b rosterBare) AdminPermissionValues(ctx context.Context, field string, record any) (map[string]int, error) {
+	return b.inner.AdminPermissionValues(ctx, field, record)
+}
+func (b rosterBare) AdminSetPermissionValues(ctx context.Context, field string, record any, values map[string]int) error {
+	return b.inner.AdminSetPermissionValues(ctx, field, record, values)
+}
+func (b rosterBare) AdminBulkActions() []pact.AdminBulkAction { return b.inner.AdminBulkActions() }
+func (b rosterBare) AdminRecordActions() []pact.AdminRecordAction {
+	return b.inner.AdminRecordActions()
+}
+func (b rosterBare) PartialData(ctx context.Context, name string, record any) (any, error) {
+	return b.inner.PartialData(ctx, name, record)
+}
+
+// rosterOptionsPerson is the roster model that serves its tagged filter's
+// choices itself (the model fallback of pact.FilterOptions).
+type rosterOptionsPerson struct {
+	rosterPerson
+}
+
+func (rosterOptionsPerson) FilterOptions(scope string) []pact.Option {
+	if scope != "tagged" {
+		return nil
+	}
+	return []pact.Option{{Value: "1", Label: "acme.roster::lang.people.tags"}, {Value: "2", Label: "Plain label"}}
+}
+
+// rosterListNoFilter is the fixture's config_list.yaml without its filter.
+func rosterListNoFilter(t *testing.T) string {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(rosterDir, "controllers/people/config_list.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	const line = "filter: config_filter.yaml\n"
+	if !strings.Contains(string(raw), line) {
+		t.Fatal("the fixture list has no filter line")
+	}
+	return strings.Replace(string(raw), line, "", 1)
+}
+
+// newRosterBareEnv assembles the roster fixture around rosterBare, without
+// the list filter (which needs FilterOptions).
+func newRosterBareEnv(t *testing.T) (*rosterEnv, *gorm.DB) {
+	t.Helper()
+	list := rosterListNoFilter(t)
+	return newRosterEnvWith(t, func(p *rosterPlugin) {
+		p.fsys = rosterTree(t, map[string]string{"controllers/people/config_list.yaml": list})
+		p.wrap = func(inner rosterController) pact.AdminController { return rosterBare{inner: inner} }
+	})
+}

modules/cabana/phase121_forbidden_test.go

@@ -0,0 +1,192 @@
+package cabana_test
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+const rosterLockedMessage = "This person is locked and cannot be changed."
+
+// rosterCount counts the people named name, soft-deleted or not.
+func rosterCount(t *testing.T, env *rosterEnv, name string) int {
+	t.Helper()
+	body, _ := rosterList(t, env, "?search="+url.QueryEscape(name))
+	n := 0
+	for _, row := range body.Data {
+		if row["name"] == name {
+			n++
+		}
+	}
+	return n
+}
+
+// TestForbiddenFromEveryHook: a cabana.ForbiddenError is a 403 with the
+// plugin's message from every Form hook, from the bulk delete and from the
+// relation link and child hooks, and the write it refuses is rolled back
+// (D-27; T-12.1-05, T-12.1-06).
+func TestForbiddenFromEveryHook(t *testing.T) {
+	t.Run("form hooks", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		refused := func(what string, rec *httptest.ResponseRecorder) {
+			t.Helper()
+			if got := rosterError(t, rec); rec.Code != http.StatusForbidden || got.Code != "forbidden" || got.Message != rosterLockedMessage {
+				t.Fatalf("%s = %d %s", what, rec.Code, rec.Body.String())
+			}
+		}
+		// Before and after create: no row is left.
+		for _, name := range []string{rosterDenyCreate, rosterDenyAfterCreate} {
+			refused("create "+name, env.call(t, http.MethodPost, rosterPeople, fmt.Sprintf(`{"name":%q,%s}`, name, rosterPair), "bearer"))
+			if n := rosterCount(t, env, name); n != 0 {
+				t.Fatalf("a refused create left %d rows named %s", n, name)
+			}
+		}
+		// After update: the row was written inside the transaction.
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada", Email: "ada@example.test"})
+		refused("after update", env.call(t, http.MethodPut, rosterPath(id, ""), fmt.Sprintf(`{"name":%q,"email":"changed@example.test"}`, rosterKeepAfter), "bearer"))
+		if stored := rosterLoad(t, gdb, id); stored.Name != "Ada" || stored.Email != "ada@example.test" {
+			t.Fatalf("a refusal after the update kept the write: %+v", stored)
+		}
+		// Before update is covered by the fixture's reserved name.
+		rec := env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), `{"name":"Reserved"}`, "bearer")
+		if got := rosterError(t, rec); got.Message != "You may not rename this person." {
+			t.Fatalf("before update = %+v", got)
+		}
+		// Before delete, and after delete once the row is gone inside the
+		// transaction.
+		keep := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterKeep})
+		after := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterKeepAfter})
+		for _, target := range []uint{keep, after} {
+			refused("delete", env.call(t, http.MethodDelete, rosterPath(target, ""), "", "bearer"))
+			if stored := rosterLoad(t, gdb, target); stored.DeletedAt.Valid {
+				t.Fatalf("a refused delete removed or soft-deleted row %d", target)
+			}
+		}
+		// Bulk delete: one refused record keeps the whole selection.
+		first := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "First"})
+		last := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Last"})
+		refused("bulk delete", env.call(t, http.MethodPost, rosterPeople+"/bulk-delete", rosterIDs(first, keep, last), "bearer"))
+		refused("bulk delete, refusal after the row delete", env.call(t, http.MethodPost, rosterPeople+"/bulk-delete", rosterIDs(first, after), "bearer"))
+		for _, target := range []uint{first, keep, after, last} {
+			rosterLoad(t, gdb, target)
+		}
+		// The same selection without the refused record is deleted.
+		env.expect(t, http.StatusOK, http.MethodPost, rosterPeople+"/bulk-delete", rosterIDs(first, last), "bearer")
+	})
+
+	t.Run("relation link and child hooks", func(t *testing.T) {
+		env := newDeferredEnv(t)
+		g := env.gadget(t, "g-"+env.stamp, false)
+		parts := func(rest string) string { return dfPath(g, "/relations/parts"+rest) }
+		members := func(rest string) string { return dfPath(g, "/relations/members"+rest) }
+		part := env.part(t, g, "stays")
+		member := env.member(t, "refused-"+env.stamp+"@example.test")
+		linked := env.member(t, "linked-"+env.stamp+"@example.test")
+		want(t, "link", env.a.do(t, http.MethodPost, members("/link"), map[string]any{"ids": []uint{linked}}, nil), http.StatusOK)
+
+		for _, tc := range []struct {
+			hook, method, rel string
+			body              map[string]any
+		}{
+			{"RelationBeforeLink:members", http.MethodPost, members("/link"), map[string]any{"ids": []uint{member}}},
+			{"RelationBeforeCreate:parts", http.MethodPost, parts("/records"), map[string]any{"label": "doomed"}},
+			{"RelationAfterCreate:parts", http.MethodPost, parts("/records"), map[string]any{"label": "doomed"}},
+			{"RelationBeforeUpdate:parts", http.MethodPut, parts(fmt.Sprintf("/records/%d", part)), map[string]any{"label": "changed"}},
+			{"RelationAfterUpdate:parts", http.MethodPut, parts(fmt.Sprintf("/records/%d", part)), map[string]any{"label": "changed"}},
+			{"RelationBeforeDelete:parts", http.MethodPost, parts("/delete"), map[string]any{"ids": []uint{part}}},
+			{"RelationAfterDelete:parts", http.MethodPost, parts("/delete"), map[string]any{"ids": []uint{part}}},
+			{"RelationBeforeCreate:members", http.MethodPost, members("/records"), map[string]any{"email": "new-" + env.stamp + "@example.test"}},
+			{"RelationAfterDelete:members", http.MethodPost, members("/delete"), map[string]any{"ids": []uint{linked}}},
+		} {
+			env.rec.reset()
+			env.rec.refuseOn(tc.hook)
+			before := env.state(t)
+			rec := env.a.do(t, tc.method, tc.rel, tc.body, nil)
+			got := rosterError(t, rec)
+			if rec.Code != http.StatusForbidden || got.Code != "forbidden" || got.Message != dfRefusal {
+				t.Fatalf("%s = %d %s, want the hook's 403", tc.hook, rec.Code, rec.Body.String())
+			}
+			if !reflect.DeepEqual(got.Details, map[string]any{"hook": []any{tc.hook}}) {
+				t.Fatalf("%s details = %#v", tc.hook, got.Details)
+			}
+			env.unchanged(t, "a refusal from "+tc.hook, before)
+		}
+		env.rec.reset()
+		// Without the refusal the same link runs.
+		want(t, "link after the refusals", env.a.do(t, http.MethodPost, members("/link"), map[string]any{"ids": []uint{member}}, nil), http.StatusOK)
+	})
+}
+
+// TestForbiddenLocalized: the message and every detail are phrase keys
+// resolved in the request locale; plain text passes through.
+func TestForbiddenLocalized(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Cy"})
+	for locale, want := range map[string][2]string{
+		"en": {"You may not rename this person.", "This name is reserved."},
+		"pl": {"Nie możesz zmienić nazwy tej osoby.", "Ta nazwa jest zastrzeżona."},
+	} {
+		rec := rosterLocale(env, http.MethodPut, rosterPath(id, ""), `{"name":"Reserved"}`, locale)
+		got := rosterError(t, rec)
+		if rec.Code != http.StatusForbidden || got.Message != want[0] || !reflect.DeepEqual(got.Details, map[string]any{"name": []any{want[1]}}) {
+			t.Fatalf("%s: status=%d error=%+v", locale, rec.Code, got)
+		}
+	}
+	// The refusal of a bulk action is localized as well.
+	locked := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterLocked})
+	rec := rosterLocale(env, http.MethodPost, rosterArchive, rosterIDs(locked), "pl")
+	if got := rosterError(t, rec); got.Message != "Ta osoba jest zablokowana i nie można jej zmienić." {
+		t.Fatalf("pl bulk refusal = %+v", got)
+	}
+	// The plugin's shared error value is never written to.
+	if rosterRefused.Message != "acme.roster::lang.people.locked" || rosterRefused.Details != nil {
+		t.Fatalf("the plugin's error value was modified: %+v", rosterRefused)
+	}
+}
+
+// TestForbiddenRollsBack: nothing of a refused request stays, also when the
+// refusal comes after rows were written.
+func TestForbiddenRollsBack(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	first := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "First"})
+	second := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Second"})
+	locked := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterLocked, Active: true, Banned: true})
+	env.expect(t, http.StatusForbidden, http.MethodPost, rosterArchive, rosterIDs(first, second, locked), "bearer")
+	for _, id := range []uint{first, second, locked} {
+		if rosterLoad(t, gdb, id).DeletedAt.Valid {
+			t.Fatalf("row %d kept the write of a refused bulk action", id)
+		}
+	}
+	env.expect(t, http.StatusForbidden, http.MethodPost, rosterPath(locked, "/actions/reinstate"), `{}`, "bearer")
+	if !rosterLoad(t, gdb, locked).Banned {
+		t.Fatal("a refused record action kept its write")
+	}
+	// A refused update keeps no field of the body, not even the allowed ones.
+	env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(first, ""), `{"name":"Reserved","email":"kept@example.test","slug":"kept"}`, "bearer")
+	if stored := rosterLoad(t, gdb, first); stored.Name != "First" || stored.Email != "" || stored.Slug != "" {
+		t.Fatalf("a refused update kept a field: %+v", stored)
+	}
+}
+
+// TestForbiddenEmptyMessage: a refusal without a message answers an empty
+// message and an object for details; the framework's own permission denial
+// keeps its fixed text.
+func TestForbiddenEmptyMessage(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bea"})
+	rec := env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), `{"name":"Silent"}`, "bearer")
+	if !strings.Contains(rec.Body.String(), `"code":"forbidden"`) || !strings.Contains(rec.Body.String(), `"message":""`) || !strings.Contains(rec.Body.String(), `"details":{}`) {
+		t.Fatalf("body = %s", rec.Body.String())
+	}
+	if rosterLoad(t, gdb, id).Name != "Bea" {
+		t.Fatal("a refused update changed the row")
+	}
+	denied := env.expect(t, http.StatusForbidden, http.MethodPost, rosterActivate, rosterIDs(id), "limited")
+	if got := rosterError(t, denied); got.Code != "forbidden" || got.Message == "" {
+		t.Fatalf("permission denial = %+v", got)
+	}
+}

modules/cabana/phase121_list_test.go

@@ -0,0 +1,101 @@
+package cabana_test
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/pact"
+)
+
+// TestInvisibleColumnSearchAndRows: a column with invisible: true is flagged
+// in the schema, searched and sorted on the server, and never part of a row
+// (D-27 G6).
+func TestInvisibleColumnSearchAndRows(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada", Email: "ada@hidden.example.test", Slug: "ada", Active: true})
+	rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bob", Email: "bob@example.test", Slug: "bob", Active: true})
+	rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Zed", Email: "zed@hidden.example.test", Active: true})
+
+	schema := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"/schema/list", "", "bearer").Body.String()
+	if !strings.Contains(schema, `{"key":"email","label":"Email","searchable":true,"sortable":true,"invisible":true}`) || strings.Count(schema, `"invisible"`) != 1 {
+		t.Fatalf("list schema = %s", schema)
+	}
+	for _, query := range []string{"", "?search=ada", "?search=hidden.example", "?sort=email&dir=asc"} {
+		raw := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+query, "", "bearer").Body.String()
+		if strings.Contains(raw, `"email"`) || strings.Contains(raw, "example.test") {
+			t.Fatalf("rows of %q carry the invisible column: %s", query, raw)
+		}
+		// The visible columns are there.
+		if !strings.Contains(raw, `"slug":"ada"`) {
+			t.Fatalf("rows of %q lack a visible column: %s", query, raw)
+		}
+	}
+	// Search by the invisible column finds the row, inside the list scope only.
+	found := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"?search=hidden.example", "", "bearer").Body.String()
+	if !strings.Contains(found, `"name":"Ada"`) || strings.Contains(found, `"name":"Bob"`) || strings.Contains(found, `"name":"Zed"`) || !strings.Contains(found, `"total":1`) {
+		t.Fatalf("search by the invisible column = %s", found)
+	}
+	// It sorts in both directions.
+	asc := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"?sort=email&dir=asc", "", "bearer").Body.String()
+	desc := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"?sort=email&dir=desc", "", "bearer").Body.String()
+	if strings.Index(asc, `"name":"Ada"`) > strings.Index(asc, `"name":"Bob"`) || strings.Index(desc, `"name":"Ada"`) < strings.Index(desc, `"name":"Bob"`) {
+		t.Fatalf("sort by the invisible column:\nasc  %s\ndesc %s", asc, desc)
+	}
+	// The record response is the form's, not the list's: email is a form field.
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Cy", Email: "cy@example.test", Active: true})
+	if shown := env.expect(t, http.StatusOK, http.MethodGet, rosterPath(id, ""), "", "bearer").Body.String(); !strings.Contains(shown, `"email":"cy@example.test"`) {
+		t.Fatalf("show = %s", shown)
+	}
+}
+
+// TestFilterOptionsControllerFirst: a controller that implements
+// pact.FilterOptions serves a scope filter's choices, from the database,
+// although the model does not.
+func TestFilterOptionsControllerFirst(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	news, beta := rosterTag{Name: "news"}, rosterTag{Name: "beta"}
+	rosterSeed(t, gdb, &news)
+	rosterSeed(t, gdb, &beta)
+	tagged := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Tagged", Active: true})
+	rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bare", Active: true})
+	rosterSeed(t, gdb, &rosterPersonTag{PersonID: tagged, TagID: news.ID})
+	options := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"/filters/tagged/options", "", "limited").Body.String()
+	want := fmt.Sprintf(`"data":[{"value":"%d","label":"beta"},{"value":"%d","label":"news"}]`, beta.ID, news.ID)
+	if !strings.Contains(options, want) {
+		t.Fatalf("options = %s, want %s", options, want)
+	}
+	// A row added after boot is offered: the choices are read per request.
+	late := rosterTag{Name: "alpha"}
+	rosterSeed(t, gdb, &late)
+	if options = env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"/filters/tagged/options", "", "bearer").Body.String(); !strings.Contains(options, `"label":"alpha"`) {
+		t.Fatalf("options after an insert = %s", options)
+	}
+	// The scope is still the model's.
+	filtered := env.expect(t, http.StatusOK, http.MethodGet, fmt.Sprintf("%s?filter[tagged]=%d", rosterPeople, news.ID), "", "bearer").Body.String()
+	if !strings.Contains(filtered, `"name":"Tagged"`) || strings.Contains(filtered, `"name":"Bare"`) {
+		t.Fatalf("filtered list = %s", filtered)
+	}
+	env.expect(t, http.StatusNotFound, http.MethodGet, rosterPeople+"/filters/missing/options", "", "bearer")
+	if _, ok := any(rosterPerson{}).(pact.FilterOptions); ok {
+		t.Fatal("the fixture model serves filter options itself")
+	}
+}
+
+// TestFilterOptionsModelFallback: without FilterOptions on the controller the
+// model serves the choices, and its labels are translated.
+func TestFilterOptionsModelFallback(t *testing.T) {
+	env, _ := newRosterEnvWith(t, func(p *rosterPlugin) {
+		p.wrap = func(inner rosterController) pact.AdminController {
+			return rosterBare{inner: inner, newRecord: func() any { return &rosterOptionsPerson{} }}
+		}
+	})
+	options := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"/filters/tagged/options", "", "bearer").Body.String()
+	if !strings.Contains(options, `"data":[{"value":"1","label":"Tags"},{"value":"2","label":"Plain label"}]`) {
+		t.Fatalf("model options = %s", options)
+	}
+	if _, ok := any(rosterBare{}).(pact.FilterOptions); ok {
+		t.Fatal("the bare controller serves filter options")
+	}
+}

modules/cabana/phase121_permission_test.go

@@ -0,0 +1,268 @@
+package cabana_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"reflect"
+	"strings"
+	"testing"
+
+	"gorm.io/gorm"
+)
+
+const (
+	permUnknown = "The permissions field contains an unknown permission."
+	permInvalid = "The permissions field contains an invalid value."
+	permShape   = "The permissions field must be an object of permission codes."
+	permLocked  = "You cannot change this permission."
+)
+
+// rosterPermissions reads a person's stored permission object.
+func rosterPermissions(t *testing.T, gdb *gorm.DB, id uint) map[string]int {
+	t.Helper()
+	out := map[string]int{}
+	if raw := rosterLoad(t, gdb, id).Permissions; raw != nil {
+		if err := json.Unmarshal([]byte(*raw), &out); err != nil {
+			t.Fatalf("stored permissions %q: %v", *raw, err)
+		}
+	}
+	return out
+}
+
+// newRosterCheckboxEnv is the roster fixture with the permission editor in
+// checkbox mode.
+func newRosterCheckboxEnv(t *testing.T) (*rosterEnv, *gorm.DB) {
+	t.Helper()
+	return newRosterEnvWith(t, func(p *rosterPlugin) {
+		p.fsys = rosterTree(t, map[string]string{rosterFieldsFile: rosterFields(t, "        mode: radio\n", "        mode: checkbox\n")})
+	})
+}
+
+// TestPermissionEditorModes: radio accepts 1 and -1, checkbox accepts 1
+// only, and 0 means "no value" in both (D-16; T-12.1-13).
+func TestPermissionEditorModes(t *testing.T) {
+	t.Run("radio", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Radio", Active: true})
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.edit":1,"posts.publish":-1,"misc.beta":0}}`, "bearer")
+		if got := rosterPermissions(t, gdb, id); !reflect.DeepEqual(got, map[string]int{"posts.edit": 1, "posts.publish": -1}) {
+			t.Fatalf("stored = %v, want 1 and -1 kept and 0 left out", got)
+		}
+		// 0 for a stored code removes it.
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.edit":0,"posts.publish":-1}}`, "bearer")
+		if got := rosterPermissions(t, gdb, id); !reflect.DeepEqual(got, map[string]int{"posts.publish": -1}) {
+			t.Fatalf("stored = %v", got)
+		}
+		for _, value := range []string{"2", "-2", "100"} {
+			rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.edit":`+value+`}}`, "bearer")
+			rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "permissions", permInvalid)
+		}
+		_, raw := rosterFormSchema(t, env, "bearer")
+		if !strings.Contains(raw, `"mode":"radio"`) {
+			t.Fatalf("schema mode: %s", raw)
+		}
+	})
+
+	t.Run("checkbox", func(t *testing.T) {
+		env, gdb := newRosterCheckboxEnv(t)
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Check", Active: true})
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.edit":1,"posts.publish":0}}`, "bearer")
+		if got := rosterPermissions(t, gdb, id); !reflect.DeepEqual(got, map[string]int{"posts.edit": 1}) {
+			t.Fatalf("stored = %v", got)
+		}
+		// A denial is not a checkbox value.
+		for _, value := range []string{"-1", "2"} {
+			rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.publish":`+value+`}}`, "bearer")
+			rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "permissions", permInvalid)
+		}
+		if got := rosterPermissions(t, gdb, id); !reflect.DeepEqual(got, map[string]int{"posts.edit": 1}) {
+			t.Fatalf("a refused save changed the stored set: %v", got)
+		}
+		// An empty object unchecks everything that is offered.
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"permissions":{}}`, "bearer")
+		if got := rosterPermissions(t, gdb, id); len(got) != 0 {
+			t.Fatalf("stored after unchecking everything = %v", got)
+		}
+		_, raw := rosterFormSchema(t, env, "bearer")
+		if !strings.Contains(raw, `"mode":"checkbox"`) {
+			t.Fatalf("schema mode: %s", raw)
+		}
+	})
+}
+
+// TestPermissionEditorUnknownCode: a code the controller does not offer is
+// 422, also when it is stored on the record, and the value must be an object
+// of integers.
+func TestPermissionEditorUnknownCode(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	stored := `{"legacy.code":1,"posts.edit":1}`
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Perm", Active: true, Permissions: &stored})
+	for body, message := range map[string]string{
+		`{"permissions":{"admin.root":1}}`:                  permUnknown,
+		`{"permissions":{"posts.edit":1,"admin.root":0}}`:   permUnknown,
+		`{"permissions":{"legacy.code":1}}`:                 permUnknown,
+		`{"permissions":{"POSTS.EDIT":1}}`:                  permUnknown,
+		`{"permissions":{"":1}}`:                            permUnknown,
+		`{"permissions":{"posts.edit":"1"}}`:                permShape,
+		`{"permissions":{"posts.edit":1.5}}`:                permShape,
+		`{"permissions":{"posts.edit":null}}`:               permShape,
+		`{"permissions":{"posts.edit":99999999999}}`:        permShape,
+		`{"permissions":{"posts.edit":[1]}}`:                permShape,
+		`{"permissions":[]}`:                                permShape,
+		`{"permissions":1}`:                                 permShape,
+		`{"name":"Renamed","permissions":{"admin.root":1}}`: permUnknown,
+	} {
+		rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), body, "bearer")
+		rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "permissions", message)
+	}
+	if got := rosterLoad(t, gdb, id); got.Name != "Perm" || got.Permissions == nil || *got.Permissions != stored {
+		t.Fatalf("a refused save wrote: %+v", got)
+	}
+}
+
+// TestPermissionEditorLocked: a locked code's stored and submitted value must
+// be equal for the administrator it is locked for; otherwise 403 and nothing
+// is written.
+func TestPermissionEditorLocked(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	stored := `{"reports.export":1}`
+	holder := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Holder", Active: true, Permissions: &stored})
+	bare := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bare", Active: true})
+	refused := func(id uint, body string) {
+		t.Helper()
+		rec := env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), body, "limited")
+		rosterErrorDetail(t, rec.Body.Bytes(), "forbidden", "permissions", permLocked)
+	}
+	refused(holder, `{"permissions":{}}`)
+	refused(holder, `{"permissions":{"reports.export":-1}}`)
+	refused(holder, `{"name":"Sneaky","permissions":{"reports.export":0,"posts.edit":1}}`)
+	refused(bare, `{"permissions":{"reports.export":1}}`)
+	refused(bare, `{"permissions":{"reports.export":-1}}`)
+	if got := rosterLoad(t, gdb, holder); got.Name != "Holder" || *got.Permissions != stored {
+		t.Fatalf("a refused save wrote: %+v", got)
+	}
+	if got := rosterLoad(t, gdb, bare); got.Permissions != nil {
+		t.Fatalf("a refused save wrote %q", *got.Permissions)
+	}
+	// The stored value sent back unchanged passes, with other codes changed.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(holder, ""), `{"permissions":{"reports.export":1,"posts.edit":-1}}`, "limited")
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(bare, ""), `{"permissions":{"posts.edit":1}}`, "limited")
+	if got := rosterPermissions(t, gdb, holder); !reflect.DeepEqual(got, map[string]int{"reports.export": 1, "posts.edit": -1}) {
+		t.Fatalf("stored = %v", got)
+	}
+	// A save without the field is not checked.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(holder, ""), `{"name":"Holder B"}`, "limited")
+	// The administrator it is not locked for changes it.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(holder, ""), `{"permissions":{}}`, "bearer")
+	if got := rosterPermissions(t, gdb, holder); len(got) != 0 {
+		t.Fatalf("the full admin's change was not stored: %v", got)
+	}
+
+	// Known property of the contract: a locked code whose stored value is
+	// outside the mode's set cannot be sent back, so every save that carries
+	// the field is refused for that administrator; a save without the field
+	// still passes. The value has to be repaired by an administrator the code
+	// is not locked for.
+	t.Run("a locked code stored outside the mode's set", func(t *testing.T) {
+		env, gdb := newRosterCheckboxEnv(t)
+		denied := `{"reports.export":-1}`
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Legacy", Active: true, Permissions: &denied})
+		rec := env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.edit":1}}`, "limited")
+		rosterErrorDetail(t, rec.Body.Bytes(), "forbidden", "permissions", permLocked)
+		rec = env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), `{"permissions":{"reports.export":-1}}`, "limited")
+		rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "permissions", permInvalid)
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Legacy B"}`, "limited")
+		if got := rosterLoad(t, gdb, id); got.Name != "Legacy B" || *got.Permissions != denied {
+			t.Fatalf("stored = %+v", got)
+		}
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.edit":1}}`, "bearer")
+		if got := rosterPermissions(t, gdb, id); !reflect.DeepEqual(got, map[string]int{"posts.edit": 1}) {
+			t.Fatalf("the full admin's repair stored %v", got)
+		}
+	})
+}
+
+// TestPermissionEditorKeepsUnoffered: stored codes the controller does not
+// offer survive every save, are shown, and cannot be invented.
+func TestPermissionEditorKeepsUnoffered(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	stored := `{"legacy.code":1,"legacy.denied":-1,"posts.edit":1}`
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Legacy", Active: true, Permissions: &stored})
+	rec := env.expect(t, http.StatusOK, http.MethodGet, rosterPath(id, ""), "", "bearer")
+	if !strings.Contains(rec.Body.String(), `"permissions":{"legacy.code":1,"legacy.denied":-1,"posts.edit":1}`) {
+		t.Fatalf("show = %s", rec.Body.String())
+	}
+	for _, body := range []string{`{"permissions":{}}`, `{"permissions":{"posts.publish":1}}`, `{"permissions":{"posts.publish":0}}`} {
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), body, "bearer")
+		got := rosterPermissions(t, gdb, id)
+		if got["legacy.code"] != 1 || got["legacy.denied"] != -1 {
+			t.Fatalf("after %s the stored codes that are not offered are %v", body, got)
+		}
+		if _, kept := got["posts.edit"]; kept {
+			t.Fatalf("after %s an offered code that was left out is still stored: %v", body, got)
+		}
+	}
+	// A record without stored permissions shows an empty object, never null.
+	blank := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Blank", Active: true})
+	rec = env.expect(t, http.StatusOK, http.MethodGet, rosterPath(blank, ""), "", "bearer")
+	if !strings.Contains(rec.Body.String(), `"permissions":{}`) {
+		t.Fatalf("show without stored permissions = %s", rec.Body.String())
+	}
+}
+
+// TestPermissionEditorOptionsPerRequest: options, with their locked flag and
+// localized texts, are asked from the controller for each request and are
+// never written into the cached schema.
+func TestPermissionEditorOptionsPerRequest(t *testing.T) {
+	env, _ := newRosterEnv(t)
+	for range 2 {
+		_, limited := rosterFormSchema(t, env, "limited")
+		if strings.Count(limited, `"locked":true`) != 1 || !strings.Contains(limited, `{"code":"reports.export","label":"Export reports","tab":"Reports","locked":true}`) {
+			t.Fatalf("limited admin's options = %s", limited)
+		}
+		_, full := rosterFormSchema(t, env, "bearer")
+		if strings.Contains(full, `"locked"`) {
+			t.Fatalf("an option is locked for the full admin after a limited request: %s", full)
+		}
+	}
+	pl := rosterLocale(env, http.MethodGet, rosterPeople+"/schema/form", "", "pl")
+	if !strings.Contains(pl.Body.String(), `{"code":"posts.edit","label":"Edycja wpisów","tab":"Treści","comment":"Zmiana treści dowolnego wpisu."}`) {
+		t.Fatalf("pl options = %s", pl.Body.String())
+	}
+	_, en := rosterFormSchema(t, env, "bearer")
+	if !strings.Contains(en, `"label":"Edit posts","tab":"Content"`) {
+		t.Fatalf("the cached schema kept another locale's labels: %s", en)
+	}
+}
+
+// TestPermissionEditorProviderError: an error from the provider is the
+// generic 500 on every route that asks it, and nothing is written.
+func TestPermissionEditorProviderError(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	stored := `{"posts.edit":1}`
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Perm", Active: true, Permissions: &stored})
+	opaque := func(what, method, rel, body string) {
+		t.Helper()
+		rec := env.expect(t, http.StatusInternalServerError, method, rel, body, "bearer")
+		if got := rosterError(t, rec); got.Code != "error" || len(got.Details) != 0 || strings.Contains(rec.Body.String(), "hunter2") || strings.Contains(rec.Body.String(), "permission table") || strings.Contains(rec.Body.String(), "permission column") {
+			t.Fatalf("%s = %s", what, rec.Body.String())
+		}
+	}
+	env.knobs.permissionOptions.Store(true)
+	opaque("the form schema", http.MethodGet, rosterPeople+"/schema/form", "")
+	opaque("an update with the field", http.MethodPut, rosterPath(id, ""), `{"name":"Changed","permissions":{"posts.publish":1}}`)
+	// A save that does not carry the field does not ask for the options.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Perm B"}`, "bearer")
+	env.knobs.permissionOptions.Store(false)
+
+	env.knobs.permissionValues.Store(true)
+	opaque("show", http.MethodGet, rosterPath(id, ""), "")
+	opaque("an update that reads the stored values", http.MethodPut, rosterPath(id, ""), `{"name":"Changed","permissions":{"posts.publish":1}}`)
+	env.knobs.permissionValues.Store(false)
+
+	if got := rosterLoad(t, gdb, id); got.Name != "Perm B" || *got.Permissions != stored {
+		t.Fatalf("a failed save wrote: %+v", got)
+	}
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), fmt.Sprintf(`{"permissions":%s}`, stored), "bearer")
+}

modules/cabana/phase121_preview_test.go

@@ -0,0 +1,144 @@
+package cabana_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/cabana"
+)
+
+// TestPreviewSchema: the form schema reports the preview block, the
+// preview-only field with its context, and nothing of either for a form
+// without a preview (D-11).
+func TestPreviewSchema(t *testing.T) {
+	env, _ := newRosterEnv(t)
+	view, raw := rosterFormSchema(t, env, "bearer")
+	if view.Preview == nil || view.Preview.HeaderPartial != "status" || !strings.Contains(raw, `"preview":{"headerPartial":"status"}`) {
+		t.Fatalf("preview block = %+v in %s", view.Preview, raw)
+	}
+	if !strings.Contains(raw, `"name":"joined_ip","type":"text","label":"Joined from IP address","context":"preview"}`) {
+		t.Fatalf("the preview-only field is not in the schema: %s", raw)
+	}
+	if !strings.Contains(raw, `{"name":"name","type":"text","label":"Name","span":"left"}`) {
+		t.Fatalf("a field without a context got one: %s", raw)
+	}
+	// The same schema for the limited administrator: the preview is part of
+	// the form, not a permission.
+	if limited, _ := rosterFormSchema(t, env, "limited"); limited.Preview == nil {
+		t.Fatal("the limited administrator gets no preview block")
+	}
+	// preview: {} enables the screen without a header partial.
+	bare, _ := newRosterEnvWith(t, func(p *rosterPlugin) {
+		p.fsys = rosterTree(t, map[string]string{"controllers/people/config_form.yaml": rosterFormHead + "preview: {}\n"})
+	})
+	view, raw = rosterFormSchema(t, bare, "bearer")
+	if view.Preview == nil || view.Preview.HeaderPartial != "" || !strings.Contains(raw, `"preview":{}`) {
+		t.Fatalf("preview: {} = %+v in %s", view.Preview, raw)
+	}
+	// A form without the key has no preview at all.
+	none, _ := newRosterEnvWith(t, func(p *rosterPlugin) {
+		p.fsys = rosterTree(t, map[string]string{"controllers/people/config_form.yaml": rosterFormHead})
+	})
+	view, raw = rosterFormSchema(t, none, "bearer")
+	if view.Preview != nil || strings.Contains(raw, `"preview":{}`) || strings.Contains(raw, "headerPartial") {
+		t.Fatalf("a form without preview reports one: %s", raw)
+	}
+}
+
+// TestPreviewFieldNeverWritten: a field with context preview is returned by
+// show and ignored by create and update (T-12.1-14).
+func TestPreviewFieldNeverWritten(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	ip := "203.0.113.7"
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada", Active: true, JoinedIP: &ip})
+	rec := env.expect(t, http.StatusOK, http.MethodGet, rosterPath(id, ""), "", "bearer")
+	if got := rosterRecord(t, rec.Body.Bytes()).Data["joined_ip"]; got != ip {
+		t.Fatalf("show joined_ip = %v", got)
+	}
+	for _, body := range []string{`{"joined_ip":"198.51.100.1"}`, `{"name":"Ada L","joined_ip":null}`, `{"name":"Ada L","joined_ip":""}`} {
+		rec = env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), body, "bearer")
+		if got := rosterRecord(t, rec.Body.Bytes()).Data["joined_ip"]; got != ip {
+			t.Fatalf("update %s answered joined_ip = %v", body, got)
+		}
+		if stored := rosterLoad(t, gdb, id); stored.JoinedIP == nil || *stored.JoinedIP != ip {
+			t.Fatalf("update %s wrote joined_ip = %v", body, stored.JoinedIP)
+		}
+	}
+	if rosterLoad(t, gdb, id).Name != "Ada L" {
+		t.Fatal("the writable part of the body was not saved")
+	}
+	rec = env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"New","joined_ip":"198.51.100.2",`+rosterPair+`}`, "bearer")
+	created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+	if stored := rosterLoad(t, gdb, uint(created)); stored.JoinedIP != nil {
+		t.Fatalf("create wrote joined_ip = %q", *stored.JoinedIP)
+	}
+	// A nested value for it is ignored like any other value.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"joined_ip":{"x":1}}`, "bearer")
+}
+
+// TestPreviewHeaderPartialScoped: the status hint is served through the
+// partial route with the form scope and the controller's permission, as
+// nodes (T-12.1-15).
+func TestPreviewHeaderPartialScoped(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	banned := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bea", Active: true, Banned: true})
+	gone := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Gone", Active: true, DeletedAt: rosterDeleted()})
+	idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+	foreign := rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Zed", Banned: true})
+	hint := func(id uint) string { return fmt.Sprintf("%s/partials/status?id=%d", rosterPeople, id) }
+	for id, want := range map[uint][2]string{
+		banned: {"summer-callout--danger", "This person is banned"},
+		gone:   {"summer-callout--danger", "This person is archived"},
+		idle:   {"summer-callout--warning", "This person is not active"},
+	} {
+		rec := env.expect(t, http.StatusOK, http.MethodGet, hint(id), "", "limited")
+		if body := rec.Body.String(); !strings.Contains(body, want[0]) || !strings.Contains(body, want[1]) || strings.Contains(body, "<") {
+			t.Fatalf("hint of %d = %s", id, body)
+		}
+		var view cabana.Envelope[cabana.PartialView]
+		if err := json.Unmarshal(rec.Body.Bytes(), &view); err != nil || len(view.Data.Nodes) != 1 || view.Data.Nodes[0].Attrs["role"] != "status" {
+			t.Fatalf("hint nodes = %+v (%v)", view.Data.Nodes, err)
+		}
+	}
+	rec := env.expect(t, http.StatusNotFound, http.MethodGet, hint(foreign), "", "bearer")
+	actErrorCode(t, rec.Body.Bytes(), "not_found")
+	env.expect(t, http.StatusNotFound, http.MethodGet, hint(999999), "", "bearer")
+	env.expect(t, http.StatusNotFound, http.MethodGet, fmt.Sprintf("%s/partials/missing?id=%d", rosterPeople, banned), "", "bearer")
+	// The Polish request gets Polish text.
+	if pl := rosterLocale(env, http.MethodGet, hint(banned), "", "pl"); !strings.Contains(pl.Body.String(), "Ta osoba jest zablokowana") {
+		t.Fatalf("pl hint = %s", pl.Body.String())
+	}
+	// Without a token there is no hint.
+	req := httptest.NewRequest(http.MethodGet, adminAPI(hint(banned)), nil)
+	anonymous := httptest.NewRecorder()
+	env.h.ServeHTTP(anonymous, req)
+	if anonymous.Code != http.StatusUnauthorized {
+		t.Fatalf("anonymous hint = %d", anonymous.Code)
+	}
+}
+
+// TestPreviewMessagesDefaults: a form that names no preview or edit message
+// gets the framework's, in the request locale.
+func TestPreviewMessagesDefaults(t *testing.T) {
+	env, _ := newRosterEnvWith(t, func(p *rosterPlugin) {
+		p.fsys = rosterTree(t, map[string]string{"controllers/people/config_form.yaml": rosterFormHead + "preview: {}\n"})
+	})
+	view, _ := rosterFormSchema(t, env, "bearer")
+	if view.Messages.Preview["other"] != "Record preview" || view.Messages.Edit["other"] != "Edit record" {
+		t.Fatalf("default messages = %v / %v", view.Messages.Preview, view.Messages.Edit)
+	}
+	pl := rosterLocale(env, http.MethodGet, rosterPeople+"/schema/form", "", "pl")
+	if !strings.Contains(pl.Body.String(), `"preview":{"other":"Podgląd rekordu"}`) {
+		t.Fatalf("pl default messages = %s", pl.Body.String())
+	}
+	// The fixture's own messages replace them.
+	own, _ := newRosterEnv(t)
+	view, _ = rosterFormSchema(t, own, "bearer")
+	if view.Messages.Preview["other"] != "Person details" || view.Messages.Edit["other"] != "Edit person" {
+		t.Fatalf("plugin messages = %v / %v", view.Messages.Preview, view.Messages.Edit)
+	}
+}

modules/cabana/phase121_record_test.go

@@ -0,0 +1,189 @@
+package cabana_test
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+// TestRecordActionScope: the record is loaded through the form scope, so a
+// missing id and an id outside the scope are the same 404 (T-12.1-04).
+func TestRecordActionScope(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	foreign := rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Foreign"})
+	trashed := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Trashed", DeletedAt: rosterDeleted()})
+	var bodies []string
+	for _, id := range []uint{foreign, 999999} {
+		rec := env.expect(t, http.StatusNotFound, http.MethodPost, rosterPath(id, "/actions/activate"), `{}`, "bearer")
+		actErrorCode(t, rec.Body.Bytes(), "not_found")
+		bodies = append(bodies, rec.Body.String())
+	}
+	if bodies[0] != bodies[1] {
+		t.Fatalf("an out-of-scope id and a missing id answer differently:\n%s\n%s", bodies[0], bodies[1])
+	}
+	for _, id := range []string{"abc", "0", "-1", "1.5"} {
+		if rec := env.call(t, http.MethodPost, rosterPeople+"/"+id+"/actions/activate", `{}`, "bearer"); rec.Code/100 == 2 {
+			t.Fatalf("id %q answered %d", id, rec.Code)
+		}
+	}
+	if rosterLoad(t, gdb, foreign).Active || len(env.spy.takeRecord()) != 0 {
+		t.Fatal("an out-of-scope record was changed")
+	}
+	// The form scope of this controller includes soft-deleted records.
+	env.expect(t, http.StatusOK, http.MethodPost, rosterPath(trashed, "/actions/activate"), `{}`, "bearer")
+	if !rosterLoad(t, gdb, trashed).Active {
+		t.Fatal("an in-scope soft-deleted record was not reached")
+	}
+}
+
+// TestRecordActionApplies: Applies is checked again inside the transaction;
+// an action that does not apply is a 409 and does not run.
+func TestRecordActionApplies(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	active := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Active", Active: true})
+	idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+	rec := env.expect(t, http.StatusConflict, http.MethodPost, rosterPath(active, "/actions/activate"), `{}`, "bearer")
+	actErrorCode(t, rec.Body.Bytes(), "conflict")
+	rec = env.expect(t, http.StatusConflict, http.MethodPost, rosterPath(idle, "/actions/reinstate"), `{}`, "bearer")
+	actErrorCode(t, rec.Body.Bytes(), "conflict")
+	if len(env.spy.takeRecord()) != 0 {
+		t.Fatal("an action ran on a record it does not apply to")
+	}
+	// It runs once; the second request finds it no longer applies.
+	env.expect(t, http.StatusOK, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "bearer")
+	env.expect(t, http.StatusConflict, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "bearer")
+	if calls := env.spy.takeRecord(); len(calls) != 1 || calls[0].RecordID != uint64(idle) {
+		t.Fatalf("Run calls = %+v", calls)
+	}
+}
+
+// TestRecordActionBody: the body is a strict, empty JSON object.
+func TestRecordActionBody(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+	for _, body := range []string{
+		fmt.Sprintf(`{"record_id":%d}`, idle), `{"record_id":null,"values":{}}`, `{"values":{"active":true}}`,
+		`{"extra":1}`, `{"field":"name"}x`, `{} {}`, `{}{}`, `null {}`, `[]`, `"activate"`, `{`, ``,
+	} {
+		rec := env.call(t, http.MethodPost, rosterPath(idle, "/actions/activate"), body, "bearer")
+		if rec.Code != http.StatusUnprocessableEntity {
+			t.Fatalf("body %q = %d, want 422: %s", body, rec.Code, rec.Body.String())
+		}
+		actErrorCode(t, rec.Body.Bytes(), "validation_failed")
+	}
+	if rosterLoad(t, gdb, idle).Active || len(env.spy.takeRecord()) != 0 {
+		t.Fatal("a malformed body ran the action")
+	}
+	env.expect(t, http.StatusOK, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "bearer")
+	// A JSON null is read as the empty object: it carries no input either.
+	other := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Other"})
+	env.expect(t, http.StatusOK, http.MethodPost, rosterPath(other, "/actions/activate"), `null`, "bearer")
+}
+
+// TestRecordActionPermissions: the controller's permission and the action's
+// own, and the CSRF header for cookie requests (T-12.1-02, T-12.1-03).
+func TestRecordActionPermissions(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle", Banned: true})
+	rec := env.expect(t, http.StatusForbidden, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "limited")
+	actErrorCode(t, rec.Body.Bytes(), "forbidden")
+	env.expect(t, http.StatusForbidden, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "cookie-only")
+	req := httptest.NewRequest(http.MethodPost, adminAPI(rosterPath(idle, "/actions/activate")), strings.NewReader(`{}`))
+	req.Header.Set("Content-Type", "application/json")
+	anonymous := httptest.NewRecorder()
+	env.h.ServeHTTP(anonymous, req)
+	if anonymous.Code != http.StatusUnauthorized {
+		t.Fatalf("anonymous record action = %d", anonymous.Code)
+	}
+	if rosterLoad(t, gdb, idle).Active || len(env.spy.takeRecord()) != 0 {
+		t.Fatal("a refused request ran the action")
+	}
+	// reinstate asks for no permission of its own.
+	env.expect(t, http.StatusOK, http.MethodPost, rosterPath(idle, "/actions/reinstate"), `{}`, "limited")
+	env.expect(t, http.StatusOK, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "cookie")
+	if stored := rosterLoad(t, gdb, idle); stored.Banned || !stored.Active {
+		t.Fatalf("after the permitted actions: %+v", stored)
+	}
+}
+
+// TestRecordActionOffered: meta.actions of the show response lists the
+// actions in declared order and leaves out the denied and the non-applicable.
+func TestRecordActionOffered(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	both := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Both", Banned: true})
+	neither := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Neither", Active: true})
+	if got := rosterOffered(t, env, both, "bearer"); !reflect.DeepEqual(got, []string{"activate", "reinstate"}) {
+		t.Fatalf("both apply, full admin: %v (declared order is activate, reinstate)", got)
+	}
+	if got := rosterOffered(t, env, both, "limited"); !reflect.DeepEqual(got, []string{"reinstate"}) {
+		t.Fatalf("both apply, limited admin: %v", got)
+	}
+	if got := rosterOffered(t, env, neither, "bearer"); len(got) != 0 {
+		t.Fatalf("none applies: %v", got)
+	}
+	rec := env.expect(t, http.StatusOK, http.MethodGet, rosterPath(neither, ""), "", "bearer")
+	if strings.Contains(rec.Body.String(), `"actions"`) {
+		t.Fatalf("meta.actions sent without an offered action: %s", rec.Body.String())
+	}
+	// Labels and confirm texts follow the request locale; an action without a
+	// confirm has no confirm key.
+	rec = rosterLocale(env, http.MethodGet, rosterPath(both, ""), "", "pl")
+	if !strings.Contains(rec.Body.String(), `"actions":[{"name":"activate","label":"Aktywuj"},{"name":"reinstate","label":"Przywróć","confirm":"Zdjąć blokadę z tej osoby?"}]`) {
+		t.Fatalf("pl actions = %s", rec.Body.String())
+	}
+	// The list rows never carry actions.
+	list := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople, "", "bearer")
+	if strings.Contains(list.Body.String(), `"actions"`) {
+		t.Fatalf("the list carries actions: %s", list.Body.String())
+	}
+}
+
+// TestRecordActionRollback: a refusal or a failure after the action's write
+// rolls the write back.
+func TestRecordActionRollback(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	for name, status := range map[string]int{rosterLocked: http.StatusForbidden, rosterRunErr: http.StatusInternalServerError} {
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: name, Active: true, Banned: true})
+		rec := env.expect(t, status, http.MethodPost, rosterPath(id, "/actions/reinstate"), `{}`, "bearer")
+		if strings.Contains(rec.Body.String(), "hunter2") {
+			t.Fatalf("%s: the error text of Run is in the body: %s", name, rec.Body.String())
+		}
+		if !rosterLoad(t, gdb, id).Banned {
+			t.Fatalf("%s: the action's write survived its error", name)
+		}
+		if calls := env.spy.takeRecord(); len(calls) != 1 {
+			t.Fatalf("%s: Run calls = %d", name, len(calls))
+		}
+	}
+}
+
+// TestRecordActionAppliesError: an error from Applies is the generic 500, on
+// the action route and on the show route that offers actions.
+func TestRecordActionAppliesError(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	logs := captureLog(t)
+	id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterAppliesErr})
+	for _, call := range []struct{ method, rel, body string }{
+		{http.MethodPost, rosterPath(id, "/actions/activate"), `{}`},
+		{http.MethodGet, rosterPath(id, ""), ""},
+	} {
+		rec := env.expect(t, http.StatusInternalServerError, call.method, call.rel, call.body, "bearer")
+		got := rosterError(t, rec)
+		if got.Code != "error" || len(got.Details) != 0 || strings.Contains(rec.Body.String(), "hunter2") || strings.Contains(rec.Body.String(), "applies check") {
+			t.Fatalf("%s %s = %s", call.method, call.rel, rec.Body.String())
+		}
+	}
+	if rosterLoad(t, gdb, id).Active || len(env.spy.takeRecord()) != 0 {
+		t.Fatal("the action ran although Applies failed")
+	}
+	// The cause is logged on the server, with the controller and the action.
+	failed := logs.matching("cabana: admin record action failed")
+	if len(failed) != 2 || !strings.Contains(failed[0], "action=activate") || !strings.Contains(failed[0], "hunter2") {
+		t.Fatalf("server log = %q", failed)
+	}
+	// An administrator who is not offered the action never triggers Applies.
+	env.expect(t, http.StatusOK, http.MethodGet, rosterPath(id, ""), "", "limited")
+}

modules/cabana/phase121_relation_lock_test.go

@@ -0,0 +1,313 @@
+package cabana_test
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/cabana"
+	"gorm.io/gorm"
+)
+
+const rosterTagLocked = "You need an additional permission to change the staff tag."
+
+// rosterLockSeed stores the staff, news and beta tags.
+func rosterLockSeed(t *testing.T, gdb *gorm.DB) (staff, news, beta rosterTag) {
+	t.Helper()
+	staff, news, beta = rosterTag{Name: "staff"}, rosterTag{Name: "news"}, rosterTag{Name: "beta"}
+	for _, tag := range []*rosterTag{&staff, &news, &beta} {
+		rosterSeed(t, gdb, tag)
+	}
+	return staff, news, beta
+}
+
+// rosterTags is the tags key of a save body.
+func rosterTags(ids ...uint) string {
+	parts := make([]string, len(ids))
+	for i, id := range ids {
+		parts[i] = fmt.Sprint(id)
+	}
+	return `"tags":[` + strings.Join(parts, ",") + `]`
+}
+
+// rosterLockRefused asserts the 403 of a locked relation field.
+func rosterLockRefused(t *testing.T, env *rosterEnv, method, rel, body, field, message string) {
+	t.Helper()
+	rec := env.expect(t, http.StatusForbidden, method, rel, body, "limited")
+	rosterErrorDetail(t, rec.Body.Bytes(), "forbidden", field, message)
+}
+
+// TestRelationLockCreate: a create that carries a locked id is 403 and
+// creates nothing; the pivot is written only by a create that leaves the
+// locked subset empty (D-07; T-12.1-12).
+func TestRelationLockCreate(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	staff, news, _ := rosterLockSeed(t, gdb)
+	create := func(name string, ids ...uint) string {
+		return fmt.Sprintf(`{"name":%q,%s,%s}`, name, rosterPair, rosterTags(ids...))
+	}
+	rosterLockRefused(t, env, http.MethodPost, rosterPeople, create("Smuggled", staff.ID), "tags", rosterTagLocked)
+	rosterLockRefused(t, env, http.MethodPost, rosterPeople, create("Smuggled", news.ID, staff.ID), "tags", rosterTagLocked)
+	if n := rosterCount(t, env, "Smuggled"); n != 0 {
+		t.Fatalf("a refused create left %d rows", n)
+	}
+	var pivots int64
+	if err := gdb.Model(&rosterPersonTag{}).Count(&pivots).Error; err != nil || pivots != 0 {
+		t.Fatalf("a refused create left %d pivot rows (%v)", pivots, err)
+	}
+	rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, create("Plain", news.ID), "limited")
+	created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+	if got := rosterPivot(t, gdb, uint(created)); !reflect.DeepEqual(got, []uint{news.ID}) {
+		t.Fatalf("pivot of the created person = %v", got)
+	}
+	// The administrator the id is not locked for creates with it.
+	rec = env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, create("Staffer", staff.ID), "bearer")
+	created, _ = rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+	if got := rosterPivot(t, gdb, uint(created)); !reflect.DeepEqual(got, []uint{staff.ID}) {
+		t.Fatalf("pivot of the full admin's person = %v", got)
+	}
+}
+
+// TestRelationLockUpdate: adding, removing or replacing a locked id on update
+// is 403 and writes nothing; a provider error is the generic 500.
+func TestRelationLockUpdate(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	staff, news, beta := rosterLockSeed(t, gdb)
+	plain := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Plain", Active: true})
+	member := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Member", Active: true})
+	rosterSeed(t, gdb, &rosterPersonTag{PersonID: plain, TagID: news.ID})
+	rosterSeed(t, gdb, &rosterPersonTag{PersonID: member, TagID: staff.ID})
+	rosterSeed(t, gdb, &rosterPersonTag{PersonID: member, TagID: news.ID})
+	for _, tc := range []struct {
+		person uint
+		body   string
+	}{
+		{plain, `{"name":"Sneaky",` + rosterTags(news.ID, staff.ID) + `}`},
+		{plain, `{` + rosterTags(staff.ID) + `}`},
+		{member, `{` + rosterTags(news.ID) + `}`},
+		{member, `{` + rosterTags() + `}`},
+		{member, `{"name":"Sneaky",` + rosterTags(beta.ID) + `}`},
+	} {
+		rosterLockRefused(t, env, http.MethodPut, rosterPath(tc.person, ""), tc.body, "tags", rosterTagLocked)
+	}
+	if got := rosterPivot(t, gdb, plain); !reflect.DeepEqual(got, []uint{news.ID}) {
+		t.Fatalf("pivot of the plain person = %v", got)
+	}
+	if got := rosterPivot(t, gdb, member); !reflect.DeepEqual(got, []uint{staff.ID, news.ID}) {
+		t.Fatalf("pivot of the member = %v", got)
+	}
+	if rosterLoad(t, gdb, plain).Name != "Plain" || rosterLoad(t, gdb, member).Name != "Member" {
+		t.Fatal("a refused save wrote another field of its body")
+	}
+	// The locked subset unchanged: the rest of the pivot may change.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(member, ""), `{`+rosterTags(beta.ID, staff.ID)+`}`, "limited")
+	if got := rosterPivot(t, gdb, member); !reflect.DeepEqual(got, []uint{staff.ID, beta.ID}) {
+		t.Fatalf("pivot after an allowed change = %v", got)
+	}
+	// The refusal follows the request locale.
+	req := httptest.NewRequest(http.MethodPut, adminAPI(rosterPath(member, "")), strings.NewReader(`{`+rosterTags()+`}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept-Language", "pl")
+	req.Header.Set("Authorization", "Bearer "+env.limited)
+	pl := httptest.NewRecorder()
+	env.h.ServeHTTP(pl, req)
+	if pl.Code != http.StatusForbidden {
+		t.Fatalf("pl refusal = %d %s", pl.Code, pl.Body.String())
+	}
+	rosterErrorDetail(t, pl.Body.Bytes(), "forbidden", "tags", "Zmiana tagu staff wymaga dodatkowego uprawnienia.")
+
+	// A provider that fails: the generic 500, and nothing is written.
+	env.knobs.relationLocks.Store(true)
+	rec := env.expect(t, http.StatusInternalServerError, http.MethodPut, rosterPath(plain, ""), `{"name":"Changed",`+rosterTags(beta.ID)+`}`, "limited")
+	if got := rosterError(t, rec); got.Code != "error" || strings.Contains(rec.Body.String(), "hunter2") || strings.Contains(rec.Body.String(), "lock table") {
+		t.Fatalf("500 body = %s", rec.Body.String())
+	}
+	env.expect(t, http.StatusInternalServerError, http.MethodGet, rosterPeople+"/fields/tags/options", "", "limited")
+	env.knobs.relationLocks.Store(false)
+	if got := rosterPivot(t, gdb, plain); !reflect.DeepEqual(got, []uint{news.ID}) || rosterLoad(t, gdb, plain).Name != "Plain" {
+		t.Fatalf("a failed save wrote: pivot %v", got)
+	}
+}
+
+// TestRelationLockBelongsTo: for a belongsTo field a change is refused when
+// the current or the submitted id is locked. A lock without a message of its
+// own answers the framework's text.
+func TestRelationLockBelongsTo(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	vault, open, other := rosterTeam{Tenant: "acme", Name: "vault"}, rosterTeam{Tenant: "acme", Name: "open"}, rosterTeam{Tenant: "acme", Name: "other"}
+	for _, team := range []*rosterTeam{&vault, &open, &other} {
+		rosterSeed(t, gdb, team)
+	}
+	inside := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Inside", Active: true, OrganisationID: &vault.ID})
+	outside := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Outside", Active: true, OrganisationID: &open.ID})
+	const message = "You do not have permission to make this change. Nothing was saved."
+	team := func(id uint) uint {
+		t.Helper()
+		if stored := rosterLoad(t, gdb, id); stored.OrganisationID != nil {
+			return *stored.OrganisationID
+		}
+		return 0
+	}
+	// Into the locked team, out of it, and clearing it.
+	rosterLockRefused(t, env, http.MethodPut, rosterPath(outside, ""), fmt.Sprintf(`{"name":"Sneaky","team":%d}`, vault.ID), "team", message)
+	rosterLockRefused(t, env, http.MethodPut, rosterPath(inside, ""), fmt.Sprintf(`{"team":%d}`, open.ID), "team", message)
+	rosterLockRefused(t, env, http.MethodPut, rosterPath(inside, ""), `{"team":null}`, "team", message)
+	rosterLockRefused(t, env, http.MethodPost, rosterPeople, fmt.Sprintf(`{"name":"Born inside",%s,"team":%d}`, rosterPair, vault.ID), "team", message)
+	if team(outside) != open.ID || team(inside) != vault.ID || rosterLoad(t, gdb, outside).Name != "Outside" || rosterCount(t, env, "Born inside") != 0 {
+		t.Fatal("a refused save changed a team")
+	}
+	// A refusal without a message has an empty message and the framework's
+	// text on the field.
+	rec := env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(inside, ""), `{"team":null}`, "limited")
+	if got := rosterError(t, rec); got.Message != "" {
+		t.Fatalf("message of a lock without one = %q", got.Message)
+	}
+	// The locked id sent back unchanged, and a change between unlocked teams.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(inside, ""), fmt.Sprintf(`{"name":"Inside B","team":%d}`, vault.ID), "limited")
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(outside, ""), fmt.Sprintf(`{"team":%d}`, other.ID), "limited")
+	if team(inside) != vault.ID || team(outside) != other.ID {
+		t.Fatalf("teams after the allowed saves = %d and %d", team(inside), team(outside))
+	}
+	// The options and the label carry the flag for the limited administrator.
+	options := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"/fields/team/options", "", "limited").Body.String()
+	if !strings.Contains(options, fmt.Sprintf(`{"value":%d,"label":"vault","locked":true}`, vault.ID)) || strings.Count(options, `"locked"`) != 1 {
+		t.Fatalf("team options = %s", options)
+	}
+	if shown := env.expect(t, http.StatusOK, http.MethodGet, rosterPath(inside, ""), "", "limited").Body.String(); strings.Count(shown, `"locked":true`) != 1 {
+		t.Fatalf("the locked team label is not flagged: %s", shown)
+	}
+	// The full administrator moves a person out of the locked team.
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(inside, ""), `{"team":null}`, "bearer")
+	if team(inside) != 0 {
+		t.Fatal("the full admin could not clear the locked team")
+	}
+}
+
+// TestRelationLockAbsentField: only relation fields present in the body are
+// checked, so an ordinary update of a record that holds a locked id passes.
+func TestRelationLockAbsentField(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	staff, _, _ := rosterLockSeed(t, gdb)
+	vault := rosterTeam{Tenant: "acme", Name: "vault"}
+	rosterSeed(t, gdb, &vault)
+	member := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Member", Active: true, OrganisationID: &vault.ID})
+	rosterSeed(t, gdb, &rosterPersonTag{PersonID: member, TagID: staff.ID})
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(member, ""), `{"name":"Member B","email":"member@example.test"}`, "limited")
+	stored := rosterLoad(t, gdb, member)
+	if stored.Name != "Member B" || stored.OrganisationID == nil || *stored.OrganisationID != vault.ID {
+		t.Fatalf("stored = %+v", stored)
+	}
+	if got := rosterPivot(t, gdb, member); !reflect.DeepEqual(got, []uint{staff.ID}) {
+		t.Fatalf("pivot = %v", got)
+	}
+	// A record action and a bulk action on the same record pass too: they do
+	// not write the relation.
+	env.expect(t, http.StatusOK, http.MethodPost, rosterArchive, rosterIDs(member), "limited")
+	if got := rosterPivot(t, gdb, member); !reflect.DeepEqual(got, []uint{staff.ID}) {
+		t.Fatalf("pivot after a bulk action = %v", got)
+	}
+}
+
+// TestRelationLockNoProvider: a controller without cabana.RelationLockProvider
+// has no locked option and no refusal.
+func TestRelationLockNoProvider(t *testing.T) {
+	env, gdb := newRosterBareEnv(t)
+	staff, news, _ := rosterLockSeed(t, gdb)
+	person := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Free", Active: true, Password: rosterHash("stored-before")})
+	options := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"/fields/tags/options", "", "limited").Body.String()
+	if strings.Contains(options, `"locked"`) || !strings.Contains(options, `"label":"staff"`) {
+		t.Fatalf("options without a provider = %s", options)
+	}
+	rec := env.expect(t, http.StatusOK, http.MethodPut, rosterPath(person, ""), `{"name":"Free",`+rosterPair+`,`+rosterTags(staff.ID, news.ID)+`}`, "limited")
+	if strings.Contains(rec.Body.String(), `"locked"`) {
+		t.Fatalf("a label is flagged without a provider: %s", rec.Body.String())
+	}
+	if got := rosterPivot(t, gdb, person); !reflect.DeepEqual(got, []uint{staff.ID, news.ID}) {
+		t.Fatalf("pivot = %v", got)
+	}
+}
+
+// TestWritableForeignKeyOptIn: a belongsTo field over a protected foreign key
+// is writable only when its contract says so (D-27 G3; T-12.1-11).
+func TestWritableForeignKeyOptIn(t *testing.T) {
+	for _, writable := range []bool{true, false} {
+		t.Run(fmt.Sprintf("WritableForeignKey=%v", writable), func(t *testing.T) {
+			env, gdb := newRosterEnvWith(t, func(p *rosterPlugin) {
+				p.relations = func(in []cabana.FieldRelationContract) []cabana.FieldRelationContract {
+					in[0].WritableForeignKey = writable
+					return in
+				}
+			})
+			team := rosterTeam{Tenant: "acme", Name: "Home"}
+			rosterSeed(t, gdb, &team)
+			person := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ro", Active: true})
+			_, raw := rosterFormSchema(t, env, "bearer")
+			readOnly := strings.Contains(raw, `"emptyOption":"No team","readOnly":true}`)
+			if readOnly == writable {
+				t.Fatalf("readOnly = %v for WritableForeignKey = %v: %s", readOnly, writable, raw)
+			}
+			options := env.call(t, http.MethodGet, rosterPeople+"/fields/team/options", "", "bearer")
+			if (options.Code == http.StatusOK) != writable {
+				t.Fatalf("options status = %d", options.Code)
+			}
+			env.expect(t, http.StatusOK, http.MethodPut, rosterPath(person, ""), fmt.Sprintf(`{"team":%d}`, team.ID), "bearer")
+			stored := rosterLoad(t, gdb, person).OrganisationID
+			if writable && (stored == nil || *stored != team.ID) {
+				t.Fatalf("the opted-in field did not write the key: %v", stored)
+			}
+			if !writable && stored != nil {
+				t.Fatalf("the field wrote the protected key without the opt-in: %d", *stored)
+			}
+			// The scalar column itself is never a fill key.
+			env.expect(t, http.StatusOK, http.MethodPut, rosterPath(person, ""), `{"organisation_id":987654}`, "bearer")
+			if after := rosterLoad(t, gdb, person).OrganisationID; !reflect.DeepEqual(after, stored) {
+				t.Fatalf("a scalar organisation_id was written: %v", after)
+			}
+			rec := env.expect(t, http.StatusOK, http.MethodGet, rosterPath(person, ""), "", "bearer")
+			if _, leaked := rosterRecord(t, rec.Body.Bytes()).Data["organisation_id"]; leaked {
+				t.Fatalf("the record carries organisation_id: %s", rec.Body.String())
+			}
+		})
+	}
+}
+
+// TestWritableForeignKeyScope: a submitted id passes the scoped options query
+// before it is written.
+func TestWritableForeignKeyScope(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	home, away := rosterTeam{Tenant: "acme", Name: "Home"}, rosterTeam{Tenant: "other", Name: "Away"}
+	rosterSeed(t, gdb, &home)
+	rosterSeed(t, gdb, &away)
+	person := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Tess", Active: true, OrganisationID: &home.ID})
+	for _, value := range []string{fmt.Sprint(away.ID), "999999", `"x"`, `[1]`, `{"id":1}`, "-1", "1.5"} {
+		rec := env.call(t, http.MethodPut, rosterPath(person, ""), `{"name":"Changed","team":`+value+`}`, "bearer")
+		if rec.Code != http.StatusUnprocessableEntity {
+			t.Fatalf("team %s = %d, want 422: %s", value, rec.Code, rec.Body.String())
+		}
+		var details map[string]any = rosterError(t, rec).Details
+		if _, ok := details["team"]; !ok {
+			t.Fatalf("team %s: no detail on the field: %s", value, rec.Body.String())
+		}
+	}
+	if stored := rosterLoad(t, gdb, person); stored.Name != "Tess" || stored.OrganisationID == nil || *stored.OrganisationID != home.ID {
+		t.Fatalf("a refused save wrote: %+v", stored)
+	}
+	// The out-of-scope team is not offered either.
+	options := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"/fields/team/options", "", "bearer").Body.String()
+	if strings.Contains(options, "Away") || !strings.Contains(options, "Home") {
+		t.Fatalf("options = %s", options)
+	}
+	env.expect(t, http.StatusOK, http.MethodPut, rosterPath(person, ""), `{"team":null}`, "bearer")
+	if stored := rosterLoad(t, gdb, person); stored.OrganisationID != nil {
+		t.Fatalf("null did not clear the key: %d", *stored.OrganisationID)
+	}
+	// On create as well.
+	rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPost, rosterPeople, fmt.Sprintf(`{"name":"Away born",%s,"team":%d}`, rosterPair, away.ID), "bearer")
+	rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "team", "The selected team is invalid.")
+	if n := rosterCount(t, env, "Away born"); n != 0 {
+		t.Fatalf("a refused create left %d rows", n)
+	}
+}

modules/cabana/phase121_rowstate_test.go

@@ -0,0 +1,134 @@
+package cabana_test
+
+import (
+	"fmt"
+	"net/http"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+// TestRowStateOrder: states are sent in the fixed order deleted, negative,
+// disabled, whatever order the hook answers in, and a repeated state is sent
+// once (D-12).
+func TestRowStateOrder(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	// The fixture answers disabled twice, then negative, then deleted.
+	all := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "All", Banned: true, DeletedAt: rosterDeleted()})
+	two := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Two", Banned: true})
+	one := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "One"})
+	body, raw := rosterList(t, env, "")
+	want := map[string][]string{
+		fmt.Sprint(all): {"deleted", "negative", "disabled"},
+		fmt.Sprint(two): {"negative", "disabled"},
+		fmt.Sprint(one): {"disabled"},
+	}
+	if !reflect.DeepEqual(body.Meta.RowStates, want) {
+		t.Fatalf("row_states = %v, want %v\n%s", body.Meta.RowStates, want, raw)
+	}
+}
+
+// TestRowStateUnknownDropped: a value outside the fixed set is never sent
+// (T-12.1-07); the known states of the same row stay.
+func TestRowStateUnknownDropped(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	logs := captureLog(t)
+	only := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Odd", Active: true})
+	mixed := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Odd", Banned: true})
+	body, raw := rosterList(t, env, "")
+	if strings.Contains(raw, "starred") {
+		t.Fatalf("an unknown state was sent: %s", raw)
+	}
+	if _, ok := body.Meta.RowStates[fmt.Sprint(only)]; ok {
+		t.Fatalf("a row whose only state is unknown is listed: %v", body.Meta.RowStates)
+	}
+	if got := body.Meta.RowStates[fmt.Sprint(mixed)]; !reflect.DeepEqual(got, []string{"negative", "disabled"}) {
+		t.Fatalf("known states next to an unknown one = %v", got)
+	}
+	if dropped := logs.matching("cabana: unknown list row state dropped"); len(dropped) != 2 || !strings.Contains(dropped[0], "state=starred") {
+		t.Fatalf("server log = %q", dropped)
+	}
+}
+
+// TestRowStateLengthMismatch: a hook result that is not aligned with the page
+// fails the list with the generic 500.
+func TestRowStateLengthMismatch(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada"})
+	rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterShort})
+	rec := env.expect(t, http.StatusInternalServerError, http.MethodGet, rosterPeople, "", "bearer")
+	got := rosterError(t, rec)
+	if got.Code != "error" || len(got.Details) != 0 || strings.Contains(rec.Body.String(), "row states") || strings.Contains(rec.Body.String(), "Ada") {
+		t.Fatalf("500 body = %s", rec.Body.String())
+	}
+	// A page without the misaligned answer still lists.
+	env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+"?search=Ada", "", "bearer")
+}
+
+// TestRowStateHookError: a hook error fails the list with the generic 500 and
+// no error text.
+func TestRowStateHookError(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	logs := captureLog(t)
+	rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterStateErr})
+	rec := env.expect(t, http.StatusInternalServerError, http.MethodGet, rosterPeople, "", "bearer")
+	if got := rosterError(t, rec); got.Code != "error" || strings.Contains(rec.Body.String(), "hunter2") || strings.Contains(rec.Body.String(), "state table") {
+		t.Fatalf("500 body = %s", rec.Body.String())
+	}
+	if failed := logs.matching("cabana: list row states failed"); len(failed) != 1 || !strings.Contains(failed[0], "controller=acme.roster.people") {
+		t.Fatalf("server log = %q", failed)
+	}
+}
+
+// TestRowStateAbsentKey: meta has no row_states key when no row has a state,
+// when the page is empty and when the controller has no hook.
+func TestRowStateAbsentKey(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Plain", Active: true})
+	for _, query := range []string{"", "?search=nobody-matches-this"} {
+		rec := env.expect(t, http.StatusOK, http.MethodGet, rosterPeople+query, "", "bearer")
+		if strings.Contains(rec.Body.String(), "row_states") {
+			t.Fatalf("row_states sent for %q: %s", query, rec.Body.String())
+		}
+	}
+	demo, demoDB := newActEnv(t)
+	actInsert(t, demoDB, "plain", "acme")
+	rec := demo.expect(t, http.StatusOK, http.MethodGet, "/acme/demo/gadgets", "", "bearer")
+	if strings.Contains(rec.Body.String(), "row_states") {
+		t.Fatalf("a controller without the hook sent row_states: %s", rec.Body.String())
+	}
+	// Row states are meta, never a column of the row.
+	body, _ := rosterList(t, env, "")
+	for _, row := range body.Data {
+		if _, ok := row["row_states"]; ok {
+			t.Fatalf("a row carries row_states: %v", row)
+		}
+	}
+}
+
+// TestRowStateOncePerPage: the hook is called once per served page with that
+// page's records, and not at all for an empty page.
+func TestRowStateOncePerPage(t *testing.T) {
+	env, gdb := newRosterEnv(t)
+	for i := range 21 {
+		rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: fmt.Sprintf("Person %02d", i)})
+	}
+	rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Foreign"})
+	env.spy.takeStates()
+	first, _ := rosterList(t, env, "")
+	second, _ := rosterList(t, env, "?page=2")
+	rosterList(t, env, "?search=nobody-matches-this")
+	if calls := env.spy.takeStates(); !reflect.DeepEqual(calls, []int{20, 1}) {
+		t.Fatalf("ListRowStates calls = %v, want one call of 20 and one of 1", calls)
+	}
+	if len(first.Meta.RowStates) != 20 || len(second.Meta.RowStates) != 1 {
+		t.Fatalf("row_states sizes = %d and %d", len(first.Meta.RowStates), len(second.Meta.RowStates))
+	}
+	// The keys of a page are the ids of that page's rows.
+	for _, row := range second.Data {
+		id, _ := row["id"].(float64)
+		if _, ok := second.Meta.RowStates[fmt.Sprint(uint(id))]; !ok {
+			t.Fatalf("page 2 row %v has no state entry: %v", row["id"], second.Meta.RowStates)
+		}
+	}
+}

modules/cabana/phase121_schema_boot_test.go

@@ -0,0 +1,218 @@
+package cabana_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/cabana"
+	"git.golem15.com/golem15/summercms/modules/pact"
+)
+
+// rosterActions is the roster controller with its registered bulk and record
+// actions replaced (boot-error tests).
+type rosterActions struct {
+	rosterController
+	bulk   func([]pact.AdminBulkAction) []pact.AdminBulkAction
+	record func([]pact.AdminRecordAction) []pact.AdminRecordAction
+}
+
+func (a rosterActions) AdminBulkActions() []pact.AdminBulkAction {
+	out := a.rosterController.AdminBulkActions()
+	if a.bulk != nil {
+		out = a.bulk(out)
+	}
+	return out
+}
+
+func (a rosterActions) AdminRecordActions() []pact.AdminRecordAction {
+	out := a.rosterController.AdminRecordActions()
+	if a.record != nil {
+		out = a.record(out)
+	}
+	return out
+}
+
+// TestPhase121BootErrors is the table of every boot error Phase 12.1 added
+// to the framework: each stops activation and names the plugin, the
+// controller and, where the mistake is in a file, that file.
+func TestPhase121BootErrors(t *testing.T) {
+	const (
+		listFile = "controllers/people/config_list.yaml"
+		formFile = "controllers/people/config_form.yaml"
+		listHead = "list: ~/plugins/acme/roster/models/person/columns.yaml\nmodelClass: Person\n"
+	)
+	noRun := func(context.Context, pact.AdminBulkActionInput) (pact.AdminBulkActionResult, error) {
+		return pact.AdminBulkActionResult{}, nil
+	}
+	bulk := func(edit func([]pact.AdminBulkAction) []pact.AdminBulkAction) func(*rosterPlugin) {
+		return func(p *rosterPlugin) {
+			p.wrap = func(inner rosterController) pact.AdminController {
+				return rosterActions{rosterController: inner, bulk: edit}
+			}
+		}
+	}
+	record := func(edit func([]pact.AdminRecordAction) []pact.AdminRecordAction) func(*rosterPlugin) {
+		return func(p *rosterPlugin) {
+			p.wrap = func(inner rosterController) pact.AdminController {
+				return rosterActions{rosterController: inner, record: edit}
+			}
+		}
+	}
+	relations := func(edit func([]cabana.FieldRelationContract)) func(*rosterPlugin) {
+		return func(p *rosterPlugin) {
+			p.relations = func(in []cabana.FieldRelationContract) []cabana.FieldRelationContract {
+				edit(in)
+				return in
+			}
+		}
+	}
+	notifyBlock := "    notify:\n        label: acme.roster::lang.people.notify\n        type: checkbox\n        default: true\n        context: create\n"
+
+	for _, tc := range []struct {
+		name   string
+		files  map[string]string
+		plugin func(*rosterPlugin)
+		want   string
+		file   string // "" when the mistake is in Go code, not in a file
+	}{
+		// config_list.yaml bulkActions (D-09).
+		{name: "bulkActions without showCheckboxes", files: map[string]string{listFile: listHead + "bulkActions: [activate]\n"},
+			want: "bulkActions needs showCheckboxes: true", file: listFile},
+		{name: "bulkActions names an unregistered action", files: map[string]string{listFile: listHead + "showCheckboxes: true\nbulkActions: [activate, promote]\n"},
+			want: "bulkActions: unsupported action promote (want a bulk action the controller registers)", file: listFile},
+		{name: "bulkActions names the built-in delete", files: map[string]string{listFile: listHead + "showCheckboxes: true\nbulkActions: [delete]\n"},
+			want: "bulkActions: unsupported action delete (want a bulk action the controller registers)", file: listFile},
+		{name: "bulkActions names an action twice", files: map[string]string{listFile: listHead + "showCheckboxes: true\nbulkActions: [activate, activate]\n"},
+			want: "bulkActions: duplicate action activate", file: listFile},
+		{name: "bulkActions is a scalar", files: map[string]string{listFile: listHead + "showCheckboxes: true\nbulkActions: activate\n"},
+			want: "bulkActions must be a list of bulk action names the controller registers", file: listFile},
+		{name: "a declared bulk action has no label", plugin: bulk(func(in []pact.AdminBulkAction) []pact.AdminBulkAction {
+			in[0].Label = ""
+			return in
+		}), want: "bulkActions: action activate needs a label", file: listFile},
+		// Registered bulk actions.
+		{name: "a bulk action with a reserved name", plugin: bulk(func(in []pact.AdminBulkAction) []pact.AdminBulkAction {
+			return append(in, pact.AdminBulkAction{Name: "delete", Label: "x", Run: noRun})
+		}), want: "bulk action delete uses a reserved built-in name (create, delete)"},
+		{name: "a bulk action registered twice", plugin: bulk(func(in []pact.AdminBulkAction) []pact.AdminBulkAction {
+			return append(in, in[0])
+		}), want: "duplicate bulk action activate"},
+		{name: "a bulk action without Run", plugin: bulk(func(in []pact.AdminBulkAction) []pact.AdminBulkAction {
+			in[1].Run = nil
+			return in
+		}), want: "bulk action archive has no Run function"},
+		{name: "a bulk action name that is not an identifier", plugin: bulk(func(in []pact.AdminBulkAction) []pact.AdminBulkAction {
+			return append(in, pact.AdminBulkAction{Name: "ban users", Label: "x", Run: noRun})
+		}), want: `bulk action name "ban users" is not an identifier`},
+		// config_form.yaml recordActions and preview (D-10, D-11).
+		{name: "recordActions without preview", files: map[string]string{formFile: rosterFormHead + "recordActions: [activate]\n"},
+			want: "recordActions needs a preview block (record actions are offered on the preview screen)", file: formFile},
+		{name: "recordActions names an unregistered action", files: map[string]string{formFile: rosterFormHead + "preview: {}\nrecordActions: [activate, promote]\n"},
+			want: "recordActions: unsupported action promote (want a record action the controller registers)", file: formFile},
+		{name: "recordActions names an action twice", files: map[string]string{formFile: rosterFormHead + "preview: {}\nrecordActions: [activate, activate]\n"},
+			want: "recordActions: duplicate action activate", file: formFile},
+		{name: "recordActions is a scalar", files: map[string]string{formFile: rosterFormHead + "preview: {}\nrecordActions: activate\n"},
+			want: "recordActions must be a list of record action names the controller registers", file: formFile},
+		{name: "a declared record action has no label", plugin: record(func(in []pact.AdminRecordAction) []pact.AdminRecordAction {
+			in[0].Label = ""
+			return in
+		}), want: "recordActions: action activate needs a label", file: formFile},
+		{name: "a record action with a reserved name", plugin: record(func(in []pact.AdminRecordAction) []pact.AdminRecordAction {
+			in[1].Name = "create"
+			return in
+		}), want: "record action create uses a reserved built-in name (create, delete)"},
+		{name: "a record action registered twice", plugin: record(func(in []pact.AdminRecordAction) []pact.AdminRecordAction {
+			return append(in, in[0])
+		}), want: "duplicate record action activate"},
+		{name: "a record action without Run", plugin: record(func(in []pact.AdminRecordAction) []pact.AdminRecordAction {
+			in[0].Run = nil
+			return in
+		}), want: "record action activate has no Run function"},
+		{name: "a null preview", files: map[string]string{formFile: rosterFormHead + "preview:\n"},
+			want: "preview must be a mapping; write preview: {} to enable the preview screen without a header partial", file: formFile},
+		{name: "a scalar preview", files: map[string]string{formFile: rosterFormHead + "preview: true\n"},
+			want: "preview must be a mapping", file: formFile},
+		{name: "an unknown preview key", files: map[string]string{formFile: rosterFormHead + "preview:\n    toolbar: x\n"},
+			want: "preview: unknown field toolbar", file: formFile},
+		{name: "a preview header partial that is a path", files: map[string]string{formFile: rosterFormHead + "preview:\n    headerPartial: $/acme/status.htm\n"},
+			want: "path must be a partial name", file: formFile},
+		{name: "a preview header partial without a template", files: map[string]string{formFile: rosterFormHead + "preview:\n    headerPartial: missing\n"},
+			want: "partial missing", file: "controllers/people/_missing.htm"},
+		// Password and form-only fields (D-27 G1, G2).
+		{name: "a password field outside FormVirtualFields", files: map[string]string{rosterFieldsFile: rosterFields(t, "", "    secret:\n        type: password\n")},
+			want: "field secret: type password needs the controller to list it in FormVirtualFields", file: rosterFieldsFile},
+		{name: "a listed virtual field that is not on the form", files: map[string]string{rosterFieldsFile: rosterFields(t, notifyBlock, "")},
+			want: "FormVirtualFields: field notify is not a field of this form", file: rosterFieldsFile},
+		{name: "a virtual field of a wrong type", files: map[string]string{rosterFieldsFile: rosterFields(t, "        type: checkbox\n        default: true\n", "        type: partial\n        path: status\n")},
+			want: "FormVirtualFields: field notify has type partial (want password, text, textarea, number, checkbox, switch or dropdown)", file: rosterFieldsFile},
+		{name: "a form-only field the controller does not list", files: map[string]string{rosterFieldsFile: rosterFields(t, "", "    nickname:\n        type: text\n")},
+			want: "field nickname is not a model column"},
+		// preset (D-27 G7).
+		{name: "an unsupported preset type", files: map[string]string{rosterFieldsFile: rosterFields(t, "        preset: name\n", "        preset:\n            field: name\n            type: camel\n")},
+			want: "preset type camel is not supported (want slug or exact)", file: rosterFieldsFile},
+		{name: "an unknown preset key", files: map[string]string{rosterFieldsFile: rosterFields(t, "        preset: name\n", "        preset:\n            field: name\n            prefix: x\n")},
+			want: "preset: unknown field prefix", file: rosterFieldsFile},
+		{name: "preset on a field that is not text", files: map[string]string{rosterFieldsFile: rosterFields(t, "        type: checkbox\n        default: true\n", "        type: checkbox\n        default: true\n        preset: name\n")},
+			want: "preset is only valid on type: text", file: rosterFieldsFile},
+		{name: "preset from an unknown field", files: map[string]string{rosterFieldsFile: rosterFields(t, "        preset: name\n", "        preset: title\n")},
+			want: "field slug: preset field title is not a field of this form", file: rosterFieldsFile},
+		{name: "preset from a field that is not text", files: map[string]string{rosterFieldsFile: rosterFields(t, "        preset: name\n", "        preset: notify\n")},
+			want: "field slug: preset field notify must be a text field", file: rosterFieldsFile},
+		{name: "preset from the field itself", files: map[string]string{rosterFieldsFile: rosterFields(t, "        preset: name\n", "        preset: slug\n")},
+			want: "field slug: preset names the field itself", file: rosterFieldsFile},
+		// permissioneditor (D-16).
+		{name: "permissioneditor without mode", files: map[string]string{rosterFieldsFile: rosterFields(t, "        mode: radio\n", "")},
+			want: "field permissions: mode must be radio or checkbox on type: permissioneditor", file: rosterFieldsFile},
+		{name: "permissioneditor with an unknown mode", files: map[string]string{rosterFieldsFile: rosterFields(t, "        mode: radio\n", "        mode: tabs\n")},
+			want: "mode must be radio or checkbox on type: permissioneditor", file: rosterFieldsFile},
+		{name: "permissioneditor with a default", files: map[string]string{rosterFieldsFile: rosterFields(t, "        mode: radio\n", "        mode: radio\n        default: 1\n")},
+			want: "default is not valid on type: permissioneditor", file: rosterFieldsFile},
+		{name: "mode on another type", files: map[string]string{rosterFieldsFile: rosterFields(t, "        type: checkbox\n        default: true\n", "        type: checkbox\n        default: true\n        mode: radio\n")},
+			want: "mode is only valid on type: fileupload, datepicker or permissioneditor", file: rosterFieldsFile},
+		// Relation fields (D-27 G3) and controller filter choices.
+		{name: "WritableForeignKey on belongsToMany", plugin: relations(func(in []cabana.FieldRelationContract) { in[1].WritableForeignKey = true }),
+			want: "field tags: WritableForeignKey is only valid on belongsTo"},
+		{name: "a scope filter without choices", plugin: func(p *rosterPlugin) {
+			p.wrap = func(inner rosterController) pact.AdminController { return rosterBare{inner: inner} }
+		}, want: "scope filter tagged needs FilterOptions on the controller or the model to serve its choices (D-27)", file: "controllers/people/config_filter.yaml"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			plugin := rosterPlugin{spy: &rosterSpy{}}
+			if tc.files != nil {
+				plugin.fsys = rosterTree(t, tc.files)
+			}
+			if tc.plugin != nil {
+				tc.plugin(&plugin)
+			}
+			err := rosterBootWith(t, plugin)
+			if err == nil {
+				t.Fatalf("the plugin booted, want an error with %q", tc.want)
+			}
+			parts := []string{tc.want, "acme.roster", "acme.roster.people"}
+			if tc.file != "" {
+				parts = append(parts, tc.file)
+			}
+			for _, part := range parts {
+				if !strings.Contains(err.Error(), part) {
+					t.Fatalf("error %q does not name %q", err, part)
+				}
+			}
+		})
+	}
+
+	// The provider-less permission editor is reported for the controller
+	// that lacks the provider.
+	t.Run("permissioneditor without the provider", func(t *testing.T) {
+		err := activateFields(t, datepickerFields("    rights:\n        type: permissioneditor\n        mode: checkbox\n"))
+		const want = "field rights: type permissioneditor needs the controller to implement cabana.PermissionEditorProvider"
+		if err == nil || !strings.Contains(err.Error(), want) || !strings.Contains(err.Error(), "fields.yaml") {
+			t.Fatalf("error = %v, want %q", err, want)
+		}
+	})
+
+	// The unchanged fixture boots, so every failure above is its one change.
+	if err := rosterBoot(t, rosterTree(t, nil)); err != nil {
+		t.Fatalf("the unchanged fixture does not boot: %v", err)
+	}
+}

modules/cabana/phase121_threats_test.go

@@ -0,0 +1,447 @@
+package cabana_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/cabana"
+)
+
+// rosterIDs is the body of a bulk request.
+func rosterIDs(ids ...uint) string {
+	raw, _ := json.Marshal(map[string]any{"ids": ids})
+	return string(raw)
+}
+
+// rosterPath is the admin path of one person, with an optional suffix.
+func rosterPath(id uint, suffix string) string {
+	return fmt.Sprintf("%s/%d%s", rosterPeople, id, suffix)
+}
+
+// rosterPair is the password pair every roster create needs.
+const rosterPair = `"password":"long-enough-1","password_confirmation":"long-enough-1"`
+
+// logCapture keeps the records written to the default logger while it is
+// installed.
+type logCapture struct {
+	mu      sync.Mutex
+	records []string
+}
+
+func (c *logCapture) Enabled(context.Context, slog.Level) bool { return true }
+func (c *logCapture) WithAttrs([]slog.Attr) slog.Handler       { return c }
+func (c *logCapture) WithGroup(string) slog.Handler            { return c }
+func (c *logCapture) Handle(_ context.Context, record slog.Record) error {
+	var line strings.Builder
+	line.WriteString(record.Message)
+	record.Attrs(func(attr slog.Attr) bool {
+		fmt.Fprintf(&line, " %s=%v", attr.Key, attr.Value.Any())
+		return true
+	})
+	c.mu.Lock()
+	c.records = append(c.records, line.String())
+	c.mu.Unlock()
+	return nil
+}
+
+// matching returns the captured lines that start with prefix.
+func (c *logCapture) matching(prefix string) []string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	var out []string
+	for _, line := range c.records {
+		if strings.HasPrefix(line, prefix) {
+			out = append(out, line)
+		}
+	}
+	return out
+}
+
+// captureLog installs a capturing default logger for the rest of the test.
+func captureLog(t *testing.T) *logCapture {
+	t.Helper()
+	capture := &logCapture{}
+	previous := slog.Default()
+	slog.SetDefault(slog.New(capture))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+	return capture
+}
+
+// TestPhase121Threats has one subtest per mitigated framework threat of
+// Phase 12.1, named by its id. Each asserts the protection through the admin
+// API on the acme.roster fixture, so removing the protection fails the
+// subtest on an assertion (scripts/check-phase12.1.sh --removal).
+//
+// T-12.1-16 (a preview URL in plugin YAML that points at a foreign route) is
+// mitigated in the SPA and pinned by the vitest case "backstop: mapWinterUrl
+// maps preview/:id to the preview route" in admin/tests/app/winterUrl.test.ts.
+// T-12.1-17 (the tag) is a release step and has no code path.
+func TestPhase121Threats(t *testing.T) {
+	t.Run("T-12.1-01", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		own := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Own"})
+		foreign := rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Foreign"})
+		// Only out-of-scope ids: nothing reaches Run and nothing changes.
+		rec := env.expect(t, http.StatusOK, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(foreign), "bearer")
+		if result := rosterBulkResult(t, rec); result.Affected != 0 {
+			t.Fatalf("out-of-scope selection affected %d rows", result.Affected)
+		}
+		// A mixed selection is refused as a whole.
+		rec = env.expect(t, http.StatusConflict, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(own, foreign), "bearer")
+		actErrorCode(t, rec.Body.Bytes(), "conflict")
+		if calls := env.spy.takeBulk(); len(calls) != 0 {
+			t.Fatalf("Run was called with %d selections for ids outside the list scope", len(calls))
+		}
+		if rosterLoad(t, gdb, own).Active || rosterLoad(t, gdb, foreign).Active {
+			t.Fatal("a refused selection changed a row")
+		}
+	})
+
+	t.Run("T-12.1-02", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+		// Undeclared names, and names registered in the other namespace only.
+		for _, name := range []string{"missing", "reinstate", "delete", "create"} {
+			env.expect(t, http.StatusNotFound, http.MethodPost, rosterPeople+"/bulk/"+name, rosterIDs(idle), "bearer")
+		}
+		for _, name := range []string{"missing", "archive", "delete", "create"} {
+			env.expect(t, http.StatusNotFound, http.MethodPost, rosterPath(idle, "/actions/"+name), `{}`, "bearer")
+		}
+		// Declared, but the administrator lacks the action's own permission.
+		rec := env.expect(t, http.StatusForbidden, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(idle), "limited")
+		actErrorCode(t, rec.Body.Bytes(), "forbidden")
+		rec = env.expect(t, http.StatusForbidden, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "limited")
+		actErrorCode(t, rec.Body.Bytes(), "forbidden")
+		if rosterLoad(t, gdb, idle).Active {
+			t.Fatal("an action ran without its permission")
+		}
+		if calls, one := env.spy.takeBulk(), env.spy.takeRecord(); len(calls) != 0 || len(one) != 0 {
+			t.Fatalf("a refused action reached the plugin: bulk=%d record=%d", len(calls), len(one))
+		}
+		// The same action is absent from what that administrator is offered.
+		if got := rosterBulkNames(t, env, "limited"); !reflect.DeepEqual(got, []string{"delete", "archive"}) {
+			t.Fatalf("limited admin is offered bulk actions %v", got)
+		}
+		if got := rosterOffered(t, env, idle, "limited"); len(got) != 0 {
+			t.Fatalf("limited admin is offered record actions %v", got)
+		}
+		if got := rosterOffered(t, env, idle, "bearer"); !reflect.DeepEqual(got, []string{"activate"}) {
+			t.Fatalf("full admin is offered record actions %v", got)
+		}
+	})
+
+	t.Run("T-12.1-03", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+		for _, rel := range []string{rosterPeople + "/bulk/activate", rosterPath(idle, "/actions/activate")} {
+			body := `{}`
+			if strings.Contains(rel, "/bulk/") {
+				body = rosterIDs(idle)
+			}
+			rec := env.expect(t, http.StatusForbidden, http.MethodPost, rel, body, "cookie-only")
+			actErrorCode(t, rec.Body.Bytes(), "forbidden")
+			if rosterLoad(t, gdb, idle).Active {
+				t.Fatalf("%s ran for a cookie request without X-Requested-With", rel)
+			}
+		}
+		// The same cookie with the header is accepted.
+		env.expect(t, http.StatusOK, http.MethodPost, rosterPath(idle, "/actions/activate"), `{}`, "cookie")
+		if !rosterLoad(t, gdb, idle).Active {
+			t.Fatal("the cookie request with the header did not run")
+		}
+	})
+
+	t.Run("T-12.1-04", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		active := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Active", Active: true})
+		foreign := rosterInsert(t, gdb, rosterPerson{Tenant: "other", Name: "Foreign"})
+		rec := env.expect(t, http.StatusNotFound, http.MethodPost, rosterPath(foreign, "/actions/activate"), `{}`, "bearer")
+		actErrorCode(t, rec.Body.Bytes(), "not_found")
+		rec = env.expect(t, http.StatusConflict, http.MethodPost, rosterPath(active, "/actions/activate"), `{}`, "bearer")
+		actErrorCode(t, rec.Body.Bytes(), "conflict")
+		if calls := env.spy.takeRecord(); len(calls) != 0 {
+			t.Fatalf("Run was called %d times for a record outside the scope or state", len(calls))
+		}
+		if rosterLoad(t, gdb, foreign).Active {
+			t.Fatal("an out-of-scope record was changed")
+		}
+	})
+
+	t.Run("T-12.1-05", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		first := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "First"})
+		second := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Second"})
+		crash := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterCrash})
+		// The action soft-deletes the first two rows and fails on the last.
+		env.expect(t, http.StatusInternalServerError, http.MethodPost, rosterPeople+"/bulk/archive", rosterIDs(first, second, crash), "bearer")
+		for _, id := range []uint{first, second, crash} {
+			if rosterLoad(t, gdb, id).DeletedAt.Valid {
+				t.Fatalf("row %d kept the write of a bulk action that failed on the last row", id)
+			}
+		}
+		if calls := env.spy.takeBulk(); len(calls) != 1 || len(calls[0].Records) != 3 {
+			t.Fatalf("the action did not run over the three rows: %+v", calls)
+		}
+	})
+
+	t.Run("T-12.1-06", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada"})
+		rec := env.expect(t, http.StatusInternalServerError, http.MethodPut, rosterPath(id, ""), `{"name":"Boom"}`, "bearer")
+		if got := rosterError(t, rec); got.Code != "error" || len(got.Details) != 0 {
+			t.Fatalf("500 error = %+v", got)
+		}
+		for _, leak := range []string{"hunter2", "roster database"} {
+			if strings.Contains(rec.Body.String(), leak) {
+				t.Fatalf("the 500 body carries the hook's error text %q: %s", leak, rec.Body.String())
+			}
+		}
+		crash := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: rosterCrash})
+		rec = env.expect(t, http.StatusInternalServerError, http.MethodPost, rosterPeople+"/bulk/archive", rosterIDs(crash), "bearer")
+		if strings.Contains(rec.Body.String(), "hunter2") {
+			t.Fatalf("the 500 body of a bulk action carries its error text: %s", rec.Body.String())
+		}
+		// A ForbiddenError is the one error whose text is the plugin's to show.
+		rec = env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), `{"name":"Reserved"}`, "bearer")
+		if got := rosterError(t, rec); got.Code != "forbidden" || got.Message != "You may not rename this person." {
+			t.Fatalf("403 error = %+v", got)
+		}
+	})
+
+	t.Run("T-12.1-07", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		odd := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Odd", Active: true})
+		idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Idle"})
+		body, raw := rosterList(t, env, "")
+		if strings.Contains(raw, "starred") {
+			t.Fatalf("a row state outside the fixed set was sent: %s", raw)
+		}
+		if _, ok := body.Meta.RowStates[fmt.Sprint(odd)]; ok {
+			t.Fatalf("a row with only an unknown state is listed: %v", body.Meta.RowStates)
+		}
+		if got := body.Meta.RowStates[fmt.Sprint(idle)]; !reflect.DeepEqual(got, []string{"disabled"}) {
+			t.Fatalf("known state = %v", got)
+		}
+	})
+
+	t.Run("T-12.1-08", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		idle := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Secretname", Email: "secret@example.test"})
+		logs := captureLog(t)
+		env.expect(t, http.StatusOK, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(idle), "bearer")
+		banned := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Secretname", Email: "secret@example.test", Active: true, Banned: true})
+		env.expect(t, http.StatusOK, http.MethodPost, rosterPath(banned, "/actions/reinstate"), `{}`, "bearer")
+
+		bulk := logs.matching("cabana: admin bulk action")
+		if len(bulk) != 1 || !strings.Contains(bulk[0], "controller=acme.roster.people") || !strings.Contains(bulk[0], "action=activate") || !strings.Contains(bulk[0], "affected=1") {
+			t.Fatalf("bulk action log lines = %q", bulk)
+		}
+		record := logs.matching("cabana: admin record action")
+		if len(record) != 1 || !strings.Contains(record[0], "action=reinstate") || !strings.Contains(record[0], fmt.Sprintf("record_id=%d", banned)) {
+			t.Fatalf("record action log lines = %q", record)
+		}
+		for _, line := range append(bulk, record...) {
+			if !strings.Contains(line, "admin_id=") || strings.Contains(line, "admin_id=0") {
+				t.Fatalf("log line lacks the admin id: %q", line)
+			}
+			if strings.Contains(line, "Secretname") || strings.Contains(line, "secret@example.test") {
+				t.Fatalf("log line carries record contents: %q", line)
+			}
+		}
+		// A refused request writes no action line.
+		env.expect(t, http.StatusForbidden, http.MethodPost, rosterPeople+"/bulk/activate", rosterIDs(idle), "limited")
+		if got := logs.matching("cabana: admin bulk action"); len(got) != 1 {
+			t.Fatalf("a refused action was logged as run: %q", got)
+		}
+	})
+
+	t.Run("T-12.1-09", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Vic","notify":true,`+rosterPair+`}`, "bearer")
+		for _, name := range []string{"notify", "password"} {
+			if strings.Contains(rec.Body.String(), name) {
+				t.Fatalf("the create response carries the virtual field %s: %s", name, rec.Body.String())
+			}
+		}
+		created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+		stored := rosterLoad(t, gdb, uint(created))
+		// The password column holds only what the hook derived; the submitted
+		// text never reached it through Fill.
+		if stored.Password != rosterHash("long-enough-1") {
+			t.Fatalf("a virtual value was bound to the model: password column = %q", stored.Password)
+		}
+		rec = env.expect(t, http.StatusOK, http.MethodGet, rosterPath(uint(created), ""), "", "bearer")
+		if strings.Contains(rec.Body.String(), "notify") || strings.Contains(rec.Body.String(), "password") {
+			t.Fatalf("the show response carries a virtual field: %s", rec.Body.String())
+		}
+	})
+
+	t.Run("T-12.1-10", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		const plain = "s3cret-plain-text"
+		responses := map[string]string{}
+		rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, fmt.Sprintf(`{"name":"Pat","password":%q,"password_confirmation":%q}`, plain, plain), "bearer")
+		responses["create"] = rec.Body.String()
+		created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+		id := uint(created)
+		if rosterLoad(t, gdb, id).Password != rosterHash(plain) {
+			t.Fatal("the password did not reach the hook")
+		}
+		responses["show"] = env.expect(t, http.StatusOK, http.MethodGet, rosterPath(id, ""), "", "bearer").Body.String()
+		responses["list"] = env.expect(t, http.StatusOK, http.MethodGet, rosterPeople, "", "bearer").Body.String()
+		responses["update"] = env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), fmt.Sprintf(`{"name":"Pat B","password":%q,"password_confirmation":%q}`, plain, plain), "bearer").Body.String()
+		responses["mismatch"] = env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), fmt.Sprintf(`{"password":%q,"password_confirmation":"other-enough-1"}`, plain), "bearer").Body.String()
+		for route, body := range responses {
+			if strings.Contains(body, plain) || strings.Contains(body, "sha256:") {
+				t.Fatalf("the %s response carries the password or its hash: %s", route, body)
+			}
+			if route != "mismatch" && strings.Contains(body, `"password`) {
+				t.Fatalf("the %s response carries a password key: %s", route, body)
+			}
+		}
+	})
+
+	t.Run("T-12.1-11", func(t *testing.T) {
+		// The same contract without WritableForeignKey: the field is read-only
+		// and a submitted id is not written.
+		env, gdb := newRosterEnvWith(t, func(p *rosterPlugin) {
+			p.relations = func(in []cabana.FieldRelationContract) []cabana.FieldRelationContract {
+				in[0].WritableForeignKey = false
+				return in
+			}
+		})
+		team := rosterTeam{Tenant: "acme", Name: "Home"}
+		rosterSeed(t, gdb, &team)
+		person := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ro", Active: true})
+		_, raw := rosterFormSchema(t, env, "bearer")
+		if !strings.Contains(raw, `"name":"team","type":"relation","label":"Team","nameFrom":"name","emptyOption":"No team","readOnly":true}`) {
+			t.Fatalf("the team field is writable without the opt-in: %s", raw)
+		}
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(person, ""), fmt.Sprintf(`{"team":%d,"organisation_id":%d}`, team.ID, team.ID), "bearer")
+		if stored := rosterLoad(t, gdb, person); stored.OrganisationID != nil {
+			t.Fatalf("a protected foreign key was written without the opt-in: %d", *stored.OrganisationID)
+		}
+	})
+
+	t.Run("T-12.1-12", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		staff, news := rosterTag{Name: "staff"}, rosterTag{Name: "news"}
+		rosterSeed(t, gdb, &staff)
+		rosterSeed(t, gdb, &news)
+		plain := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Plain", Active: true})
+		member := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Member", Active: true})
+		rosterSeed(t, gdb, &rosterPersonTag{PersonID: plain, TagID: news.ID})
+		rosterSeed(t, gdb, &rosterPersonTag{PersonID: member, TagID: staff.ID})
+		refused := func(method, rel, body string) {
+			t.Helper()
+			rec := env.expect(t, http.StatusForbidden, method, rel, body, "limited")
+			rosterErrorDetail(t, rec.Body.Bytes(), "forbidden", "tags", "You need an additional permission to change the staff tag.")
+		}
+		// Added on update, removed on update, added on create.
+		refused(http.MethodPut, rosterPath(plain, ""), fmt.Sprintf(`{"name":"Sneaky","tags":[%d,%d]}`, news.ID, staff.ID))
+		refused(http.MethodPut, rosterPath(member, ""), `{"tags":[]}`)
+		refused(http.MethodPost, rosterPeople, fmt.Sprintf(`{"name":"Smuggled",%s,"tags":[%d]}`, rosterPair, staff.ID))
+		if got := rosterPivot(t, gdb, plain); !reflect.DeepEqual(got, []uint{news.ID}) {
+			t.Fatalf("a refused save changed the pivot of the plain person: %v", got)
+		}
+		if got := rosterPivot(t, gdb, member); !reflect.DeepEqual(got, []uint{staff.ID}) {
+			t.Fatalf("a refused save changed the pivot of the member: %v", got)
+		}
+		if rosterLoad(t, gdb, plain).Name != "Plain" {
+			t.Fatal("a refused save wrote another field of the same body")
+		}
+		var smuggled int64
+		if err := gdb.Unscoped().Model(&rosterPerson{}).Where("name = ?", "Smuggled").Count(&smuggled).Error; err != nil || smuggled != 0 {
+			t.Fatalf("a refused create left %d rows (%v)", smuggled, err)
+		}
+	})
+
+	t.Run("T-12.1-13", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		stored := `{"reports.export":1}`
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Perm", Active: true, Permissions: &stored})
+		rec := env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), `{"permissions":{"admin.root":1,"reports.export":1}}`, "bearer")
+		rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "permissions", "The permissions field contains an unknown permission.")
+		rec = env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, rosterPath(id, ""), `{"permissions":{"posts.edit":2,"reports.export":1}}`, "bearer")
+		rosterErrorDetail(t, rec.Body.Bytes(), "validation_failed", "permissions", "The permissions field contains an invalid value.")
+		// The limited admin may not change the locked code, in either direction.
+		for _, body := range []string{`{"permissions":{"posts.edit":1}}`, `{"permissions":{"reports.export":-1}}`} {
+			rec = env.expect(t, http.StatusForbidden, http.MethodPut, rosterPath(id, ""), body, "limited")
+			rosterErrorDetail(t, rec.Body.Bytes(), "forbidden", "permissions", "You cannot change this permission.")
+		}
+		if got := rosterLoad(t, gdb, id).Permissions; got == nil || *got != stored {
+			t.Fatalf("a refused save changed the stored permissions: %v", got)
+		}
+	})
+
+	t.Run("T-12.1-14", func(t *testing.T) {
+		env, gdb := newRosterEnv(t)
+		ip := "203.0.113.7"
+		id := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Ada", Active: true, JoinedIP: &ip})
+		env.expect(t, http.StatusOK, http.MethodPut, rosterPath(id, ""), `{"name":"Ada L","joined_ip":"198.51.100.1"}`, "bearer")
+		if got := rosterLoad(t, gdb, id); got.JoinedIP == nil || *got.JoinedIP != ip || got.Name != "Ada L" {
+			t.Fatalf("an update wrote the preview-only field: %+v", got.JoinedIP)
+		}
+		rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"New","joined_ip":"198.51.100.2",`+rosterPair+`}`, "bearer")
+		created, _ := rosterRecord(t, rec.Body.Bytes()).Data["id"].(float64)
+		if got := rosterLoad(t, gdb, uint(created)); got.JoinedIP != nil {
+			t.Fatalf("a create wrote the preview-only field: %q", *got.JoinedIP)
+		}
+	})
+
+	t.Run("T-12.1-15", func(t *testing.T) {
+		// A status partial that carries active markup next to its callout.
+		const hostile = `<div class="summer-callout" onclick="alert(1)" style="color:red" data-tone="{{ .Data.Tone }}">` +
+			`<script>alert(1)</script><iframe src="/x"></iframe>` +
+			`<a href="javascript:alert(1)" title="t" onmouseover="x">{{ trans .Data.Title }}</a>` +
+			`<img src="//evil.example.test/x.png" onerror="alert(1)" alt="a">` +
+			`<custom-tag>kept text</custom-tag></div>`
+		env, gdb := newRosterEnvWith(t, func(p *rosterPlugin) {
+			p.fsys = rosterTree(t, map[string]string{"controllers/people/_status.htm": hostile})
+		})
+		banned := rosterInsert(t, gdb, rosterPerson{Tenant: "acme", Name: "Bea", Active: true, Banned: true})
+		rec := env.expect(t, http.StatusOK, http.MethodGet, fmt.Sprintf("%s/partials/status?id=%d", rosterPeople, banned), "", "bearer")
+		var view cabana.Envelope[cabana.PartialView]
+		if err := json.Unmarshal(rec.Body.Bytes(), &view); err != nil {
+			t.Fatalf("partial body %s: %v", rec.Body.String(), err)
+		}
+		if len(view.Data.Nodes) != 1 || view.Data.Nodes[0].Tag != "div" {
+			t.Fatalf("nodes = %+v", view.Data.Nodes)
+		}
+		root := view.Data.Nodes[0]
+		if !reflect.DeepEqual(root.Attrs, map[string]string{"class": "summer-callout", "data-tone": "danger"}) {
+			t.Fatalf("root attributes = %v, want only the allowlisted class and data-tone", root.Attrs)
+		}
+		var tags []string
+		for _, child := range root.Children {
+			tags = append(tags, child.Tag)
+			switch child.Tag {
+			case "a":
+				if !reflect.DeepEqual(child.Attrs, map[string]string{"title": "t"}) {
+					t.Fatalf("link attributes = %v, want no href and no handler", child.Attrs)
+				}
+			case "img":
+				if !reflect.DeepEqual(child.Attrs, map[string]string{"alt": "a"}) {
+					t.Fatalf("image attributes = %v, want no foreign src and no handler", child.Attrs)
+				}
+			}
+		}
+		// script and iframe are dropped with their content; the unknown element
+		// is unwrapped to its text.
+		if !reflect.DeepEqual(tags, []string{"a", "img", ""}) {
+			t.Fatalf("child tags = %q", tags)
+		}
+		for _, banned := range []string{"script", "iframe", "alert(1)", "onclick", "onerror", "onmouseover", "javascript:", "evil.example.test", "style", "custom-tag"} {
+			if strings.Contains(rec.Body.String(), banned) {
+				t.Fatalf("the partial response carries %q: %s", banned, rec.Body.String())
+			}
+		}
+	})
+}

modules/cabana/phase122_fixture_test.go

@@ -136,6 +136,8 @@ type dfRecorder struct {
 	mu    sync.Mutex
 	calls []string
 	fail  map[string]bool
+	// refuse makes a named hook answer a cabana.ForbiddenError.
+	refuse map[string]bool
 	// probe, when set, runs inside the Form hooks with the write's
 	// transaction and its result is recorded after the hook name.
 	probe func(tx *gorm.DB) string
@@ -152,6 +154,7 @@ func (r *dfRecorder) reset() {
 	defer r.mu.Unlock()
 	r.calls = nil
 	r.fail = map[string]bool{}
+	r.refuse = map[string]bool{}
 	r.probe = nil
 }
 
@@ -161,6 +164,19 @@ func (r *dfRecorder) failOn(name string) {
 	r.fail[name] = true
 }
 
+// refuseOn makes the named hook refuse with a ForbiddenError.
+func (r *dfRecorder) refuseOn(name string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.refuse == nil {
+		r.refuse = map[string]bool{}
+	}
+	r.refuse[name] = true
+}
+
+// dfRefusal is the message of a hook refusal asked for with refuseOn.
+const dfRefusal = "This change is not allowed here."
+
 func (r *dfRecorder) snapshot() []string {
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -172,6 +188,7 @@ func (r *dfRecorder) hook(ctx context.Context, name string) error {
 	r.mu.Lock()
 	probe := r.probe
 	fail := r.fail[name]
+	refuse := r.refuse[name]
 	r.mu.Unlock()
 	call := name
 	if probe != nil {
@@ -180,6 +197,9 @@ func (r *dfRecorder) hook(ctx context.Context, name string) error {
 		}
 	}
 	r.add(call)
+	if refuse {
+		return &cabana.ForbiddenError{Message: dfRefusal, Details: map[string]any{"hook": []string{name}}}
+	}
 	if fail {
 		return errors.New("fixture hook " + name + " failed")
 	}

modules/pact/capabilities_test.go

@@ -4,12 +4,14 @@ import (
 	"context"
 	"errors"
 	"io/fs"
+	"reflect"
 	"strings"
 	"testing"
 	"testing/fstest"
 
 	"git.golem15.com/golem15/summercms/modules/bonfire"
 	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
 )
 
 type configOnly struct{}
@@ -291,3 +293,140 @@ func TestFormSeamsDiscoveredByTypeAssertion(t *testing.T) {
 		t.Fatal("a plugin without the method implements FormVirtualFields")
 	}
 }
+
+// sampleRoster is a controller value that implements every admin contract of
+// Phase 12.1: declared bulk and record actions, row states and controller
+// filter choices.
+type sampleRoster struct{ ran *[]string }
+
+func (s sampleRoster) AdminBulkActions() []AdminBulkAction {
+	return []AdminBulkAction{{
+		Name: "activate", Label: "acme::lang.activate", Confirm: "acme::lang.activate_confirm",
+		Permissions: []string{"acme.manage"},
+		Run: func(_ context.Context, in AdminBulkActionInput) (AdminBulkActionResult, error) {
+			*s.ran = append(*s.ran, "bulk")
+			return AdminBulkActionResult{Message: "acme::lang.activated", Affected: len(in.Records)}, nil
+		},
+	}}
+}
+
+func (s sampleRoster) AdminRecordActions() []AdminRecordAction {
+	return []AdminRecordAction{{
+		Name: "reinstate", Label: "acme::lang.reinstate",
+		Applies: func(_ context.Context, record any) (bool, error) {
+			if record == nil {
+				return false, errors.New("no record")
+			}
+			return record.(string) == "banned", nil
+		},
+		Run: func(_ context.Context, in AdminRecordActionInput) (AdminRecordActionResult, error) {
+			*s.ran = append(*s.ran, "record")
+			return AdminRecordActionResult{Message: "acme::lang.reinstated"}, nil
+		},
+	}}
+}
+
+func (sampleRoster) ListRowStates(_ context.Context, _ *gorm.DB, records []any) ([][]RowState, error) {
+	out := make([][]RowState, len(records))
+	for i, record := range records {
+		if record.(string) == "banned" {
+			out[i] = []RowState{RowStateNegative}
+		}
+	}
+	return out, nil
+}
+
+func (sampleRoster) FilterOptions(scope string) []Option {
+	if scope != "tagged" {
+		return nil
+	}
+	return []Option{{Value: "1", Label: "acme::lang.tag"}}
+}
+
+var (
+	_ HasAdminBulkActions   = sampleRoster{}
+	_ HasAdminRecordActions = sampleRoster{}
+	_ ListRowStates         = sampleRoster{}
+	_ FilterOptions         = sampleRoster{}
+)
+
+// TestPhase121ContractsOnSampleController: the bulk action, record action,
+// row state and filter choice contracts are discovered by a type assertion
+// on a controller value and carry exactly the documented fields.
+func TestPhase121ContractsOnSampleController(t *testing.T) {
+	var ran []string
+	var ctl any = sampleRoster{ran: &ran}
+
+	bulk, ok := ctl.(HasAdminBulkActions)
+	if !ok || len(bulk.AdminBulkActions()) != 1 {
+		t.Fatal("HasAdminBulkActions is not discovered")
+	}
+	action := bulk.AdminBulkActions()[0]
+	result, err := action.Run(t.Context(), AdminBulkActionInput{Records: []any{"a", "b"}})
+	if err != nil || result.Affected != 2 || result.Message != "acme::lang.activated" {
+		t.Fatalf("bulk result = %+v err=%v", result, err)
+	}
+	if action.Name != "activate" || action.Confirm == "" || len(action.Permissions) != 1 {
+		t.Fatalf("bulk action = %+v", action)
+	}
+	// The input of a bulk action is the loaded records and nothing else: an id
+	// list would let a plugin skip the list scope.
+	if n := reflect.TypeOf(AdminBulkActionInput{}).NumField(); n != 1 {
+		t.Fatalf("AdminBulkActionInput has %d fields, want only Records", n)
+	}
+
+	record, ok := ctl.(HasAdminRecordActions)
+	if !ok || len(record.AdminRecordActions()) != 1 {
+		t.Fatal("HasAdminRecordActions is not discovered")
+	}
+	one := record.AdminRecordActions()[0]
+	for input, want := range map[string]bool{"banned": true, "active": false} {
+		if applies, err := one.Applies(t.Context(), input); err != nil || applies != want {
+			t.Fatalf("Applies(%s) = %v err=%v", input, applies, err)
+		}
+	}
+	if _, err := one.Applies(t.Context(), nil); err == nil {
+		t.Fatal("Applies did not pass its error back")
+	}
+	out, err := one.Run(t.Context(), AdminRecordActionInput{RecordID: 7, Record: "banned"})
+	if err != nil || out.Message != "acme::lang.reinstated" || one.Confirm != "" {
+		t.Fatalf("record result = %+v err=%v", out, err)
+	}
+	if fields := reflect.TypeOf(AdminRecordActionInput{}).NumField(); fields != 2 {
+		t.Fatalf("AdminRecordActionInput has %d fields, want RecordID and Record", fields)
+	}
+	if strings.Join(ran, ",") != "bulk,record" {
+		t.Fatalf("ran = %v", ran)
+	}
+
+	states, ok := ctl.(ListRowStates)
+	if !ok {
+		t.Fatal("ListRowStates is not discovered")
+	}
+	got, err := states.ListRowStates(t.Context(), nil, []any{"active", "banned"})
+	if err != nil || len(got) != 2 || got[0] != nil || len(got[1]) != 1 || got[1][0] != RowStateNegative {
+		t.Fatalf("row states = %v err=%v", got, err)
+	}
+	// The fixed set has exactly three values, each its own string.
+	set := map[RowState]bool{RowStateDeleted: true, RowStateNegative: true, RowStateDisabled: true}
+	if len(set) != 3 || string(RowStateDeleted) != "deleted" || string(RowStateNegative) != "negative" || string(RowStateDisabled) != "disabled" {
+		t.Fatalf("row state set = %v", set)
+	}
+
+	options, ok := ctl.(FilterOptions)
+	if !ok || len(options.FilterOptions("tagged")) != 1 || options.FilterOptions("other") != nil {
+		t.Fatal("FilterOptions is not discovered or answers an unknown scope")
+	}
+
+	var plain any = neither{}
+	for name, implemented := range map[string]bool{
+		"HasAdminBulkActions":   func() bool { _, ok := plain.(HasAdminBulkActions); return ok }(),
+		"HasAdminRecordActions": func() bool { _, ok := plain.(HasAdminRecordActions); return ok }(),
+		"ListRowStates":         func() bool { _, ok := plain.(ListRowStates); return ok }(),
+		"FilterOptions":         func() bool { _, ok := plain.(FilterOptions); return ok }(),
+	} {
+		if implemented {
+			t.Fatalf("a plain value implements %s", name)
+		}
+	}
+}