style: gofmt

Importing attach/webp registers the encoder library's WebP decoder ahead
of the pure Go one for the whole process, so WebP uploads are decoded
through the system libwebp when it is installed. The lagoon README and
the attachments page say so and name -tags nodynamic.

.planning/ROADMAP.md

@@ -1270,7 +1270,7 @@ Plans:
   3. An S3 blob driver can be selected through framework config, so the application does not import it. `/api-docs` and `/api-docs.json` can be served. Turnstile verification middleware is available.
   4. The touched modules' READMEs and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan.
 
-**Plans:** 6/6 plans executed
+**Plans:** 8/9 plans executed
 
 Plans:
 **Wave 1**
@@ -1533,26 +1533,33 @@ Plans:
   3. The demo is deployed publicly: the frontend is open, `/backend` is not reachable from the public internet, and the site carries a "want to see the backend? contact Golem15" call to action.
   4. The new code has unit tests, delivered in the phase's last plan.
 
-**Plans:** 6 plans
+**Plans:** 6/6 plans executed
 
 Plans:
 **Wave 1**
-- [ ] 20-01-PLAN.md — shared plugin release: siblings fast-forwarded, chat and forum pre-save seams (D-18), new sm-moderation-plugin (D-17), go.mod fixes, eight tags after go-ahead
+- [x] 20-01-PLAN.md — shared plugin release: siblings fast-forwarded, chat and forum pre-save seams (D-18), new sm-moderation-plugin (D-17), go.mod fixes, eight tags after go-ahead
 
 **Wave 2** *(blocked on Wave 1 completion)*
-- [ ] 20-02-PLAN.md — demo backend: oauthserver bump (folded todo), eight plugins mounted by tag, demo context and channel adapter, bootstrap endpoints, realtime for members, slash commands, moderation wiring, EN/PL seed and reset, Centrifugo namespaces, local LiveKit
+- [x] 20-02-PLAN.md — demo backend: oauthserver bump (folded todo), eight plugins mounted by tag, demo context and channel adapter, bootstrap endpoints, realtime for members, slash commands, moderation wiring, EN/PL seed and reset, Centrifugo namespaces, local LiveKit
 
 **Wave 3** *(blocked on Wave 2 completion)*
-- [ ] 20-03-PLAN.md — vue-chat-layer v0.1.0 (bm port, channels, threads, pins, command picker, link embeds) and /chat, floating panel, Chat tour card in vue-demo-app
+- [x] 20-03-PLAN.md — vue-chat-layer v0.1.0 (bm port, channels, threads, pins, command picker, link embeds) and /chat, floating panel, Chat tour card in vue-demo-app
 
 **Wave 4** *(blocked on Wave 3 completion)*
-- [ ] 20-04-PLAN.md — vue-forum-layer, vue-userfriends-layer, vue-chatvideo-layer v0.1.0 (DM-only call button), their pages and tour cards, herald VAPID config without UI
+- [x] 20-04-PLAN.md — vue-forum-layer, vue-userfriends-layer, vue-chatvideo-layer v0.1.0 (DM-only call button), their pages and tour cards, herald VAPID config without UI
 
 **Wave 5** *(blocked on Wave 4 completion)*
-- [ ] 20-05-PLAN.md — rome deploy: the demo's own LiveKit, Vuurmuur rule (checkpoint), nginx, .env keys, Centrifugo, release, DEPLOY.md, check-deploy and check-live
+- [x] 20-05-PLAN.md — rome deploy: the demo's own LiveKit, Vuurmuur rule (checkpoint), nginx, .env keys, Centrifugo, release, DEPLOY.md, check-deploy and check-live
 
 **Wave 6** *(blocked on Wave 5 completion)*
-- [ ] 20-06-PLAN.md — unit tests (Go, layers, site), two-browser chat and DM call checks, phase gate and live verification
+- [x] 20-06-PLAN.md — unit tests (Go, layers, site), two-browser chat and DM call checks, phase gate and live verification
+
+**Wave 7** *(gap closure, code review)*
+- [x] 20-07-PLAN.md — filter hardening (CR-02, CR-03): normalised text and canonical link hosts in sm-moderation-plugin, rendered-HTML check in sm-forum-plugin, bypass regression tests
+- [x] 20-08-PLAN.md — call and session fixes (CR-01, WR-01, WR-04, WR-05): useCall cancellation, join confirmation, failed-connect end, chat link guard, logout reset
+
+**Wave 8** *(blocked on Wave 7 completion)*
+- [ ] 20-09-PLAN.md — release, redeploy and recheck: suites, patch tags, demo bumps, rome deploy, live bypass and call probes, changelog posts, disposition ledger
 
 ### Phase 30: Płytarium cutover
 
@@ -1685,41 +1692,45 @@ Plans:
   3. The crawler reports SEO issues per URL, and each issue can be fixed through MCP.
   4. The new code has unit tests, delivered in the phase's last plan.
 
-**Plans:** 14 plans
+**Plans:** 13/16 plans executed
 
 Plans:
 **Wave 1**
-- [ ] 33-01-PLAN.md — framework: additive content descriptor fields and per-request field options, check-phase33.sh, v0.5.2 release log (no tag)
-- [ ] 33-07-PLAN.md — vue-seo-layer (new repository): CMS head and one JSON-LD graph, redirect/410 enforcement, root files, 404 report, shared purge route
+- [x] 33-01-PLAN.md — framework: additive content descriptor fields and per-request field options, check-phase33.sh, v0.5.2 release log (no tag)
+- [x] 33-07-PLAN.md — vue-seo-layer (new repository): CMS head and one JSON-LD graph, redirect/410 enforcement, root files, 404 report, shared purge route
 
 **Wave 2** *(blocked on Wave 1 completion)*
-- [ ] 33-02-PLAN.md — sm-journal-plugin: per-site H1 setting on every write path, editor J1–J4, descriptor facts, journal-author type, MCP tools
-- [ ] 33-03-PLAN.md — sm-sitemap-plugin: sitemap index with per-type files, slot table, real lastmod, hreflang, filter contract (breaking, D-32)
-- [ ] 33-08-PLAN.md — vue-seo-layer: SSR build guard, noindex routes, route report, drift check, breadcrumbs, pagination, HTML sitemap
+- [x] 33-02-PLAN.md — sm-journal-plugin: per-site H1 setting on every write path, editor J1–J4, descriptor facts, journal-author type, MCP tools
+- [x] 33-03-PLAN.md — sm-sitemap-plugin: sitemap index with per-type files, slot table, real lastmod, hreflang, filter contract (breaking, D-32)
+- [x] 33-08-PLAN.md — vue-seo-layer: SSR build guard, noindex routes, route report, drift check, breadcrumbs, pagination, HTML sitemap
 
 **Wave 3** *(blocked on Wave 2 completion)*
-- [ ] 33-04-PLAN.md — sm-sitemap-plugin: image and News sitemaps, IndexNow, HTML-sitemap API, MCP tools
-- [ ] 33-09-PLAN.md — journal, menu and FAQ layers on the SEO layer: headings in both H1 modes, one link per card, body links, breadcrumbs, pagination, related posts
+- [x] 33-04-PLAN.md — sm-sitemap-plugin: image and News sitemaps, IndexNow, HTML-sitemap API, MCP tools
+- [x] 33-09-PLAN.md — journal, menu and FAQ layers on the SEO layer: headings in both H1 modes, one link per card, body links, breadcrumbs, pagination, related posts
 
 **Wave 4** *(blocked on Wave 3 completion)*
-- [ ] 33-05-PLAN.md — sm-seo-plugin I: sitemap filter, page registry with route report, site endpoint, llms.txt, Links settings, purge after writes
+- [x] 33-05-PLAN.md — sm-seo-plugin I: sitemap filter, page registry with route report, site endpoint, llms.txt, Links settings, purge after writes
 
 **Wave 5** *(blocked on Wave 4 completion)*
-- [ ] 33-06-PLAN.md — sm-seo-plugin II: JSON-LD @graph, publisher, schema fields (E8/E9), breadcrumbs, hreflang, pagination; chromedp and webp legitimacy checkpoint
+- [x] 33-06-PLAN.md — sm-seo-plugin II: JSON-LD @graph, publisher, schema fields (E8/E9), breadcrumbs, hreflang, pagination; chromedp and webp legitimacy checkpoint
 
 **Wave 6** *(blocked on Wave 5 completion)*
-- [ ] 33-10-PLAN.md — sm-seo-plugin: crawler with optional rendered comparison (chromedp), issue report with fix routes, Site audit and Crawls, MCP tools
+- [x] 33-10-PLAN.md — sm-seo-plugin: crawler with optional rendered comparison (chromedp), issue report with fix routes, Site audit and Crawls, MCP tools
 
 **Wave 7** *(blocked on Wave 6 completion)*
-- [ ] 33-11-PLAN.md — internal linking and media: auto-links, link suggestions (E10), WebP variants with srcset
+- [x] 33-11-PLAN.md — internal linking and media: auto-links, link suggestions (E10), WebP variants with srcset
 
 **Wave 8** *(blocked on Wave 7 completion)*
-- [ ] 33-12-PLAN.md — apps I: demo end to end on local links, summercms.io patches, sm-bm-app noindex (D-72)
-- [ ] 33-13-PLAN.md — grzybyfunkcjonalne.pl on the new sitemap format and the SEO layer; uat deploy by decision
+- [x] 33-12-PLAN.md — apps I: demo end to end on local links, summercms.io patches, sm-bm-app noindex (D-72)
+- [x] 33-13-PLAN.md — grzybyfunkcjonalne.pl on the new sitemap format and the SEO layer; uat deploy by decision
 
 **Wave 9** *(blocked on Wave 8 completion)*
 - [ ] 33-14-PLAN.md — unit tests, check-phase33.sh --all, release tags in order, app re-pins, changelog post
 
+**Wave 10** *(gap closure after the 33-14 release checkpoint; 33-14 Task 4 resumes after both)*
+- [x] 33-15-PLAN.md — Go plugins: route report noindex paths and the filter (G1), Journal descriptors per translated locale (G3), crawl lifecycle and addresses, sitemap IndexNow/lock/lastmod/migration/headings, Journal content fixes
+- [x] 33-16-PLAN.md — Nuxt layers: route report noindex paths (G1), HTML sitemap pages (redirect, catch-all, i18n), root files 503, post article meta, journal pagination routes, link: release guard and versions
+
 ### Phase 34: Plugin marketplace
 
 **Goal:** People browse the public Golem15 plugins at summercms.io/marketplace and add one to their application with a single command, `summer plugin:install <id>`. The same command installs private plugins straight from a git URL without contacting summercms.io. The admin SPA gains a read-only Plugins screen listing installed plugins and searching the marketplace, which shows the install command with a copy button. v1 has no paid plugins, no developer registration and no installs from the admin panel.
@@ -1804,11 +1815,11 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | Complete    | 2026-10-22 |
 | 19.7. Generic MCP module | 9/9 | In Progress|  |
 | 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress|  |
-| 20. Demo instance with every shared plugin | 0/TBD | Not started | - |
+| 20. Demo instance with every shared plugin | 6/6 | In Progress|  |
 | 30. Płytarium cutover | 0/TBD | Not started | - |
 | 31. Chat polish against WavePath clients | 0/TBD | Not started | - |
 | 32. SEO foundation | 6/6 | In Progress|  |
-| 33. SEO output, audit and content | 0/14 | Planned | - |
+| 33. SEO output, audit and content | 13/14 | In Progress|  |
 | 34. Plugin marketplace | 6/6 | In Progress|  |
 
 ## Backlog

.planning/WINDOWS.md

@@ -1,10 +1,10 @@
 ---
 schema_version: 1
-open_count: 20
+open_count: 26
 waived_count: 0
-fixed_count: 7
-total_count: 27
-last_updated: 2026-10-22T14:44:56.679Z
+fixed_count: 9
+total_count: 35
+last_updated: 2026-11-04T19:19:01.124Z
 ---
 
 # Broken Windows Ledger
@@ -42,6 +42,14 @@ last_updated: 2026-10-22T14:44:56.679Z
 | 25 | 19.7 | deviation | modules/cabana |  | 19.7-01: admin route inventories (phase09Routes, tokenRouteClasses, CSRF walk 35, phase10 want list, conformCases) extended for the two account contribution routes | open |  | 2026-10-22T14:44:56.218Z |  |
 | 26 | 19.7 | deviation | modules/cabana |  | 19.7-01: TestRecordActionPromptRun added on Postgres to prove Run receives the trimmed prompt value | open |  | 2026-10-22T14:44:56.449Z |  |
 | 27 | 19.7 | unrun-verify | scripts/check-phase19.6.1.sh |  | 19.7-01: check-phase19.6.1.sh --all stopped by the host (memory pressure) after the cabana and surf Postgres suites passed; re-run on the Docker host | open |  | 2026-10-22T14:44:56.679Z |  |
+| 28 | 33 | deviation | modules/lagoon/validate.go |  | 33-02: lagoon.Validate rejects the string and url rule tokens, so the Journal admin settings save answers 500 (pre-existing); the Headings and links switch is saved through the settings API/MCP until fixed | open |  | 2026-11-04T09:39:12.905Z |  |
+| 29 | 33 | stub | contract/contract.go |  | sm-sitemap-plugin: contract.ListingSettings HTMLEnabled, HTMLPaths, HTMLPageSize and KeyFile stay zero and golem15_sitemap_urls.images stays [] until 33-04 adds the HTML sitemap, IndexNow and image settings | fixed |  | 2026-11-04T10:26:56.754Z | 2026-11-04T11:41:58.774Z |
+| 30 | 33 | deviation | models/settings/fields.yaml |  | sm-sitemap-plugin: the Additional addresses lastmod is a text field read as YYYY-MM-DD (server-checked, errors.lastmod) because the framework repeater accepts no datepicker column; swap to a datepicker once cabana supports it in repeaters | open |  | 2026-11-04T10:26:56.940Z |  |
+| 31 | 33 | deviation | models/settings/fields.yaml |  | sm-sitemap-plugin: News sources is a taglist with custom tags and no options (values listed by the news_sources partial, server-checked) because cabana taglist options are a fixed YAML list and form extensions take no taglist; switch to options from the article types and categories once the framework offers per-request taglist options | open |  | 2026-11-04T11:42:13.158Z |  |
+| 32 | 33 | deviation | controllers/issues/config_filter.yaml |  | sm-seo-plugin: the Site audit status filter cannot default to Open (cabana list filters have no default value), so the list shows ignored issues too, badged Ignored; GET /_seo/api/v1/issues and seo_list_issues default to status open; set the default once cabana filters accept one | open |  | 2026-11-04T15:03:28.372Z |  |
+| 33 | 33 | deviation | controllers/issues/_issue_details.htm |  | sm-seo-plugin: P7 shows Open the page and the Rich Results Test as labelled addresses, not links, because the partial allowlist keeps only same-origin hrefs; make them links once partials may carry an external link (new tab) | open |  | 2026-11-04T15:03:28.619Z |  |
+| 34 | 33 | deviation | vue-demo-app/nuxt.config.ts |  | 33-12: the demo serves Polish by cookie at one address (no_prefix), but the CMS names /pl/... alternates and sitemap addresses, which answer 404; i18n strategy decision before 33-14 applies the demo patches | open |  | 2026-11-04T17:10:13.946Z |  |
+| 35 | 33 | todo | sm-sitemap-plugin/classes/rebuild.go |  | 33-12: additional addresses are not de-duplicated against content records (migrated /, /blog, /faq listed twice on rome-like data); the demo DEPLOY step works around it | fixed |  | 2026-11-04T17:10:14.144Z | 2026-11-04T19:19:01.124Z |
 
 ````json
 [
@@ -395,6 +403,110 @@ last_updated: 2026-10-22T14:44:56.679Z
     "recorded_at": "2026-10-22T14:44:56.679Z",
     "resolved_at": null,
     "milestone": "v1.0"
+  },
+  {
+    "id": 28,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "modules/lagoon/validate.go",
+    "line": null,
+    "description": "33-02: lagoon.Validate rejects the string and url rule tokens, so the Journal admin settings save answers 500 (pre-existing); the Headings and links switch is saved through the settings API/MCP until fixed",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T09:39:12.905Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 29,
+    "kind": "stub",
+    "phase": "33",
+    "file": "contract/contract.go",
+    "line": null,
+    "description": "sm-sitemap-plugin: contract.ListingSettings HTMLEnabled, HTMLPaths, HTMLPageSize and KeyFile stay zero and golem15_sitemap_urls.images stays [] until 33-04 adds the HTML sitemap, IndexNow and image settings",
+    "status": "fixed",
+    "reason": "",
+    "recorded_at": "2026-11-04T10:26:56.754Z",
+    "resolved_at": "2026-11-04T11:41:58.774Z",
+    "milestone": "v1.0"
+  },
+  {
+    "id": 30,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "models/settings/fields.yaml",
+    "line": null,
+    "description": "sm-sitemap-plugin: the Additional addresses lastmod is a text field read as YYYY-MM-DD (server-checked, errors.lastmod) because the framework repeater accepts no datepicker column; swap to a datepicker once cabana supports it in repeaters",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T10:26:56.940Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 31,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "models/settings/fields.yaml",
+    "line": null,
+    "description": "sm-sitemap-plugin: News sources is a taglist with custom tags and no options (values listed by the news_sources partial, server-checked) because cabana taglist options are a fixed YAML list and form extensions take no taglist; switch to options from the article types and categories once the framework offers per-request taglist options",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T11:42:13.158Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 32,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "controllers/issues/config_filter.yaml",
+    "line": null,
+    "description": "sm-seo-plugin: the Site audit status filter cannot default to Open (cabana list filters have no default value), so the list shows ignored issues too, badged Ignored; GET /_seo/api/v1/issues and seo_list_issues default to status open; set the default once cabana filters accept one",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T15:03:28.372Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 33,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "controllers/issues/_issue_details.htm",
+    "line": null,
+    "description": "sm-seo-plugin: P7 shows Open the page and the Rich Results Test as labelled addresses, not links, because the partial allowlist keeps only same-origin hrefs; make them links once partials may carry an external link (new tab)",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T15:03:28.619Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 34,
+    "kind": "deviation",
+    "phase": "33",
+    "file": "vue-demo-app/nuxt.config.ts",
+    "line": null,
+    "description": "33-12: the demo serves Polish by cookie at one address (no_prefix), but the CMS names /pl/... alternates and sitemap addresses, which answer 404; i18n strategy decision before 33-14 applies the demo patches",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-11-04T17:10:13.946Z",
+    "resolved_at": null,
+    "milestone": "v1.0"
+  },
+  {
+    "id": 35,
+    "kind": "todo",
+    "phase": "33",
+    "file": "sm-sitemap-plugin/classes/rebuild.go",
+    "line": null,
+    "description": "33-12: additional addresses are not de-duplicated against content records (migrated /, /blog, /faq listed twice on rome-like data); the demo DEPLOY step works around it",
+    "status": "fixed",
+    "reason": "",
+    "recorded_at": "2026-11-04T17:10:14.144Z",
+    "resolved_at": "2026-11-04T19:19:01.124Z",
+    "milestone": "v1.0"
   }
 ]
 ````

.planning/notes/2026-10-28-chromedp-rendered-crawl.md

@@ -0,0 +1,42 @@
+# Decision: the site audit's rendered comparison uses chromedp, optionally
+
+**Date:** 2026-10-28 (dependency approved 2026-11-04)
+**Status:** Accepted
+**Context:** Phase 33 (SEO output, audit and content, D-70), 33-CONTEXT.md "Rendered comparison (Jakub, 2026-10-28): optional chromedp", 33-RESEARCH.md Alternatives considered and Package Legitimacy Audit, plan 33-06 Task 4 (approval), plan 33-10 Task 4 (P33-55)
+
+## Decision
+
+The site audit's crawler (`sm-seo-plugin`, package `classes/crawl`) always checks the raw, server-rendered HTML. It compares a page's raw HTML with its JavaScript-rendered DOM only when an operator configures a Chrome or Chromium binary; without one every crawl records the comparison as skipped and says so (the crawl preview P6, `GET /_seo/api/v1/crawls/{id}` and the MCP tool `seo_get_crawl` answer `render {status: skipped}`).
+
+- **`github.com/chromedp/chromedp` pinned at exactly v0.21.0.** Published 2026-10-11 (proxy.golang.org, origin `github.com/chromedp/chromedp` at tag `v0.21.0`, commit `7862adfd`), MIT. Approved by Jakub on 2026-11-04 (33-06 Task 4). v0.21.1 and v0.22.0 exist but were under two weeks old at approval and are deliberately not used. Its go.mod requires `github.com/chromedp/cdproto` v0.157.8 and `github.com/go-json-experiment/json`; nothing else.
+- **Why this library.** A maintained pure-Go client of the Chrome DevTools Protocol: no cgo, no Node runtime, no bundled browser. It drives an operator-installed Chrome or Chromium binary (RESEARCH Alternatives considered: a raw-HTML-only crawl misses content that appears only after JavaScript; a Node headless browser would add a second runtime to a single-binary deployment).
+- **What is compared** (D-70, P33-55): same-host links, an H1, or a substantial amount of text (at least 50 words and 20 % more) that appear only after JavaScript are reported as `content_js` with `details.check: rendered`. The raw HTML against the CMS record stays `details.check: cms` and runs on every crawl.
+- **Chrome is optional and operator-installed.** Production servers have none by default. The executable path is the Go config key `golem15.seo.crawl_chrome_path` (environment-overridable like every key); `golem15.seo.crawl_render_max` (default 200) caps the pages rendered per crawl, in crawl order. An empty path skips the comparison; a relative path, or one that is not an executable regular file, records the comparison as failed with a note. The crawl itself never fails because of the renderer.
+- **The path comes from config only, never from an admin setting or MCP.** Any holder of `golem15.seo.manage` can write the SEO settings and call the SEO tools; a writable executable path would let them make the server run an arbitrary binary (T-33-69).
+- **Plugin-only.** Only `sm-seo-plugin` requires chromedp. The framework go.mod does not (D-90: the framework gets no SEO code), and `grep chromedp go.mod` in summercms.go stays empty.
+
+## The guard (P33-55)
+
+Headless Chrome executes untrusted page JavaScript on the server, so it is held to the crawler's `fetchguard` limits:
+
+- **Resolver pinning.** Before Chrome starts, the site host and its `www` twin are resolved and every address is checked with `fetchguard.IsPrivateAddr`; a private or reserved address refuses to start the renderer (render status failed, the note names the address) unless `golem15.seo.crawl_trusted` is true. The checked addresses go into `--host-resolver-rules` as `MAP <host> <address>` lines (one address per host, IPv4 first) followed by a final `MAP * ~NOTFOUND`, so every other host resolves to nothing and Chrome cannot re-resolve the site host to another address. Chrome applies the first rule that matches a host, so the catch-all must come last: with a leading `MAP * ~NOTFOUND` the site host itself fails with `ERR_NAME_NOT_RESOLVED` (checked against Chromium during 33-10; P33-55 had it leading).
+- **Request interception.** Every request is paused through the DevTools Fetch domain and continued only when it is `https` (`http` only in trusted mode) to the site host or its twin, or a `data:` or `blob:` URL; every other request fails with `BlockedByClient`. Third-party scripts, fonts, analytics and link-local metadata addresses are therefore never loaded.
+- **No state.** Each crawl uses a fresh temporary profile (`os.MkdirTemp`) removed when the renderer closes; no cookies, Authorization header, HTTP credentials or extensions; downloads denied. The crawler never signs in.
+- **Limits.** One tab renders at a time, 20 s per page, the DOM read with `OuterHTML` is capped at 5 MiB, and Chrome is closed when the crawl finishes, fails or is cancelled.
+- **Sandbox.** chromedp's default allocator flags are used without additions that weaken Chrome's sandbox (no `--no-sandbox`).
+
+## Rejected alternatives
+
+- **Raw HTML only.** No dependency and no browser on the server, but content and links that appear only after JavaScript go unreported, which D-70 asks the audit to find.
+- **`github.com/go-rod/rod`.** Also a pure-Go DevTools client, but it downloads a browser by itself by default and adds a larger API surface; chromedp's allocator takes an explicit executable path, which keeps the binary under operator control.
+- **A Node headless browser (Puppeteer, Playwright).** A second runtime next to the single binary.
+
+## Package legitimacy
+
+The package-legitimacy seam cannot check Go modules, so chromedp was gated by the blocking human check of plan 33-06 Task 4 and approved by Jakub (v0.21.0) before any `go get`. v0.21.0 resolves through proxy.golang.org with the origin above.
+
+## Consequences
+
+- `sm-seo-plugin/go.mod` requires `github.com/chromedp/chromedp v0.21.0` (and, through it, `github.com/chromedp/cdproto`); applications that mount the plugin get it through the plugin, and chromedp is compiled in whether or not a Chrome path is configured.
+- A site whose crawl should compare rendered pages installs Chrome or Chromium on the server and sets `golem15.seo.crawl_chrome_path`; nothing else changes.
+- If the library ever needs replacing, only `classes/crawl/render_chrome.go` changes: the crawler talks to the `crawl.Renderer` seam.

.planning/notes/2026-10-28-webp-gen2brain.md

@@ -0,0 +1,50 @@
+# Decision: WebP variants of attachment thumbnails through github.com/gen2brain/webp
+
+**Date:** 2026-10-28 (dependency approved 2026-11-04)
+**Status:** Accepted
+**Context:** Phase 33 (SEO output, audit and content, D-85), 33-CONTEXT.md "Image formats (Jakub, 2026-10-28): WebP now, in Go", 33-RESEARCH.md Open Question 3 and Package Legitimacy Audit, plan 33-06 Task 4 (approval), plan 33-11 (P33-42, P33-43)
+
+## Decision
+
+Sites serve their featured images as `<picture>` with a WebP source and the original format as the `srcset` fallback. The WebP files are encoded in Go, once per thumbnail size, in a background job, never in the upload request. AVIF is deferred.
+
+- **`github.com/gen2brain/webp` pinned at exactly v0.6.4.** Published 2026-07-01 (proxy.golang.org, origin `github.com/gen2brain/webp` at tag `v0.6.4`, commit `3dcf5268`), MIT (the bundled libwebp under its BSD licence, `lib/LICENSE.libwebp`). Approved by Jakub on 2026-11-04 (33-06 Task 4). Its go.mod requires `github.com/ebitengine/purego` v0.10.1 and nothing else.
+- **Why this library.** `golang.org/x/image/webp`, which `attach` already uses, decodes only; the standard library has no WebP encoder. cgo bindings to libwebp would break the cgo-free build of the single binary. gen2brain/webp encodes in Go without cgo.
+- **What is encoded.** Each thumbnail a caller asks for (`attach.File.ThumbKey` at a width, height and mode) gets one WebP variant next to it, at quality 80, under `attach.VariantKey(thumbKey, "webp")`. The original upload is never re-encoded, and images an editor inserts into a body keep their original file.
+- **Where it runs.** Journal's conga job `golem15.journal.image_variants` is dispatched after a featured image upload commits, and `journal:image-variants --all` backfills existing images. A slow or failing encode never fails the upload.
+
+## How it runs (checked in the v0.6.4 module source, 2026-11-04)
+
+- **First choice: the system libwebp through purego.** At init the package opens `libwebp.so` and `libwebpdemux.so` with `purego.Dlopen` (no cgo). On Linux this only works in a dynamically linked binary.
+- **Fallback: libwebp transpiled to Go.** When the libraries are missing (or with the build tag `nodynamic`), it uses libwebp compiled to WASM and then transpiled to plain Go source by wasm2go (`libwebp.go`, about 2.7 MB of generated Go). There is no WASM runtime at run time and no wazero; 33-CONTEXT's "WASM fallback" means this transpiled code. `webp.Dynamic()` reports which path is active.
+- **Linking consequence.** purego's no-cgo runtime support makes a binary that imports the package dynamically linked, even with `CGO_ENABLED=0`: the probe binary needed the ELF interpreter `/lib64/ld-linux-x86-64.so.2` and `libc.so.6`, `libdl.so.2` and `libpthread.so.0`. It runs on glibc hosts such as the Debian servers. It does not run in a `scratch` image, a distroless static image or on musl (Alpine). Building with `-tags nodynamic` keeps the binary statically linked and uses only the transpiled code (checked: `statically linked`, `Dynamic()` reports "dynamic disabled").
+- **Side effect.** The package registers a `webp` decoder with `image.RegisterFormat`, next to the one `golang.org/x/image/webp` registers. Both decode WebP, so `image.Decode` keeps working whichever one it picks.
+
+## Benchmark
+
+- **33-CONTEXT, 2026-10-28.** A 1200 px variant of a 2592×1754 photo: WebP 78 KB against JPEG q80 at 133 KB. Encoding took about 90 ms with the system libwebp and about 510 ms in the fallback. AVIF came out only about 6 % smaller than WebP, at 1.3× to 20× the CPU.
+- **Probe of v0.6.4 on 2026-11-04** (this workstation, a synthetic 1200×812 gradient, quality 80): about 17 ms through the system libwebp and about 90 ms in the transpiled fallback. WebP was 29.8 KB against 58.4 KB for JPEG q80. The two runs used different images and machines, so compare the paths with each other, not the numbers across runs.
+
+## Where the code lives (P33-42)
+
+- **Framework, generic media.** `modules/lagoon/attach/webp` (package `webp`): `Encode(w, img)` at quality 80 and `Variant(ctx, bucket, f, w, h, mode)`. `Variant` writes the variant next to the thumbnail, returns early when it exists, and deletes the key when an encode or close fails. In `attach` itself there is one generic helper, `attach.VariantKey(thumbKey, format)`.
+- **Why it is not SEO code.** A WebP variant of a thumbnail is a media format. It has nothing to do with SEO, and the framework gets no SEO wording (D-90). The addition is additive at patch level (D-106).
+- **Only binaries that import it link it.** `attach` does not import the sub-package, so a binary links gen2brain/webp, purego and the linking consequence above only when it imports `modules/lagoon/attach/webp`. In practice that means through sm-journal-plugin.
+- **The job lives in Journal.** Only plugins register conga jobs, and Journal owns the featured images and their variants table (`golem15_journal_image_variants`, P33-43).
+
+## Rejected alternatives
+
+- **AVIF through `github.com/gen2brain/avif`.** About 6 % smaller than WebP at 1.3× to 20× the CPU. Deferred.
+- **A Nuxt image pipeline (sharp).** New npm dependencies with a native module, and the encoding would move into the frontend server.
+- **cgo bindings to libwebp.** They break the cgo-free cross-compiled builds the applications use.
+- **Widths only, no new format.** This needs no dependency, but D-85 asks for a modern format.
+
+## Package legitimacy
+
+The package-legitimacy seam cannot check Go modules, so gen2brain/webp was gated by the blocking human check of plan 33-06 Task 4 and approved by Jakub at v0.6.4 before any `go get`. v0.6.4 resolves through proxy.golang.org with the origin above (`h1:SUDdmxADOAiPQ+5ylNmuHhuYf2dOi0KgKZHL5vpVCNU=`).
+
+## Consequences
+
+- The framework go.mod requires `github.com/gen2brain/webp v0.6.4` (and, through it, `github.com/ebitengine/purego v0.10.1`). Only packages under `modules/lagoon/attach/webp` import it.
+- An application that mounts sm-journal-plugin links the encoder. Its binary is dynamically linked against glibc unless it is built with `-tags nodynamic`. Installing libwebp on the server makes encoding about five times faster, and nothing else changes. The package opens the unversioned names `libwebp.so` and `libwebpdemux.so`, which Debian ships in `libwebp-dev`.
+- If the library ever needs replacing, only `modules/lagoon/attach/webp/webp.go` changes. Callers use `Encode` and `Variant`.

.planning/phases/20-demo-instance-with-every-shared-plugin/20-01-SUMMARY.md

@@ -0,0 +1,214 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 01
+subsystem: plugins
+tags: [chat, forum, moderation, go-modules, release, gitea]
+
+requires:
+  - phase: 19.4.1-early-public-demo-on-demo-summercms-io
+    provides: live demo instance the chat family is added to
+  - phase: 34
+    provides: summercms v0.6.0 framework tag the family requires
+provides:
+  - "sm-chat-plugin v0.1.5: events.MessageSaving pre-save event + contracts.Rejection (422 on refusal)"
+  - "sm-forum-plugin v0.1.1: events.PostSaving pre-save event + contracts.Rejection (422 on refusal)"
+  - "sm-moderation-plugin v0.1.0 (new public repo): golem15.moderation, *classes.Filter for banned words and links, admin settings screen"
+  - "sm-chatvideo-plugin, sm-herald-plugin, sm-userfriends-plugin v0.1.1: go.mod on tagged chat/user/summercms, framework replace only"
+  - "Eight chat-family module tags that resolve together with GOWORK=off against summercms v0.6.0"
+affects: [20-02, 20-03, 20-04, 20-05, 20-06, sm-demo-app]
+
+actuals:
+  tokens: 32150    # chars/4 over the realized diffs in the six changed sibling repos
+  tasks: 6
+  commits: 7       # measured: git rev-list over the sibling repos (chat 2, forum 1, moderation 1, chatvideo 1, herald 1, userfriends 1); summercms.go had 0 code commits
+plan_head_before: 677e30f6f53e9eab79d6cadd46b8b6e2843f5c61   # summercms.go; multi-repo plan, per-repo bases listed in the body
+plan_head_after: 677e30f6f53e9eab79d6cadd46b8b6e2843f5c61    # summercms.go before this SUMMARY commit
+
+tech-stack:
+  added: []
+  patterns:
+    - "Pre-save veto event: plugin fires <Thing>Saving on the bus before the transaction; a listener returning contracts.Rejection{Field, Message} maps to the existing 422 validation envelope, any other error keeps the opaque 500 path"
+    - "Shared filter published as a typed service (app.Publish(*classes.Filter)) that consumers look up; the filter plugin imports none of its consumers"
+
+key-files:
+  created:
+    - ../sm-moderation-plugin/plugin.go
+    - ../sm-moderation-plugin/classes/filter.go
+    - ../sm-moderation-plugin/models/settings.go
+    - ../sm-moderation-plugin/admin.go
+    - ../sm-chat-plugin/contracts/rejection.go
+    - ../sm-forum-plugin/contracts/rejection.go
+  modified:
+    - ../sm-chat-plugin/events/events.go
+    - ../sm-chat-plugin/classes/service.go
+    - ../sm-chat-plugin/api/errors.go
+    - ../sm-forum-plugin/events/events.go
+    - ../sm-forum-plugin/classes/forum_service.go
+    - ../sm-forum-plugin/api/errors.go
+    - ../sm-chatvideo-plugin/go.mod
+    - ../sm-herald-plugin/go.mod
+    - ../sm-userfriends-plugin/go.mod
+
+key-decisions:
+  - "Task 5 checkpoint answered \"release\" by the user (2026-10-30): create sm-moderation-plugin, push and tag"
+  - "Tag numbers moved up one because the marketplace manifest commits had already tagged chat v0.1.4 and the others v0.1.0; chat v0.1.5, forum/chatvideo/herald/userfriends v0.1.1, moderation v0.1.0"
+  - "The family requires summercms v0.6.0, not the planned v0.5.1"
+  - "sm-moderation-plugin is public, like sm-sitemap-plugin, default branch main"
+
+patterns-established:
+  - "Pre-save veto seam: events.<Thing>Saving + contracts.Rejection, additive and parity-safe"
+
+requirements-completed: [SC-1, D-17, D-18, D-19, D-20]
+
+coverage:
+  - id: D1
+    description: "Chat MessageSaving seam: a Rejection from a listener answers 422 on send, reply and edit, with no row written and no event or publish"
+    requirement: "D-18"
+    verification:
+      - kind: integration
+        ref: "../sm-chat-plugin/saving_smoke_test.go#TestMessageSavingTracer"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Forum PostSaving seam: CreateThread, Reply and EditPost fire PostSaving before render; a Rejection maps to 422 under title or body"
+    requirement: "D-18"
+    verification:
+      - kind: integration
+        ref: "../sm-forum-plugin/saving_smoke_test.go"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "golem15.moderation Filter flags banned words and phrases (Unicode boundaries, Polish letters) and banned links (domain, subdomains, URL prefixes), nil for clean text"
+    requirement: "D-17"
+    verification:
+      - kind: unit
+        ref: "../sm-moderation-plugin/classes/filter_smoke_test.go#TestFilterSmoke"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Eight chat-family tags pushed to git.golem15.com on the verified HEADs and resolving together in module mode"
+    requirement: "SC-1"
+    verification:
+      - kind: other
+        ref: "Task 6 verify loop: git describe --tags --exact-match HEAD == ls-remote refs/tags/<tag>^{} for all eight repos (exit 0)"
+        status: pass
+      - kind: other
+        ref: "scratch module, GOWORK=off GOPRIVATE='git.golem15.com/*' GOFLAGS=-mod=mod go build ./... (exit 0)"
+        status: pass
+    human_judgment: false
+
+duration: 3min (Task 6 continuation; Tasks 1-5 ran in earlier sessions)
+completed: 2026-10-30
+status: complete
+---
+
+# Phase 20 Plan 01: Chat Family Release Summary
+
+**Chat and forum gained additive pre-save veto events (MessageSaving, PostSaving with contracts.Rejection → 422). The new shared golem15.moderation plugin publishes a banned word and link filter. All eight chat-family modules are tagged on git.golem15.com and build together with GOWORK=off against summercms v0.6.0.**
+
+## Performance
+
+- **Duration:** about 3 min for the Task 6 continuation (17:22–17:25 UTC); Tasks 1-5 ran in earlier sessions
+- **Started (continuation):** 2026-10-30T17:22:07Z
+- **Completed:** 2026-10-30T17:25Z
+- **Tasks:** 6/6 (Task 5 was the go-ahead decision)
+- **Files modified:** 45 across six sibling repos (chat 7, forum 7, chatvideo 3, herald 3, userfriends 4, moderation 21 new)
+
+## Accomplishments
+
+- `sm-chat-plugin` v0.1.5: `events.MessageSaving` fires in `SendMessageWith` (send, reply, ReplyTo) and `EditMessage` before the transaction. `writeChatError` maps a `contracts.Rejection` to the existing 422 `{"error":"Validation failed","errors":{field:[msg]}}`. With no listener the behaviour is unchanged, and the parity and golden tests pass without edits.
+- `sm-forum-plugin` v0.1.1: `events.PostSaving` fires in `CreateThread`, `Reply` and `EditPost` before `breakwater.Render`. A Rejection lands under `errors.title` or `errors.body`.
+- `sm-moderation-plugin` v0.1.0 (new repo): `golem15.moderation` publishes `*classes.Filter` at boot. The lists come from the `banned_words` and `banned_links` textareas on its settings screen (singleton `golem15_moderation_settings`, permission `golem15.moderation.manage_settings`). It imports neither chat nor forum.
+- chatvideo, herald and userfriends v0.1.1: each go.mod now keeps only the framework replace and requires tagged chat/user/summercms modules.
+- Module-mode proof: a scratch module that requires the eight tags and summercms v0.6.0 and blank-imports all eight plugin packages built with `GOWORK=off`. It resolved sm-user-plugin v0.1.13 transitively.
+
+## Release table (for plan 02)
+
+| Repo | Before HEAD (origin) | After HEAD | Tag | Tag commit | Why |
+|------|----------------------|------------|-----|------------|-----|
+| sm-chat-plugin | db3b518 | 6275ae4 | v0.1.5 | 6275ae4c7cd80fdc5b0c07466ba65ca63b518503 | MessageSaving seam (patch) |
+| sm-chatchannels-plugin | 017843a | 017843a | v0.1.0 (existing) | 017843a | no new commits, not pushed or re-tagged |
+| sm-chatbots-plugin | 24eadf6 | 24eadf6 | v0.1.0 (existing) | 24eadf6 | no new commits, not pushed or re-tagged |
+| sm-chatvideo-plugin | 33ff4f5 | 0f08c35 | v0.1.1 | 0f08c35380d7505d591cef96ac80ef8d7649e70e | go.mod hygiene |
+| sm-forum-plugin | 36bd875 | 4e8a3c3 | v0.1.1 | 4e8a3c35e20698eaf8603ce68410ce7f02bc2674 | PostSaving seam |
+| sm-herald-plugin | db8a1bb | 82f070a | v0.1.1 | 82f070ac89dbd1a081aee282f121f1e186a65465 | go.mod hygiene |
+| sm-userfriends-plugin | 2f29b26 | 1c28db8 | v0.1.1 | 1c28db8a08a819290591a4e0365a751ebf8c913f | go.mod hygiene + plugin.yaml |
+| sm-moderation-plugin | (new) | d9791e2 | v0.1.0 | d9791e2ea53bcb7abbfbca65cfc79d817ad5f33b | first release |
+
+All tags are annotated. Each was pushed separately, and `git ls-remote origin refs/tags/<tag>^{}` equals the local HEAD in every repo. All branch pushes were fast-forwards with no force. All eight working trees are clean.
+
+## Task Commits
+
+1. **Task 1: chat MessageSaving seam**: `42f64eb` (feat), plus `6275ae4` (chore: no host application named in the CanDeleteMessage comment), in sm-chat-plugin
+2. **Task 2: forum PostSaving seam**: `4e8a3c3` (feat), sm-forum-plugin
+3. **Task 3: golem15.moderation plugin**: `d9791e2` (feat), sm-moderation-plugin
+4. **Task 4: go.mod hygiene**: sm-chatvideo-plugin `0f08c35`, sm-herald-plugin `82f070a`, sm-userfriends-plugin `1c28db8` (chore)
+5. **Task 5: go-ahead**: the user answered **"release"**
+6. **Task 6: release**: no code commit; repo created, five branches and moderation main pushed, six tags pushed, module-mode build proven
+
+## go.mod changes (Task 4)
+
+- **sm-chatvideo-plugin:** dropped `replace sm-chat-plugin => ../sm-chat-plugin` and `replace sm-user-plugin => ../fonoteka.go/plugins/golem15/user`; sm-user-plugin v0.1.2 → v0.1.13; keeps sm-chat-plugin v0.1.3 and summercms v0.6.0.
+- **sm-herald-plugin:** dropped `replace sm-user-plugin => ../fonoteka.go/plugins/golem15/user`; sm-user-plugin v0.1.1 → v0.1.13; summercms v0.6.0.
+- **sm-userfriends-plugin:** sm-chat-plugin pseudo-version `v0.0.0-20261017200243-4d0e764ca443` → v0.1.3; sm-user-plugin v0.1.1 → v0.1.13; summercms v0.6.0.
+- **sm-moderation-plugin:** requires summercms v0.6.0.
+- Every one of them keeps only `replace git.golem15.com/golem15/summercms => ../summercms.go`.
+
+## How the moderation repository was created
+
+`tea login list` showed a git.golem15.com login (user jakub). The API reported sm-sitemap-plugin as `"private":false`, default branch `main`. The repo was created with `tea repo create --login git.golem15.com --name sm-moderation-plugin --owner golem15` as a public repo (no `--private`), and the API confirmed `private:false`, `default_branch:main`. Then `git -C ../sm-moderation-plugin remote add origin git@git.golem15.com:golem15/sm-moderation-plugin.git` and `git push -u origin main`. `git ls-remote git@git.golem15.com:golem15/sm-moderation-plugin.git` exits 0 and shows d9791e2 on `refs/heads/main`. The local repo had been created in Task 3 with `git init -b main`.
+
+## Decisions Made
+
+- Checkpoint answer: **"release"** (user, 2026-10-30).
+- The family requires summercms v0.6.0, the current framework tag, instead of the v0.5.1 the plan named.
+- chatchannels and chatbots keep their existing v0.1.0 tags on HEAD. They had no new commits, so they were neither pushed nor re-tagged.
+
+## Deviations from Plan
+
+1. **Tag numbers moved up one.** Another session's marketplace manifest commits had already tagged sm-chat-plugin v0.1.4 and the other repos v0.1.0. The new tags are therefore chat v0.1.5 and forum/chatvideo/herald/userfriends v0.1.1. Moderation is v0.1.0 as planned, and chatchannels and chatbots stay on their existing v0.1.0. The tags were read from `git ls-remote --tags origin` immediately before tagging.
+2. **summercms stays v0.6.0** in every go.mod and in the scratch proof, not v0.5.1.
+3. **[Rule 2] Moderation got `plugin.yaml` and `manifest_test.go`** (`TestPluginManifest`), so the plugin matches the marketplace manifest convention that landed during the plan.
+4. **[Rule 3] userfriends `plugin.yaml` regenerated** because the go.mod change made the manifest check fail (commit 1c28db8).
+5. **No changelog lines for chatvideo, herald and userfriends.** Their READMEs have no changelog section.
+6. **App names removed** from a chat comment (`6275ae4`) and from the chat README, per the "framework code never names a consuming application" rule.
+7. **Added `(*Filter).SetTranslator`** to the moderation filter, so violation messages are localised through the host's translator.
+8. **Extra moderation exports** beyond the plan's list: `models.SetLimits`, `models.Limits`, `models.Lines`, `models.LinkEntry`, `models.ValidHost`, `models.DefaultSettings`, `models.Text`; root `PluginID`, `ConfigMaxEntries`, `ConfigMaxEntryLength`, `PermissionManageSettings`.
+9. **Task 4 acceptance check `grep -c v0.0.0` fails as written.** It matches only third-party `// indirect` pseudo-versions. No golem15 module is on a pseudo-version any more.
+
+**Total deviations:** 9 (2 auto-fixed under Rules 2/3, the rest are renumbering, scope notes and documentation)
+**Impact on plan:** None on the goal. The seams stay additive, and plan 02 can mount all eight by tag.
+
+## Follow-ups left alone (out of scope)
+
+- The tracked `go.work` files in the sibling repos still point at `../fonoteka.go/plugins/golem15/user`. They only affect workspace builds, not module mode.
+- The forum and herald READMEs still say "v0.4.0 modules" in their Dependencies section.
+- `../sm-chat-plugin/classes/kind_test.go` is not gofmt'd. This predates the plan.
+
+## Issues Encountered
+
+None in Task 6. Every push, tag push and ls-remote check succeeded on the first attempt. The proxy had not yet seen the new tags, and `GOPRIVATE='git.golem15.com/*'` made go fetch them directly.
+
+## Threat notes
+
+- T-20-03 (filter cost): one uncached `Match` at 2 lists × 500 entries × 200 characters takes about 36 ms, and the compiled matchers take about 8.8 KB. Matchers are compiled once per list version, so this cost is paid once per settings change, not per message.
+- T-20-05 (one-way tags): the tags sit on the HEADs that passed vet and tests in Tasks 1-4. They were confirmed free immediately before creation and verified on the remote afterwards.
+
+## User Setup Required
+
+None.
+
+## Next Phase Readiness
+
+- Plan 02 can require the chat family by tag: chat v0.1.5, chatchannels v0.1.0, chatbots v0.1.0, chatvideo v0.1.1, forum v0.1.1, herald v0.1.1, userfriends v0.1.1, moderation v0.1.0, with summercms v0.6.0 and sm-user-plugin v0.1.13.
+- Plugin release posts on summercms.io/changelog/plugins for the six new tags are not written yet. Per CLAUDE.md, plugin tags get a post.
+
+---
+*Phase: 20-demo-instance-with-every-shared-plugin*
+*Completed: 2026-10-30*
+
+## Self-Check: PASSED
+
+- All eight repos: `git describe --tags --exact-match HEAD` matches `ls-remote refs/tags/<tag>^{}` (verify loop exit 0).
+- Commits 42f64eb, 6275ae4, 4e8a3c3, d9791e2, 0f08c35, 82f070a, 1c28db8 exist on origin/main of their repos.
+- `../sm-moderation-plugin/classes/filter.go`, `../sm-chat-plugin/contracts/rejection.go` and `../sm-forum-plugin/contracts/rejection.go` exist.

.planning/phases/20-demo-instance-with-every-shared-plugin/20-02-SUMMARY.md

@@ -0,0 +1,311 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 02
+subsystem: sm-demo-app
+tags: [chat, chatchannels, chatbots, chatvideo, forum, herald, userfriends, moderation, livekit, centrifugo, seed]
+
+requires:
+  - phase: 20-01
+    provides: the eight chat-family tags (chat v0.1.5 with MessageSaving, forum v0.1.1 with PostSaving, moderation v0.1.0 Filter)
+provides:
+  - "sm-demo-app mounts chat, chatchannels, chatbots, chatvideo, forum, herald, userfriends and moderation at their tags"
+  - "golem15.demo hosts the chat family: contexts demo/1 and channel/{id}, channel and forum access policies, moderation seams, slash commands /demo and /tour"
+  - "Host bootstrap contract GET /_demo/api/v1/chat and GET /_demo/api/v1/chat/members (for vue-chat-layer, plan 03)"
+  - "demo.realtime-access: every community member gets a realtime token"
+  - "demo:seed EN/PL showcase data for chat, forum and friends; demo:reset covers every chat-family table"
+  - "Local LiveKit in scripts/dev.sh; deploy/livekit.yaml.example and Centrifugo namespaces chat, user, video (for plan 05)"
+affects: [20-03, 20-04, 20-05, 20-06]
+
+actuals:
+  tokens: 36500    # chars/4 over the realized sm-demo-app diff 56c1141..f4ed2c2 without go.sum (146079 chars)
+  tasks: 4
+  commits: 1       # MEASURED in summercms.go: git rev-list --count plan_head_before..HEAD (the todo move); sm-demo-app: 12 (git rev-list --count 56c1141..f4ed2c2)
+plan_head_before: 159cd5ecf4aac6e48c2579c68c19addb7633cfce   # summercms.go
+plan_head_after: d6f490a9abcaf4322aec5a072f7842b8f0d3d2c3    # summercms.go before this SUMMARY commit; sm-demo-app 56c1141 -> f4ed2c2
+
+tech-stack:
+  added:
+    - "github.com/livekit/server-sdk-go/v2 v2.19.0 and github.com/SherClockHolmes/webpush-go v1.4.0 (transitive, through chatvideo and herald)"
+  patterns:
+    - "Channel-as-context adapter: the host registers chatchannels' `channel` alias on chat's registry so a channel's backing conversation resolves"
+    - "Host wiring in lagoon.OnDatabase after each plugin published its service (ChannelService, ForumService, chatbots Registry, moderation Filter); a missing service is a boot error naming the summer.yaml order"
+    - "Pre-save veto listeners (MessageSaving, PostSaving) look up the moderation Filter per event"
+
+key-files:
+  created:
+    - ../sm-demo-app/plugins/demo/classes/chat_context.go
+    - ../sm-demo-app/plugins/demo/classes/forum_access.go
+    - ../sm-demo-app/plugins/demo/chat.go
+    - ../sm-demo-app/plugins/demo/chat_api.go
+    - ../sm-demo-app/plugins/demo/chatbots.go
+    - ../sm-demo-app/plugins/demo/moderation.go
+    - ../sm-demo-app/plugins/demo/realtime_access.go
+    - ../sm-demo-app/plugins/demo/console/seed_chat.go
+    - ../sm-demo-app/plugins/demo/console/seed_forum.go
+    - ../sm-demo-app/plugins/demo/console/seed_friends.go
+    - ../sm-demo-app/chat_smoke_test.go
+    - ../sm-demo-app/config/golem15.chatvideo.yaml
+    - ../sm-demo-app/config/golem15.chat.yaml
+    - ../sm-demo-app/config/env/production/golem15.chatvideo.yaml
+    - ../sm-demo-app/deploy/livekit.yaml.example
+  modified:
+    - ../sm-demo-app/summer.yaml
+    - ../sm-demo-app/go.mod
+    - ../sm-demo-app/go.work
+    - ../sm-demo-app/.gitmodules
+    - ../sm-demo-app/plugins.gen.go
+    - ../sm-demo-app/plugins/demo/plugin.go
+    - ../sm-demo-app/plugins/demo/routes.go
+    - ../sm-demo-app/plugins/demo/config/config.yaml
+    - ../sm-demo-app/plugins/demo/console/seed.go
+    - ../sm-demo-app/plugins/demo/console/reset.go
+    - ../sm-demo-app/boot_test.go
+    - ../sm-demo-app/realtime_test.go
+    - ../sm-demo-app/deploy/centrifugo.json.example
+    - ../sm-demo-app/deploy/env.example
+    - ../sm-demo-app/scripts/dev.sh
+    - ../sm-demo-app/README.md
+    - .planning/todos/done/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md
+
+key-decisions:
+  - "Folded oauthserver/journal todo closed without a commit in sm-demo-app: 2133309 and 5ec5941 had already moved oauthserver to v0.1.6 (contains b6a9586) and journal to v0.2.6; not moved back to v0.1.3"
+  - "Channel join path: GetGroupChat's lazy join holds (opening GET /_chat/api/v1/contexts/channel/{id}/conversation adds the participant row); the bootstrap joins nobody"
+  - "Bootstrap channels[].joined is 'has not left' (chatchannels prefs.has_left); left channels stay listed with joined false"
+  - "Chat attachments capped at 5 MiB per message (config/golem15.chat.yaml max_message_bytes 5242880), reported as limits.max_bytes"
+  - "Forum CanManage and CanManageContext both go to the moderator group, as the plan says; forum needs no RegisterContext for listing or posting"
+  - "Production livekit_url wss://demo.summercms.io/livekit lives in config/env/production/golem15.chatvideo.yaml"
+
+patterns-established:
+  - "Seed steps write chat rows by raw SQL in created order and call chat's own jobs.Work to keep thread summaries consistent"
+
+requirements-completed: [SC-1, D-05, D-06, D-07, D-08, D-09, D-10, D-12, D-14, D-17, D-20, D-22, D-23]
+
+coverage:
+  - id: D1
+    description: "A registered member reads the bootstrap, opens seeded #general (lazy join), posts and reads back through the chat API; channel creation refused; members endpoint excludes the caller"
+    requirement: "D-06, D-07"
+    verification:
+      - kind: integration
+        ref: "../sm-demo-app/chat_smoke_test.go#TestDemoChatTracer"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Banned word in a chat message -> 422 errors.content, banned link in a forum title -> 422 errors.title, clean content stored; DM between two members; /demo and /tour listed and ephemeral"
+    requirement: "D-17, D-08, D-05"
+    verification:
+      - kind: integration
+        ref: "../sm-demo-app/chat_smoke_test.go#TestDemoModerationSmoke"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "demo:seed EN/PL chat, forum, friends, moderator group, moderation lists; second run all exists; demo:reset --force wipes and reseeds, keeps moderation settings and the userfriends context"
+    requirement: "D-09, D-22"
+    verification:
+      - kind: integration
+        ref: "../sm-demo-app/chat_smoke_test.go#TestSeedChatSmoke"
+        status: pass
+      - kind: other
+        ref: "scripts/dev.sh seed twice against the local Postgres: every new step 'created', then 'exists'"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Every plugin activates, prefixes routed, go.mod tags only, pins match"
+    requirement: "SC-1"
+    verification:
+      - kind: integration
+        ref: "../sm-demo-app/boot_test.go#TestBootAllPlugins, go_mod_test.go#TestGoModRequiresTags, scripts/check-pins.sh (25 modules), scripts/build.sh dev"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Realtime token for any member (401 without JWT), Centrifugo namespaces, local LiveKit on 7890/7891/7892"
+    requirement: "D-10, D-06"
+    verification:
+      - kind: integration
+        ref: "../sm-demo-app/realtime_test.go#TestRealtimeRoutes"
+        status: pass
+      - kind: other
+        ref: "dev.sh start_livekit (curl 127.0.0.1:7890 200); new binary on 127.0.0.1:8197: GO_ADDR=127.0.0.1:8197 scripts/check-local.sh realtime ok; fresh registered member: token, /chat, /chat/members 200"
+        status: pass
+    human_judgment: false
+
+duration: 33min
+completed: 2026-10-30
+status: complete
+---
+
+# Phase 20 Plan 02: Demo backend for the chat family Summary
+
+**sm-demo-app mounts all eight chat-family plugins at their tags and golem15.demo hosts them as one community. Every registered member can post in the seeded EN/PL channels, DM anyone, use /demo and /tour, post in the forum and get a realtime token. Moderation refuses banned words and links with 422, and a local LiveKit runs from scripts/dev.sh.**
+
+## Performance
+
+- **Duration:** about 33 min
+- **Started:** 2026-10-30T17:37:25Z
+- **Completed:** 2026-10-30T18:10:23Z
+- **Tasks:** 4/4
+- **Files modified:** 40 in sm-demo-app (2902 insertions, 111 deletions), 1 in summercms.go
+
+## Accomplishments
+
+- Eight `feat: mount golem15.<id> <tag>` commits. `summer.yaml` lists chat, chatchannels, chatbots, chatvideo, forum, herald, userfriends and moderation after golem15.user and before golem15.demo. Every submodule describes as its tag, and `check-pins` reports ok for 25 modules.
+- Host types in `plugins/demo/classes`:
+  - `DemoContext` (demo/1, `chat:context:1`).
+  - `ChannelContext` (alias `channel`, `chat:channel:{id}`).
+  - `ChatAccess`: members may access demo/1 and `CanManageContext` is always false.
+  - `ForumAccess`.
+  - `MemberIDs`, `IsMember` and `IsModerator`.
+  - Membership means activated, not deleted and not banned (`user_throttle.is_banned`).
+- The bootstrap `GET /_demo/api/v1/chat` returns `{member, moderator, context, channels[], conversations[], limits}` and `/chat/members` returns `{members[]}`. Both need a JWT and are throttled at 120 a minute.
+- Listeners on MessageSaving and PostSaving call the moderation Filter. `/demo` and `/tour` answer ephemerally, in EN or PL from `preferred_locale`.
+- demo:seed adds eight steps. demo:reset clears 27 more tables in foreign-key order.
+- `demo.realtime-access` guards the token route. Centrifugo gets the namespaces chat, user and video. `deploy/livekit.yaml.example` is added, dev.sh starts and stops a local LiveKit, and the README has a chat family section.
+
+## Task Commits
+
+| # | Task | Repo | Commit | Message |
+|---|------|------|--------|---------|
+| 1 | Folded todo | summercms.go | d6f490a | docs(20-02): close the sm-demo-app journal/oauthserver pointer todo |
+| 1 | Mount chat | sm-demo-app | 7815001 | feat: mount golem15.chat v0.1.5 |
+| 1 | Mount chatchannels | sm-demo-app | 6edfae5 | feat: mount golem15.chatchannels v0.1.0 |
+| 1 | Tracer host wiring | sm-demo-app | 58ba678 | feat: demo chat context, channel adapter and bootstrap |
+| 2 | Mount chatbots | sm-demo-app | 47c7833 | feat: mount golem15.chatbots v0.1.0 |
+| 2 | Mount chatvideo | sm-demo-app | 5076d8c | feat: mount golem15.chatvideo v0.1.1 |
+| 2 | Mount forum | sm-demo-app | 2dea441 | feat: mount golem15.forum v0.1.1 |
+| 2 | Mount herald | sm-demo-app | 64d37a2 | feat: mount golem15.herald v0.1.1 |
+| 2 | Mount userfriends | sm-demo-app | a78c543 | feat: mount golem15.userfriends v0.1.1 |
+| 2 | Mount moderation | sm-demo-app | 864a14b | feat: mount golem15.moderation v0.1.0 |
+| 2 | Wiring | sm-demo-app | b03fe83 | feat: demo hosts forum, friends, slash commands and moderation |
+| 3 | Seed and reset | sm-demo-app | 4a94565 | feat: seed and reset the chat family (EN/PL) |
+| 4 | Realtime, members, deploy, dev | sm-demo-app | f4ed2c2 | feat: realtime for every demo member, members endpoint, Centrifugo namespaces and local LiveKit |
+
+Nothing was pushed, tagged or deployed. No file inside a plugin submodule was edited.
+
+## Details for later plans
+
+**Channel join path:** the lazy join holds. `GET /_chat/api/v1/contexts/channel/{channelId}/conversation` reaches chat's `GetGroupChat`, which adds the caller as a participant of the existing backing conversation. TestDemoChatTracer asserts the participant row. The bootstrap fallback (`AddUserToGroupChat`) was not needed.
+
+**Personas:** Ada Hart and Ben Carter (en), Ola Nowak and Tomek Wiśniewski (pl). Emails are `<key>@personas.demo.invalid`. Each gets a random bcrypt hash of 32 random bytes, never printed, and a handle from the user plugin's `AssignHandle`.
+
+**Channels:**
+
+| Channel | Slug | Language | Messages | Thread roots | Pins |
+|---------|------|----------|----------|--------------|------|
+| #general (default) | `general` | en | 13 | 2 | 1 |
+| #announcements | `announcements` | en | 5 | 1 | 1 |
+| #ogólny | `ogolny` | pl | 15 | 1 | 1 |
+
+All three channels have reactions. Ada sends the visitor a welcome DM.
+
+**Forum:** "General discussion" (`general-discussion`) and "Show and tell" (`show-and-tell`) in English and "Rozmowy" (`rozmowy`) in Polish, with 2, 2 and 3 threads and `content_html` from `breakwater.Render`.
+
+**Friends:** accepted friendships ada-ben, ada-ola, ben-tomek and ola-tomek. Ola has a pending request to the visitor. The group "Demo crew" has Ada as owner and Ben and Tomek as members.
+
+**Moderation defaults** (only while both lists are empty): words `buy followers`, `casino bonus`, `free crypto` and `viagra`; link `bit.ly`.
+
+**Reset table order** (inserted before `users`, children first):
+1. chatvideo participants, sessions
+2. chatchannels channel_mentions, channel_pins, channel_members, channel_user_prefs, user_context_prefs, personal_categories, channels, channel_categories
+3. chat reactions, thread_mutes, thread_summaries, messages, participants, conversations
+4. forum thread_reads, posts, threads, categories
+5. userfriends group_bans, group_invites, group_members, groups, friendships
+6. herald push_subscriptions
+7. chatbots bot_flags
+
+Chatchannels comes before chat because channels hang off their backing conversations. The reset keeps `golem15_moderation_settings`, `user_groups` (the moderator group) and `golem15_userfriends_contexts`. Chat attachments were already covered: the reset removes every `system_files` owner except the kept ones.
+
+**Centrifugo option names** (v6.5.1, checked against `centrifugo defaultconfig`):
+- `chat`: `presence`, `join_leave`, `force_push_join_leave`, `allow_presence_for_subscriber` and `subscribe_proxy_enabled`.
+- `user` and `video`: `subscribe_proxy_enabled` only.
+
+**Boot warnings left by plugins** (`dev.sh seed`):
+- The chatchannels and forum deny-all warnings fire from the plugins' own database hooks before golem15.demo's hook installs the resolvers, so they are expected.
+- `golem15.chatbots: BotAuthResolver is deny-all`. The demo has no bot persona.
+- `golem15.herald: PresenceGate is deny-all` and `golem15.herald: VAPID keys are missing`. Plan 04 handles these.
+
+## Decisions Made
+
+See the key-decisions list in the frontmatter. The plan's own discretion items (aliases, personas, slugs, commands, ports) were applied as written.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Folded todo needed no sm-demo-app commit**
+- **Found during:** Task 1 step 1
+- **Issue:** go.mod already required sm-oauthserver-plugin v0.1.6 and sm-journal-plugin v0.2.6 (2133309, 5ec5941), and the oauthserver checkout contains b6a9586. Bumping to v0.1.3 would have been a downgrade.
+- **Fix:** No `chore: bump sm-oauthserver-plugin to v0.1.3` commit. The todo moved to done with a note (d6f490a).
+
+**2. [Rule 3 - Blocking] realtime_test.go namespaces updated in the mount commits**
+- **Found during:** Task 1 and Task 2 (mount chatvideo)
+- **Issue:** chat registers the `chat` namespace and chatvideo registers `video`, so the short suite failed.
+- **Fix:** `wantNamespaces` was extended in 58ba678 and 5076d8c, so `go test -short` stays green at every commit.
+
+**3. [Rule 3 - Blocking] boot_test.go realtime subtest expected the old guard**
+- **Found during:** Task 4
+- **Fix:** It now expects `demo.realtime-access`, in f4ed2c2.
+
+**4. [Rule 2 - Missing critical] Chat attachment cap**
+- **Issue:** chat's `max_message_bytes` defaults to 0 (no total limit) on a public demo, and the bootstrap reported 0.
+- **Fix:** `config/golem15.chat.yaml` sets 5 MiB per message (5 × the 1 MiB upload body limit), in b03fe83.
+
+**5. [Rule 2] Production LiveKit URL**
+- **Fix:** Added `config/env/production/golem15.chatvideo.yaml` with `livekit_url: wss://demo.summercms.io/livekit`, so the committed `ws://127.0.0.1:7890` applies locally only (f4ed2c2).
+
+**6. Scope order changes**
+- The `chat personas` step landed in Task 1, because #general's welcome message needs a sender. `users` can't send as a backend admin.
+- `/chat/members` assertions were added to TestDemoChatTracer in Task 4.
+
+**7. The `pact.HasMiddleware` assertion sits in plugin.go**, as the plan asks. The middleware itself is in realtime_access.go.
+
+**8. Forum RegisterContext not called.** Its only consumer is `forum:rewrite-context-types`. Listing and posting work without it.
+
+### Verification adjustments
+
+- **The Task 4 verify command `centrifugo checkconfig -c deploy/centrifugo.json.example` cannot pass as written.** Centrifugo picks the config type from the file extension ("Unsupported Config Type example"). I ran it on a `.json` copy instead, the way `scripts/check-deploy.sh` does. checkconfig passed, check-deploy passed, and every option name is in `centrifugo defaultconfig`.
+- **`scripts/dev.sh up` was not run as a whole.** The dev ports are held by stale processes that dev.sh did not start in this session and cannot stop:
+  - Centrifugo on 8011 (pid 212066, Oct 22)
+  - Go on 8097, run as user golem (pid 3405714, Oct 24)
+  - Nuxt on 3020 from a cursor-agent session (pid 3776486, Oct 27)
+
+  Their pid files are stale, so `claim_port` would refuse, and killing other sessions' processes was out of bounds. What I verified instead:
+  - **LiveKit:** started with dev.sh's own `ensure_env` and `start_livekit` functions. `curl 127.0.0.1:7890/` answered 200, TCP 7890/7891 and UDP 7892 were listening, `logs/livekit.yaml` is mode 600 with no CHANGE_ME left and `use_external_ip: false`.
+  - **Realtime:** the new binary ran on 127.0.0.1:8197 against the local Postgres, and `GO_ADDR=127.0.0.1:8197 scripts/check-local.sh realtime` printed ok. A freshly registered member got 200 from the token route, `/_demo/api/v1/chat` and `/chat/members`.
+  - **Seed:** `scripts/dev.sh seed` ran twice. The new steps were `created`, then `exists`.
+  - Both of my processes were stopped afterwards.
+- **Mistake made and fixed:** my first attempt sourced dev.sh's functions from the scratchpad. Its `cd "$(dirname "$0")/.."` then landed in the meta repo `..`, where it wrote `.env`, `logs/` and `storage/app/uploads/public`. All three had been created seconds earlier by that run, and I removed them. Nothing else in the meta repo was touched.
+
+**Total deviations:** 8 plus 2 verification adjustments. **Impact:** none on the plan goal.
+
+## Issues Encountered
+
+- **g15office MCP unavailable** (connection timed out in this session). Task ssuyq2os (the folded todo) was **not** moved to Live and got no comment, and the Phase 20 task xo463rwk got no comment either. The orchestrator or the user needs to do both.
+
+## Known Stubs
+
+None. Every endpoint reads live data. The bootstrap reports `is_bot: false` for everyone on purpose, because the demo has no bot persona (D-05).
+
+## Threat Flags
+
+| Flag | File | Description |
+|------|------|-------------|
+| threat_flag: endpoint | ../sm-demo-app/plugins/demo/chat_api.go | `/chat/members` lists every member's name, surname and handle to any member (planned in T-20 scope; no email or id beyond the user id) |
+| threat_flag: config | ../sm-demo-app/config/golem15.chat.yaml | Upload cap 5 MiB per message on the public demo (mitigation, not new surface) |
+
+## User Setup Required
+
+None for this plan. Plan 05 needs the LiveKit key pair on rome (`deploy/env.example`).
+
+## Next Phase Readiness
+
+- Plan 03 (vue-chat-layer) can build on `GET /_demo/api/v1/chat` and `/chat/members` as documented in sm-demo-app README "Chat family". Channels are opened with `GET /_chat/api/v1/contexts/channel/{id}/conversation`.
+- Plan 05 deploys `deploy/livekit.yaml.example`, the Centrifugo namespaces (restart summercms-demo-centrifugo), nginx `/livekit/` and the Go allow-list, and the herald VAPID keys.
+
+---
+*Phase: 20-demo-instance-with-every-shared-plugin*
+*Completed: 2026-10-30*
+
+## Self-Check: PASSED
+
+- All 15 created files listed under key-files exist, and the todo is under `.planning/todos/done/`.
+- sm-demo-app commits 7815001, 6edfae5, 58ba678, 47c7833, 5076d8c, 2dea441, 64d37a2, a78c543, 864a14b, b03fe83, 4a94565, f4ed2c2 and summercms.go d6f490a exist.
+- `git -C ../sm-demo-app submodule status` shows no `+` or `-`, and the sm-demo-app working tree is clean (`--ignore-submodules=none`).

.planning/phases/20-demo-instance-with-every-shared-plugin/20-03-SUMMARY.md

@@ -0,0 +1,298 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 03
+subsystem: vue-chat-layer, vue-demo-app
+tags: [chat, nuxt-layer, realtime, centrifuge, i18n, slash-commands, threads, pins]
+
+requires:
+  - phase: 20-02
+    provides: "Host bootstrap GET /_demo/api/v1/chat and /chat/members, the chat family mounted, realtime for every member"
+provides:
+  - "vue-chat-layer v0.1.0 on git.golem15.com (public), tag v0.1.0 = c465414"
+  - "The page's one Centrifuge client with onUserEvent, shared by the chat and the presentations remote"
+  - "vue-demo-app /chat, the floating chat panel, the Chat tour card, EN/PL"
+  - "check-local chat (check-chat.cjs), tour with seven cards, smoke.sh /chat"
+affects: [20-04, 20-05, 20-06]
+
+actuals:
+  tokens: 80100    # chars/4: layer tracked files without the lockfile (279087) + vue-demo-app diff 44a5229..3fe8018 without the lockfile (30546) + sm-demo-app scripts diff f4ed2c2..b4fc7dc (10832)
+  tasks: 6
+  commits: 0       # MEASURED in summercms.go before this SUMMARY commit (docs only here); code commits: vue-chat-layer 4, vue-demo-app 4, sm-demo-app 2
+plan_head_before: baa0f20eb2cd316cb3424fe6b4fd957d079713c0   # summercms.go
+plan_head_after: baa0f20eb2cd316cb3424fe6b4fd957d079713c0    # summercms.go before this SUMMARY commit
+
+tech-stack:
+  added:
+    - "vue-chat-layer (new shared Nuxt layer) with centrifuge 5.7.3 and @nuxtjs/i18n 10.4.0; vitest 3.2.7, nuxt 4.4.8, vue 3.5.35, typescript 5.9.3 as dev deps (all versions already pinned in the workspace)"
+  patterns:
+    - "Store as a composable over useState keys prefixed chat:, one reactive store per Nuxt app (no Pinia)"
+    - "Auth hook $chatAuth {token, refresh, unauthorized, userId?}; pure Nuxt-free client in app/lib, imported explicitly"
+    - "One realtime client per page; other layers get user:{me} events through onUserEvent"
+
+key-files:
+  created:
+    - ../vue-chat-layer/nuxt.config.ts
+    - ../vue-chat-layer/README.md
+    - ../vue-chat-layer/app/lib/client.ts
+    - ../vue-chat-layer/app/lib/realtime.ts
+    - ../vue-chat-layer/app/lib/linkEmbeds.ts
+    - ../vue-chat-layer/app/composables/useChat.ts
+    - ../vue-chat-layer/app/components/Chat/FloatingPanel.vue
+    - ../vue-chat-layer/app/components/Chat/CommandPicker.vue
+    - ../vue-chat-layer/app/components/Chat/ThreadPane.vue
+    - ../vue-chat-layer/app/assets/css/chat-tokens.css
+    - ../vue-chat-layer/tests/smoke.test.ts
+    - ../sm-demo-app/vue-demo-app/app/pages/chat.vue
+    - ../sm-demo-app/scripts/check-chat.cjs
+  modified:
+    - ../sm-demo-app/vue-demo-app/package.json
+    - ../sm-demo-app/vue-demo-app/pnpm-lock.yaml
+    - ../sm-demo-app/vue-demo-app/nuxt.config.ts
+    - ../sm-demo-app/vue-demo-app/app/plugins/auth.ts
+    - ../sm-demo-app/vue-demo-app/app/lib/realtime.ts
+    - ../sm-demo-app/vue-demo-app/app/lib/realtime.test.ts
+    - ../sm-demo-app/vue-demo-app/vitest.config.ts
+    - ../sm-demo-app/vue-demo-app/app/layouts/default.vue
+    - ../sm-demo-app/vue-demo-app/app/pages/index.vue
+    - ../sm-demo-app/vue-demo-app/app/components/TourCard.vue
+    - ../sm-demo-app/vue-demo-app/i18n/locales/en.json
+    - ../sm-demo-app/vue-demo-app/i18n/locales/pl.json
+    - ../sm-demo-app/scripts/check-local.sh
+    - ../sm-demo-app/scripts/smoke.sh
+
+key-decisions:
+  - "Task 5 checkpoint answer: release. golem15/vue-chat-layer created public with tea (same visibility as vue-faq-layer), main pushed, annotated tag v0.1.0 on c465414"
+  - "The layer reads the caller's user id from the JWT's numeric sub claim; an optional $chatAuth.userId() overrides it"
+  - "vue-demo-app chatAuth.refresh posts to POST /_user/api/v1/refresh and stores the rotated token through lib/api/client.ts tokens (document.cookie)"
+  - "Ported libs keep bm's signatures with optional localized copy and setFormatLocale (defaults pl-PL / Europe/Warsaw), so bm's tests port unchanged in plan 06"
+  - "Slash command answers render through renderChatText, the only v-html besides message bodies"
+
+patterns-established:
+  - "A layer's realtime client is re-exported by the app (export * from 'vue-chat-layer/app/lib/realtime'); vitest inlines the layer and dedupes centrifuge"
+
+requirements-completed: [SC-2, D-01, D-02, D-03, D-04, D-05, D-07, D-20, D-22, D-23]
+
+coverage:
+  - id: D1
+    description: "A logged-in visitor opens #general on /chat and a message sent from the composer appears; anonymous /chat has the register link to /register?next=/chat and no chat"
+    requirement: "D-02, D-04"
+    verification:
+      - kind: e2e
+        ref: "../sm-demo-app/scripts/check-chat.cjs (check-local.sh chat)"
+        status: pass
+      - kind: smoke
+        ref: "../sm-demo-app/scripts/smoke.sh (/chat in the page loop, register prompt, no chat in the HTML)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "The chat client sends the bearer, refreshes once on 401, calls unauthorized after a failed refresh, maps 422 to field errors"
+    requirement: "D-01"
+    verification:
+      - kind: unit
+        ref: "../vue-chat-layer/tests/smoke.test.ts"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "One shared Centrifuge client: the presentations remote and the chat ride one socket; bm's realtime test passes against it"
+    requirement: "SC-2"
+    verification:
+      - kind: unit
+        ref: "../sm-demo-app/vue-demo-app/app/lib/realtime.test.ts"
+        status: pass
+      - kind: e2e
+        ref: "check-local.sh realtime remote"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Live delivery, /demo command (ephemeral, nothing posted), unknown command row, link card, reaction, thread reply and live thread reply, pins, attachment upload and send, DM from the picker, edit, delete, PL UI, floating panel badge and DM reply, panel hidden on /chat and decks"
+    requirement: "SC-2, D-02, D-03, D-05"
+    verification:
+      - kind: manual
+        ref: "Playwright probes against the local stack with two members (scratchpad live.cjs, features.cjs, floating.cjs)"
+        status: pass
+    human_judgment: true
+  - id: D5
+    description: "Tour has seven cards with Chat (EN) and Czat (PL); vue-demo-app builds and tests against the tag"
+    requirement: "D-03, D-01"
+    verification:
+      - kind: e2e
+        ref: "check-local.sh chat tour after the tag pin"
+        status: pass
+      - kind: build
+        ref: "pnpm --dir ../sm-demo-app/vue-demo-app test (209) && run build"
+        status: pass
+    human_judgment: false
+
+duration: 52min
+completed: 2026-10-31
+status: complete
+---
+
+# Phase 20 Plan 03: vue-chat-layer v0.1.0 and chat on the demo site Summary
+
+**vue-chat-layer v0.1.0 is released on git.golem15.com. It carries bm's chat ported to a Pinia-free Nuxt layer and widened to several channels, threads, pins, link cards and a slash command picker. The demo site now has /chat for members, a register prompt for visitors, a floating DM panel on every page and a Chat tour card, in EN and PL.**
+
+## Performance
+
+- **Duration:** about 52 min
+- **Started:** 2026-10-31T12:27Z
+- **Completed:** 2026-10-31T13:19Z
+- **Tasks:** 6/6. Task 5 was the checkpoint, answered "release".
+- **Files:** vue-chat-layer has 52 tracked files without the lockfile. vue-demo-app has 13 files changed (436 insertions, 147 deletions). sm-demo-app scripts have 3 files changed.
+
+## The layer's public API (v0.1.0)
+
+**Runtime config:**
+
+| Key | Env | Purpose |
+|-----|-----|---------|
+| `chat.apiBase` | `NUXT_CHAT_API_BASE` | Server-side base of the chat API |
+| `public.chat.apiBase` | | `/_chat/api/v1` |
+| `public.chat.channelsApiBase` | | `/_chatchannels/api/v1` |
+| `public.chat.botsApiBase` | | `/_chatbots/api/v1` |
+| `public.chat.hostApiBase` | | `''`. With an empty value the chat does not start, and a console error names the key |
+
+**Hook:** `$chatAuth` with `token()`, `refresh()`, `unauthorized()` and an optional `userId()`.
+
+**Host contract:** `GET {hostApiBase}/chat` and `GET {hostApiBase}/chat/members`. The README documents both with a neutral `acme` host.
+
+**Slots:**
+- `conversation-actions`, with `{ conversation }`. It renders only for a DM, in `ChatHeader`, `ChatPanel`, `ChatPage` and `ChatFloatingPanel`.
+- `sidebar-footer`, in `ChatChannelList` and `ChatPage`.
+
+**Components:** `ChatPage`, `ChatFloatingPanel` (prop `chatPath`), `ChatChannelList`, `ChatDmList`, `ChatPanel`, `ChatHeader`, `ChatMessageList`, `ChatMessage`, `ChatComposer`, `ChatThreadPane`, `ChatPinsPanel`, `ChatReactionBar`, `ChatStagingChips`, `ChatDeleteDialog`, `ChatMemberPicker`, `ChatMentionPopup`, `ChatCommandPicker`, `ChatLinkEmbed`, `ChatAvatar`, `ChatIcon` and `ChatNotices`.
+
+**Composables:** `useChat`, `useChatApi` (with `useChatAuth` and `useChatConfig`) and `useChatNotice`.
+
+**Library exports:**
+- `client.ts`: `createChatClient`, `ChatApiError`, `userIdFromToken`.
+- `realtime.ts`: `REALTIME_WS_PATH`, `connect`, `subscribe`, `presence`, `openChannel`, `onUserEvent`, `dispatchUserEvent`, `setRealtimeAuth`, `disconnect`, `onConnection`, `onUnavailable`.
+- `linkEmbeds.ts`: `linkify`, `messageUrls`, `registerEmbedRenderer`, `embedRendererFor`.
+- The ported `chatEvents`, `chatFormat`, `chatText` and `chatUnread`, plus `format` (`setFormatLocale`), `attachments`, `markdown`, `media` and `tabs`.
+
+**Copy:** EN and PL under `chat.*`, 131 keys. PL covers every EN key.
+
+## What was stripped from bm and why
+
+- **bm's embeds and the embed picker were dropped** (`deadline`, `class` and `reading`, plus `EmbedPicker`, `EmbedCard`, `lib/embeds.ts` and the paste-to-embed logic). They are bm entities. In their place:
+  - A generic link card shows the host and path, with no fetch.
+  - `registerEmbedRenderer` lets a host render its own entity links (the D-01 extension point).
+- **The single `# ogólny` model became `channels[]`, `activeId` and `kind`.** bm's "Czat roku" tab layout became a sidebar plus pane. Threads, pins and the command picker are new.
+- **The Pinia stores went away.** `useChat` became `useState` and `useToast` became `useChatNotice`.
+- **The bm cached membership flag in localStorage and its BM bootstrap paths were removed.** Every string went to i18n.
+
+## Task Commits
+
+| # | Repo | Commit | Message |
+|---|------|--------|---------|
+| 1 | vue-chat-layer | fa6f995 | feat: chat layer tracer: bootstrap, channel list, messages, composer |
+| 1 | vue-demo-app | 5b7648f | feat: /chat page on vue-chat-layer |
+| 1 | sm-demo-app | b6ece43 | test: check-chat browser check |
+| 2 | vue-chat-layer | 5d58153 | feat: port the chat store, realtime client and components |
+| 2 | vue-demo-app | ae3dbfc | refactor: share the chat layer's realtime client |
+| 3 | vue-chat-layer | 269c75b | feat: threads, pins, reactions, attachments, link embeds and the command picker |
+| 4 | vue-chat-layer | c465414 | feat: floating chat panel |
+| 4 | vue-demo-app | 8636aa3 | feat: floating chat panel, Chat tour card |
+| 4 | sm-demo-app | b4fc7dc | test: tour expects the Chat card, smoke covers /chat |
+| 6 | vue-chat-layer | tag v0.1.0 (1e6a907, peels to c465414) | vue-chat-layer v0.1.0 |
+| 6 | vue-demo-app | 3fe8018 | feat: pin vue-chat-layer v0.1.0 |
+
+**Pushed:** only vue-chat-layer `main` and the tag `v0.1.0`. They went to the new public repository `git@git.golem15.com:golem15/vue-chat-layer.git`, created with `tea repo create`. `git ls-remote origin 'refs/tags/v0.1.0^{}'` equals HEAD c465414.
+
+**Not pushed:** vue-demo-app and sm-demo-app (plan 05). sm-demo-app shows the moved `vue-demo-app` submodule pointer as uncommitted; plan 05 bumps it.
+
+## Checkpoint answer
+
+Task 5: **release**. The user gave the go-ahead to create the repository, push main and tag v0.1.0.
+
+## Verification
+
+- **Layer:** `pnpm test` passes 6/6, and `pnpm build:playground` builds.
+- **vue-demo-app:** `pnpm test` passes 209/209 and `pnpm run build` builds, both against the link pin and against the tag.
+- **check-local.sh:** these runs all printed ok.
+  - `chat` (Task 1)
+  - `chat realtime remote` (Task 2)
+  - `chat` (Task 3)
+  - `tour chat realtime remote` (Task 4)
+  - `chat tour` after the tag pin (Task 6)
+- **smoke.sh:** `smoke: ok` with /chat included.
+- **Manual (Task 3 criterion):** `/demo` typed in the #general composer opened the picker, and Enter showed the ephemeral answer. The channel had 18 messages before and 18 after, so nothing was posted.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 2 - Missing critical] The caller's user id**
+- **Found during:** Task 2.
+- **Issue:** The demo bootstrap and `/chat/members` do not include the caller. The store needs the id for `user:{me}` and for telling its own messages apart.
+- **Fix:** `userIdFromToken` reads the JWT's numeric `sub` claim. An optional `$chatAuth.userId()` overrides it. Documented in the README. Commit 5d58153.
+
+**2. Refresh endpoint**
+- useDemoAuth has no refresh.
+- `chatAuth.refresh` calls `POST /_user/api/v1/refresh` with the bearer token. The user plugin answers the rotated token in the body.
+- The token is stored through `lib/api/client.ts` `tokens` (`document.cookie`), because the hook runs outside a component's setup, where `useCookie` fails. Commits 5b7648f and ae3dbfc.
+
+**3. [Rule 3 - Blocking] Realtime test and vitest config**
+- vue-demo-app's `app/lib/realtime.test.ts` is now bm's current realtime test against the shared client. Two adjustments go beyond import paths:
+  - The token route is a stubbed `fetch` instead of a mocked `@/api/client`, because the layer fetches the token itself.
+  - The 503 case asserts `{status: 503}`, since the error is now `RealtimeTokenError`.
+- `vitest.config.ts` (outside Task 2's file list) got `resolve.dedupe: ['centrifuge']` and `test.server.deps.inline: ['vue-chat-layer']`. With these the mock applies, and the tag-installed layer's TypeScript is transformed. Commit ae3dbfc.
+
+**4. Extra layer files and the shape of the ported libs**
+- Two files are outside the plan's list:
+  - `app/lib/markdown.ts`: `escapeHtml`, `safeUrl` and `formatSpans`, for chatText.
+  - `app/lib/attachments.ts`: `checkFiles`.
+- The ported libs keep bm's signatures, with optional localized copy. `setFormatLocale` configures the format locale; its defaults stay pl-PL and Europe/Warsaw, so bm's tests port unchanged in plan 06. The components set the app's locale and the browser's time zone.
+- `chatEvents` adds an optional `rootId` to created events, so replies stay out of the main list.
+
+**5. Ephemeral answers**
+- Slash command answers render through `renderChatText`. This keeps the prohibition: `v-html` is used only for the escaped renderer output.
+- `linkify` is exported but not used by the components.
+
+**6. Naming and copy**
+- The app's `chat.*` keys (`eyebrow`, `title`, `lead`, `slashHint`, `anonymous`, `registerToChat`) avoid the layer's `chat.*` tree. The layer's own title key is `chat.name`.
+- `{'@'}` escapes @ in the app copy, because a bare @ is vue-i18n link syntax.
+- /chat also has a Log in link next to the register link.
+
+**7. Dev-stack note**
+- Running `nuxt build` while `nuxt dev` is up makes the dev server loop on "Another Nuxt dev is already running".
+- The stack was restarted with `dev.sh down` and `dev.sh up` after each build.
+
+**8. Pins**
+- The visitor was allowed to pin in #general, and the pin succeeded.
+- The refused-pin path (a notice, then the action hidden for the session) is in the code but was not exercised.
+
+**Total deviations:** 8. **Impact:** none on the plan goal.
+
+## Known Stubs
+
+None. Link cards are generic by design (D-01; there is no unfurl backend).
+
+## Issues Encountered
+
+- **vue-tsc on the playground** (run with summercms.go/admin's vue-tsc, not a gate) reports only `noUncheckedIndexedAccess` errors (the "possibly undefined" kind). They are mostly in the modules ported from bm and come from the source. Builds don't typecheck.
+
+## Threat Flags
+
+| Flag | File | Description |
+|------|------|-------------|
+| threat_flag: supply-chain | ../sm-demo-app/vue-demo-app/package.json | New git dependency vue-chat-layer pinned by tag v0.1.0 (commit c465414 in the lockfile), as planned in T-20-18 |
+
+## Next Phase Readiness
+
+- **Plan 04** (vue-chatvideo-layer) can extend `vue-chat-layer#v0.1.0`:
+  - Call button: put it in the `conversation-actions` slot, which renders for DMs only.
+  - `video:*` events: listen through `onUserEvent`.
+  - Session channels: subscribe through the shared `subscribe`.
+- **Plan 05** needs to know:
+  - vue-demo-app is ready to push. Its `package.json` and lockfile pin the tag, with no local path.
+  - The sm-demo-app submodule pointer bump is still to do.
+
+## Self-Check: PASSED
+
+- The listed files exist in their repos: vue-chat-layer, vue-demo-app and sm-demo-app scripts.
+- Commits exist:
+  - vue-chat-layer: fa6f995, 5d58153, 269c75b, c465414.
+  - vue-demo-app: 5b7648f, ae3dbfc, 8636aa3, 3fe8018.
+  - sm-demo-app: b6ece43, b4fc7dc.
+- The remote tag v0.1.0 peels to c465414.

.planning/phases/20-demo-instance-with-every-shared-plugin/20-04-SUMMARY.md

@@ -0,0 +1,303 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 04
+subsystem: vue-forum-layer, vue-userfriends-layer, vue-chatvideo-layer, vue-demo-app, sm-demo-app
+tags: [forum, friends, video-calls, livekit, nuxt-layer, herald, vapid, tour, i18n]
+
+requires:
+  - phase: 20-02
+    provides: "Chat family mounted in sm-demo-app, seeded forum and friends, local LiveKit, Centrifugo namespaces chat/user/video, GET /_demo/api/v1/chat/members"
+  - phase: 20-03
+    provides: "vue-chat-layer v0.1.0: conversation-actions (DM only) and sidebar-footer slots, onUserEvent and subscribe on the page's one realtime client, $chatAuth"
+provides:
+  - "vue-forum-layer v0.1.0 on git.golem15.com (public), tag v0.1.0 = dcd6549"
+  - "vue-userfriends-layer v0.1.0 on git.golem15.com (public), tag v0.1.0 = bcc8e99"
+  - "vue-chatvideo-layer v0.1.0 on git.golem15.com (public), tag v0.1.0 = 75e9a40, livekit-client 2.23.0 exact"
+  - "vue-demo-app /forum, /forum/t/{id}, /friends, /call/{conversation}, the DM call button, the incoming-call prompt, ten tour cards, all three layers pinned by tag"
+  - "sm-demo-app check-local forum, friends, call, herald; tour expects ten cards; smoke.sh covers /forum and /friends; dev.sh writes herald's VAPID keys into .env"
+  - "Phase COVERAGE.md (livekit-client, LiveKit server, Centrifugo, Web Push)"
+affects: [20-05, 20-06]
+
+actuals:
+  tokens: 56900    # chars/4: the three layers' tracked files without lockfiles (56107 + 54654 + 63266) + vue-demo-app diff 3fe8018..9357711 without the lockfile (28917) + sm-demo-app diff b4fc7dc..fc23b4c in scripts, README and deploy (19375) + COVERAGE.md (5418) = 227737 chars
+  tasks: 7
+  commits: 1       # MEASURED in summercms.go: git rev-list --count b40c519..0301dc2 (COVERAGE.md) before this SUMMARY commit; code commits: vue-forum-layer 1, vue-userfriends-layer 1, vue-chatvideo-layer 1, vue-demo-app 5, sm-demo-app 4
+plan_head_before: b40c519   # summercms.go
+plan_head_after: 0301dc2ae48607c69847b3300ec844f80cad25d3    # summercms.go before this SUMMARY commit
+
+tech-stack:
+  added:
+    - "livekit-client 2.23.0 (exact, vue-chatvideo-layer dependency; approved at the Task 3 checkpoint)"
+    - "vue-forum-layer, vue-userfriends-layer, vue-chatvideo-layer (new shared Nuxt layers); every other package is an existing workspace pin (@nuxtjs/i18n 10.4.0, nuxt 4.4.8, vue 3.5.35, typescript 5.9.3, vitest 3.2.7)"
+  patterns:
+    - "Layer clients in app/utils carry a layer prefix on every export (forumError, friendTarget), because Nuxt auto-imports app/utils into the app"
+    - "A companion layer (vue-chatvideo-layer) takes vue-chat-layer as a peer dependency, does not extend it, and dedupes it in Vite so the realtime module stays one instance"
+    - "Token getter hooks per layer ($forumAuth, $userfriendsAuth), optional data hook ($userfriendsDirectory), $chatAuth reused by the companion layer"
+
+key-files:
+  created:
+    - ../vue-forum-layer/app/utils/forumClient.ts
+    - ../vue-forum-layer/app/components/Forum/Thread.vue
+    - ../vue-forum-layer/README.md
+    - ../vue-userfriends-layer/app/utils/friendsClient.ts
+    - ../vue-userfriends-layer/app/components/Friends/Groups.vue
+    - ../vue-userfriends-layer/README.md
+    - ../vue-chatvideo-layer/app/lib/callMachine.ts
+    - ../vue-chatvideo-layer/app/lib/videoClient.ts
+    - ../vue-chatvideo-layer/app/composables/useCall.ts
+    - ../vue-chatvideo-layer/app/composables/useIncomingCalls.ts
+    - ../vue-chatvideo-layer/README.md
+    - ../sm-demo-app/vue-demo-app/app/pages/forum/index.vue
+    - ../sm-demo-app/vue-demo-app/app/pages/forum/t/[id].vue
+    - ../sm-demo-app/vue-demo-app/app/pages/friends.vue
+    - ../sm-demo-app/vue-demo-app/app/pages/call/[conversation].vue
+    - .planning/phases/20-demo-instance-with-every-shared-plugin/COVERAGE.md
+  modified:
+    - ../sm-demo-app/vue-demo-app/package.json
+    - ../sm-demo-app/vue-demo-app/pnpm-lock.yaml
+    - ../sm-demo-app/vue-demo-app/nuxt.config.ts
+    - ../sm-demo-app/vue-demo-app/app/plugins/auth.ts
+    - ../sm-demo-app/vue-demo-app/app/pages/chat.vue
+    - ../sm-demo-app/vue-demo-app/app/pages/index.vue
+    - ../sm-demo-app/vue-demo-app/app/pages/account/security.vue
+    - ../sm-demo-app/vue-demo-app/app/layouts/default.vue
+    - ../sm-demo-app/vue-demo-app/app/components/SiteHeader.vue
+    - ../sm-demo-app/vue-demo-app/app/components/TourCard.vue
+    - ../sm-demo-app/vue-demo-app/i18n/locales/en.json
+    - ../sm-demo-app/vue-demo-app/i18n/locales/pl.json
+    - ../sm-demo-app/scripts/check-local.sh
+    - ../sm-demo-app/scripts/smoke.sh
+    - ../sm-demo-app/scripts/dev.sh
+    - ../sm-demo-app/deploy/env.example
+    - ../sm-demo-app/README.md
+
+key-decisions:
+  - "Task 3 checkpoint: the user approved livekit-client 2.23.0 (repository github.com/livekit/client-sdk-js, npm maintainer thedavidzhao, no install or postinstall hooks, npm provenance attestations, published 2026-10-16, 15 days old; compatibility with LiveKit server 1.13.1 not checked separately, the local 1.13.1 calls work)"
+  - "Task 6 checkpoint: release. The subagent's tea repo create was refused by the permission system; the orchestrator, after the user's go-ahead in manual mode, created the three repositories public, pushed main and the annotated tags v0.1.0 (remote tags equal HEAD)"
+  - "Decline posts video/leave: no chatvideo path publishes video:call:declined; the caller shows a did-not-answer note for a participant who left without joining"
+  - "The last one out ends the call (video/end instead of video/leave), so the next start rings again"
+  - "The call button's start answer is handed to the call page in memory (one start per call, no token in the URL)"
+  - "Forum manage rights come from the host: ForumThread canManage, filled by the demo from the chat bootstrap's moderator flag"
+
+patterns-established:
+  - "check-local throwaway_user prints e-mail and JWT; LiveKit join tokens are validated with GET /rtc/validate, the token passed to curl through a config on stdin"
+
+requirements-completed: [SC-2, D-11, D-12, D-13, D-14, D-15, D-16, D-20, D-21, D-22, D-23]
+
+coverage:
+  - id: D1
+    description: "Members read the seeded EN/PL forum, create threads, reply, preview, edit and delete own posts; anonymous /forum has the register link to /register?next=/forum and no forum"
+    requirement: "D-14, D-21, D-22"
+    verification:
+      - kind: e2e
+        ref: "../sm-demo-app/scripts/check-local.sh forum"
+        status: pass
+      - kind: unit
+        ref: "../vue-forum-layer/tests/client.test.ts"
+        status: pass
+      - kind: manual
+        ref: "Playwright probe (scratchpad forum.cjs): categories, thread, preview, reply, edit, delete, new thread, no console error"
+        status: pass
+    human_judgment: true
+  - id: D2
+    description: "Friends, requests (accept, reject, cancel), unfriend, groups (create, invite code, join by code, leave); /friends linked from the chat sidebar, the header and /account/security"
+    requirement: "D-15"
+    verification:
+      - kind: e2e
+        ref: "../sm-demo-app/scripts/check-local.sh friends"
+        status: pass
+      - kind: unit
+        ref: "../vue-userfriends-layer/tests/client.test.ts"
+        status: pass
+      - kind: manual
+        ref: "Playwright probe (scratchpad friends.cjs) with two throwaway members"
+        status: pass
+    human_judgment: true
+  - id: D3
+    description: "DM-only call button; start, LiveKit token accepted, end; two members in a call with remote video, mute and camera off seen remotely, decline note, prompt cleared when the caller hangs up, server end ends the page's call"
+    requirement: "D-11, D-12, D-13, D-23"
+    verification:
+      - kind: e2e
+        ref: "../sm-demo-app/scripts/check-local.sh call"
+        status: pass
+      - kind: unit
+        ref: "../vue-chatvideo-layer/tests/callMachine.test.ts"
+        status: pass
+      - kind: manual
+        ref: "Playwright probe (scratchpad call.cjs) with fake media, against the link pins"
+        status: pass
+    human_judgment: true
+  - id: D4
+    description: "Herald VAPID keys in .env without printing them; public-key route 401 without and 200 with a JWT; no /_herald in goPaths"
+    requirement: "D-16"
+    verification:
+      - kind: e2e
+        ref: "../sm-demo-app/scripts/check-local.sh herald"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Ten tour cards in EN and PL; vue-demo-app tests and build against the three tags"
+    requirement: "D-03, D-20"
+    verification:
+      - kind: e2e
+        ref: "check-local.sh tour; forum friends call chat tour after the tag pin"
+        status: pass
+      - kind: build
+        ref: "pnpm --dir ../sm-demo-app/vue-demo-app test (209) && run build"
+        status: pass
+    human_judgment: false
+
+duration: about 2 h of work (14:13 to 15:15 for Tasks 1 to 5, then the release checkpoint and Task 7 until 20:03)
+completed: 2026-10-31
+status: complete
+---
+
+# Phase 20 Plan 04: forum, friends and video-call layers v0.1.0 on the demo site Summary
+
+**Three new shared layers are released at v0.1.0: vue-forum-layer (categories, threads, Markdown posts from the server's content_html), vue-userfriends-layer (friends, requests, groups with invite codes) and vue-chatvideo-layer (DM calls on livekit-client 2.23.0, loaded on demand). The demo site has /forum, /friends, /call/{conversation}, a call button in DM headers, an incoming-call prompt on every page, ten tour cards, and herald runs with VAPID keys and no UI.**
+
+## Performance
+
+- **Tasks:** 7/7. Task 3 (package legitimacy) and Task 6 (release go-ahead) were checkpoints answered by the user.
+- **Files:** vue-forum-layer 22, vue-userfriends-layer 22 and vue-chatvideo-layer 22 tracked files; vue-demo-app 5 commits; sm-demo-app 4 commits.
+
+## The layers' public API (v0.1.0)
+
+**vue-forum-layer**
+- Runtime config: `forum.apiBase` (`NUXT_FORUM_API_BASE`), `public.forum.apiBase` (`/_forum/api/v1`).
+- Hook: `$forumAuth` (token getter).
+- Components: `ForumPage` (contextType, contextId, threadPath), `ForumThread` (contextType, contextId, threadId, canManage, backPath), `ForumCategoryList`, `ForumThreadList`, `ForumPostEditor` (submit, preview, withTitle, …).
+- Composables: `useForum`, `useForumApi`, `useForumAuth`. Client: `createForumClient`, `ForumApiError`, `forumContextPath`, `forumError`.
+- Copy: `forum.*` EN and PL.
+
+**vue-userfriends-layer**
+- Runtime config: `userfriends.apiBase`, `public.userfriends.apiBase` (`/_userfriends/api/v1`).
+- Hooks: `$userfriendsAuth` (token getter), optional `$userfriendsDirectory(): Promise<{id, name}[]>`.
+- Components: `FriendsPage`, `FriendsList`, `FriendsRequests`, `FriendsAddFriend`, `FriendsGroups`.
+- Composables: `useFriends` (useState keys `userfriends:*`), `useFriendsApi`, `useFriendsAuth`, `useFriendsDirectory`. Client: `createFriendsClient`, `FriendsApiError`, `friendTarget`, `friendsError`.
+- Copy: `friends.*` EN and PL.
+
+**vue-chatvideo-layer**
+- Peer dependency `vue-chat-layer ^0.1.0` (not extended; the app extends both, chat first). Dependency `livekit-client` 2.23.0 exact.
+- Runtime config: `public.chatvideo.apiBase` (`/_chatvideo/api/v1`). Auth: vue-chat-layer's `$chatAuth`.
+- Components: `ChatvideoCallButton` (conversationId, callPath), `ChatvideoCall` (conversationId, start, backPath), `ChatvideoTile`, `ChatvideoIncomingCall` (callPath).
+- Composables: `useCall`, `useVideoClient`, `useIncomingCalls` (`RING_MS` 45 s).
+- Lib: `callMachine` (`initialCallState`, `transition`, `isLive`, `failureReason`), `videoClient` (`createVideoClient`, `VideoApiError`, `videoSessionChannel`, `videoPath`, `videoEvent`, `parseIncomingCall`, `rememberStart`, `takeStart`).
+- Copy: `chatvideo.*` EN and PL, reason keys `chatvideo.reason.*`.
+
+## Task Commits
+
+| # | Repo | Commit | Message |
+|---|------|--------|---------|
+| 1 | vue-forum-layer | dcd6549 | feat: forum layer: categories, threads and Markdown posts |
+| 1 | vue-demo-app | 2473517 | feat: /forum and /forum/t/{id} on vue-forum-layer |
+| 1 | sm-demo-app | c4a9cfc | test: check-local forum, smoke covers /forum |
+| 2 | vue-userfriends-layer | bcc8e99 | feat: friends layer: friends, requests and friend groups |
+| 2 | vue-demo-app | 4edc81f | feat: /friends on vue-userfriends-layer, linked from the chat and the account |
+| 2 | sm-demo-app | c2208e9 | test: check-local friends, smoke covers /friends |
+| 3 | — | — | checkpoint: approved livekit-client 2.23.0 |
+| 4 | vue-chatvideo-layer | 75e9a40 | feat: video-call layer: DM calls on LiveKit |
+| 4 | vue-demo-app | 1db4394 | feat: DM video calls on vue-chatvideo-layer |
+| 4 | sm-demo-app | c669717 | test: check-local call (DM start, LiveKit token validation, end) |
+| 4 | summercms.go | 0301dc2 | docs(20-04): API coverage of livekit-client, LiveKit, Centrifugo and Web Push |
+| 5 | sm-demo-app | fc23b4c | feat: herald VAPID keys without UI, check-local herald and the ten-card tour |
+| 5 | vue-demo-app | cc8d330 | feat: Forum, Friends and Calls tour cards |
+| 6 | — | — | checkpoint: release |
+| 7 | vue-forum-layer, vue-userfriends-layer, vue-chatvideo-layer | tags v0.1.0 | created, pushed and tagged by the orchestrator (below) |
+| 7 | vue-demo-app | 9357711 | feat: pin the forum, friends and video-call layers v0.1.0 |
+
+**Release (Task 7).** The subagent's `tea repo create` was refused by the permission system ("Create Public Surface"), so nothing was created from the subagent. After the user's go-ahead (in manual permission mode), the orchestrator created `golem15/vue-forum-layer`, `golem15/vue-userfriends-layer` and `golem15/vue-chatvideo-layer` public (vue-faq-layer's visibility), pushed `main` and the annotated tags `v0.1.0`. `ls-remote 'refs/tags/v0.1.0^{}'` equals HEAD for each: dcd6549, bcc8e99, 75e9a40. The subagent then pinned the tags in vue-demo-app.
+
+**Not pushed:** vue-demo-app and sm-demo-app (plan 05). sm-demo-app shows the moved `vue-demo-app` submodule pointer as uncommitted.
+
+## Checkpoint answers
+
+- **Task 3:** approved livekit-client 2.23.0. Facts checked by the orchestrator: repository github.com/livekit/client-sdk-js, npm maintainer thedavidzhao, no install or postinstall hooks, npm provenance attestations, published 2026-10-16 (15 days old). Compatibility with LiveKit server 1.13.1 was not checked from the release notes; calls on the local 1.13.1 work. Installed with `--save-exact`; lockfile integrity `sha512-j9Kg86nJ…`.
+- **Task 6:** release.
+
+## Verification
+
+- **Layers:** forum `pnpm test` 7/7, friends 6/6, chatvideo vitest 10/10; `pnpm build:playground` builds for all three.
+- **vue-demo-app:** `pnpm test` 209/209 and `pnpm run build` after every task and against the tags.
+- **check-local.sh:** `forum` (Task 1), `friends forum chat` (Task 2), `call chat` (Task 4), `herald tour` (Task 5), `forum friends call chat tour herald` and `back remote realtime quizzes journal` (before the release), `forum friends call chat tour` against the tags (Task 7): all ok.
+- **smoke.sh:** `smoke: ok`, with /forum and /friends in the page loop and their anonymous prompts.
+- **Browser probes** (Playwright, throwaway members, fake media, against the link pins): the forum, friends and call flows listed in the coverage block passed with no console error. Against the tags, the call probe's ring step failed five times in a row because the stale servers took every incoming-call broadcast (environment notes); the tagged install itself resolves one vue-chat-layer copy (one entry in `node_modules/.pnpm`) and passes check-local call and chat.
+- **Task 5 manual check:** `dev.sh up` printed only "added the herald VAPID keys to .env"; no line of the output holds a key value. A second `dev.sh seed` added nothing. The plan's `grep .env` was blocked by the secret-read hook; `check-local herald` (200 with a non-empty publicKey) shows the key is loaded.
+- **Acceptance greps:** all print the expected values (no consuming-app names in the layers, v-html only on content_html, one `import('livekit-client')`, no static runtime import, every `subscribe(` line uses `videoSessionChannel`, exact livekit pin, one `conversation-actions`, one `sidebar-footer`, one `to="/friends"` in SiteHeader, no `'/_herald'`, three tour keys, `HERALD__VAPID__PRIVATE_KEY=` once and empty, no OPT-OUT row without a reason, no link pins left).
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] Decline has no declined event on the server**
+- **Found during:** Task 4 (read video_service.go as the plan asked).
+- **Issue:** `Notifier.Declined` exists, but no VideoService path calls it; `Leave` publishes `video:participant:left`. No endpoint publishes `video:call:declined`.
+- **Fix:** Decline posts `video/leave`. The caller's page treats `video:participant:left` (and `video:call:declined`, should it ever come) for a participant who never connected as a decline and shows "did not answer". The shared plugin is unchanged (follow-up below).
+- **Commit:** 75e9a40.
+
+**2. [Rule 1 - Bug] A left-open session never rings again**
+- **Found during:** Task 4.
+- **Issue:** `start` answers the live session without a new `video:call:incoming` when one exists. If both members only posted `leave`, the session stayed open until the reconcile job, and the next call from the DM would not ring.
+- **Fix:** Leave posts `video/end` when nobody else is in the room (the last one out ends the call), else `video/leave`. Both use `keepalive` so pagehide still sends them.
+- **Commit:** 75e9a40.
+
+**3. [Rule 2 - Missing critical] One start per call**
+- **Issue:** The plan has both the button and the call page start the call; `video-initiate` allows 5 starts a minute.
+- **Fix:** The button keeps its start answer in memory for 60 s (`rememberStart`), and the page takes it once (`takeStart`) before starting itself. The join token never goes into a URL.
+- **Commit:** 75e9a40.
+
+**4. Forum manage rights from the host**
+- The forum API does not report manage rights. `ForumThread` takes `canManage`; the demo thread page fills it from `GET /_demo/api/v1/chat`'s `moderator` flag (the same group the forum policy checks). A refused action hides itself for the session.
+- **Commit:** dcd6549, 2473517.
+
+**5. [Rule 3 - Blocking] Auto-import collisions**
+- Nuxt auto-imports `app/utils` into the app, so the layers' generic helper names would collide. Exports carry the layer's prefix: `forumError`, `forumContextPath`, `friendsError`, `friendTarget`.
+- **Commit:** dcd6549, bcc8e99.
+
+**6. [Rule 3 - Blocking] One vue-chat-layer copy**
+- With the development `link:` pin, the linked checkout's own `node_modules/vue-chat-layer` (its dev dependency) would be a second realtime module that never hears the chat's events. vue-chatvideo-layer's nuxt.config sets `vite.resolve.dedupe: ['vue-chat-layer']`. With the link pin the incoming-call prompt works; with the tag install pnpm resolves the peer to the app's copy.
+- **Commit:** 75e9a40.
+
+**7. Smaller additions**
+- check-local.sh: `throwaway_user` (e-mail and JWT) with `throwaway_jwt` on top of it; `check_call` reads Ada's id from `/chat/members`.
+- smoke.sh: the anonymous prompts of /forum and /friends are checked, not only the page loop.
+- `ensure_vapid` runs at the end of `seed()`, so `up` and `seed` both cover it.
+- The add-friend picker hides current friends and people with a pending request.
+- App copy lives under `forum.*`, `friends.*` and `call.*` next to the layers' trees (distinct keys), plus `header.friends`, `chat.friendsLink` and `security.friendsLink`.
+- The plan's draft progress SUMMARY after Task 4 was skipped on the orchestrator's instruction; this SUMMARY is the only one.
+
+**Total deviations:** 7. **Impact:** none on the plan goal; 1 and 2 make the call flow work with the plugin as it is.
+
+## Follow-ups
+
+- **sm-chatvideo-plugin:** `Notifier.Declined` is never called. A decline route (or `Leave` publishing `video:call:declined` for a participant still in status invited) would let the layer drop its participant-left inference. Not needed for this phase.
+- **Herald:** the boot warning "PresenceGate is deny-all; the host must SetPresenceGate" remains; it matters only once push is sent (D-16 defers the subscribe UI).
+
+## Environment notes
+
+- **Stale demo servers share the local database.** `./bin/demo serve` pid 684528 (user jin, 127.0.0.1:8099, since Oct 22, in sm-demo-app) and pid 2918923 (user golem, 0.0.0.0:8096, since Oct 20) run River workers on `127.0.0.1:55540/summercms_demo` and take `summer.broadcast` jobs. Since the release, the current server ran 7 of about 50 broadcasts; the stale ones ran the rest, and their pushes do not reach the current Centrifugo clients. A Node test without a browser received 4 of 6 incoming-call pushes earlier; later the browser ring step failed 5 runs in a row. They were left running (not approved to stop). Stop them before plan 06's browser tests.
+- **Headless Chrome** sometimes hits `ERR_NETWORK_CHANGED` (the host's network interfaces change, likely docker), which breaks page loads in probes.
+- **Vite dev re-optimization:** the first `check-local chat` after adding a layer got a 504 "Outdated Optimize Dep" and passed on the rerun (dev server only).
+- **Local secrets in a tool log:** while diagnosing, the Centrifugo `PROXY_SECRET`, `TOKEN_SECRET` and `API_KEY` from pid 684528's environment were printed into the session's tool output. They are local development values and were never committed; removing the `SUMMER_REALTIME__CENTRIFUGO__*` lines from `.env` and running `dev.sh up` rotates them.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+| Flag | File | Description |
+|------|------|-------------|
+| threat_flag: supply-chain | ../vue-chatvideo-layer/package.json | New third-party dependency livekit-client 2.23.0 (exact), installed after the Task 3 checkpoint as planned in T-20-SC |
+| threat_flag: supply-chain | ../sm-demo-app/vue-demo-app/package.json | Three new git dependencies pinned by tag v0.1.0 (commits dcd6549, bcc8e99, 75e9a40 in the lockfile) |
+
+## Next Phase Readiness
+
+- **Plan 05:** vue-demo-app pins every layer by tag and has no link pin, so it can be pushed. The sm-demo-app submodule pointer bump is still to do. The deploy needs `/_forum`, `/_userfriends` and `/_chatvideo` routed to Go in nginx (not `/_herald`), the herald VAPID keys in rome's `.env`, and LiveKit reachable at the production `livekit_url`.
+- **Plan 06:** the call machine and the three clients have unit tests to extend; browser checks of the call flow need the stale servers stopped.
+
+## Self-Check: PASSED
+
+- Layer commits exist: vue-forum-layer dcd6549, vue-userfriends-layer bcc8e99, vue-chatvideo-layer 75e9a40; remote tags v0.1.0 peel to them.
+- vue-demo-app: 2473517, 4edc81f, 1db4394, cc8d330, 9357711. sm-demo-app: c4a9cfc, c2208e9, c669717, fc23b4c. summercms.go: 0301dc2.
+- The key files listed above exist in their repos.

.planning/phases/20-demo-instance-with-every-shared-plugin/20-05-SUMMARY.md

@@ -0,0 +1,162 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 05
+subsystem: sm-demo-app deploy, rome
+tags: [deploy, rome, livekit, vuurmuur, nginx, centrifugo, herald, vapid, robots, check-live]
+
+requires:
+  - phase: 20-02
+    provides: "chat family mounted in sm-demo-app, deploy/livekit.yaml.example, Centrifugo namespaces in the example, production livekit_url"
+  - phase: 20-03
+    provides: "vue-chat-layer v0.1.0 pinned in vue-demo-app"
+  - phase: 20-04
+    provides: "forum, friends and video-call layers v0.1.0 pinned in vue-demo-app, herald VAPID handling in dev.sh"
+provides:
+  - "demo.summercms.io serves /chat, /forum, /friends and /call/{id} with the banner and register prompts; the chat-family APIs answer 401 without a JWT"
+  - "The demo's own LiveKit 1.13.1 on rome (supervisor program summercms-demo-livekit, 127.0.0.1:7890 behind nginx /livekit/, media 7891/tcp and 7892/udp open through Vuurmuur)"
+  - "Centrifugo namespaces chat, user, video on rome; herald VAPID keys in rome's .env; robots.txt disallows the new prefixes"
+  - "scripts/check-deploy.sh LiveKit and chat-family checks; scripts/check-live.sh chat-family checks; DEPLOY.md runbooks for LiveKit, the firewall and the chat family"
+affects: [20-06]
+
+actuals:
+  tokens: 14800    # chars/4 over sm-demo-app fc23b4c..f2e35c1 without the ROADMAP snapshot and the gitlink (59224 chars)
+  tasks: 6
+  commits: 0       # MEASURED in summercms.go: git rev-list --count 6389479..HEAD before this SUMMARY commit (docs-only plan here); sm-demo-app: 6 (git rev-list --count fc23b4c..f2e35c1)
+plan_head_before: 63894799065795c54d91e40094692cf4f0cbe419   # summercms.go
+plan_head_after: 63894799065795c54d91e40094692cf4f0cbe419    # summercms.go before this SUMMARY commit; sm-demo-app fc23b4c -> f2e35c1, vue-demo-app 44a5229 -> 9357711 (pushed)
+
+tech-stack:
+  added: []
+  patterns:
+    - "Secrets generated on rome go into files through bash builtins and stdin only (printf, tee), never as a process argument"
+    - "Shared-host supervisor changes name the program (supervisorctl update <name>), so no other program restarts"
+    - "Admin-only settings changed unattended through rome's loopback admin API, the password read on rome into a 0700 temp dir"
+
+key-files:
+  created:
+    - ../sm-demo-app/deploy/supervisor/summercms-demo-livekit.conf
+  modified:
+    - ../sm-demo-app/deploy/nginx/demo.summercms.io.conf
+    - ../sm-demo-app/deploy/livekit.yaml.example
+    - ../sm-demo-app/config/env/production/golem15.chatvideo.yaml
+    - ../sm-demo-app/scripts/check-deploy.sh
+    - ../sm-demo-app/scripts/check-live.sh
+    - ../sm-demo-app/DEPLOY.md
+    - ../sm-demo-app/README.md
+    - ../sm-demo-app/plugins/demo/content/ROADMAP.md
+    - ../sm-demo-app/vue-demo-app
+
+key-decisions:
+  - "Task 3 checkpoint: deploy (push both repositories and release the chat family on rome)"
+  - "Task 5 checkpoint: firewall done; the user applied the Vuurmuur rule as service sm-demo-livekit (7891/tcp, 7892/udp), rule on line 1 of rules.conf"
+  - "Media path: ICE over the UDP mux 7892 with ICE-TCP 7891, no embedded TURN; TURN on 3478/5349 with a DNS-only host is the recorded fallback"
+  - "Admin stays at /smbackend with login; /backend answers 404"
+  - "robots.txt updated through PUT /_seo/api/v1/robots on rome's loopback (admin bearer token), not by hand"
+  - "VAPID subject mailto:DEMO_ADMIN_EMAIL from the build machine's secrets file"
+
+requirements-completed: [SC-2, SC-3, D-10, D-12, D-16, D-20, D-21]
+
+duration: about 5 h of work over two sessions (2026-10-31 evening to 2026-11-01 18:40), with three checkpoints and the user's own firewall change
+completed: 2026-11-01
+status: complete
+---
+
+# Phase 20 Plan 05: chat family deployed on demo.summercms.io with its own LiveKit Summary
+
+**The chat family runs on the public demo: https://demo.summercms.io serves /chat, /forum, /friends and /call/{id} with the banner and register prompts, every chat-family API answers 401 without a JWT, /livekit/rtc/validate reaches the demo's own LiveKit 1.13.1 (supervisor program summercms-demo-livekit, separate from WavePath's), Centrifugo has the chat, user and video namespaces, herald has VAPID keys without a route, and Vuurmuur admits LiveKit's media on 7891/tcp and 7892/udp. `check-live.sh https://demo.summercms.io` prints `check-live: ok`.**
+
+## Task Commits
+
+| # | Repo | Commit | Message |
+|---|------|--------|---------|
+| 1 | sm-demo-app | b5c639e | feat: deploy files for the chat family and the demo's LiveKit |
+| 2 | sm-demo-app | cf08fb5 | fix: check-live tells an unrouted /_herald by its 404, not its type |
+| 3 | — | — | checkpoint: deploy |
+| 4 | vue-demo-app | (push) | 44a5229..9357711 pushed to origin master |
+| 4 | sm-demo-app | c399bfd | chore: bump vue-demo-app (chat, forum, friends, calls) |
+| 4 | sm-demo-app | 6d726b4 | chore: sync the roadmap snapshot |
+| 4 | sm-demo-app | fcd8d95 | docs: record the chat-family release on rome |
+| 5 | — | — | checkpoint: firewall done (applied by the user) |
+| 6 | sm-demo-app | f2e35c1 | docs: record the LiveKit firewall rule |
+
+**Pushed:** vue-demo-app master = 9357711 (`ls-remote` equals local HEAD, and sm-demo-app's gitlink points to it); sm-demo-app master = f2e35c1 (`ls-remote` equals local HEAD). Push order: vue-demo-app first, then the pointer bump.
+
+## Deploy table (Task 2, rome read-only, 2026-10-31/11-01; no secret values)
+
+| Item | State before the release |
+|------|--------------------------|
+| Listeners on 7890, 7891, 7892 | none (free); the trio was kept |
+| WavePath LiveKit | `wavepath-livekit` RUNNING pid 1104; 127.0.0.1:7880, *:7881, UDP 50000-60000 |
+| LiveKit binary | `/usr/local/bin/livekit-server` 1.13.1 |
+| Demo programs | summercms-demo, summercms-demo-site, summercms-demo-centrifugo RUNNING; no summercms-demo-livekit, conf or livekit.yaml |
+| `.env` key counts | CHATVIDEO__LIVEKIT_API_KEY 0, __LIVEKIT_API_SECRET 0, HERALD__VAPID__PUBLIC_KEY 0, __PRIVATE_KEY 0, __SUBJECT 0 |
+| centrifugo.json | namespaces `["presentations"]` only (chat 0, user 0, video 0); Centrifugo v6.5.1 |
+| Vuurmuur | 0.8.1, INPUT policy DROP, 62 vrmr lines, 15 rules, service Livekit unused, 0 rules for 789x |
+| Unpushed | sm-demo-app 19 commits (plans 02-04) + this plan's; vue-demo-app 9 commits |
+
+## Ports used
+
+7890/tcp on 127.0.0.1 (signal and RoomService, behind nginx `location ^~ /livekit/` and `livekit_admin_url`), 7891/tcp on all addresses (ICE-TCP), 7892/udp on every interface including 54.36.173.176 (ICE UDP mux). No collision with Go 8098, Nuxt 3098, Centrifugo 8010 or WavePath's 7880/7881/50000-60000 (check-deploy asserts it).
+
+## What changed on rome (2026-11-01)
+
+- **LiveKit:** `/srv/summercms-demo/livekit.yaml` (0640 root:summercms-demo, own key pair generated on rome), the same pair in `.env` (secret line count 1), `/etc/supervisor/conf.d/summercms-demo-livekit.conf`, program started alone with `supervisorctl update summercms-demo-livekit`. `curl 127.0.0.1:7890/` answers OK, `/rtc/validate` 401.
+- **Centrifugo:** namespaces `["presentations","chat","user","video"]`, `checkconfig` passed, summercms-demo-centrifugo restarted. Backup `/srv/summercms-demo/centrifugo.json.bak-2026-11-01`.
+- **VAPID:** public key, private key and subject `mailto:` + DEMO_ADMIN_EMAIL appended to `.env` (count 3, values non-empty: 87 and 43 characters), generated with `bin/demo.new herald:vapid-generate --json -q`.
+- **Release** `c49fabf46c88` (sm-demo-app 6d726b4): 9 migrations (the chat family's tables), demo:seed created channels and history EN/PL, the visitor's welcome DM, forum categories and threads, friends and group, the moderator group demo-moderators and the moderation lists; binary and site swapped (`bin/demo.prev` 21e6abc585e6, `site/.output.prev`), summercms-demo and summercms-demo-site restarted, `websockets:health` reports the API key set.
+- **nginx:** the new vhost installed, `nginx -t` passed, reloaded. Previous vhost `/root/demo.summercms.io.nginx.bak-2026-11-01`.
+- **robots.txt:** `Disallow:` /_chat, /_chatchannels, /_chatbots, /_chatvideo, /_forum, /_userfriends and /livekit appended through `PUT /_seo/api/v1/robots` on loopback (bot switches untouched); the live file shows them with the Sitemap line. Previous rules `/root/summercms-demo-seo-robots.bak-2026-11-01.json`.
+- **Firewall (by the user):** service `/etc/vuurmuur/services/sm-demo-livekit` (`RANGE="6;7891*1024:65535"`, `RANGE="17;7892*1024:65535"`, no COMMENT), rule `Accept service sm-demo-livekit from any to firewall(any) options log,loglimit="30"` on line 1 of rules.conf. `iptables -S` shows NFLOG `vrmr: ACCEPT` and NEWACCEPT for `--dport 7891` and `--dport 7892` (66 vrmr lines, 62 before); `nc -zv 54.36.173.176 7891` connects. It differs from the proposal in the service name (`sm-demo-livekit`, not `summercms-demo-livekit`), the missing COMMENT and the position (first, not appended); no `rules.conf.bak-*` is in `/etc/vuurmuur/rules/` (the pre-change file was the 15-line one probed on 2026-10-31). DEPLOY.md records it and its removal commands use the applied names.
+- **WavePath untouched:** `wavepath-livekit` kept pid 1104 throughout (uptime 1 day 23:53 before, 2 days 0:09 after); no other non-demo program was restarted. Nothing was added to `/etc/livekit/livekit.yaml`.
+
+Supervisor status after the release: summercms-demo, summercms-demo-site, summercms-demo-centrifugo and summercms-demo-livekit RUNNING.
+
+## Checkpoint answers
+
+- **Task 3:** deploy.
+- **Task 5:** firewall done; the user applied the Vuurmuur rule, Claude made no firewall change and verified it read-only.
+
+## Verification
+
+- check-deploy: `check-deploy: ok`; negative copies (a /_herald location, LiveKit on another port, a UDP port range, bind 0.0.0.0, a real key, a cap mismatch, a wrong admin URL) each fail with their own line.
+- Local LiveKit 1.13.1 with the example: signal on 127.0.0.1:7890 only, ICE-TCP on *:7891, UDP 7892 per interface, /rtc/validate 401.
+- check-pins ok (25 modules); `build.sh release` → `build: ok release c49fabf46c88`; smoke ok; `go vet` and `go test -short ./...` green.
+- check-live against the live demo after the release and again after the firewall rule: `check-live: ok` (banner, CTA, /backend 404, /smbackend, /chat /forum /friends /call/1 prompts, six chat-family 401s, /livekit/rtc/validate from LiveKit, /_herald 404, robots lines, /ws 101, Back in a browser).
+- Acceptance greps: 6 chat-family locations, the program once, Vuurmuur 14+ times in DEPLOY.md. The plan's `grep -c 'location ^~ /livekit/'` prints 0 on this machine because `grep` is ugrep, which treats a mid-pattern `^` as an anchor (it also prints 0 for the existing `/_demo/` location); `grep -cF` prints 1.
+- Robots state: updated, see above. Nothing left for the user from robots.
+
+## Deviations from Plan
+
+**1. [Rule 1 - Bug] check-live's /_herald check** (Task 2, cf08fb5). The first version failed on any JSON answer, but Nuxt answers its 404 as JSON to curl's `Accept: */*`. It now wants status 404 (Go would answer 401 without a JWT).
+
+**2. [Rule 3 - Blocking] Release build prerequisites** (Tasks 2 and 4). `build.sh release` refused in Task 2: the uncommitted vue-demo-app gitlink (the plan's Task 4 bump), the user's untracked backup file (left untouched; the user removed it) and a stale ROADMAP snapshot (phase 20 progress lines). The snapshot was synced in Task 4 just before the build (6d726b4) so it matched the framework's master at release time.
+
+**3. [Rule 2 - Missing critical] Runbook safety on a shared host** (Task 1). The LiveKit secret goes into the files through bash builtins and stdin only (the Centrifugo runbook's `sed` put secrets in argv); the substitution is anchored on the newline and indent so a comment holding the placeholder cannot take it; `supervisorctl update` names the program; the new Centrifugo file is created 0640 before `tee` writes it; the vhost is backed up before it is replaced (added to "Release").
+
+**4. robots.txt through the loopback SEO API** (Task 4). DEPLOY.md's SEO section described a hand edit; the plan allowed an unattended path. The procedure is recorded in DEPLOY.md "Chat family".
+
+**5. check-live also covers /call/1 and /_chat** (Task 1), because SC-2 and SC-3 name them; the plan's list had /chat, /forum, /friends and five API prefixes.
+
+**Total deviations:** 5. **Impact:** none on the goal.
+
+## Boot-log warnings (rome and local alike)
+
+`golem15.chatchannels: ChannelAccessResolver is deny-all`, `golem15.forum: ForumAccessResolver is deny-all`, `golem15.chatbots: BotAuthResolver is deny-all` and `golem15.herald: PresenceGate is deny-all` appear at every boot, locally too (12 times each in the local go.log). They are logged before golem15.demo installs its resolvers in `lagoon.OnDatabase` (`plugins/demo/chat.go:68,86`); chatbots has no bot users and herald no UI (D-16). Plan 06's signed-in live checks confirm the wiring on rome.
+
+## Known Stubs
+
+None.
+
+## Left for the user
+
+Nothing required. Optional: keep a dated copy of the pre-change rules.conf if you want one next to the file (DEPLOY.md lists the 15 earlier rules). NAT'd-browser media is proven only by plan 06's live call; the TURN fallback needs its own decision.
+
+## Next Phase Readiness
+
+Plan 06 can run its live checks: the stale local demo servers from plan 04 are stopped, the live demo passes check-live, the media ports are reachable, and a signed-in member (Turnstile is closed in production, so a test account comes from the operator or the visitor account in rome's .env) can exercise chat, forum, friends and a two-browser DM call.
+
+## Self-Check: PASSED
+
+- sm-demo-app commits exist and are on origin: b5c639e, cf08fb5, c399bfd, 6d726b4, fcd8d95, f2e35c1 (remote master f2e35c1). vue-demo-app origin master 9357711.
+- Files exist: deploy/supervisor/summercms-demo-livekit.conf, the modified files above.
+- rome: summercms-demo-livekit RUNNING, `.env` LiveKit secret count 1, VAPID count 3, wavepath-livekit pid 1104 unchanged, check-live ok.

.planning/phases/20-demo-instance-with-every-shared-plugin/20-06-SUMMARY.md

@@ -0,0 +1,328 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 06
+subsystem: tests, sm-demo-app checks, vue-demo-app header
+tags: [tests, vitest, testcontainers, playwright, livekit, moderation, chat, forum, check-all, uat]
+
+requires:
+  - phase: 20-01
+    provides: "MessageSaving and PostSaving seams, golem15.moderation Filter"
+  - phase: 20-02
+    provides: "the demo host (contexts, policies, bootstrap, seed, reset, realtime guard)"
+  - phase: 20-03
+    provides: "vue-chat-layer v0.1.0"
+  - phase: 20-04
+    provides: "vue-forum-layer, vue-userfriends-layer and vue-chatvideo-layer v0.1.0"
+  - phase: 20-05
+    provides: "the chat family live on demo.summercms.io with its own LiveKit"
+provides:
+  - "Unit and database tests for the phase's new code in the plugin, layer and app repos that own it (SC-4)"
+  - "check-chat.cjs --two and --call; check-local chatlive and callmedia (two browsers, a DM call with fake media through the local LiveKit)"
+  - "check-all.sh runs the chat family's plugin suites, the four layer suites and the two-browser checks"
+  - "The live header: every site link on the left (menu entries, Chat, Forum, member links), only the language switcher and Log in/Log out on the right"
+affects: [phase-20 verification]
+
+actuals:
+  tokens: 82300    # chars/4 over the realized diffs of the nine repos (329253 chars, go.sum and the roadmap snapshot excluded)
+  tasks: 8
+  commits: 0       # MEASURED in summercms.go: git rev-list --count 8a3ac87..HEAD before this SUMMARY commit (docs only here); code commits: 18 across nine sibling repos (table below)
+plan_head_before: 8a3ac87abb6caa5d8d668fa9ead52fb0dcc24ee9   # summercms.go
+plan_head_after: 8a3ac87abb6caa5d8d668fa9ead52fb0dcc24ee9    # summercms.go before this SUMMARY commit
+
+tech-stack:
+  added:
+    - "sm-moderation-plugin: github.com/testcontainers/testcontainers-go v0.44.0 and github.com/jackc/pgx/v5 v5.10.0 as test-only dependencies (the decided versions the other plugins pin)"
+  patterns:
+    - "Fake LiveKit RoomService for Go tests: an httptest server answering /twirp/livekit.RoomService/* with empty protobuf bodies, so chatvideo's real RoomServiceClient path runs"
+    - "Nuxt composables tested outside Nuxt by stubbing the auto-imported globals (useState, useNuxtApp, useChatApi, ...) over a fresh state per test"
+    - "Two-browser Playwright checks with --use-fake-ui-for-media-stream and --use-fake-device-for-media-stream against the local LiveKit"
+
+key-files:
+  created:
+    - ../sm-moderation-plugin/classes/filter_test.go
+    - ../sm-moderation-plugin/classes/filter_internal_test.go
+    - ../sm-moderation-plugin/models/settings_test.go
+    - ../sm-moderation-plugin/plugin_test.go
+    - ../sm-chat-plugin/saving_test.go
+    - ../sm-forum-plugin/saving_test.go
+    - ../sm-demo-app/moderation_test.go
+    - ../sm-demo-app/chat_test.go
+    - ../sm-demo-app/video_test.go
+    - ../sm-demo-app/seed_chat_test.go
+    - ../sm-demo-app/plugins/demo/chatbots_test.go
+    - ../sm-demo-app/plugins/demo/classes/chat_context_test.go
+    - ../vue-chat-layer/app/lib/chatEvents.test.ts
+    - ../vue-chat-layer/app/lib/chatFormat.test.ts
+    - ../vue-chat-layer/app/lib/chatText.test.ts
+    - ../vue-chat-layer/app/lib/chatUnread.test.ts
+    - ../vue-chat-layer/app/lib/realtime.test.ts
+    - ../vue-chat-layer/app/lib/linkEmbeds.test.ts
+    - ../vue-chat-layer/app/lib/slots.ts
+    - ../vue-chat-layer/tests/client.test.ts
+    - ../vue-chat-layer/tests/store.test.ts
+    - ../vue-chat-layer/tests/support/http.ts
+    - ../vue-chatvideo-layer/tests/videoClient.test.ts
+    - ../vue-chatvideo-layer/tests/useCall.test.ts
+    - ../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts
+    - ../sm-demo-app/vue-demo-app/app/utils/communityAuth.test.ts
+    - ../sm-demo-app/vue-demo-app/app/components/SiteNav.vue
+  modified:
+    - ../sm-moderation-plugin/go.mod
+    - ../sm-moderation-plugin/README.md
+    - ../sm-demo-app/boot_test.go
+    - ../sm-demo-app/realtime_test.go
+    - ../sm-demo-app/reset_test.go
+    - ../sm-demo-app/scripts/check-chat.cjs
+    - ../sm-demo-app/scripts/check-local.sh
+    - ../sm-demo-app/scripts/check-all.sh
+    - ../sm-demo-app/README.md
+    - ../sm-demo-app/plugins/demo/content/ROADMAP.md
+    - ../vue-chat-layer/vitest.config.ts
+    - ../vue-chat-layer/app/components/Chat/Header.vue
+    - ../vue-chat-layer/README.md
+    - ../vue-chatvideo-layer/tests/callMachine.test.ts
+    - ../vue-chatvideo-layer/README.md
+    - ../vue-forum-layer/tests/client.test.ts
+    - ../vue-userfriends-layer/tests/client.test.ts
+    - ../sm-demo-app/vue-demo-app/app/plugins/auth.ts
+    - ../sm-demo-app/vue-demo-app/app/components/SiteHeader.vue
+    - ../sm-demo-app/vue-demo-app/app/assets/css/site.css
+    - ../sm-demo-app/vue-demo-app/i18n/locales/en.json
+    - ../sm-demo-app/vue-demo-app/i18n/locales/pl.json
+
+key-decisions:
+  - "Task 6 checkpoint: push. The tests found no bugs, so there were no fixes, no tags and no fix release; only branch pushes."
+  - "Task 8 round 1: the user approved the chat (and the DM video call) on the live demo, and asked for Chat and Forum in the header with every feature link on the left and only the language switcher and Log out on the right"
+  - "Chat and Forum are header links in a local SiteNav, not seeded menu entries: MenuNav has no slot for app items, so the member links could not sit in its mobile panel, and seeded entries would have needed a new binary and demo:seed on rome. The fix shipped as a site-only redeploy."
+  - "Task 8 round 2: approved (the live header and the live check, including the DM video call)"
+  - "The DM-only conversation-actions rule became a tested helper (dmActionsTarget) instead of a component mount: @vue/test-utils is in no lockfile"
+
+patterns-established:
+  - "check-all.sh covers every repo the demo's chat family depends on, with overridable *_PLUGIN_DIR and *_LAYER_DIR checkouts"
+
+requirements-completed: [SC-1, SC-2, SC-3, SC-4, D-01, D-02, D-04, D-05, D-06, D-07, D-08, D-09, D-11, D-12, D-13, D-14, D-15, D-17, D-18, D-20, D-21, D-22, D-23]
+
+coverage:
+  - id: D1
+    description: "Banned words and links from the settings row reach the filter, the demo listeners and the chat and forum seams: 422 under content, title or body on every write path, nothing stored, list changes live, disabled passes"
+    requirement: "D-17, D-18"
+    verification:
+      - kind: unit
+        ref: "../sm-moderation-plugin/classes/filter_test.go#TestMatchWords, TestMatchLinks, TestParseList"
+        status: pass
+      - kind: integration
+        ref: "../sm-demo-app/moderation_test.go#TestDemoModeration"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "The pre-save seams are silent without listeners and refuse totally with one (no row, no post-save event, no publication); a plain listener error stays 500"
+    requirement: "D-18"
+    verification:
+      - kind: integration
+        ref: "../sm-chat-plugin/saving_test.go#TestMessageSavingNoListener, TestMessageSavingRejects, TestMessageSavingOtherError"
+        status: pass
+      - kind: integration
+        ref: "../sm-forum-plugin/saving_test.go#TestPostSavingNoListener, TestPostSavingRejects"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Moderation settings limits, the filter cache and message locale, and the plugin's boot"
+    requirement: "D-17"
+    verification:
+      - kind: unit
+        ref: "../sm-moderation-plugin/models/settings_test.go#TestSettingsLimits; classes/filter_internal_test.go#TestFilterCheckCache, TestViolationMessage"
+        status: pass
+      - kind: integration
+        ref: "../sm-moderation-plugin/plugin_test.go#TestBootPublishesFilter, TestFilterCheckDisabled, TestFilterCheckReload"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Demo host: live membership, channel adapter, seeded-only channels, bootstrap JSON, members, DMs, moderator delete limited to channels, slash commands, DM video start against a fake RoomService, seed counts and idempotency, reset of every chat-family table, member-only realtime tokens, jwt.auth on every chat-family route"
+    requirement: "D-05, D-06, D-07, D-08, D-09, D-11, D-12, D-22, D-23"
+    verification:
+      - kind: integration
+        ref: "../sm-demo-app/chat_test.go, video_test.go#TestDemoVideoStart, seed_chat_test.go#TestSeedChat, reset_test.go#TestResetKeepsPlans, realtime_test.go#TestRealtimeMemberToken, boot_test.go#TestBootAllPlugins"
+        status: pass
+      - kind: unit
+        ref: "../sm-demo-app/plugins/demo/classes/chat_context_test.go, plugins/demo/chatbots_test.go#TestDemoCommands"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Layers: bm's chat tests unchanged on the port, the client, the multi-channel store, link embeds, the call machine, the video client, useCall on a mocked Room, the forum and friends clients, the site's auth hooks"
+    requirement: "D-01, D-02, D-04, D-05, D-13, D-14, D-15, D-21, D-23"
+    verification:
+      - kind: unit
+        ref: "pnpm test in vue-chat-layer (146), vue-chatvideo-layer (114), vue-forum-layer (12), vue-userfriends-layer (11), vue-demo-app (218)"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Two browsers locally: a live #general message with reaction and typing; a DM call with fake media, remote video on both sides, mute seen across, the session ended after both leave; no call button in #general"
+    requirement: "SC-2, D-11, D-13, D-23"
+    verification:
+      - kind: e2e
+        ref: "../sm-demo-app/scripts/check-local.sh chatlive callmedia (check-chat.cjs --two, --call)"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "The phase gate, ending with check-live against the live demo"
+    requirement: "SC-2, SC-3, SC-4"
+    verification:
+      - kind: e2e
+        ref: "../sm-demo-app/scripts/check-all.sh --local (check-all: ok)"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "Two-browser chat and a DM video call on https://demo.summercms.io, and the header with every link on the left"
+    requirement: "SC-2, SC-3"
+    verification:
+      - kind: manual
+        ref: "Task 8 UAT by the user: approved (after the header round)"
+        status: pass
+    human_judgment: true
+
+duration: about 3 h of work (2026-11-01 17:42Z to the header redeploy), with two checkpoints and one UAT round
+completed: 2026-11-02
+status: complete
+---
+
+# Phase 20 Plan 06: unit tests for the chat family, two-browser checks and the live sign-off Summary
+
+**The phase's new code is covered by tests in the repos that own it: the moderation filter and settings, both pre-save seams, the demo host (membership, channels, DMs, moderator delete, slash commands, video start against a fake LiveKit RoomService, seed, reset, realtime), bm's chat tests running unchanged on vue-chat-layer next to new client, store and link-embed tests, the call machine and useCall on a mocked Room, and the forum, friends and site auth clients. Two browsers prove live chat and a DM call with fake media locally, check-all gates every suite and ends green against the live demo, and the user approved the live chat, DM call and a reworked header.**
+
+## Test counts
+
+| Suite | Before | After |
+|---|---|---|
+| sm-moderation-plugin (Go top-level tests) | 2 | 16 |
+| sm-chat-plugin (Go) | 44 | 47 |
+| sm-forum-plugin (Go) | 16 | 18 |
+| sm-demo-app `./...` (Go) | 27 | 47 |
+| vue-chat-layer (vitest) | 6 | 146 |
+| vue-chatvideo-layer (vitest) | 10 | 114 |
+| vue-forum-layer (node --test) | 7 | 12 |
+| vue-userfriends-layer (node --test) | 6 | 11 |
+| vue-demo-app (vitest) | 209 | 218 |
+
+Go counts are top-level test functions (`go test -list`); the Docker tests ran in every verify (PASS lines counted).
+
+## Tests per repository
+
+- **sm-moderation-plugin:**
+  - `classes`: `TestMatchWords`, `TestMatchWordsFirstAndEmpty`, `TestMatchLinks`, `TestMatchLinksInvalidEntries`, `TestParseList`, `TestFilterCheckCache` and `TestViolationMessage`.
+  - `models`: `TestSettingsLimits`, `TestLinkEntry` and `TestSettingsModel`.
+  - root (testcontainers): `TestBootPublishesFilter`, `TestFilterCheckDisabled` and `TestFilterCheckReload`.
+- **sm-chat-plugin:** `TestMessageSavingNoListener`, `TestMessageSavingRejects` (send, reply, ReplyTo, edit; field empty, content or custom) and `TestMessageSavingOtherError`.
+- **sm-forum-plugin:** `TestPostSavingNoListener` and `TestPostSavingRejects` (thread, reply, edit; title, body or empty field; plain error 500).
+- **sm-demo-app:**
+  - `TestDemoModeration`.
+  - In chat_test.go: `TestDemoChatContextMembership`, `TestDemoChannelAdapter`, `TestDemoChannelsSeededOnly`, `TestDemoChatBootstrap`, `TestDemoChatMembers`, `TestDemoDMs`, `TestDemoModeratorDelete` and `TestDemoCommands` (HTTP).
+  - `TestDemoVideoStart`, `TestSeedChat` and `TestSeedChatWithoutVisitor`.
+  - Extended `TestResetKeepsPlans` and `TestBootAllPlugins`, and the new `TestRealtimeMemberToken`.
+  - In `plugins/demo/classes`: `TestDemoChatContextConstants`, `TestDemoChatContextMembershipHooks`, `TestDemoChatContextLoaders`, `TestDemoChatAccess`, `TestDemoForumAccess` and `TestDemoMembershipWithoutDatabase`.
+  - In `plugins/demo`: `TestDemoCommands`.
+- **vue-chat-layer:**
+  - bm's `chatEvents`, `chatFormat`, `chatText`, `chatUnread` and `realtime` tests next to their ports (only the imports differ).
+  - `linkEmbeds.test.ts`, `tests/client.test.ts` and `tests/store.test.ts`.
+- **vue-chatvideo-layer:** `callMachine.test.ts` (every event in every state), `videoClient.test.ts` and `useCall.test.ts` (`vi.mock('livekit-client')`).
+- **vue-forum-layer, vue-userfriends-layer:** every client method's refusal and answer, and the error bodies.
+- **vue-demo-app:** `app/utils/communityAuth.test.ts`. The existing `app/lib/realtime.test.ts` still passes through the re-export.
+
+**What TestDemoVideoStart recorded for a channel start.** Seeded #general has 5 participants (4 personas plus the caller) against `max_participants` 4. A start there answers 422 "Conversation has too many participants for a video call". With 2 participants it answers 201, so the server has no conversation-type rule; calls are limited to DMs only by the UI (D-23). The DM start answers 201, then 200 with the same session on a second start and for the other side. The token claims (issuer, user id, room) verify with the test secret, and CreateRoom reached the fake Twirp RoomService exactly once with a bearer token.
+
+## Task commits
+
+| Task | Repo | Commit | Message |
+|---|---|---|---|
+| 1 | sm-moderation-plugin | 8a93cc8 | test: word, phrase and link matching of the filter |
+| 1 | sm-demo-app | a660add | test: moderation end to end through the chat and forum seams |
+| 2 | sm-moderation-plugin | 313d117 | test: settings limits, filter cache and locale, boot publishes the filter |
+| 2 | sm-chat-plugin | 6539dd2 | test: MessageSaving parity, refusals on every write path and other errors |
+| 2 | sm-forum-plugin | 13aa642 | test: PostSaving parity and refusals on thread, reply and edit |
+| 3 | sm-demo-app | 08b7784 | test: demo chat family |
+| 4 | vue-chat-layer | 764cb42 | refactor: the DM-only conversation-actions rule as a helper |
+| 4 | vue-chat-layer | b6d3389 | test: the SPA's chat tests on the port, client, store and link embeds |
+| 4 | vue-chatvideo-layer | 8222255 | test: every call transition, the video client and useCall on a fake Room |
+| 4 | vue-forum-layer | 4780824 | test: every forum client method's refusal and answer, error bodies |
+| 4 | vue-userfriends-layer | 6a5f6ce | test: every friends client method's refusal and answer, error bodies |
+| 4 | vue-demo-app | 0c1a66b | refactor: community auth hooks into app/utils |
+| 4 | vue-demo-app | ec45480 | test: community auth hooks |
+| 5 | sm-demo-app | 9b9da38 | test: two-browser chat and call checks; phase gate covers the chat family |
+| 5 | sm-demo-app | 3d86215 | chore: bump vue-demo-app (community auth hooks and their tests) |
+| 5 | sm-demo-app | 71ff755 | chore: sync the roadmap snapshot |
+| 6 | — | — | checkpoint: **push** |
+| 7 | all nine | — | branch pushes; check-all: ok |
+| 8 | vue-demo-app | deb809f | feat: every site link on the left of the header, with Chat and Forum |
+| 8 | sm-demo-app | 2cd4640 | chore: bump vue-demo-app (header: all links left, Chat and Forum) |
+| 8 | — | — | site-only redeploy on rome; UAT: **approved** |
+
+Every repo was pushed with plain fast-forwards. `git ls-remote origin` equals local HEAD for each:
+
+| Repo | Pushed head |
+|---|---|
+| sm-moderation-plugin | 313d117 |
+| sm-chat-plugin | 6539dd2 |
+| sm-forum-plugin | 13aa642 |
+| vue-chat-layer | b6d3389 |
+| vue-chatvideo-layer | 8222255 |
+| vue-forum-layer | 4780824 |
+| vue-userfriends-layer | 6a5f6ce |
+| vue-demo-app | deb809f |
+| sm-demo-app | 2cd4640 |
+
+No tags were created in this plan.
+
+## Checkpoint answers and the UAT
+
+- **Task 6:** push. No bugs were found, so there were no fixes and no fix release; only branch pushes.
+- **Task 7:** `check-all.sh --local` printed `check-all: ok`. It covered:
+  - every suite: the app, the MCP-tagged app, sm-user, sm-journal, chat, forum and moderation with Docker, `-short` of chatchannels, chatbots, chatvideo, herald and userfriends, vitest in vue-demo-app and the four layers;
+  - `check-pins: ok (25 modules)`, `build: ok release e50834496975`, `smoke: ok` and `check-deploy: ok`;
+  - `check-local: ok back remote chatlive callmedia`;
+  - `check-live: ok` against https://demo.summercms.io.
+- **Task 8, round 1:** "chat itself approved, but it's missing in navbar … make all to the left, and on the right just language and logout."
+  - Fix: `SiteNav` renders the main menu's entries (vue-menu-layer's `MenuNavItem`), then Chat and Forum for everyone, then My presentations, Friends and Security for members, in one list. The right side keeps only the language switcher and Log in or Log out.
+  - Below 1180px every link is in the menu panel, so the member links are reachable on phones too. Phone spacing was tightened to fit 390px.
+  - Checked with Playwright at 1280, 1440, 1024 and 390px, as visitor and member, in EN and PL. Also `check-local tour chat back`, `smoke.sh`, vue-demo-app's tests and build.
+  - Released site-only after the user's "yes":
+    - pushed deb809f and 2cd4640;
+    - `build: ok release f9fa556fd20e`, `smoke: ok`;
+    - rsynced only `vue-demo-app/.output/` to `site/.output.new`, swapped it in (`.output.prev` kept) and restarted only `summercms-demo-site` (RUNNING, pid 1773325);
+    - `check-live: ok`;
+    - the anonymous live header shows Home, Journal, FAQ, Subscriptions, Chat, Forum (PL: Start, Blog, FAQ, Subskrypcje, Czat, Forum) on the left and EN/PL and Log in on the right.
+  - The binary, config, migrations, `demo:seed`, nginx, Centrifugo and LiveKit were untouched. Site rollback: `sudo mv site/.output site/.output.bad && sudo mv site/.output.prev site/.output && sudo supervisorctl restart summercms-demo-site`.
+- **Task 8, round 2:** approved. This covers the live header and the live check, including the two-browser chat and the DM video call.
+
+## Deviations from Plan
+
+1. **Slot helper instead of a component mount.** @vue/test-utils is in no lockfile, so ChatHeader's inline DM-only `v-if` became `dmActionsTarget` (`vue-chat-layer/app/lib/slots.ts`, 764cb42, no behaviour change) and is tested in the store test. It is on vue-chat-layer main, untagged; the demo still pins v0.1.0.
+2. **Where the filter tests landed.** `TestFilterCheckCache` is an internal test in `classes`. The database tests (`TestFilterCheckDisabled`, `TestFilterCheckReload`) are in the plugin root's `plugin_test.go` with the sitemap-style harness, not in `filter_test.go`. Extra tests were added (listed above).
+3. **Test-only dependencies.** sm-moderation-plugin's go.mod gained testcontainers-go v0.44.0 and pgx v5.10.0, resolved offline with `GOPROXY=off` from the versions the other plugins already pin. The README Testing section names them.
+4. **The ported realtime test.** vue-chat-layer's `realtime.test.ts` is vue-demo-app's adapted copy of bm's test (a stubbed token route). The vitest config maps bm's `@/api/http` to `tests/support/http.ts`. The other four bm tests match bm's after `describe` (diff empty).
+5. **Split chatvideo test file.** The video-client part of `callMachine.test.ts` moved into a new `videoClient.test.ts`.
+6. **Extra demo tests.** `TestSeedChatWithoutVisitor`; `TestDemoCommands` exists in `plugins/demo` (the command objects) and in the root package (HTTP); `TestBootAllPlugins` checks `jwt.auth` on every chat-family route.
+7. **Commits needed by the gate.** The vue-demo-app pointer bump (3d86215) and a roadmap snapshot sync (71ff755) were committed in Task 5. `build.sh release` refuses a dirty tree and a stale snapshot, and the framework's ROADMAP had moved since plan 05.
+8. **The check-back hook.** The header rework kept the `site-header__mine` class on the member links and keeps the text out of template comments. scripts/check-back.cjs (also run by check-live) relies on it, so the live check works on the old and the new site alike.
+9. **Header breakpoint.** The panel takes over below 1180px rather than only below 768px, because nine links for a member do not fit on one row below that width.
+
+**Total deviations:** 9. **Impact on plan:** none on the goal. No production behaviour changed except the header, which the user asked for in the UAT.
+
+## Notes
+
+- **Banned-link prefix matching.** A banned-link entry with a path matches by string prefix, so `shop.example/promo` also matches `/promotions`. That's what the README and the admin form say ("starts with"); the plan said "only below its path". It is not pinned by a test.
+- **A stale snapshot reddens the gate.** Any later commit to the framework ROADMAP turns `check-all` red at `sync-roadmap --check` until the demo's snapshot is synced and committed.
+- **Leftover dev process.** A `nuxt dev` from Oct 22 (pids 212159 and 212194) still runs in vue-demo-app, listening on no port. It was left alone, as instructed.
+- **Phone header before this plan.** At 390px the visitor's Polish header ("Zaloguj się") probably overflowed already; the header round fixed it along the way.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None. The new surface is test code and check scripts. The scripts read the visitor's credentials only through check-local's existing `.env` helper and never print them; the header change adds links to existing pages.
+
+## Self-Check: PASSED
+
+- Commits exist on their remotes: sm-moderation-plugin 8a93cc8 and 313d117; sm-chat-plugin 6539dd2; sm-forum-plugin 13aa642; vue-chat-layer 764cb42 and b6d3389; vue-chatvideo-layer 8222255; vue-forum-layer 4780824; vue-userfriends-layer 6a5f6ce; vue-demo-app 0c1a66b, ec45480 and deb809f; sm-demo-app a660add, 08b7784, 9b9da38, 3d86215, 71ff755 and 2cd4640 (`ls-remote` heads above).
+- The key files listed above exist in their repos.
+- rome: summercms-demo-site RUNNING with `site/.output` (new) and `site/.output.prev`; check-live ok.

.planning/phases/20-demo-instance-with-every-shared-plugin/20-07-PLAN.md

@@ -0,0 +1,255 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 07
+type: execute
+wave: 7
+depends_on: ["20-06"]
+gap_closure: true
+review_findings: [CR-02, CR-03]
+files_modified:
+  - ../sm-moderation-plugin/classes/filter.go
+  - ../sm-moderation-plugin/classes/normalize.go
+  - ../sm-moderation-plugin/classes/html.go
+  - ../sm-moderation-plugin/classes/bypass_test.go
+  - ../sm-moderation-plugin/classes/html_test.go
+  - ../sm-moderation-plugin/classes/filter_test.go
+  - ../sm-moderation-plugin/models/settings.go
+  - ../sm-moderation-plugin/models/settings_test.go
+  - ../sm-moderation-plugin/plugin_test.go
+  - ../sm-moderation-plugin/go.mod
+  - ../sm-moderation-plugin/go.sum
+  - ../sm-moderation-plugin/README.md
+  - ../sm-forum-plugin/events/events.go
+  - ../sm-forum-plugin/classes/forum_service.go
+  - ../sm-forum-plugin/classes/lifecycle.go
+  - ../sm-forum-plugin/saving_test.go
+  - ../sm-forum-plugin/README.md
+autonomous: true
+requirements: [D-17, D-18, SC-2]
+estimate:
+  tokens: 170000
+  raw_tokens: 170000
+  tasks: 3
+  confidence: low
+must_haves:
+  truths:
+    - "CR-03, D-17: classes.Match and Filter.Check refuse every word bypass the reviewer listed: a zero-width space or soft hyphen inside a banned word (and every other format character), a no-break, thin or ideographic space between the words of a banned phrase, decomposed (NFD) Polish diacritics against an NFC entry, fullwidth letters, HTML entities (viagra) and inline markup inside a word (via**gra**, via`gra`, _viagra_). Matching is diacritic-insensitive (zolw matches the entry żółw) and reports the entry as listed."
+    - "CR-02, D-17: classes.Match and Filter.Check refuse every link bypass the reviewer listed: a percent-encoded host (bit%2Ely, bit.l%79), fullwidth letters and ideographic, fullwidth or halfwidth dots in the host, a port in front of a path rule (example.com:443/promo), a percent-encoded or doubled path (/%70romo, //promo), a trailing dot (example.com./promo), a subdomain of a path rule (sub.example.com/promo), userinfo (user@bit.ly), an entity in a link destination ([x](https://bit.ly/a)), and either spelling of an IDN (punycode against Unicode, both ways). The http(s) scheme with no or mixed slashes and backslashes after the colon (https:bit.ly) counts as the host it opens."
+    - "Clean text stays clean: every existing case of TestMatchWords, TestMatchWordsFirstAndEmpty, TestMatchLinks, TestMatchLinksInvalidEntries and TestParseList keeps its expectation, except `a.shop.example/promo`, which the review's subdomain rule now flags."
+    - "CR-03, D-18: forum's events.PostSaving carries HTML, the content_html breakwater renders from Body, on thread, reply and edit; the value equals what is stored. With no listener the forum's routes, payloads, stored rows and status codes are unchanged, and the existing seam, golden and method-map tests pass unedited."
+    - "CR-03: classes.MatchHTML and Filter.CheckHTML read rendered HTML as a member sees it (text across inline tags joined, entities decoded, href and src values as links), so the forum's Markdown forms the raw check cannot see (bit\\.ly, via<!-- x -->gra, [x](https:bit.ly), a reference link with an entity in its destination) are refused once a host checks PostSaving.HTML."
+    - "No new module enters the build: golang.org/x/text v0.42.0 and golang.org/x/net v0.58.0 become direct requires of sm-moderation-plugin at the versions the framework already requires directly (summercms.go go.mod), resolved offline."
+  artifacts:
+    - path: "../sm-moderation-plugin/classes/normalize.go"
+      provides: "text normaliser (entities, NFKC, format characters, Unicode spaces, diacritics, inline markup) and the link-candidate canonicaliser (percent-decoding, dots, IDNA, port, userinfo, path)"
+      contains: "norm.NFKC"
+    - path: "../sm-moderation-plugin/classes/html.go"
+      provides: "MatchHTML and Filter.CheckHTML over x/net/html tokens"
+      contains: "func MatchHTML"
+    - path: "../sm-moderation-plugin/classes/bypass_test.go"
+      provides: "the reviewer's probes as regression tests"
+      contains: "TestMatchBypassLinks"
+    - path: "../sm-forum-plugin/events/events.go"
+      provides: "PostSaving.HTML"
+      contains: "HTML"
+  key_links:
+    - from: "../sm-forum-plugin/classes/forum_service.go"
+      to: "../sm-forum-plugin/events/events.go"
+      via: "CreateThread and Reply render first and fire PostSaving with HTML set to the rendered body"
+      pattern: "HTML: *html"
+    - from: "../sm-forum-plugin/classes/lifecycle.go"
+      to: "../sm-forum-plugin/events/events.go"
+      via: "EditPost renders first and fires PostSaving with HTML"
+      pattern: "HTML: *html"
+    - from: "../sm-moderation-plugin/classes/filter.go"
+      to: "../sm-moderation-plugin/classes/normalize.go"
+      via: "compile folds every entry and match runs on the normalised text, Check and Match alike"
+      pattern: "normali[sz]e"
+  prohibitions:
+    - statement: "sm-moderation-plugin imports neither sm-chat-plugin nor sm-forum-plugin."
+      status: unresolved
+      verification: automated
+    - statement: "No push, tag or deploy in this plan; sm-demo-app is not edited here (its listener change needs the new tags and lands in 20-09)."
+      status: unresolved
+      verification: judgment
+    - statement: "Forum's HTTP API, stored columns, migrations and config keys do not change; PostSaving gains a field and nothing else changes shape."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format; no story is invented here): sm-demo-app runs every shared plugin and its public site shows them working, deployed publicly.
+
+This plan's slice (gap round after the code review, plan 7 of 9, wave 7): the moderation filter refuses what members actually see, not only the literal text they type. It closes CR-02 (banned-link bypass through URL forms browsers normalise) and CR-03 (banned-word bypass through invisible characters, Unicode spaces, decomposed diacritics and forum Markdown) from 20-REVIEW.md, in the two repositories that own the code: sm-moderation-plugin (the filter) and sm-forum-plugin (the pre-save seam passes the rendered post).
+
+**Unit tests rule for this gap round:** the project rule "unit tests are the last plan of every phase" is met because every fix in this plan ships with its own regression tests in the repository that owns the code, and plan 20-09 runs every touched repository's full suite before anything is tagged.
+
+## Decisions taken in this plan (Claude's discretion, recorded)
+
+- **Where the rendered text comes from.** Forum renders the body before it fires PostSaving and passes the result in a new field `HTML` (additive; the review's second option, "so every host gets it"). The moderation plugin offers `MatchHTML` and `Filter.CheckHTML` to read it. Moderation stays free of chat and forum imports; HTML is generic, so a later host (journal posts, a rich editor) can use the same call.
+- **The raw check stays and gets stronger.** `Check` and `Match` normalise the text themselves (entities, NFKC, format characters, Unicode spaces, diacritics, inline markup inside words), so chat messages, which the browser renders with vue-chat-layer's inline renderer, and forum titles are covered without any host change. The three forum forms the reviewer reproduced (via**gra**, vi&#97;gra, an entity in a link destination) are already refused on the raw body by this normalisation; `CheckHTML` adds the forms only the renderer resolves.
+- **The demo listener.** `plugins/demo/moderation.go` `checkMessage` needs no change (Check normalises). `checkPost` needs one more check, `CheckHTML` on `ev.HTML`, which compiles only against the new moderation and forum tags. sm-demo-app's go.work points at the submodule checkouts pinned to the current tags, so that edit is made in 20-09 right after the dependency bumps, keeping every sm-demo-app commit buildable. This plan records the finding in its SUMMARY.
+- **Dependencies (CLAUDE.md rule).** `golang.org/x/text` (unicode/norm) and `golang.org/x/net` (idna for punycode, html for the tokenizer) move from indirect to direct requires of sm-moderation-plugin. Both are already direct requires of the framework at v0.42.0 and v0.58.0 (summercms.go go.mod), already in the plugin's go.sum and in the module cache, and sm-journal-plugin imports `x/net/html` directly (.planning/notes/journal-html-sanitizing-bluemonday.md). The standard library has no NFKC, IDNA or HTML tokenizer. This plan is the phase note that names them; the README's Dependencies section says so too.
+- **Diacritic-insensitive matching** folds both the entries and the text: NFD, drop nonspacing marks, recompose, plus a small map for the letters that have no decomposition (ł, đ, ø, ħ, ŧ and their capitals). An entry is reported as listed, so `Match` keeps answering "żółw", not its folded form.
+- **Path rules match subdomains** as host rules do (the review's fix). This flips one existing expectation, `a.shop.example/promo`, from clean to flagged; the plan updates that case and no other.
+- **Versions.** The next patch tags are v0.1.1 for sm-moderation-plugin (its latest tag is v0.1.0; the brief's v0.1.2 assumed a v0.1.1 that does not exist) and v0.1.2 for sm-forum-plugin (latest v0.1.1). The README changelog entries name those versions; 20-09 re-checks the tags before the release gate.
+- spec-less probe fallback skipped: phase has no requirement IDs to probe (visible skip).
+
+<objective>
+Make the banned-word and banned-link filter match what a member sees: normalise the text and every link candidate before matching, read rendered forum HTML, and give the forum seam the rendered post.
+
+Purpose: D-17 (banned words and links refused in chat and forum) holds against anyone who tries more than once; D-18's seam carries what the forum stores. Closes CR-02 and CR-03 server-side.
+Output: commits in ../sm-moderation-plugin and ../sm-forum-plugin (not pushed, not tagged), with regression tests for every bypass the reviewer listed.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-CONTEXT.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-06-SUMMARY.md
+
+Repos: ../sm-moderation-plugin (main at 313d117, tag v0.1.0) and ../sm-forum-plugin (main at 13aa642, tag v0.1.1). Both have a tracked go.work (`use .`, framework replaced by ../summercms.go). Read-only reference: ../sm-demo-app/plugins/demo/moderation.go (the listener), ../summercms.go/modules/breakwater (Render), ../sm-demo-app/plugins/demo/console/seed_friends.go (the demo's default lists: buy followers, casino bonus, free crypto, viagra; bit.ly).
+
+Rules: no co-author tags; stage files by explicit path; plugin code and planning docs in separate commits; no push or tag (20-09 does both after a go-ahead); framework code and these plugins name no consuming application (README examples use `acme`); check `git status` in each repo before editing and leave edits that are not this plan's alone. Docker tests skip under `-short`; if the Docker socket is denied, run the Docker tests through `sudo -u golem` (CLAUDE.md). Resolve modules offline: `GOFLAGS=-mod=mod GOPROXY=off` for `go mod tidy`.
+
+The reviewer's probe: /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/0fc9bf8a-bc2a-4cab-8faa-51763a879541/scratchpad/modtest/main_test.go (a module that replaces sm-moderation-plugin with the sibling checkout; run it with `GOWORK=off GOFLAGS=-mod=mod GOPROXY=off go test -v` in that directory). It may be gone after a reboot; its cases are copied into bypass_test.go in Task 1 and Task 2, which are the record.
+
+<interfaces>
+sm-moderation-plugin today (classes/filter.go): consts KindWord, KindLink; type Violation {Kind, Match, Message}; `boundary` = non-letter, non-digit, non-underscore; `hostPattern` regexp (labels of letters, digits, inner hyphens, a dot; optional http(s) scheme; optional path); `ParseList(text) []string` (trim, lower-case, collapse whitespace, dedupe); unexported `compile(words, links) (*matcher, error)` and `(*matcher).match(text) *Violation` (words regexp `(?i)(?:^|boundary)(alt|alt)(?:$|boundary)` with `\s+` between phrase words; link rules {entry, host, path}, host rules match the host and its subdomains, path rules the same host and a path prefix); `Match(words, links, text) *Violation` (pure); `Filter` {db, tr, cache} with `NewFilter(db)`, `SetTranslator(tr)`, `Check(ctx, text) (*Violation, error)` (reads row 1, enabled switch, recompiles on change, translated message).
+models/settings.go: `LinkEntry(entry) (host, path string, ok bool)` (host entry or http(s) URL, lower-cased, www. and trailing dot dropped, path unescaped, port and userinfo refused), `ValidHost(h)`, `Lines`, `Text`, `Settings.BeforeValidate` (uses LinkEntry to refuse bad link entries).
+sm-forum-plugin: events.PostSaving {ContextType, ContextID, ActorID, ThreadID, PostID, Title, Body, Op}; fire sites CreateThread (classes/forum_service.go, Fire at ~284, Render at ~290), Reply (~341, Render ~347), EditPost (classes/lifecycle.go ~235, Render ~241), each guarded by `s.bus != nil`; tests saving_test.go TestPostSavingNoListener, TestPostSavingRejects (Docker harness).
+breakwater.Render output for the forum probes (checked during planning): via**gra** → `<p>via<strong>gra</strong></p>`; vi&#97;gra → `<p>viagra</p>`; [x](https://bit&#46;ly/a) → an anchor with href https://bit.ly/a; bit\.ly → `<p>bit.ly</p>`; via<!-- -->gra → `<p>viagra</p>`; [x](https:bit.ly) → href "https:bit.ly"; _viagra_ → `<em>viagra</em>`; a reference link `[x][1]` with `[1]: https://bit&#46;ly/r` → href https://bit.ly/r.
+Go facts (checked during planning): net/url refuses a percent-escape in the host ("invalid URL escape %2E"), so the authority is percent-decoded before parsing; `idna.Lookup.ToASCII` maps fullwidth letters and the dots U+3002, U+FF0E and U+FF61 and gives punycode for an IDN (żółw.pl → xn--w-uga1v8h.pl); NFKC maps fullwidth letters and U+FF0E but not U+3002.
+</interfaces>
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: a banned word split by a zero-width space and a banned host written as bit%2Ely are refused by Match and by Filter.Check, through one normaliser and one link canonicaliser, under test</name>
+  <precondition>`git -C ../sm-moderation-plugin status --porcelain` prints nothing and `git -C ../sm-moderation-plugin rev-parse HEAD` equals `git -C ../sm-moderation-plugin ls-remote origin refs/heads/main` (fast-forward base).</precondition>
+  <files>../sm-moderation-plugin/classes/normalize.go, ../sm-moderation-plugin/classes/filter.go, ../sm-moderation-plugin/classes/bypass_test.go, ../sm-moderation-plugin/plugin_test.go, ../sm-moderation-plugin/go.mod, ../sm-moderation-plugin/go.sum</files>
+  <read_first>../sm-moderation-plugin/classes/filter.go (whole file), classes/filter_test.go (runMatch helper and the existing cases), classes/filter_internal_test.go, plugin_test.go (TestMain, the testcontainers harness, TestFilterCheckDisabled), models/settings.go (LinkEntry), go.mod, 20-REVIEW.md CR-02 and CR-03, the scratchpad probe main_test.go</read_first>
+  <action>Per D-17, closing the first case of CR-03 and of CR-02 end to end.
+1. Red first: create classes/bypass_test.go (package classes_test, reusing the runMatch shape of filter_test.go) with `TestMatchBypassWords` holding one case, the word "viagra" with a U+200B zero-width space after "via", and `TestMatchBypassLinks` holding one case, "https://bit%2Ely/x" against the host entry bit.ly. Lists come from `classes.ParseList` of the demo defaults (words "buy followers", "casino bonus", "free crypto", "viagra"; links "bit.ly" and "example.com/promo"). Run them and see both fail.
+2. classes/normalize.go (new, unexported helpers, doc comments in the file's style):
+   - a text normaliser used by both Match and Filter.Check: decode HTML entities once with the standard library's `html.UnescapeString`, apply `norm.NFKC` (golang.org/x/text/unicode/norm), drop every rune of category Cf (zero-width space, joiners, word joiner, BOM, soft hyphen, bidi controls), and turn every rune that `unicode.IsSpace` or the Z categories accept into a plain space;
+   - a link-candidate canonicaliser: given one candidate (with or without an http(s) scheme), percent-decode its authority once (the WHATWG parser does; net/url refuses an escape in the host), parse it with net/url, take `Hostname()` (this drops the port and userinfo), lower-case it, drop a trailing dot and a leading "www.", and convert it with `idna.Lookup.ToASCII` (golang.org/x/net/idna), falling back to the lower-cased NFKC form when ToASCII refuses the label.
+3. classes/filter.go: `compile` folds each word entry with the same normaliser before quoting it, and remembers the entry as listed; `match` normalises the text first; link candidates found in the text go through the canonicaliser, and rule hosts are converted to their ASCII form once in compile. Keep `Violation.Match` the entry as listed (ParseList's form). This task only needs candidate extraction to see "bit%2Ely" as one host: widen candidate extraction so a host may contain percent-escapes (Task 2 replaces it with full tokenising).
+4. go.mod: `GOFLAGS=-mod=mod GOPROXY=off go -C ../sm-moderation-plugin mod tidy`; golang.org/x/text and golang.org/x/net move to the direct block at v0.42.0 and v0.58.0 (no version change, no new module).
+5. plugin_test.go: add `TestFilterCheckNormalises` (Docker, the existing harness): with the settings row holding the demo default lists, `Filter.Check` on the zero-width-space word answers KindWord "viagra" and on "https://bit%2Ely/x" KindLink "bit.ly", and clean text answers nil.
+6. Make both bypass tests and every existing test green. Commit in sm-moderation-plugin: `fix: normalise text and link hosts before matching banned entries`.</action>
+  <verify>
+    <automated>go -C ../sm-moderation-plugin vet ./... &amp;&amp; go -C ../sm-moderation-plugin test -count=1 -short ./... &amp;&amp; go -C ../sm-moderation-plugin test -count=1 -short -run '^(TestMatchBypassWords|TestMatchBypassLinks)$' -v ./classes 2>&amp;1 | grep -c -- '^--- PASS: TestMatchBypass' | grep -qx 2 &amp;&amp; go -C ../sm-moderation-plugin test -count=1 -run '^TestFilterCheckNormalises$' .</automated>
+    <fails_when>Non-zero exit: vet fails, an existing short test breaks, either bypass test is missing or red, or the Docker test TestFilterCheckNormalises fails (the stored lists do not reach the normalised matcher).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -cE '^\s+golang.org/x/(text|net) v0\.(42|58)\.0$' ../sm-moderation-plugin/go.mod` prints 2 (both direct, without the indirect comment).
+    - `go -C ../sm-moderation-plugin list -deps ./... | grep -cE 'sm-(chat|forum)-plugin'` prints 0.
+  </acceptance_criteria>
+  <done>One invisible-character word and one percent-encoded host are refused by the pure matcher and by the stored-list filter, and the tracer's normaliser and canonicaliser are the single path every later case goes through.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Every word and link bypass the reviewer listed is refused, entries are normalised the same way, and clean text stays clean</name>
+  <files>../sm-moderation-plugin/classes/normalize.go, ../sm-moderation-plugin/classes/filter.go, ../sm-moderation-plugin/classes/bypass_test.go, ../sm-moderation-plugin/classes/filter_test.go, ../sm-moderation-plugin/models/settings.go, ../sm-moderation-plugin/models/settings_test.go, ../sm-moderation-plugin/README.md</files>
+  <read_first>The Task 1 code, classes/filter_test.go (all cases), models/settings_test.go (TestLinkEntry), README.md (Features, Usage, API reference, Dependencies, Testing, Changelog), 20-REVIEW.md CR-02 table and CR-03 list, ../vue-chat-layer/app/lib/markdown.ts formatSpans and ../vue-chat-layer/app/lib/chatText.ts CODE_RE (the inline markup chat renders)</read_first>
+  <behavior>
+    - Words (TestMatchBypassWords): viagra split by U+200B, U+00AD, U+200D, U+2060 or U+FEFF; "buy followers" with U+00A0, U+2009, U+202F or U+3000 between the words; fullwidth ｖｉａｇｒａ; vi&#97;gra and vi&#x61;gra; via**gra**, via`gra`, via~~gra~~ and _viagra_; with the entry żółw, its NFD spelling (z plus U+0307, o plus U+0301, ł, w) and the folded spelling zolw both flag and report "żółw".
+    - Words that must stay clean: spam_bot, _spam, spamming (with spam listed), and every existing TestMatchWords case.
+    - Links (TestMatchBypassLinks), against bit.ly and example.com/promo: https://bit%2Ely/x, https://bit.l%79/x, bit.l%79/x, https://ｂｉｔ.ｌｙ/x, https://bit。ly/x, https://bit．ly/x, https://bit｡ly/x, https://user@bit.ly/x, https://example.com@bit.ly/, [x](https://bit&#46;ly/a), https:bit.ly, https:/\bit.ly/x, https://bit.ly./x, https://example.com:443/promo, https://example.com/%70romo, https://example.com//promo, https://example.com/./promo, https://example.com./promo, https://sub.example.com/promo; with the entry żółw.example, https://xn--w-uga1v8h.example/ flags, and with the entry xn--w-uga1v8h.example, https://żółw.example/ flags.
+    - Links that must stay clean: https://notbit.ly/x, https://example.com/about, https://example.com/x/promo, https://bit.lyx/, and every existing TestMatchLinks case except a.shop.example/promo, which now flags (path rules cover subdomains).
+  </behavior>
+  <action>Per D-17, closing CR-02 and the text half of CR-03.
+- Extend bypass_test.go with every case of the behavior block (one table per test, each case commented with the bypass it pins), then make it green:
+  - normaliser: after the Task 1 steps, fold diacritics (NFD, drop category Mn, recompose with NFC, then map ł Ł đ Đ ø Ø ħ Ħ ŧ Ŧ to their base letters); the same function folds the entries in compile, and a map from folded entry to listed entry keeps `Violation.Match` as listed. Join the words of a phrase with `[\p{Z}\s]+`.
+  - markup: `match` runs the words and links on two forms of the text, first the normalised text, then the same text with inline markup removed: every asterisk, backtick and tilde dropped, and an underscore pair around a word (`_word_` between boundaries, the rule of vue-chat-layer's formatSpans) unwrapped. A lone underscore stays a word character, so spam_bot and _spam stay clean.
+  - links: replace the regexp candidate extraction with tokenising: split the normalised text on whitespace and on the delimiters `<>"'()[]{}`, trim trailing sentence punctuation (.,;:!?), and treat a token as a candidate when it has an http(s) scheme or contains a dot after the dot mapping. For http and https, any run of slashes and backslashes after the colon (none included) counts as `//`, as the WHATWG parser reads special schemes. The candidate's path is percent-decoded and cleaned with path.Clean after a leading slash (collapses //, /./ and dot segments) and compared lower-cased. A path rule matches its host and every subdomain, like a host rule.
+- models/settings.go `LinkEntry`: apply NFKC and the dot mapping to the entry, and return the host in its IDNA ASCII form (`idna.Lookup.ToASCII`); an entry whose host ToASCII refuses is not ok, so the admin form refuses it. Existing ASCII cases of TestLinkEntry keep their results; change the żółw.example case to expect its punycode host and add cases for a fullwidth entry and an entry with U+3002.
+- filter_test.go: change only the a.shop.example/promo case to expect a KindLink violation for https://shop.example/promo, with a comment that path rules cover subdomains (CR-02).
+- README.md: Features (normalisation and link canonicalisation, in plain words, with the list of forms), Usage unchanged, API reference (LinkEntry's ASCII host), Dependencies (golang.org/x/text and golang.org/x/net, why, at the framework's versions), Testing (the new test names), Changelog `### v0.1.1` (banned entries match what members see: invisible characters, Unicode spaces, diacritics, entities, inline markup, URL forms browsers normalise; path rules cover subdomains; no schema, config or API change other than LinkEntry's ASCII host). Name no application.
+- Commit in sm-moderation-plugin: `fix: match banned words and links in the forms browsers show`.</action>
+  <verify>
+    <automated>go -C ../sm-moderation-plugin vet ./... &amp;&amp; go -C ../sm-moderation-plugin test -count=1 -short ./... &amp;&amp; go -C ../sm-moderation-plugin test -count=1 ./... &amp;&amp; P=/tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/0fc9bf8a-bc2a-4cab-8faa-51763a879541/scratchpad/modtest; if [ -f "$P/main_test.go" ]; then (cd "$P" &amp;&amp; GOWORK=off GOFLAGS=-mod=mod GOPROXY=off go test -count=1 -v . 2>&amp;1 | grep -c 'flagged=false' | grep -qx 0); fi</automated>
+    <fails_when>Non-zero exit: vet fails; a short or Docker test fails (a bypass case still passes, a clean case is now flagged, an existing expectation other than a.shop.example/promo changed, LinkEntry refuses a valid entry); or the reviewer's probe, when it still exists, prints any flagged=false line.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `go -C ../sm-moderation-plugin test -count=1 -short -run '^TestMatchBypass(Words|Links)$' -v ./classes 2>&amp;1 | grep -c -- '^--- PASS'` prints 2.
+    - `grep -F 'a.shop.example/promo' ../sm-moderation-plugin/classes/filter_test.go | grep -c 'KindLink'` prints 1 (the one existing case that changed), and `git -C ../sm-moderation-plugin diff --stat 313d117 -- classes/filter_test.go` reports 1 deletion (the old case line; the insertions are the new case and its comment).
+    - `grep -c '### v0.1.1' ../sm-moderation-plugin/README.md` prints 1.
+  </acceptance_criteria>
+  <done>No word or link form from the review gets past the filter, an admin's entry matches in every spelling a browser accepts, and every clean sentence the earlier tests pinned still passes.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: The forum seam carries the rendered post, and the filter reads rendered HTML the way a member sees it</name>
+  <files>../sm-moderation-plugin/classes/html.go, ../sm-moderation-plugin/classes/html_test.go, ../sm-moderation-plugin/README.md, ../sm-forum-plugin/events/events.go, ../sm-forum-plugin/classes/forum_service.go, ../sm-forum-plugin/classes/lifecycle.go, ../sm-forum-plugin/saving_test.go, ../sm-forum-plugin/README.md</files>
+  <read_first>../sm-forum-plugin/events/events.go, classes/forum_service.go (CreateThread, Reply), classes/lifecycle.go (EditPost, Preview), saving_test.go (harness, TestPostSavingNoListener, TestPostSavingRejects), README.md (Features "Pre-save seam", API reference, Testing, Changelog), ../summercms.go/modules/breakwater/breakwater.go (Render, the sanitiser policy: which tags and attributes survive), ../sm-demo-app/plugins/demo/moderation.go (checkPost, read only), the Task 2 normaliser</read_first>
+  <behavior>
+    - TestMatchHTML (moderation, -short): for each forum probe, MatchHTML(defaults, breakwater.Render(probe)) is a violation: via**gra**, vi&#97;gra, _viagra_, via`gra`, via<!-- x -->gra (word "viagra"); [x](https://bit&#46;ly/a), [x](https:bit.ly), bit\.ly, a reference link [x][1] with [1]: https://bit&#46;ly/r, and an autolink <https://bit.ly/x> (link "bit.ly"). Clean Markdown (a heading, a list, a link to https://example.org/about, code with "via" in one span and "gra" in another paragraph) is not.
+    - Text across inline tags joins without a boundary (via<strong>gra</strong> is "viagra"); block tags and <br> separate (<p>via</p><p>gra</p> is clean); href and src values are link candidates; alt and title text is checked as words.
+    - TestPostSavingHTML (forum, Docker): a recording listener sees, for a thread, a reply and an edit, HTML equal to the content_html stored for that post; a body of vi&#97;gra gives HTML that contains "viagra"; TestPostSavingNoListener and TestPostSavingRejects pass unchanged.
+  </behavior>
+  <action>Per D-17 and D-18, closing the forum half of CR-03.
+sm-forum-plugin:
+- events/events.go: add the field `HTML` to PostSaving, documented as the content_html that would be stored, rendered by breakwater from Body (sanitised), set on every Op. Update the package and type comments: the event fires after the Markdown is rendered and before anything is persisted.
+- classes/forum_service.go (CreateThread, Reply) and classes/lifecycle.go (EditPost): call `breakwater.Render(body)` before the Fire and pass the result as `HTML`; the transaction stores the same value. Behaviour without a listener is byte-identical (the render only moves up). Update the doc comments of the three methods.
+- saving_test.go: add TestPostSavingHTML per the behavior block.
+- README.md: Features "Pre-save seam" (fires after render, carries HTML), API reference row for PostSaving with HTML, the acme listener example also checking `ev.HTML`, Testing (TestPostSavingHTML), Changelog `### v0.1.2` (PostSaving carries the rendered HTML; additive, no route, payload, table, migration or config change). Commit in sm-forum-plugin: `feat: PostSaving carries the rendered post HTML`.
+sm-moderation-plugin:
+- classes/html.go: `MatchHTML(words, links []string, html string) *Violation` (pure) and `(*Filter).CheckHTML(ctx, html string) (*Violation, error)` (the same settings row, enabled switch, cache and translated message as Check). Walk the HTML with the golang.org/x/net/html tokenizer: text tokens (the tokenizer decodes entities) appended as they come, with no separator for inline elements and a newline for block elements and br; the values of href and src checked as link candidates on their own; alt and title appended as text. Then run the Task 2 matcher (both forms) on the joined text, words before links, and on each attribute URL.
+- classes/html_test.go: TestMatchHTML per the behavior block, rendering with breakwater (a framework module the plugin already requires).
+- README.md: Usage gets the host pattern for rendered content (check the source text with Check and the rendered HTML with CheckHTML, as in the acme example); API reference rows for MatchHTML and Filter.CheckHTML; Testing; the v0.1.1 changelog entry gains "MatchHTML and Filter.CheckHTML read rendered HTML". Commit in sm-moderation-plugin: `feat: MatchHTML and Filter.CheckHTML for rendered content`.
+- Read ../sm-demo-app/plugins/demo/moderation.go and write into the SUMMARY: checkMessage needs no change; checkPost needs `CheckHTML(ctx, ev.HTML)` after title and body (field body), which 20-09 adds after bumping the demo to these tags. Do not edit sm-demo-app here.</action>
+  <verify>
+    <automated>go -C ../sm-forum-plugin vet ./... &amp;&amp; go -C ../sm-forum-plugin test -count=1 -short ./... &amp;&amp; go -C ../sm-forum-plugin test -count=1 -run '^(TestPostSavingNoListener|TestPostSavingRejects|TestPostSavingHTML|TestPostSavingTracer)$' . &amp;&amp; go -C ../sm-moderation-plugin vet ./... &amp;&amp; go -C ../sm-moderation-plugin test -count=1 -short -run '^TestMatchHTML$' -v ./classes 2>&amp;1 | grep -q -- '^--- PASS: TestMatchHTML' &amp;&amp; go -C ../sm-moderation-plugin test -count=1 ./...</automated>
+    <fails_when>Non-zero exit: forum vet or tests fail (the HTML field differs from the stored content_html, the no-listener path changed, a refusal stopped working), TestMatchHTML is missing or red (a rendered probe passes, clean Markdown is flagged), or any moderation test fails.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -cE 'HTML: *html' ../sm-forum-plugin/classes/forum_service.go` prints 2 and `grep -cE 'HTML: *html' ../sm-forum-plugin/classes/lifecycle.go` prints 1.
+    - `grep -c '### v0.1.2' ../sm-forum-plugin/README.md` prints 1.
+    - `grep -cE 'MatchHTML|CheckHTML' ../sm-moderation-plugin/README.md` prints at least 3.
+  </acceptance_criteria>
+  <done>A host can refuse a forum post by what its readers will see, and the two plugins are ready for their patch tags with every bypass pinned by a test.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| member text to the filter | untrusted chat messages, forum titles and Markdown bodies, any Unicode |
+| filter to the member's browser | what passes is rendered as text, links and link cards by the chat renderer, goldmark and the WHATWG URL parser |
+| admin settings to the filter | banned entries typed by an administrator, any Unicode |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-20-38 | Spoofing | banned-link matching (classes/normalize.go, filter.go) | high | mitigate | candidates are canonicalised the way browsers resolve them (percent-decoded authority, IDNA ASCII, dots mapped, port and userinfo dropped, special-scheme slashes, cleaned path) and compared with entries in the same form; TestMatchBypassLinks pins every form from CR-02 |
+| T-20-39 | Tampering | banned-word matching | high | mitigate | NFKC, format characters dropped, Unicode spaces folded, diacritics folded on both sides, entities decoded, inline markup removed in a second pass; TestMatchBypassWords pins every form from CR-03 |
+| T-20-40 | Tampering | forum Markdown rendered after the check | high | mitigate | PostSaving carries the rendered HTML and CheckHTML reads it as a member sees it; TestPostSavingHTML and TestMatchHTML pin the rendered forms (wired in the demo in 20-09) |
+| T-20-41 | Denial of service | normalising and matching large texts | low | accept | RE2 is linear, lists are bounded by max_entries and max_entry_length, the work is two passes over a message the plugins already cap in size |
+| T-20-SC | Tampering | Go module installs | high | mitigate | no new module: golang.org/x/text v0.42.0 and golang.org/x/net v0.58.0 are already direct requires of the framework and in go.sum; tidy runs with GOPROXY=off, so nothing is fetched |
+</threat_model>
+
+<verification>
+- Task 1: vet, short tests, the two tracer bypass tests and the Docker TestFilterCheckNormalises.
+- Task 2: the full moderation suite with Docker; every reviewer probe flagged; one existing expectation flipped on purpose.
+- Task 3: forum suite with the HTML seam test and the unchanged seam tests; TestMatchHTML on breakwater output; the demo listener finding recorded for 20-09.
+</verification>
+
+<success_criteria>
+Every bypass in CR-02 and CR-03 is refused by the filter and pinned by a regression test, the forum seam passes the rendered post (D-18, additive), clean text is still accepted, and both plugins are committed, untagged, ready for 20-09's release gate.
+</success_criteria>
+
+<output>
+Create `.planning/phases/20-demo-instance-with-every-shared-plugin/20-07-SUMMARY.md` when done: the commits per repo, the probe table (form, before, after), the one changed expectation, the dependency note, and the listener finding for 20-09 (checkMessage unchanged, checkPost adds CheckHTML on ev.HTML).
+</output>

.planning/phases/20-demo-instance-with-every-shared-plugin/20-07-SUMMARY.md

@@ -0,0 +1,185 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 07
+subsystem: moderation filter (sm-moderation-plugin) and forum pre-save seam (sm-forum-plugin)
+status: complete
+gap_closure: true
+review_findings: [CR-02, CR-03]
+tags: [moderation, normalisation, idna, nfkc, forum, seam, security]
+requires: [20-06]
+provides:
+  - "classes.Match / Filter.Check normalise text and links before matching (CR-02, CR-03)"
+  - "classes.MatchHTML / Filter.CheckHTML read rendered HTML as members see it"
+  - "models.CanonicalHost; models.LinkEntry returns the IDNA ASCII host"
+  - "forum events.PostSaving.HTML (the content_html that is stored)"
+affects: [20-09 (dependency bumps, demo listener, tags)]
+tech-stack:
+  added: []
+  patterns:
+    - "normalise both sides: entries and text through the same fold, entry reported as listed"
+    - "two passes per text (as typed, without inline markup), words before links"
+    - "link candidates canonicalised like the WHATWG URL parser (percent-decoded authority, last @, port dropped, IDNA ASCII, special-scheme slashes, cleaned path)"
+key-files:
+  created:
+    - ../sm-moderation-plugin/classes/normalize.go
+    - ../sm-moderation-plugin/classes/html.go
+    - ../sm-moderation-plugin/classes/bypass_test.go
+    - ../sm-moderation-plugin/classes/html_test.go
+  modified:
+    - ../sm-moderation-plugin/classes/filter.go
+    - ../sm-moderation-plugin/classes/filter_test.go
+    - ../sm-moderation-plugin/models/settings.go
+    - ../sm-moderation-plugin/models/settings_test.go
+    - ../sm-moderation-plugin/plugin_test.go
+    - ../sm-moderation-plugin/go.mod
+    - ../sm-moderation-plugin/README.md
+    - ../sm-forum-plugin/events/events.go
+    - ../sm-forum-plugin/classes/forum_service.go
+    - ../sm-forum-plugin/classes/lifecycle.go
+    - ../sm-forum-plugin/saving_test.go
+    - ../sm-forum-plugin/README.md
+decisions:
+  - "Hosts go through a WHATWG-like UTS #46 profile (lookup mapping, bidi and joiner rules, CheckHyphens and STD3 off) rather than idna.Lookup, which refuses names browsers open (ab--c.example)"
+  - "The authority is split by hand (last @, last :) instead of net/url, which errors on escapes and odd ports and would drop the candidate"
+  - "The old host regexp stays as a second candidate source next to tokenising, so every host the old matcher found (url=bad.example) is still found"
+  - "The markup pass also drops a backslash before ASCII punctuation, so the raw check refuses bit\\.ly too"
+  - "Combining marks Mn and Me are dropped when folding; Cc controls that are not spaces are dropped with Cf"
+metrics:
+  duration: 20min
+  started: 2026-11-02T17:29:01Z
+  completed: 2026-11-02T17:49:03Z
+  tasks: 3
+  files: 16
+actuals:
+  tokens: 17100
+  tasks: 3
+  commits: 4
+plan_head_before: "sm-moderation-plugin 313d117, sm-forum-plugin 13aa642 (summercms.go: no code commits)"
+plan_head_after: "sm-moderation-plugin 334697b, sm-forum-plugin ec1a82c"
+---
+
+# Phase 20 Plan 07: Filter hardening for CR-02 and CR-03 Summary
+
+The moderation filter now matches text and links the way a member reads and a browser opens them: NFKC, dropped format characters, Unicode spaces, folded diacritics, entities and inline markup for words; percent-decoding, IDNA ASCII, mapped dots, port and userinfo, special-scheme slashes and cleaned paths for links. Rendered forum HTML can be checked with `CheckHTML`, and forum's `PostSaving` now carries that HTML.
+
+## Commits
+
+The plan's code lives in the two sibling repos. Nothing was pushed or tagged. The `commits: 4` above was counted with `git rev-list --count` from each repo's base. The summercms.go repo has no code commits; this SUMMARY is left uncommitted for the orchestrator.
+
+| Repo | Hash | Subject |
+|------|------|---------|
+| sm-moderation-plugin | 266fc60 | fix: normalise text and link hosts before matching banned entries |
+| sm-moderation-plugin | 9715ce7 | fix: match banned words and links in the forms browsers show |
+| sm-moderation-plugin | 334697b | feat: MatchHTML and Filter.CheckHTML for rendered content |
+| sm-forum-plugin | ec1a82c | feat: PostSaving carries the rendered post HTML |
+
+## Probe table
+
+Lists: words `buy followers`, `casino bonus`, `free crypto`, `viagra`; links `bit.ly`, `example.com/promo`. "Before" is v0.1.0 (313d117); every row was also checked with the reviewer's scratchpad probe, which now prints no `flagged=false` line.
+
+| Form | Before | After | Where pinned |
+|------|--------|-------|--------------|
+| `via<U+200B>gra`, soft hyphen, ZWJ, word joiner, BOM | clean | word viagra | TestMatchBypassWords |
+| `buy<NBSP/U+2009/U+202F/U+3000>followers` | clean | word buy followers | TestMatchBypassWords |
+| fullwidth `ｖｉａｇｒａ` | clean | word viagra | TestMatchBypassWords |
+| `vi&#97;gra`, `vi&#x61;gra` | clean | word viagra | TestMatchBypassWords, TestMatchHTML |
+| `via**gra**`, ``via`gra` ``, `via~~gra~~`, `_viagra_` | clean | word viagra | TestMatchBypassWords, TestMatchHTML |
+| NFD `żółw`, folded `zolw` (entry żółw) | clean | word żółw (as listed) | TestMatchBypassWords |
+| `https://bit%2Ely/x`, `https://bit.l%79/x`, `bit.l%79/x` | clean | link bit.ly | TestMatchBypassLinks, TestFilterCheckNormalises |
+| `https://ｂｉｔ.ｌｙ/x`, `bit。ly`, `bit．ly`, `bit｡ly` | clean | link bit.ly | TestMatchBypassLinks |
+| `https://user@bit.ly/x`, `https://example.com@bit.ly/` | flagged (the regexp found bit.ly after the @) | link bit.ly | TestMatchBypassLinks |
+| `[x](https://bit&#46;ly/a)` | clean | link bit.ly | TestMatchBypassLinks, TestMatchHTML |
+| `https:bit.ly`, `https:/\bit.ly/x`, `https:\\bit.ly` | flagged (regexp found the bare host) | link bit.ly | TestMatchBypassLinks |
+| `https://bit.ly./x` | flagged | link bit.ly | TestMatchBypassLinks |
+| `example.com:443/promo`, `/%70romo`, `//promo`, `/./promo`, `/x/../promo`, `example.com./promo` | clean | link example.com/promo | TestMatchBypassLinks |
+| `https://sub.example.com/promo` | clean | link example.com/promo | TestMatchBypassLinks |
+| punycode against a Unicode entry, and the reverse | clean | link (entry as listed) | TestMatchBypassLinks |
+| rendered `via<!-- x -->gra`, `bit\.ly`, reference link with an entity, `<https://bit.ly/x>` | clean (raw) | flagged by MatchHTML | TestMatchHTML |
+| clean: `spam_bot`, `_spam`, `spamming`, `notbit.ly`, `/about`, `/x/promo`, `bit.lyx`, `<p>via</p><p>gra</p>` | clean | clean | bypass and HTML tests |
+
+## The one changed expectation
+
+`TestMatchLinks`: `a.shop.example/promo` against the entry `https://shop.example/promo` was clean and now flags (KindLink, entry as listed). Path rules cover subdomains, as host rules do (CR-02). `git diff --stat 313d117 -- classes/filter_test.go` shows 2 insertions (the comment and the case) and 1 deletion. No other existing case changed.
+
+`TestLinkEntry`: the `żółw.example` case now expects `xn--w-uga1v8h.example`. New cases cover fullwidth letters, U+3002 and U+FF61 dots, an ASCII punycode entry, `ab--c.example` (accepted) and the invalid punycode `xn--zz.example` (refused).
+
+## Dependency note
+
+`golang.org/x/text v0.42.0` (unicode/norm) and `golang.org/x/net v0.58.0` (idna, html) moved from indirect to direct requires of sm-moderation-plugin. The framework already requires both directly at these versions. `go mod tidy` ran with `GOPROXY=off`, go.sum did not change, and no new module entered the build. The README's Dependencies section names both. `go list -deps ./...` shows no sm-chat-plugin or sm-forum-plugin import.
+
+## Listener finding for 20-09
+
+`../sm-demo-app/plugins/demo/moderation.go` (read only, not edited):
+
+- `checkMessage` needs no change: `Check` now normalises the chat text itself.
+- `checkPost` should call `f.CheckHTML(ctx, ev.HTML)` after the title and body checks, and reject under field `body` when it flags. This only compiles against the new tags (sm-forum-plugin v0.1.2 for `PostSaving.HTML`, sm-moderation-plugin v0.1.1 for `CheckHTML`). The demo's go.work uses the submodule checkouts at `plugins/golem15/{forum,moderation}`, currently at v0.1.1 and v0.1.0. So the edit belongs right after 20-09 bumps those submodules.
+- Even without that edit, the raw `Check` on the body now refuses `via**gra**`, `vi&#97;gra`, `_viagra_`, `[x](https://bit&#46;ly/a)`, `[x](https:bit.ly)` and `bit\.ly`. Only the forms the renderer alone resolves, such as a comment inside a word or a reference-link destination with an entity, need `CheckHTML`.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] TestPostSavingNoListener had to gain the HTML field**
+- **Found during:** Task 3
+- **Issue:** The plan said the existing seam tests pass unedited. But `TestPostSavingNoListener` compares whole `PostSaving` values with `slices.Equal`, so the new field made it fail.
+- **Fix:** The three expected events now carry `HTML: breakwater.Render(body)`. Nothing else in the test changed. `TestPostSavingRejects`, `TestPostSavingTracer`, the golden and method-map tests are unedited and pass.
+- **Files modified:** ../sm-forum-plugin/saving_test.go
+- **Commit:** ec1a82c
+
+**2. [Rule 1 - Bug] WHATWG-like IDNA profile instead of `idna.Lookup`**
+- **Found during:** Task 2
+- **Issue:** `idna.Lookup` checks hyphens. It refuses `ab--c.example`, a name browsers open. Used in `LinkEntry`, that would make the admin form reject a valid entry.
+- **Fix:** `models.CanonicalHost` uses `idna.New(MapForLookup, BidiRule, Transitional(false), CheckHyphens(false), StrictDomainName(false), CheckJoiners(true))`, which is UTS #46 as the URL standard applies it. Punycode results are the same (`żółw.example` → `xn--w-uga1v8h.example`). It is one exported function used by both `LinkEntry` and the matcher, so entries and candidates are always read alike.
+- **Files modified:** ../sm-moderation-plugin/models/settings.go
+- **Commit:** 9715ce7
+
+**3. [Rule 1 - Bug] Authority split by hand, not with net/url**
+- **Issue:** `url.Parse` errors on some decoded hosts and on non-numeric ports. Each such error would silently drop a candidate.
+- **Fix:** `canonicalLink` takes the text after the last `@`, drops a `:port` and passes the host to CanonicalHost. This gives the same result as `Hostname()` for valid URLs and never drops a candidate.
+- **Commit:** 266fc60
+
+**4. [Rule 2 - Missing functionality] The host regexp stays next to tokenising**
+- **Issue:** The plan said to replace the regexp with tokenising. Tokens alone miss a host glued to other text (`url=bad.example`, `a,bad.example`), which the old matcher found.
+- **Fix:** `matchLinks` checks the tokens first, then every `hostPattern` match (widened for percent-escapes). The union can only add matches, and every must-stay-clean case still passes.
+- **Commit:** 9715ce7
+
+**5. [Rule 2 - Missing functionality] Small additions to the normaliser**
+- The markup pass also drops a backslash before ASCII punctuation (a Markdown escape), so the raw check refuses `bit\.ly`.
+- Controls (Cc) that are not spaces are dropped along with Cf.
+- Diacritic folding drops enclosing marks (Me) along with Mn.
+- **Commit:** 266fc60, 9715ce7
+
+**6. [Rule 2 - Test coverage] Extra tests**
+- `TestFilterCheckNormalises` also covers `CheckHTML` through the stored lists: word, link with the pl message, clean, disabled.
+- `TestMatchHTMLWalk` pins the tokenizer walk: inline joins, block/br/td separation, href, src, alt and title, comments and scripts.
+- **Commit:** 334697b
+
+**7. [Rule 1 - Bug] Invisible characters escaped in test sources**
+- The first bypass test was committed with a literal U+200B in its source (266fc60). In 9715ce7 every invisible or combining character in the test sources became a `\uXXXX` escape, so the cases can be read and reviewed.
+
+### TDD notes
+
+- Task 1: RED was seen before any code changed. Both tracer tests failed with "got no violation".
+- Task 2: RED was seen before the code changed: 19 "got no violation" failures across TestMatchBypassWords, TestMatchBypassLinks and the flipped TestMatchLinks case.
+- Task 3: the HTML tests were written after `html.go`, and both passed on their first run. RED was not observed separately.
+
+## Test results
+
+- sm-moderation-plugin: `go vet ./...` is clean. `go test -short ./...` and `go test ./...` (Docker Postgres) pass. That covers TestMatchBypassWords, TestMatchBypassLinks, TestMatchHTML, TestMatchHTMLWalk, TestLinkEntry and TestFilterCheckNormalises.
+- sm-forum-plugin: `go vet ./...` is clean. `go test -short ./...` and `go test ./...` (Docker) pass, including TestPostSavingTracer, TestPostSavingNoListener, TestPostSavingRejects and TestPostSavingHTML.
+- Reviewer probe (scratchpad modtest): all 20 cases print `flagged=true`.
+- Acceptance greps: go.mod has 2 direct x/text and x/net lines. There are 0 chat/forum deps. `HTML: html` appears 2 times in forum_service.go and once in lifecycle.go. Each README has one changelog heading (`### v0.1.1` moderation, `### v0.1.2` forum). MatchHTML/CheckHTML appear 11 times in the moderation README.
+
+## Known limitations (not stubs)
+
+- Path rules are prefixes, as before: `example.com/promo` also matches `/promotional`. This behaviour is older than this plan and was not changed.
+- IPv4 forms a browser normalises (`0x7f.1`, dotless decimals) and IPv6 literals are not canonicalised. No listed entry in the review relies on them.
+
+## Threat Flags
+
+None. No new endpoint, auth path, file access or schema change. PostSaving gains a read-only field.
+
+## Self-Check: PASSED
+
+- FOUND: classes/normalize.go, classes/html.go, classes/bypass_test.go, classes/html_test.go (sm-moderation-plugin)
+- FOUND commits: 266fc60, 9715ce7, 334697b (sm-moderation-plugin), ec1a82c (sm-forum-plugin)

.planning/phases/20-demo-instance-with-every-shared-plugin/20-08-PLAN.md

@@ -0,0 +1,324 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 08
+type: execute
+wave: 7
+depends_on: ["20-06"]
+gap_closure: true
+review_findings: [CR-01, WR-01, WR-04, WR-05, CR-02]
+files_modified:
+  - ../vue-chatvideo-layer/app/composables/useCall.ts
+  - ../vue-chatvideo-layer/app/lib/videoClient.ts
+  - ../vue-chatvideo-layer/app/components/Chatvideo/Call.vue
+  - ../vue-chatvideo-layer/app/components/Chatvideo/IncomingCall.vue
+  - ../vue-chatvideo-layer/app/assets/css/chatvideo-base.css
+  - ../vue-chatvideo-layer/i18n/locales/en.json
+  - ../vue-chatvideo-layer/i18n/locales/pl.json
+  - ../vue-chatvideo-layer/tests/useCall.test.ts
+  - ../vue-chatvideo-layer/tests/videoClient.test.ts
+  - ../vue-chatvideo-layer/README.md
+  - ../vue-chat-layer/app/lib/urlGuard.ts
+  - ../vue-chat-layer/app/lib/urlGuard.test.ts
+  - ../vue-chat-layer/app/lib/markdown.ts
+  - ../vue-chat-layer/app/lib/linkEmbeds.ts
+  - ../vue-chat-layer/app/lib/linkEmbeds.test.ts
+  - ../vue-chat-layer/README.md
+  - ../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts
+  - ../sm-demo-app/vue-demo-app/app/utils/communityAuth.test.ts
+  - ../sm-demo-app/vue-demo-app/app/plugins/auth.ts
+  - ../sm-demo-app/vue-demo-app/app/composables/useDemoAuth.ts
+autonomous: true
+requirements: [SC-2, D-02, D-04, D-11, D-13, D-17, D-23]
+estimate:
+  tokens: 230000
+  raw_tokens: 230000
+  tasks: 5
+  confidence: low
+must_haves:
+  truths:
+    - "CR-01, D-13: a call the user leaves, or whose page unmounts, while start or join is pending, while livekit-client loads, while LiveKit connects or between enabling the camera and the microphone never publishes media after the leave: no Room connects after it, setCameraEnabled and setMicrophoneEnabled are not called after it, a Room already created is disconnected, and once the server session exists the starter posts end and the callee posts leave. Leave works in the starting and connecting states. A second begin while one is pending creates no second Room."
+    - "WR-05: a failed LiveKit connect posts end when the session has nobody joined besides this user (GET status), and leave otherwise; when status cannot be read, the starter posts end and the callee leave."
+    - "WR-04, D-11, D-13, D-23: ChatvideoCall starts media on mount only when an in-memory handoff younger than a minute shows the user just clicked: the DM call button's start answer (start) or the incoming prompt's Accept (join). A direct load or a chat link to /call/{id}, with or without ?start=1, shows a confirmation with a Start call or Join call button and calls neither video/start nor video/join and opens no LiveKit connection until it is clicked."
+    - "CR-02 (client side), D-02, D-17: the chat renders as text, with no link and no link card, any http(s) URL whose host as written is not the host the browser opens: a percent-escape, userinfo or a backslash in the authority, ideographic, fullwidth or halfwidth dots, fullwidth letters, a trailing dot, or a scheme not followed by exactly two slashes. Honest URLs, IDN hosts written in Unicode, ports, queries and fragments still link and embed. bm's copied chat tests pass unchanged."
+    - "WR-01, D-04: logging out (header or login page) and the chat's unauthorized() reset the chat store, close the shared realtime socket and dismiss a ringing call prompt in the same tab; one failing part does not stop the others; the next login starts from empty chat state with a fresh connection token."
+    - "Every fix has vitest regression tests in the repository that owns it; vue-demo-app builds and passes its tests on its current layer pins (v0.1.0 already exports useChat().reset, the realtime disconnect and useIncomingCalls().dismiss); nothing is pushed or tagged here."
+  artifacts:
+    - path: "../vue-chatvideo-layer/app/composables/useCall.ts"
+      provides: "per-attempt token, stale checks after every await, leave from the pre-room states, failed-connect end rule"
+      contains: "attempt"
+    - path: "../vue-chatvideo-layer/app/lib/videoClient.ts"
+      provides: "hasStart, rememberAccept, takeAccept and callAutostart (the click handoffs)"
+      contains: "callAutostart"
+    - path: "../vue-chatvideo-layer/app/components/Chatvideo/Call.vue"
+      provides: "the join confirmation"
+      contains: "chatvideo-confirm"
+    - path: "../vue-chat-layer/app/lib/urlGuard.ts"
+      provides: "honestHttpUrl"
+      contains: "honestHttpUrl"
+    - path: "../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts"
+      provides: "createCommunitySignOut and endSession"
+      contains: "createCommunitySignOut"
+  key_links:
+    - from: "../vue-chatvideo-layer/app/components/Chatvideo/IncomingCall.vue"
+      to: "../vue-chatvideo-layer/app/lib/videoClient.ts"
+      via: "Accept leaves the join handoff before it navigates"
+      pattern: "rememberAccept"
+    - from: "../vue-chatvideo-layer/app/components/Chatvideo/Call.vue"
+      to: "../vue-chatvideo-layer/app/lib/videoClient.ts"
+      via: "mount begins only when callAutostart answers true"
+      pattern: "callAutostart"
+    - from: "../vue-chat-layer/app/lib/markdown.ts"
+      to: "../vue-chat-layer/app/lib/urlGuard.ts"
+      via: "safeUrl allows an http(s) target only through honestHttpUrl"
+      pattern: "honestHttpUrl"
+    - from: "../vue-chat-layer/app/lib/linkEmbeds.ts"
+      to: "../vue-chat-layer/app/lib/urlGuard.ts"
+      via: "linkify and messageUrls parse through honestHttpUrl"
+      pattern: "honestHttpUrl"
+    - from: "../sm-demo-app/vue-demo-app/app/plugins/auth.ts"
+      to: "../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts"
+      via: "the plugin builds the sign-out and hands it to createChatAuth and to logout"
+      pattern: "createCommunitySignOut"
+  prohibitions:
+    - statement: "No push, tag or pin change in this plan; vue-demo-app keeps its v0.1.0 layer pins and the sm-demo-app gitlink is not bumped (20-09)."
+      status: unresolved
+      verification: judgment
+    - statement: "No new package in any package.json or lockfile; tests use vitest, vi.mock and pure helpers (no @vue/test-utils, which no lockfile has)."
+      status: unresolved
+      verification: automated
+    - statement: "Neither layer names a consuming application or a host path."
+      status: unresolved
+      verification: automated
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format; no story is invented here): sm-demo-app runs every shared plugin and its public site shows them working, video calls included.
+
+This plan's slice (gap round after the code review, plan 8 of 9, wave 7, parallel with 20-07: no shared file): the call and session fixes from 20-REVIEW.md in the repositories that own the code.
+- CR-01: leaving or unmounting during start or join still connected and published the camera and microphone.
+- WR-05: a failed connect posted leave and left an empty ringing session.
+- WR-04: a link opened a call and turned media on with no confirmation.
+- WR-01: logout left the previous user's chat store, realtime socket and call prompt running.
+- The client half of CR-02: the chat's link-embed rendering gets the guard the brief asked for; the server half is 20-07.
+
+**Unit tests rule for this gap round:** the project rule "unit tests are the last plan of every phase" is met because every fix here ships with vitest regression tests in the repository that owns it, and 20-09 runs every touched repository's full suite before anything is tagged.
+
+## Decisions taken in this plan (Claude's discretion, recorded)
+
+- **One attempt token** (the review's fix shape). `begin` increments an attempt counter and dispatches `start` before its first await, for the callee too, so the state leaves idle at once and Leave and unmount always see a live attempt. After every await (the start or join answer, the livekit-client import, connect, each media toggle) it bails out when the attempt is stale. `leave()` invalidates the attempt. The call machine already moves starting → connecting on `joined`, so it needs no change.
+- **Who posts what after a stale answer.** When the start or join answer arrives after a leave, the server session exists only from that moment, so `begin`'s stale branch posts `end` (starter) or `leave` (callee) itself. `leave()` posts only when an answer has already arrived for the attempt. This avoids the 404 that the current code's premature `end` produced.
+- **"Alone" after a failed connect (WR-05).** The review's formula (`start || remoteParticipants.size === 0`) would end the call for a waiting caller whenever a callee's connect fails, because a room that never connected has no remote participants. The plan uses the server's view instead: GET status, alone when at most one participant has status `joined` (chatvideo marks the starter joined at start and the callee at join). Fallback on a status error: the starter ends, the callee leaves.
+- **Confirmation (WR-04).** The autostart decision is a pure helper, `callAutostart(conversationId, start)`, over in-memory handoffs that a link cannot create: the call button's start answer (existing `rememberStart`, now readable with `hasStart` without taking it) and a new Accept marker (`rememberAccept`, `takeAccept`), each valid for a minute. `?start=1` stays in the demo's call path but only chooses Start over Join on the confirmation. The rule is tested as a helper because @vue/test-utils is in no lockfile (20-06 deviation 1). The demo's call page needs no code change. Its doc comment is updated together with the pin bump in 20-09, so it never describes behaviour that the pinned layer lacks.
+- **Link guard (CR-02 client side).** It lives in a new `app/lib/urlGuard.ts` with `honestHttpUrl(raw)`, used by `safeUrl` (markdown.ts) and by `parseHttp` (linkEmbeds.ts). A deceptive URL stays text: no anchor and no card. The server now refuses banned ones (20-07). The client guard covers any host, so a card never shows a different host than the text. bm's copied tests (chatText.test.ts and the other four) stay byte-identical, so the new cases go into urlGuard.test.ts and linkEmbeds.test.ts.
+- **Sign-out (WR-01).** The review's explicit-call option, not a `watch(loggedIn)`: the token store is document.cookie, which a useCookie watcher would not see when `unauthorized()` clears it. `createCommunitySignOut` and `endSession` are Nuxt-free factories in `app/utils/communityAuth.ts`, tested with vitest. The plugin builds the sign-out with `nuxtApp.runWithContext` and hands it to `createChatAuth` (unauthorized) and, through `$communitySignOut`, to `useDemoAuth().logout()`. SiteHeader.vue and login.vue already go through `logout()` and need no change. Clearing `chatvideo:incoming` uses `useIncomingCalls().dismiss()`, which also stops the ring timer and closes the session handle. The handle leak between two pending subscribes is IN-07 and stays deferred.
+- spec-less probe fallback skipped: phase has no requirement IDs to probe (visible skip).
+
+<objective>
+Make leaving a call final at any moment, end empty sessions after a failed connect, ask before a call page starts the camera and microphone, keep deceptive link hosts out of chat links and cards, and reset the previous user's chat, socket and call prompt on logout.
+
+Purpose: D-13 (the minimal call page) and D-11/D-23 (DM calls from the call button) behave as the user expects. D-02 and D-17 hold in the chat renderer. D-04 holds after logout (no chat for a signed-out visitor).
+Output: commits in ../vue-chatvideo-layer, ../vue-chat-layer and ../sm-demo-app/vue-demo-app (not pushed, not tagged, pins unchanged), each with vitest regression tests.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-CONTEXT.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-06-SUMMARY.md
+
+Repos: ../vue-chatvideo-layer (main at 8222255, tag v0.1.0), ../vue-chat-layer (main at b6d3389, tag v0.1.0; 764cb42 and b6d3389 are already on main after the tag), ../sm-demo-app/vue-demo-app (the submodule, master at deb809f; pins vue-chat-layer and vue-chatvideo-layer v0.1.0 by git+https tag). Test runners: `pnpm --dir <repo> test` (vitest 3.2.7); the layers' SFCs compile with `pnpm --dir <layer> run build:playground`; vue-demo-app builds with `pnpm --dir ../sm-demo-app/vue-demo-app run build`.
+
+Rules: no co-author tags; stage files by explicit path; no push, tag or pin change (20-09); a layer's README changes in the same commit as its API; the layers name no application; check `git status` in each repo before editing and leave edits that are not this plan's alone (vue-demo-app often has a stale `nuxt dev` from 2026-10-22 running, pids 212159 and 212194, leave it alone). Do not edit sm-demo-app itself; its browser checks for these fixes are written in 20-09 Task 1, where they run against the unreleased layers.
+
+<interfaces>
+vue-chatvideo-layer today:
+- app/composables/useCall.ts: `useCall(conversationId)` returns {state, tiles, declined, audioBlocked, reconnecting, mediaError, begin(start), leave(), toggleMute(), toggleCamera(), startAudio()}; module-level `room`, `lk`, `channel`, `leaving`; begin: guard on `status !== 'idle' && isLive`, `dispatch start` only for the starter, `await client.start/join` (or takeStart), `joined`, pagehide listener, `openChannel(session_id)`, `await import('livekit-client')`, `room = new Room(...)`, `await r.connect`, a check that room is still r, `connected`, `await setCameraEnabled(true)`, `await setMicrophoneEnabled(true)`; on connect failure it posts leave. `leave()` returns early on idle; it posts end when alone (no room or no remote participants) else leave, then disconnects. onBeforeUnmount calls leave.
+- app/lib/callMachine.ts: states idle, starting, connecting, connected, ended, failed; `joined` accepted from idle or starting; `isLive`; unchanged by this plan.
+- app/lib/videoClient.ts: `createVideoClient` {start, join, leave, end, status → VideoStatus {session_id, conversation_id, status, started_by, participants [{user_id, status}]} or null}; `rememberStart`/`takeStart` (in-memory, a minute, taken once); `videoSessionChannel`; `parseIncomingCall`.
+- Call.vue: props conversationId, start, backPath; `onMounted(() => call.begin(props.start))`; Leave enabled while starting, connecting or connected; retry calls begin. IncomingCall.vue: `accept()` takes the pending call and navigates to callPath; decline posts leave. Locale keys chatvideo.state.*, chatvideo.action.*, chatvideo.reason.*.
+- tests/useCall.test.ts: vi.mock of livekit-client (fake Room with connect, disconnect, localParticipant setters as vi.fn, `Room.instances`, `failConnect`, `onCreate`), vi.mock of vue-chat-layer realtime (`realtime.subs`), unmount hooks captured, a stub client (start, join, leave, end, status as vi.fn), `connected(start)` helper. The test "a failed LiveKit connect fails the call and leaves the session" expects leave; WR-05 changes it.
+- chatvideo server facts: Start creates the session with the starter's participant row `joined` and the others `invited`; Join marks the actor `joined`; Leave marks `left`.
+vue-chat-layer today: app/lib/markdown.ts `safeUrl(raw)` (http(s) with `//` and a non-slash, mailto, site paths, anchors), `escapeHtml`, `formatSpans`; app/lib/chatText.ts `renderChatText` (LINK_RE, URL_RE through safeUrl); app/lib/linkEmbeds.ts `parseHttp(raw)` (new URL, http(s) only), `linkify`, `messageUrls`, `registerEmbedRenderer`, `embedRendererFor`; Chat/LinkEmbed.vue shows url.host and links url.href; useChat `reset()` (exported in v0.1.0); app/lib/realtime.ts `disconnect()` (exported in v0.1.0).
+vue-demo-app today: app/utils/communityAuth.ts {CommunityTokens, CommunityFetch, tokenGetter, createChatAuth(store, fetchJson) → {token, refresh, unauthorized}, friendsDirectory}; app/plugins/auth.ts provides paymentGatewayAuth, chatAuth, forumAuth, userfriendsAuth, userfriendsDirectory and calls setRealtimeAuth; app/composables/useDemoAuth.ts `logout()` posts /_user/api/v1/logout with the token, then `token.value = null`; app/lib/realtime.ts re-exports vue-chat-layer's realtime (disconnect included); app/layouts/default.vue renders ChatFloatingPanel and ChatvideoIncomingCall for members.
+</interfaces>
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: the caller clicks Leave while the call is still starting, and nothing connects or turns on afterwards, under test</name>
+  <precondition>`git -C ../vue-chatvideo-layer status --porcelain` prints nothing; `pnpm --dir ../vue-chatvideo-layer test` passes before the change.</precondition>
+  <files>../vue-chatvideo-layer/app/composables/useCall.ts, ../vue-chatvideo-layer/tests/useCall.test.ts</files>
+  <read_first>../vue-chatvideo-layer/app/composables/useCall.ts (whole file), app/lib/callMachine.ts, tests/useCall.test.ts (whole file: the fakes, beforeEach, the connected helper, every existing test), 20-REVIEW.md CR-01</read_first>
+  <action>Per D-13, closing the caller path of CR-01 end to end.
+1. Red first: in tests/useCall.test.ts add a small deferred-promise helper and the test "leave while start is pending: no room, no media, end once the session exists". `client.start` answers a deferred promise; call `begin(true)` without awaiting it, `await leave()`, then resolve the start answer and await the begin promise. Expect: no fake Room was connected (`Room.instances` empty, or none of them had connect called), setCameraEnabled and setMicrophoneEnabled never called, `client.end` called once with the conversation id after the answer arrived, the state ended with reason left, no open session channel, no pagehide listener. Run it and see it fail.
+2. useCall.ts: add the per-attempt counter. begin increments it and keeps its own number, resets `leaving`, dispatches `start` before the first await (for both roles), and after the start or join answer checks whether the attempt is stale (another attempt started or leave ran); if so it posts `end` for a start or `leave` for a join (errors swallowed) and returns before subscribing, adding the pagehide listener or loading livekit-client. leave() no longer returns early while an attempt is in flight in the starting state: it marks leaving, invalidates the attempt, dispatches leave, posts end or leave only when this attempt already has its answer, and disconnects.
+3. Keep every existing test green; update the module header comment (begin, leave and unmount semantics).
+4. Commit in vue-chatvideo-layer: `fix: leaving while a call starts never connects it`.</action>
+  <verify>
+    <automated>pnpm --dir ../vue-chatvideo-layer test</automated>
+    <fails_when>Non-zero exit: the new test fails (a Room connects, a media setter runs, end is posted before or never, the state is not ended) or an existing useCall, callMachine or videoClient test breaks.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'leave while start is pending' ../vue-chatvideo-layer/tests/useCall.test.ts` prints 1.
+    - `git -C ../vue-chatvideo-layer diff --stat 8222255 -- package.json pnpm-lock.yaml` prints nothing.
+  </acceptance_criteria>
+  <done>A caller who hangs up during "Connecting…" is out of the call for good: the late start answer ends the session and no camera or microphone turns on.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Every other moment of leaving is final too (callee join, unmount, livekit-client load, connect, between camera and microphone, a second begin), and a failed connect ends an empty session</name>
+  <files>../vue-chatvideo-layer/app/composables/useCall.ts, ../vue-chatvideo-layer/tests/useCall.test.ts, ../vue-chatvideo-layer/README.md</files>
+  <read_first>The Task 1 code and test, tests/useCall.test.ts (the fake Room's connect and setters, failConnect, onCreate, the unmount hooks), app/lib/videoClient.ts (status, VideoStatus), README.md (Usage, "The call flow", API reference, Testing)</read_first>
+  <behavior>
+    - "unmount while join is pending": begin(false) with a deferred join, run the captured unmount hook, resolve the join; no Room connects, no media setter runs, client.leave is posted once after the answer, state ended.
+    - "leave while connect is pending": connect answers a deferred promise; leave; resolve connect; setCameraEnabled and setMicrophoneEnabled never called, the Room disconnected, end posted once (alone).
+    - "leave between camera and microphone": setCameraEnabled answers a deferred promise; leave; resolve it; setMicrophoneEnabled never called, the Room disconnected.
+    - "leave while livekit-client loads": the import is awaited after the answer; stall it with a hoisted deferred gate in the mocked module if vitest allows it reliably, otherwise call leave in the same tick the answer resolves (the stale check right after the answer) and say which in the SUMMARY; no Room created after the leave, end posted once.
+    - "a second begin while the first join is pending": two begin(false) calls before the answer; join called once, at most one Room ever created and connected.
+    - WR-05 "a failed connect ends a session nobody else joined": failConnect set, client.status answers participants [{user_id: 7, status: 'joined'}, {user_id: 9, status: 'invited'}]; client.end posted, client.leave not. "a failed connect leaves when the other side joined": status answers two joined participants; client.leave posted, client.end not. "status unreadable": status rejects; the starter posts end, the callee posts leave.
+    - The existing test "a failed LiveKit connect fails the call and leaves the session" is renamed and changed to the WR-05 rule: the stub's status answers undefined, which counts as unreadable (as do null and a rejection), so the starter ends; every other existing expectation stays.
+  </behavior>
+  <action>Per D-13 and D-12 (the reconcile job and ringing behave as designed), closing the rest of CR-01 and WR-05.
+- useCall.ts: after the livekit-client import, return when stale (no Room is created); after `connect` resolves, when stale disconnect that Room (disconnect(true), errors swallowed) and return; check staleness before each of setCameraEnabled and setMicrophoneEnabled, and after the camera, so a leave between them disconnects and skips the microphone; the Disconnected handler and finish() keep working for the current attempt only. On a connect failure: dispatch error, disconnect, then ask `client.status(conversationId)`; post end when at most one participant has status joined, else leave; on a status error post end for a start and leave for a join. Remove nothing else (tiles, declined, audio, reconnecting stay as they are).
+- tests/useCall.test.ts: the behavior block's tests; keep the fakes, extend them only where a deferred is needed.
+- README.md: "The call flow" says Leave works at any moment and what is posted when, the WR-05 rule, and Testing lists the new tests.
+- Commit in vue-chatvideo-layer: `fix: a call left at any moment stays left, and a failed connect ends an empty session`.</action>
+  <verify>
+    <automated>pnpm --dir ../vue-chatvideo-layer test</automated>
+    <fails_when>Non-zero exit: any behavior-block test fails (media published after a leave, a second Room, a stale branch posting the wrong call, WR-05 posting leave for an empty session) or an existing test breaks.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -cE "test\('(unmount while join is pending|leave while connect is pending|leave between camera and microphone|a second begin while the first join is pending)" ../vue-chatvideo-layer/tests/useCall.test.ts` prints 4.
+    - `grep -c 'a failed connect ends a session nobody else joined' ../vue-chatvideo-layer/tests/useCall.test.ts` prints 1.
+  </acceptance_criteria>
+  <done>Whatever the moment a user leaves or navigates away, the camera and microphone stay off and the session is closed the right way, and a call that could not connect does not keep ringing.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: The call page asks before it starts media, unless the user just clicked the call button or Accept</name>
+  <files>../vue-chatvideo-layer/app/lib/videoClient.ts, ../vue-chatvideo-layer/app/components/Chatvideo/Call.vue, ../vue-chatvideo-layer/app/components/Chatvideo/IncomingCall.vue, ../vue-chatvideo-layer/app/assets/css/chatvideo-base.css, ../vue-chatvideo-layer/i18n/locales/en.json, ../vue-chatvideo-layer/i18n/locales/pl.json, ../vue-chatvideo-layer/tests/videoClient.test.ts, ../vue-chatvideo-layer/README.md</files>
+  <read_first>app/lib/videoClient.ts (the handoff block: HANDOFF_MS, rememberStart, takeStart), app/components/Chatvideo/Call.vue, CallButton.vue, IncomingCall.vue, app/assets/css/chatvideo-base.css (button and note styles), i18n/locales/en.json and pl.json, tests/videoClient.test.ts (the handoff tests), README.md (Usage, Components, "The call flow"), ../sm-demo-app/vue-demo-app/app/pages/call/[conversation].vue and app/pages/chat.vue (how the demo passes start and callPath; read only), 20-REVIEW.md WR-04</read_first>
+  <behavior>
+    - callAutostart(id, true) is false on a direct load; true right after rememberStart(id, …) within a minute, and begin's takeStart still receives that answer (hasStart does not take it); false after a minute; false for another conversation.
+    - callAutostart(id, false) is false on a direct load; true once right after rememberAccept(id) within a minute, then false (taken); false after a minute; false for another conversation; a start handoff does not make a join autostart.
+    - takeStart behaves as before (the existing handoff tests stay).
+  </behavior>
+  <action>Per D-11, D-13 and D-23, closing WR-04.
+- app/lib/videoClient.ts: add `hasStart(conversationId, now?)` (a start answer younger than HANDOFF_MS is waiting; not taken), `rememberAccept(conversationId, now?)` and `takeAccept(conversationId, now?)` (an Accept marker, a minute, taken once; in memory, never in a URL or storage), and `callAutostart(conversationId, start, now?)` (start: hasStart; join: takeAccept). Doc comments say why: a link can open the call route but cannot create a handoff.
+- IncomingCall.vue: accept() calls rememberAccept for the conversation before it navigates.
+- Call.vue: on mount, begin only when callAutostart answers true; otherwise the idle state renders a confirmation block (class `chatvideo-confirm`) with the text chatvideo.confirm.start or chatvideo.confirm.join and one button (classes `chatvideo-button chatvideo-confirm__go`, label chatvideo.action.startCall or chatvideo.action.joinCall) that calls begin(start), plus the back link when backPath is set. Live, ended and failed states render as today; Retry stays an explicit click. Update the component's header comment (media starts only after a click on this page, the call button or Accept).
+- Locales en and pl: confirm.start, confirm.join (each says the camera and microphone turn on after the click), action.startCall, action.joinCall. chatvideo-base.css: the confirm block in the existing card and button style.
+- tests/videoClient.test.ts: the behavior block.
+- README.md: Components (ChatvideoCall's confirmation; `start` picks Start or Join), "The call flow" (autostart only after the call button or Accept; a direct load or a link asks), API reference (hasStart, rememberAccept, takeAccept, callAutostart), Usage (the ?start=1 example now only selects Start), Testing.
+- Commit in vue-chatvideo-layer: `feat: the call page asks before it starts the camera and microphone`.</action>
+  <verify>
+    <automated>pnpm --dir ../vue-chatvideo-layer test &amp;&amp; pnpm --dir ../vue-chatvideo-layer run build:playground</automated>
+    <fails_when>Non-zero exit: a handoff test fails (a direct load autostarts, Accept does not, hasStart takes the answer, a marker outlives a minute or crosses conversations), an earlier test breaks, or the playground build fails to compile Call.vue or IncomingCall.vue.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'callAutostart' ../vue-chatvideo-layer/app/components/Chatvideo/Call.vue` prints at least 1 and `grep -c 'rememberAccept' ../vue-chatvideo-layer/app/components/Chatvideo/IncomingCall.vue` prints at least 1.
+    - `node -e "for (const l of ['en','pl']) { const c = require('../vue-chatvideo-layer/i18n/locales/' + l + '.json').chatvideo; if (!c.confirm?.start || !c.confirm?.join || !c.action?.startCall || !c.action?.joinCall) process.exit(1) }"` exits 0.
+    - `grep -rniE 'golem15\.demo|sm-demo|demo\.summercms' ../vue-chatvideo-layer/app ../vue-chatvideo-layer/README.md | wc -l` prints 0.
+  </acceptance_criteria>
+  <done>Opening a call link shows a clear Start call or Join call button and nothing turns on until it is clicked, while the call button and Accept still go straight into the call.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 4: The chat renders deceptive link hosts as text, never as a link or a link card</name>
+  <files>../vue-chat-layer/app/lib/urlGuard.ts, ../vue-chat-layer/app/lib/urlGuard.test.ts, ../vue-chat-layer/app/lib/markdown.ts, ../vue-chat-layer/app/lib/linkEmbeds.ts, ../vue-chat-layer/app/lib/linkEmbeds.test.ts, ../vue-chat-layer/README.md</files>
+  <read_first>../vue-chat-layer/app/lib/markdown.ts, app/lib/chatText.ts (LINK_RE, URL_RE, how safeUrl is used), app/lib/linkEmbeds.ts, app/lib/linkEmbeds.test.ts, app/components/Chat/LinkEmbed.vue, README.md (link embeds section, Testing), 20-REVIEW.md CR-02 (the table and the rendering paragraph)</read_first>
+  <behavior>
+    - honestHttpUrl refuses (returns null): https://bit%2Ely/x, https://bit.l%79/x, https://ｂｉｔ.ｌｙ/x, https://bit。ly/x, https://bit．ly/x, https://bit｡ly/x, https://user@bit.ly/x, https://example.com@bit.ly/, https:/\bit.ly/x, https://\bit.ly/x, https://bit.ly./x, javascript: and data: URLs, and anything new URL cannot parse.
+    - honestHttpUrl accepts: https://bit.ly/x, http://example.com:8080/a?b=c#d, https://żółw.example/ (an IDN written in Unicode), https://xn--w-uga1v8h.example/, https://sub.example.org/path.
+    - renderChatText of each refused URL, bare and as [label](url), contains no anchor (the text shows as written, escaped); messageUrls of a text holding them returns none; linkify leaves them as text. The accepted URLs still render as links and still yield cards.
+    - bm's copied tests (chatEvents, chatFormat, chatText, chatUnread, realtime) pass byte-identical.
+  </behavior>
+  <action>Per D-02 (generic link embeds) and D-17, the client half of CR-02.
+- app/lib/urlGuard.ts (new): `honestHttpUrl(raw: string): URL | null`. The URL must parse with new URL as http or https, and the scheme must be followed by exactly two slashes. The authority as written, up to the first slash, question mark or hash, must hold no percent sign, no at sign and no backslash. The host as written must hold none of U+3002, U+FF0E and U+FF61, must be unchanged by NFKC (no fullwidth or compatibility characters), and must not end with a dot. Its lower-cased form must equal url.hostname, or, for a host with non-ASCII letters, it must be in NFC with only U+002E as the separator. Doc comment: the chat links and embeds only URLs whose written host is the host the browser opens, so a card never shows a host the text does not.
+- markdown.ts: safeUrl allows an http(s) target only when honestHttpUrl accepts it (mailto, site paths and anchors unchanged). linkEmbeds.ts: parseHttp delegates to honestHttpUrl, so linkify and messageUrls skip deceptive URLs.
+- app/lib/urlGuard.test.ts (new): the behavior block, including renderChatText cases (import it from ./chatText). linkEmbeds.test.ts: messageUrls and linkify cases for two refused and two accepted URLs.
+- README.md: the link embeds section describes the guard; Testing lists urlGuard.test.ts.
+- Commit in vue-chat-layer: `fix: deceptive link hosts render as text, not links or cards`.</action>
+  <verify>
+    <automated>pnpm --dir ../vue-chat-layer test &amp;&amp; git -C ../vue-chat-layer diff --quiet b6d3389 -- app/lib/chatEvents.test.ts app/lib/chatFormat.test.ts app/lib/chatText.test.ts app/lib/chatUnread.test.ts app/lib/realtime.test.ts</automated>
+    <fails_when>Non-zero exit: a guard test fails (a deceptive URL becomes an anchor or a card, an honest or IDN URL stops linking), a store, client or embed test breaks, or one of bm's copied test files was edited.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'honestHttpUrl' ../vue-chat-layer/app/lib/markdown.ts` and `grep -c 'honestHttpUrl' ../vue-chat-layer/app/lib/linkEmbeds.ts` each print at least 1.
+    - `grep -rniE 'golem15\.demo|sm-demo|demo\.summercms' ../vue-chat-layer/app ../vue-chat-layer/README.md | wc -l` prints 0.
+  </acceptance_criteria>
+  <done>A message can no longer show a working link or a link card to a host it hides behind escapes, dots or userinfo; honest links work as before.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 5: Logging out resets the chat, closes the realtime socket and clears a ringing call in the same tab</name>
+  <files>../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts, ../sm-demo-app/vue-demo-app/app/utils/communityAuth.test.ts, ../sm-demo-app/vue-demo-app/app/plugins/auth.ts, ../sm-demo-app/vue-demo-app/app/composables/useDemoAuth.ts</files>
+  <read_first>../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts and communityAuth.test.ts (whole files), app/plugins/auth.ts, app/composables/useDemoAuth.ts (whole file), app/components/SiteHeader.vue and app/pages/login.vue (their logout calls), app/lib/realtime.ts (the re-export), app/layouts/default.vue, vitest.config.ts, ../vue-chat-layer/app/composables/useChat.ts (reset, lines around 1514) and app/lib/realtime.ts (disconnect), ../vue-chatvideo-layer/app/composables/useIncomingCalls.ts (dismiss), 20-REVIEW.md WR-01</read_first>
+  <behavior>
+    - createCommunitySignOut({resetChat, disconnectRealtime, dismissCall}) runs the three in that order; a part that throws does not stop the next ones; calling it twice is safe.
+    - createChatAuth(store, fetch, onSignedOut): unauthorized() clears the token, then calls onSignedOut once; without onSignedOut it behaves as before (the existing tests pass unchanged).
+    - endSession(token, postLogout, clearToken, signOut): with a token it posts logout with that token, clears the token even when the post rejects, then signs out once; without a token it posts nothing and still clears and signs out.
+  </behavior>
+  <action>Per D-04 (no chat for a signed-out visitor), closing WR-01.
+- app/utils/communityAuth.ts: add `createCommunitySignOut(parts)` and `endSession(token, postLogout, clearToken, signOut)` (Nuxt-free, doc comments), and an optional third parameter `onSignedOut` on `createChatAuth`, called by unauthorized() after the token is cleared. Update the file header.
+- app/plugins/auth.ts: take the nuxtApp argument; build the sign-out with createCommunitySignOut whose parts run only in the browser: resetChat runs useChat().reset() inside nuxtApp.runWithContext, disconnectRealtime calls disconnect from ~/lib/realtime, dismissCall runs useIncomingCalls().dismiss() inside nuxtApp.runWithContext. Pass it to createChatAuth and provide it as `communitySignOut`. Update the header comment.
+- app/composables/useDemoAuth.ts: read `$communitySignOut` from useNuxtApp() when the composable is created (before any await, so the Nuxt context is still there), and make logout() delegate to endSession with the current token, the existing logout POST, a clear that sets the token to null, and that sign-out. SiteHeader.vue and login.vue keep calling logout() unchanged.
+- app/utils/communityAuth.test.ts: the behavior block, next to the existing tests.
+- Commit in vue-demo-app only (not pushed; the sm-demo-app gitlink is bumped in 20-09): `fix: logging out resets the chat, closes the realtime socket and clears a ringing call`.</action>
+  <verify>
+    <automated>pnpm --dir ../sm-demo-app/vue-demo-app test &amp;&amp; pnpm --dir ../sm-demo-app/vue-demo-app run build</automated>
+    <fails_when>Non-zero exit: a sign-out or endSession test fails, an existing auth hook test breaks, or the site build fails (a missing auto-import or a layer API that v0.1.0 does not export).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c 'createCommunitySignOut' ../sm-demo-app/vue-demo-app/app/plugins/auth.ts` prints at least 1 and `grep -c 'endSession' ../sm-demo-app/vue-demo-app/app/composables/useDemoAuth.ts` prints at least 1.
+    - `git -C ../sm-demo-app/vue-demo-app diff --stat deb809f -- package.json pnpm-lock.yaml app/components/SiteHeader.vue` prints nothing.
+    - `git -C ../sm-demo-app status --porcelain -- vue-demo-app` prints ` M vue-demo-app` (the gitlink moved, not staged; 20-09 commits the bump).
+  </acceptance_criteria>
+  <done>After logout nothing of the previous member stays in the tab: no chat state, no open socket, no ringing prompt, and the next member starts clean.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| browser camera and microphone to LiveKit | media leaves the device once a Room is connected and tracks are published |
+| chat links to the call route | any member can post a same-site link to /call/{id} |
+| chat text to rendered links and cards | member-written URLs become anchors and cards |
+| one browser tab, two accounts | the previous member's state must not reach the next one |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-20-42 | Information disclosure | useCall (camera and microphone after leave) | critical | mitigate | per-attempt token checked after every await; leave invalidates it; a stale branch disconnects any Room and never calls the media setters; useCall tests pin each moment (start, join, import, connect, between camera and microphone, unmount, second begin) |
+| T-20-43 | Elevation of privilege | /call/{id} opened from a link | high | mitigate | media starts on mount only with an in-memory handoff a link cannot create (call button start answer, Accept marker, a minute, taken once); otherwise the confirmation waits for a click; callAutostart tests |
+| T-20-44 | Information disclosure | chat store, realtime socket and call prompt after logout | high | mitigate | logout and unauthorized run the community sign-out (reset, disconnect, dismiss), each part isolated; communityAuth tests; 20-09 adds a browser check that the socket closes |
+| T-20-45 | Denial of service | empty ringing session after a failed connect | medium | mitigate | the failed-connect branch ends the session when GET status shows nobody else joined; tests for both outcomes and for an unreadable status |
+| T-20-46 | Spoofing | deceptive hosts in chat anchors and link cards | high | mitigate | honestHttpUrl refuses escapes, userinfo, backslashes, compatibility dots and letters, trailing dots and malformed scheme separators before safeUrl, linkify or messageUrls produce a link or card; urlGuard tests |
+| T-20-SC | Tampering | npm installs | high | mitigate | no package or lockfile change in this plan; acceptance checks the layer manifests are untouched |
+</threat_model>
+
+<verification>
+- Task 1: vue-chatvideo-layer tests with the caller leave-during-start test.
+- Task 2: the remaining CR-01 moments and WR-05 under test.
+- Task 3: handoff tests and the playground build compiling the changed components.
+- Task 4: vue-chat-layer tests with the guard, bm's copied tests untouched.
+- Task 5: vue-demo-app tests and build on the v0.1.0 pins.
+</verification>
+
+<success_criteria>
+CR-01, WR-01, WR-04, WR-05 and the client half of CR-02 are fixed in the repositories that own the code, each with regression tests; nothing is pushed, tagged or re-pinned, so 20-09 can run the full suites, integrate the unreleased layers locally and release them.
+</success_criteria>
+
+<output>
+Create `.planning/phases/20-demo-instance-with-every-shared-plugin/20-08-SUMMARY.md` when done: the commits per repo, the new tests per finding, the changed expectation of the failed-connect test, the new layer exports (hasStart, rememberAccept, takeAccept, callAutostart, honestHttpUrl) and class names (chatvideo-confirm, chatvideo-confirm__go) that 20-09's browser checks use.
+</output>

.planning/phases/20-demo-instance-with-every-shared-plugin/20-08-SUMMARY.md

@@ -0,0 +1,253 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 08
+subsystem: chat-video-frontend
+tags: [vue, nuxt, livekit, vitest, chat, video, auth, gap-closure]
+status: complete
+gap_closure: true
+review_findings: [CR-01, WR-01, WR-04, WR-05, CR-02]
+
+requires:
+  - phase: 20-06
+    provides: "useCall on a fake Room, the chat layer's tests, the community auth hooks and their tests"
+provides:
+  - "useCall: a per-attempt token with stale checks after every await; leave works and is final at any moment"
+  - "useCall: a failed connect (or livekit-client import) ends a session nobody else joined (GET status)"
+  - "videoClient: hasStart, rememberAccept, takeAccept, callAutostart (click handoffs)"
+  - "ChatvideoCall: confirmation (chatvideo-confirm, chatvideo-confirm__go) unless the call button or Accept just handed over"
+  - "vue-chat-layer: honestHttpUrl (app/lib/urlGuard.ts), used by safeUrl, linkify and messageUrls"
+  - "vue-demo-app: createCommunitySignOut and endSession; logout and unauthorized() reset the chat, close the socket and dismiss the ring"
+affects: [20-09]
+
+actuals:
+  tokens: 16745   # chars/4 over the three repos' diffs (8222255..HEAD, b6d3389..HEAD, deb809f..HEAD)
+  tasks: 5
+  commits: 5      # measured per repo: vue-chatvideo-layer 3, vue-chat-layer 1, vue-demo-app 1; none in summercms.go
+plan_head_before: "vue-chatvideo-layer 8222255, vue-chat-layer b6d3389, vue-demo-app deb809f"
+plan_head_after: "vue-chatvideo-layer 5386903, vue-chat-layer a798bb1, vue-demo-app 188ae25"
+
+tech-stack:
+  added: []
+  patterns:
+    - "Per-attempt object ({start, answered, left}) plus a stale() closure checked after every await of an async lifecycle"
+    - "In-memory click handoffs (a minute, taken once) as proof of user intent before media starts"
+    - "A written-host-equals-opened-host guard before any anchor or link card is produced"
+    - "A Nuxt-free sign-out factory whose parts run isolated, wired by the plugin with runWithContext"
+
+key-files:
+  created:
+    - ../vue-chat-layer/app/lib/urlGuard.ts
+    - ../vue-chat-layer/app/lib/urlGuard.test.ts
+  modified:
+    - ../vue-chatvideo-layer/app/composables/useCall.ts
+    - ../vue-chatvideo-layer/app/lib/videoClient.ts
+    - ../vue-chatvideo-layer/app/components/Chatvideo/Call.vue
+    - ../vue-chatvideo-layer/app/components/Chatvideo/IncomingCall.vue
+    - ../vue-chatvideo-layer/app/assets/css/chatvideo-base.css
+    - ../vue-chatvideo-layer/i18n/locales/en.json
+    - ../vue-chatvideo-layer/i18n/locales/pl.json
+    - ../vue-chatvideo-layer/tests/useCall.test.ts
+    - ../vue-chatvideo-layer/tests/videoClient.test.ts
+    - ../vue-chatvideo-layer/README.md
+    - ../vue-chat-layer/app/lib/markdown.ts
+    - ../vue-chat-layer/app/lib/linkEmbeds.ts
+    - ../vue-chat-layer/app/lib/linkEmbeds.test.ts
+    - ../vue-chat-layer/README.md
+    - ../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts
+    - ../sm-demo-app/vue-demo-app/app/utils/communityAuth.test.ts
+    - ../sm-demo-app/vue-demo-app/app/plugins/auth.ts
+    - ../sm-demo-app/vue-demo-app/app/composables/useDemoAuth.ts
+
+key-decisions:
+  - "A stale start or join answer closes its session (end for the caller, leave for the callee) only when no newer attempt replaced it; a newer attempt owns the session"
+  - "leave() before the call connects posts end for the caller and leave for the callee (not the room-based alone rule), and only once the attempt has its answer"
+  - "WR-05 uses the server's view: GET status, end when at most one participant is joined; unreadable status (null, undefined, rejection) falls back to end for the caller and leave for the callee. The same rule applies to a failed livekit-client import"
+  - "callAutostart: start needs a waiting start answer (hasStart, left for begin to take); join takes an Accept marker. ?start=1 only chooses Start call over Join call"
+  - "honestHttpUrl also refuses invisible characters (Default_Ignorable_Code_Point, Cf) in a host, which the Unicode-host branch would otherwise accept"
+
+patterns-established:
+  - "Leaving at every await of begin() is a test: deferred promises for start, join, connect and the camera setter, and a gated vi.doMock of livekit-client for the import"
+
+requirements-completed: [SC-2, D-02, D-04, D-11, D-13, D-17, D-23]
+
+coverage:
+  - id: D1
+    description: "CR-01: leaving or unmounting at any moment of a call attempt never connects a Room or turns on media afterwards"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "../vue-chatvideo-layer/tests/useCall.test.ts (leave while start is pending; unmount while join is pending; leave while livekit-client loads; leave while connect is pending; a connect that fails after a leave posts nothing more; leave between camera and microphone; a second begin while the first join is pending)"
+        status: pass
+  - id: D2
+    description: "WR-05: a failed connect ends a session nobody else joined, else leaves"
+    requirement: D-13
+    verification:
+      - kind: unit
+        ref: "../vue-chatvideo-layer/tests/useCall.test.ts (a failed LiveKit connect fails the call; an unreadable status ends the starter's session; a failed connect ends a session nobody else joined; a failed connect leaves when the other side joined; a failed connect with an unreadable status: the starter ends, the callee leaves)"
+        status: pass
+  - id: D3
+    description: "WR-04: the call page asks before media unless the call button or Accept just handed over"
+    requirement: D-11
+    verification:
+      - kind: unit
+        ref: "../vue-chatvideo-layer/tests/videoClient.test.ts (describe call autostart)"
+        status: pass
+      - kind: other
+        ref: "pnpm --dir ../vue-chatvideo-layer run build:playground (Call.vue and IncomingCall.vue compile)"
+        status: pass
+  - id: D4
+    description: "CR-02 client side: deceptive link hosts render as text, never as a link or a card"
+    requirement: D-17
+    verification:
+      - kind: unit
+        ref: "../vue-chat-layer/app/lib/urlGuard.test.ts; ../vue-chat-layer/app/lib/linkEmbeds.test.ts"
+        status: pass
+  - id: D5
+    description: "WR-01: logout and unauthorized() reset the chat, close the socket and dismiss the ring"
+    requirement: D-04
+    verification:
+      - kind: unit
+        ref: "../sm-demo-app/vue-demo-app/app/utils/communityAuth.test.ts (createChatAuth with a sign-out, createCommunitySignOut, endSession)"
+        status: pass
+      - kind: other
+        ref: "pnpm --dir ../sm-demo-app/vue-demo-app run build on the v0.1.0 pins"
+        status: pass
+
+duration: 14min
+completed: 2026-11-02
+---
+
+# Phase 20 Plan 08: Call and session fixes Summary
+
+**Leaving a call is now final at any await of the attempt (per-attempt token with stale checks), a failed connect ends an empty session from GET status, the call page asks before media unless the call button or Accept handed over in memory, the chat renders deceptive link hosts as text through `honestHttpUrl`, and logout resets the chat, the realtime socket and the ring in the same tab.**
+
+## Performance
+
+- **Duration:** about 14 min
+- **Started:** 2026-11-02T17:25:39Z
+- **Completed:** 2026-11-02T17:39:00Z
+- **Tasks:** 5 of 5
+- **Files modified:** 20 (2 created) across three repositories
+
+## Commits per repository
+
+Nothing was pushed or tagged. vue-demo-app keeps its v0.1.0 layer pins. The sm-demo-app gitlink moved but is not staged (` M vue-demo-app`); 20-09 bumps it.
+
+| Repo | Hash | Subject |
+|------|------|---------|
+| ../vue-chatvideo-layer | 69e8b83 | fix: leaving while a call starts never connects it |
+| ../vue-chatvideo-layer | 27ad81c | fix: a call left at any moment stays left, and a failed connect ends an empty session |
+| ../vue-chatvideo-layer | 5386903 | feat: the call page asks before it starts the camera and microphone |
+| ../vue-chat-layer | a798bb1 | fix: deceptive link hosts render as text, not links or cards |
+| ../sm-demo-app/vue-demo-app | 188ae25 | fix: logging out resets the chat, closes the realtime socket and clears a ringing call |
+
+## Test results
+
+| Suite | Before | After |
+|-------|--------|-------|
+| vue-chatvideo-layer `pnpm test` | 114 | 127 passed (3 files) |
+| vue-chat-layer `pnpm test` | 146 | 215 passed (10 files) |
+| vue-demo-app `pnpm test` | 218 | 225 passed (18 files) |
+
+- `pnpm --dir ../vue-chatvideo-layer run build:playground` passed. So did `pnpm --dir ../vue-chat-layer run build:playground` and `pnpm --dir ../sm-demo-app/vue-demo-app run build` (v0.1.0 pins). In the built bundle, the plugin calls the resolved `useChat().reset()`, `disconnect()` and `useIncomingCalls().dismiss()`.
+- The SPA's copied chat tests (chatEvents, chatFormat, chatText, chatUnread, realtime) are byte-identical to b6d3389 (`git diff --quiet` exit 0).
+- No package.json or lockfile changed in any repo. Neither layer names an application (grep count 0).
+
+## New tests per finding
+
+- **CR-01** (useCall.test.ts):
+  - leave while start is pending: no room, no media, end once the session exists (Task 1, red first)
+  - unmount while join is pending: no room, no media, leave once the session exists
+  - leave while connect is pending: no media, the Room disconnected, end once
+  - a connect that fails after a leave posts nothing more
+  - leave between camera and microphone: the microphone stays off, the Room disconnected
+  - a second begin while the first join is pending creates no second Room
+  - leave while livekit-client loads: no Room after the leave, end once. This one stalls the import itself. `vi.resetModules()` plus `vi.doMock('livekit-client')` with an async factory gated on a deferred, then a fresh import of useCall; the `finally` restores the plain fake. The test is last in the file, and five consecutive runs were stable.
+- **WR-05** (useCall.test.ts): a failed connect ends a session nobody else joined; a failed connect leaves when the other side joined; a failed connect with an unreadable status: the starter ends, the callee leaves.
+- **Changed expectation:** the old test "a failed LiveKit connect fails the call and leaves the session" is now "a failed LiveKit connect fails the call; an unreadable status ends the starter's session". The stub's `status` answers undefined, which counts as unreadable, so the starter posts `end`, not `leave`. Every other expectation stays.
+- **WR-04** (videoClient.test.ts, `describe('call autostart')`):
+  - a start begins on mount only with the call button's answer, which begin still takes
+  - a join begins on mount only once, right after Accept
+  - a start answer does not make a join begin, nor an Accept a start
+- **CR-02 client** (urlGuard.test.ts, new):
+  - `honestHttpUrl` refuses 16 deceptive forms. These are the review's table plus `https:///`, `https:bit.ly`, soft hyphen, ZWSP and `0x7f.1`, along with other schemes and unparseable input.
+  - It accepts 8 honest forms: a port with query and fragment, an IDN in Unicode and in punycode, a subdomain, upper case, `@` in the path, and `%` in the query.
+  - `renderChatText` (bare and `[label](url)`), `safeUrl`, `messageUrls` and `linkify` behave on both sets.
+  - linkEmbeds.test.ts has two new cases.
+- **WR-01** (communityAuth.test.ts): unauthorized clears the token, then signs out once. createCommunitySignOut runs its parts in order, keeps going when a part throws, and is safe to call twice. endSession posts then clears then signs out, clears and signs out when the post rejects, and posts nothing without a token.
+
+## For 20-09 (browser checks and release)
+
+- **Layer exports added:** vue-chatvideo-layer `app/lib/videoClient.ts`: `hasStart`, `rememberAccept`, `takeAccept`, `callAutostart`. vue-chat-layer `app/lib/urlGuard.ts`: `honestHttpUrl`. vue-demo-app `app/utils/communityAuth.ts`: `createCommunitySignOut`, `endSession`, and an optional third parameter `onSignedOut` on `createChatAuth`. The plugin provides `$communitySignOut`.
+- **Class names:** `.chatvideo-confirm` (the confirmation block), `.chatvideo-confirm__go` (Start call / Join call button), `.chatvideo-confirm__text`, `.chatvideo-confirm__back` (the back link when `backPath` is set).
+- **Locale keys:** `chatvideo.confirm.start`, `chatvideo.confirm.join`, `chatvideo.action.startCall` (en "Start call", pl "Rozpocznij rozmowę"), `chatvideo.action.joinCall` (en "Join call", pl "Dołącz do rozmowy").
+- **Browser-visible behaviour changes once the pins move:**
+  - A direct load of `/call/{id}` or `/call/{id}?start=1` shows the confirmation and posts nothing until the click.
+  - The DM call button (start handoff) and the incoming prompt's Accept still go straight in.
+  - The callee's status now passes through `starting` before `connecting`; both render "Connecting…".
+  - Existing browser checks that load `/call/{id}?start=1` directly and expect media must click `.chatvideo-confirm__go` first.
+- **Demo call page doc comment** (`vue-demo-app/app/pages/call/[conversation].vue`) still says "With ?start=1 … it starts the call". Per the plan it is updated with the pin bump in 20-09.
+- **New layer tags:** each layer needs one (main is ahead of v0.1.0: chatvideo 3 commits, chat 1 commit on top of the 2 already after the tag) before vue-demo-app can pin them.
+
+## Decisions Made
+
+See key-decisions in the frontmatter. In short:
+- **Stale answer:** it closes its session only when it is still the current attempt.
+- **Leave before connect:** the caller posts end and the callee posts leave, and only once the answer has arrived.
+- **WR-05:** the rule follows GET status, with a fallback by role when the status cannot be read.
+- **Autostart:** a start needs the waiting start answer; a join takes the Accept marker.
+- **Invisible characters:** hosts containing them are refused.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 2 - Missing critical] Session-channel handle closed when the attempt goes stale while subscribing**
+- **Found during:** Task 2
+- **Issue:** `openChannel` set `channel` after `await subscribe`. A leave during the subscribe left the handle open (the review's "the channel handle leaks"). A stale attempt's publications could still call `finish`.
+- **Fix:** `openChannel(sessionId, stale)` closes the handle when the attempt is stale on arrival, and ignores publications for a stale attempt.
+- **Files modified:** ../vue-chatvideo-layer/app/composables/useCall.ts
+- **Commit:** 27ad81c
+
+**2. [Rule 1 - Bug] A failed livekit-client import left the session ringing, like a failed connect**
+- **Found during:** Task 2
+- **Issue:** WR-05's cause also applied to the import-failure branch, which only disconnected.
+- **Fix:** That branch now uses the same `closeFailed` (GET status) rule.
+- **Files modified:** ../vue-chatvideo-layer/app/composables/useCall.ts
+- **Commit:** 27ad81c
+
+**3. [Rule 2 - Missing critical] Invisible characters in a Unicode host**
+- **Found during:** Task 4
+- **Issue:** The plan's Unicode-host branch (NFC, only U+002E separators) accepted `https://bit.l\u00ady/x`, which displays as and opens `bit.ly`. A soft hyphen or ZWSP is dropped by the URL parser.
+- **Fix:** `honestHttpUrl` refuses hosts containing `\p{Default_Ignorable_Code_Point}` or `\p{Cf}`. Both forms are under test.
+- **Files modified:** ../vue-chat-layer/app/lib/urlGuard.ts, ../vue-chat-layer/app/lib/urlGuard.test.ts
+- **Commit:** a798bb1
+
+**4. [Rule 1 - Bug] leave() before connect no longer ends the caller's call from the callee side**
+- **Found during:** Task 1
+- **Issue:** The old rule `alone = !room || room.remoteParticipants.size === 0` made a callee who left while connecting post `end`, which ended the waiting caller's call.
+- **Fix:** Before `connected`, the caller posts end and the callee leave, as the plan's truth states. Once connected, the room-based last-one-out rule still applies.
+- **Files modified:** ../vue-chatvideo-layer/app/composables/useCall.ts
+- **Commit:** 69e8b83
+
+### Other notes
+
+- The `leave while livekit-client loads` test stalls the dynamic import itself (the preferred variant in the plan), not the same-tick fallback.
+- **Not done here, per the plan:** IN-07 (the handle race between two pending incoming subscribes) stays deferred. The demo's call page comment waits for 20-09.
+
+## Deferred Issues
+
+- `tsc --noEmit -p .nuxt/tsconfig.app.json` in vue-demo-app reports a type error at `app/plugins/auth.ts` on the `fetchJson` line (`$fetch(url, opts)` with `method?: string`). The line was there before this plan (it is line 20 at deb809f) and does not affect the build. Out of scope.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None. The changes close T-20-42 to T-20-46 and add no new endpoint, auth path or storage.
+
+## Self-Check: PASSED
+
+- FOUND: ../vue-chat-layer/app/lib/urlGuard.ts, ../vue-chat-layer/app/lib/urlGuard.test.ts
+- FOUND commits: 69e8b83, 27ad81c, 5386903 (vue-chatvideo-layer), a798bb1 (vue-chat-layer), 188ae25 (vue-demo-app)

.planning/phases/20-demo-instance-with-every-shared-plugin/20-09-PLAN.md

@@ -0,0 +1,552 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+plan: 09
+type: execute
+wave: 8
+depends_on: ["20-07", "20-08"]
+gap_closure: true
+review_findings: [CR-01, CR-02, CR-03, WR-01, WR-04, WR-05]
+files_modified:
+  - ../vue-chat-layer/package.json
+  - ../vue-chatvideo-layer/package.json
+  - ../sm-demo-app/scripts/check-moderation.sh
+  - ../sm-demo-app/scripts/check-local.sh
+  - ../sm-demo-app/scripts/check-chat.cjs
+  - ../sm-demo-app/scripts/check-all.sh
+  - ../sm-demo-app/README.md
+  - ../sm-demo-app/DEPLOY.md
+  - ../sm-demo-app/go.mod
+  - ../sm-demo-app/go.sum
+  - ../sm-demo-app/plugins/golem15/moderation
+  - ../sm-demo-app/plugins/golem15/forum
+  - ../sm-demo-app/plugins/demo/moderation.go
+  - ../sm-demo-app/moderation_test.go
+  - ../sm-demo-app/plugins/demo/content/ROADMAP.md
+  - ../sm-demo-app/vue-demo-app
+  - ../sm-demo-app/vue-demo-app/package.json
+  - ../sm-demo-app/vue-demo-app/pnpm-lock.yaml
+  - ../sm-demo-app/vue-demo-app/app/pages/call/[conversation].vue
+  - .planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW-DISPOSITION.md
+  - .planning/todos/pending/chatchannels-pin-policy.md
+  - .planning/todos/pending/moderation-profile-group-and-filenames.md
+  - .planning/todos/pending/forum-friends-client-401-refresh.md
+  - .planning/todos/pending/chatvideo-dm-only-host-hook.md
+  - .planning/todos/pending/chatvideo-live-membership.md
+  - .planning/todos/pending/check-local-jwt-out-of-argv.md
+  - .planning/todos/pending/chat-slash-text-escape.md
+  - .planning/todos/pending/demo-seed-moderation-lists-once.md
+  - .planning/todos/pending/demo-nginx-livekit-rtc-only.md
+  - .planning/todos/pending/chatvideo-incoming-handle-leak.md
+  - .planning/todos/pending/demo-vapid-runbook-pipefail.md
+  - .planning/todos/pending/demo-chat-members-read-only.md
+autonomous: false
+requirements: [SC-2, SC-3, SC-4, D-10, D-13, D-17, D-18]
+estimate:
+  tokens: 340000
+  raw_tokens: 340000
+  tasks: 12
+  confidence: low
+must_haves:
+  truths:
+    - "SC-4: before anything is pushed, the full suites pass in every repository the gap round touched: sm-moderation-plugin and sm-forum-plugin (go vet, go test ./... with Docker), vue-chat-layer and vue-chatvideo-layer (vitest and the playground build), vue-demo-app (vitest and the Nuxt build) and sm-demo-app (go vet, go test ./... with Docker)."
+    - "Before any tag, the unreleased fixes run together in the local demo (the sibling plugin checkouts through a scratch go.work, the local layers as packed tarballs, both temporary and reverted): check-local moderation, chat, chatlive and callmedia pass, so a one-way tag never ships an untested combination."
+    - "After the Task 3 go-ahead: annotated tags exist on origin at the default branch's head, each containing the earlier tags. sm-moderation-plugin gets the next patch after v0.1.0 (v0.1.1), sm-forum-plugin after v0.1.1 (v0.1.2), and vue-chat-layer and vue-chatvideo-layer after v0.1.0 (v0.1.1 each). For each, `git ls-remote origin refs/tags/<tag>^{}` equals the pushed HEAD."
+    - "sm-demo-app requires the new moderation and forum tags (go.mod and go.sum, submodules checked out at the tags, check-pins ok, one `chore: bump` commit per plugin), its forum listener also checks the rendered post (PostSaving.HTML through CheckHTML), and TestDemoModeration refuses every reviewer probe through HTTP on chat send, reply and edit and on forum thread, reply and edit, with nothing stored. vue-demo-app pins both layers at their new tags."
+    - "check-moderation.sh refuses every reviewer probe in chat and forum with 422 under the right field, after a plain control word is refused (so changed lists cannot pass silently), and leaves nothing behind. check-chat.cjs --call shows the confirmation on a direct /call load with no LiveKit connection before the click, then completes the DM call. check-chat.cjs's default mode shows that logout closes the realtime socket."
+    - "SC-3, after the Task 7 go-ahead: rome runs the new binary and site through DEPLOY.md's Upload and Release. Only summercms-demo and summercms-demo-site restart, check-live prints `check-live: ok`, and bin/demo.prev and site/.output.prev are kept for a rollback."
+    - "SC-2, D-17 on the live site: with the user's live tokens, the bypass probe passes against https://demo.summercms.io and the call probe completes a DM call there with the confirmation step. Without tokens the user's own UAT of the same steps is recorded. smoke.sh passes on the deployed artifact."
+    - "After the Task 11 go-ahead, one post per plugin tag (sm-moderation-plugin, sm-forum-plugin) is on https://summercms.io/changelog/plugins, written per CLAUDE.md (user-facing, no planning IDs, no H1). The journal token is never printed or copied."
+    - "20-REVIEW-DISPOSITION.md: CR-01, CR-02, CR-03, WR-01, WR-04 and WR-05 are fixed, with commit refs. WR-02, WR-03, WR-06 and IN-01 to IN-09 are deferred, each pointing at its todo in .planning/todos/pending/ (g15office task id in the frontmatter when the g15office tools answer)."
+  artifacts:
+    - path: "../sm-demo-app/scripts/check-moderation.sh"
+      provides: "the bypass probe for a local or the live demo"
+      contains: "check-moderation: ok"
+    - path: "../sm-demo-app/plugins/demo/moderation.go"
+      provides: "forum listener checking the rendered post"
+      contains: "CheckHTML"
+    - path: ".planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW-DISPOSITION.md"
+      provides: "the closed ledger"
+      contains: "fixed"
+  key_links:
+    - from: "../sm-demo-app/plugins/demo/moderation.go"
+      to: "../sm-forum-plugin/events/events.go"
+      via: "checkPost runs Filter.CheckHTML on ev.HTML after title and body"
+      pattern: "ev\\.HTML"
+    - from: "../sm-demo-app/go.mod"
+      to: "../sm-moderation-plugin"
+      via: "require at the new patch tag"
+      pattern: "sm-moderation-plugin v0\\.1\\.[1-9]"
+    - from: "../sm-demo-app/vue-demo-app/package.json"
+      to: "../vue-chatvideo-layer"
+      via: "git+https pin at the new tag"
+      pattern: "vue-chatvideo-layer.git#v0\\.1\\.[1-9]"
+  prohibitions:
+    - statement: "No push, tag, rome change or changelog post happens before its checkpoint is answered; a tag is never moved or re-pushed; tags go on the default branch only."
+      status: unresolved
+      verification: judgment
+    - statement: "No secret value (JWTs, the journal token, .env values) appears in a command line, a log, a committed file or the SUMMARY; .env files are never read; JWTs reach the scripts through 0600 files or the environment and curl gets the header through a config on stdin."
+      status: unresolved
+      verification: judgment
+    - statement: "The temporary integration (scratch go.work, packed layer tarballs) is never committed: vue-demo-app's package.json and pnpm-lock.yaml match their committed state when Task 2 ends."
+      status: unresolved
+      verification: automated
+    - statement: "On rome only summercms-demo and summercms-demo-site restart; nginx, Centrifugo, LiveKit, the firewall and WavePath's programs are untouched."
+      status: unresolved
+      verification: judgment
+---
+
+## Phase Goal
+
+ROADMAP Goal (not in user-story format; no story is invented here): sm-demo-app runs every shared plugin and its public Nuxt site shows them working, deployed publicly with the backend call to action.
+
+This plan's slice (gap round after the code review, plan 9 of 9, wave 8): it releases 20-07's and 20-08's fixes, redeploys the demo and re-checks it live.
+- Prove the unreleased fixes together locally.
+- Tag the four repositories after a go-ahead.
+- Consume the tags in the demo, including the one listener change that needs them.
+- Rebuild, redeploy on rome after a go-ahead, and probe the live site for the bypasses and the call flow.
+- Publish the two plugin changelog posts after a go-ahead.
+- Close 20-REVIEW-DISPOSITION.md.
+
+**Unit tests rule for this gap round:** the project rule "unit tests are the last plan of every phase" is met because every fix in 20-07 and 20-08 carries its own regression tests and this plan runs every touched repository's full suite (Task 2) and the demo's whole gate (Task 6) before anything goes live.
+
+## Decisions taken in this plan (Claude's discretion, recorded)
+
+- **Versions.** Each tag is the next patch after the latest tag, checked on 2026-11-02 with `git tag --sort=-v:refname` and `git ls-remote --tags origin`:
+
+  | Repo | Latest tag | New tag |
+  |---|---|---|
+  | sm-moderation-plugin | v0.1.0 | v0.1.1 |
+  | sm-forum-plugin | v0.1.1 | v0.1.2 |
+  | vue-chat-layer | v0.1.0 | v0.1.1 |
+  | vue-chatvideo-layer | v0.1.0 | v0.1.1 |
+
+  The brief asked for moderation v0.1.2. No v0.1.1 exists, and skipping one would leave a hole in the series, so the plan proposes v0.1.1 and the Task 3 checkpoint shows the table for the user to confirm or override. Task 2 re-reads the tags, because another session could tag in between.
+- **Integration before tagging.** Tags are one-way, so Task 1 and Task 2 run the unreleased code together in the local demo. The Go side uses a scratch go.work that maps moderation and forum to the sibling checkouts (GOWORK is respected by dev.sh and build.sh dev). The site side installs the two layers from `pnpm pack` tarballs; unlike link pins, a tarball resolves vue-chat-layer once, as the git tag install will. Both are reverted before the release gate.
+- **The demo listener change comes after the bumps** (20-07's finding). `checkPost` gains `CheckHTML(ctx, ev.HTML)` in the commit right after the two `chore: bump` commits, so every sm-demo-app commit builds with its own pointers. Until then, the reviewer's three forum forms are already refused on the raw body by the new Check. The tarball and scratch integration therefore proves those three; the rendered-only forms (bit\.ly, an HTML comment) are pinned by TestDemoModeration in Task 5.
+- **Probes written as checks.** The bypass probe is `scripts/check-moderation.sh BASE`, reusable locally (`check-local.sh moderation`) and live. The call probe is check-chat.cjs --call, extended with the direct-load confirmation step, plus a logout step in its default mode. Both read JWTs from a 0600 file or the environment, never argv, and curl gets the bearer header through a config on stdin (the pattern IN-03 asks for). Live, the probe posts only in the visitor's own DM with a persona and as replies on a seeded thread. It starts with a control word that must be refused, and it deletes anything a probe managed to store.
+- **Live tokens are an authentication gate.** Live login needs a real Turnstile solve, so Task 9 asks the user to sign in in a browser and save the token cookie values into two files. The alternative is "manual": the user runs the same steps by hand.
+- **Changelog posts** go to sm-moderation-plugin and sm-forum-plugin only. The layers have no plugin.yaml and no changelog stream, and changelog-post.py refuses a repository without a manifest.
+- **Deferred findings** (WR-02, WR-03, WR-06, IN-01 to IN-09) each become one todo in the existing format. IN-07's logout half was fixed by 20-08 (dismiss on sign-out); its todo keeps the handle leak.
+- spec-less probe fallback skipped: phase has no requirement IDs to probe (visible skip).
+
+<objective>
+Release the gap-round fixes, put them on the live demo, and prove there that the bypasses are closed and the call flow asks before media; close the review ledger.
+
+Purpose: SC-2, SC-3 and SC-4 hold again after the code review; D-17 (moderation), D-18 (the seams) and D-13 (the call page) hold on the live site.
+Output: four tags, commits in sm-demo-app and vue-demo-app, a new release on rome, two changelog posts, the closed disposition ledger and twelve follow-up todos, each step after its go-ahead.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW-DISPOSITION.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-05-SUMMARY.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-06-SUMMARY.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-07-SUMMARY.md
+@.planning/phases/20-demo-instance-with-every-shared-plugin/20-08-SUMMARY.md
+
+Repos: ../sm-moderation-plugin, ../sm-forum-plugin, ../vue-chat-layer, ../vue-chatvideo-layer (each on main, 20-07 and 20-08 commits unpushed); ../sm-demo-app (master; submodules plugins/golem15/* at their required tags; vue-demo-app submodule with 20-08's commit, gitlink moved but not committed); ../sm-summercmsio-app (scripts/changelog-post.py). Host: rome over `ssh -p 2222 debian@10.8.3.118` (passwordless sudo; the `rome` alias does not resolve here), with `RSH="ssh -p 2222"` and `ROME=debian@10.8.3.118` as DEPLOY.md uses them.
+
+Rules (CLAUDE.md and the brief): no co-author tags; stage files by explicit path; one logical change per commit; planning docs and code in separate commits; the plugin or layer is pushed and tagged first, then the pointer or pin bump in the app as its own commit (one `chore: bump <name> to <tag>` per plugin); push vue-demo-app before the sm-demo-app commit that moves its gitlink; tags only on the default branch, annotated, never moved; never read `.env*` files; never print, copy or mint the journal token; leave other sessions' uncommitted edits (STATE.md, state.json, G15OFFICE.md) alone; Docker tests through `sudo -u golem` if the socket is denied. After Task 4, write a progress note into a draft 20-09-SUMMARY.md (tasks done, tags and commits, open points), so a context reset resumes cleanly. `SCRATCH` in the commands below is this session's scratchpad directory; set it once (`SCRATCH=<the scratchpad path>`) before Task 1 and again after a context reset.
+
+<interfaces>
+sm-demo-app scripts: dev.sh up (Postgres, Centrifugo, LiveKit 127.0.0.1:7890, Go on :8097, Nuxt on :3020; builds through go.work, so GOWORK overrides it); check-local.sh CHECK... (helpers request, json_has, bad, visitor_jwt, throwaway_user, psql_value; ALL_CHECKS; check_call, two_member_chat, check_chatlive, check_callmedia); check-chat.cjs --base URL [--two|--call] (DEMO_JWT, DEMO_JWT2 from the environment; TOKEN_COOKIE summercms_demo_token; the call mode clicks .chatvideo-callbutton__btn, accepts on .chatvideo-incoming, waits for remote video, mutes, both click .chatvideo-button--leave, polls video/status); check-all.sh [--local] (step 5 runs check-local.sh back remote chatlive callmedia); check-pins.sh; build.sh [release|dev] (release refuses dirty trees, a stale ROADMAP snapshot and pins off go.mod); sync-roadmap.sh; smoke.sh [binary]; check-deploy.sh; check-live.sh URL.
+Demo APIs used by the probe: GET /_demo/api/v1/chat/members (persona Ada Hart); POST /_chat/api/v1/contexts/demo/1/dm {user_id}; POST /_chat/api/v1/conversations/{id}/messages {content}; DELETE /_chat/api/v1/messages/{id}; GET /_forum/api/v1/contexts/demo/1/categories and /threads; POST /_forum/api/v1/contexts/demo/1/categories/{categoryId}/threads {title, body}; POST /_forum/api/v1/contexts/demo/1/threads/{threadId}/posts {body}; DELETE /_forum/api/v1/contexts/demo/1/posts/{postId} and /threads/{threadId}. Refusal: 422 {"error":"Validation failed","errors":{field:[message]}} with field content (chat), title or body (forum).
+Live default lists (demo:seed, unless an admin changed them): words "buy followers", "casino bonus", "free crypto", "viagra"; links "bit.ly".
+20-08 names used by the checks: the confirmation block `.chatvideo-confirm`, its button `.chatvideo-confirm__go`; the call button `.chatvideo-callbutton__btn`.
+DEPLOY.md: "Build" (build.sh, smoke.sh, check-deploy.sh), "Upload" (three rsync lines with --chown=root:root and sudo rsync), "Release" (migrate and demo:seed with bin/demo.new, keep bin/demo.prev and site/.output.prev, restart summercms-demo and summercms-demo-site, websockets:health), "Verify" (check-live.sh, supervisorctl status, the reset schedule off), "Rollback".
+changelog (../sm-summercmsio-app/DEPLOY.md "Posting to the changelog"): `scripts/changelog-post.py source vX.Y.Z --repo ../sm-<name>-plugin`, then `scripts/changelog-post.py publish vX.Y.Z notes.md --excerpt "…" --repo ../sm-<name>-plugin` (`--draft` saves unpublished); the plugin checkout must be exactly at the tag with a clean worktree and a plugin.yaml that passes `summer plugin:manifest --check`; the token is read from ~/.config/summercms/journal-token by the script.
+Todo format (.planning/todos/pending/*.md): frontmatter title, date, priority, area, g15office (task id); a short body. .planning/G15OFFICE.md: each todo gets a g15office task in project summercms (type Bug, Feature, Improvement or Task; the description ends with `Local: .planning/todos/pending/<file>`).
+</interfaces>
+</context>
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: Tracer: the bypass, call-confirmation and logout checks exist, and they pass against the unreleased fixes running together in the local demo</name>
+  <precondition>The 20-07 and 20-08 SUMMARYs exist and record their commits; `git -C <repo> status --porcelain` is empty in sm-moderation-plugin, sm-forum-plugin, vue-chat-layer and vue-chatvideo-layer; in sm-demo-app it lists at most ` M vue-demo-app`; Docker runs.</precondition>
+  <files>../sm-demo-app/scripts/check-moderation.sh, ../sm-demo-app/scripts/check-local.sh, ../sm-demo-app/scripts/check-chat.cjs, ../sm-demo-app/scripts/check-all.sh, ../sm-demo-app/README.md, ../sm-demo-app/DEPLOY.md</files>
+  <read_first>../sm-demo-app/scripts/check-local.sh (header, helpers, visitor_jwt, check_call, two_member_chat, ALL_CHECKS), scripts/check-chat.cjs (whole file), scripts/check-all.sh (step 5), scripts/dev.sh (up, how it builds), go.work, README.md "Checks", DEPLOY.md "Verify", 20-REVIEW.md (the probe forms), 20-07-SUMMARY.md (probe table), 20-08-SUMMARY.md (class names and handoffs)</read_first>
+  <action>Per D-17, D-13 and D-04.
+1. scripts/check-moderation.sh BASE (new, `set -euo pipefail`, header in the style of check-live.sh):
+   - It reads the member JWT from the file named by DEMO_JWT_FILE (it must be mode 600; a looser mode stops the script) or from DEMO_JWT. It never prints the JWT and never puts it in argv: every request passes the Authorization header to curl as a config on stdin, written with bash builtins.
+   - It finds the visitor's DM with the persona Ada Hart (members, then dm) and the first seeded forum category and thread.
+   - Control first: the plain word "viagra" must answer 422 as a chat message (errors.content) and as a forum reply (errors.body). If either control is accepted, it deletes what was stored, prints "check-moderation: the filter is off or the lists differ from the defaults" and exits 1.
+   - Then every probe from the review, in one array whose comment says it mirrors 20-07's TestMatchBypassWords and TestMatchBypassLinks. Words: viagra with U+200B, with U+00AD; "buy followers" with U+00A0, with U+2009, with U+3000; fullwidth ｖｉａｇｒａ; vi&#97;gra; via**gra**. Links: https://bit%2Ely/x, https://bit.l%79/x, https://ｂｉｔ.ｌｙ/x, https://bit。ly/x, https://user@bit.ly/x, [x](https://bit&#46;ly/a). Write each with bash $'\u…' escapes and build the JSON bodies with python3 json.dumps, as check-local does.
+   - Each probe must answer 422 as a chat message, as a forum reply and once as a forum thread title (errors.title). A probe that answers 2xx is deleted at once (the message, post or thread) and reported.
+   - It ends with "check-moderation: ok", or one line per failure and exit 1.
+2. check-local.sh: `check_moderation` runs check-moderation.sh against $GO with the visitor's JWT through the environment; add `moderation` to ALL_CHECKS and the header list. check-all.sh step 5 runs `moderation` with the other browser and API checks (header comment too).
+3. check-chat.cjs:
+   - Read DEMO_JWT_FILE and DEMO_JWT2_FILE when set (trimmed, never printed), else DEMO_JWT and DEMO_JWT2.
+   - --call: before the call-button step, A loads /call/{dm}?start=1 directly. `.chatvideo-confirm` must be visible within 5 s. Watch the page's WebSockets for 3 s: none may open to a URL containing /livekit/rtc, and no .chatvideo-tile may render. GET .../video/status must show no session. Then the existing flow runs (the call button and Accept autostart through the handoffs), and the summary line stays "check-chat: ok call".
+   - Default mode: after the message check, the member clicks Log out in the header. Within 5 s every WebSocket the page opened to /ws must be closed, and /chat must show the register link.
+   - Update the header comment.
+4. README.md "Checks" and DEPLOY.md "Verify": the moderation check, the live bypass probe and the live call probe with token files (the commands, the file mode, that they post only in the visitor's DM and as thread replies and clean up), in the files' style.
+5. Commit in sm-demo-app (scripts and docs only): `test: moderation bypass probe, call confirmation and logout checks`.
+6. Temporary integration (never committed):
+   - Write a scratch go.work, $SCRATCH/demo-gap.go.work under this session's scratchpad. It is ../sm-demo-app/go.work with every path made absolute, plugins/golem15/moderation replaced by the absolute path of ../sm-moderation-plugin and plugins/golem15/forum by ../sm-forum-plugin.
+   - Pack both layers with `pnpm --dir ../vue-chat-layer pack --pack-destination $SCRATCH` (and the same for vue-chatvideo-layer), then `pnpm --dir ../sm-demo-app/vue-demo-app add <the two tarball paths>`.
+   - Run `GOWORK=$SCRATCH/demo-gap.go.work ../sm-demo-app/scripts/dev.sh up`.
+   - Run `../sm-demo-app/scripts/check-local.sh moderation chat callmedia` and see them pass. Leave the setup in place for Task 2, which reverts it; say so in the draft SUMMARY if the run stops here.</action>
+  <verify>
+    <automated>bash -n ../sm-demo-app/scripts/check-moderation.sh &amp;&amp; node --check ../sm-demo-app/scripts/check-chat.cjs &amp;&amp; ../sm-demo-app/scripts/check-local.sh moderation chat callmedia</automated>
+    <fails_when>Non-zero exit: a script has a syntax error, or check-local reports moderation failed (a probe stored, a control accepted, a wrong field), chat failed (the message or the logout socket check) or callmedia failed (the direct load opened LiveKit or showed no confirmation, or the DM call did not complete).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `git -C ../sm-demo-app show --stat HEAD | grep -cE 'scripts/check-moderation.sh|scripts/check-chat.cjs|scripts/check-local.sh'` prints 3.
+    - `grep -v '^\s*#' ../sm-demo-app/scripts/check-moderation.sh | grep -cE -- '-H +.?Authorization'` prints 0 (the bearer header never goes on curl's command line).
+  </acceptance_criteria>
+  <done>The bypass probe, the call confirmation step and the logout check exist and pass against all four unreleased fixes together, before anything is tagged.</done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Full suites of every touched repository, the rest of the local checks on the unreleased code, revert of the temporary integration, and release prep</name>
+  <files>../vue-chat-layer/package.json, ../vue-chatvideo-layer/package.json</files>
+  <read_first>The Task 1 setup ($SCRATCH/demo-gap.go.work, the tarball pins), each repo's README Testing and Changelog sections, ../sm-moderation-plugin/plugin.yaml and ../sm-forum-plugin/plugin.yaml, .planning/notes/core-plugins-own-repos.md, ../sm-demo-app/scripts/check-pins.sh</read_first>
+  <action>Per SC-4.
+1. Full suites (record pass counts in the draft SUMMARY):
+   - sm-moderation-plugin and sm-forum-plugin: `go -C <repo> vet ./...` and `go -C <repo> test -count=1 ./...` with Docker.
+   - vue-chat-layer and vue-chatvideo-layer: `pnpm --dir <repo> test` and `pnpm --dir <repo> run build:playground`.
+   - vue-demo-app: `pnpm test` and `pnpm run build`, first under the tarball pins, then again after the revert below.
+   - sm-demo-app: `go vet ./...` and `go test -count=1 ./...` under its own go.work (the committed pointers). Also `GOWORK=$SCRATCH/demo-gap.go.work go -C ../sm-demo-app test -count=1 -run '^(TestDemoModeration|TestBootAllPlugins|TestGoModRequiresTags)$' .`, which shows the new plugin code works with the demo before it is tagged. TestGoModRequiresTags only reads go.mod, so it must still pass.
+2. Remaining local checks on the unreleased code: `../sm-demo-app/scripts/check-local.sh chatlive call forum friends herald tour`.
+3. Revert the temporary integration: `git -C ../sm-demo-app/vue-demo-app checkout -- package.json pnpm-lock.yaml`, then `pnpm --dir ../sm-demo-app/vue-demo-app install --frozen-lockfile`. Restart the stack without the GOWORK override (`../sm-demo-app/scripts/dev.sh up` restarts or rebuilds per its own rules; stop the old Go process if dev.sh does not). Delete the scratch tarballs and go.work.
+4. Release prep, recorded as a table in the draft SUMMARY:
+   - For each of the four repos: the latest tag (`git tag --sort=-v:refname | head -1` and `git ls-remote --tags origin`) and the next patch tag (expected v0.1.1, v0.1.2, v0.1.1, v0.1.1).
+   - The default branch (`git remote show origin`, HEAD branch main), a fast-forward of origin main (`git merge-base --is-ancestor origin/main HEAD` after `git fetch`), and every earlier tag an ancestor of HEAD.
+   - The README changelog entries for the new versions (moderation, forum), and `summer plugin:manifest --check` passing in both plugins (summer from PATH, else `go -C ../summercms.go run ./cmd/summer`).
+   - Set "version" in the two layers' package.json to the new version, and commit each: `chore: release 0.1.1`.
+   - The commits each tag will contain (`git log --oneline <latest tag>..HEAD`).</action>
+  <verify>
+    <automated>for r in sm-moderation-plugin sm-forum-plugin; do go -C ../$r vet ./... &amp;&amp; go -C ../$r test -count=1 ./... || exit 1; done &amp;&amp; for l in vue-chat-layer vue-chatvideo-layer; do pnpm --dir ../$l test || exit 1; done &amp;&amp; pnpm --dir ../sm-demo-app/vue-demo-app test &amp;&amp; pnpm --dir ../sm-demo-app/vue-demo-app run build &amp;&amp; go -C ../sm-demo-app vet ./... &amp;&amp; go -C ../sm-demo-app test -count=1 ./... &amp;&amp; git -C ../sm-demo-app/vue-demo-app diff --quiet -- package.json pnpm-lock.yaml &amp;&amp; for l in vue-chat-layer vue-chatvideo-layer; do node -e "process.exit(require('../$l/package.json').version === '0.1.1' ? 0 : 1)" || exit 1; done</automated>
+    <fails_when>Non-zero exit: a suite fails in any touched repository, the temporary pins were not reverted, or a layer's package.json version was not set.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The draft SUMMARY holds the release table (repo, latest tag, new tag, HEAD, commits since the tag) and the suite results.
+    - `git -C ../sm-demo-app status --porcelain` lists at most ` M vue-demo-app`.
+  </acceptance_criteria>
+  <done>Every touched repository is green on its own and together with the others, the integration left no trace, and the release table is ready for the go-ahead.</done>
+</task>
+
+<task type="checkpoint:decision" gate="blocking">
+  <name>Task 3: Go-ahead to push main and tag the four repositories</name>
+  <read_first>The Task 2 release table (repo, latest tag, proposed tag, HEAD, commits since the latest tag), the suite results and the local checks, the note on moderation's version (v0.1.1, not the brief's v0.1.2)</read_first>
+  <acceptance_criteria>
+    - The user's answer is recorded in the SUMMARY with the confirmed versions.
+  </acceptance_criteria>
+  <decision>Push main and create the annotated tags sm-moderation-plugin v0.1.1, sm-forum-plugin v0.1.2, vue-chat-layer v0.1.1 and vue-chatvideo-layer v0.1.1?</decision>
+  <context>Tags are one-way: consumers' go.sum and lockfiles pin them, so they are never moved, only superseded. Each tag carries only the gap-round fixes listed in the table (plus vue-chat-layer's two test and refactor commits already on main since v0.1.0). The demo can consume them only after this. Other applications pin older tags and are unaffected, because the changes are additive (PostSaving gains a field, the filter matches more forms, the layers add a guard, handoffs and a confirmation).</context>
+  <options>
+    <option id="release">
+      <name>Push and tag all four</name>
+      <pros>The demo can pin the fixes and be redeployed.</pros>
+      <cons>The versions are public and final.</cons>
+    </option>
+    <option id="push-only">
+      <name>Push main, no tags yet</name>
+      <pros>The commits are backed up and visible for review.</pros>
+      <cons>The demo cannot pin them; the plan stops after Task 4 until tags are approved.</cons>
+    </option>
+    <option id="hold">
+      <name>Hold</name>
+      <pros>Nothing leaves this machine.</pros>
+      <cons>The live demo keeps the bypasses and the call race.</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "release" (optionally with other versions), "push-only" or "hold".</resume-signal>
+</task>
+
+<task type="auto">
+  <name>Task 4: Push the four repositories and tag them</name>
+  <reversibility rating="one-way">Pushed tags are pinned by consumers' go.sum and lockfiles; they can be superseded but never moved.</reversibility>
+  <precondition>Task 3 answered "release" or "push-only".</precondition>
+  <files>(no files; git refs on origin)</files>
+  <read_first>The Task 3 answer, the Task 2 release table, .planning/notes/core-plugins-own-repos.md</read_first>
+  <action>For each of sm-moderation-plugin, sm-forum-plugin, vue-chat-layer and vue-chatvideo-layer, in that order:
+- `git fetch origin` and confirm origin/main is still an ancestor of HEAD (stop and report if another session pushed);
+- `git push origin main` and check `git ls-remote origin refs/heads/main` equals HEAD;
+- with "release": create the annotated tag at HEAD (`git tag -a <tag> -m "<one line: what the release fixes>"`), push only that tag (`git push origin <tag>`), check `git ls-remote origin "refs/tags/<tag>^{}"` equals HEAD and that the previous tag is an ancestor (`git merge-base --is-ancestor <previous> <tag>`).
+With "push-only", stop after the pushes, record it, and end the plan run here (resume at Task 3 when the user approves tags).
+Write the progress note into the draft 20-09-SUMMARY.md: the four pushed heads and tags.</action>
+  <verify>
+    <automated>for r in "sm-moderation-plugin v0.1.1" "sm-forum-plugin v0.1.2" "vue-chat-layer v0.1.1" "vue-chatvideo-layer v0.1.1"; do set -- $r; [ "$(git -C ../$1 ls-remote origin refs/heads/main | cut -f1)" = "$(git -C ../$1 rev-parse HEAD)" ] || exit 1; [ "$(git -C ../$1 ls-remote origin "refs/tags/$2^{}" | cut -f1)" = "$(git -C ../$1 rev-parse HEAD)" ] || exit 1; done</automated>
+    <fails_when>Non-zero exit: a remote main differs from the local HEAD, or a tag is missing on origin or points elsewhere. Use the versions confirmed in Task 3 if they differ from the table; with "push-only" only the main check applies.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `git -C ../sm-moderation-plugin describe --exact-match HEAD` and the same in the other three repos print the new tag.
+  </acceptance_criteria>
+  <done>The four fixes are public at their patch tags on the default branch.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 5: The demo consumes the tags: layer pins, plugin bumps, the forum listener reads the rendered post, and the gitlink</name>
+  <precondition>Task 4 created all four tags on origin.</precondition>
+  <files>../sm-demo-app/vue-demo-app/package.json, ../sm-demo-app/vue-demo-app/pnpm-lock.yaml, ../sm-demo-app/vue-demo-app/app/pages/call/[conversation].vue, ../sm-demo-app/go.mod, ../sm-demo-app/go.sum, ../sm-demo-app/plugins/golem15/moderation, ../sm-demo-app/plugins/golem15/forum, ../sm-demo-app/plugins/demo/moderation.go, ../sm-demo-app/moderation_test.go, ../sm-demo-app/vue-demo-app, ../sm-demo-app/plugins/demo/content/ROADMAP.md</files>
+  <read_first>../sm-demo-app/plugins/demo/moderation.go, moderation_test.go (TestDemoModeration: setLists, post, put, refused, the stored-count check), go.mod, .gitmodules, scripts/check-pins.sh, scripts/build.sh (the release refusals), scripts/sync-roadmap.sh, vue-demo-app/package.json, vue-demo-app/app/pages/call/[conversation].vue, 20-07-SUMMARY.md (the listener finding), ../sm-moderation-plugin/README.md (CheckHTML), ../sm-forum-plugin/README.md (PostSaving.HTML)</read_first>
+  <behavior>
+    - TestDemoModeration, with the lists set to the demo defaults plus the path rule example.com/promo: every probe of check-moderation.sh, the path-rule forms (https://example.com:443/promo, https://example.com//promo, https://sub.example.com/promo) and the decomposed żółw case (with żółw added to the words), is refused with 422 on chat send, reply and edit (errors.content) and on forum thread title, thread body, reply and edit (errors.title or errors.body); nothing is stored.
+    - The rendered-only forum forms bit\.ly and via<!-- x -->gra are refused on reply and edit with errors.body (only CheckHTML on ev.HTML catches them).
+    - The existing TestDemoModeration cases keep passing.
+  </behavior>
+  <action>Per D-17, D-18 and D-13, in this commit order:
+1. vue-demo-app: `pnpm --dir ../sm-demo-app/vue-demo-app add` the two git+https specs at the new tags (vue-chat-layer and vue-chatvideo-layer). Update the doc comment of app/pages/call/[conversation].vue: ?start=1 picks Start over Join on the confirmation; media starts only after a click there, the call button or Accept. Run `pnpm test` and `pnpm run build`, then commit in vue-demo-app: `chore: pin vue-chat-layer and vue-chatvideo-layer v0.1.1`.
+2. sm-demo-app, for moderation and then forum: fetch tags in the submodule and check it out at the new tag; `GOWORK=off GOPRIVATE=git.golem15.com/* go -C ../sm-demo-app get git.golem15.com/golem15/sm-<name>-plugin@<tag>` and `GOWORK=off GOPRIVATE=git.golem15.com/* go -C ../sm-demo-app mod tidy` (GOPRIVATE as build.sh sets it); commit go.mod, go.sum and the gitlink: `chore: bump sm-moderation-plugin to v0.1.1`, then `chore: bump sm-forum-plugin to v0.1.2`.
+3. plugins/demo/moderation.go: checkPost also runs `Filter.CheckHTML` on `ev.HTML` (when not empty), after title and body, and answers a violation as `Rejection{Field: "body"}`; update the function and file comments (chat messages are checked by Check, which normalises; forum posts also by what they render to). Extend TestDemoModeration per the behavior block (red first for the rendered-only forms). Commit: `fix: refuse forum posts whose rendered text carries a banned word or link`.
+4. Commit the vue-demo-app gitlink in sm-demo-app: `chore: bump vue-demo-app (layers v0.1.1, sign-out reset)`.
+5. If `scripts/sync-roadmap.sh --check` reports a stale snapshot, run `scripts/sync-roadmap.sh` and commit `chore: sync the roadmap snapshot`.
+Nothing is pushed in this task.</action>
+  <verify>
+    <automated>go -C ../sm-demo-app vet ./... &amp;&amp; go -C ../sm-demo-app test -count=1 ./... &amp;&amp; go -C ../sm-demo-app test -count=1 -run '^(TestDemoModeration|TestGoModRequiresTags)$' -v . 2>&amp;1 | grep -cE -- '^--- PASS: Test(DemoModeration|GoModRequiresTags) ' | grep -qx 2 &amp;&amp; ../sm-demo-app/scripts/check-pins.sh &amp;&amp; pnpm --dir ../sm-demo-app/vue-demo-app test</automated>
+    <fails_when>Non-zero exit: vet or a Go test fails (a probe stored, a rendered-only form accepted, a go.mod require not a tag), check-pins reports a checkout off its required tag, or the site tests fail on the new pins.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -cE 'sm-moderation-plugin v0\.1\.1$|sm-forum-plugin v0\.1\.2$' ../sm-demo-app/go.mod` prints 2.
+    - `grep -cE 'vue-chat(video)?-layer\.git#v0\.1\.1' ../sm-demo-app/vue-demo-app/package.json` prints 2.
+    - `git -C ../sm-demo-app status --porcelain` prints nothing.
+  </acceptance_criteria>
+  <done>The demo builds from the released fixes only, and its own listener refuses forum posts by what they render to.</done>
+</task>
+
+<task type="auto">
+  <name>Task 6: The demo's whole gate passes locally on the released versions, including a release build and the smoke run</name>
+  <files>(no files; build outputs bin/demo and vue-demo-app/.output, untracked)</files>
+  <read_first>../sm-demo-app/scripts/check-all.sh (steps and --local), DEPLOY.md "Build", 20-06-SUMMARY.md (the last check-all run)</read_first>
+  <action>Run `../sm-demo-app/scripts/dev.sh up` (the stack now builds from the bumped submodules through go.work), then `../sm-demo-app/scripts/check-all.sh --local`. It runs the app and plugin suites, vitest in vue-demo-app and the four layers, sync-roadmap --check, check-pins, `build.sh release`, smoke.sh, check-deploy, then check-local back remote chatlive callmedia moderation and check-live against the current live site. Record the release id from the `build: ok release <id>` line and each step's result in the draft SUMMARY. If a step fails, fix the cause in the repository that owns it. A fix to a tagged repository means a new patch tag through Task 3's gate again, never a moved tag.</action>
+  <verify>
+    <automated>../sm-demo-app/scripts/check-all.sh --local 2>&amp;1 | tail -1 | grep -qx 'check-all: ok'</automated>
+    <fails_when>Non-zero exit: any check-all step fails (a suite, the snapshot, pins, the release build, smoke, check-deploy, a browser check or check-live).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The draft SUMMARY records `build: ok release <id>` and `smoke: ok` from this run.
+  </acceptance_criteria>
+  <done>The exact release that would go to rome passed the whole gate on this machine.</done>
+</task>
+
+<task type="checkpoint:decision" gate="blocking">
+  <name>Task 7: Go-ahead to push the demo repositories and deploy the release to rome</name>
+  <read_first>The release id from Task 6 and the check-all result; `git -C ../sm-demo-app log --oneline origin/master..HEAD` and the same for vue-demo-app; the list of what changes on rome: binary, site, config rsync; `migrate` (no new migrations in the bumped plugins: check `git -C <plugin> diff --stat <previous tag> <new tag> -- updates/`) and `demo:seed`; restart of summercms-demo and summercms-demo-site only; no nginx, Centrifugo, LiveKit, firewall or WavePath change; the rollback commands from DEPLOY.md "Rollback"</read_first>
+  <acceptance_criteria>
+    - The user's answer is recorded in the SUMMARY.
+  </acceptance_criteria>
+  <decision>Push vue-demo-app and sm-demo-app and deploy release <id> to demo.summercms.io?</decision>
+  <context>The live demo still has CR-01 (calls connect after Leave), CR-02 and CR-03 (filter bypasses), WR-01, WR-04 and WR-05. The release restarts only the demo's own two programs; bin/demo.prev and site/.output.prev stay for a rollback.</context>
+  <options>
+    <option id="deploy">
+      <name>Push and deploy</name>
+      <pros>The fixes are live today.</pros>
+      <cons>A short restart of the demo's API and site.</cons>
+    </option>
+    <option id="push-only">
+      <name>Push, deploy later</name>
+      <pros>The pins are backed up.</pros>
+      <cons>The live demo keeps the bugs; Tasks 8 to 10 wait.</cons>
+    </option>
+    <option id="hold">
+      <name>Hold</name>
+      <pros>No change anywhere.</pros>
+      <cons>As above, and the pins exist only here.</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "deploy", "push-only" or "hold".</resume-signal>
+</task>
+
+<task type="auto">
+  <name>Task 8: Push the demo, upload and release on rome by the runbook, and check the live site</name>
+  <reversibility rating="costly">A release can be rolled back with bin/demo.prev and site/.output.prev (DEPLOY.md "Rollback"); migrations, if any ran, are not reversed.</reversibility>
+  <precondition>Task 7 answered "deploy" (with "push-only" do steps 1 and 2 only and stop).</precondition>
+  <files>(no repository files; rome: /srv/summercms-demo/bin, /srv/summercms-demo/site, /srv/summercms-demo/config)</files>
+  <read_first>../sm-demo-app/DEPLOY.md "Upload", "Release", "Verify", "Rollback"; 20-05-SUMMARY.md (how the last release went, shared-host rules)</read_first>
+  <action>Per SC-3 and D-10.
+1. Push vue-demo-app master, check `git ls-remote` equals HEAD; then push sm-demo-app master, check the same.
+2. With "push-only", record and stop here.
+3. Build machine: DEPLOY.md "Upload", the three rsync lines exactly (config without overrides.yaml, bin/demo to bin/demo.new, vue-demo-app/.output/ to site/.output.new/, `--chown=root:root`, sudo rsync, `$RSH`), from the release built in Task 6 (re-run `scripts/build.sh` if anything changed since, then smoke.sh again).
+4. rome: DEPLOY.md "Release", exactly as written, in this order:
+   - migrate and demo:seed with bin/demo.new as summercms-demo with SUMMER_ENV=production;
+   - keep bin/demo.prev and site/.output.prev, then swap in the new binary and site;
+   - `sudo supervisorctl restart summercms-demo summercms-demo-site`;
+   - websockets:health answers Configuration OK.
+   Restart nothing else. Every command that could carry a secret runs on rome without echoing it.
+5. DEPLOY.md "Verify":
+   - `scripts/check-live.sh https://demo.summercms.io` prints `check-live: ok`;
+   - supervisorctl status shows the four demo programs RUNNING;
+   - the reset schedule stays off;
+   - `wavepath-livekit` keeps its pid (read-only check).
+6. Record in the draft SUMMARY: the release id, the commands' results, the pids before and after, and the rollback state.</action>
+  <verify>
+    <automated>[ "$(git -C ../sm-demo-app ls-remote origin refs/heads/master | cut -f1)" = "$(git -C ../sm-demo-app rev-parse HEAD)" ] &amp;&amp; [ "$(git -C ../sm-demo-app/vue-demo-app ls-remote origin refs/heads/master | cut -f1)" = "$(git -C ../sm-demo-app/vue-demo-app rev-parse HEAD)" ] &amp;&amp; ../sm-demo-app/scripts/check-live.sh https://demo.summercms.io</automated>
+    <fails_when>Non-zero exit: a remote master differs from the local HEAD, or check-live reports any failure after the release (roll back per DEPLOY.md and report if the site or API is broken).</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `ssh -p 2222 debian@10.8.3.118 sudo supervisorctl status summercms-demo summercms-demo-site summercms-demo-centrifugo summercms-demo-livekit` shows four RUNNING lines.
+  </acceptance_criteria>
+  <done>demo.summercms.io runs the release with all six fixes, and its anonymous checks pass.</done>
+</task>
+
+<task type="checkpoint:human-action" gate="blocking">
+  <name>Task 9: The user signs in on the live demo so the probes can act as members (an authentication gate: live login needs a real Turnstile solve)</name>
+  <action>Sign in on https://demo.summercms.io in a browser and save the session token for the probes. Claude cannot do this because live login is behind Turnstile.</action>
+  <instructions>
+    Claude already deployed the release and ran the anonymous live checks. The member probes need a signed-in session:
+    1. In a browser, log in at https://demo.summercms.io/login as the demo's visitor account (or any member account you use for checks).
+    2. In the browser's developer tools (Application, then Cookies), copy the value of the cookie `summercms_demo_token`.
+    3. Save it in a file only you can read, without pasting it into this chat: `install -m 600 /dev/null ~/.config/summercms/demo-live-jwt`, then paste the value into that file with an editor.
+    4. For the two-browser call probe, do the same with a second member account (register one in a private window if needed) into `~/.config/summercms/demo-live-jwt2`.
+    Alternatively run the checks yourself ("manual"):
+    - Send each probe from DEPLOY.md "Verify" as a DM to Ada and as a forum reply. Each must be refused, and the plain word viagra too.
+    - Open /call/{your DM with Ada}?start=1 directly. A Start call button must show, and the camera must stay off until you click it.
+    - From a second browser, call yourself from the DM button and accept. Both sides must connect.
+    - Leave while the page still says "Connecting…". The camera light must go off and the other side must stop ringing.
+    - Log out while a call rings. The prompt and the chat panel must go away.
+  </instructions>
+  <verification>Claude checks that each file exists with mode 600 and is not empty (`stat -c %a`, `test -s`), without reading its content into the conversation.</verification>
+  <resume-signal>Reply "tokens ready" (both files), "one token" (only demo-live-jwt; the call probe is then your manual check) or "manual approved" / "manual failed: what you saw".</resume-signal>
+</task>
+
+<task type="auto">
+  <name>Task 10: Live recheck: the bypass probe, the call probe, check-live and smoke, then the changelog drafts</name>
+  <precondition>Task 9 answered; for the automated probes the token files exist with mode 600.</precondition>
+  <files>(no repository files; drafts in this session's scratchpad)</files>
+  <read_first>The Task 9 answer, ../sm-demo-app/DEPLOY.md "Verify" (the probe commands from Task 1), ../sm-summercmsio-app/DEPLOY.md "Posting to the changelog", the CLAUDE.md changelog rules</read_first>
+  <action>Per SC-2, D-17 and D-13.
+1. With a token: `DEMO_JWT_FILE=~/.config/summercms/demo-live-jwt ../sm-demo-app/scripts/check-moderation.sh https://demo.summercms.io` prints `check-moderation: ok`.
+2. With two tokens: `DEMO_JWT_FILE=~/.config/summercms/demo-live-jwt DEMO_JWT2_FILE=~/.config/summercms/demo-live-jwt2 NODE_PATH="$(npm root -g)" node ../sm-demo-app/scripts/check-chat.cjs --base https://demo.summercms.io --call` prints `check-chat: ok call`. Fake media goes through rome's LiveKit; the direct-load step shows the confirmation. Do not run the default mode live: it would post in public #general and log the token out.
+3. With "manual approved", record the user's answer instead of the automated probe it replaces; with "manual failed", stop and report what the user saw against the fix it points to.
+4. `../sm-demo-app/scripts/check-live.sh https://demo.summercms.io` and `../sm-demo-app/scripts/smoke.sh` (the deployed artifact bin/demo) again; both ok.
+5. Remove the two token files (`rm -f`) and tell the user their browser sessions stay signed in.
+6. Changelog drafts. From ../sm-summercmsio-app run `scripts/changelog-post.py source <tag> --repo ../sm-moderation-plugin`, and the same for sm-forum-plugin. Write the user-facing notes to $SCRATCH/changelog-moderation.md and $SCRATCH/changelog-forum.md, using sections `## Highlights`, `## Added`, `## Changed` and `## Fixed` as needed. Include no H1, no planning IDs and no `quick-*` codes, and no consuming application's name. Add a one-line plain-text excerpt for each.
+   - Moderation: banned words and links now match what readers see (invisible characters, Unicode spaces, diacritics, entities, inline markup, URL forms browsers normalise); path entries cover subdomains; MatchHTML and Filter.CheckHTML for rendered content.
+   - Forum: PostSaving carries the rendered post HTML.
+7. Record every result in the draft SUMMARY.</action>
+  <verify>
+    <automated>../sm-demo-app/scripts/check-live.sh https://demo.summercms.io &amp;&amp; test -s "$SCRATCH/changelog-moderation.md" &amp;&amp; test -s "$SCRATCH/changelog-forum.md" &amp;&amp; ! grep -qE '^# |CR-0|WR-0|IN-0|20-0[0-9]|quick-' "$SCRATCH/changelog-moderation.md" "$SCRATCH/changelog-forum.md"</automated>
+    <fails_when>Non-zero exit: check-live fails, a draft is missing, or a draft has an H1, a review or plan ID or a quick code. The probe runs of steps 1 and 2 are recorded with their output line; a probe failure stops the plan with a report, which is not a verify failure.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - The draft SUMMARY records `check-moderation: ok` and `check-chat: ok call` against https://demo.summercms.io, or the user's manual answer for each.
+    - `test -e ~/.config/summercms/demo-live-jwt || echo gone` prints gone.
+  </acceptance_criteria>
+  <done>The live demo refuses every bypass from the review, asks before a call page turns media on, completes a DM call, and passes its anonymous checks and smoke run.</done>
+</task>
+
+<task type="checkpoint:decision" gate="blocking">
+  <name>Task 11: Go-ahead for the two plugin changelog posts</name>
+  <read_first>$SCRATCH/changelog-moderation.md and $SCRATCH/changelog-forum.md with their excerpts, the tags (sm-moderation-plugin v0.1.1, sm-forum-plugin v0.1.2), and whether ~/.config/summercms/journal-token exists (`test -s`, never read)</read_first>
+  <acceptance_criteria>
+    - The user's answer is recorded in the SUMMARY, with any wording changes applied to the drafts.
+  </acceptance_criteria>
+  <decision>Publish the two plugin posts on https://summercms.io/changelog/plugins?</decision>
+  <context>CLAUDE.md: plugin release tags get a post on /changelog/plugins the same day. The posts are public and can be updated later with --update. The layers get no post (no plugin.yaml, no changelog stream).</context>
+  <options>
+    <option id="publish">
+      <name>Publish both</name>
+      <pros>The releases are announced the day they are tagged.</pros>
+      <cons>Public at once.</cons>
+    </option>
+    <option id="draft">
+      <name>Save as drafts (--draft)</name>
+      <pros>The text can be reviewed in the admin first.</pros>
+      <cons>Not announced until published.</cons>
+    </option>
+    <option id="skip">
+      <name>Skip</name>
+      <pros>No post.</pros>
+      <cons>Breaks the same-day rule.</cons>
+    </option>
+  </options>
+  <resume-signal>Reply "publish", "draft" or "skip", with any changes to the text.</resume-signal>
+</task>
+
+<task type="auto">
+  <name>Task 12: Publish the posts as answered, and close the review ledger with commit refs and follow-up todos</name>
+  <precondition>Task 11 answered.</precondition>
+  <files>.planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW-DISPOSITION.md, .planning/todos/pending/chatchannels-pin-policy.md, .planning/todos/pending/moderation-profile-group-and-filenames.md, .planning/todos/pending/forum-friends-client-401-refresh.md, .planning/todos/pending/chatvideo-dm-only-host-hook.md, .planning/todos/pending/chatvideo-live-membership.md, .planning/todos/pending/check-local-jwt-out-of-argv.md, .planning/todos/pending/chat-slash-text-escape.md, .planning/todos/pending/demo-seed-moderation-lists-once.md, .planning/todos/pending/demo-nginx-livekit-rtc-only.md, .planning/todos/pending/chatvideo-incoming-handle-leak.md, .planning/todos/pending/demo-vapid-runbook-pipefail.md, .planning/todos/pending/demo-chat-members-read-only.md</files>
+  <read_first>20-REVIEW-DISPOSITION.md, 20-REVIEW.md (WR-02, WR-03, WR-06, IN-01 to IN-09: files, issue, fix), two existing files in .planning/todos/pending/ (format), .planning/G15OFFICE.md (todo mirroring), the commit refs from the 20-07, 20-08 and draft 20-09 SUMMARYs</read_first>
+  <action>Per SC-4 and the brief.
+1. Posts (with "publish" or "draft"):
+   - From ../sm-summercmsio-app, for each plugin, check the checkout is exactly at its tag with a clean worktree (`git -C ../sm-<name>-plugin describe --exact-match HEAD`; check out the tag if main moved on).
+   - Run `scripts/changelog-post.py publish <tag> <draft file> --excerpt "<line>" --repo ../sm-<name>-plugin`, adding --draft for "draft". The script reads the journal token itself.
+   - If the token file is missing or the token is refused, stop and ask the user. Never print, copy or mint a token.
+   - Check https://summercms.io/changelog/plugins lists the published posts.
+   - Return the checkouts to main.
+2. 20-REVIEW-DISPOSITION.md: CR-01, CR-02, CR-03, WR-01, WR-04 and WR-05 become `fixed`. Each note names the repo, the commit short sha and the tag, for example `sm-moderation-plugin <sha> (v0.1.1)`, plus the live check that confirmed it. WR-02, WR-03, WR-06 and IN-01 to IN-09 become `deferred`, each note pointing at its todo file. Add a `closed: 2026-11-02` line (or the actual date) to the frontmatter.
+3. Todos, one per deferred finding, in the existing format: title, date, priority (high for WR-02 and WR-03, medium for WR-06, IN-01, IN-02 and IN-07, low for the rest), area (the repo and file), an empty g15office field until the task exists. The body gives the finding's issue and fix in two or three sentences, with "Source: phase 20 code review (20-REVIEW.md <ID>)". IN-07's todo notes that the logout half was fixed by 20-08. The files are:
+   - chatchannels-pin-policy.md (WR-02)
+   - moderation-profile-group-and-filenames.md (WR-03)
+   - forum-friends-client-401-refresh.md (WR-06)
+   - chatvideo-dm-only-host-hook.md (IN-01)
+   - chatvideo-live-membership.md (IN-02)
+   - check-local-jwt-out-of-argv.md (IN-03)
+   - chat-slash-text-escape.md (IN-04)
+   - demo-seed-moderation-lists-once.md (IN-05)
+   - demo-nginx-livekit-rtc-only.md (IN-06)
+   - chatvideo-incoming-handle-leak.md (IN-07)
+   - demo-vapid-runbook-pipefail.md (IN-08)
+   - demo-chat-members-read-only.md (IN-09)
+4. g15office (.planning/G15OFFICE.md):
+   - Create one task per todo in project summercms (type Bug for WR-02, WR-03, WR-06, IN-02, IN-04, IN-05, IN-07 and IN-09, Improvement for the rest). Each description ends with `Local: .planning/todos/pending/<file>`. Write each task id into its todo's frontmatter.
+   - Post a short comment on the Phase 20 milestone task: the gap round released and deployed, with the four tags.
+   - If the g15office tools do not answer, leave the ids empty and list the todos as left for the user in the SUMMARY. Do not edit G15OFFICE.md itself.
+5. Commit in summercms.go by explicit path (planning docs only; STATE.md, state.json and G15OFFICE.md untouched): `docs(20): review disposition after the gap closure`.</action>
+  <verify>
+    <automated>D=.planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW-DISPOSITION.md; for f in CR-01 CR-02 CR-03 WR-01 WR-04 WR-05; do grep -E "^\| $f \|" $D | grep -q '| fixed |' || exit 1; done; for f in WR-02 WR-03 WR-06 IN-01 IN-02 IN-03 IN-04 IN-05 IN-06 IN-07 IN-08 IN-09; do grep -E "^\| $f \|" $D | grep -q '| deferred |' || exit 1; done; ls .planning/todos/pending/{chatchannels-pin-policy,moderation-profile-group-and-filenames,forum-friends-client-401-refresh,chatvideo-dm-only-host-hook,chatvideo-live-membership,check-local-jwt-out-of-argv,chat-slash-text-escape,demo-seed-moderation-lists-once,demo-nginx-livekit-rtc-only,chatvideo-incoming-handle-leak,demo-vapid-runbook-pipefail,demo-chat-members-read-only}.md >/dev/null &amp;&amp; git diff --quiet HEAD -- $D</automated>
+    <fails_when>Non-zero exit: a finding has the wrong disposition, a todo file is missing, or the ledger change is not committed.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c '| open |' .planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW-DISPOSITION.md` prints 0.
+    - Every fixed row names at least one commit sha and tag.
+    - The SUMMARY records the post URLs (or the draft ids, or "skipped") and the g15office ids or the note that they are left for the user.
+  </acceptance_criteria>
+  <done>The gap round is announced as the user chose, every review finding has its final disposition, and every deferred one is a tracked todo.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| build machine to origin | pushes and one-way tags that other applications pin |
+| build machine to rome | rsync and sudo on a shared production host |
+| probes to the live demo | member sessions posting test content on a public site |
+| build machine to summercms.io | the journal token publishing posts |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-20-47 | Tampering | release tags | high | mitigate | annotated tags on the default branch only after Task 3's go-ahead; fast-forward check before push; ls-remote equals HEAD; earlier tags are ancestors; never moved, a fix gets a new patch tag |
+| T-20-48 | Information disclosure | live member JWTs | high | mitigate | the user writes them into 0600 files (never pasted); scripts read the files, never print them, and pass the bearer header to curl as a config on stdin; the files are removed after the probes; the live default mode of check-chat (which would log out and post publicly) is not run |
+| T-20-49 | Tampering | probe content on the live demo | medium | mitigate | probes post only in the visitor's own DM and as replies or one thread on seeded content; a control word must be refused first; anything a probe stored is deleted at once and reported |
+| T-20-50 | Information disclosure | journal token | high | mitigate | changelog-post.py reads ~/.config/summercms/journal-token itself; it is never printed, copied or minted; a missing or refused token stops the step and asks the user |
+| T-20-51 | Denial of service | the shared host during the release | medium | mitigate | DEPLOY.md's release restarts only summercms-demo and summercms-demo-site; WavePath's pid is checked before and after; rollback with bin/demo.prev and site/.output.prev |
+| T-20-52 | Tampering | temporary integration leaking into a release | medium | mitigate | the scratch go.work and the tarball pins live outside the repos or are reverted in Task 2 (verify checks package.json and pnpm-lock.yaml are unchanged); build.sh release refuses dirty trees and pins off go.mod |
+| T-20-SC | Tampering | npm and Go installs | high | mitigate | only the project's own layers and plugins change version, by git tag; no third-party package is added or bumped; Go tidy runs against tags already on origin |
+</threat_model>
+
+<verification>
+- Task 1: the three checks pass against the unreleased fixes running together locally.
+- Task 2: every touched repository's full suite; the integration reverted; the release table.
+- Task 3: go-ahead for push and tags.
+- Task 4: remote heads and tags equal local HEAD.
+- Task 5: the demo on the tags, the listener on the rendered post, TestDemoModeration and check-pins green.
+- Task 6: check-all.sh --local ends with check-all: ok (release build and smoke included).
+- Task 7: go-ahead for push and deploy.
+- Task 8: pushed heads, the runbook release, check-live ok.
+- Task 9: live tokens or the user's manual answer.
+- Task 10: bypass probe and call probe against the live site, check-live and smoke again, changelog drafts clean.
+- Task 11: go-ahead for the posts.
+- Task 12: posts as answered; the ledger closed; twelve todos.
+</verification>
+
+<success_criteria>
+The six fixed findings are released at patch tags, consumed by the demo, deployed on demo.summercms.io and proven there (bypass probe, call probe, check-live, smoke); the two plugin posts are handled as the user decided; 20-REVIEW-DISPOSITION.md has no open row and every deferred finding is a todo.
+</success_criteria>
+
+<output>
+Create `.planning/phases/20-demo-instance-with-every-shared-plugin/20-09-SUMMARY.md` when done (it grows from the draft started in Task 2): the release table and tags, every checkpoint answer, the demo commits, the release id and rome results, the live probe results, the post URLs, the ledger changes and the todo list with g15office ids.
+</output>

.planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW-DISPOSITION.md

@@ -0,0 +1,31 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+review: 20-REVIEW.md
+recorded: 2026-11-02
+closed: 2026-11-03
+---
+
+# Phase 20 review disposition
+
+One row per finding in 20-REVIEW.md. `fixed` names the commits and the release tag and the check that confirmed it on the live demo (release 195aa213c546, deployed 2026-11-02 by plan 20-09); `deferred` points at the todo that tracks it. No row is open.
+
+| Finding | Severity | Disposition | Note |
+|---|---|---|---|
+| CR-01 | critical | fixed | Leaving or unmounting during start/join still connects and publishes camera and microphone. vue-chatvideo-layer 69e8b83, 27ad81c (v0.1.1): a per-attempt token with stale checks after every await; leave is final at any moment. Live: `check-chat.cjs --call` ok against demo.summercms.io. |
+| CR-02 | critical | fixed | Banned-link filter bypass through URL forms the browser normalises, rendered as working links. sm-moderation-plugin 266fc60, 9715ce7 (v0.1.1): link hosts and paths canonicalised like the URL parser; vue-chat-layer a798bb1 (v0.1.1): deceptive hosts render as text; sm-demo-app 262da37 (CheckHTML on the rendered forum post). Live: `check-moderation.sh` ok (fixed probe, sm-demo-app da481c9), every link form refused in chat, forum reply and thread title. |
+| CR-03 | critical | fixed | Banned-word filter bypass through invisible characters, Unicode spaces and forum Markdown. sm-moderation-plugin 266fc60, 9715ce7, 334697b (v0.1.1): words matched after NFKC, format characters, Unicode spaces, diacritics, entities and inline markup; MatchHTML/CheckHTML; sm-forum-plugin ec1a82c (v0.1.2): PostSaving.HTML; sm-demo-app 262da37 (listener checks the rendered post). Live: `check-moderation.sh` ok, every word form refused. |
+| WR-01 | warning | fixed | Logout leaves the chat store and the realtime socket of the previous user running. vue-demo-app 188ae25 (pinned in sm-demo-app 27c48cf with layers v0.1.1): logout and unauthorized reset the chat, close the realtime socket and dismiss the ring. Local: check-chat.cjs default mode, every /ws socket closed within 5 s of Log out (not run live: it posts in #general). |
+| WR-02 | warning | deferred | Any member can pin or unpin any message in every public channel; the message is not checked against the channel. Todo: .planning/todos/pending/chatchannels-pin-policy.md |
+| WR-03 | warning | deferred | Member-visible text outside the chat and forum seams is never moderated. Todo: .planning/todos/pending/moderation-profile-group-and-filenames.md |
+| WR-04 | warning | fixed | A link opens a call and turns the camera and microphone on with no confirmation. vue-chatvideo-layer 5386903 (v0.1.1): the call page asks before media unless the call button or Accept handed over; vue-demo-app 9a12701 (pins). Live: `check-chat.cjs --call`, a direct /call load showed the confirmation with no LiveKit socket, tile or session before the click. |
+| WR-05 | warning | fixed | A failed LiveKit connect posts `leave`, not `end`, leaving an empty ringing session behind. vue-chatvideo-layer 27ad81c (v0.1.1): a failed connect (or livekit-client import) ends a session nobody else joined, from GET status. Unit tests in useCall.test.ts; deployed with release 195aa213c546. |
+| WR-06 | warning | deferred | The forum and friends clients have no 401 refresh; an expired token shows "not found". Todo: .planning/todos/pending/forum-friends-client-401-refresh.md |
+| IN-01 | info | deferred | Group calls in public channels are blocked only by the seeded participant count. Todo: .planning/todos/pending/chatvideo-dm-only-host-hook.md |
+| IN-02 | info | deferred | chatvideo checks participant rows, not live membership. Todo: .planning/todos/pending/chatvideo-live-membership.md |
+| IN-03 | info | deferred | check-local passes member JWTs to curl in argv. Todo: .planning/todos/pending/check-local-jwt-out-of-argv.md |
+| IN-04 | info | deferred | A chat message that starts with "/" can never be posted. Todo: .planning/todos/pending/chat-slash-text-escape.md |
+| IN-05 | info | deferred | `demo:seed` brings back the default moderation lists after an admin empties them. Todo: .planning/todos/pending/demo-seed-moderation-lists-once.md |
+| IN-06 | info | deferred | nginx `/livekit/` exposes LiveKit's whole HTTP surface. Todo: .planning/todos/pending/demo-nginx-livekit-rtc-only.md |
+| IN-07 | info | deferred | The incoming-call runtime can leak a session handle and survives logout. The logout half was fixed by 20-08 (vue-demo-app 188ae25); the handle leak remains. Todo: .planning/todos/pending/chatvideo-incoming-handle-leak.md |
+| IN-08 | info | deferred | The VAPID runbook pipeline runs without `pipefail`. Todo: .planning/todos/pending/demo-vapid-runbook-pipefail.md |
+| IN-09 | info | deferred | `GET /chat/members` writes, and builds an unbounded `IN` list. Todo: .planning/todos/pending/demo-chat-members-read-only.md |

.planning/phases/20-demo-instance-with-every-shared-plugin/20-REVIEW.md

@@ -0,0 +1,387 @@
+---
+phase: 20-demo-instance-with-every-shared-plugin
+reviewed: 2026-11-01T23:50:42Z
+depth: standard
+files_reviewed: 105
+files_reviewed_list:
+  - ../sm-chat-plugin/api/errors.go
+  - ../sm-chat-plugin/classes/service.go
+  - ../sm-chat-plugin/classes/writes.go
+  - ../sm-chat-plugin/contracts/rejection.go
+  - ../sm-chat-plugin/events/events.go
+  - ../sm-chatvideo-plugin/go.mod
+  - ../sm-demo-app/config/env/production/golem15.chatvideo.yaml
+  - ../sm-demo-app/config/golem15.chatvideo.yaml
+  - ../sm-demo-app/config/golem15.chat.yaml
+  - ../sm-demo-app/deploy/nginx/demo.summercms.io.conf
+  - ../sm-demo-app/deploy/supervisor/summercms-demo-livekit.conf
+  - ../sm-demo-app/deploy/centrifugo.json.example
+  - ../sm-demo-app/deploy/livekit.yaml.example
+  - ../sm-demo-app/deploy/env.example
+  - ../sm-demo-app/DEPLOY.md
+  - ../sm-demo-app/.gitmodules
+  - ../sm-demo-app/go.mod
+  - ../sm-demo-app/go.work
+  - ../sm-demo-app/plugins/demo/chat_api.go
+  - ../sm-demo-app/plugins/demo/chatbots.go
+  - ../sm-demo-app/plugins/demo/chat.go
+  - ../sm-demo-app/plugins/demo/classes/chat_context.go
+  - ../sm-demo-app/plugins/demo/classes/forum_access.go
+  - ../sm-demo-app/plugins/demo/config/config.yaml
+  - ../sm-demo-app/plugins/demo/console/reset.go
+  - ../sm-demo-app/plugins/demo/console/seed_chat.go
+  - ../sm-demo-app/plugins/demo/console/seed_forum.go
+  - ../sm-demo-app/plugins/demo/console/seed_friends.go
+  - ../sm-demo-app/plugins/demo/console/seed.go
+  - ../sm-demo-app/plugins/demo/moderation.go
+  - ../sm-demo-app/plugins/demo/plugin.go
+  - ../sm-demo-app/plugins/demo/realtime_access.go
+  - ../sm-demo-app/plugins/demo/routes.go
+  - ../sm-demo-app/plugins.gen.go
+  - ../sm-demo-app/scripts/check-all.sh
+  - ../sm-demo-app/scripts/check-chat.cjs
+  - ../sm-demo-app/scripts/check-deploy.sh
+  - ../sm-demo-app/scripts/check-live.sh
+  - ../sm-demo-app/scripts/check-local.sh
+  - ../sm-demo-app/scripts/dev.sh
+  - ../sm-demo-app/scripts/smoke.sh
+  - ../sm-demo-app/summer.yaml
+  - ../sm-demo-app/vue-demo-app/app/assets/css/site.css
+  - ../sm-demo-app/vue-demo-app/app/components/SiteHeader.vue
+  - ../sm-demo-app/vue-demo-app/app/components/SiteNav.vue
+  - ../sm-demo-app/vue-demo-app/app/components/TourCard.vue
+  - ../sm-demo-app/vue-demo-app/app/layouts/default.vue
+  - ../sm-demo-app/vue-demo-app/app/lib/realtime.ts
+  - ../sm-demo-app/vue-demo-app/app/pages/account/security.vue
+  - ../sm-demo-app/vue-demo-app/app/pages/call/[conversation].vue
+  - ../sm-demo-app/vue-demo-app/app/pages/chat.vue
+  - ../sm-demo-app/vue-demo-app/app/pages/forum/index.vue
+  - ../sm-demo-app/vue-demo-app/app/pages/forum/t/[id].vue
+  - ../sm-demo-app/vue-demo-app/app/pages/friends.vue
+  - ../sm-demo-app/vue-demo-app/app/pages/index.vue
+  - ../sm-demo-app/vue-demo-app/app/plugins/auth.ts
+  - ../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts
+  - ../sm-demo-app/vue-demo-app/nuxt.config.ts
+  - ../sm-demo-app/vue-demo-app/pnpm-lock.yaml
+  - ../sm-demo-app/vue-demo-app/vitest.config.ts
+  - ../sm-forum-plugin/api/errors.go
+  - ../sm-forum-plugin/classes/forum_service.go
+  - ../sm-forum-plugin/classes/lifecycle.go
+  - ../sm-forum-plugin/contracts/rejection.go
+  - ../sm-forum-plugin/events/events.go
+  - ../sm-herald-plugin/go.mod
+  - ../sm-moderation-plugin/admin.go
+  - ../sm-moderation-plugin/classes/filter.go
+  - ../sm-moderation-plugin/go.mod
+  - ../sm-moderation-plugin/models/settings.go
+  - ../sm-moderation-plugin/plugin.go
+  - ../sm-moderation-plugin/config/config.yaml
+  - ../sm-moderation-plugin/models/settings/fields.yaml
+  - ../sm-moderation-plugin/updates/202610280001_create_golem15_moderation_settings.go
+  - ../sm-userfriends-plugin/go.mod
+  - ../vue-chat-layer/app/assets/css/chat-tokens.css
+  - ../vue-chat-layer/app/components/Chat/CommandPicker.vue
+  - ../vue-chat-layer/app/components/Chat/FloatingPanel.vue
+  - ../vue-chat-layer/app/components/Chat/Header.vue
+  - ../vue-chat-layer/app/components/Chat/ThreadPane.vue
+  - ../vue-chat-layer/app/components/Chat/Message.vue
+  - ../vue-chat-layer/app/components/Chat/MessageList.vue
+  - ../vue-chat-layer/app/components/Chat/LinkEmbed.vue
+  - ../vue-chat-layer/app/composables/useChat.ts
+  - ../vue-chat-layer/app/lib/client.ts
+  - ../vue-chat-layer/app/lib/chatText.ts
+  - ../vue-chat-layer/app/lib/markdown.ts
+  - ../vue-chat-layer/app/lib/linkEmbeds.ts
+  - ../vue-chat-layer/app/lib/realtime.ts
+  - ../vue-chat-layer/app/lib/slots.ts
+  - ../vue-chat-layer/nuxt.config.ts
+  - ../vue-chat-layer/vitest.config.ts
+  - ../vue-chatvideo-layer/app/composables/useCall.ts
+  - ../vue-chatvideo-layer/app/composables/useIncomingCalls.ts
+  - ../vue-chatvideo-layer/app/lib/callMachine.ts
+  - ../vue-chatvideo-layer/app/lib/videoClient.ts
+  - ../vue-chatvideo-layer/app/components/Chatvideo/Call.vue
+  - ../vue-chatvideo-layer/app/components/Chatvideo/CallButton.vue
+  - ../vue-chatvideo-layer/app/components/Chatvideo/IncomingCall.vue
+  - ../vue-chatvideo-layer/app/components/Chatvideo/Tile.vue
+  - ../vue-chatvideo-layer/nuxt.config.ts
+  - ../vue-forum-layer/app/components/Forum/Thread.vue
+  - ../vue-forum-layer/app/utils/forumClient.ts
+  - ../vue-userfriends-layer/app/components/Friends/Groups.vue
+  - ../vue-userfriends-layer/app/utils/friendsClient.ts
+findings:
+  critical: 3
+  warning: 6
+  info: 9
+  total: 18
+status: issues_found
+---
+
+# Phase 20: Code Review Report
+
+**Reviewed:** 2026-11-01T23:50:42Z
+**Depth:** standard
+**Files Reviewed:** 105 (the 86 listed files, plus the layer components, libs and deploy files the SUMMARYs under-listed)
+**Status:** issues_found
+
+## Summary
+
+The review covered the phase's code in its sibling repositories. That is the chat and forum pre-save seams (`git diff v0.1.4..main` and `v0.1.0..main`; both tags exist), the new sm-moderation-plugin, the sm-demo-app host plugin, deploy files and scripts (commits since 2026-10-28), vue-demo-app since 44a5229, and the four new layers.
+
+Areas that held up when traced:
+- **Pre-save seams.** Both are additive and silent without a listener, and they map `contracts.Rejection` to 422 on every chat and forum write path (send, reply, ReplyTo, edit; thread, reply, edit).
+- **Core plugins.** The phase changed no core plugin (user, journal/blog, pages, payment). sm-user-plugin is consumed by tag and unchanged.
+- **XSS.** `renderChatText` escapes everything before it adds tags, placeholders cannot be forged (`\u0000` is stripped), and `safeUrl` refuses `javascript:`, `data:` and `//` / `/\` paths. Forum `content_html` comes from goldmark plus bluemonday. Attachments download as octet-stream with the `download` attribute. No XSS was found.
+- **Realtime authorization.** Every Centrifugo namespace goes through the subscribe proxy. The `user`, `chat`, `video` and `presentations` authorizers each check their own rule, so giving every member a connection token does not widen channel access. LiveKit tokens are scoped to one room, with no `roomAdmin`.
+- **Runbook secrets.** The runbooks keep secrets out of argv and logs.
+
+Three defects need fixing before more traffic reaches the demo:
+1. **Call race (CR-01).** The call composable connects to LiveKit and publishes the camera and microphone after the user has already left or navigated away.
+2. **Link filter bypass (CR-02).** The banned-link filter misses URL forms that browsers normalise to the banned host. The chat then renders them as working links and link cards.
+3. **Word filter bypass (CR-03).** The banned-word filter misses invisible characters, non-breaking spaces and forum Markdown that renders to the banned word.
+
+Each bypass was confirmed by running `classes.Match` against the probes; all of them returned `flagged=false`.
+
+## Critical Issues
+
+### CR-01: Leaving or unmounting during start/join still connects and publishes camera and microphone
+
+**File:** `../vue-chatvideo-layer/app/composables/useCall.ts:177-231` (also `258-266`, `274-276`; Leave is enabled while `starting`/`connecting` in `../vue-chatvideo-layer/app/components/Chatvideo/Call.vue:72,91`)
+
+**Issue:** `begin()` never re-checks the state or `leaving` after its awaits (`client.start`/`client.join` at line 184, `import('livekit-client')` at line 193). It also assigns `room` only after the import. `leave()` sees `room === null`, so it cannot disconnect anything.
+
+- **Caller:** Leave is clicked while the status shows "Connecting…" (the state is `starting`). `leave()` dispatches `ended`, posts `end` (404, because the session does not exist yet) and navigates away. Then `start` resolves. `begin` subscribes `video:session:{id}`, loads livekit-client, creates a `Room`, connects, and runs `setCameraEnabled(true)` and `setMicrophoneEnabled(true)`. The server session was created and the callee is ringing. If they accept, they see and hear a caller who believes they hung up. Nothing on the page can stop it, and the channel handle leaks.
+- **Callee:** this path is worse. `begin(false)` dispatches nothing before `await client.join()`, so the state stays `idle`. Navigating away during the join runs `onBeforeUnmount → leave()`, which returns early on `status === 'idle'` (line 259). Then the join resolves: `transition` lets `joined` move `idle → connecting`, and the callee is live in the room with camera and microphone, with no UI and no leave posted.
+- **Second join:** the same missing guard lets a second `begin(false)` start while the first is pending. That creates two Rooms, and the first is never disconnected.
+
+**Fix:** Add a per-attempt token and bail out after every await. Mark the attempt live before the first await. Make `leave()` work from the pre-room states.
+
+```ts
+let attempt = 0
+async function begin(start: boolean) {
+  if (state.value.status !== 'idle' && isLive(state.value)) return
+  const mine = ++attempt
+  leaving = false
+  dispatch({ type: 'start' })            // also for the callee: leaves 'idle' before any await
+  const stale = () => mine !== attempt || leaving || !isLive(state.value)
+  let join: VideoJoin
+  try { join = start ? (takeStart(conversationId) ?? (await client.start(conversationId))) : await client.join(conversationId) }
+  catch (e) { if (!stale()) dispatch({ type: 'error', code: e instanceof VideoApiError ? e.status : 0, message: e instanceof Error ? e.message : '' }); return }
+  if (stale()) { void (start ? client.end(conversationId) : client.leave(conversationId)).catch(() => {}); return }
+  // ...same checks after import('livekit-client'), after r.connect(), and before each setXEnabled:
+  // if (stale()) { await r.disconnect(true); return }
+}
+async function leave() {
+  if (leaving || !isLive(state.value)) return   // no early return on 'idle' while an attempt is pending
+  leaving = true; attempt++                      // invalidates the in-flight begin
+  // ...
+}
+```
+
+Add `useCall.test.ts` cases: "leave while start is pending" and "unmount while join is pending". Both must assert that `Room.connect` and `setCameraEnabled` are never called.
+
+### CR-02: Banned-link filter bypass through URL forms the browser normalises, rendered as working links
+
+**File:** `../sm-moderation-plugin/classes/filter.go:50,122-135`; `../sm-moderation-plugin/models/settings.go:137-168`; rendering in `../vue-chat-layer/app/lib/chatText.ts:87-93`, `../vue-chat-layer/app/lib/linkEmbeds.ts:40-47,69-83` and `../vue-chat-layer/app/components/Chat/LinkEmbed.vue:13`
+
+**Issue:** `hostPattern` matches the literal text and compares hosts and paths byte for byte. The WHATWG URL parser (browsers, and `new URL` in `linkEmbeds.ts`) percent-decodes and IDNA-maps the host, so each form below reaches the banned host. Every probe returned `flagged=false` against `Match(["viagra",...], ["bit.ly","example.com/promo"], …)`. With `node`, `new URL()` resolves each one to `bit.ly`:
+
+| Text sent | What the browser opens |
+|---|---|
+| `https://bit%2Ely/x` | `https://bit.ly/x` |
+| `https://bit.l%79/x` | `https://bit.ly/x` |
+| `https://ｂｉｔ.ｌｙ/x` (fullwidth) | `https://bit.ly/x` |
+| `https://bit。ly/x` (U+3002) | `https://bit.ly/x` |
+| `https://example.com:443/promo` | path rule skipped: the port stops the path group |
+| `https://example.com/%70romo`, `//promo`, `https://example.com./promo` | path-prefix rules skipped |
+| `https://sub.example.com/promo` | path rules never cover subdomains |
+| punycode `xn--…` vs. Unicode host | either spelling of an IDN bypasses the other |
+
+The chat then renders the bypass as a clickable `<a href="https://bit%2Ely/x">`. `ChatLinkEmbed` makes it worse: its card shows the normalised host `bit.ly` and links to `https://bit.ly/x`. The forum renders the same through goldmark autolinks. Spammers can post any banned link, which defeats D-17 for links.
+
+**Fix:** Normalise both sides the way the browser does before comparing. In the filter, find every candidate URL or host, then:
+
+```go
+// for each candidate: s := found[0]; if no scheme, s = "http://" + s
+u, err := url.Parse(s)                                  // then:
+host, _ := url.PathUnescape(u.Hostname())               // %2E -> .
+host = strings.Map(func(r rune) rune {                  // ideographic/fullwidth dots
+	switch r { case '。', '．', '｡': return '.' }; return r }, host)
+host, err = idna.Lookup.ToASCII(norm.NFKC.String(host)) // fullwidth -> ASCII, Unicode -> punycode (x/net/idna)
+host = strings.TrimSuffix(strings.TrimPrefix(strings.ToLower(host), "www."), ".")
+path := path.Clean("/" + mustUnescape(u.EscapedPath())) // //promo, /./promo, %70romo
+```
+
+Apply the same `idna.Lookup.ToASCII` and NFKC to entries in `LinkEntry`. Let path rules also match subdomains, as host rules do. Widen `hostPattern` so its host class takes `%`, `．` and `。`, or tokenise on whitespace and parse each token. Add these probes to `filter_test.go`. `golang.org/x/net/idna` and `x/text` are already transitive dependencies of the framework; note them per the dependency rule.
+
+### CR-03: Banned-word filter bypass through invisible characters, Unicode spaces and forum Markdown
+
+**File:** `../sm-moderation-plugin/classes/filter.go:45,91,94,115`; seams `../sm-forum-plugin/classes/forum_service.go:284,341` and `../sm-forum-plugin/classes/lifecycle.go:235`; listener `../sm-demo-app/plugins/demo/moderation.go:65,86`
+
+**Issue:** The word regexp uses `[^\p{L}\p{N}_]` as its boundary and RE2's ASCII-only `\s+` between the words of a phrase. Confirmed with `classes.Match`:
+
+- **Invisible characters.** `via​gra` (zero-width space) and `vi­agra` (soft hyphen) display as "viagra" and are not flagged. Format characters (`\p{Cf}`) count as boundaries.
+- **Unicode spaces.** `buy followers` (NBSP; likewise U+2009, U+3000) is not flagged.
+- **NFD text.** Polish diacritics typed in decomposed (NFD) form do not match an NFC entry, and the combining mark counts as a boundary.
+- **Forum Markdown.** The forum seam passes the raw Markdown body and title, but members see `breakwater.Render` output. `via**gra**` renders "via**gra**" as one word, `vi&#97;gra` renders "viagra", and `[x](https://bit&#46;ly/a)` renders a link to `bit.ly` because CommonMark decodes entities in link destinations. None of them are flagged.
+
+Moderation is therefore cosmetic against anyone who tries once.
+
+**Fix:** Normalise the text before matching, in `Filter.Check` (and `Match`):
+
+```go
+t := norm.NFKC.String(text)
+t = strings.Map(func(r rune) rune {
+	if unicode.Is(unicode.Cf, r) { return -1 }        // ZWSP, ZWJ, soft hyphen, BOM...
+	if unicode.IsSpace(r) { return ' ' }               // NBSP, thin, ideographic spaces
+	return r
+}, t)
+```
+
+Use `[\p{Z}\s]+` in place of `\s+` between phrase words. Normalise entries with the same function in `ParseList`.
+
+For the forum, check the rendered text too. In the demo's `checkPost`, run the filter on `html.UnescapeString` of `breakwater.Render(body)` with tags stripped, and on the hrefs it contains. Alternatively, have forum's `PostSaving` carry the rendered HTML (an additive field) so every host gets it.
+
+## Warnings
+
+### WR-01: Logout leaves the chat store and the realtime socket of the previous user running
+
+**File:** `../sm-demo-app/vue-demo-app/app/composables/useDemoAuth.ts:83-92`, `../sm-demo-app/vue-demo-app/app/components/SiteHeader.vue:12-15`, `../sm-demo-app/vue-demo-app/app/utils/communityAuth.ts:57`; `reset()` in `../vue-chat-layer/app/composables/useChat.ts:1514-1516`
+
+**Issue:** `logout()` blacklists the JWT and clears the cookie. Nothing calls `useChat().reset()` or the realtime `disconnect()`, and the floating panel just unmounts. `start()` is the only caller of `reset()`, and it runs only when a chat view mounts again. After logout the tab therefore keeps:
+- the Centrifugo connection and the `user:{me}` subscription, which deliver the old user's DM and call events until the connection token expires;
+- the old user's messages and DMs in `useState`;
+- a pending incoming-call prompt in `chatvideo:incoming`.
+
+`$chatAuth.unauthorized()` has the same gap: it only clears the cookie. The layer's own comment says reset exists so that a second account never sees the first one's chat, but the host never wires it.
+
+**Fix:** In `logout()` (and in `unauthorized`), after clearing the token, call `useChat().reset()` (it disconnects the shared client) and clear `useState('chatvideo:incoming')`. Alternatively, `watch(loggedIn)` in `plugins/auth.ts` and reset when it turns false. Add a vitest case for the logout path.
+
+### WR-02: Any member can pin or unpin any message in every public channel; the message is not checked against the channel
+
+**File:** `../sm-demo-app/plugins/demo/classes/chat_context.go:259-269` (the policy) reaching `../sm-chatchannels-plugin/classes/channel_service.go:1332-1353` and `../sm-chatchannels-plugin/api/pins.go:31-52`
+
+**Issue:** chatchannels gates `PinMessage` and `UnpinMessage` only with `requireChannelAccess`. The demo's `ChatAccess.CanAccessContext` answers true for every member, so any registered visitor can unpin the seeded welcome pins in #general, #announcements and #ogólny, or flood the pins panel. `PinMessage` also never checks that `messageID` belongs to the channel's conversation, so pins can point at another conversation's (DM) message ids. Contents do not leak, because the client's `GET /messages/{id}` needs participation, but the rows are bogus. Plan 03 noted "the visitor was allowed to pin … the pin succeeded" without treating it as a gap.
+
+**Fix:** Make pinning a manage action, for example additively in chatchannels: `PinMessage`/`UnpinMessage` require `CanManageContext`, or an optional `contracts.PinPolicy` the host implements. The demo then answers it from the moderator group. Also verify `message.conversation_id == *ch.ConversationID` before creating the pin. Until then, the demo layer can hide pin actions for non-moderators (`pinAllowed`), but the server must enforce the rule.
+
+### WR-03: Member-visible text outside the chat and forum seams is never moderated
+
+**File:** `../sm-demo-app/plugins/demo/moderation.go:28-44`
+
+**Issue:** The filter runs only on `MessageSaving.Content` and the `PostSaving` title and body. Members write other text that other members see:
+- **Profile name and surname.** They appear in `/chat/members` for every member, in mention chips, in DM headers, as forum `author_name`, and as `caller_name` in the incoming-call prompt.
+- **userfriends group names and descriptions.** They are shown to invitees in the code preview.
+- **Chat attachment filenames.**
+
+A member registering as "free crypto bit.ly/x" puts that text in front of everyone, including in a ringing prompt. D-17 states that banned words and links are refused on every write path.
+
+**Fix:** Run `Filter.Check` on the profile name and surname at registration and profile update. Use a user-plugin saving event if one exists, otherwise the demo's own registration route, without changing the core user plugin. Do the same for userfriends group create and update if a seam exists, or add an additive `GroupSaving` seam, and for attachment filenames (chat `MessageSaving` could carry them additively). Record any path left out as an explicit, documented exception.
+
+### WR-04: A link opens a call and turns the camera and microphone on with no confirmation
+
+**File:** `../vue-chatvideo-layer/app/components/Chatvideo/Call.vue:34-36`, `../sm-demo-app/vue-demo-app/app/pages/call/[conversation].vue:17,30`; same-tab site links in `../vue-chat-layer/app/lib/markdown.ts:22`
+
+**Issue:** `ChatvideoCall` calls `begin()` on mount. `/call/{id}?start=1` starts a call (and rings the other side), and `/call/{id}` joins a live one. The chat renders site paths such as `/call/45?start=1` as same-tab links. One member can DM another `[see this](/call/45?start=1)`, where 45 is their shared DM. A click puts the victim in a call that publishes camera and microphone at once; once the origin has the media permission there is no prompt. A forged `?start=1` also bypasses the call button's intent.
+
+**Fix:** Require an explicit action on the call page. Render a "Start call" or "Join" button and call `begin()` from its click. Keep auto-start only for a `takeStart()` handoff, which proves the click came from `ChatvideoCallButton`, and drop the `?start=1` trigger for direct loads.
+
+### WR-05: A failed LiveKit connect posts `leave`, not `end`, leaving an empty ringing session behind
+
+**File:** `../vue-chatvideo-layer/app/composables/useCall.ts:204-208`
+
+**Issue:** When `r.connect()` fails, the caller posts `client.leave()`. As the starter and only connected participant, the session stays `pending` or `active` with nobody in it:
+- the callee keeps ringing for up to 45 s, and Accept joins an empty room;
+- Retry (`begin(true)`) gets the existing session back (`Created: false`), so it never rings again until the reconcile job runs.
+
+This is the "left-open session never rings again" bug that `leave()` itself fixed with "last one out ends".
+
+**Fix:** Use the same rule as `leave()`: `void (start || r.remoteParticipants.size === 0 ? client.end(conversationId) : client.leave(conversationId)).catch(() => {})`.
+
+### WR-06: The forum and friends clients have no 401 refresh; an expired token shows "not found"
+
+**File:** `../vue-forum-layer/app/utils/forumClient.ts:139-159`, `../vue-forum-layer/app/components/Forum/Thread.vue:41`, `../vue-userfriends-layer/app/utils/friendsClient.ts:135`
+
+**Issue:** The chat and video clients refresh once on 401 through `$chatAuth.refresh()`. `$forumAuth` and `$userfriendsAuth` are bare token getters, and neither client retries. After the JWT expires, a member on `/forum/t/{id}` sees "thread not found", because `Thread.vue` maps 401 to `forum.error.notFound`. Posting fails the same way. `/chat` keeps working in the same tab.
+
+**Fix:** Give both hooks the `{token, refresh, unauthorized}` shape (the demo can pass `chatAuth`), and add the chat client's single-flight refresh-and-retry to `request()`. Map 401 to its own "signed out" message rather than not-found.
+
+## Info
+
+### IN-01: Group calls in public channels are blocked only by the seeded participant count
+
+**File:** `../sm-demo-app/config/golem15.chatvideo.yaml:13-18`, `../sm-chatvideo-plugin/classes/video_service.go:91,109-112`
+
+**Issue:** The server has no DM-only rule (D-23 is UI only, as documented). Channel calls are refused today only because the four personas plus any visitor exceed `max_participants: 4`. If the cap is raised, or a channel is created with fewer seeded participants, any member can start a call that rings everyone who opened that channel.
+
+**Fix:** Add a host hook in chatvideo (for example an optional `CanStartCall(conversationType)`), or check `conversation.type == dm` in the demo, so the rule does not depend on seed data.
+
+### IN-02: chatvideo checks participant rows, not live membership
+
+**File:** `../sm-chatvideo-plugin/classes/video_service.go:425-443`, `../sm-chatvideo-plugin/classes/authorizer.go:54-79`
+
+**Issue:** A ban revokes the user's JWTs, so new calls are blocked. A LiveKit join token already minted (900 s) and an open `video:session` subscription still survive the ban, because chatvideo never consults `contracts.LiveMembership` as chat does.
+
+**Fix:** Optional: have chatvideo honour `LiveMembership` (via chat's `Service.IsParticipant`) in `requireParticipant` and the authorizer, and remove the participant from the LiveKit room on a ban.
+
+### IN-03: check-local passes member JWTs to curl in argv
+
+**File:** `../sm-demo-app/scripts/check-local.sh:452,514,601` (and the friends checks)
+
+**Issue:** The LiveKit join token is passed carefully through a curl config on stdin, but the member JWTs go into `-H "Authorization: Bearer $jwt"` arguments, which other local users can read in `/proc/*/cmdline`. This is local and uses throwaway users, but it is inconsistent with the stated pattern.
+
+**Fix:** Reuse the `curl -K -` approach with `header = "Authorization: Bearer …"`.
+
+### IN-04: A chat message that starts with "/" can never be posted
+
+**File:** `../vue-chat-layer/app/composables/useChat.ts:825-829`
+
+**Issue:** Every text starting with `/` (for example "/r/golang is great", or a path) is dispatched as a slash command and refused as unknown.
+
+**Fix:** Dispatch only when the first token matches a known trigger from `commands`, or support a `//` escape.
+
+### IN-05: `demo:seed` brings back the default moderation lists after an admin empties them
+
+**File:** `../sm-demo-app/plugins/demo/console/seed_friends.go:117-122`
+
+**Issue:** `seedModerationLists` refills both lists whenever both are empty, and every release runs `demo:seed`. An admin who deliberately clears both lists gets the defaults back at the next deploy.
+
+**Fix:** Seed only on the first run, for example by inserting the lists in a row-creation step or recording a seeded flag.
+
+### IN-06: nginx `/livekit/` exposes LiveKit's whole HTTP surface
+
+**File:** `../sm-demo-app/deploy/nginx/demo.summercms.io.conf:363-375`
+
+**Issue:** Browsers need only `/rtc` (and `/rtc/validate`). The location also exposes LiveKit's Twirp `RoomService` on the public origin. That service is protected by admin JWTs signed with the API secret, so exposing it publicly is unnecessary.
+
+**Fix:** `location ^~ /livekit/rtc { proxy_pass http://127.0.0.1:7890/rtc; … }`, and answer 404 for the rest of `/livekit/`. Adjust check-deploy.
+
+### IN-07: The incoming-call runtime can leak a session handle and survives logout
+
+**File:** `../vue-chatvideo-layer/app/composables/useIncomingCalls.ts:41-56,58-70`
+
+**Issue:** Two `video:call:incoming` events for the same session, both pending in `subscribe`, both pass the `pending.value?.sessionId === call.sessionId` check. The second overwrites `rt.channel` and the first handle is never closed. `pending` is also never cleared on logout (see WR-01).
+
+**Fix:** Keep a sequence number per `watchSession` and close the handle unless it is the latest. Clear `pending` from the logout path.
+
+### IN-08: The VAPID runbook pipeline runs without `pipefail`
+
+**File:** `../sm-demo-app/DEPLOY.md:533-540`
+
+**Issue:** The remote script uses `set -e` without `pipefail`. If `herald:vapid-generate` fails, `jq` emits nothing and `tee -a` appends nothing, but the `SUBJECT` line is still appended. The re-run guard (`grep -c "^…VAPID__" = 0`) then refuses ("already in .env") although no key pair exists, and recovery needs a hand edit of `.env`. The keys were already applied on rome; this matters for a rebuild.
+
+**Fix:** Use `set -eo pipefail`, generate into a variable first, check both keys are non-empty, then append all three lines in one `tee`.
+
+### IN-09: `GET /chat/members` writes, and builds an unbounded `IN` list
+
+**File:** `../sm-demo-app/plugins/demo/chat_api.go:338-358`
+
+**Issue:** A GET assigns handles (`AssignHandle`) to members without one. Two concurrent first loads race on the same rows. It also expands every member id into `id IN ?`, which fails with 500 past Postgres' 65535 bind-parameter limit. The production reset schedule is off, so users accumulate.
+
+**Fix:** Select with the `memberWhere` subquery (`WHERE id <> ? AND <memberWhere>`) instead of an id list. Assign missing handles at registration or in `demo:seed`, not in a GET.
+
+---
+
+_Reviewed: 2026-11-01T23:50:42Z_
+_Reviewer: Claude (msd-code-reviewer)_
+_Depth: standard_

.planning/phases/20-demo-instance-with-every-shared-plugin/COVERAGE.md

@@ -0,0 +1,72 @@
+# API Coverage — Phase 20 (livekit-client, LiveKit server, Centrifugo, Web Push)
+
+> Full coverage by default. Opt-outs are explicit, reasoned decisions. The phase builds no new server-side client: LiveKit's server API is called by `sm-chatvideo-plugin` (server-sdk-go), Centrifugo by `lighthouse`, Web Push by `sm-herald-plugin`. This phase adds the browser side of the video calls (`vue-chatvideo-layer` on `livekit-client` 2.23.0, plan 04), the chat's use of Centrifugo (`vue-chat-layer`, plan 03) and herald's VAPID configuration (plan 04).
+
+## livekit-client 2.23.0 (plan 04, vue-chatvideo-layer)
+
+| capability | decision | reason |
+|---|---|---|
+| Room connect (livekit_url and the server-minted join token) | INTEGRATE | |
+| Room disconnect (stops the local tracks) | INTEGRATE | |
+| publish camera (localParticipant.setCameraEnabled) | INTEGRATE | |
+| publish microphone (localParticipant.setMicrophoneEnabled) | INTEGRATE | |
+| subscribe and attach remote tracks (TrackSubscribed, track.attach and detach) | INTEGRATE | |
+| mute and unmute | INTEGRATE | |
+| camera toggle | INTEGRATE | |
+| participant events (ParticipantConnected, ParticipantDisconnected, TrackMuted, TrackUnmuted, LocalTrackPublished) | INTEGRATE | |
+| connection state and reconnection (Reconnecting, Reconnected, Disconnected) | INTEGRATE | |
+| adaptiveStream and dynacast | INTEGRATE | |
+| audio playback unlock (AudioPlaybackStatusChanged, startAudio) | INTEGRATE | |
+| dynamic import of the package | INTEGRATE | |
+| screen share | OPT-OUT | explicitly out of scope: D-13 keeps the call page minimal and the server config has screen_share false |
+| data channel (publishData, data streams, RPC) | OPT-OUT | not needed: chat messages go through the chat plugins, not the call |
+| device selection (switchActiveDevice, getLocalDevices) | OPT-OUT | not needed for a minimal demo call: the browser's default camera and microphone are used |
+| end-to-end encryption (E2EE worker) | OPT-OUT | explicitly out of scope: a public demo call with a short-lived room; media is DTLS-SRTP encrypted in transit |
+| recording and egress | OPT-OUT | explicitly out of scope: the demo records nothing |
+| simulcast tuning (videoEncoding, layers) | OPT-OUT | not needed: the defaults with adaptiveStream and dynacast fit 1:1 calls |
+| audio-only mode | OPT-OUT | not needed: turning the camera off gives the same call without video |
+| background effects and track processors | OPT-OUT | not needed: not part of a minimal call page |
+| active speaker highlighting | OPT-OUT | not needed: calls are 1:1 DMs (D-11), so there is no speaker to pick out |
+
+## LiveKit server 1.13.1 through golem15.chatvideo (plans 02 and 05)
+
+| capability | decision | reason |
+|---|---|---|
+| room create (on video/start) | INTEGRATE | |
+| room delete (on video/end and at max_duration) | INTEGRATE | |
+| join token mint (per participant, token_ttl 900) | INTEGRATE | |
+| participant count and active rooms (reconcile) | INTEGRATE | |
+| remove participant (on video/leave) | INTEGRATE | |
+| reconcile job (chatvideo:reconcile-sessions ends idle and overdue rooms) | INTEGRATE | |
+| room max_participants (4 in livekit.yaml, next to chatvideo max_participants, D-12) | INTEGRATE | |
+| /rtc/validate (check-local call) | INTEGRATE | |
+| egress (recording, streaming) | OPT-OUT | explicitly out of scope: the demo records nothing |
+| ingress (RTMP, WHIP) | OPT-OUT | explicitly out of scope: calls start from the site only |
+| SIP | OPT-OUT | explicitly out of scope: no phone dial-in on a public demo |
+| webhooks | OPT-OUT | not needed: the reconcile job polls room state, and the call events go through Centrifugo |
+| TURN server | OPT-OUT | deferred: plan 05 decides it with the rome network setup (ICE TCP 7891 and UDP 7892 first) |
+
+## Centrifugo v6 (plans 02 to 04)
+
+| capability | decision | reason |
+|---|---|---|
+| chat namespace with presence and join/leave | INTEGRATE | |
+| user namespace (user:{id}, the chat's events and video:call:incoming) | INTEGRATE | |
+| video namespace (video:session:{id}: accepted, ended, participant joined and left) | INTEGRATE | |
+| subscribe proxy on chat, user and video | INTEGRATE | |
+| one shared client per page (vue-chat-layer realtime, onUserEvent for other layers) | INTEGRATE | |
+| server HTTP API publish (lighthouse broadcast jobs) | INTEGRATE | |
+| history and recovery | OPT-OUT | not needed: the chat refetches the open conversation over HTTP on every (re)subscribe |
+| client-side publish | OPT-OUT | explicitly out of scope: browsers never publish; Go publishes after authorizing the write |
+| client RPC | OPT-OUT | not needed: every action is an HTTP call |
+| presence on the video namespace | OPT-OUT | not needed: LiveKit's participant events show who is in the call |
+
+## Web Push through golem15.herald (plan 04)
+
+| capability | decision | reason |
+|---|---|---|
+| VAPID key pair in .env (herald:vapid-generate, D-16) | INTEGRATE | |
+| VAPID public key route (/_herald/api/v1/push/vapid-public-key, check-local herald) | INTEGRATE | |
+| subscribe UI and service worker | OPT-OUT | deferred per D-16: herald is mounted without UI in this phase |
+| push on chat events (DMs, mentions, incoming calls) | OPT-OUT | deferred per D-16: needs the subscribe UI first |
+| push to /_herald from the site (goPaths) | OPT-OUT | deferred per D-16: the site does not call herald, so /_herald is not routed by vue-demo-app |

.planning/phases/33-seo-output-audit-and-content/33-01-SUMMARY.md

@@ -0,0 +1,254 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 01
+subsystem: framework
+tags: [pact, signpost, cabana, content-descriptor, field-types, gate-script, release-ledger]
+
+requires:
+  - phase: 32-seo-foundation
+    provides: pact.ContentDescriptor, signpost content registry, plugin field types, form extensions, check-phase32.sh engine
+provides:
+  - pact.ContentDescriptor.Kind and Tools with ContentKind*/ContentTool* constants
+  - pact.ContentRecord.PublishedAt, Parents, Authors, TopHeading
+  - pact.ContentLocale.Images, Videos, Headings and the value types ContentRef, ContentPerson, ContentImage, ContentVideo, ContentHeading
+  - pact.FormFieldType.RequestOptions merged into served typeOptions per schema request
+  - scripts/check-phase33.sh (eleven stages plus --all)
+  - 33-release-log.md (v0.6.1 planned contents and release order)
+affects: [33-02, 33-03, 33-04, 33-05, 33-06, 33-07, 33-08, 33-09, 33-10, 33-11, 33-12, 33-13, 33-14]
+
+actuals:
+  tokens: 24700
+  tasks: 4
+  commits: 4
+plan_head_before: 399efed845bc7dc7e6a1dbd26ed74d78172684e4
+plan_head_after: 21aa4e5
+
+tech-stack:
+  added: []
+  patterns:
+    - "Optional descriptor facts: new slices are nil-or-empty alike; signpost hands records through untouched"
+    - "Per-request field options: computed once per type per schema request, merged into a copy, fields.yaml wins, errors fail open with one WARN"
+
+key-files:
+  created:
+    - modules/signpost/content_fields_smoke_test.go
+    - modules/cabana/field_request_options_smoke_test.go
+    - scripts/check-phase33.sh
+    - .planning/phases/33-seo-output-audit-and-content/33-release-log.md
+  modified:
+    - modules/pact/content.go
+    - modules/pact/capabilities.go
+    - modules/cabana/field_type.go
+    - modules/cabana/http.go
+    - modules/cabana/schema_types.go
+    - modules/cabana/admin_openapi.go
+    - modules/signpost/example_content_test.go
+    - modules/cabana/example_field_type_test.go
+    - admin/openapi/admin.json
+    - admin/src/api/schema.d.ts
+    - docs/plugins/menu-item-types.md
+    - docs/backend/field-types.md
+    - modules/pact/README.md
+    - modules/signpost/README.md
+    - modules/cabana/README.md
+
+key-decisions:
+  - "Task 1 Decision A (Jakub 2026-11-04): as-planned; P33-01 descriptor fields/constants/value types and P33-02 FormFieldType.RequestOptions exactly as the plan names them"
+  - "Task 1 Decision B (Jakub 2026-11-04): WR-02 accepted; pact.RecordSaved.Locale stays the primary tag of the request locale (released in v0.5.2)"
+  - "Task 1 Decision C (Jakub 2026-11-04): Phase 33 delivers SummerCMS v0.6.1 (patch, additive); additive and marker stages compare with v0.6.0; plans reading v0.5.1/v0.5.2 mean v0.6.0/v0.6.1"
+  - "RequestOptions receives the application database bound to the request context, nil when none is configured"
+
+patterns-established:
+  - "Content facts: a content type may set Kind/Tools and per-record PublishedAt/Parents/Authors/TopHeading/Images/Videos/Headings; consumers read them through signpost without importing the content plugin"
+  - "Phase gate: check-phase33.sh stage engine; a missing repository fails with 'missing <path>'"
+
+requirements-completed: [SC-2, SC-3, D-93, D-90, D-106, D-43, D-86, D-31, D-85, D-50, D-51, D-96, D-10]
+
+coverage:
+  - id: D1
+    description: "Additive content descriptor fields and value types, handed through signpost.Describe and signpost.Records unchanged; a type without them describes as before"
+    requirement: "D-93"
+    verification:
+      - kind: unit
+        ref: "modules/signpost/content_fields_smoke_test.go#TestContentDescriptorFields"
+        status: pass
+      - kind: unit
+        ref: "modules/signpost/example_content_test.go#ExampleRegistry_MatchPath"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "pact.FormFieldType.RequestOptions merged into served typeOptions (every screen, fields.yaml wins, once per type per request, error fails open with one warning, unchanged schema without it, form extension fields, authenticated handler only)"
+    requirement: "SC-3"
+    verification:
+      - kind: unit
+        ref: "modules/cabana/field_request_options_smoke_test.go#TestFieldTypeRequestOptions"
+        status: pass
+      - kind: other
+        ref: "scripts/check-admin-openapi.sh --check"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Framework API strictly additive against v0.6.0 and no framework line names SEO, a sitemap, JSON-LD or an application"
+    requirement: "D-106"
+    verification:
+      - kind: other
+        ref: "bash scripts/check-phase33.sh --go --docs --marker --additive"
+        status: pass
+      - kind: other
+        ref: "bash scripts/check-phase33.sh --compat"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "check-phase33.sh with eleven stages; self-test detects an API removal, an interface method, a marker hit, a failing go test and a missing repository"
+    verification:
+      - kind: other
+        ref: "bash scripts/check-phase33.sh --self-test"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "33-release-log.md records v0.6.1 planned contents, the six Phase 32 fixes as already released in v0.5.2, plugin/layer tag state and the release order"
+    verification: []
+    human_judgment: true
+    rationale: "A planning ledger; its accuracy and the release order are Jakub's call before 33-14 tags anything"
+
+duration: 22min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 01: Framework seams, phase gate and release ledger Summary
+
+**Optional content facts on pact.ContentDescriptor/Record/Locale (kind, MCP tools, first publication, parents, authors, top heading, images, videos, heading outline), per-request plugin field options through pact.FormFieldType.RequestOptions, the eleven-stage check-phase33.sh gate and the v0.6.1 release ledger**
+
+## Task 1 answers (Jakub, 2026-11-04)
+
+Later plans (33-02 to 33-14) use these:
+
+1. **Decision A: as-planned.** P33-01 and P33-02 are adopted exactly as written, no rename:
+   - `pact.ContentDescriptor.Kind string` with `ContentKindArticle = "article"`, `ContentKindCollection = "collection"`, `ContentKindProfile = "profile"`, `ContentKindPage = "page"`;
+   - `pact.ContentDescriptor.Tools map[string]string` with `ContentToolEdit = "edit"`, `ContentToolHeadings = "headings"`, `ContentToolImageAlt = "image_alt"` (values are full MCP tool names);
+   - `pact.ContentRecord.PublishedAt *time.Time`, `Parents []ContentRef`, `Authors []ContentPerson`, `TopHeading int`;
+   - `pact.ContentLocale.Images []ContentImage`, `Videos []ContentVideo`, `Headings []ContentHeading`;
+   - `ContentRef{Type, ID string}`, `ContentPerson{Name string; Ref ContentRef}`, `ContentImage{URL, Alt string; Decorative bool; Width, Height int}`, `ContentVideo{Provider, ID string}`, `ContentHeading{Level int; Text string}`;
+   - `pact.FormFieldType.RequestOptions func(ctx context.Context, db *gorm.DB) (map[string]any, error)` with `json:"-"`.
+2. **Decision B: WR-02 accepted.** `pact.RecordSaved.Locale` stays the primary tag of the request locale, as released in v0.5.2 (commit 1583651). 32-UAT.md is left to verify-work.
+3. **Decision C: version base.** Tags v0.5.2, v0.5.3 and v0.6.0 already exist and contain all six Phase 32 fixes (676ca53, 5471b66, d660cd0, 468af06, 1583651, 0e187cf). This phase delivers **SummerCMS v0.6.1** (patch, additive per D-106). `check-phase33.sh --additive` compares against the newest tag not containing HEAD (computed, currently v0.6.0); `--marker` diffs from v0.6.0 (`PHASE33_BASE`). **Where a Phase 33 plan says v0.5.1 (base) or v0.5.2 (target), read v0.6.0 and v0.6.1.** Nothing is pushed or tagged before 33-14.
+
+## Performance
+
+- **Duration:** 22 min (continuation; Task 1 answered before this run)
+- **Started:** 2026-11-04T07:26:44Z
+- **Completed:** 2026-11-04T07:49:00Z
+- **Tasks:** 4 (Task 1 decision, Tasks 2-4 executed)
+- **Files modified:** 19
+
+## Accomplishments
+
+- Content types can describe kind, fixing MCP tools, first publication, ordered parents, authors, top heading level, images (with alt and a decorative flag), videos and the heading outline; signpost hands them through, and a type without them is unaffected.
+- A plugin field type can serve per-request options to its element through the existing `typeOptions` attribute; the compiled schema is never mutated and errors fail open.
+- `scripts/check-phase33.sh` gates the phase: `--self-test`, `--go`, `--docs`, `--marker`, `--additive`, `--admin`, `--plugins` and `--compat` all pass on this host.
+- `33-release-log.md` records the v0.6.1 contents and the release order 33-14 follows.
+
+## Task Commits
+
+1. **Task 1: Confirm descriptor fields, RequestOptions, RecordSaved.Locale meaning**: no commit (decision, answers above)
+2. **Task 2: Content descriptor fields (tracer)**: `561a56c` (feat)
+3. **Task 3: Per-request options for plugin field types**: `4cd35c9` (feat)
+4. **Task 4: Phase gate script and release log**: `6ea43bb` (test, group A), `21aa4e5` (docs, group B)
+
+**Plan metadata:** this SUMMARY commit (docs)
+
+## Files Created/Modified
+
+- `modules/pact/content.go`: Kind, Tools, the kind and tool constants, the record and locale fields and the five value types.
+- `modules/pact/capabilities.go`: `FormFieldType.RequestOptions` with its doc comment (no secrets, fails open).
+- `modules/cabana/field_type.go`: `mergeRequestOptions` (once per type, copy-merge, fields.yaml wins, one WARN on error).
+- `modules/cabana/http.go`: form schema route calls it on the request's own field slice; `requestDB` helper.
+- `modules/cabana/schema_types.go`, `modules/cabana/admin_openapi.go`, `admin/openapi/admin.json`, `admin/src/api/schema.d.ts`: typeOptions description now names per-request options.
+- `modules/signpost/content_fields_smoke_test.go`: `TestContentDescriptorFields` (full type, plain type, nil vs empty slices).
+- `modules/cabana/field_request_options_smoke_test.go`: `TestFieldTypeRequestOptions`, one subtest per behaviour line plus the authenticated-handler check (T-33-01).
+- `modules/signpost/example_content_test.go`, `modules/cabana/example_field_type_test.go`: runnable examples that the docs embed.
+- `docs/plugins/menu-item-types.md`, `docs/backend/field-types.md`, `modules/pact/README.md`, `modules/signpost/README.md`, `modules/cabana/README.md`: documentation of every new identifier.
+- `scripts/check-phase33.sh`: phase gate.
+- `.planning/phases/33-seo-output-audit-and-content/33-release-log.md`: release ledger.
+
+## Decisions Made
+
+- The Task 1 answers above.
+- `RequestOptions` gets the application database bound to the request context, or nil when the application has none. The test service has no database, and a type that needs one can check for nil.
+- The compat stage reads the sitemap and Journal plugins at their releases before the phase (v0.1.2, v0.3.1) and sm-demo-app at its HEAD when 33-01 ran (da481c9). It uses read-only snapshots, not worktrees in the sibling repos.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Version base moved from v0.5.1/v0.5.2 to v0.6.0/v0.6.1 (Jakub's ruling, Decision C)**
+- **Found during:** Task 1 (checkpoint), applied in Task 4
+- **Issue:** The plan was written before v0.5.2, v0.5.3 and v0.6.0 were tagged, so the six Phase 32 fixes are already released.
+- **Fix:** The additive stage still computes the newest tag that does not contain HEAD (v0.6.0). The marker base is `PHASE33_BASE=v0.6.0`. The release log lists the fixes as "already released in v0.5.2" and plans v0.6.1. The commit subject of group B is `docs(33-01): release log for v0.6.1`, not `... v0.5.2`.
+- **Files modified:** scripts/check-phase33.sh, 33-release-log.md
+- **Committed in:** 6ea43bb, 21aa4e5
+
+**2. [Rule 3 - Blocking] Plugin tags moved past the plan's ranges**
+- **Found during:** Task 4
+- **Issue:** The plan pasted `sm-seo-plugin v0.1.0..HEAD` and `sm-journal-plugin v0.2.5..HEAD` as unreleased fixes. Those commits are now released in sm-seo-plugin v0.1.1 and sm-journal-plugin v0.2.6 to v0.3.1, and no plugin or layer has unreleased commits.
+- **Fix:** The release log has a table of the newest tag per repository with "none" unreleased. Versions are still read from `git tag` in 33-14.
+- **Committed in:** 21aa4e5
+
+**3. [Rule 3 - Blocking] Docs checker requires src= snippets for go code blocks**
+- **Found during:** Task 3
+- **Issue:** The docs checker refuses a hand-written go snippet in docs/backend/field-types.md.
+- **Fix:** Added a runnable `headingLevels` func and `ExampleCompileFormWithTypes_requestOptions` to modules/cabana/example_field_type_test.go. The page embeds the func through `src=`.
+- **Committed in:** 4cd35c9
+
+**4. [Rule 2 - Marker] pact README addition moved to a new bullet**
+- **Found during:** Task 2
+- **Issue:** Editing the existing descriptor bullet re-added its pre-existing word "sitemaps" as a changed line, which the D-90 marker stage would flag.
+- **Fix:** The new facts are described in a separate "Content facts" bullet, and the original line is unchanged.
+- **Committed in:** 561a56c
+
+**5. [TDD] Task 3 RED evidence not committed separately**
+- **Found during:** Task 3
+- **Issue:** The plan's commit-group table gives Task 3 one commit (`feat(cabana): ...`), while tdd.md's cycle commits `test(...)` first. The plan is `type: execute`, not `type: tdd`.
+- **Fix:** I followed the plan's single commit. RED was recorded before implementing: TestFieldTypeRequestOptions failed on 4 behaviour subtests (`typeOptions=map[rows:4]`, `calls=0`, no warning logged), and `check tdd-red-evidence` returned RED_EVIDENCE_OK. GREEN then passed all 8 subtests.
+
+---
+
+**Total deviations:** 5 (3 blocking, 1 marker-safety, 1 TDD commit-shape note)
+**Impact on plan:** The API shape and behaviour are exactly as planned. Only version numbers, the ledger contents and the doc mechanics changed.
+
+## Issues Encountered
+
+- The compat stage reports sm-feedback-plugin, sm-presentations-plugin and sm-quizzes-plugin as "skipped (fails at v0.6.0 too)": they do not resolve the framework through a scratch workspace at either revision. These failures predate this plan and are not caused by it.
+- shellcheck warns SC2034 (`type` unused) in the copied `snapshot_submodules`. check-phase32.sh has the same warning, so I left it as is.
+
+## Verification run
+
+- `go vet ./... && go test -short ./...`: green after every commit.
+- `go test ./modules/signpost -run 'TestContentDescriptorFields|Example' -v`: PASS (5 subtests, 3 examples).
+- `go test ./modules/cabana -run 'TestFieldTypeRequestOptions|TestFormExtensionUnextendedSchemaUnchanged' -v`: PASS (8 subtests).
+- `scripts/check-admin-openapi.sh --check`: exit 0. `check-phase33.sh --admin` (openapi + dist): passed.
+- `go test ./cmd/summer -run TestDocsTree` and `summer docs:build --check`: no problems.
+- `bash scripts/check-phase33.sh --self-test`: passed (37 checks). Without an argument it exits 2 and prints the usage.
+- `bash scripts/check-phase33.sh --go --docs --marker --additive`: PASS all four; additive: cabana +0, pact +35, signpost +0 lines against v0.6.0.
+- `bash scripts/check-phase33.sh --plugins`: passed (sm-seo-plugin 77 and sm-journal-plugin 232 vitest tests).
+- `bash scripts/check-phase33.sh --compat`: passed.
+- Not run here: `--layers` (vue-seo-layer `testing/guard-check.mjs` arrives in 33-08), `--consumers`, `--docker`.
+
+## User Setup Required
+
+None. No external service configuration is required.
+
+## Next Phase Readiness
+
+- 33-02 (Blog Editor) can use `RequestOptions` for `headingLevels` and `genericAnchors`, and 33-03 onward can fill and read the content facts.
+- 33-14 tags framework **v0.6.1** and follows 33-release-log.md.
+
+## Self-Check: PASSED
+
+- FOUND: modules/pact/content.go, modules/pact/capabilities.go, modules/signpost/content_fields_smoke_test.go, modules/cabana/field_request_options_smoke_test.go, scripts/check-phase33.sh, 33-release-log.md
+- FOUND commits: 561a56c, 4cd35c9, 6ea43bb, 21aa4e5
+
+---
+*Phase: 33-seo-output-audit-and-content*
+*Completed: 2026-11-04*

.planning/phases/33-seo-output-audit-and-content/33-02-SUMMARY.md

@@ -0,0 +1,346 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 02
+subsystem: journal
+tags: [sm-journal-plugin, headings, h1-setting, blog-editor, tiptap, content-descriptor, mcp, media-names, bluemonday]
+
+requires:
+  - phase: 33-seo-output-audit-and-content
+    provides: "33-01 seams: pact content facts (Kind, Tools, PublishedAt, Parents, Authors, TopHeading, Images, Videos, Headings) and pact.FormFieldType.RequestOptions"
+  - phase: 32-seo-foundation
+    provides: "Journal content descriptors, journal-tag, RecordSaved emission on API writes"
+provides:
+  - "Journal H1 setting content_h1_to_h2 (settings row, config key golem15.journal.content_h1_to_h2 as fallback) with H1 to H2 conversion on every Journal rich-text write path (post content and category pillar text)"
+  - "content_h1_to_h2 flag on GET /posts/{slug} and every GET /categories row; notices key on API write answers"
+  - "journal:fix-headings and POST /_journal/api/v1/fix-headings over stored post and category content"
+  - "GET/PUT /_journal/api/v1/settings and POST /_journal/api/v1/images/alt"
+  - "MCP tools journal_get_settings, journal_update_settings, journal_fix_headings, journal_set_image_alt"
+  - "Descriptor facts for posts, categories and tags, and the journal-author content type (golem15.journal.author_pages)"
+  - "Blog Editor J1-J4 on RequestOptions (heading levels, outline panel, link rel, generic-anchor warning, image naming)"
+  - "HTML policy keeps rel=nofollow|sponsored|ugc on a; classes.MediaFileName slugs uploaded image names"
+affects: [33-04, 33-06, 33-09, 33-10, 33-11, 33-13, 33-14]
+
+actuals:
+  tokens: 55440
+  tasks: 4
+  commits: 9
+plan_head_before: f7bfb3313b718e31cc754c87e4e0f9b0dcf95c0a
+plan_head_after: 0edf6e1b67d4f7d8f62980e30d52292cce94faf3
+
+tech-stack:
+  added: []
+  patterns:
+    - "Byte-preserving HTML rewrites on the x/net/html tokenizer (ConvertH1 rewrites only the tag name; SetImageAlt rewrites only the matching img from its token)"
+    - "One setting reader (EffectiveH1ToH2): settings row, else config key, else true"
+    - "Per-request field options from settings (RequestOptions), read by the element from its options attribute"
+    - "A parse rule carried by a never-created node type (HeadingOneAsTwo) to map h1 to the heading node at level 2"
+
+key-files:
+  created:
+    - ../sm-journal-plugin/updates/202610280001_add_golem15_journal_settings_headings.go
+    - ../sm-journal-plugin/config/config.yaml
+    - ../sm-journal-plugin/classes/headings.go
+    - ../sm-journal-plugin/classes/heading_fix.go
+    - ../sm-journal-plugin/classes/journal_settings.go
+    - ../sm-journal-plugin/classes/image_alt.go
+    - ../sm-journal-plugin/classes/content_facts.go
+    - ../sm-journal-plugin/classes/media_names.go
+    - ../sm-journal-plugin/console/fix_headings.go
+    - ../sm-journal-plugin/controllers/api/settings.go
+    - ../sm-journal-plugin/controllers/api/maintenance.go
+    - ../sm-journal-plugin/assets/src/blogeditor/outline.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/linkform.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/imageform.ts
+    - ../sm-journal-plugin/headings_test.go
+    - ../sm-journal-plugin/journal_descriptor_fields_test.go
+    - ../sm-journal-plugin/classes/media_names_test.go
+    - ../sm-journal-plugin/tests/blogeditor/additions.test.ts
+  modified:
+    - ../sm-journal-plugin/models/settings.go
+    - ../sm-journal-plugin/models/settings/fields.yaml
+    - ../sm-journal-plugin/plugin.go
+    - ../sm-journal-plugin/routes.go
+    - ../sm-journal-plugin/mcp.go
+    - ../sm-journal-plugin/classes/blog_editor.go
+    - ../sm-journal-plugin/classes/format_html.go
+    - ../sm-journal-plugin/classes/media_store.go
+    - ../sm-journal-plugin/classes/content_descriptors.go
+    - ../sm-journal-plugin/classes/menu_item_types.go
+    - ../sm-journal-plugin/controllers/api/posts.go
+    - ../sm-journal-plugin/controllers/api/posts_helpers.go
+    - ../sm-journal-plugin/console/import_posts.go
+    - ../sm-journal-plugin/assets/src/blogeditor/element.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/extensions.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/toolbar.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/labels.ts
+    - ../sm-journal-plugin/assets/src/blogeditor/blogeditor.css
+    - ../sm-journal-plugin/assets/dist/blogeditor.js
+    - ../sm-journal-plugin/assets/dist/blogeditor.css
+    - ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json
+    - ../sm-journal-plugin/lang/en/lang.yaml
+    - ../sm-journal-plugin/lang/pl/lang.yaml
+    - ../sm-journal-plugin/README.md
+
+key-decisions:
+  - "Version mapping (Jakub's 33-01 ruling): the framework target is SummerCMS v0.6.1 (base v0.6.0); sm-journal-plugin is at v0.3.1, its next version is read from git tag in 33-14. go.mod still requires v0.6.0 with the existing replace to ../summercms.go; the require bump waits for the v0.6.1 tag"
+  - "P33-04 as planned: EffectiveH1ToH2 reads the settings row, then golem15.journal.content_h1_to_h2, then true"
+  - "API H1 conversion converts content and content_html together (default and translated); ConvertH1 is byte-preserving, so markdown content changes only where it holds raw <h1> tags. An update that does not send content converts nothing"
+  - "API notices: one {message, count} per converted locale, with a locale key on a translation's notice (additive)"
+  - "POST /fix-headings defaults to dry_run true (mirrors the CLI); POST /images/alt defaults to dry_run false (an explicit per-change edit); set_image_alt also checks post.CanEdit per post (403)"
+  - "The stored-heading fix rewrites translate rows directly (attribute_data JSON, translate's own encoding) so a translation in a since-disabled locale is converted too and SetTranslated's enabled-locale check cannot abort the batch"
+  - "Editor schema keeps H5 and H6 (levels 2-6 while the setting is on, 1-6 while off); the toolbar offers only H2-H4 or H1-H4. A strict [2,3,4] schema would drop stored H5/H6 on the first edit"
+  - "Post Parents are the post's categories by name (the order :category takes its first category in)"
+  - "journal-author: Controller empty, Model Backend\\Models\\User, Published = has a published post, LastMod = newest update of their published posts"
+  - "MediaFileName applies to both the editor upload and POST /_journal/api/v1/media/upload (D-85 server backstop); the response shape is unchanged, the stored name is now slugged"
+
+patterns-established:
+  - "Content plugins answer their own fixing tools in ContentDescriptor.Tools (journal_update_post, journal_fix_headings, journal_set_image_alt)"
+  - "Editor options arrive per request through RequestOptions; the element parses them from its options attribute with defaults"
+
+requirements-completed: [SC-2, SC-3, D-50, D-51, D-81, D-83, D-85, D-96, D-43, D-93, D-10]
+
+coverage:
+  - id: D1
+    description: "H1 setting (column, config key, Headings and links tab) with admin save conversion and the post-title notice; GET /posts/{slug} reports content_h1_to_h2; setting off stores H1 unchanged; switching never rewrites stored content"
+    requirement: "D-50"
+    verification:
+      - kind: integration
+        ref: "../sm-journal-plugin/headings_test.go#TestHeadingConversionTracer"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/headings_test.go#TestConvertH1"
+        status: pass
+      - kind: integration
+        ref: "../sm-journal-plugin/updates/settings_headings_migration_test.go#TestSettingsHeadingsMigration"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Conversion on the API (default and translated), markdown, import and category admin paths with notices; GET /categories rows carry content_h1_to_h2"
+    requirement: "D-96"
+    verification:
+      - kind: integration
+        ref: "../sm-journal-plugin/headings_test.go#TestHeadingConversion"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "journal:fix-headings (dry run, --apply, nothing to do, refusal exit 1) and POST /fix-headings over posts and categories with RecordSaved per changed record; settings API with manage_settings (401/403/422)"
+    requirement: "D-10"
+    verification:
+      - kind: integration
+        ref: "../sm-journal-plugin/headings_test.go#TestFixHeadingsCommand"
+        status: pass
+      - kind: integration
+        ref: "../sm-journal-plugin/headings_test.go#TestJournalSettingsTools"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "POST /images/alt and MCP journal_set_image_alt: tokenizer-escaped alt, all-or-nothing 422, dry run, decorative alt, translated content, access_posts; four new MCP tools listed and bound to routes"
+    requirement: "D-85"
+    verification:
+      - kind: integration
+        ref: "../sm-journal-plugin/headings_test.go#TestSetImageAlt"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/image_alt_test.go#TestSetImageAlt"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/mcp_test.go#TestJournalMCP"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/mcp_smoke_test.go#TestJournalMCPSmoke"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Descriptor facts for posts (PublishedAt, Parents, Authors, Images, Videos, Headings, TopHeading, Kind, Tools), categories (Parents, Headings, TopHeading, Kind, Tools) and tags (Kind)"
+    requirement: "D-93"
+    verification:
+      - kind: integration
+        ref: "../sm-journal-plugin/journal_descriptor_fields_test.go#TestJournalDescriptorFields"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "journal-author content type with author_pages on and off"
+    requirement: "D-43"
+    verification:
+      - kind: integration
+        ref: "../sm-journal-plugin/journal_descriptor_fields_test.go#TestJournalAuthorType"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "Stored HTML keeps rel with only nofollow/sponsored/ugc; MediaFileName slug rule on uploads; corpus pins a rel link and a decorative image"
+    requirement: "D-83"
+    verification:
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/editor_policy_test.go#TestEditorOutputPassesPolicy"
+        status: pass
+      - kind: unit
+        ref: "../sm-journal-plugin/classes/media_names_test.go#TestMediaFileName"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "Blog Editor J1-J4 behaviour: heading levels per setting via RequestOptions, outline flags and counts with CLDR plurals, rel checkboxes and generic warning, slugged file name and decorative alt; dist matches a fresh build"
+    requirement: "D-51"
+    verification:
+      - kind: automated_ui
+        ref: "../sm-journal-plugin/tests/blogeditor/additions.test.ts"
+        status: pass
+      - kind: integration
+        ref: "../sm-journal-plugin/headings_test.go#TestBlogEditorRequestOptions"
+        status: pass
+      - kind: other
+        ref: "bash ../sm-journal-plugin/scripts/check-dist.sh"
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "J2 outline look and wrapping in the real admin (long headings wrap with a hanging indent at 360 px, 12px indent per level, icon and colours in light and dark), J3/J4 form layout"
+    requirement: "D-81"
+    verification: []
+    human_judgment: true
+    rationale: "Visual layout in the embedded admin SPA; happy-dom tests cover structure and behaviour, not rendering"
+  - id: D10
+    description: "The H1 setting switch saved from Settings › Journal in the admin"
+    verification: []
+    human_judgment: true
+    rationale: "Blocked by a pre-existing framework issue (lagoon.Validate rejects the string/url rule tokens; the Journal settings screen answers 500 on save, deferred-items.md); the API and MCP path is tested"
+
+duration: 60min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 02: Journal headings, editor additions and content facts Summary
+
+**Per-site Journal H1 setting with byte-preserving H1→H2 conversion on every rich-text write path (admin, API/MCP, markdown, import, category pillar text), journal:fix-headings, the settings and bulk image-alt routes with four new MCP tools, descriptor facts plus a journal-author content type, and Blog Editor J1–J4 (heading levels, outline, link rel, slugged image names)**
+
+## Read first: version mapping and things to decide
+
+- **Versions (Jakub's 33-01 ruling).** Read "v0.5.1" in the plan as SummerCMS v0.6.0 and "v0.5.2" as v0.6.1. The Journal changes need v0.6.1 (the content facts and `RequestOptions` are new there). `sm-journal-plugin/go.mod` still requires `v0.6.0` and resolves the framework through its existing `replace => ../summercms.go`; I did not touch that replace. The require bump to v0.6.1 happens when 33-14 tags the framework. The Journal was at v0.3.1 before this plan, and its next version is read from `git tag` in 33-14. Nothing was pushed or tagged.
+- **No breaking change to an existing Journal consumer.** Every API change adds something: `content_h1_to_h2` on `GET /posts/{slug}` and on the category rows, `notices` on write answers, and new routes and tools. Two behaviour changes need a line in the release notes:
+  1. The H1 setting defaults to **on** (D-50, Jakub 2026-10-28). After the upgrade, new saves on a site turn H1 into H2 until someone switches the setting off. Stored content is never rewritten unless `journal:fix-headings --apply` runs.
+  2. Uploaded image names are now slugged on the server (D-85). This covers `POST /_journal/api/v1/media/upload` too: `My Photo.JPG` is stored as `my-photo.jpg`. The response shape is the same, and clients use the returned URL.
+- **Pre-existing framework issue (deferred, needs a decision).** Saving Settings › Journal in the admin answers **500**, and it did before this plan too. `lagoon.Validate` does not know the `string` and `url` rule tokens that `Settings.Rules()` has used for a long time. So until the framework is fixed, the new switch can only be changed through `PUT /_journal/api/v1/settings` or MCP `journal_update_settings`. Details are in `deferred-items.md`, and there is a WINDOWS.md entry. The fix belongs in lagoon (v0.6.1).
+
+## Performance
+
+- **Duration:** about 60 min
+- **Started:** 2026-11-04T08:38:29Z
+- **Completed:** 2026-11-04T09:38:48Z
+- **Tasks:** 4 (9 commits in sm-journal-plugin)
+- **Files modified:** 63 in sm-journal-plugin
+
+## Accomplishments
+
+- The Journal H1 setting (`content_h1_to_h2`, Headings and links tab, config fallback) converts H1 to H2 on every Journal rich-text write path and sends a notice. Post and category answers expose the setting. Stored content changes only through `journal:fix-headings --apply` or `journal_fix_headings`.
+- Journal fixes its own content through MCP: `journal_get_settings`, `journal_update_settings`, `journal_fix_headings` and `journal_set_image_alt` (D-10, D-85, P33-05).
+- Descriptors give the SEO, sitemap and audit plugins publication dates, parents, authors, images (with alt and the decorative flag), YouTube videos, the heading outline, the top heading level, the kind and the fixing tools. Author pages are a content type (`journal-author`).
+- Blog Editor J1–J4: the heading levels follow the setting (per request through `RequestOptions`). There is a read-only outline that flags skipped, empty, link-only and Source-mode H1 headings and generic link texts. External links get rel checkboxes, a generic link text gets a non-blocking warning, and an image gets a slugged file name and a required alt (or is marked decorative) before upload.
+- On the server, the HTML policy keeps `rel` when it holds only `nofollow`, `sponsored` and `ugc`, and `MediaFileName` applies the same slug rule as the editor.
+
+## Task Commits (sm-journal-plugin, branch main, not pushed)
+
+1. **Task 1: H1 setting with the admin save conversion (tracer)**: `305f94a` (feat)
+2. **Task 2: other write paths, fix-headings, settings API, MCP tools**: `faaa9b0` (group A), `5210b64` (group B), `af25eaa` (group C)
+3. **Task 3: descriptor facts and journal-author**: `e8e77a1` (group A), `805bfdb` (group B)
+4. **Task 4: Blog Editor J1–J4, rel policy, media names, README**: `391435b` (group A), `4b09bd9` (groups B and C together), `0edf6e1` (group D, docs)
+
+**Plan metadata:** the SUMMARY commit in summercms.go (docs), then ROADMAP alone.
+
+## Files Created/Modified (sm-journal-plugin)
+
+- `updates/202610280001_add_golem15_journal_settings_headings.go`: `content_h1_to_h2 BOOLEAN NOT NULL DEFAULT TRUE`, `generic_anchors TEXT NULL`, with rollback.
+- `config/config.yaml`, `plugin.go`: `ConfigFS` (`pact.HasConfig`) and the `journal:fix-headings` registration.
+- `classes/journal_settings.go`: `EffectiveH1ToH2`, `GenericAnchors`, `DefaultGenericAnchors`, `H1ToH2Key`.
+- `classes/headings.go`: `ConvertH1`, `CountH1`, `ConvertContentH1`, `ConvertTranslationH1`.
+- `classes/heading_fix.go`: `FixStoredHeadings`, `HeadingFix` and the refusal text. They are shared by the command and the API.
+- `classes/image_alt.go`: `SetImageAlt` on the tokenizer.
+- `classes/content_facts.go`: the image, video and heading parse, category refs and the author projection.
+- `classes/content_descriptors.go`, `classes/menu_item_types.go`: the facts, `AuthorPagesKey`, and the `journal-author` type (`MenuTypeAuthor`, `DefaultAuthorPattern`).
+- `classes/blog_editor.go`: the Decode conversion with the post or category notice, and `RequestOptions` (`headingLevels`, `genericAnchors`). `safeUploadName` now uses `MediaFileName`.
+- `classes/format_html.go`: the rel rule. `classes/media_names.go`: `MediaFileName`. `classes/media_store.go`: applies it.
+- `controllers/api/posts.go`, `posts_helpers.go`: conversion inside the write transaction, the `notices` answer and the category flag.
+- `controllers/api/settings.go`: `ShowSettings`, `UpdateSettings`. `controllers/api/maintenance.go`: `FixHeadings`, `SetImageAlt`. `routes.go`: four routes.
+- `console/fix_headings.go`. `console/import_posts.go`: `ImportFromDirConfig`, `ImportStats.H1Converted`. `ImportFromDir` keeps its signature.
+- `mcp.go`: four tools.
+- `assets/src/blogeditor/{element,extensions,toolbar,labels,outline,linkform,imageform}.ts`, `blogeditor.css`, `assets/dist/*`: J1–J4.
+- `lang/{en,pl}/lang.yaml`: the C27 keys with the P33-54 wording, `editor.h1_converted` and `editor.h1_converted_category` (CLDR plurals), and `menuitem.journal_author`.
+- `README.md`: the setting and its precedence, the write paths, the command, the routes, the MCP tools, `journal-author`, the content facts, the editor additions and the rel and name rules.
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter. The main ones:
+- The API converts `content` and `content_html` together.
+- A PUT without `content` converts nothing.
+- `fix-headings` is a dry run by default. `images/alt` is not, because it is an explicit edit, and it checks edit rights per post.
+- The editor schema keeps H5 and H6 so that stored headings survive an edit.
+- Post parents are ordered by category name.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug, deferred root cause] Settings screen save fails in the admin (pre-existing)**
+- **Found during:** Task 2 (settings API)
+- **Issue:** `lagoon.Validate` rejects the `string` and `url` tokens in `Settings.Rules()`. The admin settings PUT answers 500, and my API handler hit the same error.
+- **Fix:** `UpdateSettings` checks `string` and `url` itself (`settingsRule`) and passes the other tokens to `lagoon.Validate`. The admin screen is not fixed, because that needs a framework change; it is logged in `deferred-items.md` and WINDOWS.md.
+- **Files modified:** controllers/api/settings.go
+- **Verification:** TestJournalSettingsTools (422 for a bad URL and for a non-string value)
+- **Committed in:** 5210b64
+
+**2. [Rule 3 - Blocking] The category-content migration test assumed it was the last migration**
+- **Found during:** Task 1
+- **Fix:** It now rolls back to the step before its own (`RollbackTo`). I added `TestSettingsHeadingsMigration` for the new step.
+- **Committed in:** 305f94a
+
+**3. [Rule 1 - Data loss] The heading schema keeps H5 and H6**
+- **Found during:** Task 4
+- **Issue:** TipTap levels of exactly `[2, 3, 4]` (UI-SPEC C28) would turn stored H5 and H6 into paragraphs on the first edit of their block.
+- **Fix:** The schema levels are 2–6 while the setting is on and 1–6 while it is off. The toolbar offers H2–H4 or H1–H4. A dedicated parse rule (`HeadingOneAsTwo`) maps `<h1>` to level 2 without importing `@tiptap/extension-heading`, so no package was added.
+- **Committed in:** 4b09bd9
+
+**4. [Rule 3 - Blocking] Existing tests pinned the behaviour this plan changes**
+- Tool lists (TestJournalMCP, TestJournalMCPSmoke), menu type lists (TestMenuItemTypesPatterns, TestContentDescriptors), the category key list (categories_test.go), and the corpus test's "no rel" assertion. The upload-name expectations changed too: `zdj-cie-1.png` is now `zdjecie-1.png`, `ok-adka.png` is now `okladka.png`, and `b.JPEG` is now `b.jpeg`. The old upload-on-pick tests (smoke.test.ts, embed.test.ts) were rewritten to the J4 flow, which is pick, then the form, then Insert uploads, then the image is inserted on the result. I updated each test to the new behaviour; I did not remove any.
+- **Committed in:** 5210b64, af25eaa, 805bfdb, 391435b, 4b09bd9
+
+**5. [Plan shape] Task 4 groups B and C are one commit**
+- **Issue:** J1–J4 share `element.ts`, `labels.ts` and the bundle. If B were committed without C, the import graph would not build.
+- **Fix:** One commit, `feat: editor heading levels, outline, link rel, generic-anchor warning and image naming`.
+
+**6. [Plan shape] Helper and test files the plan did not list**
+- `classes/heading_fix.go` holds the logic the command and the API share. The tests not in the plan are `classes/headings_test.go`, `classes/image_alt_test.go`, `updates/settings_headings_migration_test.go`, `tests/blogeditor/additions.test.ts` and `TestBlogEditorRequestOptions`. The slug helpers live in `imageform.ts`. I added `controllers.PermissionManageSettings` and `console.ImportFromDirConfig`; both are additive.
+- For the acceptance greps, the C27 console copy appears in `console/fix_headings.go` (doc comment and long help). The runtime refusal string is `classes.H1ConversionOffText`.
+
+**7. [TDD note] RED evidence**
+- Task 2 group A tests were written right after the code, so no RED was captured for them. For Task 2 groups B and C and for Task 3, I ran the tests against stubs first. Each failed on its target assertion: TestFixHeadingsCommand had dry-run output `""`, TestJournalSettingsTools got 404, TestSetImageAlt got 404, the TestJournalMCP tool list mismatched, and the descriptor kinds were empty and journal-author was nil. `check tdd-red-evidence` only reads TAP, so I converted the Go output to TAP, and it then returned RED_EVIDENCE_OK.
+
+**8. [Cosmetic] Attribute order of new editor links**
+- TipTap renders `rel` before `href` (`<a rel="nofollow sponsored" href="…">`). The policy and the layer do not depend on attribute order. Stored links keep their own bytes.
+
+---
+
+**Total deviations:** 8 (1 deferred pre-existing bug, 1 blocking test fix, 1 data-loss guard, 1 test update set, 2 plan-shape, 1 TDD note, 1 cosmetic)
+**Impact on plan:** Every must-have truth is met through the API, MCP, editor and descriptors. The one exception is the admin switch save, which a pre-existing framework issue blocks.
+
+## Issues Encountered
+
+- `go test ./... -run X` prints "no tests to run" for the subpackages. The plan's `fails_when` lists that phrase, but each named root test passes: the line is from the other packages.
+- vue-journal-layer holds a copy of `editor-corpus.json`. Its policy mirror (htmlGate) has to accept `rel` with the three tokens and `alt=""`, which is 33-09's work.
+
+## User Setup Required
+
+None. No external service configuration is required.
+
+## Next Phase Readiness
+
+- 33-04 (image and News sitemaps), 33-06 (JSON-LD, breadcrumbs), 33-09 (layer title tag and htmlGate following `content_h1_to_h2`) and 33-10 (CMS checks through `Tools`, `TopHeading`, `Images`, `Headings`) can read what this plan provides.
+- 33-14: bump the Journal `go.mod` to the v0.6.1 tag, tag the Journal from `git tag` (after v0.3.1), and include the release notes about the default-on setting and slugged upload names.
+- Open: the framework fix for `lagoon.Validate` `string`/`url` (deferred-items.md).
+
+## Self-Check: PASSED
+
+- FOUND: the 18 created files listed in key-files.created (checked with `[ -f ]`).
+- FOUND commits in sm-journal-plugin: 305f94a, faaa9b0, 5210b64, af25eaa, e8e77a1, 805bfdb, 391435b, 4b09bd9, 0edf6e1. `git rev-list --count f7bfb33..HEAD` = 9.
+- Verification: `go vet ./...` and `go test -short ./...` are green. The full Docker `go test ./...` is green (root, classes, controllers, api, models, updates). `npm run test` passed 244 of 244. `check-dist.sh` matches. `check-phase33.sh --plugins` passed.
+
+---
+*Phase: 33-seo-output-audit-and-content*
+*Completed: 2026-11-04*

.planning/phases/33-seo-output-audit-and-content/33-03-SUMMARY.md

@@ -0,0 +1,437 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 03
+subsystem: sitemap
+tags: [sm-sitemap-plugin, sitemap-index, slot-table, stable-numbering, lastmod, hreflang, filter-contract, listing, conga, settings-singleton, breaking-change]
+
+requires:
+  - phase: 33-seo-output-audit-and-content
+    provides: "33-01 version ruling (framework target v0.6.1, base v0.6.0) and the signpost content facts"
+  - phase: 32-seo-foundation
+    provides: "signpost content descriptors and Records (D-93), pact.RecordSaved/RecordDeleted (D-92), form extensions (D-91)"
+provides:
+  - "sm-sitemap-plugin per-type format: GET /sitemap.xml index and GET /_sitemap/files/{file} served from the slot table golem15_sitemap_urls (D-30)"
+  - "Stable file numbering (classes.AssignSlots), file_size setting 1..50 000 (default 1000), renumbering only on a size change"
+  - "Event-driven lastmod (RecordSaved with changes outside golem15.sitemap.lastmod_ignore), RecordDeleted holes"
+  - "Rebuild job golem15.sitemap.rebuild: debounced after record events (rebuild_pending_until), dispatched on settings save, nightly sitemap:rebuild 03:00, sitemap:rebuild [--queue]"
+  - "hreflang xhtml:link alternates with x-default (D-55 to D-57)"
+  - "Package git.golem15.com/golem15/sm-sitemap-plugin/contract: Filter (consumed through app.Lookup), Listing (published by the plugin), reasons (D-95)"
+  - "Settings singleton golem15.sitemap.settings (Files with S1 partial, Content types extension tab, Additional addresses); golem15_sitemap_types"
+  - "Migration of the Phase 17 definition url items into extra_urls, frontend_url into site_url, frontend_default_locale into default_locale (D-32)"
+  - "sitemap:import and sitemap:import-winter retargeted to the additional addresses"
+affects: [33-04, 33-05, 33-07, 33-08, 33-13, 33-14]
+
+actuals:
+  tokens: 60600
+  tasks: 4
+  commits: 7
+plan_head_before: 049f3ee270ed9ac2619f357626914b1a8caac780
+plan_head_after: 64453d2a914f00a8310f76f806a8858d5d4345da
+
+tech-stack:
+  added: []
+  patterns:
+    - "Slot table: every address is a row with (grp, file_no); a rebuild keeps numbers, appends oldest first, leaves holes; numbered_size detects a file size change"
+    - "One rebuild transaction that locks settings row 1 (SELECT ... FOR UPDATE), so two rebuilds never interleave"
+    - "Debounce through a conditional UPDATE of rebuild_pending_until plus conga Enqueue in the same transaction; the job clears it when it starts"
+    - "Published contract sub-package without init, so other plugins import the seam without registering the plugin"
+
+key-files:
+  created:
+    - ../sm-sitemap-plugin/contract/contract.go
+    - ../sm-sitemap-plugin/classes/slots.go
+    - ../sm-sitemap-plugin/classes/rebuild.go
+    - ../sm-sitemap-plugin/classes/writer.go
+    - ../sm-sitemap-plugin/classes/settings.go
+    - ../sm-sitemap-plugin/classes/types.go
+    - ../sm-sitemap-plugin/classes/dispatch.go
+    - ../sm-sitemap-plugin/classes/lastmod.go
+    - ../sm-sitemap-plugin/classes/listing.go
+    - ../sm-sitemap-plugin/models/url.go
+    - ../sm-sitemap-plugin/models/type_setting.go
+    - ../sm-sitemap-plugin/models/legacy.go
+    - ../sm-sitemap-plugin/updates/202610280001_create_golem15_sitemap_urls.go
+    - ../sm-sitemap-plugin/updates/202610280002_update_golem15_sitemap_settings.go
+    - ../sm-sitemap-plugin/updates/202610280003_create_golem15_sitemap_types.go
+    - ../sm-sitemap-plugin/controllers/settings.go
+    - ../sm-sitemap-plugin/controllers/settings/config_form.yaml
+    - ../sm-sitemap-plugin/controllers/settings/_sitemap_files.htm
+    - ../sm-sitemap-plugin/extensions_settings.go
+    - ../sm-sitemap-plugin/jobs.go
+    - ../sm-sitemap-plugin/listeners.go
+    - ../sm-sitemap-plugin/schedule.go
+    - ../sm-sitemap-plugin/console/rebuild.go
+    - ../sm-sitemap-plugin/sitemap_index_test.go
+    - ../sm-sitemap-plugin/content_fixture_test.go
+    - ../sm-sitemap-plugin/filter_fixture_test.go
+    - ../sm-sitemap-plugin/classes/slots_test.go
+    - ../sm-sitemap-plugin/classes/lastmod_test.go
+  modified:
+    - ../sm-sitemap-plugin/plugin.go
+    - ../sm-sitemap-plugin/routes.go
+    - ../sm-sitemap-plugin/admin.go
+    - ../sm-sitemap-plugin/models/settings.go
+    - ../sm-sitemap-plugin/models/settings/fields.yaml
+    - ../sm-sitemap-plugin/controllers/admin_registry.go
+    - ../sm-sitemap-plugin/console/import.go
+    - ../sm-sitemap-plugin/console/import_winter.go
+    - ../sm-sitemap-plugin/console/helpers.go
+    - ../sm-sitemap-plugin/config/config.yaml
+    - ../sm-sitemap-plugin/lang/en/lang.yaml
+    - ../sm-sitemap-plugin/lang/pl/lang.yaml
+    - ../sm-sitemap-plugin/README.md
+    - ../sm-sitemap-plugin/plugin.yaml
+    - ../sm-sitemap-plugin/go.mod
+
+key-decisions:
+  - "Task 1 ANSWERED: as-proposed (Jakub, 2026-11-04): index stays /sitemap.xml, files /sitemap-<slug>-<n>.xml served through /_sitemap/files/{file}, /sitemap.xsl removed, one settings singleton, url items to Additional addresses, priority/changefreq/tiers/manifest removed, definitions table kept unread"
+  - "Version mapping (33-01 ruling): framework target v0.6.1, base v0.6.0; go.mod still requires summercms v0.6.0 with the existing replace => ../summercms.go; the bump is 33-14's"
+  - "Settings validation runs in the controller's FormBeforeUpdate (Settings.Validate), not lagoon.HasBeforeValidate: cabana's CRUD path turns a BeforeValidate error into a 500"
+  - "Content type titles (the HTML sitemap heading) are stored as a JSONB locale map on golem15_sitemap_types, not through the translation writer"
+  - "Rows left out (deleted, unpublished, noindex, type) keep their file number as a hole; a renumber drops the numbers of left-out rows"
+  - "S1 links files to the backend routes (/sitemap.xml, /_sitemap/files/<name>): the partial kit keeps only root-relative hrefs; the note names the public index URL"
+  - "The index answers 404 while no site address is configured, and an empty sitemapindex before the first rebuild"
+  - "A Filter error or a wrong number of decisions fails the rebuild (the files stay as they were); an invalid Decision.Group is ignored with a warning"
+  - "x-default points to the default_locale setting's address, else the record's first listed locale; alternates list only listed (not excluded) locales"
+  - "Reserved slugs images and news (33-04's image and News sitemaps) are refused as type file names"
+
+patterns-established:
+  - "Plugins publish narrow seams in a contract sub-package with no init; consumers Lookup the interface and work without it"
+  - "Fake content plugin over an in-memory store for testing signpost consumers without database tables"
+
+requirements-completed: [SC-1, D-30, D-32, D-55, D-56, D-57, D-93, D-95, D-24, D-22]
+
+coverage:
+  - id: D1
+    description: "GET /sitemap.xml answers an index of per-type files sitemap-<slug>-<n>.xml with lastmod; each file at most file_size URLs with absolute <loc> and real <lastmod>, no priority or changefreq; drafts absent; escaping; unknown files 404; /sitemap.xsl 404"
+    requirement: "D-30"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestSitemapIndex"
+        status: pass
+      - kind: unit
+        ref: "../sm-sitemap-plugin/routes_test.go#TestFileNames"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Stable numbering: holes on delete, appends to the last file with room, renumber only on file_size change"
+    requirement: "D-30"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestStableNumbering"
+        status: pass
+      - kind: unit
+        ref: "../sm-sitemap-plugin/classes/slots_test.go#TestAssignSlots"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "lastmod moves only on a real change (per locale for translated changes); no-op saves, ignored attributes and rebuilds leave it; deletes leave the files"
+    requirement: "D-30"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestLastmod"
+        status: pass
+      - kind: unit
+        ref: "../sm-sitemap-plugin/classes/lastmod_test.go#TestRealChanges"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "hreflang alternates for each translated locale plus x-default; none for a missing translation or a single locale"
+    requirement: "D-55"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestHreflangAlternates"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "contract.Filter batches per page; Exclude leaves the files counted by reason, Group moves to sitemap-offers-1.xml, Groups titles reach Listing.Settings; without a Filter everything published is listed; Listing.Entries paging"
+    requirement: "D-95"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestFilterExcludes"
+        status: pass
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestNoFilter"
+        status: pass
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestListing"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Rebuilds: debounced to one job per delay after record events, dispatched on save, nightly 03:00, sitemap:rebuild [--queue]"
+    requirement: "D-30"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestDebouncedRebuild"
+        status: pass
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestRebuildCommand"
+        status: pass
+      - kind: unit
+        ref: "../sm-sitemap-plugin/commands_documented_test.go#TestScheduleAndJobs"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "Settings singleton (one tile, Files/Content types/Additional addresses), errors.* refusals, save dispatches a rebuild, type off leaves files with reason type, S1 empty/building/files/left-out states"
+    requirement: "D-32"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestSettingsSingleton"
+        status: pass
+      - kind: unit
+        ref: "../sm-sitemap-plugin/models/settings_test.go#TestSettingsValidate"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "Definitions migration (url items to extra_urls, frontend_url to site_url, locale), definitions table untouched, rollback keeps data; sitemap:import and sitemap:import-winter write the additional addresses"
+    requirement: "D-32"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_index_test.go#TestMigrateDefinitions"
+        status: pass
+      - kind: integration
+        ref: "../sm-sitemap-plugin/import_test.go#TestImportWinter"
+        status: pass
+      - kind: integration
+        ref: "../sm-sitemap-plugin/import_test.go#TestImportFile"
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "Site URL precedence: setting, golem15.sitemap.site_url, app.url; never the Host header"
+    requirement: "D-22"
+    verification:
+      - kind: unit
+        ref: "../sm-sitemap-plugin/routes_test.go#TestSiteURLPrecedence"
+        status: pass
+    human_judgment: false
+  - id: D10
+    description: "The settings screen's look in the real admin (S1 tables and callouts, the Content types tab placement after Files, the repeater)"
+    verification: []
+    human_judgment: true
+    rationale: "Rendering in the embedded admin SPA; the tests cover the schema, the API and the partial's node tree, not the visual layout"
+
+duration: 43min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 03: Golem15.Sitemap rewrite Summary
+
+**sm-sitemap-plugin now serves a sitemap index at /sitemap.xml over per-type files `sitemap-<slug>-<n>.xml` from a slot table with stable numbering, event-driven lastmod, hreflang alternates and a debounced conga rebuild, narrowed by a published `contract.Filter` and readable through `contract.Listing`; the PHP-parity format, the definitions screen and the XSL are gone and the old data migrates.**
+
+## Task 1 ANSWERED: as-proposed (Jakub, 2026-11-04)
+
+- The index stays at `/sitemap.xml`. The per-type files are `/sitemap-<slug>-<n>.xml`, and Go serves them at `/_sitemap/files/{file}`.
+- The XSL stylesheet `/sitemap.xsl` is removed and now answers 404. This resolves the todo `.planning/todos/completed/sitemap-xslt-browser-deprecation.md`. If g15office task **w8kupqi3** is still open, it can be closed as resolved by removal (commit `84cb27a` in sm-sitemap-plugin). I could not check its state from here.
+- The Phase 17 definitions screen and the settings tile are now one settings singleton. The url items moved to "Additional addresses". priority, changefreq, tiers and the manifest are removed. The definitions table stays in the database and is no longer read.
+
+## Read first: versions, breaking changes, consumers
+
+- **Versions.** The framework target is v0.6.1 with base v0.6.0 (33-01 ruling). `sm-sitemap-plugin/go.mod` still requires `summercms v0.6.0` through the existing `replace => ../summercms.go`, and that replace was not touched. The plugin was at v0.1.2 (049f3ee). These changes are breaking, so the next minor tag is cut in 33-14. Nothing was pushed or tagged.
+- **Breaking changes in sm-sitemap-plugin**, approved by the "as-proposed" answer:
+  1. `/sitemap.xml` is now a `<sitemapindex>`, not a `<urlset>`. The URL is unchanged, so robots.txt and the GSC submission need no change.
+  2. The files live at the site root as `/sitemap-<slug>-<n>.xml`, served by Go at `/_sitemap/files/<name>`. A site must map the root names: vue-seo-layer does this (33-07, next tag v0.2.0), or nginx can (the README has the snippet).
+  3. `/sitemap.xsl` answers 404. `<priority>` and `<changefreq>` are no longer written.
+  4. The admin has one "Sitemaps" tile linking to `golem15.sitemap.settings`. The `golem15.sitemap.definitions` controller and the `sitemap_settings` settings form are gone. The permission code `golem15.sitemap.access_definitions` is unchanged, so roles keep their access.
+  5. Config keys `golem15.sitemap.cache_seconds` and `golem15.sitemap.priority_tiers` are removed. New keys: `site_url`, `lastmod_ignore`, `rebuild_delay_seconds`. The festival events `classes.BeforeAddItem` and `classes.AddItem` are removed.
+  6. A `<loc>` never uses the request Host. Without a site address (the setting, `golem15.sitemap.site_url` or `app.url`), the index answers 404.
+  7. `sitemap:import` writes `{url, lastmod}` into the additional addresses and ignores `changefreq` and `priority`. Its success line is now "Imported N addresses into the sitemap's additional addresses." `sitemap:import-winter` keeps its flags but writes url items into the additional addresses and the settings into `site_url` and `default_locale`. Reference items are dropped.
+  8. The application needs a conga worker for rebuilds (record events and saves queue them) and the scheduler for the nightly run. Otherwise someone has to run `sitemap:rebuild`. After deploying, run `sitemap:rebuild` once so the files exist.
+- **Consumers.** sm-grzybyfunkcjonalne-app and sm-demo-app pin v0.1.2 as a submodule and are untouched. They move to the new URLs in 33-13. No core plugin (user, blog, pages, payment, journal) was changed, and the framework got no code from this plan (D-90; `--marker` passed).
+
+## Performance
+
+- **Duration:** about 43 min
+- **Started:** 2026-11-04T09:47:25Z
+- **Completed:** 2026-11-04T10:30Z
+- **Tasks:** 4 (Task 1 decision answered before the run, Tasks 2 to 4 executed)
+- **Commits:** 7 in sm-sitemap-plugin (branch main, not pushed). 78 files changed: 49 added or modified, 29 removed.
+
+## Accomplishments
+
+- **Index and files from a slot table (D-30).** `golem15_sitemap_urls` holds one row per address with its group and file number. Rebuilds keep file numbers, append new addresses to the last file with room, and leave holes for deleted, unpublished or excluded addresses. Only a `file_size` change renumbers. The routes read the table and never generate per request.
+- **Real lastmod.** A row's lastmod starts at the record's `LastMod`. After that it moves only when `pact.RecordSaved` reports a change outside `golem15.sitemap.lastmod_ignore`. A translated change moves only that locale's row. A no-op save, a counter update or a rebuild moves nothing. `pact.RecordDeleted` takes the rows out at once.
+- **Rebuilds.** Rebuilds run as the conga job `golem15.sitemap.rebuild`:
+  - debounced after record events through `rebuild_pending_until` (P33-12), defaulting to 60 s;
+  - dispatched after every settings save commits;
+  - run nightly at 03:00 through the scheduled `sitemap:rebuild`;
+  - run by hand with `sitemap:rebuild`, or `--queue` to hand it to a worker.
+- **hreflang (D-55 to D-57).** A record with two or more listed locales gets `xhtml:link` alternates on every listed address, plus `x-default` on the default locale's address. The xhtml namespace is declared only when used.
+- **Contract (D-95).** `contract.Filter` is asked once per page of records and once for the additional addresses:
+  - an excluded address keeps its row with the reason and is counted in S1;
+  - `Decision.Group` moves the address to another file group;
+  - `Decision.LastMod` sets the first lastmod of a new address.
+
+  The plugin publishes `classes.Listing` as `contract.Listing` in `Register`. Its `Settings` returns the site address, the index address, the default locale and the groups with counts and titles. Its `Entries` pages through a group's addresses, with a locale filter.
+- **Settings singleton (C26).** One tile opens it. It has three tabs:
+  - Files: site address, file size, and the S1 partial (index plus files, the left-out table by reason, a note; the empty and building states).
+  - Content types: built at boot from signpost, one block per type (include, file name, HTML heading).
+  - Additional addresses.
+
+  Saving refuses bad input with the `errors.*` copy.
+- **Migration (D-32).** Migration 202610280002 copies the url items of the served definition into `extra_urls`, `frontend_url` into `site_url` and `frontend_default_locale` into `default_locale`. The definitions table and the Phase 17 columns are untouched, and rollback drops only the new columns.
+- **Removal.** The generator, the libxml serializer, tiers, the rewrite, the manifest, the `Url::to` port, the events, the PHP goldens with their generator, the XSL, the definition model, the definitions controller and its form are all deleted, along with their tests.
+
+## Task Commits (sm-sitemap-plugin, branch main, not pushed)
+
+1. **Task 1: Confirm the public format.** No commit; answered "as-proposed" (above).
+2. **Task 2: index and per-type files (tracer):** `3359f1a` feat: sitemap index and per-type files from a slot table (tracer)
+3. **Task 3:**
+   - group A `3ba70bb` feat: sitemap settings singleton with content types and additional addresses
+   - group B `84cb27a` feat!: remove the PHP-parity sitemap, tiers, definitions screen and XSL
+   - group C `62fc7d7` feat: migrate definitions into additional addresses
+4. **Task 4:**
+   - group A `653627b` feat: real lastmod from record events and debounced rebuilds
+   - group B `ded1095` feat: hreflang alternates and the sitemap filter contract
+   - group C `64453d2` docs: README for the per-type sitemap format
+
+**Plan metadata:** this SUMMARY commit in summercms.go (docs), then ROADMAP alone.
+
+## Files Created/Modified (sm-sitemap-plugin)
+
+- `contract/contract.go`: every P33-08 type. No init and no `party.Register`.
+- `classes/slots.go`: `AssignSlots` and `Slot`.
+- `classes/rebuild.go`: `Rebuild`, `RebuildResult`, `RebuildArgs` and `RebuildKind`, `DefaultSlug`, `ExtraRecordID`, the Filter decisions, the alternates.
+- `classes/writer.go`: `WriteIndex` and `WriteURLSet` on `bufio` with `xml.EscapeText`; `FileName`, `ParseFileName`, `ValidSlug`.
+- `classes/settings.go`: `LoadSettings`, `SiteURL`, `Absolute`.
+- `classes/types.go`: `EffectiveType`, `LoadTypeSettings`, `ReservedSlugs`.
+- `classes/dispatch.go`: `RequestRebuild`, `DispatchRebuild`, `Building`.
+- `classes/lastmod.go`: `RecordSaved`, `RecordDeleted`, `RealChanges`, `RequestDebouncedRebuild`, `ClearPending`, and the config readers.
+- `classes/listing.go`: `Listing`.
+- `models/url.go`, `models/type_setting.go`, `models/legacy.go`: the slot row, the type row, and a reader for Phase 17 and Winter definition data (used by the import and the migration).
+- `models/settings.go`: the new columns only, plus `Validate` and `Problems`.
+- `updates/2026102800{01,02,03}_*.go`: the slot table, the settings columns with the definitions copy, and the types table.
+- `controllers/settings.go` with `settings/config_form.yaml` and `settings/_sitemap_files.htm`: the singleton and S1.
+- `extensions_settings.go`: the Content types tab.
+- `admin.go`: one tile; embeds by pattern.
+- `jobs.go`, `listeners.go`, `schedule.go`, `console/rebuild.go`, `plugin.go`: the job, the listeners, the schedule, the command, and publishing the Listing.
+- `console/import.go`, `console/import_winter.go`, `console/helpers.go`: these now write to the additional addresses.
+- `routes.go`: the index and file routes.
+- `config/config.yaml`: `site_url` (commented), `lastmod_ignore`, `rebuild_delay_seconds`.
+- `lang/{en,pl}/lang.yaml`: every C26 key, including the images, News, IndexNow and HTML keys that 33-04 uses, plus `errors.lastmod`, `settings.extra_url_lastmod_comment` and `jobs.rebuild`. The Phase 17 item and definition keys are removed.
+- `README.md` and `plugin.yaml` (regenerated by `summer plugin:manifest`), `go.mod` (`goccy/go-yaml` is now a direct dependency; it is already in the decided set).
+- Tests:
+  - `sitemap_index_test.go`: 13 Docker tests.
+  - `content_fixture_test.go`, `filter_fixture_test.go`: the fake content plugin and the fake filter plugin.
+  - `import_test.go`, `routes_test.go`, `classes/slots_test.go`, `classes/lastmod_test.go`, `models/settings_test.go`, `console/import_winter_test.go`, `commands_documented_test.go`.
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] The framework repeater does not accept a datepicker**
+- **Found during:** Task 3
+- **Issue:** C26 asks for a datepicker for the row lastmod. cabana refuses `datepicker` inside a `repeater` when it compiles the schema, so the plugin would not boot.
+- **Fix:** the lastmod is a text field with the comment "Optional, as YYYY-MM-DD". The server checks it (`models.ValidDate`) and refuses a bad value with the new `errors.lastmod`. This is logged in deferred-items.md and WINDOWS.md #30. The framework fix (datepicker in repeater rows) is separate, additive work.
+- **Commit:** 3ba70bb
+
+**2. [Rule 1 - Bug] `BeforeValidate` refusals became 500s**
+- **Found during:** Task 3
+- **Issue:** cabana's CRUD path turns any `lagoon.HasBeforeValidate` error into a `CapabilityError` (500). The Phase 17 hook only worked through the old settings-form route.
+- **Fix:** validation is now `Settings.Validate`, called from the controller's `FormBeforeUpdate` and `FormBeforeCreate` (the SEO plugin's pattern). It returns 422 with field details.
+- **Commit:** 3ba70bb
+
+**3. [Rule 3 - Blocking] S1 cannot link to the public file URLs**
+- **Issue:** the partial renderer keeps only root-relative `href`s (`safePartialURL`).
+- **Fix:** each file links to the backend route that serves it. The note names the public index address. Logged in deferred-items.md as by design.
+- **Commit:** 3ba70bb
+
+**4. [Plan shape] Field labels cannot carry `:type`**
+- **Issue:** cabana translates field labels without parameters, so "Include :type" cannot be rendered.
+- **Fix:** each type's switch is labelled with the type's own signpost label. The copy moved to comments without the parameter (`type_include` "Include this content type in the sitemaps.", `type_slug` "File name", `type_title` "Heading in the HTML sitemap", and their pl equivalents).
+- **Commit:** 3ba70bb
+
+**5. [Plan shape] Content type titles stored as a JSONB locale map**
+- **Issue:** the plan said "title via the translation writer", but the extension's `Save` already receives the mltext value as a locale map, and `golem15_sitemap_types` has no host-column model for translate.
+- **Fix:** titles are stored as `titles jsonb` and fed directly into `GroupInfo.Titles` and `Group.Titles`.
+- **Commit:** 3ba70bb
+
+**6. [Rule 3 - Blocking] The Phase 17 tests needed rework**
+- **Issue:** the route smoke tests (`TestSitemapTracer`, `TestSitemapCacheAndThrottle`, `TestSitemapImportSmoke`), the admin smoke test (`TestSitemapAdminSmoke`, which already failed before this plan because the framework now localizes 422 phrase keys), `TestBackendURL`, and the tier Boot assertion all pinned the removed format.
+- **Fix:** they were replaced by the new tests, and `TestImportWinter` was rewritten for the new targets. No surviving behaviour lost its test.
+- **Commits:** 3359f1a, 3ba70bb, 84cb27a
+
+**7. [Plan shape] Extra settings columns**
+- The plan did not list `numbered_size` (detects a file size change), `built_at` and `rebuild_requested_at` (the S1 building state).
+- `extra_urls` is `JSONB NULL DEFAULT '[]'` instead of `NOT NULL`, because a `lagoon.Jsonable` that is not valid writes NULL.
+- **Commit:** 3359f1a
+
+**8. [Acceptance grep] Two greps print more than the plan expects**
+- `grep "priority_tiers\|cache_seconds"` still matches `enable_priority_tiers`, in two places:
+  - the column in the released Phase 17 migration 202610110002, whose DDL must not change;
+  - the PHP export key that `sitemap:import-winter` recognizes so it can report it as ignored.
+
+  Both config keys themselves are gone.
+- `grep "/_sitemap/files/{file}" routes.go` prints two lines: the route and its doc comment.
+
+**9. [TDD note] RED evidence**
+- Before implementing, I ran the tests for 3C and for 4A and 4B:
+  - `TestMigrateDefinitions` failed with `extra_urls = ""`.
+  - `TestLastmod` and `TestDebouncedRebuild` failed on their target assertions.
+  - `TestHreflangAlternates`, `TestFilterExcludes` and `TestListing` failed on theirs.
+- `TestStableNumbering` and `TestNoFilter` passed at RED. They pin invariants that the tracer slot logic already had.
+- The plan is `type: execute`, and each task is one commit per the plan's commit-group table, with no separate `test(...)` commit.
+
+### Auth gates
+
+None.
+
+---
+
+**Total deviations:** 9. One is a framework gap (deferred), one is a bug fix, one is a by-design link limitation, and the rest are plan shape, test rework, acceptance-grep notes and a TDD note.
+**Impact on plan:** every must-have truth is met. The two visible differences from UI-SPEC C26 are the lastmod text field and the switch labels.
+
+## Known Stubs
+
+- `contract.ListingSettings.HTMLEnabled`, `HTMLPaths`, `HTMLPageSize` and `KeyFile` stay zero, and `golem15_sitemap_urls.images` stays `[]`, until 33-04 adds the HTML sitemap, IndexNow and image settings (P33-08; WINDOWS.md #29). The C26 copy for those tabs is already in the phrasebooks.
+
+## Threat Flags
+
+None outside the plan's threat model. T-33-09 to T-33-12 are mitigated:
+- every value goes through `xml.EscapeText`, and the test covers `&`, `<` and quotes;
+- only an http(s) site URL from the setting or config is used, never the Host;
+- the routes are table-served, throttled and constrained by `Where`;
+- only published records are listed, and drafts are tested to be absent;
+- `site_url` is validated, and the settings are guarded by the existing permission.
+
+## Issues Encountered
+
+- `go test ./... -run X` prints "no tests to run" for the subpackages, while every named root test passes (same as in 33-02).
+
+## Verification run
+
+- `go vet ./...` and `go test -short ./...` in sm-sitemap-plugin: green after every commit.
+- Docker `go test ./... -count=1` in sm-sitemap-plugin: green after every commit except the tracer. At the tracer the old `TestSitemapAdminSmoke` was red; it was already failing before this plan and was removed in 3A.
+- The plan's named tests all pass: TestSitemapIndex, TestStableNumbering, TestLastmod, TestHreflangAlternates, TestFilterExcludes, TestNoFilter, TestDebouncedRebuild, TestMigrateDefinitions, TestSettingsSingleton, TestImportWinter. TestListing, TestImportFile and TestRebuildCommand pass too.
+- Acceptance greps: `type Filter interface` and `type Listing interface`, `xml.EscapeText`, the files route, no init in `contract/`, no files under assets, `classes/testdata` or `tests/php`, `golem15.sitemap.settings`, `Lookup[contract.Filter]`, `Publish[contract.Listing]`, `sitemap:rebuild` in schedule.go and console/rebuild.go, `x-default`. All present; see deviation 8 for the two greps that print extra lines.
+- From summercms.go:
+  - `bash scripts/check-phase33.sh --plugins --marker`: PASS (sitemap, seo and journal vet and short tests; vitest 77 and 244).
+  - `bash scripts/check-phase33.sh --docker`: PASS (sitemap 23, seo 56, journal 124 top-level Postgres tests).
+
+## User Setup Required
+
+None for this plan. When the apps move to the new format in 33-13:
+- run `sitemap:rebuild` once after the deploy;
+- make sure a conga worker and the scheduler run;
+- map the root file names (vue-seo-layer v0.2.0 or the nginx rule in the README).
+
+## Next Phase Readiness
+
+- **33-04:** add images, News, IndexNow and the HTML sitemap on this table and settings. Fill the zero `ListingSettings` fields. Use `RebuildResult.Added/Changed/Removed` for IndexNow.
+- **33-05:** the SEO plugin implements `contract.Filter` (noindex, canonical, redirect) and may use `Decision.Group` for page-registry kinds.
+- **33-13:** move grzybyfunkcjonalne and demo to the new sitemap.
+- **33-14:** bump `go.mod` to v0.6.1 and tag the next minor (breaking) version from `git tag`, after v0.1.2. Write the release notes from "Read first".
+
+## Self-Check: PASSED
+
+- FOUND: every file in key-files.created (checked with `[ -f ]`).
+- FOUND commits in sm-sitemap-plugin: 3359f1a, 3ba70bb, 84cb27a, 62fc7d7, 653627b, ded1095, 64453d2. `git rev-list --count 049f3ee..HEAD` = 7.
+- No uncommitted changes in sm-sitemap-plugin.
+
+---
+*Phase: 33-seo-output-audit-and-content*
+*Completed: 2026-11-04*

.planning/phases/33-seo-output-audit-and-content/33-04-SUMMARY.md

@@ -0,0 +1,320 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 04
+subsystem: sitemap
+tags: [sm-sitemap-plugin, image-sitemap, news-sitemap, indexnow, fetchguard, html-sitemap, management-api, mcp, settings-singleton]
+
+requires:
+  - phase: 33-seo-output-audit-and-content
+    provides: "33-03 slot table, rebuild (RebuildResult Added/Changed/Removed), settings singleton, contract.Listing; 33-01 content facts (Kind, PublishedAt, Parents, Images)"
+provides:
+  - "Image sitemap files sitemap-images-<n>.xml (image_file_no, stable numbering, at most 1000 images per page), images_enabled default on (D-31)"
+  - "Google News sitemap sitemap-news.xml: articles of the last 48 hours, newest first, at most 1000, news_sources type:/category: values, news_enabled default off (D-31)"
+  - "IndexNow: 32-hex key on save (crypto/rand), indexnow_new_key rotation, GET /_sitemap/indexnow/{file}, job golem15.sitemap.indexnow from rebuild diffs in production only, fetchguard client limited to api.indexnow.org, S2 status partial (D-31)"
+  - "HTML sitemap API GET /_sitemap/api/v1/html and /_sitemap/api/v1/html/{group} in the contract vue-seo-layer 33-08 consumes (D-34, D-24)"
+  - "Settings tabs Images and News, IndexNow, HTML sitemap; contract.Listing.Settings fills HTMLEnabled, HTMLPaths, HTMLPageSize, KeyFile"
+  - "Management API GET/PUT /_sitemap/api/v1/settings, POST /_sitemap/api/v1/rebuild and MCP tools sitemap_get_settings, sitemap_update_settings, sitemap_rebuild (D-10)"
+affects: [33-05, 33-07, 33-08, 33-13, 33-14]
+
+actuals:
+  tokens: 55000
+  tasks: 3
+  commits: 6
+plan_head_before: 64453d2a914f00a8310f76f806a8858d5d4345da
+plan_head_after: 291cf176db68ef498f8b8a57361d2418f7b0ebd0
+
+tech-stack:
+  added: []
+  patterns:
+    - "A second numbering of the same slot rows (image_file_no) with AssignSlots and the same renumber flag as file_no"
+    - "Outbound vendor call as a conga job through a single-host fetchguard client; the test routes it with fetchguard.WithTransport"
+    - "Production-only side effect checked twice: before queueing and again in the job"
+    - "Values a fixed-option taglist cannot offer listed by a server-rendered partial next to it, and checked on save"
+
+key-files:
+  created:
+    - ../sm-sitemap-plugin/updates/202610280004_add_golem15_sitemap_media_news_indexnow.go
+    - ../sm-sitemap-plugin/classes/images.go
+    - ../sm-sitemap-plugin/classes/news.go
+    - ../sm-sitemap-plugin/classes/indexnow.go
+    - ../sm-sitemap-plugin/classes/htmlgroups.go
+    - ../sm-sitemap-plugin/classes/files.go
+    - ../sm-sitemap-plugin/classes/typesettings.go
+    - ../sm-sitemap-plugin/controllers/api/indexnow.go
+    - ../sm-sitemap-plugin/controllers/api/html.go
+    - ../sm-sitemap-plugin/controllers/api/auth.go
+    - ../sm-sitemap-plugin/controllers/api/settings.go
+    - ../sm-sitemap-plugin/controllers/api/logger.go
+    - ../sm-sitemap-plugin/controllers/settings/_news_sources.htm
+    - ../sm-sitemap-plugin/controllers/settings/_indexnow_status.htm
+    - ../sm-sitemap-plugin/mcp.go
+    - ../sm-sitemap-plugin/sitemap_extras_test.go
+  modified:
+    - ../sm-sitemap-plugin/classes/rebuild.go
+    - ../sm-sitemap-plugin/classes/writer.go
+    - ../sm-sitemap-plugin/classes/listing.go
+    - ../sm-sitemap-plugin/classes/settings.go
+    - ../sm-sitemap-plugin/contract/contract.go
+    - ../sm-sitemap-plugin/models/url.go
+    - ../sm-sitemap-plugin/models/settings.go
+    - ../sm-sitemap-plugin/models/settings/fields.yaml
+    - ../sm-sitemap-plugin/models/settings_test.go
+    - ../sm-sitemap-plugin/controllers/settings.go
+    - ../sm-sitemap-plugin/extensions_settings.go
+    - ../sm-sitemap-plugin/jobs.go
+    - ../sm-sitemap-plugin/routes.go
+    - ../sm-sitemap-plugin/config/config.yaml
+    - ../sm-sitemap-plugin/lang/en/lang.yaml
+    - ../sm-sitemap-plugin/lang/pl/lang.yaml
+    - ../sm-sitemap-plugin/README.md
+    - ../sm-sitemap-plugin/plugin.yaml
+    - ../sm-sitemap-plugin/content_fixture_test.go
+    - ../sm-sitemap-plugin/sitemap_smoke_test.go
+    - ../sm-sitemap-plugin/commands_documented_test.go
+    - .planning/phases/33-seo-output-audit-and-content/COVERAGE.md
+
+key-decisions:
+  - "HTML sitemap API contract follows what vue-seo-layer 33-08 already reads: overview {groups:[{key, slug, title, total, more, entries:[{title, url, children?}]}]}, group page {group, title, page, pages, entries}; groups are addressed by their file slug; locale and page and page_size and total are extra fields"
+  - "html_path is stored as a JSONB locale map (html_paths) through the plugin's own form extension, not the translation writer (same reason as 33-03's type titles: the settings row has no translatable host model); a save merges the locales sent"
+  - "news_sources is a taglist with custom tags and no options; the values (type:<key>, category:<key>:<id>) are listed by the news_sources partial and checked on save, because cabana taglist options are a fixed YAML list and form extensions take no taglist"
+  - "IndexNow 5xx answers and network errors retry like 429 (five attempts); 400, 403 and 422 are recorded without retry; S2's err_rate time is the queued retry's scheduled_at in river_job, shown only while one is pending"
+  - "Image sitemap files use the same file size and renumber flag as the per-type files"
+  - "S1 and the index share classes.SitemapFiles, so the files table now lists the image and News files too (the index count counts addresses only once)"
+  - "The content type settings write moved to classes.SaveTypeSettings, shared by the form extension and PUT /_sitemap/api/v1/settings (types.<key>.<field> refusals)"
+
+patterns-established:
+  - "Plugin management API mirrors the SEO plugin's manage wrapper: cabana.ResolveBackend (token cover golem15.sitemap.*) plus cabana.Allows, 422 validation_failed with translated messages, X-Robots-Tag noindex"
+  - "A compile-only pier.Mount in the plugin's tests proves the MCP declarations bind to registered routes"
+
+requirements-completed: [SC-1, D-31, D-34, D-24, D-10, D-30]
+
+coverage:
+  - id: D1
+    description: "Image sitemap: featured then body images, deduplicated, unsafe dropped, absolute, at most 1000 per page, only image:image/image:loc, stable numbering with holes and renumber on file size change, images_enabled off removes the files from the index and answers 404"
+    requirement: "D-31"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_extras_test.go#TestImageSitemap"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "News sitemap: 1 h and 47 h old articles listed, 49 h not, never another kind, publication name (news_publication else app.name), language, date, escaped title, type and category sources, newest 1000 of 1007, off by default (no index entry, 404), malformed source refused, partial lists the values"
+    requirement: "D-31"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_extras_test.go#TestNewsSitemap"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "IndexNow in production: key on save (32 hex), key file text/plain, other names 404, one job with the new and the removed address, POST {host, key, urlList} to api.indexnow.org without keyLocation, 202 recorded, 403/422/400 recorded without retry, 429 retries, S2 states and callouts, other hosts never sent, new key makes the old file 404, off takes the file down"
+    requirement: "D-31"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_extras_test.go#TestIndexNow"
+        status: pass
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_extras_test.go#TestIndexNowStaging"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "HTML sitemap API: L3 group order, titles in the locale, category tree, posts newest first, others alphabetical, 150 + more, page 2 of 2, 404 past the last / malformed page / unknown group / off, excluded and other-locale addresses absent, noindex; HTML tab refusals; Listing HTML and KeyFile fields"
+    requirement: "D-34"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_extras_test.go#TestHTMLGroups"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Management API and MCP: 401/403, GET body, PUT refusals store nothing, PUT stores settings, HTML paths merge, types, IndexNow key and rotation, rebuild queued; MCP dispatch as the linked administrator; pier compiles sitemap_get_settings, sitemap_rebuild, sitemap_update_settings"
+    requirement: "D-10"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_extras_test.go#TestSitemapTools"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "The new settings tabs (Images and News, IndexNow with S2, HTML sitemap) in the real admin: field layout, triggers hiding the News fields and the new-key checkbox, the partial tables and callouts"
+    verification: []
+    human_judgment: true
+    rationale: "Rendering in the embedded admin SPA; the tests cover the schema, the saves and the partial node trees, not the visual layout"
+  - id: D7
+    description: "A HTML-sitemap group larger than html_page_size shows its first page plus the sitemap.all link and its group page is paginated (layer rendering in 33-08)"
+    requirement: "D-34"
+    verification:
+      - kind: integration
+        ref: "../sm-sitemap-plugin/sitemap_extras_test.go#TestHTMLGroups"
+        status: pass
+    human_judgment: false
+
+duration: 30min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 04: Sitemap extras Summary
+
+**sm-sitemap-plugin now adds image sitemap files and a Google News sitemap to the index, notifies IndexNow of each rebuild's changes in production through a single-host fetchguard client, serves the HTML sitemap's data in the JSON contract vue-seo-layer already reads, and exposes all sitemap settings through a management API that is also the MCP tools sitemap_get_settings, sitemap_update_settings and sitemap_rebuild.**
+
+## Read first: versions, breaking changes, consumers
+
+- **Versions.** Framework target v0.6.1 on base v0.6.0 (33-01 ruling). `sm-sitemap-plugin/go.mod` still requires `summercms v0.6.0` with `replace => ../summercms.go`; the bump is 33-14's. The plugin stays at v0.1.2 plus the 7 unpushed 33-03 commits plus these 6. Nothing was pushed or tagged; the breaking next-minor tag is 33-14's.
+- **No new breaking change.** Everything here is additive to the 33-03 format: new columns with defaults (migration `202610280004`), new routes, new settings, a second job kind. The image sitemap is on by default, so after the next rebuild the index of a site with images gains `sitemap-images-<n>.xml` entries; News and IndexNow are off by default; the HTML sitemap API answers by default (the layer only renders it while the site answer has it on with a path).
+- **For consumers (33-13, 33-14).** The application needs the conga worker for the IndexNow job as well. A site that turns IndexNow on must serve `/<key>.txt` at the root: vue-seo-layer does it from the SEO plugin's `root_files` (which should include `contract.ListingSettings.KeyFile`, 33-05's part), nginx with the README snippet. No core plugin (user, blog, pages, payment, journal) was touched, and the framework got no code (D-90; `--marker` passed).
+
+## Performance
+
+- **Duration:** about 30 min
+- **Started:** 2026-11-04T11:14:58Z
+- **Completed:** 2026-11-04T11:45Z
+- **Tasks:** 3
+- **Commits:** 6 in sm-sitemap-plugin (main, not pushed), 1 planning-docs commit in summercms.go (COVERAGE.md)
+
+## Accomplishments
+
+- **Image sitemap (D-31).** The rebuild stores each page's featured image and body images (absolute on the site, each once, at most 1000; `data:` and `javascript:` dropped) and numbers the listed rows with images into `sitemap-images-<n>.xml` with the per-type rules: stable numbers, holes, renumbering only with the file size. The files carry only `image:image` and `image:loc`.
+- **News sitemap (D-31).** `sitemap-news.xml` lists articles (content kind `article`) first published in the last 48 hours, newest first, at most 1000, with the publication name, language, date and title. `news_sources` narrows it to `type:<key>` or `category:<key>:<id>` values.
+- **IndexNow (D-31).**
+  - Saving with IndexNow on generates the key; "Generate a new key on save" replaces it and the old key file answers 404 at once.
+  - After each committed rebuild, in production only, the added, changed and removed addresses on the site host are queued as `golem15.sitemap.indexnow` jobs of at most 10 000.
+  - The job posts `{host, key, urlList}` to `https://api.indexnow.org/indexnow` through a fetchguard client limited to that host, records every answer, and retries 429, 5xx and network errors (five attempts).
+  - S2 shows the key or `no_key`, the last notification or `never`, and the 403, 422 and 429 callouts.
+- **HTML sitemap API (D-34, D-24).** The overview lists the non-empty groups in the L3 order with titles in the locale, the category tree, posts newest first and the rest alphabetical, each with the first `html_page_size` links and `more`. A group page pages the rest. Only the XML sitemaps' listed addresses appear. Public, `noindex`, bucket `sitemap-html`.
+- **Settings tabs.** Images and News, IndexNow (with S2) and HTML sitemap, with the C26 copy and the `errors.html_path` and `errors.page_size` refusals. `contract.Listing.Settings` now answers `HTMLEnabled`, `HTMLPaths`, `HTMLPageSize` and `KeyFile`.
+- **Management API and MCP (D-10).** GET and PUT settings and POST rebuild behind the sitemap permission, and the three tools. pier compiles them against the plugin's routes in the test.
+
+## Task Commits (sm-sitemap-plugin, branch main, not pushed)
+
+1. **Task 1 (tracer):** `5bf56fd` feat: image sitemap files (tracer)
+2. **Task 2:**
+   - group A `a10ce2d` feat: Google News sitemap
+   - group B `e02d0b1` feat: IndexNow key, key file and pings
+   - group C (summercms.go) `01a316a` docs(33-04): update the IndexNow coverage matrix
+3. **Task 3:**
+   - group A `8f4ff2a` feat: HTML sitemap groups API
+   - group B `2a05516` feat: sitemap management API and MCP tools
+   - group C `291cf17` docs: images, News, IndexNow, HTML sitemap and MCP in README
+
+**Plan metadata:** this SUMMARY commit in summercms.go (docs), then ROADMAP alone.
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Auto-fixed and plan-shape deviations
+
+**1. [Plan shape] HTML sitemap addresses stored as a JSONB locale map**
+- **Issue:** P33-13 says `html_path` goes through the translation writer. The settings row has no translatable host model, and without a writer cabana refuses a translated value on the main form.
+- **Fix:** column `html_paths jsonb` (default pl `/mapa-strony`, en `/sitemap`), edited as the mltext `html_path` added by the plugin's own form extension after `html_enabled`. A save merges the locales sent. Same approach as 33-03's type titles.
+- **Commit:** 8f4ff2a
+
+**2. [Rule 3 - Blocking] News sources taglist without options**
+- **Issue:** C26 asks for `customTags: false` with options from the article types and their categories. cabana taglist options are a fixed YAML list, and form extensions accept no taglist field, so dynamic options are impossible.
+- **Fix:** the taglist accepts custom tags. A `news_sources` partial under it lists the values the site has (article types and the categories their articles name, `classes.NewsSources`). Each value is checked on save (`models.ValidNewsSource`, new `errors.news_source`). The API answers the values as `news_source_options`. Logged in deferred-items.md and WINDOWS.md #31.
+- **Commit:** a10ce2d
+
+**3. [Rule 2 - Correctness] IndexNow 5xx and network errors retry**
+- P33-14 names 429 only. A 5xx or a network failure says nothing about the request, so dropping the notification would lose the change. These are retried within the five attempts as well. COVERAGE.md gained that row and the precise key file route (group C).
+- **Commit:** e02d0b1, 01a316a
+
+**4. [Plan shape] S2's 429 time**
+- `err_rate` needs ":time" of the next attempt. The queue owns the retry schedule, so S2 reads the pending job's `scheduled_at` from `river_job` and shows the callout only while a retry is queued. No extra column.
+- **Commit:** e02d0b1
+
+**5. [Plan shape] The key file route, not a root route**
+- As planned (`/_sitemap/indexnow/{file}`); no `/<key>.txt` root route in Go, so a site served at `/` keeps its one-segment pages. vue-seo-layer maps the root name from the site answer's `root_files`.
+
+**6. [Rule 2 - Correctness] S1 and the index share one file listing**
+- With image and News files in the index, S1 would otherwise have hidden them. `classes.SitemapFiles` now feeds both, and the index row of S1 counts addresses once.
+- **Commit:** 2a05516
+
+**7. [Rule 3 - Blocking] Type settings write shared with the API**
+- `PUT /_sitemap/api/v1/settings` must check content types like the form. The 33-03 save logic moved unchanged to `classes.SaveTypeSettings` (field-name refusals; the API renames them `types.<key>.<field>`).
+- **Commit:** 2a05516
+
+**8. [Rule 3 - Blocking] Test adjustments**
+- `TestScheduleAndJobs` now expects two jobs.
+- `TestSettingsValidate` builds settings with the default HTML page size, because 0 is now refused.
+- `bootPlugins` takes an `__env` override, so `TestIndexNow` runs in production.
+- The fake content record carries `PublishedAt` and `Parents`.
+- A fake blog plugin (`acme.journal`, an article type and a collection type) is booted only by the new tests, so the 33-03 tests are unchanged.
+
+**9. [Plan shape] Copy additions**
+- New phrases outside C26:
+  - `errors.news_publication`, `errors.news_source`, `errors.type_unknown`;
+  - `news.sources`, `news.source_value`, `news.source_label`, `news.source_type`, `news.none`.
+- Every C26 key is used as written.
+
+**10. [TDD note] RED evidence**
+- The plan is `type: execute`, and each task is one commit per its commit-group table.
+- Each test was written against the behaviour list before its implementation compiled. The tests of a group were run once the group compiled, and passed on that first run.
+- No separate RED commit was made.
+
+### Auth gates
+
+None.
+
+---
+
+**Total deviations:** 10. One is a framework gap (deferred: taglist options), one is storage shape, two are correctness additions, one is a status-source choice, and the rest are refactors, tests and copy.
+**Impact on plan:** every must-have truth is met. The visible difference from UI-SPEC C26 is the News sources tag list, which accepts typed values with the value table under it instead of a fixed choice.
+
+## Known Stubs
+
+None. WINDOWS.md #29 (the zero ListingSettings fields and the empty images column from 33-03) is resolved here and marked fixed.
+
+## Threat Flags
+
+None outside the plan's threat model:
+- **T-33-13:** fetchguard AllowHostsMode with `api.indexnow.org` only, HTTPS, no redirects, a 10 s timeout. `classes.SiteURLs` keeps only addresses on the site host, and the test sends a foreign host and a look-alike host.
+- **T-33-15:** a production check before queueing and again in the job (`TestIndexNowStaging`).
+- **T-33-16:** paging capped at `html_page_size` (at most 500), the tree read capped at 10 000 rows, bucket `sitemap-html`.
+- **T-33-17:** `cabana.ResolveBackend` and the permission check on every management route; the 401 and 403 cases are in `TestSitemapTools`.
+- **T-33-14** (key disclosure) is accepted as planned.
+- **New public surface, in the plan:** `GET /_sitemap/indexnow/{file}` and the two HTML routes; they serve only data the sitemaps already publish.
+
+## Issues Encountered
+
+- `go test ./... -run X` prints "no tests to run" for the subpackages while the named root tests pass (as in 33-02 and 33-03).
+- The 33-09 executor worked in sm-journal-plugin at the same time. `--plugins` still passed with its working tree as found.
+
+## Verification run
+
+- sm-sitemap-plugin, after every commit:
+  - `go vet ./...` and `go test -short ./...`: green.
+  - Docker `go test ./... -count=1`: green.
+- The plan's named tests all pass: TestImageSitemap, TestSitemapIndex, TestNewsSitemap, TestIndexNow (plus TestIndexNowStaging), TestHTMLGroups, TestSitemapTools. The 33-03 suite passes too.
+- Acceptance greps:
+  - one line each for `sitemap-image/1.1` (writer.go), `image_file_no` (migration), `crypto/rand` and `AllowHostsMode` (indexnow.go), and `sitemap-news/0.9` (news.go);
+  - `/_sitemap/api/v1/html` appears in routes.go and README.md;
+  - `"get_settings"`, `"update_settings"` and `"rebuild"` appear in mcp.go;
+  - `X-Robots-Tag` appears in html.go;
+  - COVERAGE.md has 3 OPT-OUT rows, each with a reason.
+- From summercms.go:
+  - `bash scripts/check-phase33.sh --plugins --marker`: PASS (sitemap, seo and journal vet and short tests; vitest 77 and 244).
+  - `bash scripts/check-phase33.sh --docker`: PASS (29 sitemap, 56 seo and 124 journal top-level Postgres tests).
+  - `--layers` was not run: it is known to be broken and is logged in deferred-items.md.
+
+## User Setup Required
+
+None for this plan. When a site turns IndexNow on (after 33-13):
+- it must run in the `production` environment with a conga worker;
+- the key file must be reachable at `https://<site>/<key>.txt` (vue-seo-layer from the site answer, or the nginx rule in the README).
+
+## Next Phase Readiness
+
+- **33-05:** the SEO plugin's site answer can take `html_sitemap` (enabled, paths, page_size) and the key file for `root_files` from `contract.Listing.Settings`.
+- **33-13:** consumers move to the new sitemap and may enable News or IndexNow per site.
+- **33-14:** bump `go.mod` to v0.6.1 and tag the next minor of sm-sitemap-plugin, covering 33-03 and 33-04.
+
+## Self-Check: PASSED
+
+- FOUND: every file in key-files.created (checked with `[ -f ]`).
+- FOUND commits in sm-sitemap-plugin: 5bf56fd, a10ce2d, e02d0b1, 8f4ff2a, 2a05516, 291cf17. `git rev-list --count 64453d2..HEAD` = 6.
+- FOUND commit in summercms.go: 01a316a.
+- No uncommitted changes in sm-sitemap-plugin.
+
+---
+*Phase: 33-seo-output-audit-and-content*
+*Completed: 2026-11-04*

.planning/phases/33-seo-output-audit-and-content/33-05-SUMMARY.md

@@ -0,0 +1,447 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 05
+subsystem: seo
+tags: [sm-seo-plugin, sitemap-filter, page-registry, route-report, site-answer, llms-txt, robots-txt, links, outbound, site-cache-purge, mcp]
+
+requires:
+  - phase: 33-seo-output-audit-and-content
+    provides: "33-03/33-04 sm-sitemap-plugin contract (Filter, Listing with HTML settings and KeyFile); 33-01 descriptor Kind/Parents; 33-08 layer contracts for POST /registry/routes and GET /site"
+provides:
+  - "classes.SitemapFilter published as contract.Filter: noindex, canonical-elsewhere and redirected addresses leave the sitemaps; production values, so staging lists the same set (D-95, D-24)"
+  - "Page registry golem15_seo_pages: SEO › Pages screen, content type seo-page (SEO tab, resolve ok, sitemaps by kind), C21 refusals (D-33)"
+  - "POST /_seo/api/v1/registry/routes route report: token, 2000-path cap, insert-only, missing state (D-33, P33-20)"
+  - "GET/POST /_seo/api/v1/pages, PUT/DELETE /pages/{id} and MCP tools seo_list_pages, seo_create_page, seo_update_page, seo_delete_page (D-10)"
+  - "GET /_seo/api/v1/site (P33-17) and GET /llms.txt (D-25)"
+  - "robots.txt Sitemap: line from the sitemap plugin's index unless robots_sitemaps is set (D-22)"
+  - "Links tab (links_new_tab, nofollow_domains, sponsored_domains) and outbound in the resolve answer (P33-16, D-83)"
+  - "noindex_published only for listed addresses; CMS issue sitemap_blocked; P1 status.excluded_* callouts (D-12, D-24)"
+  - "Site-cache purge after every SEO write, once per transaction (P33-19)"
+  - "sm-sitemap-plugin: contract.ListingSettings.TypesOff (additive)"
+affects: [33-06, 33-07, 33-08, 33-10, 33-11, 33-12, 33-13, 33-14]
+
+actuals:
+  tokens: 60200
+  tasks: 3
+  commits: 9
+plan_head_before: 55f5e5dbb0c1fc50851dd51c9a8f258d265d6024
+plan_head_after: df93c860011ee33158657a27f1a82ea1eeef6595
+
+tech-stack:
+  added: []
+  patterns:
+    - "A plugin's own form extension stores a translatable field as a locale map in JSONB (registry url/title), so the record can be matched by any locale's address without the translation writer"
+    - "Content-type label that is not a phrase key is shown as written (no translator lookup)"
+    - "Site-cache purge deduplicated per transaction by the transaction's ConnPool (package-level map, reset when it grows past 1024 entries)"
+    - "Listener transactions that record history run in lagoon.Transaction, so their after-commit work runs"
+
+key-files:
+  created:
+    - ../sm-seo-plugin/classes/sitemap_filter.go
+    - ../sm-seo-plugin/classes/registry.go
+    - ../sm-seo-plugin/classes/site.go
+    - ../sm-seo-plugin/classes/llms.go
+    - ../sm-seo-plugin/models/page.go
+    - ../sm-seo-plugin/models/page/columns.yaml
+    - ../sm-seo-plugin/models/page/fields.yaml
+    - ../sm-seo-plugin/updates/202610280002_create_golem15_seo_pages.go
+    - ../sm-seo-plugin/updates/202610280003_add_golem15_seo_links_and_llms.go
+    - ../sm-seo-plugin/menu_item_types.go
+    - ../sm-seo-plugin/extensions_pages.go
+    - ../sm-seo-plugin/controllers/pages.go
+    - ../sm-seo-plugin/controllers/pages/config_list.yaml
+    - ../sm-seo-plugin/controllers/pages/config_form.yaml
+    - ../sm-seo-plugin/controllers/pages/config_filter.yaml
+    - ../sm-seo-plugin/controllers/pages/_page_status.htm
+    - ../sm-seo-plugin/controllers/api/registry.go
+    - ../sm-seo-plugin/controllers/api/site.go
+    - ../sm-seo-plugin/controllers/api/llms.go
+    - ../sm-seo-plugin/sitemap_filter_test.go
+    - ../sm-seo-plugin/registry_test.go
+  modified:
+    - ../sm-seo-plugin/go.mod
+    - ../sm-seo-plugin/go.work
+    - ../sm-seo-plugin/plugin.go
+    - ../sm-seo-plugin/plugin.yaml
+    - ../sm-seo-plugin/routes.go
+    - ../sm-seo-plugin/admin_navigation.go
+    - ../sm-seo-plugin/extensions.go
+    - ../sm-seo-plugin/extensions_robots.go
+    - ../sm-seo-plugin/listeners.go
+    - ../sm-seo-plugin/mcp.go
+    - ../sm-seo-plugin/operations.go
+    - ../sm-seo-plugin/classes/resolver.go
+    - ../sm-seo-plugin/classes/history.go
+    - ../sm-seo-plugin/classes/batch.go
+    - ../sm-seo-plugin/classes/issues.go
+    - ../sm-seo-plugin/classes/robots.go
+    - ../sm-seo-plugin/classes/robots_write.go
+    - ../sm-seo-plugin/classes/settings_write.go
+    - ../sm-seo-plugin/classes/partials.go
+    - ../sm-seo-plugin/classes/generate.go
+    - ../sm-seo-plugin/classes/undo.go
+    - ../sm-seo-plugin/models/settings.go
+    - ../sm-seo-plugin/models/settings/fields.yaml
+    - ../sm-seo-plugin/models/robots.go
+    - ../sm-seo-plugin/models/revision.go
+    - ../sm-seo-plugin/extension/_seo_status.htm
+    - ../sm-seo-plugin/config/config.yaml
+    - ../sm-seo-plugin/lang/en/lang.yaml
+    - ../sm-seo-plugin/lang/pl/lang.yaml
+    - ../sm-seo-plugin/README.md
+    - ../sm-seo-plugin/fixture_test.go
+    - ../sm-seo-plugin/settings_test.go
+    - ../sm-seo-plugin/robots_test.go
+    - ../sm-seo-plugin/batch_test.go
+    - ../sm-seo-plugin/operations_test.go
+    - ../sm-sitemap-plugin/contract/contract.go
+    - ../sm-sitemap-plugin/classes/listing.go
+    - ../sm-sitemap-plugin/sitemap_index_test.go
+    - ../sm-sitemap-plugin/README.md
+
+key-decisions:
+  - "The sitemap filter also excludes an address the site's address rules would 301 (normalisation) with reason redirect, not only redirect-rule sources"
+  - "Registry addresses and names per locale are stored in urls/titles JSONB by the plugin's own form extension (fields url and title), not through the translation writer, so Match can find a page by any locale's address in one query"
+  - "Registry content type label is golem15.seo::lang.pages.type (Site page / Strona witryny): the plain Page label collided with another content type's SEO settings tab"
+  - "Plan commit groups 2A and 2C are one commit: TestEveryAdminOperationHasTool maps every Pages operation to its tool, so the controller cannot land without the tools"
+  - "Migration 202610280003 (links and llms columns) landed with the Links commit, ahead of the llms.txt commit that uses its robots columns"
+  - "llms.txt and the route report: llms.txt answers 404 outside production (non-production lock), and the route report answers 200 with {inserted, updated, skipped, reported_at}"
+  - "robots.txt names contract.ListingSettings.IndexURL (the sitemap plugin's site address) when robots_sitemaps is unset; the config default became a comment; both consumer apps set robots_sitemaps explicitly and keep their lines"
+  - "Issue gained an optional severity field, set to error for sitemap_blocked only; the site-audit plans fill the others"
+  - "sm-sitemap-plugin got the additive contract.ListingSettings.TypesOff so P1 can say status.excluded_type without reading the sitemap's tables (D-95)"
+
+patterns-established:
+  - "Registry/content-type ownership check: iterate signpost content types except the own one and call Match; Exact means owned"
+  - "A management write of a content-type record fires cabana.EmitRecordSaved/EmitRecordDeleted itself, so SEO address tracking and the sitemap follow as for an admin save"
+
+requirements-completed: [SC-1, SC-3, D-95, D-24, D-33, D-12, D-22, D-25, D-83, D-94, D-10]
+
+coverage:
+  - id: D1
+    description: "A noindex page leaves the XML sitemap with reason noindex, in production and on staging alike"
+    requirement: "D-95"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/sitemap_filter_test.go#TestSitemapFilterTracer"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Canonical elsewhere, redirect and rule-noindex reasons; P1 excluded callouts (plain) for noindex, canonical, redirect and a type switched off"
+    requirement: "D-24"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/sitemap_filter_test.go#TestFilterReasons"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Registry: create, resolve ok, seo-page record with SEO tab, sitemap-pages and sitemap-offers files, hreflang, C21 refusals (owned, taken, invalid, required, parent loop), 301 on address change (admin and API), filter groups and titles, delete removes entries and the sitemap row, management API with 401/403"
+    requirement: "D-33"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/registry_test.go#TestRegistry"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Route report: 404 without a token, notfound_token fallback, 401, 422 over 2000 paths, insert-only with derived title, owned and invalid paths skipped, a repeated report changes only reported_at and writes no history, missing row state, P9 states, missing filter"
+    requirement: "D-33"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/registry_test.go#TestRouteReport"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Site answer keys, root files (verification and IndexNow key), routes without the registry, noindex header"
+    requirement: "D-97"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/registry_test.go#TestSiteEndpoint"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "llms.txt off 404, on text/plain with site name, intro, groups and escaped links, excluded and other-locale addresses absent, staging 404"
+    requirement: "D-25"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/registry_test.go#TestLLMSTxt"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "robots.txt Sitemap line from the index, or the configured robots_sitemaps"
+    requirement: "D-22"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/registry_test.go#TestRobotsSitemapLine"
+        status: pass
+      - kind: integration
+        ref: "../sm-seo-plugin/robots_test.go#TestRobotsServed"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "Links tab: defaults, line-numbered domain refusal (admin and API), normalised storage, MCP-writable keys, outbound in resolve"
+    requirement: "D-83"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/registry_test.go#TestSettingsLinks"
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "noindex_published only for listed addresses; sitemap_blocked issue with line and rule"
+    requirement: "D-12"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/sitemap_filter_test.go#TestNoindexPublishedConflict"
+        status: pass
+      - kind: integration
+        ref: "../sm-seo-plugin/sitemap_filter_test.go#TestSitemapBlockedIssue"
+        status: pass
+    human_judgment: false
+  - id: D10
+    description: "One purge per committed SEO write (SEO tab, MCP redirect, settings, applied batch); none for a dry run or a refused batch"
+    requirement: "D-97"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/registry_test.go#TestPurgeAfterWrite"
+        status: pass
+    human_judgment: false
+  - id: D11
+    description: "Every Pages operation maps to an MCP tool bound to a route"
+    requirement: "D-10"
+    verification:
+      - kind: unit
+        ref: "../sm-seo-plugin/operations_test.go#TestEveryAdminOperationHasTool"
+        status: pass
+    human_judgment: false
+  - id: D12
+    description: "Pages screen, Links tab and the llms.txt fields in the real admin SPA: layout, trigger hiding llms_intro, parent dropdown, missing badge"
+    verification: []
+    human_judgment: true
+    rationale: "Rendering in the embedded admin SPA; the tests cover schema, saves, row states and partial node trees, not the visual layout"
+
+duration: 70min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 05: SEO plugin sitemap filter, page registry and site-level endpoints Summary
+
+**sm-seo-plugin now decides what the sitemaps list (noindex, canonicalised and redirected addresses leave them), keeps a page registry of the site's own frontend pages as the content type seo-page with an insert-only route report, and gives the layer its site answer, llms.txt, the index Sitemap: line, Links rules in the resolve answer and a site-cache purge after every SEO write.**
+
+## Read first: versions, breaking changes, consumers
+
+- **Versions.** Framework v0.6.0 base, v0.6.1 target (33-01 ruling); the framework got no code here (D-90, `--marker` passed). `sm-seo-plugin` stays at tag v0.1.1 plus these 9 unpushed commits on main; `sm-sitemap-plugin` at v0.1.2 plus 14 unpushed commits (13 from 33-03/33-04, 1 here). Nothing was pushed or tagged.
+- **go.mod.** `sm-seo-plugin/go.mod` requires `git.golem15.com/golem15/sm-sitemap-plugin v0.1.2`, and `go.work` replaces it with `../sm-sitemap-plugin`. The v0.1.2 tag has no `contract` package, so a build with `GOWORK=off` fails until 33-14 bumps the require to the new sitemap tag. Consumers resolve the sitemap through their own submodule `use`/`replace` (both apps already do).
+- **Changes a consumer will notice when it moves to the next sm-seo-plugin (33-13/33-14):**
+  - **`Requires()` now names `golem15.sitemap`.** A site with the SEO plugin must activate the sitemap plugin. Both known consumers (sm-demo-app, sm-grzybyfunkcjonalne-app) already list both plugins. Because no existing consumer breaks, I did not stop for a checkpoint.
+  - The SEO settings get a **Site page** tab (the registry's per-type settings) and a **Links** tab; robots.txt gets the llms.txt fields; SEO › Pages appears in the side menu.
+  - **robots.txt.** It names the sitemap plugin's index URL when `golem15.seo.robots_sitemaps` is unset. Both consumer apps set that key in `config/golem15.seo.yaml`, so their lines stay as they are.
+  - **noindex_published.** This batch conflict now fires only for addresses a sitemap file lists right now.
+  - The resolve answer gains the `outbound` key; no existing key changed.
+  - **New tables and columns.** Migrations `202610280002` and `202610280003` add the `golem15_seo_pages` table and new columns on settings and robots, all with defaults.
+- **Core plugins.** Untouched: user, blog, pages, payment and journal. The vue-* layers were not changed either.
+
+## Performance
+
+- **Duration:** about 70 min (11:40Z to 12:51Z)
+- **Tasks:** 3 (tracer, then 2 TDD tasks)
+- **Commits:** 9 in sm-seo-plugin, 1 in sm-sitemap-plugin (main, not pushed); planning docs in summercms.go
+
+## Accomplishments
+
+- **Sitemap filter (D-95, D-24).** `classes.SitemapFilter` is published in `Register`. It decides on production values, through a `Resolver` flag that skips the non-production lock. For each address it checks, in order:
+  - normalisation or a redirect rule → `redirect`;
+  - effective robots noindex → `noindex`;
+  - canonical URL not the page itself → `canonical`.
+
+  Registry pages go into the `pages`, `offers`, `services` and `landing-pages` groups. `Groups` titles each group per locale.
+- **Page registry (D-33, C21).**
+  - **Model and migration:** the `golem15_seo_pages` model and its migration.
+  - **SEO › Pages screen:**
+    - the list has kind, origin and missing filters and the missing row state;
+    - the form has the P9 partial, and the url/title mltext extension saves each locale and refuses `url_required`, `url_invalid`, `url_taken` and `url_owned` (with type and title), plus `parent_loop`.
+  - **Content type `seo-page`:** Records, Describe, Match by any locale, Resolve and References. Each page gets the SEO tab, resolves ok, takes part in address tracking with a 301 on change, and is listed in the sitemaps.
+- **Route report (P33-20).** `POST /registry/routes` uses a constant-time token and accepts at most 2000 paths. It only inserts or touches `reported_at`, skips owned and invalid paths, and stamps `routes_reported_at`.
+- **Management API and MCP (D-10).** Pages CRUD, the four tools and the `AdminOperations` rows.
+- **Site answer (P33-17).** Every key the layer's fixture expects except `pagination` and `home_crumb`, which 33-06 adds.
+- **llms.txt (D-25).** Built from the sitemaps' listed addresses in the default locale, grouped in the content types' order, with Markdown escaping.
+- **robots.txt (D-22).** One `Sitemap:` line naming the index.
+- **Links (D-83).** The Links tab, domain validation with line numbers, normalised storage, `outbound` in the resolve answer, and MCP keys.
+- **Conflicts and issues (D-12, D-24).** `noindex_published` only for listed addresses. New issue `sitemap_blocked`: severity error, `seo_update_robots`, the line and the rule. P1 shows the "Not in the sitemaps" callouts.
+- **Purge (P33-19).** `Service.Record` queues `cooler.PurgeSiteCacheAfterCommit` (kind `seo`) once per transaction.
+
+## Task Commits
+
+sm-seo-plugin (branch main, not pushed):
+
+1. **Task 1 (tracer):** `17b810d` feat: sitemap filter excludes noindex, canonicalised and redirected URLs (tracer)
+2. **Task 2:**
+   - `9e802ec` feat: page registry with its admin screen and signpost type (groups A and C together)
+   - `26193ae` feat: route report endpoint (group B)
+3. **Task 3:**
+   - `49d3879` feat: links settings and outbound rules in resolve (group B)
+   - `742a5b9` feat: site endpoint, llms.txt and the sitemap index in robots.txt (group A)
+   - `59f0457` feat: sitemap-aware batch conflict and the sitemap_blocked issue (group C)
+   - `2dfc606` feat: purge the site cache after SEO writes (group D)
+   - `397c126` fix: name a content type's plain label in url_owned without translating it
+   - `df93c86` docs: registry, site endpoint, llms.txt and links in README (group E)
+
+sm-sitemap-plugin (branch main, not pushed):
+- `9e5c393` feat: the listing names the content types switched off
+
+The tracer gate ran in interactive end-of-phase mode: `TestSitemapFilterTracer` was re-run and passed before the expansion tasks.
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Adapted to the actual repositories
+
+**1. [Plan shape] Registry translations in JSONB, not the translation writer.**
+- **Plan:** P33-18 puts other locales "through the translation writer".
+- **Why it cannot work:** a signpost `Match` must find a page by its pl address. The writer offers no reverse lookup, and the test fixture's fake writer is not keyed per record.
+- **What I did:**
+  - `urls` and `titles` are JSONB locale maps (GIN index on `urls`), edited as the mltext fields `url` and `title` of the plugin's own form extension. This is the same approach as 33-03 and 33-04.
+  - That extension runs before the SEO tab's, so address tracking sees the saved address.
+  - The url index is unique where `url <> ''`, because the owner row is inserted before the extension writes the address.
+- **Commit:** 9e802ec
+
+**2. [Rule 3 - Blocking] Registry type label.**
+- **Problem:** the registry type's label `pages.name` ("Page") collided with another content type's "Page" tab in the SEO settings, and cabana refuses two tabs whose labels read the same.
+- **Fix:** new copy key `pages.type` (Site page / Strona witryny).
+- **Commit:** 9e802ec
+
+**3. [Rule 3 - Blocking] Field types cabana requires.**
+- `content_updated_at` is a `*lagoon.Date`: cabana's datepicker in date mode needs that type.
+- `parent_id` is `*models.PageRef`, which has `UnmarshalText`, because the dropdown posts text.
+- **Commit:** 9e802ec
+
+**4. [Rule 1 - Bug] Row state read from the table.**
+- **Bug:** `ListExtendRecords` replaces the origin with its label before `ListRowStates` runs, so the missing state could never match.
+- **Fix:** `ListRowStates` reads the state with `models.MissingSQL`.
+- **Commit:** 9e802ec
+
+**5. [Plan shape] Commit groups changed.**
+- Task 2's groups A and C are one commit, because the parity test needs the Pages tools and the Pages controller together.
+- Task 3 order is B (Links, with migration 202610280003, which also holds the llms columns), A, C, D, E.
+- Task 2's route report (B) was split from A by staging stripped copies of the files. Both commits passed vet and the Docker suite.
+
+**6. [Rule 2 - Correctness] Additive sitemap contract field.**
+- **Why:** P1's `status.excluded_type` needs to know which content types are switched off, and `contract.Listing` had no way to say so. D-95 forbids reading the sitemap's tables.
+- **What I did:** added `ListingSettings.TypesOff` in sm-sitemap-plugin, with a test assertion and a README line. The change is additive and outside the plan's file list.
+- **Commit:** 9e5c393 in sm-sitemap-plugin
+
+**7. [Rule 2 - Correctness] What the filter treats as a redirect.**
+- **Rule:** an address the site's address rules would 301 (normalisation) is excluded as `redirect`, as well as redirect-rule sources.
+- **Why:** a listed URL that 301s is a sitemap error.
+
+**8. [Rule 2 - Correctness] Changes to existing code paths.**
+- **llms.txt** answers 404 outside production (the non-production lock).
+- **Undo** handles the new robots fields `llms_enabled` and `llms_intro`.
+- **Transactions:** `RecordDeleted` and `addressesAfterSave` now run in `lagoon.Transaction`. Their history records would otherwise hit "after-commit callback skipped inside unmanaged transaction" and never purge.
+- **robots.txt checks:** the file is composed once per batch of address checks, not once per address.
+- **Commits:** 742a5b9, 2dfc606, 59f0457
+
+**9. [Plan shape] Copy additions.**
+- `pages.type` and `pages.home_title` (the name of a reported `/`: Home / Strona główna).
+- `pages.filter_missing_only` and `pages.filter_missing_hide`, read from the C21 shorthand.
+- `history.what_page`, `history.kind_page`.
+- `Issue.severity` (JSON `severity`) is set only for `sitemap_blocked`.
+
+**10. [Rule 3 - Blocking] Existing tests adjusted to the planned behaviour.**
+- `TestSettingsTypeTabs`: the Site page and Links tabs.
+- `TestRobotsServed` and `TestRobotsScreen`: the Sitemap line now names the sitemap's index, which is on app.url in the fixture, and the llms fields are on the screen.
+- `TestBatch`: rebuilds the sitemap first, so its address is listed.
+- `TestPluginManifest`: plugin.yaml regenerated with `requires: golem15.sitemap`.
+- The fixture boots `golem15.sitemap` whenever `golem15.seo` is booted.
+
+**11. [Rule 1 - Bug] Plain content type labels.**
+- **Bug:** `url_owned` passed a plain content type label to the translator, which logged it as a missing key.
+- **Fix:** labels without `::` are used as written.
+- **Commit:** 397c126
+
+### TDD note
+
+The plan is `type: execute`. Each task's tests were written before or alongside its code. They were run once the group compiled, and the failures fixed before the group's commit:
+- the "/pl/pages/first" substring;
+- the file group name;
+- the NOT NULL urls column;
+- the datepicker type;
+- the dropdown fill;
+- the row-state ordering.
+
+No separate RED commit was made: the plan requires green tests at every commit, as in 33-04.
+
+### Auth gates
+
+None.
+
+**Total deviations:** 11. Two are storage or contract shapes, four are blocking fixes, three are correctness additions, one is commit grouping and one is copy additions.
+**Impact on plan:** every must-have truth is met. The visible additions to UI-SPEC are the Site page settings tab label and the plain-callout variant of P1.
+
+## Issues Encountered
+
+- **Shared file group.** A content type whose sitemap file group is also `pages` (the fixture's `acme-page`) shares the file and the HTML-sitemap group with the registry's `page` kind. The README states it.
+- **Route report size.** The framework's default body limit (`http.body_limits.default_bytes`) can refuse a report larger than 1 MB before the 2000-path cap applies. The layer's reports of static routes are far smaller.
+- **Registry history.** Undo of a registry page's history row answers `history.undo_unsupported`; registry undo was not planned.
+- `go test ./... -run X` prints "no tests to run" for subpackages while the named root tests pass (as in 33-02 to 33-04).
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None outside the plan's threat model:
+- **T-33-18** (route report): constant-time token compare, a 2000-path cap, paths of at most 2048 bytes, insert-only, owned paths skipped; covered by `TestRouteReport`.
+- **T-33-19** (`/site`): only public facts. The test asserts that no token and no registry type appear.
+- **T-33-20** (llms.txt): built from the listed addresses only, off by default, 404 outside production.
+- **T-33-21** (Pages admin and MCP): `golem15.seo.manage` on every route and screen. Covered by the parity test and the 401/403 cases.
+- **T-33-22** (domain lists): host names only, no scheme or path, validated line by line.
+- **T-33-23** (purge): one purge per transaction after commit, coalesced by the framework purger.
+
+## Verification run
+
+- **sm-seo-plugin, after every commit:**
+  - `go vet ./...` and `go test -short ./...`: green;
+  - Docker `go test ./... -count=1`: green, 67 top-level tests.
+- **Named tests:** all pass.
+  - TestSitemapFilterTracer, TestFilterReasons, TestNoindexPublishedConflict, TestSitemapBlockedIssue.
+  - TestRegistry, TestRouteReport, TestSiteEndpoint, TestLLMSTxt, TestRobotsSitemapLine, TestSettingsLinks, TestPurgeAfterWrite.
+  - TestEveryAdminOperationHasTool, TestMCPReadToolsAreGET.
+  - TestResolverPrecedence and the Phase 32 suites.
+- **sm-sitemap-plugin:** vet, short and the Docker suite green (sitemap without SEO).
+- **From summercms.go:**
+  - `bash scripts/check-phase33.sh --plugins --marker`: PASS (vet and short tests of sitemap, seo and journal; vitest 77 and 244; marker clean).
+  - `bash scripts/check-phase33.sh --docker`: PASS (29 sitemap, 67 seo, 124 journal top-level tests).
+  - `--layers` was not run: it is known to be broken and is logged in deferred-items.md. No layer was changed.
+  - `--go` and `--consumers` were not run: no framework code and no consumer pointer changed in this plan.
+- **Acceptance greps:**
+  - one line or more each for `golem15.sitemap` (plugin.go), `sm-sitemap-plugin/contract` (sitemap_filter.go and plugin.go), `sm-sitemap-plugin =>` (go.work), `"seo-page"` (registry.go), `/registry/routes` (routes.go), `subtle.ConstantTimeCompare` (api/registry.go), and `sitemap_blocked` (issues.go);
+  - four lines for the four page tools in mcp.go;
+  - `"/llms.txt"` and `"/site"` in routes.go;
+  - `links_new_tab` in settings_write.go, fields.yaml and resolver.go (via `OutboundOf`/`LinksNewTab`).
+
+## User Setup Required
+
+None for this plan. For sites (33-13):
+- **Route report:** set `golem15.seo.route_report_token`, or rely on `notfound_token`, and give the layer the same token.
+- **Purge:** configure `site_cache.purge_url` and `site_cache.purge_token`.
+- **Sitemap site address:** set the sitemap's site address (setting or `golem15.sitemap.site_url`) to the public origin, because robots.txt now names its index.
+
+## Next Phase Readiness
+
+- **33-06:** adds `pagination` and `home_crumb` to `classes.SiteAnswer`, and further resolve keys next to `outbound`.
+- **33-08's layer** can drop its fixtures for `/registry/routes` and `/site`: the plugin now answers in the shapes the layer reads.
+- **33-14:** bump the `sm-sitemap-plugin` require to its new tag and tag the next minor of both plugins.
+
+## Self-Check: PASSED
+
+- FOUND: every file in key-files.created (checked with `[ -f ]`).
+- FOUND commits in sm-seo-plugin: 17b810d, 9e802ec, 26193ae, 49d3879, 742a5b9, 59f0457, 2dfc606, 397c126, df93c86. `git rev-list --count 55f5e5d..HEAD` = 9.
+- FOUND commit in sm-sitemap-plugin: 9e5c393.
+- No uncommitted changes in sm-seo-plugin or sm-sitemap-plugin.
+
+---
+*Phase: 33-seo-output-audit-and-content*
+*Completed: 2026-11-04*

.planning/phases/33-seo-output-audit-and-content/33-06-SUMMARY.md

@@ -0,0 +1,473 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 06
+subsystem: seo
+tags: [sm-seo-plugin, json-ld, schema-org, breadcrumbs, hreflang, pagination, publisher, local-business, custom-elements, mcp, package-legitimacy]
+
+requires:
+  - phase: 33-seo-output-audit-and-content
+    provides: "33-01 descriptor facts (Kind, Parents, Authors, PublishedAt, Images, Videos); 33-05 resolve answer with outbound, the /site answer, the page registry kinds"
+provides:
+  - "One JSON-LD @graph per ok resolve answer (classes/schema Build), nodes linked by the P33-22 @ids"
+  - "Resolve keys html_lang, alternates, jsonld, breadcrumbs, pagination, seo.og.locale, seo.og.locale_alternates (additive)"
+  - "Publisher, Local business, Pagination tabs and the home crumb setting; P8 publisher preview"
+  - "Pagination forms (query or path) with one-hop 301s, invalid pages, suffixes with %pages% left for the layer"
+  - "GET /site pagination {form, param, segments} and home_crumb {name, url, names}"
+  - "SEO tab: Primary category (seoparent), Structured data (seoschema, E8), preview (E9, widget action seo_graph); P1 primary_gone, P2 schema type and trail rows"
+  - "GET /_seo/api/v1/graph and MCP seo_get_graph; primary_parent and schema on seo_set_url_seo and apply_batch"
+  - "Task 4 checkpoint answers: chromedp v0.21.0 and gen2brain/webp v0.6.4 approved"
+affects: [33-07, 33-08, 33-09, 33-10, 33-11, 33-12, 33-13, 33-14]
+
+actuals:
+  tokens: 110000
+  tasks: 4
+  commits: 6
+plan_head_before: df93c860011ee33158657a27f1a82ea1eeef6595
+plan_head_after: d38049a
+
+tech-stack:
+  added: []
+  patterns:
+    - "classes/schema is pure (no plugin imports): the resolver, the admin preview, the publisher preview and the MCP tool share Build and Validate"
+    - "Per-record structured data values live in the entry's data (primary_parent, schema) on every locale row, like the social image"
+    - "Pagination is folded into Resolve before the strict check, so normalisation, strict URLs and the page form reach the final address in one 301"
+
+key-files:
+  created:
+    - ../sm-seo-plugin/classes/schema/graph.go
+    - ../sm-seo-plugin/classes/schema/nodes.go
+    - ../sm-seo-plugin/classes/schema/validate.go
+    - ../sm-seo-plugin/classes/schema/custom.go
+    - ../sm-seo-plugin/classes/breadcrumbs.go
+    - ../sm-seo-plugin/classes/alternates.go
+    - ../sm-seo-plugin/classes/pagination.go
+    - ../sm-seo-plugin/classes/structured.go
+    - ../sm-seo-plugin/updates/202610280004_add_golem15_seo_publisher_pagination.go
+    - ../sm-seo-plugin/controllers/settings/_publisher_preview.htm
+    - ../sm-seo-plugin/controllers/api/graph.go
+    - ../sm-seo-plugin/assets/src/elements/schema.ts
+    - ../sm-seo-plugin/assets/src/elements/graph.ts
+    - ../sm-seo-plugin/assets/src/elements/parent.ts
+    - ../sm-seo-plugin/tests/elements/schema.test.ts
+    - ../sm-seo-plugin/structured_data_test.go
+  modified:
+    - ../sm-seo-plugin/classes/resolver.go
+    - ../sm-seo-plugin/classes/site.go
+    - ../sm-seo-plugin/classes/settings_write.go
+    - ../sm-seo-plugin/classes/sitemap_filter.go
+    - ../sm-seo-plugin/classes/entries.go
+    - ../sm-seo-plugin/classes/history.go
+    - ../sm-seo-plugin/classes/owner.go
+    - ../sm-seo-plugin/classes/partials.go
+    - ../sm-seo-plugin/classes/field_types.go
+    - ../sm-seo-plugin/models/settings.go
+    - ../sm-seo-plugin/models/settings/fields.yaml
+    - ../sm-seo-plugin/controllers/settings.go
+    - ../sm-seo-plugin/controllers/api/settings.go
+    - ../sm-seo-plugin/controllers/api/seo.go
+    - ../sm-seo-plugin/extensions.go
+    - ../sm-seo-plugin/routes.go
+    - ../sm-seo-plugin/mcp.go
+    - ../sm-seo-plugin/operations.go
+    - ../sm-seo-plugin/config/config.yaml
+    - ../sm-seo-plugin/assets/src/elements/index.ts
+    - ../sm-seo-plugin/assets/src/elements/labels.ts
+    - ../sm-seo-plugin/assets/src/elements/styles.css
+    - ../sm-seo-plugin/assets/dist/seo.js
+    - ../sm-seo-plugin/assets/dist/seo.css
+    - ../sm-seo-plugin/lang/en/lang.yaml
+    - ../sm-seo-plugin/lang/pl/lang.yaml
+    - ../sm-seo-plugin/README.md
+    - ../sm-seo-plugin/settings_test.go
+    - ../sm-seo-plugin/seo_tab_test.go
+
+key-decisions:
+  - "Task 4 (Jakub 2026-11-04): github.com/chromedp/chromedp approved, pin v0.21.0 (v0.21.1 and v0.22.0 exist but are under two weeks old)"
+  - "Task 4 (Jakub 2026-11-04): github.com/gen2brain/webp approved, pin v0.6.4 (its fallback is libwebp transpiled to Go with wasm2go, not wazero)"
+  - "Every graph carries the full WebSite and publisher nodes, not only the home page, so each page's graph is self-contained (the tracer expects both on a post)"
+  - "home_crumb in the site answer is {name, url, names}: name and url are what the committed 33-08 layer reads; names adds the per-locale names the plan asked for"
+  - "The graph is skipped in the sitemap filter's production resolver (it decides on robots and canonical only)"
+  - "Primary category is offered for article kinds only; the value is <type>:<id> of one of the descriptor's Parents"
+  - "Page 2 and later always uses its own canonical (D-21), and its hreflang alternates point at the same page of each translation"
+
+patterns-established:
+  - "A structured data refusal is a schema.Error code mapped to the schema.* copy, shared by the field type Decode, seo_set_url_seo and the graph tool"
+
+requirements-completed: [SC-2, SC-3, D-43, D-44, D-45, D-46, D-03, D-86, D-55, D-56, D-57, D-40, D-41, D-42, D-21, D-94, D-10, D-70, D-85]
+
+coverage:
+  - id: D1
+    description: "One @graph with WebPage, BlogPosting (headline, author, dates, image, wordCount, articleSection), BreadcrumbList, VideoObject, WebSite and Organization linked by @id; breadcrumbs equal the BreadcrumbList items; alternates en, pl, x-default; none for a single-locale record"
+    requirement: "D-43"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestGraphTracer"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Breadcrumbs through the primary parent (stored, else first; recursive; unpublished parents skipped), per-locale home crumb, home page trail"
+    requirement: "D-86"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestGraphTracer/TestBreadcrumbs"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "html_lang, og:locale and alternates from one source; paged alternates"
+    requirement: "D-55"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestGraphTracer/TestAlternates"
+        status: pass
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestPagedAlternates"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Publisher and Local business settings with every C20 refusal (422) in the admin and the API; the local business node; a person publisher; P8 with the logo finding; home crumb name"
+    requirement: "D-45"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestPublisherSettings"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Pagination query and path forms, one-hop 301s with normalisation, invalid pages, page 2+ canonical, robots and suffixes, /site pagination and home_crumb, segment and suffix refusals"
+    requirement: "D-40"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestPagination"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Custom JSON-LD refusals (invalid JSON with line/column, not an object, 16 KB, depth 8, script tag, type, price, currency), merge with the schema.merged notice, appended nodes, re-serialised storage on every locale row"
+    requirement: "D-44"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestCustomJSONLD"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "Collection, profile, registry offer (Service with offer), contact page, home SearchAction; no e-commerce node"
+    requirement: "D-43"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestGraphPerKind"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "GET /graph with findings and rules, unsaved schema preview, 401/403, primary_parent via seo_set_url_seo and apply_batch (dry run), P1 primary_gone, P2 rows"
+    requirement: "D-46"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/structured_data_test.go#TestGraphTool"
+        status: pass
+      - kind: unit
+        ref: "../sm-seo-plugin/operations_test.go#TestEveryAdminOperationHasTool"
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "E8, E9 and the parent element: type options, Service grid and price backstop, JSON status with line and column, 16 KB, nodes and findings, allGood, 800 ms re-check, locale switch, failure line"
+    requirement: "D-44"
+    verification:
+      - kind: unit
+        ref: "../sm-seo-plugin/tests/elements/schema.test.ts"
+        status: pass
+    human_judgment: false
+  - id: D10
+    description: "The new settings tabs, E8, E9 and the primary category select in the real admin SPA: layout, spacing, the local business switch hiding its fields"
+    verification: []
+    human_judgment: true
+    rationale: "Rendering in the embedded admin SPA; the tests cover schemas, saves and element DOM in happy-dom, not the visual layout"
+
+duration: 105min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 06: Structured data, breadcrumbs, hreflang and pagination Summary
+
+**sm-seo-plugin now answers every page with one JSON-LD @graph (page, article, profile, service, breadcrumbs, videos, WebSite, publisher), its breadcrumb trail through the primary category, hreflang with x-default, and paginated addresses in the site's form, with publisher and local business settings, the Structured data fields and graph preview in the SEO tab, and seo_get_graph through MCP.**
+
+## Task 4 answers: Go module legitimacy (Jakub, 2026-11-04)
+
+33-10 and 33-11 pin exactly these versions, each after its decision note:
+
+| Module | Answer | Pin | Checked by the orchestrator |
+|--------|--------|-----|-----------------------------|
+| `github.com/chromedp/chromedp` | **approved** | **v0.21.0** | Owned by the chromedp organisation, MIT. Dependencies: `github.com/chromedp/cdproto` and `github.com/go-json-experiment/json`. v0.21.1 (2026-11-01) and v0.22.0 (2026-11-03) exist, but both are less than two weeks old, so v0.21.0 is pinned. |
+| `github.com/gen2brain/webp` | **approved** | **v0.6.4** | MIT. The only dependency is `github.com/ebitengine/purego`. Correction to the plan: the fallback without a system libwebp is libwebp transpiled to Go with wasm2go, not a WASM build run through wazero. |
+
+Nothing was installed in this plan; no go.mod changed.
+
+## Read first: versions, breaking changes, consumers
+
+- **Versions.** The framework base is v0.6.0 and the target v0.6.1; this plan changed no framework code (`--marker` passed). `sm-seo-plugin` stays at tag v0.1.1 and now has 15 unpushed commits on main: 9 from 33-05 and 6 from this plan. The require on summercms and the go.work/replace setup are as 33-05 left them. Nothing was pushed or tagged.
+- **Resolve answer.** Only additive keys:
+  - top level: `html_lang`, `alternates`, `jsonld`, `breadcrumbs`, `pagination`;
+  - inside `seo.og`: `locale`, `locale_alternates`.
+  
+  No existing key changed. The new top-level keys are left out of the JSON when they are empty, and the layer reads a missing key as empty.
+- **What a consumer will notice when moving to the next sm-seo-plugin:**
+  - **Migration 202610280004** adds settings columns, all with defaults.
+  - **New settings tabs:** Pagination, Publisher and Local business, plus a home crumb field on the General tab.
+  - **New SEO tab fields:** Structured data and its preview on every content type, and Primary category on article types.
+  - **`?page=1` now redirects.** A request for `?page=1`, or for `/strona/N` while the site uses the query form, now answers 301 where it used to answer ok. Page 2 and later now get suffixes on the title and description. This is what D-41 asks for, but sites will see it.
+- **Core plugins.** Untouched: user, blog, pages, payment and journal. The vue-* layers were not changed.
+
+## Tracer resolve answer (TestGraphTracer, `/blog/first-post`)
+
+For comparison with the layer fixtures of 33-07 to 33-09:
+
+```json
+{
+  "action": "ok",
+  "alternates": [
+    {"hreflang": "en", "url": "https://www.example.test/blog/first-post"},
+    {"hreflang": "pl", "url": "https://www.example.test/pl/blog/pierwszy-wpis"},
+    {"hreflang": "x-default", "url": "https://www.example.test/blog/first-post"}
+  ],
+  "breadcrumbs": [
+    {"name": "Home", "path": "/", "url": "https://www.example.test/"},
+    {"name": "Recipes", "path": "/blog/category/recipes", "url": "https://www.example.test/blog/category/recipes"},
+    {"name": "First post", "path": "/blog/first-post", "url": "https://www.example.test/blog/first-post"}
+  ],
+  "html_lang": "en",
+  "jsonld": {
+    "@context": "https://schema.org",
+    "@graph": [
+      {"@id": "https://www.example.test/blog/first-post#webpage", "@type": "WebPage",
+       "breadcrumb": {"@id": "https://www.example.test/blog/first-post#breadcrumb"},
+       "dateModified": "2026-10-05T12:30:00Z", "datePublished": "2026-10-01T08:00:00Z",
+       "description": "About the first post", "inLanguage": "en",
+       "isPartOf": {"@id": "https://www.example.test/#website"}, "name": "First post",
+       "primaryImageOfPage": {"@type": "ImageObject", "url": "https://www.example.test/media/first.jpg"},
+       "url": "https://www.example.test/blog/first-post"},
+      {"@id": "https://www.example.test/blog/first-post#article", "@type": "BlogPosting",
+       "articleSection": "Recipes",
+       "author": [{"@id": "https://www.example.test/blog/author/jan#profile", "@type": "Person", "name": "Jan Kowalski", "url": "https://www.example.test/blog/author/jan"}],
+       "dateModified": "2026-10-05T12:30:00Z", "datePublished": "2026-10-01T08:00:00Z",
+       "description": "About the first post", "headline": "First post",
+       "image": ["https://www.example.test/media/first.jpg"], "inLanguage": "en",
+       "isPartOf": {"@id": "https://www.example.test/blog/first-post#webpage"},
+       "mainEntityOfPage": {"@id": "https://www.example.test/blog/first-post#webpage"},
+       "publisher": {"@id": "https://www.example.test/#organization"}, "wordCount": 420},
+      {"@id": "https://www.example.test/blog/first-post#breadcrumb", "@type": "BreadcrumbList",
+       "itemListElement": [
+         {"@type": "ListItem", "item": "https://www.example.test/", "name": "Home", "position": 1},
+         {"@type": "ListItem", "item": "https://www.example.test/blog/category/recipes", "name": "Recipes", "position": 2},
+         {"@type": "ListItem", "item": "https://www.example.test/blog/first-post", "name": "First post", "position": 3}]},
+      {"@id": "https://www.example.test/blog/first-post#video-1", "@type": "VideoObject",
+       "description": "About the first post", "embedUrl": "https://www.youtube.com/embed/dQw4w9WgXcQ",
+       "isPartOf": {"@id": "https://www.example.test/blog/first-post#webpage"}, "name": "First post",
+       "thumbnailUrl": ["https://i.ytimg.com/vi/dQw4w9WgXcQ/hqdefault.jpg"],
+       "uploadDate": "2026-10-01T08:00:00Z", "url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ"},
+      {"@id": "https://www.example.test/#website", "@type": "WebSite", "inLanguage": "en", "name": "Acme Blog",
+       "publisher": {"@id": "https://www.example.test/#organization"}, "url": "https://www.example.test/"},
+      {"@id": "https://www.example.test/#organization", "@type": "Organization", "name": "Acme", "url": "https://www.example.test/"}
+    ]
+  },
+  "locale": "en",
+  "outbound": {"new_tab": true, "nofollow_domains": [], "sponsored_domains": []},
+  "seo": {
+    "canonical": "https://www.example.test/blog/first-post",
+    "description": "About the first post",
+    "og": {"description": "About the first post", "image": "https://www.example.test/media/first.jpg",
+           "locale": "en_US", "locale_alternates": ["pl_PL"], "title": "First post | Acme Blog",
+           "url": "https://www.example.test/blog/first-post"},
+    "robots": "index, follow", "title": "First post | Acme Blog",
+    "twitter": {"card": "summary_large_image", "site": ""}, "verification": [], "x_robots_tag": "index, follow"
+  },
+  "staging": false,
+  "status": 200,
+  "url": "https://www.example.test/blog/first-post"
+}
+```
+
+A page-3 answer in the query form adds `"pagination": {"form": "query", "invalid": false, "page": 3, "param": "page", "segment": ""}`. Its title is `Recipes – page 3 of %pages% | Acme Blog` and its description ends with `Page 3 of %pages%.` A garbage page value answers `not_found` with `"pagination": {..., "invalid": true}`.
+
+## Performance
+
+- **Duration:** about 105 min (11:56Z to 13:41Z)
+- **Tasks:** 4: a tracer, two TDD tasks and the checkpoint, which Jakub answered in parallel.
+- **Commits:** 6 in sm-seo-plugin (main, not pushed). The planning docs are committed in summercms.go.
+
+## Accomplishments
+
+- **classes/schema.** A pure package with:
+  - `Build`: one node builder per type;
+  - `Validate`: Google's required and recommended properties per type, with `rules` false for types Google has no rich-result rules for;
+  - `Normalize`, `DecodeCustom` and `Merge`: the C17 server rules for the structured data value and custom JSON-LD.
+- **Resolve.**
+  - The breadcrumb trail goes through the primary parent: the stored choice, else the first parent, recursively up to 6 levels.
+  - Alternates list each translated locale, include x-default, and come with `html_lang` and the og locales.
+  - Pagination: the page form is parsed and folded into the one-hop decision, with invalid pages, suffixes, a self canonical and paged alternates.
+- **Settings.**
+  - New Publisher, Local business and Pagination tabs and the home crumb field.
+  - The four-place pattern (model, writer, API, form) is applied to every new column, with all C20 refusals.
+  - P8 shows the generated publisher node with its findings.
+- **SEO tab.**
+  - E8 (`seoschema`), E9 (widget `seo_graph`) and Primary category (`seoparent`).
+  - The `primary_parent` and `schema` values are stored in the entry data on every locale row.
+  - Saves answer the `schema.merged` notice.
+  - P1 gains `primary_gone`; P2 gains rows for the schema type and the breadcrumb trail.
+- **MCP.**
+  - `seo_get_graph` (`GET /_seo/api/v1/graph?url=&schema=`).
+  - `seo_set_url_seo` and `apply_batch` accept `primary_parent` and `schema`.
+  - `seo_update_settings` documents every new key.
+  - The parity row `widget_action:seo_graph` maps to `get_graph`.
+
+## Task Commits
+
+sm-seo-plugin (branch main, not pushed):
+
+1. **Task 1 (tracer):** `ea2ce24` feat: JSON-LD graph, breadcrumbs and hreflang in the resolve answer (tracer)
+2. **Task 2:**
+   - `fde5024` feat: publisher, local business and home crumb settings (group A)
+   - `032d3da` feat: pagination forms and suffixes in resolve and site (group B)
+3. **Task 3:**
+   - `17da132` feat: graph validation and custom JSON-LD (groups A and C, plus the Go side of B)
+   - `10ff628` feat: structured data, graph preview and primary category in the SEO tab (group B: elements and dist)
+   - `d38049a` docs: structured data, breadcrumbs, hreflang and pagination in README (group D)
+4. **Task 4:** no commit. The checkpoint answers are recorded at the top of this file.
+
+The tracer gate ran in interactive end-of-phase mode. `TestGraphTracer` was re-run and passed before the expansion tasks started.
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter.
+
+## Deviations from Plan
+
+### Adapted to the actual repositories
+
+**1. [Plan shape] Fake content plugin `acme.magazine` instead of extending the fixture's pages plugin.**
+- **Why:** `addresses_test.go` already registers an `acme.blog` plugin.
+- **What I did:** the tracer and the per-kind tests use an in-memory plugin `acme.magazine` with three types: `acme-story` (article), `acme-section` (collection) and `acme-writer` (profile). It uses every 33-01 fact. fixture_test.go is unchanged.
+
+**2. [Plan shape] Commit groups.**
+- **Validator moved earlier:** validate.go landed in Task 2 group A, because P8 needs the findings.
+- **Groups 3A and 3C are one commit**, together with the Go side of 3B (the SEO tab fields, the action, P1 and P2). The operations parity test binds the new `seo_graph` widget action to its tool, and the Go tests drive the SEO tab.
+- **Group 3B** is the element commit: elements, labels, styles, dist and vitest.
+
+**3. [Plan shape] `home_crumb` shape.**
+- **The conflict:** the plan says "home_crumb per locale". The committed 33-08 layer reads `home_crumb.name` and `.url` (`SeoHtmlSitemapPage.vue`, `types.ts`).
+- **What I did:** the site answer is `{"name": <default locale>, "url": <site>/, "names": {<locale>: <name>}}`. This serves both.
+
+**4. [Rule 3 - Blocking] Repeater rows cannot have a trigger.**
+- **The limit:** cabana refuses `trigger` on `type: repeater`.
+- **Effect:** `local_hours` stays visible when the Local business switch is off. Every other local field hides as planned.
+- **Logged** in deferred-items.md.
+
+**5. [Rule 2 - Correctness] Additions outside the plan's list.**
+- `classes/structured.go`: input composition, graph answers, the E9 action and the merge notices.
+- `classes/owner.go`: `seo_set_url_seo` checks the new keys.
+- `classes/history.go`: data values in history.
+- `classes/sitemap_filter.go`: signature only. The production resolver skips the graph.
+- New copy keys:
+  - `settings.url_invalid` and `settings.email_invalid` (website and email checks, T-33-25);
+  - `api.record_only`;
+  - `schema.field_price`, `schema.field_currency`, `schema.price_invalid` and `schema.currency_invalid`;
+  - `graphFailed` in E9 (the host gives the element no server message).
+- Hreflang of page 2 and later points at the same page of each translation.
+
+**6. [Plan shape] Files not touched.** These files from the plan's list needed no change:
+- `updates/registry.go` (migrations register themselves);
+- `controllers/settings/config_form.yaml`;
+- `extension/_seo_status.htm` and `_seo_effective.htm`, which render the new callout and rows unchanged.
+
+**7. [Plan shape] `field_types.go` (root) has no new lines.** The new types are registered through `classes.FieldTypes`, which the root file returns. The acceptance grep counts 2 lines in `classes/field_types.go`.
+
+**8. [Rule 1 - Bug] The seoparent value round trip.**
+- **Bug:** the admin sends the loaded `{selected, options}` object back when the editor leaves the field untouched.
+- **Fix:** Decode reads `selected` from it.
+
+**9. [Plan shape] E8 default for registry offers.** The element cannot know a registry page's kind, so the default option of a page-kind record reads "Default (WebPage)" even when the server's default is Service (offer and service kinds). The server applies Service correctly.
+
+### TDD note
+
+The plan is `type: execute` with `tdd="true"` tasks. Each group's tests were written alongside its code and run before the commit. The failures fixed before committing were:
+- the local type copy keys;
+- a nil `Settings{}` in TestTemplates;
+- the tab expectations;
+- the site JSON field order;
+- the `<` check.
+
+No separate RED commit was made: the plan needs green tests at every commit, as in 33-04 and 33-05.
+
+### Auth gates
+
+None.
+
+**Total deviations:** 9. Five are plan shape, one is a blocking framework limit, one is a correctness addition, one is a bug and one is a UI default note.
+**Impact on plan:** every must-have truth is met. The only exception is the visual hiding of the opening-hours repeater.
+
+## Issues Encountered
+
+- **Unvalidated per-locale values.** For the translatable settings (`page_segment`, the suffixes, `breadcrumb_home`, `publisher_name`), the admin's other-locale values go through the translation writer without Decode, so only the default locale's value is validated on save. An invalid segment in another locale falls back to the default segment when it is read.
+- **Undo does not restore the new data values.** Undo of an entry history row restores the Phase 32 columns, not `primary_parent` or `schema`. History does record both.
+- **`go test ./... -run X`** prints "no tests to run" for subpackages while the named root tests pass, as in 33-02 to 33-05.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None outside the plan's threat model:
+- **T-33-24** (custom JSON-LD): parse, objects only, 16 KB and depth 8, `<script` refused, re-serialised with `<` escaped. Covered by `TestCustomJSONLD`.
+- **T-33-25** (sameAs and the website): https absolute URLs only, line-numbered refusal. Covered by `TestPublisherSettings`.
+- **T-33-26** (breadcrumbs and alternates): built only from descriptors and settings.
+- **T-33-27** (graph tool): the manage wrapper applies, with 401 and 403 in `TestGraphTool`.
+- **T-33-28** (the parent chain): capped at 6 levels, cycle-safe.
+- **T-33-SC** (installs): no package was installed.
+
+## Verification run
+
+- **sm-seo-plugin, after every commit:**
+  - `go vet ./...` and `go test -short ./...`: green;
+  - Docker `go test ./... -count=1`: green.
+- **Named tests:** all pass.
+  - TestGraphTracer (with TestAlternates and TestBreadcrumbs), TestPublisherSettings, TestPagination (including its TestSiteEndpoint subtest), TestPagedAlternates, TestCustomJSONLD, TestGraphPerKind, TestGraphTool.
+  - TestSiteEndpoint, TestNormalize, TestSEOTab, TestEveryAdminOperationHasTool, TestLangKeysComplete, TestSettingsTypeTabs, TestResolverPrecedence and the Phase 32 and 33-05 suites.
+- **Elements:**
+  - `npm run test`: 87 passed (10 new);
+  - `npm run build`, then `scripts/check-dist.sh`: matches.
+- **From summercms.go:** `bash scripts/check-phase33.sh --plugins --marker`: PASS (vitest 87 and 244; marker clean).
+- **Not run here:**
+  - `--layers`: known broken (deferred-items.md).
+  - `--docker`: it would also run sm-journal-plugin, which 33-09 is editing at the same time. The SEO Docker suite was run directly instead.
+  - `--go` and `--consumers`: no framework or consumer change.
+- **Acceptance greps:**
+  - `func Build(`: 1;
+  - the four resolve json tags: 4;
+  - the settings_write keys: 15;
+  - `%pages%`: 3;
+  - `"pagination"`/`"home_crumb"` in site.go: 2;
+  - `"seoschema"`/`"seoparent"`: 2;
+  - the three element tags in index.ts: 3;
+  - `"get_graph"`: 1;
+  - `Product` in classes/schema: 0.
+
+## User Setup Required
+
+None for this plan. Optional per site:
+- `golem15.seo.search_url` turns on the SearchAction.
+- `golem15.seo.og_locales` overrides the og:locale values.
+- The Publisher tab fills the publisher node; without it, the site name is used.
+
+## Next Phase Readiness
+
+- **33-07, 33-08 and 33-09:** the backend now answers the keys their fixtures expect (see the tracer answer above). Each layer fixture's `home_crumb` should gain `names`, or the layer can keep reading `name`.
+- **33-10 and 33-11:** pin chromedp v0.21.0 and gen2brain/webp v0.6.4, each after its decision note.
+- **33-14:** tag the next sm-seo-plugin minor, which includes 33-05 and this plan.
+
+## Self-Check: PASSED
+
+- FOUND: every file in key-files.created (checked with `[ -f ]`).
+- FOUND commits in sm-seo-plugin: ea2ce24, fde5024, 032d3da, 17da132, 10ff628, d38049a. `git rev-list --count df93c86..HEAD` = 6.
+- No uncommitted changes in sm-seo-plugin.
+
+---
+*Phase: 33-seo-output-audit-and-content*
+*Completed: 2026-11-04*

.planning/phases/33-seo-output-audit-and-content/33-07-SUMMARY.md

@@ -0,0 +1,349 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 07
+subsystem: vue-seo-layer
+tags: [nuxt-layer, nitro-middleware, json-ld, hreflang, lru-cache, root-files, site-cache-purge, labels, css-tokens]
+
+requires:
+  - phase: 32-seo-foundation
+    provides: GET /_seo/api/v1/resolve answer (action, status, location, url, locale, staging, seo), POST /notfound, verification files
+  - phase: 33-01
+    provides: version ruling (phase targets SummerCMS v0.6.1, base v0.6.0)
+provides:
+  - vue-seo-layer runtime on top of v0.1.1 (repository ../vue-seo-layer, branch main, 7 commits, not pushed, not tagged)
+  - Nitro middleware server/middleware/seo.ts (resolveCached, redirect/410/X-Robots-Tag, pagination.invalid 404, event.context.seo)
+  - useCmsSeo (html lang, hreflang, og:locale, one JSON-LD @graph), useSchemaNode, mergeGraph, isPagePath
+  - resolve LRU (seo.resolveCacheTtl, 1000 entries, in-flight de-duplication) and the site answer cache (server/lib/site.ts)
+  - shared POST /api/__site__/cache/purge moved in (library and plugin byte-identical, route also clears the SEO caches) plus a purge hook for the transition
+  - root-file proxies server/middleware/seo-root.ts (robots.txt, sitemap.xml, sitemap-<name>.xml, llms.txt, listed verification and IndexNow key files)
+  - local module lib/seo-module.ts (configKey seo; cms, breadcrumbs, links.newTabHint, rootFiles, resolveFiles)
+  - useSeoLabels / pickLabels / formatSeoLabel (L8 en, pl), seo-tokens.css, seo-base.css
+  - smoke harness (count=, exact header=, noheader=, reqheader=, repeatable options, resolves/apicalls/noreport lines, --no-site), fixture API (site, root files, resolve counts, reload), purge-check.mjs, purge-token-check.mjs
+affects: [33-08, 33-09, 33-12, 33-13, 33-14]
+
+actuals:
+  tokens: 42900
+  tasks: 4
+  commits: 7
+plan_head_before: 7d52c5d2e50fb5870887751adfdcd5e78512a271
+plan_head_after: 6636cde70a6d866e6d7511c24f5d3b70258455f9
+
+tech-stack:
+  added: []
+  patterns:
+    - "Resolve once per request in Nitro middleware, hand the answer to the render through event.context.seoResolved; the route middleware reuses it on the server and resolves only on client navigation"
+    - "New behaviour gated on the backend's v0.2.0 site answer: a backend whose /site answers 404, or one never reached, keeps the v0.1.1 behaviour"
+    - "LRU with generation counter: a clear detaches loads in flight, so nothing fetched before a purge is stored after it"
+    - "Smoke runs per scenario (v0.1.1 suite against --no-site, full, off via both switches, backend down, no token)"
+
+key-files:
+  created:
+    - ../vue-seo-layer/lib/seo-module.ts
+    - ../vue-seo-layer/server/middleware/seo.ts
+    - ../vue-seo-layer/server/middleware/seo-root.ts
+    - ../vue-seo-layer/server/lib/config.ts
+    - ../vue-seo-layer/server/lib/resolve.ts
+    - ../vue-seo-layer/server/lib/lru.ts
+    - ../vue-seo-layer/server/lib/site.ts
+    - ../vue-seo-layer/server/lib/siteCachePurge.ts
+    - ../vue-seo-layer/server/api/__seo__/resolve.get.ts
+    - ../vue-seo-layer/server/api/__site__/cache/purge.post.ts
+    - ../vue-seo-layer/server/plugins/site-cache-purge.ts
+    - ../vue-seo-layer/server/plugins/seo-cache-purge.ts
+    - ../vue-seo-layer/app/composables/useCmsSeo.ts
+    - ../vue-seo-layer/app/composables/useSchemaNode.ts
+    - ../vue-seo-layer/app/composables/useSeoLabels.ts
+    - ../vue-seo-layer/app/utils/graph.ts
+    - ../vue-seo-layer/app/utils/pagePath.ts
+    - ../vue-seo-layer/app/utils/labels.ts
+    - ../vue-seo-layer/app/app.config.ts
+    - ../vue-seo-layer/app/assets/css/seo-tokens.css
+    - ../vue-seo-layer/app/assets/css/seo-base.css
+    - ../vue-seo-layer/testing/nuxt-server.mjs
+    - ../vue-seo-layer/testing/purge-check.mjs
+    - ../vue-seo-layer/testing/purge-token-check.mjs
+    - ../vue-seo-layer/testing/expect-seo.txt
+    - ../vue-seo-layer/testing/expect-seo-off.txt
+    - ../vue-seo-layer/testing/expect-seo-down.txt
+    - ../vue-seo-layer/testing/expect-seo-notoken.txt
+    - ../vue-seo-layer/testing/fixtures/seo/resolve.json
+    - ../vue-seo-layer/testing/fixtures/seo/site.json
+    - ../vue-seo-layer/tests/graph.test.ts
+    - ../vue-seo-layer/tests/pagePath.test.ts
+    - ../vue-seo-layer/tests/lru.test.ts
+    - ../vue-seo-layer/tests/labels.test.ts
+    - ../vue-seo-layer/tests/sitePurge.test.ts
+    - ../vue-seo-layer/tests/rootFiles.test.ts
+  modified:
+    - ../vue-seo-layer/nuxt.config.ts
+    - ../vue-seo-layer/package.json
+    - ../vue-seo-layer/README.md
+    - ../vue-seo-layer/app/plugins/seo-head.ts
+    - ../vue-seo-layer/app/middleware/seo.global.ts
+    - ../vue-seo-layer/app/composables/useSeoResolve.ts
+    - ../vue-seo-layer/app/utils/seo.ts
+    - ../vue-seo-layer/app/utils/types.ts
+    - ../vue-seo-layer/server/middleware/seo-verification.ts
+    - ../vue-seo-layer/server/plugins/seo-notfound.ts
+    - ../vue-seo-layer/testing/smoke-ssr.mjs
+    - ../vue-seo-layer/testing/fixture-api.mjs
+    - ../vue-seo-layer/tests/seo.test.ts
+    - ../vue-seo-layer/.playground/nuxt.config.ts
+
+key-decisions:
+  - "Task 1 (Jakub 2026-11-04): the shared layer's name is vue-seo-layer"
+  - "Option 1 (Jakub 2026-11-04): extend the existing v0.1.1 repository in place (no git init, no re-scaffold, remote origin kept, never pushed or tagged); backward compatibility with v0.1.1 mandatory"
+  - "33-14 does not create the repository with tea; the layer's next tag is v0.2.0"
+  - "Module option seo.cms is an alias of public.seo.enabled (NUXT_PUBLIC_SEO_ENABLED); either one false switches the layer off"
+  - "Redirect Location keeps the v0.1.1 rule: same-site targets become paths, other hosts stay absolute; built from the answer only"
+  - "Client navigation keeps public.seo.apiBase (/_seo/api/v1); GET /api/__seo__/resolve is opt-in by setting it to /api/__seo__"
+  - "Root files and the root_files-only verification rule apply only once the backend gave a v0.2.0 site answer; otherwise v0.1.1 behaviour"
+
+patterns-established:
+  - "Compatibility suite: testing/expect.txt (v0.1.1) runs unchanged against a backend without /site on every smoke run"
+
+requirements-completed: [SC-2, D-97, D-20, D-20a, D-20b, D-20c, D-08, D-05, D-103, D-43, D-55, D-71, D-22, D-25]
+
+coverage:
+  - id: D1
+    description: "A Nuxt page extending the layer renders the CMS title, canonical, hreflang, html lang, og:locale and exactly one JSON-LD script with one @graph (CMS nodes plus layer nodes merged by @id; '<' escaped)"
+    requirement: "D-43"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (testing/expect-seo.txt tracer lines)"
+        status: pass
+      - kind: unit
+        ref: "tests/graph.test.ts, tests/seo.test.ts#seoHeadInput: v0.2.0 keys"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Redirect (301/302, Location from the answer only, crafted Host ignored), 410, X-Robots-Tag and the pagination.invalid 404 enforced in Nitro middleware before the render and the route cache"
+    requirement: "D-20a"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (expect-seo.txt redirect/410/404 lines); testing/purge-check.mjs step 8 (redirect on a route-cached page)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Resolve LRU (TTL, 1000 entries, in-flight de-duplication, purge-safe) and the moved site cache purge route clearing route cache, resolve and site caches"
+    requirement: "D-97"
+    verification:
+      - kind: unit
+        ref: "tests/lru.test.ts, tests/sitePurge.test.ts"
+        status: pass
+      - kind: integration
+        ref: "npm run purge:check (purge-check 18 checks, purge-token-check 53 checks); smoke 'resolves /blog/lwia-grzywa 1'"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Root files from the backend (robots.txt, sitemap.xml, sitemap-<name>.xml, llms.txt, listed verification and IndexNow key files) with status, content type, X-Robots-Tag; 503 Retry-After 60 on backend failure; other paths pass through"
+    requirement: "D-05"
+    verification:
+      - kind: unit
+        ref: "tests/rootFiles.test.ts"
+        status: pass
+      - kind: integration
+        ref: "npm run smoke:ssr (expect-seo.txt root lines, expect-seo-down.txt)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "404 report once with the bearer token; none with the layer off or without a token"
+    requirement: "D-20"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (report/noreport lines in expect-seo.txt, expect-seo-off.txt, expect-seo-notoken.txt)"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "L8 labels (en, pl, app overrides), seo-tokens.css and seo-base.css (only .seo-* classes), no i18n dependency"
+    verification:
+      - kind: unit
+        ref: "tests/labels.test.ts"
+        status: pass
+      - kind: integration
+        ref: "smoke line '<p class=\"seo-visually-hidden\">Ścieżka nawigacji</p>'; plan acceptance greps"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "v0.1.1 behaviour and config keys preserved for consumers"
+    verification:
+      - kind: integration
+        ref: "testing/expect.txt (31 v0.1.1 checks) on every smoke run; expect-seo-off.txt with NUXT_PUBLIC_SEO_ENABLED=false; scratch build of vue-grzybyfunkcjonalne-app against this layer: its smoke 52/52, smoke:ga 2/2, unit 28/28"
+        status: pass
+    human_judgment: false
+
+duration: 25min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 07: vue-seo-layer runtime Summary
+
+**The existing vue-seo-layer v0.1.1 now resolves each page once in Nitro middleware with a purge-safe LRU, enforces redirect, 410 and X-Robots-Tag before the route cache, renders hreflang and one merged JSON-LD @graph, serves the CMS's root files, owns the shared site-cache purge route and ships the L8 labels and tokens. Every v0.1.1 behaviour and config key still works.**
+
+## Task 1 answer and Jakub's ruling (2026-11-04)
+
+- **Task 1 (checkpoint:decision), answered:** the layer's name is **vue-seo-layer**.
+- **The plan was stale.** It assumed `../vue-seo-layer` did not exist. In fact the repository was created and published on 2026-10-31, outside this phase: remote `git@git.golem15.com:golem15/vue-seo-layer.git`, tags v0.1.0 and v0.1.1, branch main with 2 commits (ac59f3c, 7d52c5d). It is consumed by `../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app` pinned at `#v0.1.1`.
+- **Jakub's ruling (option 1): extend the existing layer in place.** So:
+  - no `git init`, no recreate or re-scaffold, no file deleted, work stayed on main;
+  - the acceptance criterion "no remote" is void (origin exists);
+  - nothing was pushed or tagged.
+- **Backward compatibility with v0.1.1 is mandatory.** The plan's new keys were added alongside the existing ones. Where a plan key duplicates an existing one, the existing key keeps working and the new one is an alias: `seo.cms` is an alias of `public.seo.enabled`, and either one false switches the layer off.
+- **Commit subjects.** The plan's subjects were used. No scaffold commit exists, so the tracer subject describes the actual change.
+- **For later plans:**
+  - **33-14** does NOT create the repository with tea.
+  - **The layer's next tag is v0.2.0.** `package.json` still says 0.1.1; bump it when tagging in 33-14. The README already shows the `#v0.2.0` pin and marks new features "v0.2.0".
+- **Framework context (33-01):** the phase targets SummerCMS v0.6.1 on base v0.6.0.
+- **No planned change needed a checkpoint:decision.** Every planned change could be made without changing observable v0.1.1 behaviour. One regression I introduced myself was found by the consumer build and fixed (deviation 6).
+
+### How v0.1.1 compatibility was verified
+
+1. **The v0.1.1 suite is unchanged.** `testing/expect.txt` (31 checks: head priority, empty values keep page tags, staging noindex, redirects, 410, 404 reports, verification files, `404 /robots.txt`, relative canonicals) runs on every `npm run smoke:ssr` against a backend whose `/site` answers 404, as v0.1.1's backend does. It passes on the final commit.
+2. **Both switches tested.** `testing/expect-seo-off.txt` runs once with the new `NUXT_PUBLIC_SEO_CMS=false` and once with the v0.1.1 `NUXT_PUBLIC_SEO_ENABLED=false`. Both give zero API calls, the pages' own head, no redirect, no root files and no report.
+3. **Consumer build.** In a scratchpad copy of `vue-grzybyfunkcjonalne-app`, its node_modules copy of vue-seo-layer was replaced with `git archive HEAD` of this layer. The real repository was not touched. I ran `nuxt build`, then its `smoke:ssr` (52/52), `smoke:ga` (2/2) and `npm test` (28/28). This found deviation 6, which is fixed. The consumer build also runs next to `@nuxtjs/seo`, which shares the `seo` config key, without errors.
+4. **Config keys kept with v0.1.1 semantics:** `seo.apiBase`, `seo.notfoundToken`, `seo.timeoutMs`, `public.seo.apiBase` (still the browser's resolve base) and `public.seo.enabled`. The exported helpers `useSeoAnswer`, `resolveSeo`, `seoHeadInput` and the rest of `app/utils/seo.ts` keep their signatures. The new head keys are only added when the answer carries them, so an old backend gives the same tags.
+
+## Performance
+
+- **Duration:** 25 min
+- **Started:** 2026-11-04T08:07:26Z
+- **Completed:** 2026-11-04T08:32:38Z
+- **Tasks:** 4 (Task 1 answered, Tasks 2 to 4 executed)
+- **Files modified:** 57 in ../vue-seo-layer
+
+## Accomplishments
+
+- **Nitro middleware** resolves each page request once through the LRU, forwarding X-Forwarded-For. It handles redirect, 410, X-Robots-Tag and the pagination.invalid 404 before the render and the route cache. The render reuses the answer, so a page costs one resolve call; the smoke checks this with `resolves PATH 1`.
+- **One head owner** (seo-head plugin → `useCmsSeo`). It sets the v0.1.1 tags plus `<html lang>`, og:locale and og:locale:alternate, hreflang links, and exactly one JSON-LD script with one @graph. The graph merges CMS nodes and `useSchemaNode` nodes by @id, with CMS values winning.
+- **Shared purge route** moved in with the same contract. It also empties the resolve and site caches. A purge hook does the same when the journal, menu or FAQ layer's copy of the route answers instead (Pitfall 6 during the transition to 33-09).
+- **Root-file proxies** with status, content type and X-Robots-Tag passed on, and 503 with Retry-After 60 on backend failure. They are gated on the v0.2.0 site answer.
+- **L8 labels, tokens and base styles**, a README covering everything, and 67 unit tests.
+- **Six smoke runs** (93 checks) plus the purge checks (18 + 53).
+
+## Task Commits
+
+All in /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer (branch main, not pushed):
+
+1. **Task 1: name the layer.** No commit; answered: vue-seo-layer.
+2. **Task 2: tracer.** `160b53b` feat: CMS head and one JSON-LD graph on every server-rendered page (tracer)
+3. **Task 3:**
+   - A `e3baa70` feat: redirect and 410 enforcement, X-Robots-Tag and the resolve cache
+   - B `691fa09` feat: shared site cache purge route clears the SEO caches
+   - C `d162943` feat: root files from the CMS and the 404 report
+4. **Task 4:**
+   - A `aa7480e` feat: SEO labels, tokens and base styles
+   - B `c2357cd` docs: README
+5. **Deviation fix:** `6636cde` fix: root files fall through until the backend has given a site answer
+
+## Decisions Made
+
+See key-decisions in the frontmatter. In short:
+- **seo.cms** is an alias of public.seo.enabled.
+- **Redirect Location** keeps the v0.1.1 same-origin-to-path rule.
+- **The browser** keeps public.seo.apiBase; the new `/api/__seo__/resolve` is opt-in.
+- **Root files** depend on a confirmed v0.2.0 site answer.
+
+## Deviations from Plan
+
+### Ruling-driven (Jakub, option 1)
+
+**1. The repository exists.**
+- **What changed:** no `git init`, no scaffold, remote kept, "no remote" criterion void.
+- **Fixture layout:** the v0.1.1 fixtures (`testing/fixtures/resolve.json`, `verification/`) and `testing/expect.txt` were kept as they are. The new answers live in `testing/fixtures/seo/`, and the fixture API merges both.
+
+### Compatibility-driven (Rule 2, to keep v0.1.1 behaviour)
+
+**2. Redirect Location.**
+- **Plan:** "forward the resolver's absolute location" (`/stary` → `https://example.test/nowy`).
+- **What I did:** kept v0.1.1's `seoRedirectTarget`. A same-site target becomes a path (`/nowy`); another host stays absolute.
+- **Prohibition still holds:** the Location never uses request input. The smoke sends a crafted Host and X-Forwarded-Host, and `server/middleware/seo.ts` has no `getRequestHost` or `x-forwarded-host`.
+
+**3. Client-navigation resolve.**
+- **Plan:** fetch through `/api/__seo__/resolve`.
+- **What I did:** the browser still uses `public.seo.apiBase`, whose v0.1.1 meaning is the same-origin resolve base. The `/api/__seo__/resolve` route exists, goes through the server LRU, has `cache: false` and noindex, and is used when the app sets `public.seo.apiBase` to `/api/__seo__`.
+
+**4. Head application.**
+- **Plan:** `seo-head.ts` takes the answer from `useRequestEvent().context.seo`.
+- **What I did:**
+  - The v0.1.1 global route middleware stays. On the server it reuses `event.context.seoResolved` (no second call). It still resolves paths the Nitro middleware skips (dotted page paths) and client navigations.
+  - The canonical link has no explicit `key`. unhead's own canonical de-duplication then keeps one canonical even when a page sets its own, which v0.1.1's `/about` check relies on.
+
+**5. Verification files.**
+- **Plan:** only names listed in `root_files` are proxied; others pass through.
+- **What I did:** that rule applies when the backend gives a site answer. With a backend whose `/site` answers 404 (v0.1.1 era) or one never reached, `seo-verification.ts` keeps the v0.1.1 name lookup. robots.txt and the sitemaps are not proxied then, matching v0.1.1's `404 /robots.txt`.
+- **Backend base:** `seo.backendBase` defaults to empty, which means `apiBase` without `/_seo/api/v1`. That is effectively `http://127.0.0.1:8096`, and an app that set only `NUXT_SEO_API_BASE` needs nothing new.
+
+**6. [Rule 1 - Bug] Root files answered 503 while the backend was unreachable since start.**
+- **Found during:** the post-plan consumer build. vue-grzybyfunkcjonalne-app's smoke expects `404 /robots.txt` and `404 /sitemap.xml` with the SEO API down.
+- **Fix:** root proxies need a site answer (state ok, or the last one seen while the backend is down), so a cold start with the backend down falls through as in v0.1.1. The plan's 503 still applies once a site answer was seen: `503 /sitemap-fail-1.xml` in expect-seo.txt, and expect-seo-down.txt now expects the v0.1.1 404s.
+- **Files:** server/lib/site.ts, server/middleware/seo-root.ts, tests/rootFiles.test.ts, testing/expect-seo-down.txt, README.md
+- **Commit:** 6636cde
+
+### Other adjustments
+
+**7. Purge route copy and its transition hook.**
+- **Byte-identical:** the purge library and the site-config plugin match the journal, menu and FAQ copies.
+- **Not byte-identical:** the route adds `clearSeoCaches()`; its pinned hash in `tests/sitePurge.test.ts` is updated.
+- **Added `server/plugins/seo-cache-purge.ts`** (an afterResponse hook on a 200 POST to `/api/__site__/cache/purge` or `/api/__journal__/cache/purge`). In an app that also extends journal, menu or FAQ, Nitro may run their copy, which does not clear the SEO caches (Pitfall 6). 33-09 removes those copies; the hook can stay, since clearing twice is harmless.
+
+**8. purge-check.mjs.**
+- **Changed:** it changes the fixture resolve title (as planned). It drops the journal-only checks: browser `max-age=0` comes from vue-journal-layer's journal-revalidate plugin, which was not moved, and `_payload.json` carries no SEO data.
+- **Added:** step 8, where a redirect added for a route-cached page applies at once with `NUXT_SEO_RESOLVE_CACHE_TTL=0`.
+- **Unchanged:** all other checks of both scripts.
+
+**9. Playground route cache.**
+- **Plan:** `'/**': { swr: 300 }`. **Used:** `'/blog/**'`.
+- **Why:** a route-cached render has no Host header, so v0.1.1's `/relative` check (a path canonical made absolute on the request origin) needs uncached pages. Pre-existing behaviour, see Deferred.
+
+**10. Smoke harness grammar.**
+- **header=:** now means "equals", per P33-29. All v0.1.1 lines still pass.
+- **Added:** `noheader=`, `reqheader=`, `noreport`, `resolves PATH N`, `apicalls N` and `--no-site`.
+- **Runs:** `smoke:ssr` runs six scenarios instead of one; `purge:check` script added.
+- **Boot probe:** `testing/nuxt-server.mjs` probes `/_nuxt/` so the boot never resolves a page.
+
+**11. TDD gate.**
+- **Not done:** no separate RED commits.
+- **Why:** the plan requires `npm run test` green at every commit.
+- **What was done:** tests were written and run failing before each implementation (`lru.test.ts`, `labels.test.ts`: ERR_MODULE_NOT_FOUND, plus a deliberate run with `clearSeoCaches()` removed failing three sitePurge tests). Each was then committed with its implementation in the plan's commit groups.
+
+## TDD Gate Compliance
+
+- RED observed locally (not committed) for `tests/lru.test.ts`, `tests/labels.test.ts` and the sitePurge cache-clear tests.
+- GREEN in commits e3baa70, 691fa09 and aa7480e.
+- No refactor commits.
+- A separate `test(...)` commit was not made because the plan requires a green test suite at every commit (deviation 11).
+
+## Known Stubs
+
+Intentional forward options, wired in later plans and not blocking this plan's goal:
+- **`lib/seo-module.ts` `breadcrumbs`** (default true): reaches `runtimeConfig.public.seo.breadcrumbs`; `<SeoBreadcrumbs>` arrives in 33-08.
+- **`lib/seo-module.ts` `links.newTabHint`** (default true): reaches `runtimeConfig.public.seo.links.newTabHint`; the body-link pipeline is 33-09.
+- **`nuxt.config.ts` `seo.routeReportToken`:** read by `seoServerConfig`; the route report is 33-08.
+- **`app/assets/css/seo-base.css`:** only `.seo-visually-hidden` and the focus ring so far. Breadcrumb, pagination and sitemap rules land with their components in 33-08.
+
+## Deferred Issues
+
+- **Pre-existing in v0.1.1, out of scope:** on a route-cached (swr) render the request has no Host, so a canonical, og:url or og:image that the backend answers as a path becomes absolute on `http://localhost`. It does not affect backends with `golem15.seo.site_url` or `app.url` set, which the README already requires. Logged in deferred-items.md.
+
+## Threat Flags
+
+| Flag | File | Description |
+|------|------|-------------|
+| threat_flag: new-endpoint | ../vue-seo-layer/server/api/__seo__/resolve.get.ts | Public GET /api/__seo__/resolve?url= returns the same public resolve answer the backend's /_seo/api/v1/resolve gives. Only path URLs up to 2048 characters; goes through the LRU, never route-cached, noindex, 404 when the layer is off. |
+| threat_flag: proxy | ../vue-seo-layer/server/middleware/seo-root.ts | Root-file proxy (T-33-32): targets are the server-only bases plus an allow-listed name (exact names, `sitemap-[a-z0-9-]+.xml`, names listed in root_files); covered by tests/rootFiles.test.ts including traversal inputs. |
+
+## Self-Check: PASSED
+
+- All key files exist in ../vue-seo-layer (checked after writing).
+- Commits 160b53b, e3baa70, 691fa09, d162943, aa7480e, c2357cd and 6636cde are present on main in ../vue-seo-layer.
+- `npm run test`: 67 pass, 0 fail.
+- `npm run smoke:ssr`: six runs ok (31, 36, 9, 9, 6, 2 checks).
+- `npm run purge:check`: purge-check ok (18), purge-token-check ok (53).
+- Plan acceptance greps:
+  - `sendRedirect` appears once in seo.ts; no `getRequestHost` or `x-forwarded-host`.
+  - expect-seo.txt has more than 5 `header=` or `count=` lines.
+  - `application/ld+json` appears once in useCmsSeo.ts.
+  - package.json has no `"dependencies"` and no i18n.
+  - Both the `--seo-target-size` and `--seo-space-5` tokens are present.
+  - No bare-element rules in seo-base.css.

.planning/phases/33-seo-output-audit-and-content/33-08-SUMMARY.md

@@ -0,0 +1,406 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 08
+subsystem: vue-seo-layer
+tags: [nuxt-layer, build-guard, ssr, noindex, route-report, drift-check, breadcrumbs, pagination, html-sitemap]
+
+requires:
+  - phase: 33-07
+    provides: vue-seo-layer runtime (resolve middleware, useCmsSeo, site answer cache, labels, tokens, smoke harness, fixture API)
+  - phase: 33-03
+    provides: sitemap index /sitemap.xml and per-type files /sitemap-<slug>-<n>.xml through /_sitemap/files/{file} (unchanged here)
+provides:
+  - SSR build guard (lib/guard.ts) with options seo.noindexRoutes and seo.indexable, guard:check over four fixture apps
+  - automatic noindex for declared routes and for pages whose meta sets requiresAuth or seo.robots (app plugin seo-route-robots)
+  - route artefact #seo-routes, the route report (POST /registry/routes) and the startup drift check
+  - GET /api/__seo__/site and useSeoSite()
+  - <SeoBreadcrumbs>, <SeoPagination> + usePagination(), HTML sitemap pages (SeoHtmlSitemapPage, GET /api/__seo__/sitemap) and <SeoSitemapLink>
+  - options seo.routeReport, seo.pagination, seo.htmlSitemap
+affects: [33-09, 33-12, 33-13, 33-14]
+
+actuals:
+  tokens: 42200
+  tasks: 3
+  commits: 7
+plan_head_before: 6636cde70a6d866e6d7511c24f5d3b70258455f9
+plan_head_after: b051bda0809b9a8ca58f2c55c55d12d6477e8127
+
+tech-stack:
+  added: []
+  patterns:
+    - "Build-time checks in the local module: nitro:config (rules merged) runs before pages:resolved, so the guard runs once the pages are resolved; a production build throws, nuxt dev and nuxt prepare warn"
+    - "Build-time route data for runtime plugins through addServerTemplate (#seo-routes), no network call at build time"
+    - "Pagination and breadcrumb links through NuxtLink's custom slot, so the router's aria-current does not mark every page of the same path"
+    - "Helpers in app/utils carry the seo prefix (auto-imported next to the journal layer's paginationWindow)"
+
+key-files:
+  created:
+    - ../vue-seo-layer/lib/guard.ts
+    - ../vue-seo-layer/lib/routes.ts
+    - ../vue-seo-layer/lib/options.ts
+    - ../vue-seo-layer/testing/guard-check.mjs
+    - ../vue-seo-layer/testing/guard/{indexable-ssr-false,noindex-ok,client-page,global-ssr-false}/
+    - ../vue-seo-layer/app/plugins/seo-route-robots.ts
+    - ../vue-seo-layer/server/plugins/seo-route-report.ts
+    - ../vue-seo-layer/server/plugins/seo-drift.ts
+    - ../vue-seo-layer/server/lib/drift.ts
+    - ../vue-seo-layer/server/lib/routeReport.ts
+    - ../vue-seo-layer/server/lib/htmlSitemap.ts
+    - ../vue-seo-layer/server/seo-routes.d.ts
+    - ../vue-seo-layer/server/api/__seo__/site.get.ts
+    - ../vue-seo-layer/server/api/__seo__/sitemap.get.ts
+    - ../vue-seo-layer/app/composables/useSeoSite.ts
+    - ../vue-seo-layer/app/composables/usePagination.ts
+    - ../vue-seo-layer/app/components/Seo/Breadcrumbs.vue
+    - ../vue-seo-layer/app/components/Seo/Pagination.vue
+    - ../vue-seo-layer/app/components/Seo/SitemapLink.vue
+    - ../vue-seo-layer/app/components/Seo/SitemapList.vue
+    - ../vue-seo-layer/app/components/global/SeoHtmlSitemapPage.vue
+    - ../vue-seo-layer/app/seo-pages/SitemapPage.vue
+    - ../vue-seo-layer/app/seo-pages/SitemapGroupPage.vue
+    - ../vue-seo-layer/app/utils/paginationWindow.ts
+    - ../vue-seo-layer/app/utils/pageHref.ts
+    - ../vue-seo-layer/app/utils/breadcrumbClaim.ts
+    - ../vue-seo-layer/app/utils/sitePath.ts
+    - ../vue-seo-layer/testing/expect-seo-drift.txt
+    - ../vue-seo-layer/testing/fixtures/seo/site-drift.json
+    - ../vue-seo-layer/testing/fixtures/seo/html.json
+    - ../vue-seo-layer/.playground/app/pages/{konto,szkic}.vue, prywatne/index.vue, blog/index.vue
+    - ../vue-seo-layer/tests/{guard,routes,paginationWindow,pageHref,breadcrumbClaim,htmlSitemap}.test.ts
+  modified:
+    - ../vue-seo-layer/lib/seo-module.ts
+    - ../vue-seo-layer/server/lib/config.ts
+    - ../vue-seo-layer/app/composables/useCmsSeo.ts
+    - ../vue-seo-layer/app/composables/useSeoLabels.ts
+    - ../vue-seo-layer/app/utils/seo.ts
+    - ../vue-seo-layer/app/utils/types.ts
+    - ../vue-seo-layer/app/assets/css/seo-base.css
+    - ../vue-seo-layer/package.json
+    - ../vue-seo-layer/README.md
+    - ../vue-seo-layer/testing/smoke-ssr.mjs
+    - ../vue-seo-layer/testing/fixture-api.mjs
+    - ../vue-seo-layer/testing/expect-seo.txt, expect-seo-off.txt, expect-seo-down.txt, expect-seo-notoken.txt
+    - ../vue-seo-layer/testing/fixtures/seo/site.json, resolve.json
+    - ../vue-seo-layer/.playground/nuxt.config.ts, app/app.vue, app/pages/[...slug].vue
+
+key-decisions:
+  - "The build guard runs when the pages are resolved (pages:resolved), not inside nitro:config: Nuxt fires nitro:config first; the rules are read from the final Nitro config (nitro:init), and nitro:build:before is the fallback for an app without pages"
+  - "The guard throws only in a production build or generate; nuxt dev and nuxt prepare (run on install) warn, so an install never fails"
+  - "Declared noindex and page-meta robots win over the CMS robots (tagPriority -10 against the head entry's critical -8), except on staging"
+  - "The route report retries once after 60 s only on no answer or a non-404/401/403 status; a 404 (no page registry) and a refused token are logged, not retried"
+  - "A root catch-all page does not count as serving a CMS content-type pattern in the drift check; a prefixed catch-all does"
+  - "app/utils helpers are seo-prefixed (seoPaginationWindow, seoPageHref, seoClaimBreadcrumbs, seoSitePath): the journal layer auto-imports its own paginationWindow with another return shape"
+  - "HTML sitemap pages answer 404 unless the CMS's site answer has the HTML sitemap on with a path for the locale, 503 when the backend has not answered; an app page at the same path keeps it"
+
+patterns-established:
+  - "Smoke grammar: routereport N [has=PATH] [lacks=PATH], log TEXT:N, --site-file NAME"
+  - "Split commits verified on the staged tree: git checkout-index into a scratch dir, then test, build and smoke there"
+
+requirements-completed: [SC-2, D-70, D-23, D-21, D-33, D-20c, D-86, D-40, D-41, D-42, D-71, D-34, D-97]
+
+coverage:
+  - id: D1
+    description: "nuxt build fails with the D-70 message for a Nuxt route rule, a Nitro route rule, a .client.vue page and a global ssr: false, and passes when the route is declared in seo.noindexRoutes; the declared route is served with X-Robots-Tag: noindex, nofollow and / without it; inline route rules are refused; seo.indexable false checks nothing"
+    requirement: "D-70"
+    verification:
+      - kind: integration
+        ref: "npm run guard:check (testing/guard-check.mjs, 16 checks)"
+        status: pass
+      - kind: unit
+        ref: "tests/guard.test.ts"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "A page with requiresAuth meta, a page with seo.robots and a path under noindexRoutes get the robots meta tag and X-Robots-Tag without page code; an ordinary page keeps the CMS robots"
+    requirement: "D-23"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (expect-seo.txt /konto, /szkic, /prywatne, /plain lines)"
+        status: pass
+      - kind: unit
+        ref: "tests/routes.test.ts#pageMetaRobots"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "One route report at server start with the token and the static paths (not /konto, /szkic, /prywatne, the sitemap pages); none without a token or with routeReport false"
+    requirement: "D-33"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (routereport lines in expect-seo.txt, expect-seo-notoken.txt, expect-seo-drift.txt)"
+        status: pass
+      - kind: unit
+        ref: "tests/routes.test.ts#staticRoutes, routeReportBody, routeReportOutcome"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Startup drift check: no warning when CMS and build agree, three warnings (URL pattern, pagination form, pl HTML sitemap path) against site-drift.json, and the server still serves pages"
+    requirement: "D-20c"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (log lines in expect-seo.txt and expect-seo-drift.txt)"
+        status: pass
+      - kind: unit
+        ref: "tests/routes.test.ts#driftWarnings"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "<SeoBreadcrumbs>: one nav per page with a layout and a page instance, server-rendered links, last item aria-current text; none on the home page or a page without a trail"
+    requirement: "D-86"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (expect-seo.txt L1 lines, count=<nav class=\"seo-breadcrumbs\":1)"
+        status: pass
+      - kind: unit
+        ref: "tests/breadcrumbClaim.test.ts"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "<SeoPagination> + usePagination(): window 1 … 3–7 … 14, page 1 unnumbered, other query parameters kept, rel prev/next anchors and head links, %pages% filled in the CMS title and description, nothing with one page"
+    requirement: "D-42"
+    verification:
+      - kind: unit
+        ref: "tests/paginationWindow.test.ts, tests/pageHref.test.ts"
+        status: pass
+      - kind: integration
+        ref: "npm run smoke:ssr (expect-seo.txt L2 lines)"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "HTML sitemap: overview with H1 and an H2 per non-empty group, nested categories, sitemap.all link, sitemap.empty; group pages with built trail, page suffix and pagination; 404 unknown group / past the last / malformed page, 301 ?page=1, 503 on API failure and with the backend down, 404 with the layer off; non-http URLs never rendered as links"
+    requirement: "D-34"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (expect-seo.txt L3 lines, expect-seo-off.txt, expect-seo-down.txt)"
+        status: pass
+      - kind: unit
+        ref: "tests/htmlSitemap.test.ts"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "<SeoSitemapLink> renders the locale's sitemap link only while the CMS has the HTML sitemap on and the layer serves it"
+    requirement: "D-34"
+    verification:
+      - kind: integration
+        ref: "npm run smoke:ssr (L4 line in expect-seo.txt and expect-seo-drift.txt; none in expect-seo-off.txt and the --no-site v0.1.1 run)"
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "Default styles of L1–L3 (only .seo-* selectors, tokens only, long text wraps)"
+    verification:
+      - kind: other
+        ref: "app/assets/css/seo-base.css review; no bare-element selector"
+        status: pass
+    human_judgment: true
+  - id: D10
+    description: "v0.1.1 compatibility: the v0.1.1 smoke suite unchanged; the scratch build of the existing consumer against this layer passes its own checks"
+    verification:
+      - kind: integration
+        ref: "testing/expect.txt (31 checks, --no-site) on every smoke run; scratch copy of the consumer app with node_modules/vue-seo-layer = git archive aee6957: nuxt build, smoke:ssr 52/52, smoke:ga 2/2, npm test 28/28"
+        status: pass
+    human_judgment: false
+
+duration: 27min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 08: vue-seo-layer build guard, noindex routes, route report and public components Summary
+
+**vue-seo-layer now fails a production build whose indexable routes would render only in the browser, marks declared and signed-in routes noindex without page code, reports its static routes to the CMS page registry and logs CMS/build drift at start. It also ships server-rendered breadcrumbs, pagination in the CMS URL form and an HTML sitemap with its footer link. All of it is additive to v0.1.1.**
+
+## Context rulings applied
+
+- **Framework version:** the framework is at v0.6.0 and this phase delivers v0.6.1. This plan changes no framework code, so D-90 holds.
+- **The layer:** vue-seo-layer was extended in place on main after 33-07 (6636cde).
+  - Nothing was pushed or tagged.
+  - `package.json` stays at 0.1.1; the next tag is v0.2.0, in 33-14.
+- **Sitemap paths (33-03):** the plan's layer code proxies no XML sitemap path, so no alignment was needed.
+  - The HTML sitemap pages call the sitemap plugin's HTML API at `/_sitemap/api/v1/html` and `/_sitemap/api/v1/html/{group}`, the contract planned in 33-04.
+  - 33-04 is not built yet, so these calls run against fixtures. The same is true of the SEO plugin's `POST /registry/routes` (33-05): 33-03 and 33-05 code had not landed in the plugins when this plan ran.
+
+## Performance
+
+- **Duration:** about 27 min (2026-11-04T10:37:49Z to 11:04:32Z)
+- **Tasks:** 3 (tracer, then 2 TDD tasks)
+- **Commits:** 7 in ../vue-seo-layer
+- **Files:** 68 changed in ../vue-seo-layer
+
+## Task Commits
+
+All in /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer (branch main, not pushed):
+
+1. **Task 1 (tracer):** `b4680af` feat: the build fails when an indexable route renders only in the browser (tracer)
+2. **Task 2:**
+   - A `9cc2cda` feat: noindex for declared and signed-in routes
+   - B `3abc986` feat: route report and drift check at server start
+3. **Task 3:**
+   - A `ebb0c80` feat: breadcrumbs component
+   - B `f2d13d6` feat: pagination component and composable
+   - C `aee6957` feat: HTML sitemap pages and footer link
+   - D `b051bda` docs: build guard, noindex routes and components
+
+The tracer gate ran in interactive end-of-phase mode with automated checks only. Its `<verify>` was re-run (tests plus `guard:check`) and passed before expansion.
+
+## Accomplishments
+
+### Build guard (D-70)
+- `lib/guard.ts` holds the pure checks: `isNoindex` and `patternCovers` (Nitro route-rule semantics), `pagePattern`, `flattenPages`, `findOffenders` and `guardMessage`.
+- The module collects every merged route rule from the final Nitro config, plus the `.client.vue` pages. It refuses `experimental.inlineRouteRules`.
+- A production build throws `[vue-seo-layer] indexable routes must render on the server (D-70): …`.
+- Each declared noindex pattern gets an X-Robots-Tag route rule.
+- `testing/guard-check.mjs` builds four fixtures (about 14 s in total) and checks the header on the noindex fixture.
+
+### Noindex routes (D-23, D-21)
+- The module adds `requiresAuth` and `seo` to Nuxt's page-meta extraction keys.
+- The app plugin `seo-route-robots` applies the robots meta tag (priority above the CMS head entry) and, during SSR, the header once navigation is done.
+- Staging keeps the CMS's noindex.
+
+### Route report and drift check (D-33, D-20c)
+- `#seo-routes` is written from the resolved pages at bundle time.
+- `seo-route-report` posts the static paths once per process.
+- `seo-drift` compares URL patterns, pagination and HTML-sitemap paths with the site answer and logs one warning per mismatch.
+- `GET /api/__seo__/site` and `useSeoSite()` share the cached site answer.
+
+### Components (D-86, D-40 to D-42, D-34, D-71)
+- `<SeoBreadcrumbs>`: one trail per page, claimed by the first instance per path.
+- `<SeoPagination>` with `usePagination()`: hrefs in the CMS form, head prev/next links, and `%pages%` filled in the CMS title and description (`useCmsSeo` with `seoFillPages`).
+- HTML sitemap pages, registered per locale through `extendPages` and rendering the overridable global `SeoHtmlSitemapPage`. They load data from `GET /api/__seo__/sitemap`.
+- `<SeoSitemapLink>`.
+- Default styles for L1 to L3.
+
+### README
+The README documents everything above.
+
+## Compatibility notes for v0.1.1 consumers
+
+All new behaviour is additive or tied to a declaration or a v0.2.0 backend answer:
+
+- **v0.1.1 options:** every v0.1.1 option, runtime key and exported helper keeps its meaning. The v0.1.1 smoke suite (`testing/expect.txt`, 31 checks against a backend without `/site`) passes unchanged on every run.
+- **Build guard:** it only fails an app with an indexable `ssr: false` route, a `.client.vue` page or a global `ssr: false`.
+  - The existing consumer has none of these and builds.
+  - The demo app's `/p/**` and `/presentations/**` must be declared in `seo.noindexRoutes` when it moves to v0.2.0, as 33-12 plans. Otherwise its build fails by design.
+  - `nuxt prepare` and `nuxt dev` only warn, so an install never fails.
+- **Noindex:** applied only to routes the app declares, and to pages whose meta sets `requiresAuth: true` or `seo.robots`. An app that already uses `requiresAuth` for its own guard gets `noindex, nofollow` on those pages, which is the intended D-23 behaviour.
+- **Route report:**
+  - It needs a token. It falls back to `NUXT_SEO_NOTFOUND_TOKEN`, so an app that set that token will start posting the report.
+  - A v0.1.1-era backend answers 404, which is logged once and not retried.
+  - `seo.routeReport: false` switches it off.
+- **HTML sitemap pages:** registered by default at `/mapa-strony` and `/sitemap`.
+  - **If the app already has a page at one of these paths:** the app's page is kept.
+  - **CMS has no HTML sitemap** (no site answer, or the sitemap off or without a path for the locale): the pages answer 404. In the existing consumer these paths answered 404 before as well, through the journal's `/:category` route.
+  - **Backend unreachable since start:** they answer 503 instead of 404.
+  - The layer also statically claims these two paths ahead of a dynamic route such as `/:category`.
+  - `seo.htmlSitemap: false` registers none.
+- **New global names:** components `SeoBreadcrumbs`, `SeoPagination`, `SeoSitemapLink`, `SeoSitemapList` and `SeoHtmlSitemapPage`; composables `usePagination`, `useSeoPages` and `useSeoSite`; utils prefixed `seo*`. None of them collides with the journal, menu or FAQ layers.
+- **Consumer check:** the existing consumer app was copied to a scratch directory with `node_modules/vue-seo-layer` replaced by `git archive` of aee6957. The real repository was not touched. Results:
+  - `nuxt build` passed, guard included.
+  - `smoke:ssr` 52/52, `smoke:ga` 2/2, `npm test` 28/28.
+
+## Decisions Made
+
+See key-decisions in the frontmatter.
+
+## Deviations from Plan
+
+### Adapted to the actual repository and Nuxt
+
+**1. Guard timing.**
+- **Plan:** throw in `nitro:config`.
+- **What happens in Nuxt 4.4.8:** `nitro:config` fires before `pages:resolved`, so the pages are not known there.
+- **What I did:**
+  - `nitro:config` only adds the noindex header rules.
+  - The rules are read from the final Nitro config (`nitro:init`).
+  - The check runs in `pages:resolved`, with `nitro:build:before` as the fallback.
+  - The acceptance grep still prints the two hook lines.
+
+**2. Dev and prepare only warn.** Throwing in `nuxt prepare`, which pnpm runs on install, would break installs. Production `build` and `generate` fail as planned.
+
+**3. Helper names are prefixed.**
+- **Plan names:** `paginationWindow`, `pageHref`, `breadcrumbClaim`.
+- **Why changed:** vue-journal-layer already auto-imports a `paginationWindow` with another return shape. A second auto-import of that name in the same app would shadow it.
+- **What I did:** the files keep the plan's names, and the exports are `seoPaginationWindow`, `seoPageHref` / `seoPageNumber` and `seoClaimBreadcrumbs` / `seoReleaseBreadcrumbs`.
+
+**4. Extra files.** Each was split out of a planned file or task:
+- `lib/options.ts` and `server/lib/{drift,routeReport,htmlSitemap}.ts`: pure parts, so they can be unit-tested.
+- `app/utils/sitePath.ts`: same-origin URLs become paths; anything that is not http(s) is never a link.
+- `app/components/Seo/SitemapList.vue`: the recursive category tree.
+- `server/seo-routes.d.ts`: types for `#seo-routes`.
+- `tests/routes.test.ts` and `tests/htmlSitemap.test.ts`.
+
+**5. Fixture site answer.** `testing/fixtures/seo/site.json` changed its post pattern from `/blog/:slug` to `/posts/:slug`. The playground serves posts at `posts/[slug].vue`, while `/blog/<slug>` is rendered by the root catch-all, which by design does not count for the drift check. Only the drift check reads `routes`.
+
+**6. Playground HTML sitemap paths.** The playground sets `htmlSitemap.paths` to `{pl: '/mapa-strony', en: '/en/sitemap'}`, matching the 33-07 fixture site answer. The layer default stays pl `/mapa-strony`, en `/sitemap`.
+
+**7. Fixture for the "/blog with one page" case.** The blog listing takes `?pages=N`. "One page" is `/blog?pages=1`, because the fixture's `/blog` has 14 pages.
+
+**8. HTML sitemap behaviour beyond the plan:**
+- **Breadcrumbs:** the overview's trail comes from the resolver, as on any page.
+- **`?page=1`:** the 301 is enforced in the layer page, since the resolver does not know these pages.
+- **Path pagination form:** an extra route `<path>/:group/<segment>/:page` is registered.
+- **Gating:** the pages answer only while the site answer has the HTML sitemap on with a path for the locale.
+
+**9. [Rule 1 - Bug] `setResponseHeader` is not auto-imported in app code.**
+- **Found during:** the Task 2 smoke (`/konto` answered 500).
+- **Fix:** the header is set with `useResponseHeader` inside `nuxtApp.runWithContext`.
+- **Files:** app/plugins/seo-route-robots.ts. Fixed before commit 9cc2cda.
+
+**10. [Rule 1 - Bug] The router marked every query variant as the active page.**
+- **Found during:** a Task 3 probe. NuxtLink's active match ignores the query, so every `/blog?page=N` link carried `aria-current="page"`.
+- **Fix:** pagination and breadcrumb links render through NuxtLink's `custom` slot. They still navigate on the client, and only the current item carries `aria-current`. Fixed before commit f2d13d6.
+
+**11. [Rule 2 - Security] Non-http(s) sitemap URLs.** A `javascript:` URL from the sitemap API renders as text, never as a link. The smoke covers it with a fixture entry.
+
+**12. Smoke expectations adjusted to real markup:**
+- **aria-current count:** `aria-current="page"` appears twice on `/blog?page=5` (the current page and the breadcrumbs' last item).
+- **Payload:** the raw `%pages%` stays in the payload, so the check targets the title and description tags.
+
+**13. Commit splits:**
+- Task 2 A/B and Task 3 A/B/C share files.
+- Intermediate versions of those files were staged with `git update-index`.
+- Each staged tree was checked out into a scratch directory and passed `npm run test`, `build:playground` and `smoke:ssr` there before its commit.
+
+### TDD gate
+
+- Tests were written alongside each unit before running (guard, routes/drift/report, window/href/claim, htmlSitemap).
+- **RED observed:**
+  - `pagePatterns` (a `?` stripped as a query, fixed in lib/guard.ts before the Task 1 commit).
+  - The smoke's `/konto` 500 (deviation 9).
+- No separate RED commits, because the plan requires `npm run test` green at every commit (same as 33-07).
+
+## Deferred Issues
+
+- **The `scripts/check-phase33.sh --layers` stage cannot pass.**
+  - **Cause:** its `npm_vitest` step demands a vitest summary, while all four layers run `node --test` TAP ("refuse: no all-passing vitest summary", `test=0 detect=3`).
+  - **What I ran instead:** every step of the stage by hand: unit tests, playground builds and smokes for all four layers, and `guard-check.mjs`. All passed.
+  - **Logged in:** deferred-items.md, for a gate fix outside this plan.
+- **No typecheck script.** The layer has no typecheck script, and its devDependencies lack `vue-tsc`. Types were not machine-checked, as in 33-07. The build (vite + oxc) compiled every file.
+
+## Known Stubs
+
+None. The sitemap HTML API (33-04) and the page registry (33-05) are not built yet. The layer code follows their planned contracts and is covered by fixtures, so it does not depend on stubs.
+
+## Threat Flags
+
+| Flag | File | Description |
+|------|------|-------------|
+| threat_flag: new-endpoint | ../vue-seo-layer/server/api/__seo__/site.get.ts | Public GET /api/__seo__/site returns the backend's public site answer (cached); no-store, noindex, never route-cached |
+| threat_flag: proxy | ../vue-seo-layer/server/api/__seo__/sitemap.get.ts | Public GET /api/__seo__/sitemap proxies the sitemap HTML API on the server-only backendBase; locale, group slug and page are checked by regex before use, only these reach the backend, the answer is reduced to known fields (T-33-38) |
+| threat_flag: outbound-token | ../vue-seo-layer/server/plugins/seo-route-report.ts | The route-report token (server-only runtime config) is sent only to the configured apiBase (T-33-36) |
+
+## Self-Check: PASSED
+
+- **Files:** all key files listed above exist in ../vue-seo-layer.
+- **Commits:** b4680af, 9cc2cda, 3abc986, ebb0c80, f2d13d6, aee6957 and b051bda are on main in ../vue-seo-layer (7 since 6636cde).
+- **Unit tests:** `npm run test` 106 pass, 0 fail.
+- **Smoke:** `npm run smoke:ssr` passed all seven runs (31, 64, 11, 11, 7, 3 and 7 checks).
+- **Purge:** `npm run purge:check` 18 + 53 checks.
+- **Guard:** `npm run guard:check` 16 checks.
+- **Other layers:** the remaining steps of the gate's layers stage passed: journal, menu and FAQ unit tests, playground builds and smokes.
+- **Acceptance greps:**
+  - The D-70 message is in lib/guard.ts.
+  - `nitro:config` and `pages:resolved` appear once each in seo-module.ts.
+  - `requiresAuth` is in seo-route-robots.ts and `drift:` in seo-drift.ts (the message prefix itself lives in server/lib/drift.ts).
+  - `registry/routes` in seo-route-report.ts prints two lines, not the planned one: the header comment and the call.
+  - `aria-current` is in Breadcrumbs.vue and Pagination.vue.
+  - No `ClientOnly` or `onMounted` in the components and pages.
+  - expect-seo.txt has `count=<nav class="seo-breadcrumbs":1`.

.planning/phases/33-seo-output-audit-and-content/33-09-SUMMARY.md

@@ -0,0 +1,502 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 09
+subsystem: vue-journal-layer, vue-menu-layer, vue-faq-layer, vue-seo-layer, sm-journal-plugin
+tags: [nuxt-layer, seo-layer, headings, h1, post-card, body-links, autolink, outbound, breadcrumbs, pagination, itemlist, faqpage, purge, related-posts]
+
+requires:
+  - phase: 33-08
+    provides: vue-seo-layer components (SeoBreadcrumbs, SeoPagination, usePagination), useSchemaNode, labels, seo.links.newTabHint, seo.pagination, the shared purge route
+  - phase: 33-07
+    provides: vue-seo-layer runtime (resolve middleware, useSeoAnswer, useCmsSeo, one JSON-LD graph, smoke grammar)
+  - phase: 33-02
+    provides: content_h1_to_h2 on GET /posts/{slug} and every GET /categories row; the Journal policy keeps rel nofollow/sponsored/ugc and alt=""
+provides:
+  - vue-seo-layer app/utils/bodyLinks.ts (autolink, applyOutbound, imageAttrs)
+  - vue-journal-layer on vue-seo-layer without @nuxtjs/seo; one H1 in both Journal H1 modes; journal.postTitleTag and journal.breadcrumbs
+  - renderJournalBody (L7 order), gateJournalHtml/sanitizeJournalHtml demoteH1, rel token policy
+  - one link per post card (headingLevel 2 | 3), SeoBreadcrumbs on journal pages, JournalPagination as SeoPagination, path-form listing routes, pillar text on page 1, ItemList nodes
+  - vue-menu-layer and vue-faq-layer on vue-seo-layer without purge copies; FaqBlock headingLevel 0 and schema (FAQPage node)
+  - sm-journal-plugin golem15.journal.related_mode / related_count (opt-in scored related posts, previous_in_category / next_in_category)
+affects: [33-10, 33-11, 33-12, 33-13, 33-14]
+
+actuals:
+  tokens: 40100
+  tasks: 4
+  commits: 13
+plan_head_before:
+  vue-seo-layer: b051bda0809b9a8ca58f2c55c55d12d6477e8127
+  vue-journal-layer: 1dd31760601e4bbbe93033b5aba6c5edb2c1bef3
+  vue-menu-layer: ef3a090647ac994fa920baa48464edcd8338a77f
+  vue-faq-layer: 1f23340a2f8bc14ac3bcd8819485dc13eca1fda3
+  sm-journal-plugin: 0edf6e1b67d4f7d8f62980e30d52292cce94faf3
+plan_head_after:
+  vue-seo-layer: 7af91fc
+  vue-journal-layer: adcea4d
+  vue-menu-layer: 8b5da67
+  vue-faq-layer: f7ec4fe
+  sm-journal-plugin: ee3cb26
+
+tech-stack:
+  added: []
+  patterns:
+    - "A content layer extends vue-seo-layer through a link dependency during development (P33-33); 33-14 swaps it for the git tag pin"
+    - "Body link steps live in vue-seo-layer (pure, auto-imported); the journal gate takes them as injected functions, so its node tests never import across packages"
+    - "Smoke checks of page structure: headings=strict (one h1, no skipped level) and cardlinks=N, outside <script> elements"
+
+key-files:
+  created:
+    - ../vue-seo-layer/app/utils/bodyLinks.ts
+    - ../vue-seo-layer/tests/bodyLinks.test.ts
+    - ../vue-journal-layer/app/composables/useJournalItemList.ts
+    - ../vue-journal-layer/testing/fixtures/acme/seo/resolve.json
+    - ../vue-journal-layer/testing/fixtures/acme/seo/site.json
+    - ../vue-journal-layer/testing/expect-acme-title-h1.txt
+    - ../vue-journal-layer/testing/expect-acme-title-p.txt
+    - ../vue-journal-layer/testing/expect-acme-hint-off.txt
+    - ../vue-journal-layer/testing/expect-acme-breadcrumbs-off.txt
+    - ../vue-faq-layer/app/utils/faqSchema.ts
+    - ../vue-faq-layer/tests/faqSchema.test.ts
+    - ../sm-journal-plugin/classes/related.go
+    - ../sm-journal-plugin/related_media_test.go
+  modified:
+    - ../vue-journal-layer/package.json, pnpm-lock.yaml, nuxt.config.ts, lib/journal-module.ts
+    - ../vue-journal-layer/app/utils/{htmlGate,seo,postView,types,routes,pagination,view}.ts
+    - ../vue-journal-layer/app/components/Journal/{PostBody,PostCard,PostList,RelatedPosts,Pagination,CategoryHeader}.vue
+    - ../vue-journal-layer/app/journal-pages/{PostPage,PostIndexPage,CategoryPage,TagPage,AuthorPage,SearchPage}.vue
+    - ../vue-journal-layer/app/assets/css/{journal-tokens,journal-base}.css
+    - ../vue-journal-layer/testing/{smoke-ssr,fixture-api,nuxt-server}.mjs, expect-acme.txt, fixtures/acme/{posts,categories}.json
+    - ../vue-journal-layer/tests/{htmlGate,seo,routes,pagination,postView,embeds}.test.ts, tests/fixtures/editor-corpus.json
+    - ../vue-journal-layer/.playground/nuxt.config.ts, .playground/app/app.vue, README.md
+    - ../vue-menu-layer/package.json, pnpm-lock.yaml, nuxt.config.ts, .playground/nuxt.config.ts, testing/smoke-ssr.mjs, README.md
+    - ../vue-faq-layer/package.json, pnpm-lock.yaml, nuxt.config.ts, app/components/Faq/Block.vue, .playground/nuxt.config.ts, .playground/app/app.vue, testing/smoke-ssr.mjs, testing/expect.txt, README.md
+    - ../vue-seo-layer/README.md
+    - ../sm-journal-plugin/controllers/api/posts.go, config/config.yaml, README.md
+  deleted:
+    - ../vue-journal-layer/server/api/__sitemap__/journal.ts, app/utils/sitemap.ts, tests/sitemap.test.ts
+    - ../vue-journal-layer/server/api/__site__/cache/purge.post.ts, server/lib/siteCachePurge.ts, server/plugins/site-cache-purge.ts, tests/sitePurge.test.ts
+    - the same four purge files in ../vue-menu-layer and ../vue-faq-layer
+
+key-decisions:
+  - "Layer breaking changes approved, option A (Jakub, 2026-11-04): journal drops @nuxtjs/seo and its sitemap source; the three layers extend vue-seo-layer; one link per card, breadcrumbs on by default, related titles h3"
+  - "P33-33 as planned: \"vue-seo-layer\": \"link:../vue-seo-layer\" in each layer's dependencies, lockfiles updated by pnpm install; 33-14 swaps it for the git tag pin"
+  - "The deprecated POST /api/__journal__/cache/purge keeps its own helpers (app/utils/siteCache.ts): a bare import of vue-seo-layer's .ts library from a server route would be externalized by Nitro in a git-installed app (Node does not strip types under node_modules)"
+  - "The body link steps are injected into the journal's renderJournalBody by PostBody (auto-imported from vue-seo-layer), so htmlGate stays pure and its node tests import nothing from another package"
+  - "Auto-links within one text are taken in document order (longer phrase first at the same place) up to autolink_max; each phrase and each URL once"
+  - "Post page neighbours: the in-category pair when the Journal answers at least one, else the site-wide pair"
+  - "Scored related posts: posts sharing nothing are never related; in-category neighbours keep previous_post/next_post's direction (previous = nearest newer)"
+  - "Page-less apps that extend vue-seo-layer set seo.htmlSitemap false (the menu and FAQ playgrounds do)"
+
+patterns-established:
+  - "Journal smoke grammar: count=, header=, noheader=, headings=strict, cardlinks=N, resolves PATH N; the fixture API also answers the SEO resolve and site endpoints"
+  - "Cross-layer check: scratch app outside the repositories with link dependencies, fixture APIs of all three layers, the journal smoke harness"
+
+requirements-completed: [SC-2, D-97, D-50, D-52, D-80, D-81, D-82, D-83, D-71, D-86, D-40, D-41, D-43]
+
+coverage:
+  - id: D1
+    description: "The journal layer extends vue-seo-layer without @nuxtjs/seo: one canonical and one JSON-LD script per page, the CMS title wins, the post's own title and description only without a CMS answer"
+    requirement: "D-97"
+    verification:
+      - kind: integration
+        ref: "vue-journal-layer pnpm smoke:ssr (expect-acme.txt tracer lines: count=rel=\"canonical\":1, count=application/ld+json:1, count=<title>:1, /blog/uncategorised-note fallback)"
+        status: pass
+      - kind: unit
+        ref: "tests/seo.test.ts (cmsHeadPresent, journalSiteOrigin)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "Exactly one H1 in both Journal H1 modes: title h1 and body h1 demoted while content_h1_to_h2 is on; title p.journal-post__title and body h1 kept while off; postTitleTag h1/p give the documented two and zero H1"
+    requirement: "D-50"
+    verification:
+      - kind: integration
+        ref: "expect-acme.txt (/blog/heading-on, /blog/heading-off), expect-acme-title-h1.txt, expect-acme-title-p.txt"
+        status: pass
+      - kind: unit
+        ref: "tests/htmlGate.test.ts (demoteH1), tests/seo.test.ts (journalPostTitleTag)"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Heading convention on every fixture page (one h1, no skipped level), cards h2 / h3 under related, category pillar text follows the category row's setting, page >= 2 suffix"
+    requirement: "D-52"
+    verification:
+      - kind: integration
+        ref: "expect-acme.txt headings=strict lines (16 count=<h1:1 lines), /blog/category/news and /blog/category/plain"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "One link per post card (title only, no read-more, image not a link), stretched-link CSS with the focus ring on the card"
+    requirement: "D-80"
+    verification:
+      - kind: integration
+        ref: "expect-acme.txt cardlinks=1 on every listing and post page, notcontains=journal-post-card__more"
+        status: pass
+      - kind: other
+        ref: "journal-base.css review (stretched link, :has focus ring)"
+        status: pass
+    human_judgment: true
+  - id: D5
+    description: "Body links: auto-links in document order up to autolink_max, never in headings or to the page itself; outbound rel kept plus nofollow/sponsored; target, noopener and hint only while new_tab is on, no hint with newTabHint false; images lazy/async with alt=\"\" kept"
+    requirement: "D-82, D-83, D-71"
+    verification:
+      - kind: unit
+        ref: "vue-seo-layer tests/bodyLinks.test.ts (21 tests, including quotes, entities, javascript: and protocol-relative URLs refused)"
+        status: pass
+      - kind: unit
+        ref: "vue-journal-layer tests/htmlGate.test.ts (rel tokens, renderJournalBody order)"
+        status: pass
+      - kind: integration
+        ref: "expect-acme.txt (hello-acme, heading-off), expect-acme-hint-off.txt"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "SeoBreadcrumbs at the top of journal pages, none with journal.breadcrumbs false (the layout's instance renders the trail, BreadcrumbList unchanged)"
+    requirement: "D-86"
+    verification:
+      - kind: integration
+        ref: "expect-acme.txt breadcrumb lines, expect-acme-breadcrumbs-off.txt"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "JournalPagination as SeoPagination with journal class names (first, last, gap items, head prev/next); path-form routes registered for the path pagination form; pillar text on page 1 only"
+    requirement: "D-40, D-41, D-42"
+    verification:
+      - kind: integration
+        ref: "expect-acme.txt /blog/category/news?page=6 and ?page=2 lines"
+        status: pass
+      - kind: unit
+        ref: "tests/routes.test.ts (journalPagedRoutes), tests/pagination.test.ts (pageFromRoute)"
+        status: pass
+    human_judgment: false
+  - id: D8
+    description: "ItemList on index, category, tag and author pages and the FAQPage node of FAQ blocks, one JSON-LD script per page"
+    requirement: "D-43"
+    verification:
+      - kind: integration
+        ref: "expect-acme.txt ItemList lines; vue-faq-layer expect.txt (count=\"@type\":\"FAQPage\":1)"
+        status: pass
+      - kind: unit
+        ref: "tests/seo.test.ts (journalItemList), vue-faq-layer tests/faqSchema.test.ts"
+        status: pass
+    human_judgment: false
+  - id: D9
+    description: "Purge copies removed from the three layers; the shared route from vue-seo-layer and the deprecated journal route keep working"
+    requirement: "RESEARCH Pitfall 6"
+    verification:
+      - kind: integration
+        ref: "vue-journal-layer testing/purge-check.mjs (post and category) and purge-token-check.mjs; vue-seo-layer pnpm purge:check"
+        status: pass
+    human_judgment: false
+  - id: D10
+    description: "An app extending journal, menu and FAQ layers renders each page with one resolve call, one canonical and one JSON-LD script"
+    requirement: "SC-2"
+    verification:
+      - kind: integration
+        ref: "cross-layer scratch app (command and output below), 17 checks"
+        status: pass
+    human_judgment: false
+  - id: D11
+    description: "Journal related posts: default answer as before; scored mode ranks by shared tags and categories with count 3 to 6 and adds previous_in_category / next_in_category; drafts and future posts never shown to visitors; the layer renders the in-category neighbours"
+    requirement: "D-82"
+    verification:
+      - kind: integration
+        ref: "sm-journal-plugin TestRelatedDefaultUnchanged, TestRelatedScored, TestRelatedScoredCountClamped (Postgres)"
+        status: pass
+      - kind: integration
+        ref: "expect-acme.txt neighbour lines; tests/postView.test.ts (postNeighbours)"
+        status: pass
+    human_judgment: false
+
+duration: 51min
+completed: 2026-11-04
+status: complete
+---
+
+**Layer breaking changes APPROVED: option A; versions confirmed: vue-journal-layer v0.8.0, vue-menu-layer v0.5.0, vue-faq-layer v0.5.0 (breaking minors, tagged in 33-14) (Jakub, 2026-11-04)**
+
+# Phase 33 Plan 09: content layers on the shared SEO layer, heading convention, body links and opt-in related posts Summary
+
+**vue-journal-layer, vue-menu-layer and vue-faq-layer now extend vue-seo-layer. Every page gets one CMS head, one canonical and one JSON-LD graph. The journal layer drops @nuxtjs/seo and keeps exactly one H1 in both Journal H1 modes. Its post cards have one link, its post bodies follow the CMS link and image rules, and it renders the CMS breadcrumbs and pagination. Journal gains opt-in scored related posts and category neighbours, and its default answer is unchanged.**
+
+## Context rulings applied
+
+- **Breaking changes:** option A as approved (see the line at the top).
+  - The non-breaking guarantees hold:
+    - the deprecated `POST /api/__journal__/cache/purge` still works;
+    - `postTitleTag: 'auto'` gives an h1 while the Journal setting is on or absent;
+    - FAQ `headingLevel` keeps its default of 2 (0 is new and opt-in);
+    - Journal's scored related posts are opt-in, and the default answer is the same as before (TestRelatedDefaultUnchanged, the API matrix tests).
+  - No package.json version was changed; 33-14 does that.
+- **Framework:** no framework code changed (D-90), and no `summercms` requires were bumped.
+- **No SEO code in Journal (D-96):** Journal imports no SEO plugin. All link and SEO logic is in vue-seo-layer.
+- **How the layers reference vue-seo-layer:** P33-33 as planned. Each layer's package.json has `"vue-seo-layer": "link:../vue-seo-layer"`, and `pnpm install` updated the lockfiles.
+  - 33-14 must swap this for the git tag pin before tagging.
+  - No package came from the registry ("downloaded 0"). The lockfile diffs only move peer resolutions.
+- **Not pushed or tagged.** The consumers (grzybyfunkcjonalne, demo, the summercms.io changelog) were not touched.
+
+## Performance
+
+- **Duration:** about 51 min (2026-11-04T12:28:32Z to 13:19:06Z)
+- **Tasks:** 4 (a tracer, two TDD tasks and one auto task)
+- **Commits:** 13 across 5 repositories (measured with `git rev-list --count <before>..HEAD` per repository)
+
+## Task Commits
+
+All on the default branch, not pushed:
+
+**vue-journal-layer** (1dd3176..adcea4d, 7 commits)
+1. Task 1 (tracer): `289d031` feat!: render the post page on the shared SEO layer with one H1 in both Journal H1 modes (tracer)
+2. Task 2:
+   - A `1010a60` feat: body links, outbound rules and image attributes in the post body
+   - B `51e5d67` feat!: one link per post card and the heading convention
+   - C `98904b8` feat: breadcrumbs, CMS pagination and pillar content on page one
+   - D `642c25a` feat: ItemList nodes on listing pages
+3. Task 3: `ed50826` docs: README for the SEO layer
+4. Task 4: `adcea4d` feat: category neighbours on the post page
+
+**vue-seo-layer** (b051bda..7af91fc, 2 commits)
+- Task 2: `db44ca4` feat: body link utilities (auto-links, outbound rules, image attributes)
+- Task 3: `7af91fc` docs: body link utilities and the app-without-pages note
+
+**vue-menu-layer** (ef3a090..8b5da67, 1 commit)
+- Task 3: `8b5da67` feat!: extend the SEO layer and drop the copied purge route
+
+**vue-faq-layer** (1f23340..f7ec4fe, 2 commits)
+- Task 3:
+  - A `cb321e9` feat!: extend the SEO layer and drop the copied purge route
+  - B `f7ec4fe` feat: FAQPage node and widget headings
+
+**sm-journal-plugin** (0edf6e1..ee3cb26, 1 commit)
+- Task 4: `ee3cb26` feat: opt-in scored related posts and category neighbours
+
+The untracked `go.work.sum`, which belongs to another session, was left alone.
+
+The tracer gate ran in interactive end-of-phase mode with automated checks only. Its checks (unit tests, playground build, smoke, both purge checks) passed on the committed tree before expansion.
+
+## Accomplishments
+
+### Journal on the SEO layer (Task 1; D-97, D-50, P33-33 to P33-36)
+- `extends: ['vue-seo-layer']`, and `@nuxtjs/seo` is gone from the modules, the dependencies and the `ogImage`, `seo` and `sitemap` keys.
+- The journal sitemap source and the copied shared purge route, library, plugin and tests are removed.
+- The post title element is decided by `journalPostTitleTag(cfg.postTitleTag, post.content_h1_to_h2)`. While the setting is on, the body is sanitized with `demoteH1` (in both the payload and the sink).
+- The fallback meta (post title, excerpt, featured image, article times) applies only while `cmsHeadPresent(answer)` is false.
+- `useSiteConfig()` is replaced by `journalSiteOrigin(answer.url, request origin)` in PostPage and AuthorPage.
+- The search page is marked noindex through page meta (`seo: { robots: 'noindex, follow' }`), so vue-seo-layer sends both the meta tag and the header.
+- New tokens `--journal-post-title-size`, `--journal-post-title-weight` and `--journal-post-title-line-height`; `.journal-post__title` is styled by its class.
+
+### Body links, cards, headings, breadcrumbs, pagination, ItemList (Task 2; D-80 to D-83, D-71, D-52, D-86, D-40 to D-43)
+- **vue-seo-layer `bodyLinks.ts`:**
+  - `autolink` works over text nodes only, with a stack of open tags and an entity guard.
+  - `applyOutbound` handles rel tokens, target, noopener and the hint inserted before `</a>`.
+  - `imageAttrs` adds the image attributes.
+  - Everything works on sanitize-html output, with escaped values.
+- **Journal `renderJournalBody`** runs in the L7 order. The steps are injected by PostBody.
+  - The sanitizer keeps a `rel` made only of the tokens nofollow, sponsored and ugc, mirroring the Go regex exactly. This is the 33-02 follow-up.
+  - `alt=""` was already kept.
+  - The editor corpus was copied again from the plugin (17 entries).
+- **PostCard:** the title link is the only anchor, the image sits in a `div`, the read-more link is gone, and `headingLevel` takes 2 or 3. The stretched link uses `::after`, and the focus ring is on the card (`:has`). RelatedPosts renders its cards with `heading-level="3"`.
+- **Breadcrumbs:** `<SeoBreadcrumbs>` at the top of the post, index, category, tag and author pages while `journal.breadcrumbs` is on.
+- **JournalPagination** wraps `<SeoPagination class-prefix="journal-pagination">` with the journal labels.
+- **Path pagination form:** with `seo.pagination.form` set to `path`, the module registers `<listing>/<segment>/:page` routes, and the pages read the page through `pageFromRoute`.
+- **CategoryHeader:** the pillar text renders on page 1 only, demoted by the category row's `content_h1_to_h2`.
+- **ItemList:** `useJournalItemList` adds the node to the index, category, tag and author pages.
+
+### Menu and FAQ layers (Task 3; D-52, D-43, D-71)
+- Both extend vue-seo-layer through the link dependency. Their purge copies are removed with `git rm`.
+- Their smokes point `NUXT_SEO_API_BASE` at the fixture API, which answers 404, so the layer fails open.
+- **FaqBlock:**
+  - `headingLevel: 0` renders `<p class="faq-block__title">` with the same id and `aria-labelledby`.
+  - The `schema` prop (default true) adds a FAQPage node through `faqSchema(faq, pageUrl)`: `@id` `<url>#faq`, with the answers as plain text.
+  - The FAQ smoke harness gained `count=` and repeatable options.
+- README updates in all four layers (upgrade notes in the journal, menu and FAQ layers).
+
+### Opt-in related posts (Task 4; D-82, P33-44)
+- **Config:** `golem15.journal.related_mode` (`category` | `scored`, default `category`) and `golem15.journal.related_count` (3 to 6, default 3, clamped) are in `config/config.yaml`.
+- **Code:** `classes.ReadRelatedSettings`, `ScoredRelatedPosts` (one scoring query), `PrimaryCategoryID` and `CategoryNeighbour`.
+- **Show handler:** uses the scored ranking only in scored mode, and only then adds `previous_in_category` and `next_in_category`.
+- **Layer:** `postNeighbours` prefers the in-category pair when the Journal answers one.
+
+## Cross-layer check (Task 3)
+
+**Scratch app:** a scratch app outside the repositories, in `/tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/cross-layer-app`. Nothing from it is committed.
+- `package.json` has nuxt 4.4.8 and vue 3.5.35, plus link dependencies on vue-journal-layer, vue-menu-layer and vue-faq-layer.
+- `nuxt.config.ts` sets `extends: ['vue-journal-layer', 'vue-menu-layer', 'vue-faq-layer']` and the playground's i18n.
+- `app.vue` renders `<MenuNav code="main">`, `<NuxtPage>` and a `<FaqBlock slug="acme" :heading-level="0">` widget.
+
+**How it runs:** `run-cross.mjs` starts the menu and FAQ fixture APIs, then runs the journal harness:
+```
+node vue-journal-layer/testing/smoke-ssr.mjs --output .output --fixtures vue-journal-layer/testing/fixtures/acme --expect expect-cross.txt --env NUXT_MENU_API_BASE=<menu fixture> --env NUXT_FAQ_API_BASE=<faq fixture>
+```
+
+**What `expect-cross.txt` checks:**
+- For 8 pages (`/blog/hello-acme`, `/blog/heading-on`, `/blog/heading-off`, `/blog`, `/blog?page=2`, `/blog/category/news`, `/blog/tag/release` and `/blog/author/jane-doe`):
+  - one `application/ld+json` script on every page;
+  - one `rel="canonical"` on the five pages the CMS fixture answers;
+  - the menu, the FAQ widget title and the FAQPage node merged into the CMS graph.
+- After each page, `resolves <path> 1`.
+- At the end, `resolves * 8`.
+
+**Output** (`pnpm exec nuxt build`, then `node run-cross.mjs`, on the final layer trees):
+```
+build=0
+smoke-ssr: ok (17 checks)
+```
+That is exactly one resolve call per page render.
+
+## Consumer migration notes (for 33-12 and 33-13)
+
+Consumers stay pinned to their current tags until they are migrated. When an app moves to vue-journal-layer v0.8.0, vue-menu-layer v0.5.0 and vue-faq-layer v0.5.0:
+
+**Config and modules**
+- Remove `site: { url, name }` and the `@nuxtjs/seo` keys: `ogImage`, `seo.canonicalQueryWhitelist`, `sitemap`, `robots` and `schemaOrg`.
+- Set `NUXT_SEO_API_BASE`, or `seo: { cms: false }` for a site without the SEO plugin (planned for summercms.io in 33-12).
+- An app that calls `useSiteConfig()`, `useSchemaOrg()` or other `@nuxtjs/seo` composables must add the module itself or move off those composables. An app that adds the module itself gets a second canonical and graph next to the CMS's.
+- A site without the SEO plugin loses the `| site.name` title suffix in fallback titles; set `app.head.titleTemplate`.
+
+**Sitemaps and purge**
+- Sitemaps now come from the sitemap plugin through vue-seo-layer's root files. `/api/__sitemap__/journal` is gone.
+- The purge environment stays the same (`NUXT_CACHE_PURGE_TOKEN`, `NUXT_CACHE_PURGE_ALLOW_PROXIED`, the deprecated `NUXT_SITE_CACHE_*` names). The route is now vue-seo-layer's.
+
+**Markup and CSS**
+- **Post cards:**
+  - `.journal-post-card__more` and the image link are gone, and `.journal-post-card__image` is now a `div`.
+  - Overrides for those parts have nothing to style any more, and the whole card is clickable.
+  - Related post card titles are `h3`. CSS on `h2.journal-post-card__title` must target the class instead.
+- **Post title:** with the Journal setting off, the title is a `p.journal-post__title`. Style the class or the `--journal-post-title-*` tokens, not `h1`.
+- **Breadcrumbs:** they now appear at the top of journal pages. A layout that already renders breadcrumbs sets `journal.breadcrumbs: false`.
+- **Pagination:** markup classes stay the same, plus `.journal-pagination__gap` and the page 1 and last-page items. Pagination links follow the CMS form.
+- **FAQ:** FAQ blocks add a FAQPage node by default. A page with several FAQ blocks sets `:schema="false"` on all but one.
+
+**Other**
+- An app without pages that extends any of these layers sets `seo: { htmlSitemap: false }`. Otherwise every path answers 404 (deferred-items.md).
+- The demo app's `/p/**` and `/presentations/**` need `seo.noindexRoutes` (33-08 note), which now comes through every layer.
+
+## Decisions Made
+
+See key-decisions in the frontmatter.
+
+## Deviations from Plan
+
+### Adapted to the actual repositories
+
+**1. [Rule 3 - Blocking] The deprecated journal purge route keeps its own helpers.**
+- **Plan:** import the purge library from vue-seo-layer.
+- **Why changed:** Nitro externalizes a bare import (`vue-seo-layer/server/lib/siteCachePurge.ts`). In a git-installed app that file sits under node_modules, where Node does not strip types, so the server would fail to start.
+- **What I did:** the route still uses `app/utils/siteCache.ts`, unchanged. vue-seo-layer's `seo-cache-purge` plugin already empties the SEO caches after it, so the route keeps working (purge-check).
+
+**2. [Rule 3 - Blocking] `useSiteConfig()` was gone.**
+- **Found during:** Task 1. It came from @nuxtjs/seo, and PostPage and AuthorPage used it.
+- **Fix:** both use the CMS answer's origin, else the request origin (`journalSiteOrigin`).
+- **Search page robots:** they came from nuxt-robots through a route rule and now come from page meta. The route rule and the sitemap exclude stay, for apps that add those modules.
+
+**3. Smoke harness.**
+- **Expectation lines removed:** the journal expect file dropped its sitemap lines, since the layer no longer serves a sitemap.
+- **Fixture API:** answers the SEO resolve and site endpoints, and `resolveCount` was added.
+- **Boot probe:** fetches `/_nuxt/` instead of `/`, as the SEO layer's does, so resolve counts stay exact.
+- **New checks:** `headings=strict` and `cardlinks=N`. The plan names the rules but not a grammar.
+- **Extra expectation files:** beyond the plan's `expect-acme-title-h1.txt`, there are `expect-acme-title-p.txt`, `expect-acme-hint-off.txt` and `expect-acme-breadcrumbs-off.txt`. The `smoke:ssr` script runs all five, and the plan's two verify commands still pass on their own.
+
+**4. Playground changes.**
+- The journal playground drops `site`, shows one post per category page (so the 12-page news category has gap items), and has a layout trail shown only while `journal.breadcrumbs` is off.
+- The menu and FAQ playgrounds set `seo.htmlSitemap: false`; see deviation 7.
+- The FAQ playground adds a `headingLevel` 0 widget.
+
+**5. [Rule 2] The body pipeline takes its steps by injection.**
+- **Plan:** "htmlGate runs the L7 order".
+- **What I did:** htmlGate has `renderJournalBody(html, options, steps)`, and PostBody passes vue-seo-layer's auto-imported functions.
+- **Why:** journal unit tests must not import `.ts` from another package; that breaks once the dependency is a git install (33-14). The order is unit-tested with recording steps.
+
+**6. [Rule 1 - Bug] The FAQ and menu smokes read the default SEO base.** The smokes now point `NUXT_SEO_API_BASE` at the fixture API. Otherwise a local backend on :8096 could answer and make them nondeterministic. This touched `testing/smoke-ssr.mjs` in both layers, which the plan did not list.
+
+**7. [Rule 3 - Blocking] The menu and FAQ playgrounds answered 404 on every path.**
+- **Cause:** vue-seo-layer's HTML sitemap pages made Nuxt turn the router on in an app that has only `app.vue`.
+- **Fix:** `seo: { htmlSitemap: false }` in both playgrounds, plus README notes in all three layers.
+- **Logged in:** deferred-items.md, as a possible SEO-layer fix.
+
+**8. A commit split folded back.**
+- **What happened:** commit A (body links) first went in with a stale source-text assertion in `tests/embeds.test.ts`, which matched `expandEmbeds(sanitizeJournalHtml(` only. I had not re-run the unit tests after the last PostBody edit.
+- **Fix:** a fixup commit, folded into A with a non-interactive autosquash before anything later was pushed or depended on it.
+- **Check:** A's tree was then exported (`git archive`) and passed `npm run test` (182/182).
+- **History:** every journal commit is green.
+
+**9. [Rule 2] Extra commit in vue-seo-layer.** `docs: body link utilities and the app-without-pages note`: the plan lists `../vue-seo-layer/README.md` in Task 3 but no seo commit group there.
+
+**10. Grep and test names.**
+- `grep -n SeoPagination Pagination.vue` prints two lines, not one: the doc comment and the template.
+- The plan's `TestJournalAPIMatrix` names no test. `journal_api_matrix_test.go` holds `TestJournalAPIShowNeighbors`, `TestJournalAPIMassAssignRedactor` and others, which I ran with `-run TestJournalAPI` and which pass. The related-posts commit does not touch that file.
+- `posts_helpers.go` is unchanged: the new logic lives in `classes/related.go`.
+
+**11. [Rule 2] An extra related-posts test, and its rules.**
+- `TestRelatedScoredCountClamped` covers the 3..6 clamp and an invalid count.
+- A post that shares nothing scores 0 and is never related.
+- A future-dated published post is excluded alongside the planted draft (T-33-70).
+
+### TDD gate
+
+- **Task 2:** `tests/bodyLinks.test.ts` was written first.
+  - **RED:** the module was missing.
+  - **First GREEN run:** 20 of 21. One test failed because the limit was applied in table order; I changed it to document order and documented that.
+  - **Final:** 21 of 21. The FAQ `faqSchema` tests went RED then GREEN the same way.
+- **Task 4:** `related_media_test.go` was written first.
+  - **RED:** the scored tests failed on the default ranking.
+  - **One correction on my side:** my expectation for `previous_post` / `next_post` was wrong. `siblingPost` answers previous as the nearest newer post, and I fixed the test before implementing.
+- No separate RED commits, because the plan requires green tests at every commit (as in 33-07 and 33-08).
+
+## Issues Encountered
+
+- **The `scripts/check-phase33.sh --layers` stage still refuses** (`test=0 detect=3`, the vitest detector against `node --test` TAP; deferred-items.md, from 33-08). I ran every step of it by hand; the results are under Self-Check.
+- **An off-mode category page has two `h1`.** A category whose row has `content_h1_to_h2` false and whose pillar text has an h1 shows two `h1` (the header and the pillar's). That is what the plan's rule produces; the fixture's `/blog/category/plain` asserts it, and the crawler (33-10) reports it.
+- **vue-journal-layer `check-git-install.sh` needs updating in 33-14:**
+  - its lockfile check expects exactly one commit;
+  - its scratch app lacks the playground options the expectations use.
+  - Logged in deferred-items.md.
+- **The journal fixture API's previous/next direction is the opposite of Go's.** This is pre-existing and logged.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None beyond the plan's threat model.
+- **T-33-39 and T-33-40:** autolink and applyOutbound only add escaped markup between tags of sanitized output. URLs are limited to site paths and http(s). target and noopener never come from stored HTML. Covered by unit tests.
+- **T-33-70:** the scored and neighbour queries apply the published rule for visitors (TestRelatedScored).
+- **T-33-SC:** the only new dependency is the first-party `vue-seo-layer` through a local link, and @nuxtjs/seo was removed. The lockfiles are committed.
+
+## Self-Check: PASSED
+
+- **Files:** every created file listed in key-files exists.
+- **Commits:** all 13 commits are present in their repositories:
+  - vue-seo-layer db44ca4 and 7af91fc;
+  - vue-journal-layer 289d031, 1010a60, 51e5d67, 98904b8, 642c25a, ed50826 and adcea4d;
+  - vue-menu-layer 8b5da67;
+  - vue-faq-layer cb321e9 and f7ec4fe;
+  - sm-journal-plugin ee3cb26.
+- **Unit tests:** vue-seo-layer 127/127, vue-journal-layer 187/187, vue-menu-layer 24/24, vue-faq-layer 14/14.
+- **Builds:** all four playgrounds build.
+- **Smokes:**
+  - vue-seo-layer `smoke:ssr`: seven runs (31, 64, 11, 11, 7, 3, 7);
+  - vue-journal-layer `smoke:ssr`: 84, 2, 2, 2, 2;
+  - vue-menu-layer 17;
+  - vue-faq-layer 14.
+- **Purge and guard:** journal `purge-check` (post and category) 19/19 each and `purge-token-check` 53; vue-seo-layer `purge:check` 18 and 53, `guard:check` 16.
+- **Cross-layer check:** 17 checks.
+- **sm-journal-plugin:**
+  - `go vet ./...` clean, `go test -short ./...` green;
+  - full Docker `go test ./...` green (root package 50 s);
+  - `TestRelatedScored`, `TestRelatedDefaultUnchanged`, `TestRelatedScoredCountClamped` and the `TestJournalAPI*` matrix pass;
+  - editor `npm test` 244/244;
+  - editor bundle unchanged, so `check-dist.sh` was not needed.
+- **Acceptance greps:**
+  - no `@nuxtjs/seo` in the journal package.json or nuxt.config.ts;
+  - `vue-seo-layer` appears in the package.json and nuxt.config.ts of all three layers;
+  - no tracked files under `server/lib`, `server/api/__site__` or `server/api/__sitemap__` in the three layers;
+  - `postTitleTag` in journal-module.ts and PostPage.vue;
+  - the three `bodyLinks` exports;
+  - no `journal-post-card__more` or `readMore` in PostCard.vue;
+  - 16 `count=<h1:1` lines;
+  - `content_h1_to_h2` in CategoryPage.vue and CategoryHeader.vue;
+  - `FAQPage` in faqSchema.ts;
+  - `related_mode` and `related_count` in classes/related.go and config/config.yaml;
+  - `previous_in_category` in PostPage.vue;
+  - the related-posts commit does not list journal_api_matrix_test.go.

.planning/phases/33-seo-output-audit-and-content/33-10-SUMMARY.md

@@ -0,0 +1,365 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 10
+subsystem: seo
+status: complete
+tags: [sm-seo-plugin, site-audit, crawler, fetchguard, chromedp, conga, mcp, issues, crawls]
+
+requires:
+  - phase: 33-seo-output-audit-and-content
+    provides: "33-01 descriptor facts (Tools, TopHeading, Images, Headings, Words, Parents); 33-05 sitemap filter, registry and the CMS issue report; 33-06 schema.Validate and the chromedp approval (v0.21.0)"
+provides:
+  - "classes/crawl: the crawler (fetchguard client on the site host and its www twin, sitemap index and robots.txt seeds, two workers, settings delay and page limit, cancel), the C23 checks, fix routes, fingerprints, storage and recheck"
+  - "golem15_seo_crawls, golem15_seo_crawl_pages, golem15_seo_crawl_links, golem15_seo_issues, golem15_seo_issue_ignores (migration 202610280005)"
+  - "CMS-data kinds image_alt and h1_in_content from the content descriptors (classes.Service.ContentIssues), stored with each crawl as source cms"
+  - "Site audit (golem15.seo.issues) and Crawls (golem15.seo.crawls) screens with P7 issue_details and P6 crawl_summary"
+  - "Site audit settings tab (crawl_schedule, crawl_max_pages, crawl_delay, crawl_keep, generic_anchors; migration 202610280006), seo:crawl [--scheduled] and the 02:30 schedule entry"
+  - "MCP tools seo_start_crawl, seo_cancel_crawl, seo_list_crawls, seo_get_crawl, seo_delete_crawls, seo_list_issues (filters), seo_recheck_url, seo_ignore_issues, seo_unignore_issues"
+  - "Optional raw-versus-rendered comparison through github.com/chromedp/chromedp v0.21.0 (golem15.seo.crawl_chrome_path, crawl_render_max), guarded by resolver pinning and request interception"
+affects: [33-11, 33-12, 33-13, 33-14]
+
+actuals:
+  tokens: 81000
+  tasks: 4
+  commits: 2
+plan_head_before: e245b54ad994554b4b7cf20ee8cc1ad53dd54f3d
+plan_head_after: 835bf3f
+sm_seo_plugin_head_before: d38049a9561d892b77f541266f9a7ef6d0086e81
+sm_seo_plugin_head_after: b553fc2
+sm_seo_plugin_commits: 8
+
+tech-stack:
+  added:
+    - "github.com/chromedp/chromedp v0.21.0 (sm-seo-plugin only; with github.com/chromedp/cdproto v0.157.8)"
+  patterns:
+    - "A crawl finding names its fix route once (crawl.Route): the record type's fitting tool for content, else a fixed seo_ tool, else fix code with details.what"
+    - "Issues are keyed by a fingerprint (kind, url, locale, check): ignores survive crawls, a recheck and the pre-crawl CMS refresh keep the row (and id) of an issue found again"
+    - "The renderer is a seam (crawl.Renderer); tests inject one through a context (crawl.WithRenderer), like fetchguard.WithTransport for the crawler's requests"
+
+key-files:
+  created:
+    - ../sm-seo-plugin/classes/crawl/crawler.go
+    - ../sm-seo-plugin/classes/crawl/fetch.go
+    - ../sm-seo-plugin/classes/crawl/parse.go
+    - ../sm-seo-plugin/classes/crawl/checks.go
+    - ../sm-seo-plugin/classes/crawl/links.go
+    - ../sm-seo-plugin/classes/crawl/orphans.go
+    - ../sm-seo-plugin/classes/crawl/store.go
+    - ../sm-seo-plugin/classes/crawl/fix.go
+    - ../sm-seo-plugin/classes/crawl/job.go
+    - ../sm-seo-plugin/classes/crawl/actions.go
+    - ../sm-seo-plugin/classes/crawl/render.go
+    - ../sm-seo-plugin/classes/crawl/render_chrome.go
+    - ../sm-seo-plugin/classes/crawl/compare.go
+    - ../sm-seo-plugin/models/crawl.go
+    - ../sm-seo-plugin/models/crawl_page.go
+    - ../sm-seo-plugin/models/issue.go
+    - ../sm-seo-plugin/models/crawl/columns.yaml
+    - ../sm-seo-plugin/models/crawl/fields.yaml
+    - ../sm-seo-plugin/models/issue/columns.yaml
+    - ../sm-seo-plugin/models/issue/fields.yaml
+    - ../sm-seo-plugin/updates/202610280005_create_golem15_seo_crawls.go
+    - ../sm-seo-plugin/updates/202610280006_add_golem15_seo_audit_settings.go
+    - ../sm-seo-plugin/controllers/issues.go
+    - ../sm-seo-plugin/controllers/crawls.go
+    - ../sm-seo-plugin/controllers/issues/config_list.yaml
+    - ../sm-seo-plugin/controllers/issues/config_form.yaml
+    - ../sm-seo-plugin/controllers/issues/config_filter.yaml
+    - ../sm-seo-plugin/controllers/issues/_issue_details.htm
+    - ../sm-seo-plugin/controllers/crawls/config_list.yaml
+    - ../sm-seo-plugin/controllers/crawls/config_form.yaml
+    - ../sm-seo-plugin/controllers/crawls/config_filter.yaml
+    - ../sm-seo-plugin/controllers/crawls/_crawl_summary.htm
+    - ../sm-seo-plugin/controllers/api/crawls.go
+    - ../sm-seo-plugin/schedule.go
+    - ../sm-seo-plugin/crawler_test.go
+    - ../sm-seo-plugin/crawl_site_test.go
+    - ../sm-seo-plugin/crawl_admin_test.go
+    - ../sm-seo-plugin/crawl_render_test.go
+    - .planning/notes/2026-10-28-chromedp-rendered-crawl.md
+  modified:
+    - ../sm-seo-plugin/classes/issues.go
+    - ../sm-seo-plugin/classes/partials.go
+    - ../sm-seo-plugin/classes/registry.go
+    - ../sm-seo-plugin/classes/settings_write.go
+    - ../sm-seo-plugin/controllers/api/issues.go
+    - ../sm-seo-plugin/controllers/api/settings.go
+    - ../sm-seo-plugin/controllers/admin_registry.go
+    - ../sm-seo-plugin/controllers/settings.go
+    - ../sm-seo-plugin/models/settings.go
+    - ../sm-seo-plugin/models/settings/fields.yaml
+    - ../sm-seo-plugin/admin_navigation.go
+    - ../sm-seo-plugin/jobs.go
+    - ../sm-seo-plugin/commands.go
+    - ../sm-seo-plugin/menu_item_types.go
+    - ../sm-seo-plugin/routes.go
+    - ../sm-seo-plugin/mcp.go
+    - ../sm-seo-plugin/operations.go
+    - ../sm-seo-plugin/operations_test.go
+    - ../sm-seo-plugin/seo_tab_test.go
+    - ../sm-seo-plugin/settings_test.go
+    - ../sm-seo-plugin/config/config.yaml
+    - ../sm-seo-plugin/lang/en/lang.yaml
+    - ../sm-seo-plugin/lang/pl/lang.yaml
+    - ../sm-seo-plugin/README.md
+    - ../sm-seo-plugin/plugin.yaml
+    - ../sm-seo-plugin/go.mod
+    - ../sm-seo-plugin/go.sum
+    - .planning/research/STACK.md
+
+key-decisions:
+  - "chromedp pinned exactly at v0.21.0 (Jakub 2026-11-04, recorded in 33-06); the decision note was committed before the go.mod change"
+  - "Chrome's --host-resolver-rules list the site hosts first and MAP * ~NOTFOUND last: Chrome applies the first matching rule, and a leading catch-all made the site host fail with ERR_NAME_NOT_RESOLVED in Chromium (P33-55 had it leading)"
+  - "One address per host in the resolver rules, IPv4 first (localhost resolving to ::1 first refused the IPv4 test server)"
+  - "page_status covers errors other than 404/410 (those are broken_link when linked, sitemap_error when listed), so each planted page has exactly one kind"
+  - "A record's CMS-known links are its primary parent's address (the breadcrumb link): descriptors carry no body links"
+  - "broken_link, page_status and hreflang_error name seo_create_redirect; sitemap_missing names seo_create_page (seo_set_url_seo for a record page); publisher and site nodes name seo_update_settings"
+  - "GET /_seo/api/v1/issues and seo_list_issues default to status open (ignored issues left out; ignored or all on request); without ignores the Phase 32 answer is unchanged"
+  - "Before any crawl the issues list refreshes the stored CMS-data issues on every read; after the first crawl it shows the newest finished, failed or cancelled crawl's issues"
+  - "Errors-first ordering comes from the Site audit's ListExtendQuery (rank column); the severity column itself is not sortable"
+  - "List toolbar actions get their own admin operation kind (toolbar_action) in AdminOperations and its parity test"
+
+patterns-established:
+  - "Stored issue fingerprints: kind + url + locale + check, sha256 truncated, unique per crawl"
+
+requirements-completed: [SC-3, D-14, D-46, D-51, D-70, D-71, D-80, D-81, D-82, D-85, D-24, D-50, D-10, D-94]
+
+coverage:
+  - id: C1
+    description: "Tracer: an administrator starts a crawl through the API, the job fetches the site with the crawler's User-Agent, GET /issues lists h1_multiple as an error, fix code for the template and the record type's headings tool for an H1 in the record's content"
+    requirement: "D-14"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawler_test.go#TestCrawlerTracer"
+        status: pass
+    human_judgment: false
+  - id: C2
+    description: "The planted site: every C23 crawl kind found exactly once at its page with its severity and details, nothing on /clean, no request to another host, a private address or plain http"
+    requirement: "D-14"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawler_test.go#TestCrawlerChecks"
+        status: pass
+    human_judgment: false
+  - id: C3
+    description: "CMS-data issues stored with the crawl as source cms, image_alt and h1_in_content with the descriptor tools, pillar heading_skipped as fix code, every issue routed, ignores surviving the next crawl, fixed pages losing their issues"
+    requirement: "SC-3"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawler_test.go#TestIssueMerge"
+        status: pass
+    human_judgment: false
+  - id: C4
+    description: "Staging: the lock's noindex is never reported and pages stay indexable for the other checks"
+    requirement: "D-24"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawler_test.go#TestStagingCrawl"
+        status: pass
+    human_judgment: false
+  - id: C5
+    description: "Rendered comparison skipped without a renderer, failed with its note when Render fails, the crawl still finishing with its raw checks"
+    requirement: "D-70"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawler_test.go#TestRenderSkipped"
+        status: pass
+    human_judgment: false
+  - id: C6
+    description: "Site audit and Crawls: start and its refusals, errors first, labels and fix column, P7, ignore, row badge, status filter, unignore, bulk ignore, recheck (admin and API), P6 with callouts, the rendered line and kind links, GET crawl render answer, cancel, refused delete of a running crawl"
+    requirement: "D-14"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawl_admin_test.go#TestCrawlAdmin"
+        status: pass
+    human_judgment: false
+  - id: C7
+    description: "Site audit settings ranges, seeded generic anchors driving generic_anchor, seo:crawl --scheduled off/daily/weekly (ScheduledDue), crawl_keep pruning with pages and issues"
+    requirement: "D-14"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawl_admin_test.go#TestCrawlSchedule"
+        status: pass
+    human_judgment: false
+  - id: C8
+    description: "The nine MCP tools bound to their routes, delete destructive, MCP start (trigger mcp), list, ignore and unignore; every Site audit and Crawls operation mapped"
+    requirement: "D-10"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawl_admin_test.go#TestCrawlTools"
+        status: pass
+      - kind: unit
+        ref: "../sm-seo-plugin/operations_test.go#TestEveryAdminOperationHasTool"
+        status: pass
+    human_judgment: false
+  - id: C9
+    description: "Headless Chromium renders a page with JavaScript-added content; the third-party script and the link-local request are blocked; the profile is removed on Close; the crawl reports content_js check rendered naming /js-only with render done"
+    requirement: "D-70"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/crawl_render_test.go#TestChromeRenderer"
+        status: pass
+      - kind: unit
+        ref: "../sm-seo-plugin/crawl_render_test.go#TestRendererGuards"
+        status: pass
+    human_judgment: false
+  - id: C10
+    description: "Every stored kind has issues.kind_ and issues.sum_ copy in en and pl"
+    requirement: "SC-3"
+    verification:
+      - kind: unit
+        ref: "../sm-seo-plugin/crawl_admin_test.go#TestIssueKindLabels"
+        status: pass
+    human_judgment: false
+
+duration: 75min
+completed: 2026-11-04
+---
+
+# Phase 33 Plan 10: Site audit crawler Summary
+
+**A built-in crawler (a conga job on a fetchguard client limited to the site host) audits the rendered site for every C23 kind, stores the findings with the CMS-data checks under ignorable fingerprints, routes each issue to an MCP tool or to template code, and compares raw with JavaScript-rendered pages through an optional, guarded chromedp v0.21.0 renderer; Site audit and Crawls screens, a Site audit settings tab, a nightly schedule and nine MCP tools sit on top.**
+
+## Read first: consumers, versions, what is not done
+
+- **sm-seo-plugin is additive for its consumers.** No exported identifier, route, tool, lang key or table of the plugin was removed or renamed. `GET /_seo/api/v1/issues` keeps its Phase 32 keys (`data[].kind/url/locale/details/tool`, `counts`, `total`) and gains `id`, `severity`, `source`, `fix`, `found_at`, `ignored`, `crawl_id`; it now reads stored issues (the CMS checks are refreshed on each read until the first crawl, then the newest crawl's), and it leaves ignored issues out unless `status=ignored|all`. `details.what` is added to fix-code issues. The settings answer gains five `crawl_*`/`generic_anchors` keys. Two migrations (202610280005, 202610280006) add tables and settings columns.
+- **New Go dependency in sm-seo-plugin only:** `github.com/chromedp/chromedp v0.21.0` (+ `github.com/chromedp/cdproto v0.157.8`, `github.com/go-json-experiment/json`). It is compiled into every app that mounts the plugin; Chrome itself is optional and operator-installed. `golang.org/x/net` moved from indirect to direct. The framework go.mod is untouched (D-90).
+- **plugin.yaml** (kiosk manifest): the description follows the README summary, and `requires.golem15.sitemap` is now `v0.1.2` — kiosk derives that once chromedp is in go.mod (it derived `""` before); `TestPluginManifest` passes.
+- **Apps pin sm-seo-plugin as a submodule**, so sm-demo-app and sm-grzybyfunkcjonalne-app still build the old plugin. A scratch go.work that points sm-demo-app at the sibling sm-seo-plugin and sm-sitemap-plugin builds (`go build ./...`, exit 0). With only sm-seo-plugin swapped in, the demo's pinned sitemap lacks the `contract` package — pre-existing since 33-05, resolved by the 33-14 pointer bumps.
+- **Not done here (deferred-items.md, WINDOWS #32, #33):** the Site audit status filter cannot default to Open (cabana filters have no default); P7's "Open the page" and Rich Results lines are addresses, not links (partials allow same-origin links only); the settings tile and permission texts wait for 33-11.
+- sm-seo-plugin is 23 commits ahead of v0.1.1 (15 before this plan + 8), nothing pushed or tagged.
+
+## Performance
+
+- **Duration:** about 75 min
+- **Started:** 2026-11-04T13:50:37Z
+- **Completed:** 2026-11-04T15:05Z
+- **Tasks:** 4 (all)
+- **Files:** 65 changed in sm-seo-plugin (8512 insertions), 2 planning files in summercms.go plus this summary
+
+## Accomplishments
+
+- **Crawler** (`classes/crawl`): robots.txt, the sitemap index and its files, then breadth-first from `/` and the sitemap addresses over same-host links, redirect targets, canonicals and hreflang alternates; `fetchguard.AllowHostsMode` on the site host and its `www` twin (HTTPS, private addresses refused, redirects never followed), `TrustedMode` only from `golem15.seo.crawl_trusted`; two requests at a time with the settings' pause, 10 s, 5 MiB, 1000 links per page, the settings' page limit; cancel keeps what was fetched; one crawl at a time (settings row locked in the start transaction); P33-41 User-Agent.
+- **Checks**: all C23 crawl kinds with the kinds-table severities, `schema.Validate` for JSON-LD, the raw HTML against the CMS record (`content_js` check cms: title in an H1, half the word count, the primary parent's link), the rendered comparison (`compareRendered`, check rendered), orphan pages with suggestions from titles and focus keyphrases; CMS kinds `image_alt` and `h1_in_content` from the descriptors; staging noindex never counted.
+- **Fix routes** (`crawl.Route`): content findings go to the record type's `Tools` (headings for H1, image_alt, edit), data findings to `seo_set_url_seo`, `seo_update_robots`, `seo_create_redirect`, `seo_create_page`, `seo_update_settings`; everything else is `fix: code` with `details.what`. The registry pages name `seo_update_page` as their edit tool. No stored issue has neither.
+- **Storage**: crawls, pages (with main text up to 100 000 characters for 33-11's E10), links, issues with fingerprints, ignores; crawls beyond `crawl_keep` pruned with their rows.
+- **Admin**: Site audit (errors first, labels, summary and fix columns, five filters, Ignored badge, P7, Check this address again, Ignore, Stop ignoring, bulk Ignore, Start crawl) and Crawls (newest first, P6 with one status callout, staging and render lines, stats strip and per-kind table with filter links, Cancel, refused delete of a running crawl); navigation Site audit (`gauge`) and Crawls (`globe`) after Pages.
+- **Settings**: Site audit tab before Verification with the C20 ranges (`lagoon::validation.between.numeric` on the screen and the API) and the en+pl generic anchors seed.
+- **Schedule**: `seo:crawl [--scheduled]`, entry `DailyAt(2, 30)`; weekly runs on Mondays in `app.timezone`.
+- **MCP**: nine tools with `AdminOperations` rows; reads are GET, delete is destructive.
+- **Rendered comparison**: `NewRenderer` from `golem15.seo.crawl_chrome_path` and `crawl_render_max`; `chromeRenderer` with resolver pinning (`fetchguard.IsPrivateAddr`), Fetch-domain interception (`allowRequest`), fresh profile removed on Close, downloads denied, one tab, 20 s, 5 MiB DOM, default allocator flags (no `--no-sandbox`). Verified against the local Chromium.
+
+## Task Commits
+
+sm-seo-plugin (`/media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin`, branch main, not pushed):
+
+1. **Task 1 (tracer)** `c2b61bf` feat: crawler finds a page with two H1 headings and stores the issue (tracer)
+2. **Task 2A** `f2c93ae` feat: crawler checks for status, sitemaps, canonical, titles and headings
+3. **Task 2B** `8c63233` feat: crawler checks for JSON-LD, hreflang, links, images, raw HTML and the rendered-comparison seam
+4. **Task 2C** `edc03ca` feat: orphan pages and merged CMS issues with fix routes
+5. **Task 3A+C** `c4f0b4f` feat: Site audit and Crawls screens with their MCP tools
+6. **Task 3B** `fc53d93` feat: site audit settings and the nightly crawl
+7. **Task 3D** `96963c3` docs: crawler and site audit in README
+8. **Task 4B** `b553fc2` feat: rendered comparison through headless Chrome
+
+summercms.go (master):
+
+- **Task 4A** `e9504b1` docs(33-10): chromedp decision note and STACK row (before the go.mod change)
+- `835bf3f` docs(33-10): resolver rule order in the chromedp note
+
+## Decisions Made
+
+See `key-decisions` above. The rule-order and IPv4 decisions were checked against Chromium: with `MAP * ~NOTFOUND` first, `TestChromeRenderer` failed with `ERR_NAME_NOT_RESOLVED`; with it last, it passes.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] Resolver rule order**
+- **Found during:** Task 4
+- **Issue:** P33-55 (and the first version of the decision note) put `MAP * ~NOTFOUND` first; Chrome applies the first matching rule, so the site host itself did not resolve.
+- **Fix:** site host rules first, catch-all last; the note corrected in `835bf3f`.
+- **Files modified:** `classes/crawl/render.go`, `.planning/notes/2026-10-28-chromedp-rendered-crawl.md`
+- **Commit:** `b553fc2`, `835bf3f`
+
+**2. [Rule 1 - Bug] IPv6-first resolution refused the site**
+- **Found during:** Task 4 (`TestChromeRenderer`: `ERR_CONNECTION_REFUSED`)
+- **Issue:** `localhost` resolved to `::1` first while the server listened on IPv4.
+- **Fix:** the resolver rule takes the first IPv4 address, else the first.
+- **Commit:** `b553fc2`
+
+**3. [Rule 3 - Blocking] Admin screens and MCP tools in one commit**
+- **Found during:** Task 3
+- **Issue:** `TestEveryAdminOperationHasTool` fails for any admin operation without its tool, so commit A (screens) cannot be green without commit C (tools).
+- **Fix:** groups A and C landed together as `c4f0b4f`; B and D followed. Commit order: A+C, B, D.
+
+**4. [Rule 3 - Blocking] Renderer seam in the tracer commit**
+- The tracer's `crawler.go` already calls the `Renderer` interface, so `render.go` (interface, statuses, `WithRenderer`) landed in `c2b61bf`; `compareRendered` and the wiring of findings landed in 2B as planned.
+
+**5. [Rule 3 - Blocking] Exported renderer test seam**
+- The crawler tests live in the external `seo_test` package, so the fake renderer is injected through `crawl.WithRenderer(ctx, r)`, a context value settable only from Go code (like `fetchguard.WithTransport`), not an unexported option.
+
+**6. [Rule 3 - Blocking] plugin.yaml followed the README summary**
+- `96963c3` changed the README's first sentence, which kiosk's manifest check compares; the README commit was amended (local, unpushed) with the regenerated description so it passes on its own. Task 4 then set `requires.golem15.sitemap: v0.1.2`, what kiosk derives with chromedp in go.mod.
+
+**7. [Rule 3 - Blocking] Tests following new screens**
+- `TestLangKeysComplete` skips value-built `kind_`/`sum_` keys like it skips `via_`/`source_` (`TestIssueKindLabels` checks every kind instead); `TestSettingsTypeTabs` expects the new Site audit tab before Verification.
+
+**8. [Rule 2 - Missing] `cancelled_by` column**
+- P6's cancelled text names who cancelled; P33-37's table had no column for it.
+
+**9. [Rule 2 - Missing] Recheck keeps the issue's row**
+- The record action reloads the preview of the same issue, so a recheck (and the pre-crawl CMS refresh) keeps the rows of issues found again and only deletes or adds the difference.
+
+### Plan assumptions adapted
+
+- **Filter default (C23):** cabana filters take no default; the list shows ignored issues badged, the API defaults to open (deferred item, WINDOWS #32).
+- **External links in P7:** the partial allowlist drops cross-origin `href`; the page address and the Rich Results URL are shown in DM Mono (deferred item, WINDOWS #33).
+- **P6 kind links** filter the Site audit by kind only; the list shows the current crawl and has no crawl filter.
+- **Severity sorting:** errors first comes from `ListExtendQuery`'s `ORDER BY rank`; `defaultSort` is `kind` and the severity column is not sortable.
+- **CMS links:** descriptors have no body links, so content_js check cms checks the primary parent's address (the breadcrumb link).
+- **`compareRendered(raw, rendered *PageFacts, hosts []string)`** takes the site hosts to tell same-host links apart.
+- **The seo-page Tools** sit in `classes/registry.go`, where its descriptor is (menu_item_types.go only registers it).
+- **Acceptance greps that assume flat lang keys** (`grep -c "issues.kind_"`) count 0 in the nested YAML; each file has 36 `kind_` and 36 `sum_` keys under `issues:` (`TestIssueKindLabels`).
+- **Note-before-go.mod check:** the note's first commit (`e9504b1`, ct 1793803438) precedes the first chromedp go.mod commit (`b553fc2`, ct 1793804316); `git log -1` on the note now prints the later correction commit `835bf3f`.
+
+## Issues Encountered
+
+- A shell `cp` alias (`cp -i`) left a background experiment waiting for input after it restored `render.go`; the file was restored with Python, the waiting process killed, and the build re-checked.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None beyond the plan's threat model: the new routes are management routes behind `golem15.seo.manage`; outbound HTTP goes through fetchguard; Chrome is held to the same hosts and addresses.
+
+## Verification run
+
+In `/media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin`, after every commit: `go vet ./...` and `go test -short ./...` green; the full Docker suite (`go test ./...`) green before each code commit (about 100 s at the end).
+
+- `go test ./... -run 'TestCrawlerTracer|TestCrawlerChecks|TestIssueMerge|TestStagingCrawl|TestRenderSkipped|TestIssues' -v`: all PASS.
+- `go test ./... -run 'TestCrawlAdmin|TestCrawlSchedule|TestCrawlTools|TestEveryAdminOperationHasTool|TestMCPReadToolsAreGET|TestCrawlerChecks' -v`: all PASS.
+- `go test ./... -run 'TestChromeRenderer|TestRenderSkipped|TestCrawlerChecks|TestRendererGuards' -v`: all PASS; `TestChromeRenderer` ran against `/usr/bin/chromium` (not skipped).
+- Acceptance greps: `fetchguard.NewClient`/`AllowHostsMode` in fetch.go; `golem15.seo.crawl` in jobs.go and job.go; `crawl_trusted`, `crawl_chrome_path`, `crawl_render_max` once each in config.yaml; `schema.Validate` in checks.go; `func compareRendered(` and `type Renderer interface` once each; eight tool names in mcp.go; `seo:crawl` in schedule.go and commands.go; the two controller IDs in admin_navigation.go; `render_skipped|render_done|render_failed` in both phrasebooks; `host-resolver-rules` and `fetchguard.IsPrivateAddr` in render_chrome.go; no `no-sandbox`; no `crawl_chrome_path` under models/ or settings_write.go; `github.com/chromedp/chromedp` in go.mod, STACK.md and the note.
+
+`scripts/check-phase33.sh` in summercms.go (`--layers` skipped, known broken since 33-08):
+
+- `--plugins`: passed (vet and short tests of sm-sitemap-plugin, sm-seo-plugin, sm-journal-plugin; vitest 87/87 in sm-seo-plugin, 244/244 in sm-journal-plugin).
+- `--consumers`: passed (the four apps build with their pinned submodules; see "Read first" for the scratch build against this plugin).
+- `--self-test --go --admin --docs --marker --docker --additive --compat`: every stage PASS (`docker` ran the three plugins' Postgres suites; `additive`: 4 packages against v0.6.0). `compat` printed refusals for sm-feedback-plugin, sm-presentations-plugin and sm-quizzes-plugin (their own replace layout resolves the framework to nothing, at the base tag too) and passed.
+
+## User Setup Required
+
+None for the crawler. For the rendered comparison an operator installs Chrome or Chromium on the server and sets `golem15.seo.crawl_chrome_path` (absolute path); a staging or local site over http needs `golem15.seo.crawl_trusted: true`.
+
+## Next Phase Readiness
+
+- 33-11 can read `golem15_seo_crawl_pages.text` (main text, 100 000 characters) for E10 suggestions, add Auto-links between Pages and Site audit in the navigation, and replace the settings tile and permission texts.
+- 33-14: bump the sm-seo-plugin pointer in the apps together with sm-sitemap-plugin (the demo's pinned sitemap lacks `contract`), tag the plugin, and note the chromedp dependency and the two migrations in the release notes.
+
+## Self-Check: PASSED
+
+- Files: every created file listed above exists in sm-seo-plugin or summercms.go.
+- Commits: `c2b61bf`, `f2c93ae`, `8c63233`, `edc03ca`, `c4f0b4f`, `fc53d93`, `96963c3`, `b553fc2` in sm-seo-plugin; `e9504b1`, `835bf3f` in summercms.go.

.planning/phases/33-seo-output-audit-and-content/33-11-SUMMARY.md

@@ -0,0 +1,389 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 11
+subsystem: seo, media
+status: complete
+tags: [sm-seo-plugin, auto-links, internal-links, e10, mcp, lagoon, attach, webp, gen2brain, sm-journal-plugin, conga, image-variants, vue-journal-layer, picture, srcset]
+
+requires:
+  - phase: 33-seo-output-audit-and-content
+    provides: "33-05 Links tab and the four-place settings pattern; 33-06 element bundle, the seo_graph widget pattern and the gen2brain/webp approval (v0.6.4); 33-09 vue-seo-layer autolink(), the consumer of autolinks/autolink_max; 33-10 crawl pages (main text) and links, the toolbar action operation kind"
+provides:
+  - "golem15_seo_autolinks and settings autolink_max (migration 202610280007); ok resolve answers carry autolinks [{phrase, url}] and autolink_max"
+  - "SEO › Auto-links (golem15.seo.autolinks) with Add focus keyphrases; /_seo/api/v1/autolinks routes; MCP seo_list_autolinks, seo_create_autolink, seo_update_autolink, seo_delete_autolinks, seo_autolinks_from_keyphrases"
+  - "E10 golem15-seo-links (widget action seo_links) and GET /_seo/api/v1/links; MCP seo_get_link_suggestions"
+  - "Framework: attach.VariantKey and package modules/lagoon/attach/webp (Encode, Variant, Quality, Format, ContentType); github.com/gen2brain/webp v0.6.4"
+  - "sm-journal-plugin: golem15_journal_image_variants (migration 202610280002), job golem15.journal.image_variants, journal:image-variants [--all], config golem15.journal.image_widths, featured_images[].variants"
+  - "vue-journal-layer: app/utils/srcset.ts (imageSrcsets) and <picture> with WebP in JournalFeaturedImage"
+affects: [33-12, 33-13, 33-14]
+
+actuals:
+  tokens: 46000
+  tasks: 4
+  commits: 2
+plan_head_before: 3bfdc8616e8bda172a5c835d3c6ac30548c4616a
+plan_head_after: 5c07224
+sibling_repos:
+  sm-seo-plugin: {head_before: b553fc2, head_after: 49cc241, commits: 3}
+  sm-journal-plugin: {head_before: ee3cb26, head_after: 4f5bd19, commits: 1}
+  vue-journal-layer: {head_before: adcea4d, head_after: 1080a3f, commits: 1}
+
+tech-stack:
+  added:
+    - "github.com/gen2brain/webp v0.6.4 (framework go.mod; only modules/lagoon/attach/webp imports it; its one dependency github.com/ebitengine/purego v0.10.1 was already in the module graph)"
+  patterns:
+    - "A generic media helper lives in a framework sub-package so that only binaries that import it link the encoder (attach/webp next to attach)"
+    - "Auto-link writes record history under subject autolink, and its purge slug is * (a phrase may appear in any text)"
+    - "A widget's suggestions read the last finished crawl; phrase matching shares crawl's normal form (classes.NormalText)"
+
+key-files:
+  created:
+    - ../sm-seo-plugin/models/autolink.go
+    - ../sm-seo-plugin/models/autolink/columns.yaml
+    - ../sm-seo-plugin/models/autolink/fields.yaml
+    - ../sm-seo-plugin/updates/202610280007_create_golem15_seo_autolinks.go
+    - ../sm-seo-plugin/classes/autolinks.go
+    - ../sm-seo-plugin/classes/linkgraph.go
+    - ../sm-seo-plugin/controllers/autolinks.go
+    - ../sm-seo-plugin/controllers/autolinks/config_list.yaml
+    - ../sm-seo-plugin/controllers/autolinks/config_form.yaml
+    - ../sm-seo-plugin/controllers/autolinks/config_filter.yaml
+    - ../sm-seo-plugin/controllers/api/autolinks.go
+    - ../sm-seo-plugin/controllers/api/links.go
+    - ../sm-seo-plugin/assets/src/elements/links.ts
+    - ../sm-seo-plugin/tests/elements/links.test.ts
+    - ../sm-seo-plugin/linking_test.go
+    - .planning/notes/2026-10-28-webp-gen2brain.md
+    - modules/lagoon/attach/variant.go
+    - modules/lagoon/attach/webp/webp.go
+    - modules/lagoon/attach/webp/webp_smoke_test.go
+    - modules/lagoon/attach/webp/export_test.go
+    - ../sm-journal-plugin/classes/image_variants.go
+    - ../sm-journal-plugin/console/image_variants.go
+    - ../sm-journal-plugin/models/image_variant.go
+    - ../sm-journal-plugin/updates/202610280002_create_golem15_journal_image_variants.go
+    - ../sm-journal-plugin/jobs.go
+    - ../vue-journal-layer/app/utils/srcset.ts
+    - ../vue-journal-layer/tests/srcset.test.ts
+  modified:
+    - ../sm-seo-plugin/classes/resolver.go
+    - ../sm-seo-plugin/classes/settings_write.go
+    - ../sm-seo-plugin/classes/history.go
+    - ../sm-seo-plugin/classes/crawl/fix.go
+    - ../sm-seo-plugin/models/settings.go
+    - ../sm-seo-plugin/models/settings/fields.yaml
+    - ../sm-seo-plugin/models/revision.go
+    - ../sm-seo-plugin/controllers/admin_registry.go
+    - ../sm-seo-plugin/controllers/api/settings.go
+    - ../sm-seo-plugin/extensions.go
+    - ../sm-seo-plugin/admin_navigation.go
+    - ../sm-seo-plugin/routes.go
+    - ../sm-seo-plugin/mcp.go
+    - ../sm-seo-plugin/operations.go
+    - ../sm-seo-plugin/operations_test.go
+    - ../sm-seo-plugin/seo_tab_test.go
+    - ../sm-seo-plugin/assets/src/elements/index.ts
+    - ../sm-seo-plugin/assets/src/elements/labels.ts
+    - ../sm-seo-plugin/assets/src/elements/styles.css
+    - ../sm-seo-plugin/assets/dist/seo.js
+    - ../sm-seo-plugin/assets/dist/seo.css
+    - ../sm-seo-plugin/lang/en/lang.yaml
+    - ../sm-seo-plugin/lang/pl/lang.yaml
+    - ../sm-seo-plugin/README.md
+    - go.mod
+    - go.sum
+    - modules/lagoon/README.md
+    - docs/database/attachments.md
+    - .planning/research/STACK.md
+    - ../sm-journal-plugin/controllers/api/posts.go
+    - ../sm-journal-plugin/controllers/posts.go
+    - ../sm-journal-plugin/plugin.go
+    - ../sm-journal-plugin/config/config.yaml
+    - ../sm-journal-plugin/go.mod
+    - ../sm-journal-plugin/go.sum
+    - ../sm-journal-plugin/README.md
+    - ../sm-journal-plugin/related_media_test.go
+    - ../vue-journal-layer/app/components/Journal/FeaturedImage.vue
+    - ../vue-journal-layer/app/components/Journal/PostCard.vue
+    - ../vue-journal-layer/app/journal-pages/PostPage.vue
+    - ../vue-journal-layer/app/utils/types.ts
+    - ../vue-journal-layer/app/assets/css/journal-base.css
+    - ../vue-journal-layer/testing/fixtures/acme/posts.json
+    - ../vue-journal-layer/testing/expect-acme.txt
+    - ../vue-journal-layer/README.md
+
+key-decisions:
+  - "gen2brain/webp pinned exactly at v0.6.4 (Jakub 2026-11-04, recorded in 33-06); the decision note (1bb2ecf) is older than the go.mod change (5c07224)"
+  - "The gen2brain/webp fallback is libwebp compiled to WASM and transpiled to Go by wasm2go (libwebp.go, about 2.7 MB of generated Go). There is no WASM runtime and no wazero; the first choice is the system libwebp through purego"
+  - "Importing purego makes a binary dynamically linked against glibc even with CGO_ENABLED=0; -tags nodynamic keeps it static (transpiled encoder only). Recorded in the note, the lagoon README, docs/database/attachments.md and deferred-items for 33-14"
+  - "An auto-link's locale is stored as '' for every locale (NOT NULL), not NULL as P33-45 wrote; the unique index is (lower(phrase), locale), and the save refuses a phrase of every locale that meets the phrase of one locale, both ways"
+  - "Auto-link history uses subject autolink with purge slug * (a phrase can appear on any page); auto-links have no undo, like registry pages"
+  - "autolinks and autolink_max are omitted on non-ok answers and from the sitemap filter's production resolve; with autolink_max 0 the answer carries no phrases"
+  - "E10 is left out for the kinds collection and profile and for the page registry, because Words is a per-record fact (deferred item)"
+  - "E10's inbound count is the distinct pages linking here, the outbound count the distinct site pages it links to; a page missing from the crawl gets 0 and 0 and is not called an orphan; suggestions skip pages already linked either way"
+  - "WebP variants are written in mode exact at the original's aspect ratio for each width no larger than the original; every variant row carries the original's source_width and source_height, so the only new API key is variants"
+  - "golem15_journal_image_variants has no foreign key to system_files (the plugin's migration tests run without framework tables); the API delete removes the rows"
+
+patterns-established:
+  - "Framework media add-ons: a separate sub-package (attach/webp) keeps a heavy dependency out of binaries that do not import it"
+
+requirements-completed: [SC-2, SC-3, D-82, D-85, D-71, D-10]
+
+coverage:
+  - id: L1
+    description: "Tracer: an all-locale phrase reaches another page's resolve answer with autolink_max 3, never the target page, never a disabled or other-locale phrase; autolink_max 0 answers none; 21 refused; three history rows"
+    requirement: "D-82"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/linking_test.go#TestAutolinksTracer"
+        status: pass
+    human_judgment: false
+  - id: L2
+    description: "Auto-links screen and API: the refusals (short phrase, phrase taken naming its URL, javascript:, data:, protocol-relative, ftp, whitespace), labels, the disabled row state, the active and locale filters, Add focus keyphrases twice (second adds nothing), MCP origin, update, delete, history vias"
+    requirement: "D-82, D-10, T-33-50"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/linking_test.go#TestAutolinks"
+        status: pass
+    human_judgment: false
+  - id: L3
+    description: "E10 data: null counts before a crawl; after it, inbound/outbound/orphan and both suggestion lists with public and admin addresses; the widget action answers the same; seo_links is in the SEO tab after seo_graph"
+    requirement: "D-82"
+    verification:
+      - kind: integration
+        ref: "../sm-seo-plugin/linking_test.go#TestLinkSuggestions"
+        status: pass
+      - kind: integration
+        ref: "../sm-seo-plugin/seo_tab_test.go#TestSEOTab"
+        status: pass
+    human_judgment: false
+  - id: L4
+    description: "E10 element: counters, orphan callout, both lists, notCrawled, none, checking line with aria-busy, danger line on failure, Copy address and the copied status for 2 s, hidden button without a clipboard, locale switch"
+    requirement: "D-82"
+    verification:
+      - kind: unit
+        ref: "../sm-seo-plugin/tests/elements/links.test.ts"
+        status: pass
+    human_judgment: false
+  - id: L5
+    description: "MCP parity: six new tools, every Auto-links and E10 operation mapped, reads are GET, the delete is destructive"
+    requirement: "D-10"
+    verification:
+      - kind: unit
+        ref: "../sm-seo-plugin/operations_test.go#TestEveryAdminOperationHasTool"
+        status: pass
+      - kind: unit
+        ref: "../sm-seo-plugin/operations_test.go#TestMCPReadToolsAreGET"
+        status: pass
+    human_judgment: false
+  - id: M1
+    description: "WebP encoder: RIFF/WEBP output, VariantKey rules (webp original appends), a variant next to its thumbnail written once, a failed encode leaves no file, the documented example"
+    requirement: "D-85"
+    verification:
+      - kind: unit
+        ref: "modules/lagoon/attach/webp/webp_smoke_test.go"
+        status: pass
+    human_judgment: false
+  - id: M2
+    description: "Journal: the upload answers before any encoding and queues the job; the job writes 480 and 800 (1200 wider than the 1000 px original) with WebP copies; the API's variants; a second run writes nothing; an admin save queues only for an image lacking a width; the API delete removes rows and blobs"
+    requirement: "D-85"
+    verification:
+      - kind: integration
+        ref: "../sm-journal-plugin/related_media_test.go#TestImageVariants"
+        status: pass
+    human_judgment: false
+  - id: M3
+    description: "Layer: srcset strings from variants plus the original's width; <picture> with image/webp, width, height, alt, eager with fetchpriority high on the post, lazy in cards; an image without variants renders as before"
+    requirement: "D-85, D-71"
+    verification:
+      - kind: unit
+        ref: "../vue-journal-layer/tests/srcset.test.ts"
+        status: pass
+      - kind: integration
+        ref: "../vue-journal-layer/testing/expect-acme.txt (featured image lines, smoke-ssr 87 checks)"
+        status: pass
+    human_judgment: false
+
+duration: 75min
+completed: 2026-11-04
+---
+
+# Phase 33 Plan 11: auto-links, internal link suggestions and WebP featured images Summary
+
+**Editors keep a phrase → URL table that every ok resolve answer carries for its locale (minus the page itself), with a screen, a keyphrase feed and MCP tools; the SEO tab shows each page's inbound and outbound links from the last crawl with linking suggestions (E10); featured images get thumbnails at 480/800/1200 and a WebP copy of each from a Journal conga job, encoded in Go by the framework's new `attach/webp` package (github.com/gen2brain/webp v0.6.4), and the journal layer serves them as `<picture>` with srcset.**
+
+## Read first: consumers, versions, what is not done
+
+- **Everything is additive.** No exported identifier, route, tool, lang key, table or answer key was removed or renamed in any repository.
+  - sm-seo-plugin: the resolve answer gains `autolinks` and `autolink_max` on ok answers; the settings answer gains `autolink_max`. New routes `GET/POST /_seo/api/v1/autolinks`, `PUT /autolinks/{id}`, `DELETE /autolinks?ids=`, `POST /autolinks/from-keyphrases`, `GET /links?url=`. Six MCP tools. Migration 202610280007 (table and settings column).
+  - Framework: `attach.VariantKey` and the new package `modules/lagoon/attach/webp`. The gate's additive check passes (5 packages against v0.6.0, `modules/lagoon/attach` +1 line).
+  - sm-journal-plugin: `featured_images[].variants` (new key on every entry, `[]` until made), migration 202610280002, job `golem15.journal.image_variants`, command `journal:image-variants`, config key `golem15.journal.image_widths`. The plugin now registers jobs (`pact.HasJobs`).
+  - vue-journal-layer: `JournalFeaturedImage` gains the optional props `image` and `sizes`. Without variants its markup is byte-for-byte as before.
+- **New dependency: `github.com/gen2brain/webp` v0.6.4, pinned exactly**, in the framework go.mod (and indirect in sm-journal-plugin's). The only package that imports it is `modules/lagoon/attach/webp`. Its one dependency, `github.com/ebitengine/purego` v0.10.1, was already in the module graph, so no other module was added. The module source confirms the fallback is wasm2go-transpiled Go, not wazero.
+- **Linking consequence, which 33-14 should decide on.** A binary that imports `attach/webp` (any app mounting sm-journal-plugin) is dynamically linked against glibc even with `CGO_ENABLED=0`, because of purego. It needs `ld-linux-x86-64.so.2`, `libc.so.6`, `libdl.so.2` and `libpthread.so.0`. It runs on the Debian servers but not in scratch or musl images. `-tags nodynamic` gives a static binary with the slower transpiled encoder. Installing `libwebp-dev` enables the fast path. The note, the lagoon README, the attachments docs and deferred-items all say this.
+- **Not pushed or tagged.** sm-seo-plugin is 26 commits ahead of v0.1.1. sm-journal-plugin, vue-journal-layer and summercms.go have unpushed phase-33 commits. The apps still pin the old plugin submodules, and 33-14 bumps them.
+- **Settings tile and permission texts** (33-10 deferred item) now carry the UI-SPEC texts in en and pl, and the deferred item is marked resolved.
+
+## Performance
+
+- **Duration:** about 75 min (2026-11-04, about 15:05Z to 16:20Z)
+- **Tasks:** 4 (a tracer, two TDD tasks, one auto task)
+- **Commits:** 7 across 4 repositories (sm-seo-plugin 3, summercms.go 2, sm-journal-plugin 1, vue-journal-layer 1); measured with `git rev-list --count <before>..HEAD` per repository
+
+## Task Commits
+
+**sm-seo-plugin** (`/media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin`, main, b553fc2..49cc241)
+1. Task 1 (tracer): `6203aec` feat: auto-link phrases in the resolve answer (tracer)
+2. Task 2A: `ab4e834` feat: auto-links screen, keyphrase feed and MCP tools
+3. Task 2B: `49cc241` feat: internal links widget with counts and suggestions
+
+**summercms.go** (master, 3bfdc86..5c07224)
+4. Task 3A: `1bb2ecf` docs(33-11): WebP decision note and STACK row
+5. Task 3B: `5c07224` feat(lagoon): WebP variants of attachment thumbnails
+
+**sm-journal-plugin** (main, ee3cb26..4f5bd19)
+6. Task 4A: `4f5bd19` feat: image variants job and variants in the post API
+
+**vue-journal-layer** (main, adcea4d..1080a3f)
+7. Task 4B: `1080a3f` feat: WebP and srcset for featured images
+
+## Accomplishments
+
+- **Auto-links (D-82).** The table has a phrase, a URL (a `/` path or an http(s) address), a locale or all, an active switch, an origin (manual, keyphrase or mcp) and a note. Every write is checked and recorded in history, which purges the site cache with slug `*`.
+  - `Service.ForPage` lists the active phrases of a locale, longest first. It drops phrases that link to the page itself, as a path or as an absolute URL on the site host or its www twin.
+  - The resolver adds `autolinks` and `autolink_max`, and vue-seo-layer's `autolink()` (33-09) applies them.
+- **Auto-links screen (C22).** It sits after Pages with the icon `wand-sparkles`. The list shows 50 rows, has checkboxes and setup, and its toolbar holds create, delete and Add focus keyphrases.
+  - Columns: phrase, links to, language (All languages or the code), origin label, updated. A row gets the disabled state ("Off") when the phrase is inactive.
+  - Filters: language, origin, and the Active only switch.
+  - Form: phrase and URL, language (empty option All languages) and Active, note.
+  - Refusals: `phrase_short`, `phrase_taken` (names the URL), `url_invalid`.
+  - Add focus keyphrases turns the SEO entries' focus keyphrases into phrases (one per locale, origin keyphrase) and toasts the count (CLDR plural) or `keyphrases_none`.
+- **E10 golem15-seo-links (C19).** The `seo_links` widget sits in the SEO tab after `seo_graph`, on update only.
+  - It shows the counters (`.summer-stats`) with the crawl time, the orphan callout, "Pages you could link to from this text" with Copy address, and "Pages that could link here" with admin links.
+  - Empty states: `notCrawled` before the first crawl, `none` under an empty list.
+  - Loading and errors: the checking line with `aria-busy`, a danger line on failure. Copy address falls back to the selectable URL when the clipboard is unavailable, and the element follows the ML locale switch.
+  - `classes/linkgraph.go` reads the last finished crawl's pages and links. The crawler's orphan suggestions now share `classes.NormalText`.
+- **Framework WebP (P33-42).**
+  - `attach.VariantKey(thumbKey, format)` replaces the thumbnail's extension, or appends the format when the thumbnail already has that extension.
+  - `webp.Encode` encodes at quality 80.
+  - `webp.Variant` calls ThumbKey first and returns early when the variant exists. It encodes in memory, stores `image/webp`, and deletes the key on a write or close error.
+  - Docs section "WebP variants" in docs/database/attachments.md, with a synced `src=` example.
+- **Journal image variants.**
+  - The job runs with three attempts. It makes each configured width no larger than the original (mode exact, the original's aspect ratio) through ThumbKey and `webp.Variant`, then inserts rows with ON CONFLICT DO NOTHING. It skips originals that are missing, don't decode or are over the pixel limit.
+  - It is queued after an API upload and after an admin save of a post whose images lack a width. The upload never encodes, and a queue failure is only logged.
+  - `journal:image-variants [--all]` backfills.
+  - `featured_images[].variants` is loaded with one query per post.
+  - The API delete removes a file's rows.
+- **Layer.**
+  - `imageSrcsets` builds the WebP and original-format srcsets, adds the original when it is wider than every variant, works out the reserved size, and escapes addresses.
+  - `JournalFeaturedImage` renders `<picture>`: cards pass `sizes="(min-width: 48rem) 33vw, 100vw"` and load lazily; the post page passes `sizes="(min-width: 46rem) 46rem, 100vw"` with eager loading and `fetchpriority="high"`.
+  - `picture` is styled as a block element.
+
+## Decisions Made
+
+See `key-decisions` above.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Auto-link locale stored as '' instead of NULL**
+- **Found during:** Task 1
+- **Issue:** P33-45 has `locale null = all`. The admin dropdown's empty option posts "", and a nullable column would need a custom binding type.
+- **Fix:** `locale TEXT NOT NULL DEFAULT ''`, unique `(lower(phrase), locale)`. The save check treats a phrase of every locale as meeting each locale, both ways. "all" is accepted as an alias in the API and the filter.
+- **Commit:** `6203aec`
+
+**2. [Rule 2 - Missing] Auto-link history purges every page**
+- **Issue:** `purgeSlug` would have used the autolink's target `url` as the purge slug, but a phrase changes the pages that contain it, not its target.
+- **Fix:** `SubjectAutolink` purges `*`.
+- **Commit:** `6203aec`
+
+**3. [Rule 3 - Blocking] E10 omitted by kind, not by Words**
+- **Issue:** `Words` is per record and locale (`pact.ContentLocale`), so the per-type SEO tab cannot read it.
+- **Fix:** `hasBody(key, kind)` leaves E10 out for collection, profile and the page registry. Logged in deferred-items with a framework fix (`ContentDescriptor.HasBody`).
+- **Commit:** `49cc241`
+
+**4. [Rule 2 - Missing] E10 checking and failure copy**
+- **Issue:** The E10 copy table has no loading or failure text, and E3's `checking` says "Checking for duplicates…".
+- **Fix:** Added `linksChecking` ("Loading the internal links…" / "Wczytywanie linków wewnętrznych…") and `linksFailed` ("The internal links could not be loaded. Try again." / "Nie udało się wczytać linków wewnętrznych. Spróbuj ponownie."). E10 keys are prefixed `links*` because `none` and `links` already exist in the shared dictionary.
+- **Commit:** `49cc241`
+
+**5. [Rule 2 - Missing] The original's size in the variants**
+- **Issue:** The layer needs the original's width for the srcset and the reserved size, and `system_files` has no dimensions.
+- **Fix:** Each row and each `variants` entry carries `source_width` and `source_height`, so `variants` stays the only new API key.
+- **Commit:** `4f5bd19`
+
+**6. [Rule 3 - Blocking] No foreign key from the variants table to system_files**
+- **Issue:** The plugin's own migration tests (updates, models) run without the framework's tables, and the foreign key broke five tests.
+- **Fix:** Plain `file_id`. The API delete removes the rows; leftovers from admin removals are logged in deferred-items.
+- **Commit:** `4f5bd19`
+
+**7. [Rule 1 - Bug] The admin save re-queued the job for complete images**
+- **Issue:** The "missing" filter counted variant rows against the number of widths, but widths wider than the original never get a row.
+- **Fix:** An image counts as missing only when it lacks a width no larger than its recorded source width.
+- **Commit:** `4f5bd19`
+
+**8. [Rule 3 - Blocking] Docs code blocks need a `src=` snippet**
+- **Issue:** `docs:build --check` refuses a Go block without `src=`.
+- **Fix:** Added `ExampleVariant` to the webp tests (external test package, plus `export_test.go` for the encoder seam), referenced with `src=` and synced.
+- **Commit:** `5c07224`
+
+### Plan assumptions adapted
+
+- **Files that did not apply.** `modules/lagoon/attach/README.md` does not exist, so attach is documented in `modules/lagoon/README.md`. `models/registry.go` and `updates/registry.go` (both plugins) needed no change, because new files register themselves in `init`. `classes/settings_write.go` also carries the `autolink_max` range through `Settings.AuditProblems` (0 to 20, `lagoon::validation.between.numeric`).
+- **The plan's description of the fallback.** It says "WASM via wazero". The v0.6.4 source is wasm2go-transpiled Go, and the decision note says so.
+- **`TestJournalAPIMatrix` does not exist.** The plan's verify names it, but the matrix file holds several tests (`TestJournalAPIShowNeighbors`, `TestJournalPerPageClamp`, …). The full Journal suite (`go test ./...`, Docker) ran green instead.
+- **Acceptance grep `golem15.seo.autolinks` in admin_navigation.go.** The navigation uses the constant `controllers.AutolinksControllerID`, so a comment on the nav entry names the controller ID.
+- **TestAutolinks reads list rows by phrase, not by position.** cabana sorts the phrase column in the database's byte order. Logged as a deferred item.
+
+## Issues Encountered
+
+- `gofmt` turned `''` in a Go comment into a typographic quote. The comment now reads "empty".
+- The SSR expectation grammar splits on ` type=`, so the `<source type="image/webp"` lines start their `contains=` after `type`.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None beyond the plan's threat model.
+- T-33-50: URLs are restricted to paths and http(s), tested with javascript:, data:, protocol-relative and ftp addresses.
+- T-33-51: the pixel limit is checked from the header before any decode, widths wider than the original are skipped, and encoding runs in a job with attempts.
+- T-33-52: the version is pinned, and the note and STACK row were committed before go.mod.
+- T-33-53: every new route sits behind `manage()` with `golem15.seo.manage`, and the parity test covers the tools.
+
+## Verification run
+
+- **sm-seo-plugin:** `go vet ./...`, `go test -short ./...` and the full Docker suite (`go test ./...`, about 100 s) were green before each of the three commits.
+  - `TestAutolinksTracer`, `TestAutolinks`, `TestLinkSuggestions`, `TestEveryAdminOperationHasTool`, `TestMCPReadToolsAreGET` and `TestSEOTab` all PASS.
+  - `npm run test`: 93/93 (9 files). `npm run build` then `scripts/check-dist.sh`: "assets/dist matches a fresh build".
+  - Acceptance greps: two resolver json tags; `autolink_max` in settings_write.go and fields.yaml; six tool names in mcp.go; `golem15-seo-links` in index.ts; `golem15.seo.autolinks` in admin_navigation.go.
+- **summercms.go:**
+  - `go vet ./...` and `go test -short ./...` green. `go test ./modules/lagoon/...` (Docker): lagoon, attach and attach/webp all ok.
+  - `summer docs:build --check`: no problems. `go test ./cmd/summer -run TestDocsTree`: ok.
+  - `grep -rln gen2brain modules --include=*.go` lists only `modules/lagoon/attach/webp/webp.go`.
+  - Note before go.mod: `1bb2ecf` is the parent of `5c07224`, the first gen2brain change to go.mod.
+- **sm-journal-plugin:** `go vet ./...`, `go test -short ./...` and the full Docker suite all green. `TestImageVariants` PASS. `GOWORK=off go build ./... && go vet ./...` also green (go.mod has the framework replace). `TestCommandsDocumented` logs nothing for `journal:image-variants`.
+- **vue-journal-layer:**
+  - `npm run test`: 192 pass, 0 fail (srcset.test.ts: 5).
+  - `npm run build:playground`: complete. `npm run smoke:ssr`: ok (87, 2, 2, 2, 2 checks).
+  - TypeScript: the package has no typecheck script. `tsc --noEmit -p .playground/.nuxt/tsconfig.app.json --allowImportingTsExtensions` reports 3 pre-existing errors in untouched files (useJournalItemList.ts, siteCache.ts) and none in the changed files. .vue files are not covered by tsc.
+- **`scripts/check-phase33.sh`:** self-test, go, plugins, docs, marker, additive (5 packages, attach +1 line), admin, docker, consumers and compat all PASS. compat printed the known refusals for sm-feedback-plugin, sm-presentations-plugin and sm-quizzes-plugin (skipped, they fail at v0.6.0 too). `--layers` was skipped (known broken, deferred-items 33-08), and its steps were run by hand for vue-journal-layer as listed above.
+
+## User Setup Required
+
+None for the defaults. Optional: install `libwebp-dev` on servers for about five times faster encoding. For a static or musl deploy of an app with Journal, build with `-tags nodynamic`. Run `journal:image-variants` once per site to backfill existing featured images.
+
+## Next Phase Readiness
+
+- **33-12 / 33-13:** E10, Auto-links and the resolve keys are in place. vue-seo-layer already consumes `autolinks` and `autolink_max` (33-09).
+- **33-14:**
+  - Bump the sm-seo-plugin, sm-journal-plugin and vue-journal-layer pins in the apps. sm-journal-plugin then needs the framework at v0.6.1 (`attach/webp`).
+  - Decide each app's build on the glibc linking (`-tags nodynamic` or not).
+  - Name the new migrations (SEO 202610280007, Journal 202610280002), the `journal:image-variants` backfill and the gen2brain/webp dependency in the release notes.
+
+## Self-Check: PASSED
+
+- Files: every created file listed in `key-files.created` exists (checked with `test -f` in each repository).
+- Commits: `6203aec`, `ab4e834`, `49cc241` (sm-seo-plugin); `1bb2ecf`, `5c07224` (summercms.go); `4f5bd19` (sm-journal-plugin); `1080a3f` (vue-journal-layer). Each was found with `git cat-file -e`.

.planning/phases/33-seo-output-audit-and-content/33-12-SUMMARY.md

@@ -0,0 +1,412 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 12
+subsystem: apps
+tags: [seo, sitemap, nuxt, vue-seo-layer, demo, summercms-io, bm, noindex, patches]
+
+requires:
+  - phase: 33-03..33-06
+    provides: sitemap index and files, SEO plugin page registry, site answer, JSON-LD graph, breadcrumbs
+  - phase: 33-07..33-09
+    provides: vue-seo-layer v0.2.0 (resolve, root files, build guard, noindex routes, route report, components) and the journal, menu and faq layers on it
+  - phase: 33-11
+    provides: WebP variants (purego linking note)
+provides:
+  - "33-12-sm-demo-app.patch: Journal (tag_pages false), sitemap (site_url) and SEO (route_report_token) config, nginx without sitemap locations, env templates, DEPLOY.md SEO steps, deploy/seo-pages.csv, TestSEOOutput, scripts/smoke-seo.sh, scripts/smoke.sh and check-deploy.sh on the new format"
+  - "33-12-vue-demo-app.patch: seo.noindexRoutes ['/p/**', '/presentations/**'], page meta instead of hand-written robots, SeoSitemapLink in the footer, @nuxtjs/seo keys removed, SSR resolve through /api/__seo__"
+  - "33-12-vue-summercmsio-app.patch: changelog on seo: { cms: false, htmlSitemap: false } and 12 new expectation lines"
+  - "33-12-sm-summercmsio-app.patch: the empty note (no change beyond the pin bumps)"
+  - "33-12-local-wiring.md: worktrees, go.work, pnpm overrides, run variables, checks and cleanup for 33-13 and 33-14"
+  - "sm-bm-app bd7ee84: robots.txt Disallow, robots meta, X-Robots-Tag in nginx, scripts/check-noindex.sh (D-72)"
+affects: [33-13, 33-14]
+
+actuals:
+  tokens: 30000
+  tasks: 3
+  commits: 2
+plan_head_before: 617e15d
+plan_head_after: 298c81d701c697e77cc7b4b5e8639f07f87a98e2
+
+tech-stack:
+  added: []
+  patterns:
+    - "Release patches from scratch worktrees: git add -N for new files, git diff --binary over an explicit path list, so the wiring (go.work, plugins.gen.go, pnpm overrides and lockfile) never enters a patch"
+    - "Scratch Nuxt wiring with pnpm 12 overrides in pnpm-workspace.yaml (link: to the sibling layers, applied at every depth)"
+    - "An SEO smoke run against a site: CMS head checks, a sitemap crawl through the site with duplicate and noindex detection, a redirect and a 404 created and removed through the SEO API"
+
+key-files:
+  created:
+    - .planning/phases/33-seo-output-audit-and-content/33-12-sm-demo-app.patch
+    - .planning/phases/33-seo-output-audit-and-content/33-12-vue-demo-app.patch
+    - .planning/phases/33-seo-output-audit-and-content/33-12-sm-summercmsio-app.patch
+    - .planning/phases/33-seo-output-audit-and-content/33-12-vue-summercmsio-app.patch
+    - .planning/phases/33-seo-output-audit-and-content/33-12-local-wiring.md
+    - ../sm-bm-app/frontend/public/robots.txt
+    - ../sm-bm-app/scripts/check-noindex.sh
+  modified:
+    - ../sm-bm-app/frontend/index.html
+    - ../sm-bm-app/deploy/nginx/bm.jakubzych.com.conf
+    - ../sm-bm-app/DEPLOY.md
+    - ../sm-bm-app/README.md
+    - .planning/phases/33-seo-output-audit-and-content/deferred-items.md
+    - .planning/WINDOWS.md
+
+key-decisions:
+  - "The demo keeps its cookie-based Polish (D-13). Moving to /pl/ prefixes is a Rule 4 change and goes to 33-14 as a decision; smoke-seo.sh reports the /pl/ 404s as WARN lines (SMOKE_SEO_STRICT=1 fails on them)"
+  - "Demo sitemaps go through Nuxt: nginx drops = /sitemap.xml and = /sitemap.xsl and gets no /_sitemap or /_seo location, and check-deploy.sh refuses one. robots.txt stays on the Go port"
+  - "The demo resolves client-side navigations through the Nuxt server (public.seo.apiBase /api/__seo__), so /_seo stays unrouted"
+  - "Registry page titles: deploy/seo-pages.csv restores 'SummerCMS Demo' (/) and 'FAQ' (/faq), which the registry would otherwise derive as 'Home' and 'Faq'"
+  - "sm-bm-app's check-noindex.sh builds the frontend into a temp outDir, so the committed build in the jz.bm plugin submodule is not touched"
+
+requirements-completed: [SC-1, SC-2, D-72, D-70, D-23, D-97, D-33, D-22, D-30, D-34]
+
+coverage:
+  - id: D1
+    description: "The demo stack on local links serves a Journal post with the CMS title, one canonical, one JSON-LD @graph, hreflang and breadcrumbs, /sitemap.xml as an index whose files answer through the layer, a 301 from an SEO plugin redirect, noindex on /p/** and the auth pages, the reported routes in the registry and a 404 in the 404 log"
+    requirement: SC-1
+    verification:
+      - kind: e2e
+        ref: "SMOKE_SEO_API=http://127.0.0.1:8120 bash scripts/smoke-seo.sh http://127.0.0.1:3020 (smoke-seo: ok, 29 ok lines, 9 WARN)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "The demo build passes the D-70 guard with seo.noindexRoutes and fails without the line"
+    requirement: D-70
+    verification:
+      - kind: automated_ui
+        ref: "pnpm exec nuxt build in the vue-demo-app worktree: exit 0 with the line, exit 1 '[vue-seo-layer] indexable routes must render on the server (D-70): /p/**, /presentations/**' without it"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "TestSEOOutput (Docker): sitemap index and file on the public origin, no tag address and /blog/tag/releases not_found with tag_pages false, site answer, post resolve with @graph and breadcrumbs, route report with route_report_token"
+    requirement: SC-2
+    verification:
+      - kind: integration
+        ref: "go test -tags summercms_mcp -run TestSEOOutput -count=1 . (pass; fails without config/golem15.journal.yaml)"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "summercms.io's changelog on seo.cms false keeps its titles, one canonical, one graph and makes no resolve call; landing generate, unit tests and marketplace smoke pass"
+    requirement: D-97
+    verification:
+      - kind: e2e
+        ref: "pnpm run build:changelog && pnpm run test:changelog (smoke-ssr: ok (89 checks)); pnpm run generate; pnpm test (82 pass, 0 fail); pnpm run test:marketplace (30 checks)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "sm-bm-app has no indexable page: robots.txt Disallow, robots meta, X-Robots-Tag in both server blocks and the location with its own add_header"
+    requirement: D-72
+    verification:
+      - kind: unit
+        ref: "bash ../sm-bm-app/scripts/check-noindex.sh (check-noindex: ok; three negative runs fail)"
+        status: pass
+    human_judgment: false
+  - id: D6
+    description: "Patches apply cleanly to the live HEADs"
+    verification:
+      - kind: other
+        ref: "git apply --check of all four patches (sm-summercmsio-app with --allow-empty)"
+        status: pass
+    human_judgment: false
+  - id: D7
+    description: "The demo's noindex set covers only browser-only or private routes (D-70 values prohibition); subscriptions is marked signed-in per P33-48 although its plan list is visible to visitors"
+    requirement: D-70
+    verification: []
+    human_judgment: true
+    rationale: "Whether /subscriptions (plans shown to visitors, subscribing needs an account) counts as a signed-in page is a product judgement for Jakub at 33-14's release checkpoint"
+
+duration: 50min
+completed: 2026-11-04
+status: complete
+---
+
+# Phase 33 Plan 12: Demo, summercms.io and bm on the Phase 33 stack Summary
+
+**The demo runs end to end on local links: CMS head, one graph, breadcrumbs, the sitemap index through vue-seo-layer, a CMS redirect enforced by Nuxt, D-70/D-23 noindex. Release patches for the demo and summercms.io apply to the current HEADs, and bm is noindexed by file, meta and header. The run also found that the demo's cookie-based Polish leaves 8 of 23 sitemap addresses (all `/pl/...`) answering 404.**
+
+## Performance
+
+- **Duration:** about 50 min (16:25Z to 17:15Z)
+- **Tasks:** 3 of 3
+- **Files:**
+  - four patches and a wiring note in the phase directory;
+  - six files in sm-bm-app;
+  - deferred-items.md and WINDOWS.md.
+
+## Ports and wiring
+
+Ports:
+- Go `127.0.0.1:8120`. dev.sh uses 8097; the other port avoids a clash with a running dev stack.
+- Nuxt `127.0.0.1:3020`.
+- Scratch Postgres `127.0.0.1:55561` (container `sm-demo-pg-scratch33`, now removed).
+- 33-13's Nuxt `3016` and its two worktrees were not touched.
+
+33-12-local-wiring.md has every command.
+
+The plan's Task 1 verify line uses the default `SMOKE_SEO_API=http://127.0.0.1:8097`. This run needs `SMOKE_SEO_API=http://127.0.0.1:8120`.
+
+## Accomplishments
+
+### Task 1: tracer, demo end to end on local links
+
+The tracer gate passed: `<verify>` was re-run after the fixes, and it ended `smoke-seo: ok`.
+
+**Setup:**
+- worktrees under `../../scratch-33`;
+- a scratch go.work with sm-journal-plugin, sm-sitemap-plugin, sm-seo-plugin and the framework replace;
+- pnpm 12 overrides for the four layers;
+- `summer build`;
+- a fresh Postgres, then `migrate`, `admin:create` and `demo:seed` (posts with categories and Polish translations);
+- `SUMMER_ENV=production` with local overrides, so the staging lock does not mask the noindex checks;
+- `sitemap:rebuild`;
+- the `seo-pages.csv` import.
+
+**Final smoke** (`$S/smoke-seo-final.txt`):
+
+```
+ok   /blog/welcome-to-summercms answers 200
+ok   /blog/welcome-to-summercms has one ld+json script
+ok   /blog/welcome-to-summercms ld+json is one @graph
+ok   /blog/welcome-to-summercms has one canonical
+ok   /blog/welcome-to-summercms has 3 hreflang links
+ok   /blog/welcome-to-summercms has nav.seo-breadcrumbs (2 links)
+ok   /blog/welcome-to-summercms title is the CMS title (Welcome to SummerCMS)
+ok   /blog/welcome-to-summercms X-Robots-Tag is the CMS's (index, follow)
+ok   alternate /blog/welcome-to-summercms answers 200
+WARN alternate /pl/blog/welcome-to-summercms answers 404
+ok   /sitemap.xml is a sitemap index (application/xml)
+ok   /sitemap-authors-1.xml answers a urlset through the site
+WARN sitemap address /pl/blog/author/summercms-team answers 404
+ok   /sitemap-categories-1.xml answers a urlset through the site
+WARN sitemap address /pl/blog/category/uncategorized answers 404   (and news, guides)
+ok   /sitemap-pages-1.xml answers a urlset through the site
+ok   /sitemap-posts-1.xml answers a urlset through the site
+WARN sitemap address /pl/blog/welcome-to-summercms answers 404    (and the other three posts)
+ok   23 sitemap addresses fetched, 8 not 200
+ok   no address is listed twice in the sitemaps
+ok   /robots.txt names the sitemap index
+ok   /p/smoke-seo (200) sends X-Robots-Tag: noindex, nofollow
+ok   /presentations/new (200) sends X-Robots-Tag: noindex, nofollow
+ok   /login (200) sends X-Robots-Tag: noindex, nofollow
+ok   /register (200) sends X-Robots-Tag: noindex, nofollow
+ok   /account/security (200) sends X-Robots-Tag: noindex, nofollow
+ok   /login has the robots meta noindex, nofollow
+ok   / (200) links the HTML sitemap in the footer
+ok   /sitemap lists /blog/welcome-to-summercms
+ok   /smoke-seo-old-1793811624-4025853 answers 301 to /blog/welcome-to-summercms (SEO plugin redirect 4)
+ok   the registry lists the reported routes: / /blog /chat /contact /faq /forum /quizzes
+ok   /smoke-seo-missing-1793811625-4025853 answers 404
+ok   /smoke-seo-missing-1793811625-4025853 reached the 404 log (entry 12)
+smoke-seo: ok
+```
+
+**Negative run** on rome-like sitemap data (the migrated additional addresses `/` and `/subscriptions`), which the smoke must catch:
+
+```
+FAIL sitemap address /subscriptions answers X-Robots-Tag: noindex, nofollow
+FAIL addresses listed more than once in the sitemaps: /
+```
+
+### Task 2: release patches
+
+**33-12-sm-demo-app.patch** (13 files):
+- config:
+  - `config/golem15.journal.yaml` (new, `tag_pages: false`);
+  - `config/golem15.sitemap.yaml` (new, `site_url: https://demo.summercms.io`);
+  - `config/golem15.seo.yaml` (`route_report_token: ""` from the environment).
+- deploy files:
+  - `deploy/env.example` and `deploy/site.env.example`: SEO tokens and the `NUXT_SEO_*` bases; `NUXT_PUBLIC_SITE_URL` and `NUXT_PUBLIC_SITEMAP_URL` dropped, since nothing reads them;
+  - `deploy/nginx/demo.summercms.io.conf`: `= /sitemap.xml` and `= /sitemap.xsl` dropped;
+  - `deploy/seo-pages.csv` (new).
+- DEPLOY.md:
+  - the overview, the one-time setup with the SEO tokens, and the rewritten SEO section;
+  - the "Before" and "After the first release with Phase 33" steps (the token append refuses when a key exists and was dry-run twice; the additional-address cleanup and the CSV import were tested on the scratch backend);
+  - the smoke-seo.sh usage.
+- README.md.
+- `scripts/check-deploy.sh`: refuses `/_seo`, `/_sitemap` and `/sitemap*` locations.
+- `scripts/smoke.sh`:
+  - runs `sitemap:rebuild` and checks the index on Go and, through the site, `/sitemap.xml`, `sitemap-posts-1.xml` and `/robots.txt`;
+  - starts the site with `NUXT_SEO_API_BASE`;
+  - replaces the deck check that relied on nuxt-site-config's `window.__NUXT_SITE_CONFIG__` with the empty-app-root and `X-Robots-Tag` check.
+- `scripts/smoke-seo.sh` (new, 0755).
+- `seo_output_test.go` (new).
+
+**33-12-vue-demo-app.patch** (18 files):
+- nuxt.config.ts:
+  - `site`, `robots`, `linkChecker` and `public.sitemapUrl` removed;
+  - `seo: { noindexRoutes: ['/p/**', '/presentations/**'] }`;
+  - `runtimeConfig.seo.apiBase` and `public.seo.apiBase: '/api/__seo__'`.
+- Page meta, per P33-48:
+  - `seo: { robots: 'noindex, nofollow' }` on login, register, connect and link-admin;
+  - `requiresAuth: true` on account/security, subscriptions, friends, call/[conversation] and forum/t/[id];
+  - `seo: { robots: 'noindex' }` on quizzes/[slug] (login required) and roadmap (a redirect only);
+  - the robots value dropped from the three /presentations pages (noindexRoutes covers them).
+- The footer's XML sitemap link is replaced by `<SeoSitemapLink />`, and the unused `footer.sitemap` labels are dropped.
+- The patch adds no `useSeoMeta(` line with a robots value.
+
+**33-12-vue-summercmsio-app.patch:**
+- `changelog/nuxt.config.ts`: `seo: { cms: false, htmlSitemap: false }`;
+- `changelog/testing/expect.txt`: 12 lines, covering title, canonical ×1, ld+json ×1, h1 ×1, no breadcrumbs, 404 for /sitemap and /mapa-strony, and `resolves * 0`.
+
+The card and heading markup needed no expectation change: the app overrides PostCard, PostList and IndexHeader, so the layer's new card markup does not reach it.
+
+**33-12-sm-summercmsio-app.patch:** the single note line. It needs `git apply --check --allow-empty` (see Deviations).
+
+**Results:**
+- demo:
+  - build passes, and fails without the noindexRoutes line;
+  - `go vet ./...`, `go test -short ./...` and `go test -tags summercms_mcp -count=1 ./...` (Docker) pass;
+  - `scripts/smoke.sh bin/demo` ends `smoke: ok`;
+  - `scripts/check-deploy.sh` ends `check-deploy: ok`;
+  - `pnpm test` gives 225/225.
+- summercms.io:
+  - `test:changelog` gives 89 checks;
+  - `generate` passes;
+  - `pnpm test` gives 82 pass, 0 fail;
+  - `test:marketplace` gives 30 checks;
+  - Go `go test ./...` passes on the wiring.
+
+**Cleanup:** the four worktrees were removed with `git worktree remove --force` after the patch commits. The demo worktree was recreated once for the TestSEOOutput fix and removed again. `git worktree list` shows only the main checkouts. The scratch Postgres and both servers are stopped. Ports 8120, 3020 and 55561 are free.
+
+### Task 3: sm-bm-app (D-72)
+
+- **Changes:**
+  - `frontend/public/robots.txt`;
+  - the robots meta in `frontend/index.html`;
+  - `add_header X-Robots-Tag "noindex, nofollow" always;` in both server blocks and in `location = /prezentacje/AW_tematy-prezentacji.html`;
+  - `scripts/check-noindex.sh`;
+  - DEPLOY.md, "Search engines (noindex)";
+  - one README line.
+- **Check:** `check-noindex: ok`. Removing the header from the port-80 server, the header from the location, or the meta each fails with its own line.
+- **Commit:** bd7ee84 on master, local, not pushed.
+- **sm-bm-app `.planning`:** there were no other-session `.planning` changes to preserve; `git status --short .planning` was empty before and after.
+
+## Task Commits
+
+| Repo | Commit | Message |
+|------|--------|---------|
+| summercms.go | e1d5110 | docs(33-12): app patches for the release |
+| summercms.go | 298c81d | docs(33-12): demo patch tags a post in TestSEOOutput |
+| sm-bm-app | bd7ee84 | feat: keep the app out of search engines (noindex, Disallow) |
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter. The main one: the demo's /pl/ problem is reported, not fixed (Rule 4).
+
+## Deviations from Plan
+
+### Auto-fixed and plan-shape deviations
+
+**1. [Rule 1 - Bug] TestSEOOutput's tag check was vacuous**
+- **Found during:** Task 2, after the first patch commit.
+- **Issue:** demo:seed creates no tag, so the test passed without `config/golem15.journal.yaml` too.
+- **Fix:** the test tags the seeded post and requires `/blog/tag/releases` to resolve `not_found`. Without the config the test fails: `resolves "ok", want not_found`.
+- **Commit:** 298c81d. The patch was regenerated and re-checked.
+
+**2. [Rule 1 - Bug] The live run never served `config/golem15.journal.yaml`**
+- **Found during:** cleanup.
+- **Issue:** the first manually started Go process kept port 8120, because its pid file recorded the subshell's pid. The later restarts could not bind the port. The local stack therefore served the config as it was at the first start, plus the env overrides.
+- **Effect:** every smoke result stands, because none depends on the files added later. `tag_pages: false` is proven by TestSEOOutput only.
+
+**3. [Rule 3 - Blocking] The release smoke depended on nuxt-site-config**
+- **Issue:** `scripts/smoke.sh` used `window.__NUXT_SITE_CONFIG__` to prove the deck page renders in the browser only. That module left with @nuxtjs/seo.
+- **Fix:** replaced by the empty `#__nuxt` root and the declared `X-Robots-Tag`. The smoke also starts the site with `NUXT_SEO_API_BASE` and checks the new sitemap format.
+
+**4. [Rule 2 - Missing] Registry pages lose their titles**
+- **Issue:** the route report creates registry pages named from their path ("Home", "Faq").
+- **Fix:** `deploy/seo-pages.csv` and a DEPLOY import step bring back "SummerCMS Demo" and "FAQ", as P33-50 does for 33-13's site. Tested: the import applied with 2 changed and 0 refused, and the titles showed at once.
+
+**5. [Rule 2 - Missing] Migrated sitemap addresses on rome**
+- **Issue:** on rome the old sitemap definition becomes additional addresses (`/`, `/blog`, `/faq`, `/subscriptions`). That gives duplicates and a noindex address in the sitemap.
+- **Fix:** DEPLOY.md's "After the first release" removes them through `PUT /_sitemap/api/v1/settings` (tested on the scratch backend). smoke-seo.sh now fails on duplicates and on noindex addresses.
+
+**6. [Rule 2 - Missing] HTML sitemap pages on summercms.io's changelog**
+- **Issue:** the layer registered `/sitemap` and `/mapa-strony` pages, which only answer 404 there.
+- **Fix:** `htmlSitemap: false` next to `cms: false`. The expectations pin both 404s.
+
+**7. Plan assumption: the empty patch**
+- **Plan:** "git apply treats it as an empty patch".
+- **Actual:** plain `git apply --check` answers `error: No valid patches in input (allow with "--allow-empty")`, exit 128. With `--allow-empty` it exits 0.
+- **For 33-14:** use the flag or skip the file.
+
+**8. Scope additions to the demo patch**
+- **Added beyond the plan's list:** check-deploy.sh, smoke.sh, README.md, `deploy/env.example`, `deploy/site.env.example`, `deploy/seo-pages.csv` and `config/golem15.journal.yaml`.
+- **Why:** each was needed for the new format or for correct output.
+
+**9. P33-48 followed for `/subscriptions`**
+- **What:** the page gets `requiresAuth: true`, as P33-48 says. The plan list is visible to visitors.
+- **Open:** whether that is "signed-in" is listed as D7 (human judgement) for 33-14's checkpoint.
+
+### Auth gates
+
+None.
+
+## Issues Encountered
+
+**The demo's cookie-based Polish** (deferred-items.md, WINDOWS #34). The demo serves Polish from a cookie at one address, but the CMS names `/pl/…` addresses, which affects three outputs:
+- hreflang;
+- the sitemaps: 8 of 23 addresses, all 404;
+- the Polish visitor's head: English CMS title over a Polish body.
+
+Fixing it means moving the demo to `prefix_except_default`, which reverses D-13. **33-14 or Jakub must decide this before the demo patches are applied.**
+
+Other findings, all in deferred-items.md:
+- **Sitemap duplicates** (WINDOWS #35): the sitemap plugin does not de-duplicate additional addresses against content records.
+- **Noindex additional addresses:** an additional address the site serves noindex stays listed.
+- **Tag pattern in the site answer:** the SEO site answer lists `journal-tag` with `tag_pages: false` (a drift warning at every start).
+- **Duplicate type export:** vue-journal-layer warns `Duplicated imports "JournalImageVariant"` on every build.
+
+**Local quirks** (in the wiring note):
+- the admin login throttle (5 a minute);
+- `cp` is interactive in this shell (`/bin/cp -f`);
+- `go build ./...` in sm-summercmsio-app drops a binary in the repository root (that is the untracked `sm-summercmsio-app` file in the live checkout);
+- the secret-read guard blocks `.env` files, so the run variables lived in `$S/demo-run.vars` and were deleted at cleanup.
+
+## For 33-14
+
+**Pins:**
+- sm-demo-app:
+  - go.mod requires and submodule pointers for sm-journal-plugin, sm-sitemap-plugin and sm-seo-plugin (all three move together, because the SEO plugin needs the sitemap `contract`), plus summercms v0.6.1;
+  - then `summer build` (plugins.gen.go), then apply 33-12-sm-demo-app.patch.
+- vue-demo-app: pins vue-journal-layer v0.8.0, vue-menu-layer v0.5.0 and vue-faq-layer v0.5.0. vue-seo-layer comes in through them; add a direct pin if the layers' `link:` dependency becomes a git pin. Then apply 33-12-vue-demo-app.patch.
+- sm-summercmsio-app: summercms v0.6.1 and sm-journal-plugin (submodule and require). Skip the empty patch, or apply it with `--allow-empty`.
+- vue-summercmsio-app: vue-journal-layer v0.8.0, then apply 33-12-vue-summercmsio-app.patch. The changelog still gets @nuxtjs/seo from the landing ('..'), so the canonical and graph stay single.
+- sm-bm-app:
+  - robots.txt and the meta reach rome only after `npm --prefix frontend run build` is committed in the jz.bm plugin repository (`jakub/sm-bm-plugin`, `plugins/jz/bm/public`), pushed, and the pointer bumped. 33-12 committed only in sm-bm-app.
+  - The nginx header is inserted into the live vhost by hand (DEPLOY.md, "Search engines (noindex)").
+
+**Linking decision:**
+- **Demo:** `scripts/build.sh` builds the release with `CGO_ENABLED=0` and no `nodynamic`, which gives a dynamically linked binary (checked: "dynamically linked"; with `-tags summercms_mcp,nodynamic` "statically linked").
+- **summercms.io:** `scripts/build.sh` uses `CGO_ENABLED=0`, and the scratch build is "dynamically linked".
+- **grzybyfunkcjonalne:** `CGO_ENABLED=0` as well (not built here).
+- **DEPLOY.md:** both the demo's and summercms.io's say "(linux/amd64, static)". Add `nodynamic` or change that line.
+
+**Rome steps:**
+- the "Before" and "After the first release with Phase 33" blocks in the demo's DEPLOY.md: SEO tokens, NUXT_SEO bases, the vhost without the sitemap locations, clearing the additional addresses, `sitemap:rebuild`, the seo-pages.csv import;
+- `journal:image-variants` once per site with Journal (33-11).
+
+**Release-note items:**
+- **Demo:** sitemap index and per-type files served by the site; `/sitemap.xsl` gone; noindex on decks and auth/signed-in pages; HTML sitemap link in the footer; page titles from the SEO plugin.
+- **summercms.io:** changelog on the new journal layer with the SEO layer off.
+- **bm:** noindex everywhere.
+
+## Known Stubs
+
+None. Two items are open (not stubs) and are in deferred-items.md and WINDOWS: the demo's `/pl/` WARN lines and the sitemap duplicates.
+
+## Threat Flags
+
+| Flag | File | Description |
+|------|------|-------------|
+| threat_flag: credential-handling | sm-demo-app scripts/smoke-seo.sh | Logs in as an admin to create and delete a redirect and a 404 log entry. The password is read from a file or the environment and passed through stdin and a temp file under mktemp, never argv; the token goes through `-H @file`; it logs out at exit. The default password is scripts/dev.sh's local admin. |
+| threat_flag: secret-file-edit | sm-demo-app DEPLOY.md | The "Before the first release" block appends tokens to .env and site.env on rome and deletes two unused keys. It prints no value and refuses when a key exists. |
+
+## Self-Check: PASSED
+
+- FOUND: 33-12-sm-demo-app.patch, 33-12-vue-demo-app.patch, 33-12-sm-summercmsio-app.patch, 33-12-vue-summercmsio-app.patch, 33-12-local-wiring.md (phase directory)
+- FOUND: ../sm-bm-app/frontend/public/robots.txt, ../sm-bm-app/scripts/check-noindex.sh
+- FOUND commits: e1d5110, 298c81d (summercms.go), bd7ee84 (sm-bm-app)
+- `git apply --check` passes for all four patches against the live HEADs (the empty one with `--allow-empty`)
+- `bash ../sm-bm-app/scripts/check-noindex.sh` gives `check-noindex: ok`
+- `grep -c noindexRoutes 33-12-vue-demo-app.patch` gives 1
+- No scratch worktree of this plan remains, and none of this plan's processes are listening

.planning/phases/33-seo-output-audit-and-content/33-12-local-wiring.md

@@ -0,0 +1,202 @@
+# 33-12 local wiring (P33-46)
+
+How plan 33-12 ran the demo and summercms.io against the unreleased Phase 33 repositories, without pushing or tagging anything. 33-13 and 33-14 repeat these steps. Nothing here is committed to an application repository: the wiring (go.work, pnpm overrides, lockfiles, `plugins.gen.go`) stays in the scratch worktrees, and the patches carry only the changes that stay after the release (P33-47).
+
+## Paths and ports
+
+| What | Value |
+|------|-------|
+| Scratch directory | `/media/nvme/dev/golem15/summercms.io/scratch-33` (`$S`; outside every repository) |
+| Sibling root | `/media/nvme/dev/golem15/summercms.io/summercms` (`$R`) |
+| Demo Go binary | `127.0.0.1:8120` (dev.sh uses 8097; 8120 avoids a clash with a running dev stack) |
+| Demo Nuxt server | `127.0.0.1:3020` (the dev.sh port; app.url and the site URLs point at it) |
+| Scratch Postgres | `127.0.0.1:55561`, container `sm-demo-pg-scratch33`, postgres:17-alpine (sm-demo-pg on 55540 untouched) |
+| 33-13's site | Nuxt `127.0.0.1:3016`, worktrees `$S/sm-grzybyfunkcjonalne-app` and `$S/vue-grzybyfunkcjonalne-app` (not touched by 33-12) |
+
+Repository heads used: sm-demo-app da481c9, vue-demo-app 9a12701, sm-summercmsio-app ca06049, vue-summercmsio-app f36cbf1; sm-seo-plugin 49cc241, sm-sitemap-plugin 9e5c393, sm-journal-plugin 4f5bd19, vue-seo-layer 7af91fc, vue-journal-layer 1080a3f, vue-menu-layer 8b5da67, vue-faq-layer f7ec4fe, summercms.go at the 33-11 commits.
+
+## Worktrees
+
+```sh
+S=/media/nvme/dev/golem15/summercms.io/scratch-33
+R=/media/nvme/dev/golem15/summercms.io/summercms
+mkdir -p $S
+git -C $R/sm-demo-app worktree add --detach $S/sm-demo-app HEAD
+git -C $R/sm-demo-app/vue-demo-app worktree add --detach $S/vue-demo-app HEAD
+git -C $R/sm-summercmsio-app worktree add --detach $S/sm-summercmsio-app HEAD
+git -C $R/sm-summercmsio-app/vue-summercmsio-app worktree add --detach $S/vue-summercmsio-app HEAD
+```
+
+A worktree's submodules are empty. The Go wiring points at the live checkouts' plugin submodules, and the Nuxt app lives in its own worktree. Tests that read the site from inside the Go repository need the empty directory replaced by a symlink for the run, and then restored before the patch is made:
+
+```sh
+rmdir $S/sm-demo-app/vue-demo-app && ln -s $S/vue-demo-app $S/sm-demo-app/vue-demo-app   # scripts/smoke.sh
+/bin/rm -f $S/sm-demo-app/vue-demo-app && mkdir $S/sm-demo-app/vue-demo-app              # before git diff
+```
+
+The same applies to `$S/sm-summercmsio-app/vue-summercmsio-app` for `TestTerminalScript`.
+
+## Go: sm-demo-app
+
+`$S/sm-demo-app/go.work` replaces the committed one. It uses the live plugin submodules, except the three Phase 33 plugins, which come from the sibling checkouts. The SEO plugin needs the sitemap plugin's `contract` package, which the demo's pinned v0.1.2 submodule lacks.
+
+```sh
+cd $S/sm-demo-app
+{
+echo "go 1.27.0"; echo; echo "toolchain go1.27.0"; echo; echo "use ("; echo "	."
+for p in chat chatbots chatchannels chatvideo faq feedback forum golem herald menu mfa moderation oauthserver pgstripe presentations quizzes sociallogin translate userfriends; do echo "	$R/sm-demo-app/plugins/golem15/$p"; done
+echo "	$R/sm-journal-plugin"; echo "	$R/sm-seo-plugin"; echo "	$R/sm-sitemap-plugin"; echo ")"; echo
+echo "replace git.golem15.com/golem15/summercms => $R/summercms.go"; echo
+echo "replace ("
+echo "	git.golem15.com/golem15/sm-paymentgateway-plugin => $R/sm-demo-app/plugins/golem15/paymentgateway"
+echo "	git.golem15.com/golem15/sm-paymentgatewaysubscriptions-plugin => $R/sm-demo-app/plugins/golem15/paymentgatewaysubscriptions"
+echo "	git.golem15.com/golem15/sm-user-plugin => $R/sm-demo-app/plugins/golem15/user"
+echo ")"
+} > go.work
+cp $R/sm-demo-app/go.work.sum .
+(cd $R/summercms.go && go build -o $S/summer ./cmd/summer)   # the CLI from the framework HEAD
+$S/summer build                                               # bin/demo (tags summercms_mcp); regenerates plugins.gen.go
+```
+
+`summer build` rewrites `plugins.gen.go` with the sibling versions (`v0.3.1-11-g4f5bd19` and the like). That file is wiring: 33-14 regenerates it on the real pins.
+
+## Go: sm-summercmsio-app
+
+Its `go.mod` replaces the plugins with `./plugins/golem15/*`, which are empty in a worktree. `go.work` replaces them at every version and uses only the app. Listing the plugins under `use` as well fails with "workspace module … is replaced at all versions".
+
+```sh
+cd $S/sm-summercmsio-app
+cat > go.work <<EOF
+go 1.27.0
+
+toolchain go1.27.0
+
+use .
+
+replace git.golem15.com/golem15/summercms => $R/summercms.go
+
+replace (
+	git.golem15.com/golem15/sm-journal-plugin => $R/sm-journal-plugin
+	git.golem15.com/golem15/sm-summercmsio-plugin => $R/sm-summercmsio-app/plugins/golem15/summercms
+	git.golem15.com/golem15/sm-translate-plugin => $R/sm-summercmsio-app/plugins/golem15/translate
+	git.golem15.com/golem15/sm-user-plugin => $R/sm-summercmsio-app/plugins/golem15/user
+)
+EOF
+cp $R/sm-summercmsio-app/go.work.sum .
+$S/summer build
+```
+
+Don't run `go build ./...` in the module root: it writes the binary `sm-summercmsio-app` there. The untracked `sm-summercmsio-app` file in the live checkout is such a binary.
+
+## Nuxt: pnpm overrides
+
+The same four lines go in each Nuxt worktree's `pnpm-workspace.yaml`. pnpm 12 reads `overrides:` there, and they apply at every depth, so the journal, menu and faq layers' own `link:../vue-seo-layer` resolves to the same checkout:
+
+```sh
+for d in $S/vue-demo-app $S/vue-summercmsio-app; do cat >> $d/pnpm-workspace.yaml <<EOF
+overrides:
+  vue-seo-layer: link:$R/vue-seo-layer
+  vue-journal-layer: link:$R/vue-journal-layer
+  vue-menu-layer: link:$R/vue-menu-layer
+  vue-faq-layer: link:$R/vue-faq-layer
+EOF
+done
+(cd $S/vue-demo-app && pnpm install && pnpm exec nuxt build)
+export NUXT_PUBLIC_SUMMERCMS_VERSION=v0.6.1   # the summercms.io worktree has no ../go.mod
+(cd $S/vue-summercmsio-app && pnpm install && pnpm run build:changelog && pnpm run test:changelog && pnpm run generate)
+```
+
+`pnpm install` rewrites `pnpm-lock.yaml` (wiring, left out of the patches). The build warns `Duplicated imports "JournalImageVariant"` (vue-journal-layer exports the type from two utils; harmless, deferred-items.md).
+
+## The demo stack
+
+The run variables live in `$S/demo-run.vars` (mode 0600, outside every repository). The tokens are generated per run and never printed (T-33-56):
+
+```sh
+rnd() { head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n'; }
+(umask 077; cat > $S/demo-run.vars <<EOF
+SUMMER_ENV=production
+SUMMER_DATABASE__DSN=postgres://summercms_demo:summercms_demo@127.0.0.1:55561/summercms_demo?sslmode=disable
+SUMMER_APP__KEY=$(head -c 32 /dev/urandom | base64)
+SUMMER_ADMIN__JWT__SECRET=$(head -c 32 /dev/urandom | base64)
+SUMMER_GOLEM15__USER__JWT__SECRET=$(head -c 32 /dev/urandom | base64)
+SUMMER_GOLEM15__DEMO__VISITOR__EMAIL=visitor@example.test
+SUMMER_GOLEM15__DEMO__VISITOR__PASSWORD=$(rnd | cut -c1-24)
+SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN=$(rnd)
+SUMMER_GOLEM15__SEO__ROUTE_REPORT_TOKEN=$(rnd)
+SUMMER_SITE_CACHE__PURGE_URL=http://127.0.0.1:3020/api/__site__/cache/purge
+SUMMER_SITE_CACHE__PURGE_TOKEN=$(rnd)
+SUMMER_APP__URL=http://127.0.0.1:3020
+SUMMER_GOLEM15__SEO__SITE_URL=http://127.0.0.1:3020
+SUMMER_GOLEM15__SITEMAP__SITE_URL=http://127.0.0.1:3020
+SUMMER_MCP__RESOURCE=http://127.0.0.1:3020/mcp
+SUMMER_GOLEM15__OAUTHSERVER__MCP__RESOURCE=http://127.0.0.1:3020/mcp
+SUMMER_REALTIME__DRIVER=null
+SUMMER_GOLEM15__USER__REGISTRATION__USE_REGISTER_THROTTLE=false
+EOF
+)
+```
+
+`SUMMER_ENV=production` matters. Outside production, the SEO plugin answers every page `noindex, nofollow` (staging lock), and the noindex checks would prove nothing. The local overrides replace the production overlay's demo.summercms.io addresses. A file named `.env` cannot be used from an agent session, because the secret-read guard blocks any command that touches it.
+
+```sh
+docker run -d --name sm-demo-pg-scratch33 -e POSTGRES_DB=summercms_demo -e POSTGRES_USER=summercms_demo \
+	-e POSTGRES_PASSWORD=summercms_demo -p 127.0.0.1:55561:5432 postgres:17-alpine
+cd $S/sm-demo-app && mkdir -p logs storage/app/uploads/public
+set -a; . $S/demo-run.vars; set +a
+./bin/demo migrate
+printf '%s\n' 'AdminDemo123!' | ./bin/demo admin:create --email admin@example.test --login admin --superuser
+./bin/demo demo:seed                 # Journal posts with categories and Polish translations
+bash $S/run-demo-go.sh               # bin/demo serve --addr 127.0.0.1:8120 (pid in logs/go.pid)
+bash $S/run-demo-nuxt.sh             # node .output/server/index.mjs on 127.0.0.1:3020 (pid in $S/logs/demo-nuxt.pid)
+./bin/demo sitemap:rebuild           # after the Nuxt start, so the reported pages are listed
+```
+
+`run-demo-nuxt.sh` passes the Nuxt server, under `env -i`, every `NUXT_*_API_BASE` at `http://127.0.0.1:8120`, plus `NUXT_SEO_API_BASE=http://127.0.0.1:8120/_seo/api/v1`, `NUXT_SEO_BACKEND_BASE=http://127.0.0.1:8120`, `NUXT_SEO_NOTFOUND_TOKEN`, `NUXT_SEO_ROUTE_REPORT_TOKEN` and `NUXT_CACHE_PURGE_TOKEN`, all from the vars file. `stop-demo.sh` stops both servers. The page titles of `deploy/seo-pages.csv` were imported with `POST /_seo/api/v1/import` (`{"dataset": "records", "csv": …}`), as DEPLOY.md's "After the first release with Phase 33" describes.
+
+## Checks
+
+```sh
+cd $S/sm-demo-app
+SMOKE_SEO_API=http://127.0.0.1:8120 bash scripts/smoke-seo.sh http://127.0.0.1:3020    # smoke-seo: ok
+go vet ./... && go test -short ./...
+go test -tags summercms_mcp -count=1 ./...                                         # Docker (testcontainers)
+go test -tags summercms_mcp -run 'TestSEOOutput|TestSEOTabMounted|TestBootAllPlugins' -count=1 -v .
+bash scripts/smoke.sh bin/demo                                                     # with the vue-demo-app symlink
+bash scripts/check-deploy.sh
+cd $S/vue-demo-app && pnpm test
+```
+
+The admin login is throttled to 5 attempts a minute per address. The smoke logs in once, so two runs in the same minute after other logins answer 429; wait a minute.
+
+The SEO smoke is also kept outside the worktrees as `$S/33-12-smoke-seo.sh`, for 33-13 to reuse.
+
+## Patches
+
+```sh
+cd $S/sm-demo-app && git add -N config/golem15.journal.yaml config/golem15.sitemap.yaml deploy/seo-pages.csv scripts/smoke-seo.sh seo_output_test.go
+git diff --binary -- DEPLOY.md README.md config/golem15.journal.yaml config/golem15.seo.yaml config/golem15.sitemap.yaml \
+	deploy/env.example deploy/nginx/demo.summercms.io.conf deploy/seo-pages.csv deploy/site.env.example \
+	scripts/check-deploy.sh scripts/smoke-seo.sh scripts/smoke.sh seo_output_test.go > 33-12-sm-demo-app.patch
+cd $S/vue-demo-app && git diff --binary -- $(git diff --name-only | grep -v '^pnpm-') > 33-12-vue-demo-app.patch
+cd $S/vue-summercmsio-app && git diff --binary -- changelog/nuxt.config.ts changelog/testing/expect.txt > 33-12-vue-summercmsio-app.patch
+printf '# no change beyond the pin bumps in 33-14\n' > 33-12-sm-summercmsio-app.patch
+git -C $R/sm-demo-app apply --check 33-12-sm-demo-app.patch
+git -C $R/sm-demo-app/vue-demo-app apply --check 33-12-vue-demo-app.patch
+git -C $R/sm-summercmsio-app/vue-summercmsio-app apply --check 33-12-vue-summercmsio-app.patch
+git -C $R/sm-summercmsio-app apply --check --allow-empty 33-12-sm-summercmsio-app.patch   # without --allow-empty: "No valid patches in input"
+```
+
+## Cleanup
+
+```sh
+bash $S/stop-demo.sh
+docker rm -f sm-demo-pg-scratch33
+/bin/rm -f $S/demo-run.vars
+git -C $R/sm-demo-app worktree remove --force $S/sm-demo-app
+git -C $R/sm-demo-app/vue-demo-app worktree remove --force $S/vue-demo-app
+git -C $R/sm-summercmsio-app worktree remove --force $S/sm-summercmsio-app
+git -C $R/sm-summercmsio-app/vue-summercmsio-app worktree remove --force $S/vue-summercmsio-app
+```
+
+`--force` is needed because the worktrees hold the wiring and build output. The patches are committed before the removal.

.planning/phases/33-seo-output-audit-and-content/33-12-sm-demo-app.patch

@@ -0,0 +1,975 @@
+diff --git a/DEPLOY.md b/DEPLOY.md
+index 19b6300..f2f4d0b 100644
+--- a/DEPLOY.md
++++ b/DEPLOY.md
+@@ -23,11 +23,12 @@ internet ──> Cloudflare (proxied, like summercms.io) ──443──> nginx
+                                                               │     /_paymentgatewaysubscriptions/ /_presentations/ /_quizzes/
+                                                               │     /_feedback/ /_demo/ /webhook/stripe/ /storage/app/uploads/public/
+                                                               │     /_chat/ /_chatchannels/ /_chatbots/ /_chatvideo/ /_forum/ /_userfriends/
+-                                                              │     = /api/realtime/token  = /sitemap.xml  = /sitemap.xsl
++                                                              │     = /api/realtime/token  = /robots.txt
+                                                               │     = /mcp (unbuffered)  /.well-known/oauth-protected-resource*
+                                                               │     = /.well-known/oauth-authorization-server  /oauth/mcp/
+                                                               └── everything else (GET/HEAD) ...... 127.0.0.1:3098  summercms-demo-site (Nuxt SSR on Node)
+                                                                                                        │ server-side API calls to 127.0.0.1:8098
++                                                                                                       │ (also /sitemap.xml and its files, through vue-seo-layer)
+ bin/demo ── PostgreSQL 15 (database summercms_demo, role summercms_demo) ── storage/ (uploads)
+          └─ jobs in-process (Stripe webhooks); site-cache purge POST to 127.0.0.1:3098 (loopback only)
+          └─ publishes the phone remote's messages to Centrifugo's HTTP API on 127.0.0.1:8010
+@@ -138,11 +139,12 @@ DBPW=$(openssl rand -hex 24)
+ printf "CREATE ROLE summercms_demo LOGIN PASSWORD '%s';\n" "$DBPW" | sudo -u postgres psql -v ON_ERROR_STOP=1 -q
+ sudo -u postgres createdb -O summercms_demo -E UTF8 summercms_demo
+ 
+-# .env and site.env, root:summercms-demo 0640. The purge token is shared
+-# (site.env names it NUXT_CACHE_PURGE_TOKEN, never NUXT_SITE_*: see Secrets).
++# .env and site.env, root:summercms-demo 0640. The purge token and the two
++# SEO tokens are shared (site.env names the purge token NUXT_CACHE_PURGE_TOKEN,
++# never NUXT_SITE_*: see Secrets).
+ sudo install -o root -g summercms-demo -m 0640 /dev/null /srv/summercms-demo/.env
+ sudo install -o root -g summercms-demo -m 0640 /dev/null /srv/summercms-demo/site.env
+-PT=$(openssl rand -hex 32)
++PT=$(openssl rand -hex 32) NT=$(openssl rand -hex 32) RT=$(openssl rand -hex 32)
+ {
+ 	printf 'SUMMER_DATABASE__DSN=postgres://summercms_demo:%s@127.0.0.1:5432/summercms_demo?sslmode=disable\n' "$DBPW"
+ 	printf 'SUMMER_APP__KEY=%s\n' "$(openssl rand -base64 32)"
+@@ -152,6 +154,8 @@ PT=$(openssl rand -hex 32)
+ 	printf 'SUMMER_GOLEM15__DEMO__VISITOR__PASSWORD=%s\n' "$(openssl rand -hex 12)"
+ 	printf 'SUMMER_SITE_CACHE__PURGE_URL=http://127.0.0.1:3098/api/__site__/cache/purge\n'
+ 	printf 'SUMMER_SITE_CACHE__PURGE_TOKEN=%s\n' "$PT"
++	printf 'SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN=%s\n' "$NT"
++	printf 'SUMMER_GOLEM15__SEO__ROUTE_REPORT_TOKEN=%s\n' "$RT"
+ } | sudo tee /srv/summercms-demo/.env >/dev/null
+ {
+ 	grep -v '^#' <<'EOF'
+@@ -160,12 +164,14 @@ NUXT_MENU_API_BASE=http://127.0.0.1:8098/_menu/api/v1
+ NUXT_FAQ_API_BASE=http://127.0.0.1:8098/_faq/api/v1
+ NUXT_PAYMENTGATEWAY_API_BASE=http://127.0.0.1:8098/_paymentgateway/api/v1
+ NUXT_PAYMENTGATEWAYSUBSCRIPTIONS_API_BASE=http://127.0.0.1:8098/_paymentgatewaysubscriptions/api/v1
+-NUXT_PUBLIC_SITE_URL=https://demo.summercms.io
+-NUXT_PUBLIC_SITEMAP_URL=/sitemap.xml
++NUXT_SEO_API_BASE=http://127.0.0.1:8098/_seo/api/v1
++NUXT_SEO_BACKEND_BASE=http://127.0.0.1:8098
+ EOF
+ 	printf 'NUXT_CACHE_PURGE_TOKEN=%s\n' "$PT"
++	printf 'NUXT_SEO_NOTFOUND_TOKEN=%s\n' "$NT"
++	printf 'NUXT_SEO_ROUTE_REPORT_TOKEN=%s\n' "$RT"
+ } | sudo tee /srv/summercms-demo/site.env >/dev/null
+-unset DBPW PT
++unset DBPW PT NT RT
+ ```
+ 
+ The visitor email comes from the build machine's secrets file, piped over SSH (never on a command
+@@ -662,8 +668,8 @@ the 404 log, robots.txt with AI bot switches, history and the `seo_` MCP tools (
+ `golem15.seo.manage`). `config/golem15.seo.yaml` sets `site_url` to `https://demo.summercms.io`.
+ 
+ - **robots.txt moves to Go.** nginx sends `= /robots.txt` to the Go port (`deploy/nginx/demo.summercms.io.conf`);
+-  the Nuxt robots module no longer answers it. Before the first release with the plugin, copy the
+-  `Disallow` lines the Nuxt config writes today (`goPaths` in `vue-demo-app/nuxt.config.ts`: `/_user`,
++  the site has no Nuxt robots module. Before the first release with the plugin, copy the
++  `Disallow` lines the Nuxt config wrote (`goPaths` in `vue-demo-app/nuxt.config.ts`: `/_user`,
+   `/_journal`, `/_menu`, `/_faq`, `/_paymentgateway`, `/_paymentgatewaysubscriptions`, `/_feedback`,
+   `/storage`, `/_presentations`, `/_quizzes`, `/_demo`, `/api/realtime/token`, `/mcp`,
+   `/.well-known/oauth-protected-resource`, `/.well-known/oauth-authorization-server`, `/oauth/mcp/`) into
+@@ -674,11 +680,100 @@ the 404 log, robots.txt with AI bot switches, history and the `seo_` MCP tools (
+   `Disallow: /_forum`, `Disallow: /_userfriends` and `Disallow: /livekit` under `User-agent: *`
+   (`goPaths` lists the six API prefixes). `/_herald` is not routed and needs no line.
+   `scripts/check-live.sh` checks the `/_chat` and `/_forum` lines.
+-- **404 log.** Set `SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN` in `.env` on rome (a random value, never printed
+-  or committed) and the same token in the Nuxt site's environment once the frontend layer reports 404s
+-  (Phase 33); without it the report endpoint stays off.
++- **The site's head comes from the plugin** (vue-seo-layer, through vue-journal-layer, vue-menu-layer and
++  vue-faq-layer). Every page is resolved with the plugin before Nuxt renders it: the title, description,
++  canonical, robots, Open Graph, hreflang and one JSON-LD `@graph` come from the answer, breadcrumbs and
++  pagination are rendered on the server, and redirects and 410s from **SEO › Redirects** apply on the
++  site. Browser navigations resolve through the Nuxt server (`/api/__seo__/resolve`), so `/_seo` has no
++  nginx location. `site.env` names the API (`NUXT_SEO_API_BASE`) and the Go origin of the root files
++  (`NUXT_SEO_BACKEND_BASE`), both on loopback (`deploy/site.env.example`).
++- **404 log and page registry.** `SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN` and
++  `SUMMER_GOLEM15__SEO__ROUTE_REPORT_TOKEN` in `.env`, the same values as `NUXT_SEO_NOTFOUND_TOKEN` and
++  `NUXT_SEO_ROUTE_REPORT_TOKEN` in `site.env` (random, never printed or committed; "One-time server
++  setup" writes them, "Before the first release with Phase 33" below adds them to an existing install).
++  Each 404 page view lands in **SEO › 404 log**; at every start the site reports its static pages (`/`,
++  `/blog`, `/chat`, `/contact`, `/faq`, `/forum`, `/quizzes`), which appear in **SEO › Pages** and the
++  sitemaps. Without a token nothing is reported.
++- **Noindex pages.** The deck routes `/p/**` and `/presentations/**` render in the browser only and are
++  declared in `seo.noindexRoutes` (`vue-demo-app/nuxt.config.ts`; the layer's build guard refuses any other
++  browser-only route, D-70); the auth pages (login, register, connect, link-admin) and the signed-in pages
++  (account security, subscriptions, friends, calls, forum threads) set it in their page meta; quizzes and
++  the roadmap redirect keep `noindex`. All of them answer `X-Robots-Tag: noindex, nofollow` (`noindex`
++  for the two) and stay out of the route report.
++- **Sitemaps** (sm-sitemap-plugin). `/sitemap.xml` is a sitemap index of `/sitemap-<type>-<n>.xml`
++  files (posts, categories, authors, pages), which Nuxt serves from the Go port's `/_sitemap/files/` on
++  loopback: nginx has no `/sitemap*` or `/_sitemap` location (`scripts/check-deploy.sh` checks it) and
++  `/sitemap.xsl` is gone. The addresses start with `golem15.sitemap.site_url`
++  (`config/golem15.sitemap.yaml`, or **Settings › Sitemaps**); without one `/sitemap.xml` answers 404. The
++  demo has no tag pages (`config/golem15.journal.yaml`, `tag_pages: false`), so no tag address is listed.
++  Rebuilds run as jobs in the serve process after each Journal save and nightly. The footer links the
++  HTML sitemap (`/sitemap`, `/mapa-strony` in Polish).
++- **Page titles.** A reported page takes its name from its path ("Home", "Faq") until it has its own SEO
++  title; `deploy/seo-pages.csv` holds the titles and descriptions the pages had before (records by URL,
++  imported once, below).
+ - **Verify** after the release: `curl -s https://demo.summercms.io/robots.txt` shows the copied lines and
+-  the `Sitemap:` line; `curl -sI https://demo.summercms.io/robots.txt` answers 200 `text/plain`.
++  the `Sitemap:` line; `curl -sI https://demo.summercms.io/robots.txt` answers 200 `text/plain`; and from
++  the build machine `SMOKE_SEO_API=… scripts/smoke-seo.sh https://demo.summercms.io` (below) ends with
++  `smoke-seo: ok`.
++
++**Before the first release with Phase 33** (the SEO layer and the new sitemap format), on rome as root
++(`$RSH $ROME 'sudo bash -s'` with a quoted heredoc). It adds the two SEO tokens to both files and
++refuses when either already names one, never printing a value:
++
++```sh
++set -euo pipefail
++E=/srv/summercms-demo/.env S=/srv/summercms-demo/site.env
++n=$(cat "$E" "$S" | { grep -c -E '^(SUMMER_GOLEM15__SEO__(NOTFOUND|ROUTE_REPORT)_TOKEN|NUXT_SEO_)' || true; })
++[ "$n" = 0 ] || { echo "$n SEO keys are already set; edit the files by hand"; exit 1; }
++NT=$(openssl rand -hex 32) RT=$(openssl rand -hex 32)
++printf 'SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN=%s\nSUMMER_GOLEM15__SEO__ROUTE_REPORT_TOKEN=%s\n' "$NT" "$RT" >>"$E"
++printf 'NUXT_SEO_API_BASE=http://127.0.0.1:8098/_seo/api/v1\nNUXT_SEO_BACKEND_BASE=http://127.0.0.1:8098\n' >>"$S"
++printf 'NUXT_SEO_NOTFOUND_TOKEN=%s\nNUXT_SEO_ROUTE_REPORT_TOKEN=%s\n' "$NT" "$RT" >>"$S"
++unset NT RT
++sed -i '/^NUXT_PUBLIC_SITE_URL=\|^NUXT_PUBLIC_SITEMAP_URL=/d' "$S"   # read by nothing since the SEO layer
++```
++
++**After the first release with Phase 33** (the release restarted both programs and installed the vhost
++without the sitemap locations), on rome as root, the same way as "robots.txt without a browser" (the
++admin password through `jq` into a 0700 temp directory). The migration copied the old sitemap
++definition's url items into the additional addresses; the reported pages list `/`, `/blog` and `/faq`
++already and `/subscriptions` is noindex, so they are removed. Then the sitemaps are rebuilt once and the
++page titles imported:
++
++```sh
++set -euo pipefail; umask 077
++D=$(mktemp -d); trap 'rm -rf "$D"' EXIT; G=http://127.0.0.1:8098
++jq -R '{login:"admin",password:.}' </root/summercms-demo-admin.txt >"$D/login.json"
++curl -sf -o "$D/login.out" -X POST -H 'Content-Type: application/json' -d @"$D/login.json" $G/smbackend/api/v1/auth/login
++printf 'Authorization: Bearer %s\n' "$(jq -r .data.access_token "$D/login.out")" >"$D/hdr"
++curl -sf -o "$D/sitemap.json" -H @"$D/hdr" $G/_sitemap/api/v1/settings
++jq -c .data.settings.extra_urls "$D/sitemap.json"   # the copied addresses, kept for the record
++jq '{extra_urls: [.data.settings.extra_urls[] | select(.url as $u | ["/", "/blog", "/faq", "/subscriptions"] | index($u) | not)]}' "$D/sitemap.json" >"$D/put.json"
++curl -s -o /dev/null -w '%{http_code}\n' -X PUT -H @"$D/hdr" -H 'Content-Type: application/json' -d @"$D/put.json" $G/_sitemap/api/v1/settings   # 200
++(cd /srv/summercms-demo && sudo -u summercms-demo SUMMER_ENV=production ./bin/demo sitemap:rebuild)   # Rebuilt the sitemaps: …
++jq -Rs '{dataset: "records", csv: .}' </tmp/seo-pages.csv >"$D/import.json"
++curl -s -o "$D/import.out" -w '%{http_code}\n' -H @"$D/hdr" -H 'Content-Type: application/json' -d @"$D/import.json" $G/_seo/api/v1/import   # 200
++jq -c '{applied, summary}' "$D/import.out"   # applied true, refused 0
++curl -s -o /dev/null -X POST -H @"$D/hdr" -H 'Content-Type: application/json' -d '{}' $G/smbackend/api/v1/auth/logout
++```
++
++`/tmp/seo-pages.csv` is `deploy/seo-pages.csv`, uploaded first
++(`rsync -av -e "$RSH" deploy/seo-pages.csv $ROME:/tmp/seo-pages.csv`). The import needs the route report
++first: the Nuxt site sends it right after its start (`[vue-seo-layer] route report: 7 routes sent` in its
++log).
++
++**smoke-seo.sh** checks the SEO output through the site the way a visitor and a crawler see it: a Journal
++post's CMS title, one canonical, hreflang, one JSON-LD `@graph` and breadcrumbs; the sitemap index, its
++files and their addresses (no duplicate, none noindex); robots.txt; the noindex routes and pages; the HTML
++sitemap; a redirect it creates through the SEO API (301 from Nuxt, removed again); the reported pages in
++the registry; and a 404 reaching the 404 log (removed again). Locally after `scripts/dev.sh up`:
++`scripts/smoke-seo.sh http://127.0.0.1:3020`. Against rome, from the build machine with the admin
++password in a 0600 file and the Go port reached over an SSH tunnel
++(`$RSH -N -L 18098:127.0.0.1:8098 $ROME &`):
++`SMOKE_SEO_API=http://127.0.0.1:18098 SMOKE_SEO_ADMIN_PASSWORD_FILE=… scripts/smoke-seo.sh https://demo.summercms.io`.
++An alternate or sitemap address that does not answer 200 is a `WARN` line (`SMOKE_SEO_STRICT=1` makes it
++a failure): the Polish addresses (`/pl/…`) the CMS names answer 404 while the site keeps the language in a
++cookie at one address (D-13).
+ 
+ ## Build
+ 
+diff --git a/README.md b/README.md
+index 5439013..78aa580 100644
+--- a/README.md
++++ b/README.md
+@@ -7,7 +7,8 @@ a login (no public page links to it); `DEPLOY.md` covers the server setup, build
+ rollback.
+ 
+ - **Go** (`bin/demo`, 127.0.0.1:8097): the admin at `/smbackend` (`backend.uri` in
+-  `config/backend.yaml`), every plugin's API and `/sitemap.xml`.
++  `config/backend.yaml`), every plugin's API, robots.txt and the sitemaps the site serves at
++  `/sitemap.xml` (DEPLOY.md, "SEO").
+ - **Nuxt** (`vue-demo-app`, 127.0.0.1:3020): the guided tour home page, journal, FAQ, subscriptions,
+   registration and login (Turnstile), contact, presentations and quizzes, in English and Polish.
+ - **Postgres** (docker compose, 127.0.0.1:55540): database, user and password `summercms_demo`.
+@@ -32,7 +33,7 @@ is a package of the root module.
+ | `golem15.moderation` | `plugins/golem15/moderation` (`sm-moderation-plugin`) | Banned words and links, edited in Settings; the demo refuses chat messages and forum posts that contain them |
+ | `golem15.translate` | `plugins/golem15/translate` | Locales and translatable content |
+ | `golem15.journal` | `plugins/golem15/journal` | Posts and categories (`/_journal/api/v1`) |
+-| `golem15.sitemap` | `plugins/golem15/sitemap` | `/sitemap.xml` from a definition edited in Settings |
++| `golem15.sitemap` | `plugins/golem15/sitemap` | The sitemap index `/sitemap.xml` and its per-type files, built from the content and edited in Settings › Sitemaps |
+ | `golem15.menu` | `plugins/golem15/menu` | Menus (`/_menu/api/v1`) |
+ | `golem15.faq` | `plugins/golem15/faq` | FAQs (`/_faq/api/v1`) |
+ | `golem15.paymentgateway` | `plugins/golem15/paymentgateway` | Orders and payments (`/_paymentgateway/api/v1`) |
+@@ -275,7 +276,8 @@ scripts/build.sh            # release: bin/demo (linux/amd64) and vue-demo-app/.
+ scripts/smoke.sh            # boot both on a fresh postgres:15 and check the APIs, every server-rendered page and the purge route (no purge token in any page)
+ scripts/check-pins.sh       # every plugin submodule is on the version go.mod requires
+ scripts/build.sh dev        # host build through go.work, no refusals
+-scripts/check-deploy.sh     # deploy/: nginx -t, supervisor parse, ports, /backend refused, /smbackend to Go, no /oauth or /api/ to Go (but the realtime token), Centrifugo checkconfig and ports, no NUXT_SITE_* key in site.env.example, the LiveKit program, ports and caps, the chat-family locations, no /_herald
++scripts/check-deploy.sh     # deploy/: nginx -t, supervisor parse, ports, /backend refused, /smbackend to Go, no /oauth or /api/ to Go (but the realtime token), Centrifugo checkconfig and ports, no NUXT_SITE_* key in site.env.example, the LiveKit program, ports and caps, the chat-family locations, no /_herald, no /sitemap, /_sitemap or /_seo location
++scripts/smoke-seo.sh http://127.0.0.1:3020   # a running site's SEO output: a post's CMS head, one graph and breadcrumbs, the sitemap index and files, robots.txt, noindex routes and pages, the HTML sitemap, a redirect, the page registry and the 404 log (DEPLOY.md, "SEO")
+ scripts/check-live.sh https://demo.summercms.io   # a deployed origin: banner, HSTS, /backend 404, /smbackend admin 200, API 200, /register Turnstile, /contact, Polish, token-less register 422, /roadmap, quizzes, realtime token 401, /ws upgrade, no link to the admin, no purge key in a page, /chat /forum /friends /call prompts, chat-family 401s, /livekit/rtc/validate from LiveKit, no /_herald, robots lines, Back in a browser
+ ```
+ 
+@@ -305,14 +307,16 @@ scripts/check-live.sh https://demo.summercms.io   # a deployed origin: banner, H
+   `vue-demo-app/.output` on 127.0.0.1:13098 (`SMOKE_SITE_PORT`) against the binary and checks every
+   server-rendered page (`/`, `/blog`, a post, `/faq`, `/subscriptions`, `/register`, `/login`,
+   `/contact`, `/quizzes`: banner, test card and backend call to action present; no admin path and
+-  no visitor credential), the `/roadmap` redirect and the quiz list. The deck pages are client-only;
++  no visitor credential), the `/roadmap` redirect and the quiz list. It runs `sitemap:rebuild` and
++  checks the sitemap index on the binary and, through the site, `/sitemap.xml`, a sitemap file and
++  `/robots.txt`. The deck pages are client-only (an empty app root, `X-Robots-Tag: noindex, nofollow`);
+   `scripts/dev.sh snapshot --site` checks their compact banner (`deck-snapshot.cjs --expect-banner`).
+   The site runs with two throwaway purge tokens, `NUXT_CACHE_PURGE_TOKEN` and the deprecated
+-  `NUXT_SITE_CACHE_PURGE_TOKEN`: no server-rendered page and no deck page
+-  (`window.__NUXT_SITE_CONFIG__`) may carry either value or a purge key name (`cachePurgeToken`,
++  `NUXT_SITE_CACHE_PURGE_TOKEN`: no server-rendered page and no deck page may carry either value or a purge key name (`cachePurgeToken`,
+   `cacheAllowProxied`), the new token purges (200) and the deprecated one gets 401, and the site log
+-  has no value and no deprecation warning (the new name wins, so the old one is ignored). nuxt-site-config publishes every `NUXT_SITE_*` variable
+-  in the page payload, which is how the old name leaked before vue-journal-layer 0.6.0.
++  has no value and no deprecation warning (the new name wins, so the old one is ignored). nuxt-site-config
++  (gone with vue-journal-layer 0.8.0) published every `NUXT_SITE_*` variable in the page payload, which
++  is how the old name leaked before vue-journal-layer 0.6.0.
+   It ends with `smoke: ok`.
+ - **Local runs** export `SUMMER_ENV=local` (`scripts/dev.sh`), so the production overlay in
+   `config/env/production/` (debug off, the public origin, CORS, Stripe return URLs) applies only on
+diff --git a/config/golem15.journal.yaml b/config/golem15.journal.yaml
+new file mode 100644
+index 0000000..c7edb31
+--- /dev/null
++++ b/config/golem15.journal.yaml
+@@ -0,0 +1,7 @@
++# golem15.journal (sm-journal-plugin): the demo's Journal.
++#
++# The site has no tag pages (vue-demo-app nuxt.config.ts: journal.routes.tag
++# is false), so tag URLs resolve to nothing: the sitemaps, the SEO plugin's
++# resolve and the menu item types never name /blog/tag/... addresses that
++# answer 404. Author pages stay on (/blog/author/:author).
++tag_pages: false
+diff --git a/config/golem15.seo.yaml b/config/golem15.seo.yaml
+index dbea376..b99938f 100644
+--- a/config/golem15.seo.yaml
++++ b/config/golem15.seo.yaml
+@@ -2,11 +2,20 @@
+ # URL rules, redirects, the 404 log, robots.txt and the SEO MCP tools.
+ #
+ # site_url is the public origin the Nuxt site serves; canonical URLs,
+-# Open Graph URLs and robots.txt Sitemap lines are built from it, never from
+-# a request's Host. The 404 report token comes from the environment
+-# (SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN, .env on rome; never committed);
+-# without it the report endpoint is off.
++# Open Graph URLs, hreflang alternates, the JSON-LD graph and robots.txt
++# Sitemap lines are built from it, never from a request's Host. Locally,
++# override it with SUMMER_GOLEM15__SEO__SITE_URL (http://127.0.0.1:3020).
++#
++# Both tokens come from the environment (.env on rome; never committed) and
++# the Nuxt site gets the same values (site.env, NUXT_SEO_NOTFOUND_TOKEN and
++# NUXT_SEO_ROUTE_REPORT_TOKEN):
++# - notfound_token (SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN): the 404 report;
++#   empty turns the endpoint off.
++# - route_report_token (SUMMER_GOLEM15__SEO__ROUTE_REPORT_TOKEN): the route
++#   report vue-seo-layer posts at server start, which lists the site's static
++#   pages in SEO › Pages; empty falls back to notfound_token.
+ site_url: https://demo.summercms.io
+ notfound_token: ""
++route_report_token: ""
+ robots_sitemaps:
+     - /sitemap.xml
+diff --git a/config/golem15.sitemap.yaml b/config/golem15.sitemap.yaml
+new file mode 100644
+index 0000000..1c09ca2
+--- /dev/null
++++ b/config/golem15.sitemap.yaml
+@@ -0,0 +1,15 @@
++# golem15.sitemap (sm-sitemap-plugin): the sitemap index at /sitemap.xml and
++# its per-type files /sitemap-<type>-<n>.xml, built from the Journal posts,
++# categories and authors, the SEO plugin's page registry and the additional
++# addresses (Settings › Sitemaps).
++#
++# site_url is the public origin every <loc> starts with (the Site address
++# setting wins when it is set); without either, /sitemap.xml answers 404. The
++# request's Host is never used. Locally, override it with
++# SUMMER_GOLEM15__SITEMAP__SITE_URL (http://127.0.0.1:3020).
++#
++# Rebuilds run as conga jobs in the serve process (config/queue.yaml
++# work_in_serve) after every Journal save and nightly; after a release that
++# changes the sitemap format, run `bin/demo sitemap:rebuild` once (DEPLOY.md,
++# "SEO").
++site_url: https://demo.summercms.io
+diff --git a/deploy/env.example b/deploy/env.example
+index cdf6238..ada8493 100644
+--- a/deploy/env.example
++++ b/deploy/env.example
+@@ -34,6 +34,12 @@ SUMMER_GOLEM15__PGSTRIPE__TEST_SUBSCRIPTION_WEBHOOK_SECRET=
+ # "Rotating the site-cache purge token").
+ SUMMER_SITE_CACHE__PURGE_URL=http://127.0.0.1:3098/api/__site__/cache/purge
+ SUMMER_SITE_CACHE__PURGE_TOKEN=
++# golem15.seo (config/golem15.seo.yaml): the 404 report token and the route
++# report token, the same values as NUXT_SEO_NOTFOUND_TOKEN and
++# NUXT_SEO_ROUTE_REPORT_TOKEN in site.env (openssl rand -hex 32). Empty: the
++# 404 log gets no reports and SEO › Pages lists no static pages.
++SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN=
++SUMMER_GOLEM15__SEO__ROUTE_REPORT_TOKEN=
+ # Cloudflare Turnstile on register and login (D-07; golem15.user.turnstile is
+ # closed in config/golem15.user.yaml): the secret key of the Turnstile widget
+ # for demo.summercms.io, from the operator's secrets file. Without it every
+diff --git a/deploy/nginx/demo.summercms.io.conf b/deploy/nginx/demo.summercms.io.conf
+index 3dbedf2..20d4e56 100644
+--- a/deploy/nginx/demo.summercms.io.conf
++++ b/deploy/nginx/demo.summercms.io.conf
+@@ -3,8 +3,8 @@
+ #   - summercms-demo, the Go binary, on 127.0.0.1:8098 (supervisor program
+ #     summercms-demo): only the allow-listed prefixes below (the admin at
+ #     /smbackend, plugin APIs including the chat family, the demo API, the
+-#     realtime token route, Stripe webhooks, public uploads, the sitemap,
+-#     the MCP endpoint and its OAuth paths);
++#     realtime token route, Stripe webhooks, public uploads, robots.txt,
++#     the MCP endpoint and its OAuth paths); the sitemaps go through Nuxt;
+ #   - summercms-demo-centrifugo, the demo's own Centrifugo, on 127.0.0.1:8010
+ #     (supervisor program summercms-demo-centrifugo, D-17): the WebSocket at
+ #     /ws of the presentations' speaker view and phone remote, the chat, the
+@@ -405,24 +405,11 @@ server {
+ 		proxy_set_header X-Forwarded-Proto $scheme;
+ 	}
+ 
+-	# The sitemap plugin's document and its stylesheet.
+-	location = /sitemap.xml {
+-		proxy_pass http://127.0.0.1:8098;
+-		proxy_http_version 1.1;
+-		proxy_set_header Host $host;
+-		proxy_set_header X-Real-IP $remote_addr;
+-		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+-		proxy_set_header X-Forwarded-Proto $scheme;
+-	}
+-
+-	location = /sitemap.xsl {
+-		proxy_pass http://127.0.0.1:8098;
+-		proxy_http_version 1.1;
+-		proxy_set_header Host $host;
+-		proxy_set_header X-Real-IP $remote_addr;
+-		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+-		proxy_set_header X-Forwarded-Proto $scheme;
+-	}
++	# The sitemaps (/sitemap.xml, the index, and its /sitemap-<type>-<n>.xml
++	# files), llms.txt and the verification files reach Nuxt through
++	# location /: vue-seo-layer fetches them from the Go port on loopback
++	# (/_sitemap/files/ and the SEO plugin's API), so neither /_sitemap nor
++	# /_seo has a location here (scripts/check-deploy.sh checks it).
+ 
+ 	# Nuxt: pages, /_nuxt assets, fonts. GET and HEAD only, so the layers' POST
+ 	# routes (the site-cache purge, called by Go on loopback) stay unreachable.
+diff --git a/deploy/seo-pages.csv b/deploy/seo-pages.csv
+new file mode 100644
+index 0000000..c98c558
+--- /dev/null
++++ b/deploy/seo-pages.csv
+@@ -0,0 +1,3 @@
++url,locale,title,description
++/,en,SummerCMS Demo,A guided tour of SummerCMS: every shared Golem15 plugin on one Go binary.
++/faq,en,FAQ,"Managed in the admin under FAQ, one set per language; served by the FAQ API and rendered with vue-faq-layer."
+diff --git a/deploy/site.env.example b/deploy/site.env.example
+index 05b34c5..46d7b37 100644
+--- a/deploy/site.env.example
++++ b/deploy/site.env.example
+@@ -10,10 +10,18 @@ NUXT_PAYMENTGATEWAY_API_BASE=http://127.0.0.1:8098/_paymentgateway/api/v1
+ NUXT_PAYMENTGATEWAYSUBSCRIPTIONS_API_BASE=http://127.0.0.1:8098/_paymentgatewaysubscriptions/api/v1
+ # The demo's own API (golem15.demo): /roadmap and /quizzes read it on the server.
+ NUXT_DEMO_API_BASE=http://127.0.0.1:8098/_demo/api/v1
+-# The public origin (canonical URLs, sitemap and robots of the SEO module) and
+-# the footer's sitemap link (nginx sends /sitemap.xml to Go).
+-NUXT_PUBLIC_SITE_URL=https://demo.summercms.io
+-NUXT_PUBLIC_SITEMAP_URL=/sitemap.xml
++# vue-seo-layer: the SEO plugin's API (resolve, site answer, 404 and route
++# reports) and the Go origin of the root files (robots.txt, the sitemaps);
++# the head, canonical and sitemap URLs come from golem15.seo.site_url and
++# golem15.sitemap.site_url on the binary, never from here.
++NUXT_SEO_API_BASE=http://127.0.0.1:8098/_seo/api/v1
++NUXT_SEO_BACKEND_BASE=http://127.0.0.1:8098
++# The same values as SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN and
++# SUMMER_GOLEM15__SEO__ROUTE_REPORT_TOKEN in .env (openssl rand -hex 32,
++# generated on rome, never printed): the 404 report and the route report of
++# the static pages to SEO › Pages. Empty: nothing is reported.
++NUXT_SEO_NOTFOUND_TOKEN=
++NUXT_SEO_ROUTE_REPORT_TOKEN=
+ # Site cache purge token: the same value as SUMMER_SITE_CACHE__PURGE_TOKEN in
+ # .env, generated on rome (openssl rand -hex 32) and never printed. Fewer
+ # than 32 characters disables the purge route. The name is deliberately not
+diff --git a/scripts/check-deploy.sh b/scripts/check-deploy.sh
+index 417cbc5..0d7d801 100755
+--- a/scripts/check-deploy.sh
++++ b/scripts/check-deploy.sh
+@@ -39,6 +39,8 @@
+ #   - each chat-family prefix (/_chat/, /_chatchannels/, /_chatbots/,
+ #     /_chatvideo/, /_forum/, /_userfriends/) is a location to the Go port,
+ #     and no location routes /_herald (D-16: no subscribe UI);
++#   - no location routes /_seo, /_sitemap or /sitemap*: vue-seo-layer serves
++#     the sitemaps through Nuxt from the Go port on loopback;
+ #   - livekit.yaml.example holds placeholder keys only, and env.example
+ #     declares the LiveKit and VAPID keys empty.
+ # Each LiveKit and chat-family mismatch prints its own line.
+@@ -405,6 +407,10 @@ for prefix in ("_chat", "_chatchannels", "_chatbots", "_chatvideo", "_forum", "_
+ for loc in re.findall(r"location\s+(?:[=~^*]+\s+)?(\S+)\s*\{", code):
+     if loc.startswith("/_herald"):
+         problems.append(f"nginx routes {loc}: /_herald stays unrouted (D-16, no subscribe UI)")
++    # vue-seo-layer serves the sitemaps from the Go port on loopback and
++    # resolves through the Nuxt server (DEPLOY.md, "SEO").
++    if loc.startswith(("/_seo", "/_sitemap", "/sitemap")):
++        problems.append(f"nginx routes {loc}: the sitemaps and the SEO API reach Go through Nuxt (vue-seo-layer), not nginx")
+ 
+ if problems:
+     sys.exit("\n".join(problems))
+diff --git a/scripts/smoke-seo.sh b/scripts/smoke-seo.sh
+new file mode 100755
+index 0000000..55af385
+--- /dev/null
++++ b/scripts/smoke-seo.sh
+@@ -0,0 +1,289 @@
++#!/usr/bin/env bash
++# The SEO output of a running demo, checked through its Nuxt site the way a
++# visitor and a crawler see it (Phase 33: vue-seo-layer, golem15.seo,
++# golem15.sitemap):
++#
++#   scripts/smoke-seo.sh BASE_URL        e.g. http://127.0.0.1:3020
++#
++# - a Journal post: the CMS title, one canonical, hreflang, one JSON-LD
++#   @graph, server-rendered breadcrumbs and the CMS's X-Robots-Tag;
++# - /sitemap.xml is a sitemap index whose files answer through the site, and
++#   robots.txt names it;
++# - a redirect created through the SEO API answers 301 from Nuxt (removed
++#   again at the end);
++# - the declared browser-only routes (/p/**, /presentations/**) and the auth
++#   and signed-in pages answer noindex, nofollow;
++# - the route report put the static pages into the page registry, and a 404
++#   reaches the 404 log (the entry is removed again);
++# - the HTML sitemap page and the footer link to it.
++#
++# The API checks talk to the Go binary directly:
++#   SMOKE_SEO_API             Go origin (default http://127.0.0.1:8097, scripts/dev.sh)
++#   SMOKE_SEO_ADMIN_LOGIN     admin login (default admin)
++#   SMOKE_SEO_ADMIN_PASSWORD_FILE  a file holding the admin password, else
++#   SMOKE_SEO_ADMIN_PASSWORD  the password (default: scripts/dev.sh's local admin)
++#   SMOKE_SEO_POST            the post path to check (default: the first post
++#                             with a category, from the Journal API)
++#   SMOKE_SEO_STRICT=1        turn WARN lines (alternates and sitemap
++#                             addresses that do not answer 200) into failures
++#
++# Prints "ok ..." per check, "WARN ..." and "FAIL ..." lines, and ends with
++# "smoke-seo: ok" (exit 0) or "smoke-seo: N failed" (exit 1). No secret is
++# printed or passed on a command line.
++set -euo pipefail
++
++[ $# -eq 1 ] || { echo "usage: scripts/smoke-seo.sh BASE_URL" >&2; exit 2; }
++BASE=${1%/}
++API=${SMOKE_SEO_API:-http://127.0.0.1:8097}
++API=${API%/}
++STRICT=${SMOKE_SEO_STRICT:-0}
++command -v python3 >/dev/null || { echo "smoke-seo: python3 not found" >&2; exit 2; }
++
++D=$(mktemp -d)
++HDR="$D/auth.hdr"
++trap 'logout; rm -rf "$D"' EXIT
++failed=0
++ok() { echo "ok   $*"; }
++fail() { echo "FAIL $*"; failed=$((failed + 1)); }
++warn() {
++	if [ "$STRICT" = 1 ]; then fail "$*"; else echo "WARN $*"; fi
++}
++
++# get PATH_OR_URL NAME: GET without following redirects into $D/NAME.body and
++# $D/NAME.head; prints the status.
++get() {
++	local url=$1
++	case "$url" in http://* | https://*) ;; *) url="$BASE$url" ;; esac
++	curl -s -o "$D/$2.body" -D "$D/$2.head" -w '%{http_code}' -H 'Accept: text/html' "$url" || echo 000
++}
++# probe PATH: the status of PATH without Accept: text/html, so the layer
++# does not report a 404 to the 404 log (alternates and sitemap addresses);
++# the headers land in $D/probe.head.
++probe() { curl -s -o /dev/null -D "$D/probe.head" -w '%{http_code}' -H 'Accept: */*' "$BASE$1" || echo 000; }
++header() { tr -d '\r' <"$D/$1.head" | awk -v k="$(echo "$2" | tr 'A-Z' 'a-z')" -F': ' 'tolower($1)==k {sub(/^[^:]*: /, ""); print; exit}'; }
++count() { { grep -o -- "$2" "$D/$1.body" || true; } | wc -l | tr -d ' '; }
++# py NAME SCRIPT: runs SCRIPT with the body of NAME on stdin.
++py() { python3 -c "$2" <"$D/$1.body"; }
++
++# --- the admin token (redirect, registry and 404 log checks) ----------------
++login() {
++	local pw
++	if [ -n "${SMOKE_SEO_ADMIN_PASSWORD_FILE:-}" ]; then
++		pw=$(head -n1 "$SMOKE_SEO_ADMIN_PASSWORD_FILE")
++	else
++		pw=${SMOKE_SEO_ADMIN_PASSWORD:-AdminDemo123!}
++	fi
++	SMOKE_LOGIN=${SMOKE_SEO_ADMIN_LOGIN:-admin} SMOKE_PW="$pw" python3 -c '
++import json, os
++print(json.dumps({"login": os.environ["SMOKE_LOGIN"], "password": os.environ["SMOKE_PW"]}))' >"$D/login.json"
++	unset pw
++	LOGIN_STATUS=$(umask 077 && curl -s -o "$D/login.out" -w '%{http_code}' -X POST -H 'Content-Type: application/json' \
++		-d @"$D/login.json" "$API/smbackend/api/v1/auth/login" || echo 000)
++	rm -f "$D/login.json"
++	python3 -c '
++import json, sys
++try:
++    print("Authorization: Bearer " + json.load(open(sys.argv[1]))["data"]["access_token"])
++except Exception:
++    sys.exit(1)' "$D/login.out" >"$HDR" 2>/dev/null || { rm -f "$HDR"; return 1; }
++	rm -f "$D/login.out"
++}
++logout() {
++	[ -f "$HDR" ] || return 0
++	curl -s -o /dev/null -X POST -H @"$HDR" -H 'Content-Type: application/json' -d '{}' "$API/smbackend/api/v1/auth/logout" || true
++	rm -f "$HDR"
++}
++api() { # METHOD PATH [JSON_FILE] -> body in $D/api.out, prints the status
++	local args=(-s -o "$D/api.out" -w '%{http_code}' -X "$1" -H @"$HDR")
++	[ $# -ge 3 ] && args+=(-H 'Content-Type: application/json' -d @"$3")
++	curl "${args[@]}" "$API$2" || echo 000
++}
++
++# --- 1. a Journal post ----------------------------------------------------
++POST=${SMOKE_SEO_POST:-}
++if [ -z "$POST" ]; then
++	curl -s -o "$D/posts.json" "$API/_journal/api/v1/posts" || true
++	POST=$(python3 -c '
++import json, sys
++try:
++    posts = json.load(open(sys.argv[1]))["data"]
++except Exception:
++    sys.exit(0)
++for p in posts:
++    if p.get("categories"):
++        print("/blog/" + p["slug"]); break
++else:
++    if posts: print("/blog/" + posts[0]["slug"])' "$D/posts.json")
++fi
++[ -n "$POST" ] || { fail "no Journal post found through $API/_journal/api/v1/posts (set SMOKE_SEO_POST)"; POST=/blog/missing; }
++
++curl -s -o "$D/resolve.json" "$API/_seo/api/v1/resolve?url=$POST" || true
++CMS_TITLE=$(python3 -c '
++import json, sys
++try:
++    a = json.load(open(sys.argv[1]))
++    print(a["seo"]["title"] if a.get("action") == "ok" else "")
++except Exception:
++    print("")' "$D/resolve.json")
++CMS_XRT=$(python3 -c '
++import json, sys
++try: print(json.load(open(sys.argv[1]))["seo"]["x_robots_tag"])
++except Exception: print("")' "$D/resolve.json")
++
++st=$(get "$POST" post)
++[ "$st" = 200 ] && ok "$POST answers 200" || fail "$POST answers $st, not 200"
++n=$(count post '<script type="application/ld+json"'); [ "$n" = 1 ] && ok "$POST has one ld+json script" || fail "$POST has $n ld+json scripts, not 1"
++py post 'import re, sys, json
++m = re.search(r"<script type=\"application/ld\+json\"[^>]*>(.*?)</script>", sys.stdin.read(), re.S)
++g = json.loads(m.group(1)) if m else {}
++sys.exit(0 if isinstance(g.get("@graph"), list) and len(g["@graph"]) > 1 else 1)' &&
++	ok "$POST ld+json is one @graph" || fail "$POST ld+json is not one @graph with nodes"
++n=$(count post 'rel="canonical"'); [ "$n" = 1 ] && ok "$POST has one canonical" || fail "$POST has $n canonical links, not 1"
++n=$(count post 'hreflang="'); [ "$n" -ge 2 ] && ok "$POST has $n hreflang links" || fail "$POST has $n hreflang links, fewer than 2"
++n=$(count post 'class="seo-breadcrumbs__link"')
++grep -q '<nav class="seo-breadcrumbs"' "$D/post.body" && [ "$n" -ge 1 ] &&
++	ok "$POST has nav.seo-breadcrumbs ($n links)" || fail "$POST has no server-rendered nav.seo-breadcrumbs with links"
++title=$(py post 'import re, sys, html
++m = re.search(r"<title>(.*?)</title>", sys.stdin.read(), re.S)
++print(html.unescape(m.group(1)).strip() if m else "")')
++if [ -n "$CMS_TITLE" ] && [ "$title" = "$CMS_TITLE" ]; then ok "$POST title is the CMS title ($title)"; else fail "$POST title '$title' is not the CMS title '$CMS_TITLE'"; fi
++xrt=$(header post X-Robots-Tag)
++[ -n "$CMS_XRT" ] && [ "$xrt" = "$CMS_XRT" ] && ok "$POST X-Robots-Tag is the CMS's ($xrt)" || fail "$POST X-Robots-Tag '$xrt' is not the CMS's '$CMS_XRT'"
++
++# The alternates should answer 200 on this site.
++for alt in $(py post 'import re, sys
++for m in re.finditer(r"<link rel=\"alternate\" hreflang=\"[^\"]+\" href=\"([^\"]+)\"", sys.stdin.read()):
++    print(m.group(1))' | sort -u); do
++	path=$(python3 -c 'import sys, urllib.parse as u; p = u.urlsplit(sys.argv[1]); print(p.path + ("?" + p.query if p.query else ""))' "$alt")
++	st=$(probe "$path")
++	[ "$st" = 200 ] && ok "alternate $path answers 200" || warn "alternate $path answers $st"
++done
++
++# --- 2. sitemaps and robots.txt ---------------------------------------------
++st=$(get /sitemap.xml index)
++if [ "$st" = 200 ] && grep -q '<sitemapindex' "$D/index.body"; then
++	ok "/sitemap.xml is a sitemap index ($(header index Content-Type))"
++else
++	fail "/sitemap.xml answers $st without <sitemapindex>"
++fi
++files=$(py index 'import re, sys, urllib.parse as u
++for m in re.findall(r"<loc>([^<]+)</loc>", sys.stdin.read()):
++    print(u.urlsplit(m).path)')
++[ -n "$files" ] || fail "/sitemap.xml lists no sitemap file"
++addresses=0
++bad=0
++for f in $files; do
++	st=$(get "$f" file)
++	if [ "$st" = 200 ] && grep -q '<urlset' "$D/file.body"; then
++		ok "$f answers a urlset through the site"
++	else
++		fail "$f answers $st without <urlset>"
++		continue
++	fi
++	for loc in $(py file 'import re, sys, urllib.parse as u
++for m in re.findall(r"<loc>([^<]+)</loc>", sys.stdin.read()):
++    print(u.urlsplit(m).path)' | head -200); do
++		addresses=$((addresses + 1))
++		echo "$loc" >>"$D/locs.txt"
++		st=$(probe "$loc")
++		[ "$st" = 200 ] || { warn "sitemap address $loc answers $st"; bad=$((bad + 1)); }
++		case "$(header probe X-Robots-Tag)" in
++		*noindex*) fail "sitemap address $loc answers X-Robots-Tag: $(header probe X-Robots-Tag)" ;;
++		esac
++	done
++done
++[ "$addresses" -gt 0 ] && ok "$addresses sitemap addresses fetched, $bad not 200" || fail "the sitemap files list no address"
++dups=$( [ -f "$D/locs.txt" ] && sort "$D/locs.txt" | uniq -d | tr '\n' ' ')
++[ -z "$dups" ] && ok "no address is listed twice in the sitemaps" || fail "addresses listed more than once in the sitemaps: $dups"
++st=$(get /robots.txt robots)
++if [ "$st" = 200 ] && grep -q '^Sitemap: .*/sitemap\.xml$' "$D/robots.body"; then
++	ok "/robots.txt names the sitemap index"
++else
++	fail "/robots.txt answers $st without a Sitemap: .../sitemap.xml line"
++fi
++
++# --- 3. noindex routes, auth and signed-in pages ------------------------------
++for p in /p/smoke-seo /presentations/new /login /register /account/security; do
++	st=$(get "$p" noindex)
++	xrt=$(header noindex X-Robots-Tag)
++	[ "$xrt" = "noindex, nofollow" ] && ok "$p ($st) sends X-Robots-Tag: noindex, nofollow" ||
++		fail "$p ($st) sends X-Robots-Tag '$xrt', not 'noindex, nofollow'"
++done
++get /login noindex >/dev/null
++grep -q '<meta name="robots" content="noindex, nofollow">' "$D/noindex.body" &&
++	ok "/login has the robots meta noindex, nofollow" || fail "/login has no robots meta noindex, nofollow"
++
++# --- 4. the HTML sitemap and the footer link ---------------------------------
++st=$(get / home)
++grep -q 'class="seo-sitemap-link"' "$D/home.body" && ok "/ ($st) links the HTML sitemap in the footer" || fail "/ ($st) has no a.seo-sitemap-link"
++href=$(py home 'import re, sys
++m = re.search(r"<a href=\"([^\"]+)\"[^>]*class=\"seo-sitemap-link\"|class=\"seo-sitemap-link\"[^>]*href=\"([^\"]+)\"", sys.stdin.read())
++print((m.group(1) or m.group(2)) if m else "")')
++if [ -n "$href" ]; then
++	st=$(get "$href" html)
++	[ "$st" = 200 ] && grep -q "href=\"$POST\"" "$D/html.body" && ok "$href lists $POST" || fail "$href answers $st without a link to $POST"
++fi
++
++# --- 5. through the SEO API: a redirect, the registry, the 404 log ----------
++if login; then
++	src="/smoke-seo-old-$(date +%s)-$$"
++	printf '{"source":"%s","target":"%s","status":301,"note":"scripts/smoke-seo.sh"}' "$src" "$POST" >"$D/redirect.json"
++	st=$(api POST /_seo/api/v1/redirects "$D/redirect.json")
++	rid=$(python3 -c 'import json, sys
++try: print(json.load(open(sys.argv[1]))["data"]["id"])
++except Exception: print("")' "$D/api.out")
++	if [ -n "$rid" ]; then
++		st=$(get "$src" redirect)
++		loc=$(header redirect Location)
++		[ "$st" = 301 ] && [ "${loc%"$POST"}" != "$loc" ] && ok "$src answers 301 to $loc (SEO plugin redirect $rid)" ||
++			fail "$src answers $st with Location '$loc', not 301 to $POST"
++		st=$(api DELETE "/_seo/api/v1/redirects/$rid")
++		case "$st" in 2*) ;; *) fail "could not delete redirect $rid ($st)" ;; esac
++	else
++		fail "creating a redirect through the SEO API answered $st"
++	fi
++
++	st=$(api GET '/_seo/api/v1/pages?per_page=200')
++	python3 -c '
++import json, sys
++rows = json.load(open(sys.argv[1]))["data"]
++urls = {r["url"]: r for r in rows}
++need = ["/", "/faq", "/blog"]
++missing = [u for u in need if u not in urls or not urls[u].get("reported_at")]
++leaked = [u for u in ("/login", "/register", "/account/security", "/subscriptions") if u in urls]
++if missing or leaked:
++    print("missing=%s leaked=%s" % (missing, leaked)); sys.exit(1)
++print(" ".join(sorted(u for u, r in urls.items() if r.get("origin") == "reported")))' "$D/api.out" >"$D/registry.txt" 2>&1 &&
++		ok "the registry lists the reported routes: $(cat "$D/registry.txt")" ||
++		fail "the registry ($st) lacks reported routes or lists noindex pages: $(cat "$D/registry.txt")"
++
++	miss="/smoke-seo-missing-$(date +%s)-$$"
++	st=$(get "$miss" missing)
++	[ "$st" = 404 ] && ok "$miss answers 404" || fail "$miss answers $st, not 404"
++	nid=""
++	for _ in 1 2 3 4 5 6 7 8 9 10; do
++		api GET "/_seo/api/v1/notfound?search=$miss" >/dev/null
++		nid=$(python3 -c 'import json, sys
++try:
++    rows = [r for r in json.load(open(sys.argv[1]))["data"] if r.get("url") == sys.argv[2]]
++    print(rows[0]["id"] if rows else "")
++except Exception: print("")' "$D/api.out" "$miss")
++		[ -n "$nid" ] && break
++		sleep 0.5
++	done
++	if [ -n "$nid" ]; then
++		ok "$miss reached the 404 log (entry $nid)"
++		api DELETE "/_seo/api/v1/notfound/$nid" >/dev/null
++	else
++		fail "$miss did not reach the 404 log (is NUXT_SEO_NOTFOUND_TOKEN the backend's notfound_token?)"
++	fi
++else
++	fail "admin login at $API/smbackend/api/v1/auth/login answered ${LOGIN_STATUS:-000} (429: the admin login throttle, wait a minute): no redirect, registry or 404 log checks"
++fi
++
++if [ "$failed" -eq 0 ]; then
++	echo "smoke-seo: ok"
++else
++	echo "smoke-seo: $failed failed"
++	exit 1
++fi
+diff --git a/scripts/smoke.sh b/scripts/smoke.sh
+index e2bec68..c344ec7 100755
+--- a/scripts/smoke.sh
++++ b/scripts/smoke.sh
+@@ -1,14 +1,16 @@
+ #!/usr/bin/env bash
+ # Boot the built binary on a fresh postgres:15 the way a release does
+-# (migrate, admin:create, demo:seed, serve), check the plugin APIs over HTTP,
+-# then boot the built Nuxt site (vue-demo-app/.output) against that binary and
+-# check its pages.
++# (migrate, admin:create, demo:seed, sitemap:rebuild, serve), check the plugin
++# APIs and the sitemap index over HTTP, then boot the built Nuxt site
++# (vue-demo-app/.output) against that binary and check its pages and the root
++# files it serves from the binary (vue-seo-layer: /sitemap.xml, a sitemap
++# file, /robots.txt).
+ #
+ # The site starts with two throwaway purge tokens: NUXT_CACHE_PURGE_TOKEN and
+-# the deprecated NUXT_SITE_CACHE_PURGE_TOKEN (vue-journal-layer 0.6.0 still
+-# reads it for one release). nuxt-site-config publishes every NUXT_SITE_*
+-# variable in the page payload, so no server-rendered page and no
+-# client-only page (window.__NUXT_SITE_CONFIG__) may carry either value or a
++# the deprecated NUXT_SITE_CACHE_PURGE_TOKEN (still read for one release).
++# nuxt-site-config published every NUXT_SITE_* variable in the page payload
++# until vue-journal-layer 0.8.0 dropped it, so no server-rendered page and no
++# client-only page may carry either value or a
+ # purge key name; the new token must purge (200) and the deprecated one,
+ # shadowed by it, must get 401; the site log carries no token value and no
+ # deprecation warning (the layer warns only when a setting comes from an old
+@@ -132,6 +134,11 @@ run demo:seed >"$TMP/seed.log" 2>&1 || {
+ 	cat "$TMP/seed.log" >&2
+ 	fail "demo:seed failed"
+ }
++# The sitemap files exist after the first rebuild (DEPLOY.md, "SEO").
++run sitemap:rebuild >"$TMP/sitemap.log" 2>&1 || {
++	cat "$TMP/sitemap.log" >&2
++	fail "sitemap:rebuild failed"
++}
+ 
+ free_port "$PORT" SMOKE_PORT
+ (cd "$WORK" && exec env -i PATH="$PATH" HOME="$TMP" SUMMER_ENV=production "$BIN" serve --addr "127.0.0.1:$PORT") >"$TMP/serve.log" 2>&1 &
+@@ -169,7 +176,12 @@ check() {
+ # The plugin APIs the site and the decks read.
+ check "$BASE/_journal/api/v1/posts" 200 application/json
+ check "$BASE/_faq/api/v1/faqs/home" 200 application/json
++# The sitemap index on the public origin (config/golem15.sitemap.yaml), its
++# files under /_sitemap/files/ (the site maps the root names).
+ check "$BASE/sitemap.xml" 200
++grep -qF '<loc>https://demo.summercms.io/sitemap-posts-1.xml</loc>' "$TMP/body" || fail "GET $BASE/sitemap.xml: not an index listing sitemap-posts-1.xml"
++check "$BASE/_sitemap/files/sitemap-posts-1.xml" 200
++grep -qF '/blog/welcome-to-summercms</loc>' "$TMP/body" || fail "GET $BASE/_sitemap/files/sitemap-posts-1.xml: no seeded post"
+ HASH="$(psql "SELECT public_hash FROM golem15_presentations_presentations WHERE slug = 'roadmap' AND is_published")"
+ [[ -n "$HASH" ]] || fail "demo:seed published no roadmap deck"
+ check "$BASE/_presentations/api/v1/public/roadmap-$HASH" 200 application/json
+@@ -197,6 +209,7 @@ free_port "$SITE_PORT" SMOKE_SITE_PORT
+ 	NUXT_PAYMENTGATEWAY_API_BASE="$BASE/_paymentgateway/api/v1" \
+ 	NUXT_PAYMENTGATEWAYSUBSCRIPTIONS_API_BASE="$BASE/_paymentgatewaysubscriptions/api/v1" \
+ 	NUXT_DEMO_API_BASE="$BASE/_demo/api/v1" \
++	NUXT_SEO_API_BASE="$BASE/_seo/api/v1" \
+ 	NUXT_CACHE_PURGE_TOKEN="$PURGE_TOKEN" \
+ 	NUXT_SITE_CACHE_PURGE_TOKEN="$OLD_PURGE_TOKEN" \
+ 	node "$SITE_OUT/server/index.mjs") >"$TMP/site.log" 2>&1 &
+@@ -217,6 +230,12 @@ fi
+ 
+ check "$SITE/" 200 text/html
+ 
++# vue-seo-layer serves the root files from the binary (NUXT_SEO_API_BASE).
++check "$SITE/sitemap.xml" 200 application/xml
++grep -qF '<sitemapindex' "$TMP/body" || fail "GET $SITE/sitemap.xml: not a sitemap index"
++check "$SITE/sitemap-posts-1.xml" 200 application/xml
++check "$SITE/robots.txt" 200 text/plain
++
+ # no_purge_leak LABEL fails when the last body carries a purge token value or
+ # a purge key name (cachePurgeToken, cacheAllowProxied...). Never prints a
+ # value; a key name match never spans one.
+@@ -253,7 +272,10 @@ done
+ check "$SITE/roadmap" 302
+ grep -qi "^location: /p/roadmap-$HASH" "$TMP/headers" || fail "GET $SITE/roadmap: not a redirect to /p/roadmap-$HASH"
+ check "$SITE/p/roadmap-$HASH" 200 text/html
+-grep -qF '__NUXT_SITE_CONFIG__' "$TMP/body" || fail "GET $SITE/p/roadmap-$HASH: no window.__NUXT_SITE_CONFIG__ (is the deck page still client-only?)"
++grep -qF '<div id="__nuxt"></div>' "$TMP/body" || fail "GET $SITE/p/roadmap-$HASH: the app root is rendered (is the deck page still client-only?)"
++# The deck routes render in the browser only, so seo.noindexRoutes declares
++# them (vue-seo-layer, D-70): served with X-Robots-Tag noindex, nofollow.
++tr -d '\r' <"$TMP/headers" | grep -qix 'x-robots-tag: noindex, nofollow' || fail "GET $SITE/p/roadmap-$HASH: no X-Robots-Tag: noindex, nofollow"
+ no_purge_leak "$SITE/p/roadmap-$HASH"
+ check "$SITE/quizzes" 200 text/html
+ grep -qF 'SummerCMS basics' "$TMP/body" || fail "GET $SITE/quizzes: the quiz list is not rendered"
+diff --git a/seo_output_test.go b/seo_output_test.go
+new file mode 100644
+index 0000000..c7c5192
+--- /dev/null
++++ b/seo_output_test.go
+@@ -0,0 +1,171 @@
++package main
++
++import (
++	"encoding/json"
++	"net/http"
++	"net/http/httptest"
++	"slices"
++	"strings"
++	"testing"
++
++	"git.golem15.com/golem15/summercms/modules/surf"
++)
++
++// demoSite is the public origin config/golem15.seo.yaml and
++// config/golem15.sitemap.yaml name.
++const demoSite = "https://demo.summercms.io"
++
++// TestSEOOutput checks the SEO output the Nuxt site reads from the demo
++// binary (Phase 33, SC-1/SC-2) on the seeded content: /sitemap.xml is a
++// sitemap index of per-type files on the public origin and a file lists
++// the Journal posts, while a tagged post adds no tag address and the tag's
++// path does not resolve (golem15.journal.tag_pages is false in
++// config/golem15.journal.yaml); the SEO plugin's site answer names the
++// origin, the locales and the HTML sitemap; a seeded post resolves with
++// one JSON-LD @graph and breadcrumbs through its category; and the route
++// report is accepted with golem15.seo.route_report_token.
++func TestSEOOutput(t *testing.T) {
++	skipUnlessSEOMounted(t)
++	const reportToken = "seo-output-test-route-report-token"
++	demo := bootDemo(t, visitorEnv, map[string]any{"golem15.seo.route_report_token": reportToken})
++	mustSeed(t, demo)
++	// demo:seed tags no post; one tag makes the tag_pages check meaningful.
++	var tagID uint
++	if err := demo.DB.Raw(`INSERT INTO golem15_journal_tags (name, slug, created_at, updated_at)
++VALUES ('Releases', 'releases', NOW(), NOW()) RETURNING id`).Scan(&tagID).Error; err != nil || tagID == 0 {
++		t.Fatalf("tag: id=%d err=%v", tagID, err)
++	}
++	if err := demo.DB.Exec(`INSERT INTO golem15_journal_posts_tags (post_id, tag_id)
++SELECT id, ? FROM golem15_journal_posts WHERE slug = 'welcome-to-summercms'`, tagID).Error; err != nil {
++		t.Fatal(err)
++	}
++	if out, err := runCommand(t, demo, "sitemap:rebuild"); err != nil {
++		t.Fatalf("sitemap:rebuild: %v\n%s", err, out)
++	}
++	h, err := surf.Assemble(demo.App, demo.Plugins)
++	if err != nil {
++		t.Fatalf("surf.Assemble: %v", err)
++	}
++	do := func(method, path, body string, header map[string]string) *httptest.ResponseRecorder {
++		t.Helper()
++		req := httptest.NewRequest(method, path, strings.NewReader(body))
++		for k, v := range header {
++			req.Header.Set(k, v)
++		}
++		rec := httptest.NewRecorder()
++		h.ServeHTTP(rec, req)
++		return rec
++	}
++	get := func(path string) string {
++		t.Helper()
++		rec := do(http.MethodGet, path, "", nil)
++		if rec.Code != http.StatusOK {
++			t.Fatalf("GET %s = %d %s", path, rec.Code, rec.Body.String())
++		}
++		return rec.Body.String()
++	}
++
++	t.Run("sitemap index", func(t *testing.T) {
++		index := get("/sitemap.xml")
++		if !strings.Contains(index, "<sitemapindex") {
++			t.Fatalf("/sitemap.xml is not a sitemap index:\n%s", index)
++		}
++		if !strings.Contains(index, "<loc>"+demoSite+"/sitemap-posts-1.xml</loc>") {
++			t.Fatalf("/sitemap.xml does not list %s/sitemap-posts-1.xml:\n%s", demoSite, index)
++		}
++		posts := get("/_sitemap/files/sitemap-posts-1.xml")
++		if !strings.Contains(posts, "<urlset") || !strings.Contains(posts, "<loc>"+demoSite+"/blog/welcome-to-summercms</loc>") {
++			t.Fatalf("sitemap-posts-1.xml does not list the seeded post:\n%s", posts)
++		}
++		if strings.Contains(index, "sitemap-tags-") || strings.Contains(posts, "/blog/tag/") {
++			t.Fatalf("the sitemaps name tag addresses although golem15.journal.tag_pages is false:\n%s", index)
++		}
++		var answer struct {
++			Action string `json:"action"`
++		}
++		if err := json.Unmarshal([]byte(get("/_seo/api/v1/resolve?url=/blog/tag/releases")), &answer); err != nil {
++			t.Fatal(err)
++		}
++		if answer.Action != "not_found" {
++			t.Fatalf("/blog/tag/releases resolves %q, want not_found (no tag pages)", answer.Action)
++		}
++	})
++
++	t.Run("site answer", func(t *testing.T) {
++		var site struct {
++			SiteURL     string   `json:"site_url"`
++			Locales     []string `json:"locales"`
++			HTMLSitemap struct {
++				Enabled bool              `json:"enabled"`
++				Paths   map[string]string `json:"paths"`
++			} `json:"html_sitemap"`
++		}
++		if err := json.Unmarshal([]byte(get("/_seo/api/v1/site")), &site); err != nil {
++			t.Fatal(err)
++		}
++		if site.SiteURL != demoSite || !slices.Contains(site.Locales, "en") || !slices.Contains(site.Locales, "pl") {
++			t.Fatalf("site answer %+v, want %s with en and pl", site, demoSite)
++		}
++		if !site.HTMLSitemap.Enabled || site.HTMLSitemap.Paths["en"] != "/sitemap" {
++			t.Fatalf("html_sitemap %+v, want enabled at /sitemap (vue-seo-layer's default path)", site.HTMLSitemap)
++		}
++	})
++
++	t.Run("post resolve", func(t *testing.T) {
++		var answer struct {
++			Action string `json:"action"`
++			SEO    struct {
++				Canonical string `json:"canonical"`
++			} `json:"seo"`
++			JSONLD struct {
++				Graph []map[string]any `json:"@graph"`
++			} `json:"jsonld"`
++			Breadcrumbs []struct {
++				Name string `json:"name"`
++				Path string `json:"path"`
++			} `json:"breadcrumbs"`
++		}
++		if err := json.Unmarshal([]byte(get("/_seo/api/v1/resolve?url=/blog/welcome-to-summercms")), &answer); err != nil {
++			t.Fatal(err)
++		}
++		if answer.Action != "ok" || answer.SEO.Canonical != demoSite+"/blog/welcome-to-summercms" {
++			t.Fatalf("resolve = %s, canonical %q", answer.Action, answer.SEO.Canonical)
++		}
++		var types []string
++		for _, node := range answer.JSONLD.Graph {
++			if typ, ok := node["@type"].(string); ok {
++				types = append(types, typ)
++			}
++		}
++		for _, want := range []string{"WebPage", "BlogPosting", "BreadcrumbList", "WebSite"} {
++			if !slices.Contains(types, want) {
++				t.Fatalf("@graph types %v lack %s", types, want)
++			}
++		}
++		crumbs := answer.Breadcrumbs
++		if len(crumbs) < 3 || crumbs[0].Path != "/" || crumbs[len(crumbs)-1].Path != "/blog/welcome-to-summercms" ||
++			!strings.HasPrefix(crumbs[1].Path, "/blog/category/") {
++			t.Fatalf("breadcrumbs %+v, want home, the category and the post", crumbs)
++		}
++	})
++
++	t.Run("route report", func(t *testing.T) {
++		body := `{"routes": ["/", "/faq", "/contact"]}`
++		if rec := do(http.MethodPost, "/_seo/api/v1/registry/routes", body, map[string]string{"Content-Type": "application/json"}); rec.Code != http.StatusUnauthorized {
++			t.Fatalf("route report without a token = %d, want 401", rec.Code)
++		}
++		rec := do(http.MethodPost, "/_seo/api/v1/registry/routes", body, map[string]string{
++			"Content-Type": "application/json", "Authorization": "Bearer " + reportToken,
++		})
++		if rec.Code != http.StatusOK {
++			t.Fatalf("route report = %d %s", rec.Code, rec.Body.String())
++		}
++		var urls []string
++		if err := demo.DB.Raw(`SELECT url FROM golem15_seo_pages WHERE reported_at IS NOT NULL ORDER BY url`).Scan(&urls).Error; err != nil {
++			t.Fatal(err)
++		}
++		if !slices.Contains(urls, "/faq") || !slices.Contains(urls, "/contact") {
++			t.Fatalf("reported pages %v, want /faq and /contact", urls)
++		}
++	})
++}

.planning/phases/33-seo-output-audit-and-content/33-12-sm-summercmsio-app.patch

@@ -0,0 +1 @@
+# no change beyond the pin bumps in 33-14

.planning/phases/33-seo-output-audit-and-content/33-12-vue-demo-app.patch

@@ -0,0 +1,322 @@
+diff --git a/app/components/SiteFooter.vue b/app/components/SiteFooter.vue
+index 604a4b7..54e7626 100644
+--- a/app/components/SiteFooter.vue
++++ b/app/components/SiteFooter.vue
+@@ -1,7 +1,6 @@
+-<!-- The site footer in summercms.io's: the tagline, the backend call to action and links. -->
++<!-- The site footer in summercms.io's: the tagline, the backend call to action, links and the HTML sitemap. -->
+ <script setup lang="ts">
+ const { t } = useI18n()
+-const sitemapUrl = useRuntimeConfig().public.sitemapUrl as string
+ </script>
+ 
+ <template>
+@@ -16,7 +15,8 @@ const sitemapUrl = useRuntimeConfig().public.sitemapUrl as string
+         <BackendCta />
+         <a href="https://summercms.io">{{ t('footer.website') }}</a>
+         <a href="https://summercms.io/docs">{{ t('footer.docs') }}</a>
+-        <a :href="sitemapUrl">{{ t('footer.sitemap') }}</a>
++        <!-- The HTML sitemap (vue-seo-layer), shown while the CMS has it on. -->
++        <SeoSitemapLink />
+       </div>
+     </div>
+   </footer>
+diff --git a/app/pages/account/security.vue b/app/pages/account/security.vue
+index 470d09f..d09f776 100644
+--- a/app/pages/account/security.vue
++++ b/app/pages/account/security.vue
+@@ -8,7 +8,9 @@
+ import { isTotpCode, svgDataUrl, type TotpSetup, type TwoFactorStatus } from '~/lib/twoFactor'
+ 
+ const { t } = useI18n()
+-useSeoMeta({ title: () => t('security.title'), robots: 'noindex' })
++// A signed-in page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ requiresAuth: true })
++useSeoMeta({ title: () => t('security.title') })
+ const { loggedIn } = useDemoAuth()
+ const twoFactor = useTwoFactor()
+ 
+diff --git a/app/pages/call/[conversation].vue b/app/pages/call/[conversation].vue
+index 32444e2..7db746e 100644
+--- a/app/pages/call/[conversation].vue
++++ b/app/pages/call/[conversation].vue
+@@ -12,7 +12,9 @@
+ <script setup lang="ts">
+ const { t } = useI18n()
+ const route = useRoute()
+-useSeoMeta({ title: () => t('call.title'), description: () => t('call.lead'), robots: 'noindex' })
++// A signed-in page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ requiresAuth: true })
++useSeoMeta({ title: () => t('call.title'), description: () => t('call.lead') })
+ const { loggedIn } = useDemoAuth()
+ 
+ const conversationId = computed(() => String(route.params.conversation ?? ''))
+diff --git a/app/pages/connect.vue b/app/pages/connect.vue
+index 4db725d..2c5f540 100644
+--- a/app/pages/connect.vue
++++ b/app/pages/connect.vue
+@@ -18,7 +18,9 @@ type ConsentRequest = {
+ }
+ 
+ const { t } = useI18n()
+-useSeoMeta({ title: () => t('connect.title'), robots: 'noindex' })
++// An auth page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ seo: { robots: 'noindex, nofollow' } })
++useSeoMeta({ title: () => t('connect.title') })
+ const route = useRoute()
+ const { token, loggedIn } = useDemoAuth()
+ 
+diff --git a/app/pages/forum/t/[id].vue b/app/pages/forum/t/[id].vue
+index e574901..8c5a66f 100644
+--- a/app/pages/forum/t/[id].vue
++++ b/app/pages/forum/t/[id].vue
+@@ -13,7 +13,9 @@ import { DEMO_API } from '~/lib/api/demo'
+ const { t } = useI18n()
+ const route = useRoute()
+ const threadId = computed(() => String(route.params.id ?? ''))
+-useSeoMeta({ title: () => t('forum.title'), description: () => t('forum.lead'), robots: 'noindex' })
++// A signed-in page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ requiresAuth: true })
++useSeoMeta({ title: () => t('forum.title'), description: () => t('forum.lead') })
+ const { loggedIn } = useDemoAuth()
+ 
+ const registerLink = computed(() => ({ path: '/register', query: { next: route.path } }))
+diff --git a/app/pages/friends.vue b/app/pages/friends.vue
+index 8f5bdef..11d9bd9 100644
+--- a/app/pages/friends.vue
++++ b/app/pages/friends.vue
+@@ -8,7 +8,9 @@
+ -->
+ <script setup lang="ts">
+ const { t } = useI18n()
+-useSeoMeta({ title: () => t('friends.title'), description: () => t('friends.lead'), robots: 'noindex' })
++// A signed-in page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ requiresAuth: true })
++useSeoMeta({ title: () => t('friends.title'), description: () => t('friends.lead') })
+ const { loggedIn } = useDemoAuth()
+ 
+ const registerLink = { path: '/register', query: { next: '/friends' } }
+diff --git a/app/pages/link-admin.vue b/app/pages/link-admin.vue
+index 08bfe42..e4205fb 100644
+--- a/app/pages/link-admin.vue
++++ b/app/pages/link-admin.vue
+@@ -17,7 +17,9 @@ type LinkDone = { data: { backend_user: { login: string; name: string } } }
+ type SignedIn = { user: { email?: string } }
+ 
+ const { t, locale } = useI18n()
+-useSeoMeta({ title: () => t('linkAdmin.title'), robots: 'noindex' })
++// An auth page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ seo: { robots: 'noindex, nofollow' } })
++useSeoMeta({ title: () => t('linkAdmin.title') })
+ const { token, loggedIn, logout } = useDemoAuth()
+ 
+ const code = ref('')
+diff --git a/app/pages/login.vue b/app/pages/login.vue
+index 9bc9442..fba22a4 100644
+--- a/app/pages/login.vue
++++ b/app/pages/login.vue
+@@ -2,7 +2,9 @@
+ import { challengeExpired, normalizeRecoveryCode, type TwoFactorChallenge } from '~/lib/twoFactor'
+ 
+ const { t } = useI18n()
+-useSeoMeta({ title: () => t('auth.login.title'), robots: 'noindex' })
++// An auth page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ seo: { robots: 'noindex, nofollow' } })
++useSeoMeta({ title: () => t('auth.login.title') })
+ const route = useRoute()
+ const { loggedIn, login, verifyChallenge, recoverChallenge, logout } = useDemoAuth()
+ const email = ref('')
+diff --git a/app/pages/presentations/[slug]/edit.vue b/app/pages/presentations/[slug]/edit.vue
+index 1687dd3..d16a504 100644
+--- a/app/pages/presentations/[slug]/edit.vue
++++ b/app/pages/presentations/[slug]/edit.vue
+@@ -5,7 +5,7 @@
+ -->
+ <script setup lang="ts">
+ const { t } = useI18n()
+-useSeoMeta({ title: () => t('deckForm.editTitle'), robots: 'noindex' })
++useSeoMeta({ title: () => t('deckForm.editTitle') })
+ useDeckSession()
+ const route = useRoute()
+ const slug = computed(() => String(route.params.slug ?? ''))
+diff --git a/app/pages/presentations/index.vue b/app/pages/presentations/index.vue
+index ca69e6f..94c353a 100644
+--- a/app/pages/presentations/index.vue
++++ b/app/pages/presentations/index.vue
+@@ -14,7 +14,7 @@ import { presentationApi, type MineCard } from '~/lib/api/presentations'
+ import { remoteLinkClick } from '~/lib/pilot'
+ 
+ const { t } = useI18n()
+-useSeoMeta({ title: () => t('mine.title'), robots: 'noindex' })
++useSeoMeta({ title: () => t('mine.title') })
+ const route = useRoute()
+ const { loggedIn } = useDeckSession()
+ 
+diff --git a/app/pages/presentations/new.vue b/app/pages/presentations/new.vue
+index 46728c6..8971da2 100644
+--- a/app/pages/presentations/new.vue
++++ b/app/pages/presentations/new.vue
+@@ -6,7 +6,7 @@
+ -->
+ <script setup lang="ts">
+ const { t } = useI18n()
+-useSeoMeta({ title: () => t('deckForm.newTitle'), robots: 'noindex' })
++useSeoMeta({ title: () => t('deckForm.newTitle') })
+ useDeckSession()
+ </script>
+ 
+diff --git a/app/pages/quizzes/[slug].vue b/app/pages/quizzes/[slug].vue
+index 4bbf1e9..0170ae2 100644
+--- a/app/pages/quizzes/[slug].vue
++++ b/app/pages/quizzes/[slug].vue
+@@ -19,7 +19,10 @@ const slug = computed(() => String(route.params.slug ?? ''))
+ const { loggedIn } = useDeckSession()
+ 
+ const quiz = ref<Quiz | null>(null)
+-useSeoMeta({ title: () => quiz.value?.title ?? t('quiz.listTitle'), robots: 'noindex' })
++// Taking a quiz needs an account, so the page stays out of the index
++// (vue-seo-layer applies this meta); the quiz list is public.
++definePageMeta({ seo: { robots: 'noindex' } })
++useSeoMeta({ title: () => quiz.value?.title ?? t('quiz.listTitle') })
+ const loadError = ref('')
+ const history = ref<Attempt[]>([])
+ 
+diff --git a/app/pages/register.vue b/app/pages/register.vue
+index 3a688c4..fc5836c 100644
+--- a/app/pages/register.vue
++++ b/app/pages/register.vue
+@@ -3,7 +3,9 @@
+ // POST /_user/api/v1/register behind Cloudflare Turnstile (D-07). No field is
+ // pre-filled and there is no e-mail verification step.
+ const { t } = useI18n()
+-useSeoMeta({ title: () => t('auth.register.title'), robots: 'noindex' })
++// An auth page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ seo: { robots: 'noindex, nofollow' } })
++useSeoMeta({ title: () => t('auth.register.title') })
+ const { loggedIn, register } = useDemoAuth()
+ const route = useRoute()
+ // A same-site path to return to after signing up (the quizzes' "register to
+diff --git a/app/pages/roadmap.vue b/app/pages/roadmap.vue
+index 201b0f7..5b83e96 100644
+--- a/app/pages/roadmap.vue
++++ b/app/pages/roadmap.vue
+@@ -10,7 +10,10 @@
+ import { DEMO_API, fetchRoadmap, roadmapPath } from '~/lib/api/demo'
+ 
+ const { t, locale } = useI18n()
+-useSeoMeta({ title: () => t('roadmap.title'), robots: 'noindex' })
++// Only a redirect to the roadmap deck (/p/..., declared noindex), so the
++// page itself stays out of the index (vue-seo-layer applies this meta).
++definePageMeta({ seo: { robots: 'noindex' } })
++useSeoMeta({ title: () => t('roadmap.title') })
+ 
+ const base = import.meta.server ? useRuntimeConfig().demo.apiBase : DEMO_API
+ const { data: deck, error } = await useAsyncData(`roadmap-${locale.value}`, () => fetchRoadmap(base, locale.value))
+diff --git a/app/pages/subscriptions.vue b/app/pages/subscriptions.vue
+index c2c3046..9a49ea2 100644
+--- a/app/pages/subscriptions.vue
++++ b/app/pages/subscriptions.vue
+@@ -1,5 +1,7 @@
+ <script setup lang="ts">
+ const { t } = useI18n()
++// A signed-in page: vue-seo-layer marks it noindex, nofollow from this meta.
++definePageMeta({ requiresAuth: true })
+ useSeoMeta({ title: () => t('subscriptions.title') })
+ const route = useRoute()
+ const { loggedIn } = useDemoAuth()
+diff --git a/i18n/locales/en.json b/i18n/locales/en.json
+index 126c4ee..56f81b3 100644
+--- a/i18n/locales/en.json
++++ b/i18n/locales/en.json
+@@ -37,8 +37,7 @@
+   "footer": {
+     "tagline": "{name} demo · one Go binary, every shared Golem15 plugin.",
+     "website": "summercms.io",
+-    "docs": "Docs",
+-    "sitemap": "Sitemap"
++    "docs": "Docs"
+   },
+   "cta": {
+     "link": "Want to see the backend? Contact Golem15",
+diff --git a/i18n/locales/pl.json b/i18n/locales/pl.json
+index ca8e9d4..c8183c6 100644
+--- a/i18n/locales/pl.json
++++ b/i18n/locales/pl.json
+@@ -37,8 +37,7 @@
+   "footer": {
+     "tagline": "Demo {name} · jeden plik binarny Go, wszystkie wspólne wtyczki Golem15.",
+     "website": "summercms.io",
+-    "docs": "Dokumentacja",
+-    "sitemap": "Mapa strony"
++    "docs": "Dokumentacja"
+   },
+   "cta": {
+     "link": "Chcesz zobaczyć panel administracyjny? Napisz do Golem15",
+diff --git a/nuxt.config.ts b/nuxt.config.ts
+index df8bb2d..6cb0c97 100644
+--- a/nuxt.config.ts
++++ b/nuxt.config.ts
+@@ -57,7 +57,9 @@ export default defineNuxtConfig({
+   devtools: { enabled: false },
+ 
+   // The journal and payment gateway layers declare their Nuxt modules
+-  // (@nuxt/fonts, @nuxtjs/i18n, @nuxtjs/seo); this app lists none.
++  // (@nuxt/fonts, @nuxtjs/i18n); this app lists none. The journal, menu and
++  // FAQ layers extend vue-seo-layer, which sets every page's head from the
++  // SEO plugin (golem15.seo) and serves robots.txt and the sitemaps from Go.
+   extends: ['vue-journal-layer', 'vue-menu-layer', 'vue-faq-layer', 'vue-paymentgateway-layer', 'vue-chat-layer', 'vue-chatvideo-layer', 'vue-forum-layer', 'vue-userfriends-layer'],
+ 
+   journal: {
+@@ -91,11 +93,15 @@ export default defineNuxtConfig({
+     },
+   },
+ 
+-  site: {
+-    url: 'http://127.0.0.1:3020',
+-    name: 'SummerCMS Demo',
+-    description: 'Every shared Golem15 plugin on one SummerCMS binary.',
+-    defaultLocale: 'en',
++  // vue-seo-layer (sm-demo-app DEPLOY.md, "SEO"). The deck viewers render in
++  // the browser only (routeRules below), so they are declared noindex: the
++  // layer sends them X-Robots-Tag: noindex, nofollow and its build guard
++  // (D-70) accepts them; any other browser-only route fails the build. Auth
++  // and signed-in pages mark themselves in their page meta (seo.robots,
++  // requiresAuth). The HTML sitemap pages keep the layer's paths
++  // (/sitemap, /mapa-strony), which the SEO plugin's site answer names.
++  seo: {
++    noindexRoutes: ['/p/**', '/presentations/**'],
+   },
+ 
+   runtimeConfig: {
+@@ -109,9 +115,16 @@ export default defineNuxtConfig({
+     userfriends: { apiBase: `${api}/_userfriends/api/v1` },
+     // The demo's own API (golem15.demo) for SSR fetches. NUXT_DEMO_API_BASE.
+     demo: { apiBase: `${api}/_demo/api/v1` },
++    // The SEO plugin's API for the resolve, the site answer, the 404 report
++    // and the route report (NUXT_SEO_API_BASE); robots.txt and the sitemap
++    // files come from the same Go origin (NUXT_SEO_BACKEND_BASE, empty: this
++    // base without /_seo/api/v1). The tokens are NUXT_SEO_NOTFOUND_TOKEN and
++    // NUXT_SEO_ROUTE_REPORT_TOKEN at run time, never committed.
++    seo: { apiBase: `${api}/_seo/api/v1` },
+     public: {
+-      // The Go sitemap plugin's document (the Nuxt one lists only the journal).
+-      sitemapUrl: `${api}/sitemap.xml`,
++      // Client-side navigations resolve through the Nuxt server
++      // (GET /api/__seo__/resolve, its cache), so /_seo needs no public route.
++      seo: { apiBase: '/api/__seo__' },
+       // Cloudflare Turnstile site key for register and login (D-07); public by
+       // design. NUXT_PUBLIC_TURNSTILE_SITE_KEY at runtime.
+       turnstileSiteKey: '',
+@@ -146,12 +159,6 @@ export default defineNuxtConfig({
+     },
+   },
+ 
+-  // The admin path is not listed: no public page links to the admin (D-04), and
+-  // naming it here would print it into every page's payload and robots.txt.
+-  // The admin answers with X-Robots-Tag: noindex itself.
+-  robots: { disallow: goPaths },
+-  linkChecker: { enabled: false },
+-
+   // The deck pages are bm's presentation views (D-14): they touch window,
+   // document and storage throughout, so they render in the browser only.
+   routeRules: {

.planning/phases/33-seo-output-audit-and-content/33-12-vue-summercmsio-app.patch

@@ -0,0 +1,57 @@
+diff --git a/changelog/nuxt.config.ts b/changelog/nuxt.config.ts
+index 67cb8c9..6bb556f 100644
+--- a/changelog/nuxt.config.ts
++++ b/changelog/nuxt.config.ts
+@@ -32,12 +32,21 @@ export default defineNuxtConfig({
+   compatibilityDate: '2025-07-15',
+   devtools: { enabled: false },
+ 
+-  // '..' first (header, footer, tokens, fonts, site config, landing strings),
+-  // then the Journal layer (pages, API client, sanitizer, SEO). The layer
+-  // declares @nuxt/fonts, @nuxtjs/i18n and @nuxtjs/seo, which the landing
+-  // lists at the same exact versions, so this config lists no modules.
++  // '..' first (header, footer, tokens, fonts, site config, landing strings,
++  // and @nuxtjs/seo for the canonical, robots and sitemap of the landing's
++  // site config), then the Journal layer (pages, API client, sanitizer). The
++  // layer declares @nuxt/fonts and @nuxtjs/i18n, which the landing lists at
++  // the same exact versions, so this config lists no modules.
+   extends: ['..', 'vue-journal-layer'],
+ 
++  // The Journal layer extends vue-seo-layer, the frontend of the SEO plugin.
++  // summercms.io's binary mounts no SEO plugin, so the layer makes no CMS
++  // call (no resolve, no root files, no 404 or route report): the pages keep
++  // the Journal layer's own head and @nuxtjs/seo's canonical. Without the CMS
++  // there is no HTML sitemap, so the layer registers no sitemap pages. The
++  // build guard still runs; every page here renders on the server.
++  seo: { cms: false, htmlSitemap: false },
++
+   // Layer CSS loads first (tokens, base), this file last. In this project's own
+   // config `~` is changelog/app.
+   css: ['~/assets/css/changelog.css'],
+diff --git a/changelog/testing/expect.txt b/changelog/testing/expect.txt
+index 4af772d..7fb7df2 100644
+--- a/changelog/testing/expect.txt
++++ b/changelog/testing/expect.txt
+@@ -55,6 +55,22 @@
+ # SEO
+ 200 /changelog/summercms-0-5-0 contains=<link rel="canonical" href="https://summercms.io/changelog/summercms-0-5-0"
+ 200 /changelog notcontains=content="noindex
++# vue-seo-layer is off (seo.cms false, the binary mounts no SEO plugin): the
++# titles come from the Journal layer's fallback meta with the landing's
++# title template, @nuxtjs/seo adds one canonical and one graph, no CMS
++# breadcrumbs, no HTML sitemap pages and not one resolve call.
++200 /changelog/summercms-0-5-0 contains=<title>SummerCMS 0.5.0 | SummerCMS</title>
++200 /changelog/summercms-0-5-0 count=rel="canonical":1
++200 /changelog/summercms-0-5-0 count=application/ld+json:1
++200 /changelog/summercms-0-5-0 count=<h1:1
++200 /changelog/summercms-0-5-0 notcontains=seo-breadcrumbs
++200 /changelog contains=<title>Changelog | SummerCMS</title>
++200 /changelog count=rel="canonical":1
++200 /changelog count=application/ld+json:1
++200 /changelog/plugins count=rel="canonical":1
++404 /sitemap
++404 /mapa-strony
++resolves * 0
+ 
+ # Asset prefixes
+ 200 /changelog contains="/changelog/_nuxt/

.planning/phases/33-seo-output-audit-and-content/33-13-SUMMARY.md

@@ -0,0 +1,250 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 13
+subsystem: apps
+tags: [seo, sitemap, nuxt, vue-seo-layer, grzybyfunkcjonalne, patches, deploy-decision]
+status: complete
+
+requires:
+  - phase: 33-03..33-06
+    provides: sitemap index and per-type files, Additional addresses migration, SEO page registry, route report, site answer, JSON-LD, breadcrumbs, pagination suffixes, per-type templates
+  - phase: 33-07..33-09
+    provides: vue-seo-layer v0.2.0 (root files, route report, build guard, components) and the journal, menu and faq layers on it
+  - phase: 33-11
+    provides: WebP variants (purego linking)
+  - phase: 33-12
+    provides: P33-46 wiring pattern, scratch-33 directory
+provides:
+  - "33-13-sm-grzybyfunkcjonalne-app.patch: Journal tag pages off and authors at /autor/:author, golem15.sitemap and golem15.seo config, both vhosts without root-file locations (P33-49), check-deploy.sh, smoke.sh (companions, route report, page names, seo-pages.csv, Additional addresses, rebuild, SMOKE_KEEP), smoke-seo.sh, urls.txt and urls-production.txt, migrate.sh with pl the only enabled locale, seo-settings.yaml (page_title_suffix, journal-author templates), grzyby:seo-settings types section, env templates, DEPLOY.md and README.md, boot, companions and console tests"
+  - "33-13-vue-grzybyfunkcjonalne-app.patch: nuxt.config on the seo options without @nuxtjs/seo keys, an app title template and default description for pages the CMS does not answer, no useSeoMeta in pages, SeoSitemapLink in the footer, SEO fixtures from the rehearsal under tests/fixtures/api/seo, ssr.test.ts and expect.txt checks"
+  - "33-13-local-wiring.md and 33-13-deploy-log.md (decision after-tags, production check list for 33-14)"
+affects: [33-14]
+
+actuals:
+  tokens: 45000
+  tasks: 4
+  commits: 1
+plan_head_before: c59b3e61ed833b9daa46ca7cce2e0224a822a166
+plan_head_after: 7199b26bb77507349f3eeaf12c498ec64ccea89a
+
+tech-stack:
+  added: []
+  patterns:
+    - "Scratch plugin wiring by git archive of each sibling's HEAD into the uninitialised submodule path (git refuses a symlink at a submodule path), the Nuxt worktree at the submodule path with the plan's name as a symlink, plugins.gen.go assume-unchanged in the scratch index"
+    - "Before/after head comparison: the live checkout's own production build rehearsed from a scratchpad copy, both stacks' heads diffed path by path"
+    - "Release data steps rehearsed through the management APIs with a temporary full-scope token, revoked at the end"
+
+key-files:
+  created:
+    - .planning/phases/33-seo-output-audit-and-content/33-13-sm-grzybyfunkcjonalne-app.patch
+    - .planning/phases/33-seo-output-audit-and-content/33-13-vue-grzybyfunkcjonalne-app.patch
+    - .planning/phases/33-seo-output-audit-and-content/33-13-local-wiring.md
+    - .planning/phases/33-seo-output-audit-and-content/33-13-deploy-log.md
+  modified:
+    - .planning/phases/33-seo-output-audit-and-content/deferred-items.md
+
+key-decisions:
+  - "Task 3: after-tags. 33-14 deploys the tagged v0.6.1 build to production grzybyfunkcjonalne.pl (DEPLOY.md steps 1 to 12, DB dump first); no staging install. Since the 2026-10-31 cutover the SummerCMS install is production, so there is no separate uat"
+  - "The static pages' titles move through the registry names and the site's title template (so page-2 suffixes land as on the PHP site); deploy/seo-pages.csv carries the home title, the descriptions and the social titles"
+  - "pl is the only enabled locale (migrate.sh step 3 and a DEPLOY.md step): an enabled en without content gives every page /en/ hreflang and sitemap addresses that 404"
+  - "The Additional addresses copied from the PHP definition (/, /blog) are removed once the route report lists the same pages"
+  - "All root files, robots.txt included, go to Nuxt; nginx keeps only = /_seo/api/v1/resolve of the SEO paths"
+  - "Demo (decided at the same time for 33-14): prefix_except_default, English at /, Polish at /pl/; reverses D-13"
+
+requirements-completed: [SC-1, SC-2, D-32, D-30, D-22, D-20, D-33, D-70, D-97, D-24]
+
+coverage:
+  - id: D1
+    description: "Every local urls.txt line of grzybyfunkcjonalne.pl answers as expected on the new stack (full rehearsal with the companions, the route report and the release data steps)"
+    requirement: SC-1
+    verification:
+      - kind: e2e
+        ref: "bash scripts/smoke.sh in the scratch worktree: smoke: ok (128 urls)"
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "One H1, one canonical and one JSON-LD graph on a post, a category, /kontakt and /; breadcrumbs through the category; the sitemap index and its files, each address once with lastmod, no /en/, no tag file, no /sitemap.xsl"
+    requirement: D-70
+    verification:
+      - kind: e2e
+        ref: "bash scripts/smoke-seo.sh http://127.0.0.1:3016: smoke-seo: ok"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "Both patches apply to the live repositories' HEADs"
+    requirement: D-32
+    verification:
+      - kind: automated
+        ref: "git apply --check against sm-grzybyfunkcjonalne-app 35d3664 and vue-grzybyfunkcjonalne-app e45ffe8: patches-ok"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "The static pages, /blog and the author page keep the titles and descriptions production renders today"
+    requirement: D-33
+    verification:
+      - kind: e2e
+        ref: "head diff of the Oct 31 production build and the new stack on the same rehearsal data (see Task 1)"
+        status: pass
+    human_judgment: false
+  - id: D5
+    description: "Deploy only after Jakub's decision; production checked by Jakub at 33-14's release checkpoint"
+    requirement: D-32
+    verification:
+      - kind: manual
+        ref: "33-13-deploy-log.md: Decision after-tags; check list for 33-14"
+        status: pass
+    human_judgment: true
+
+duration: 105min
+completed: 2026-11-04
+---
+
+# Phase 33 Plan 13: grzybyfunkcjonalne.pl on the new sitemap format and the SEO layer Summary
+
+**grzybyfunkcjonalne.pl rehearsed on the unreleased phase 33 stack with all 128 local URL checks passing and production's page titles kept. It now has per-type sitemaps through Nuxt, CMS-owned heads, breadcrumbs and a registry of its static pages. Two release patches cover it, and the deploy waits for the tagged build in 33-14, on production.**
+
+## Performance
+
+- **Duration:** about 105 minutes (17:28 to 19:13)
+- **Tasks:** 4 (Tasks 1 and 2 executed, Task 3 decided, Task 4 recorded as the after-tags deferral)
+- **Files in the patches:** 24 in the app repository, 15 in the Nuxt repository
+
+## Task 1: tracer on local links
+
+The wiring is in `33-13-local-wiring.md`. In short:
+- two detached worktrees under `../../scratch-33`;
+- the sibling plugins at their HEADs, copied in with `git archive`;
+- the framework replaced in go.work;
+- pnpm overrides `link:` to the four layers.
+
+**Runs:**
+- `scripts/build.sh` on the wiring, with the SSR guard passing.
+- `scripts/check-deploy.sh`: ok.
+- `scripts/smoke.sh`, the full rehearsal: `smoke: ok (128 urls)`. It runs migrate, the companions import, the route report, the page names, the CSV import, the Additional addresses step, the rebuild, Go and Nuxt, and then every local `urls.txt` line.
+- `scripts/smoke-seo.sh http://127.0.0.1:3016`: `smoke-seo: ok`. It covered 4 pages with one H1, canonical and JSON-LD each, breadcrumbs through `/cordyceps`, and the index of 5 files: posts 63, categories 8, authors 1, pages 4.
+- **Baseline:** the live checkout's Oct 31 production build ran in its own rehearsal (`smoke: ok (107 urls)`), and its heads were diffed against the new stack on the same data.
+  - Identical: the titles and descriptions of `/`, `/blog`, the posts, the categories, `/autor/admin`, `/kontakt`, `/trwaja-prace` and `/szukaj`.
+  - Different:
+    - D-41 pagination suffixes on page 2 and later;
+    - og:description added on three pages;
+    - two small og:title differences (`/autor/admin` gains the site suffix, `/blog?page=2` shows "Artykuły");
+    - `/szukaj` (noindex) without canonical and JSON-LD;
+    - the new `/mapa-strony`.
+
+## Task 2: patches
+
+- **Tests on the wiring:**
+  - `go vet` passes, untagged and tagged.
+  - `go test` passes with `-short`, with Docker and with `-tags summercms_mcp`, `plugins/grzyby/...` included.
+  - `pnpm test` 30/30, `pnpm smoke:ssr` 67 checks, `pnpm smoke:ga` 2 checks.
+- **Export:** both patches came out with `git diff --binary` and `git add -N` for new files, without the wiring.
+- **Check:** both pass `git apply --check` (`patches-ok`), again after the worktrees were removed.
+
+## Task 3: decision
+
+**after-tags** (Jakub, 2026-11-04). Production grzybyfunkcjonalne.pl gets the tagged v0.6.1 build in 33-14, following DEPLOY.md steps 1 to 12 with a DB dump first. No staging install is raised. There is no separate uat any more: the SummerCMS install has been production since the 2026-10-31 cutover. The user_setup secrets were checked by name before the checkpoint: the 404 token is in both `.env` files, and the optional route report token is in neither.
+
+## Task 4: deferral
+
+`33-13-deploy-log.md` records:
+- the decision and why the target is production;
+- that the `en` locale switch (step 5) and the emptying of the Additional addresses (step 10) are 33-14 deploy steps Jakub confirms at its release checkpoint;
+- the production check list for that checkpoint: sitemap index and one file, a post's head and breadcrumbs, SEO › Pages, Settings › Sitemaps, a crawl, the visual check of the 0.8 markup, Search Console, libwebp.
+
+The scratch worktrees are removed (see Cleanup). **uat does not run the new stack, and neither does production: it still runs the Oct 31 build (sm-grzybyfunkcjonalne-app 35d3664).**
+
+## Task Commits
+
+1. **Task 2:** `7199b26` docs(33-13): grzyby patches for the release (both patches, the wiring note, deferred findings)
+2. **Plan metadata:** `docs(33-13): complete the grzybyfunkcjonalne.pl plan` (this SUMMARY and the deploy log)
+
+Nothing was committed, pushed or tagged in the app repositories.
+
+## Decisions Made
+
+See `key-decisions` in the frontmatter. P33-49 was applied fully: robots.txt also leaves nginx for Nuxt.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] `/en/` hreflang links and sitemap addresses**
+- **Found during:** Task 1
+- **Issue:** The translate plugin's seeded `en` row is enabled. Every record then counts as available in `en`: the posts file listed 126 addresses for 63 posts, `x-default` pointed at `/en/`, and post heads linked `/en/blog/...`. All of these answer 404.
+- **Fix:** migrate.sh step 3 makes `pl` the only enabled locale and asserts it. DEPLOY.md step 5 does the same on the server. smoke-seo.sh and ssr.test.ts fail on any `/en/` link.
+
+**2. [Rule 1 - Bug] `/` and `/blog` listed twice in the pages file**
+- **Issue:** They come in as Additional addresses (migrated from the PHP definition) and as registry pages (from the route report).
+- **Fix:** smoke.sh and DEPLOY.md step 10 empty the Additional addresses after the route report, and smoke-seo.sh fails on duplicate `<loc>`. The plan expected the copied items to stay as Additional addresses: they are migrated, verified (`["/","/blog"]`), then removed. The plugin-side de-duplication stays a deferred item, also found in 33-12.
+
+**3. [Rule 1 - Bug] Titles would have changed on the live site**
+- **Issue:** A CSV title overrides the template. `/` loses the home template once it is a registry page. The new plugin answers for `/blog` (registry) and `/autor/admin` (journal-author) with derived titles ("Blog", "admin") instead of production's "Artykuły" and "Wpisy autora admin".
+- **Fix:**
+  - The registry names are set to "Artykuły" and "Trwają prace", and the titles come from the site template.
+  - The CSV carries the home title, the descriptions and the og titles.
+  - seo-settings.yaml gains `page_title_suffix "· Strona %page%"` and the journal-author templates.
+  - grzyby:seo-settings got a `types:` section (code and test) so the file can write per-type templates.
+
+**4. [Rule 1 - Bug] `/szukaj` lost its title suffix and description**
+- **Issue:** With @nuxtjs/seo gone, pages the CMS doesn't answer lost the suffix and the site description.
+- **Fix:** The app sets `app.head.titleTemplate` and a default description. error.vue keeps its old title without the suffix.
+
+**5. [Rule 3 - Blocking] grzyby console tests**
+- **Issue:** golem15.seo now requires golem15.sitemap, so the tests' plugin lists failed to activate.
+- **Fix:** The sitemap plugin is registered in both test activations, with a require/replace pair in `plugins/grzyby/go.mod`.
+
+**6. [Rule 3 - Blocking] Wiring**
+- **Issue:** Symlinks at submodule paths break `git status`.
+- **Fix:** Plugins are `git archive` copies, the Nuxt worktree sits at the submodule path, and `plugins.gen.go` is assume-unchanged in the scratch index (wiring drift only).
+
+### Plan assumptions adapted
+
+- The app was already on SummerCMS v0.6.0 with golem15.seo mounted and robots.txt served by Go (Phase 32), so summer.yaml is unchanged.
+- The SEO fixtures moved from `tests/fixtures/seo` to `tests/fixtures/api/seo`, and `smoke:ssr` no longer points the SEO API at an unreachable port.
+- `scripts/smoke.sh` gained `SMOKE_KEEP` and runs `smoke-seo.sh` last.
+- The plan's uat deploy target no longer exists (see Task 3).
+
+## Issues Encountered
+
+New items logged in deferred-items.md "From 33-13":
+- fallback locales producing addresses;
+- local-time `updated_at` on registry page saves (a lastmod one hour in the future);
+- the home template lost for a registry `/`;
+- route-report names without diacritics;
+- no token scope for the SEO or sitemap API;
+- `journal:image-variants` cannot open the database from the generated CLI;
+- the seeded `/uncategorized` category now in the sitemap.
+
+## For 33-14
+
+- **Deploy grzybyfunkcjonalne.pl to production** after the tags, by `33-13-deploy-log.md` and the patch's DEPLOY.md steps 1 to 12.
+  - Take the DB dump first.
+  - Jakub confirms steps 5 (`en` off) and 10 (Additional addresses emptied) at the release checkpoint, then runs the log's check list.
+  - Watch the grzyby:seo-settings `--dry-run`: it must list only the three new values, or editor changes would be overwritten.
+- **Apply the patches** on the release pins: `git apply` both, then bump the go.mod requires and the submodule pointers (seo, sitemap, journal, plus menu, faq and translate if tagged), the `package.json` layer tags and the lockfile. Then regenerate `plugins.gen.go` with `summer build`. The patch leaves it out because the scratch copies made it drift.
+- **Linking:** the grzyby binary becomes dynamically linked against glibc (purego). It runs on the Debian server, and DEPLOY.md documents it. Decide whether to keep that or build with `-tags nodynamic`. libwebp on the server was not checked; it is item 8 of the check list.
+- **WebP backfill:** `journal:image-variants` needs a `grzyby:image-variants` wrapper or a CLI fix before the backfill can run.
+- **Demo, decided by Jakub on 2026-11-04:** the demo moves to `prefix_except_default`. English stays at `/` and Polish moves to `/pl/…`, which reverses D-13. 33-14 applies it on top of the 33-12 demo patches: `i18n.strategy`, `/pl/mapa-strony`, locale-aware links and LanguageSwitcher, the demo's URL and smoke expectations, and `SMOKE_SEO_STRICT=1`. It is recorded in deferred-items.md under "Decided for 33-14".
+
+## Cleanup
+
+`git worktree remove --force` was run for both worktrees, and the `scratch-33/vue-grzybyfunkcjonalne-app` symlink was removed with `/bin/rm -f`. `git -C ../sm-grzybyfunkcjonalne-app worktree list` and the Nuxt submodule's list show only the live checkouts. The live app repository is unchanged: still 35d3664, with the same untracked `.gsd/`, `docs/` and self-named entry as at the start. 33-12's files in scratch-33 were not touched.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None beyond the plan's register.
+- T-33-58: tokens were checked by name only, and the rehearsal tokens were throwaway and revoked.
+- T-33-60: nginx exposes no `/_sitemap/` and no `/_seo/` path beyond resolve, and check-deploy.sh enforces it.
+- T-33-61: nothing was deployed.
+
+## Self-Check: PASSED
+
+- FOUND: 33-13-sm-grzybyfunkcjonalne-app.patch, 33-13-vue-grzybyfunkcjonalne-app.patch, 33-13-local-wiring.md, 33-13-deploy-log.md
+- FOUND: commit 7199b26
+- Both patches pass `git apply --check` against 35d3664 and e45ffe8.
+- `git -C ../sm-grzybyfunkcjonalne-app worktree list` has no scratch-33 entry.
+- No secret value in the patches, the logs or this summary.

.planning/phases/33-seo-output-audit-and-content/33-13-deploy-log.md

@@ -0,0 +1,55 @@
+# 33-13 deploy log
+
+## Decision
+
+**after-tags** (Jakub, 2026-11-04, Task 3 checkpoint). The production site grzybyfunkcjonalne.pl gets the tagged v0.6.1 build in 33-14. That deploy follows the patch's DEPLOY.md section "SEO pages and sitemaps (Phase 33)", steps 1 to 12, and step 1 takes a database dump before anything else. No staging install is raised. 33-13 deployed nothing and did not contact the server after the checkpoint.
+
+**There is no separate uat any more.** The plan was written for `uat.grzybyfunkcjonalne.pl` as a non-production environment next to the live WinterCMS site. Since the production cutover on 2026-10-31 (sm-grzybyfunkcjonalne-app 35d3664, DEPLOY.md "Production cutover"), the SummerCMS install is production:
+
+- the same `/srv/grzybyfunkcjonalne`, the same database and the same supervisor programs that served uat now serve grzybyfunkcjonalne.pl, with `SUMMER_ENV=production`;
+- the uat vhost is switched off, and re-enabling it would put the UAT gate in front of production;
+- the WinterCMS install stays on disk as the rollback, untouched.
+
+So 33-14 deploys to production. The staging-lock expectation of this plan (robots `Disallow: /` and noindex on uat) no longer applies.
+
+## Steps
+
+| Step | Result |
+|------|--------|
+| Decision recorded | after-tags, target production, no staging install |
+| Read-only check of the user_setup secrets by name (before the checkpoint) | `NUXT_SEO_NOTFOUND_TOKEN` 1 line in `nuxt/.env`, `SUMMER_GOLEM15__SEO__NOTFOUND_TOKEN` 1 line in `go/.env`; both route report tokens absent (optional, the 404 token is used). Values neither printed nor compared |
+| Build, upload, migrate, restart, nginx reload, rebuild, CSV import, smokes | not run in 33-13; 33-14 runs them on the tagged build |
+| Scratch worktrees | removed after this log (33-13-SUMMARY.md) |
+
+## Part of the 33-14 deploy, confirmed by Jakub at its release checkpoint
+
+These two data steps of DEPLOY.md change production data. Jakub confirms them at 33-14's release checkpoint before they run:
+
+- **Step 5, Polish only.** `UPDATE golem15_translate_locales SET is_enabled = (code = 'pl')` (the same switch is Settings › Locales). The seeded `en` row is enabled, which would give every page an `/en/` hreflang link and every record an `/en/` sitemap address, all answering 404. Run the `SELECT` first; no translation row is deleted.
+- **Step 10, Additional addresses.** Remove `/` and `/blog` from Settings › Sitemaps › Additional addresses. Migration `202610280002` copies them there from the Phase 17 definition, and SEO › Pages lists the same two pages after the route report, so without this step the pages file lists both twice.
+
+## Check list for 33-14's release checkpoint (production)
+
+Jakub runs these on https://grzybyfunkcjonalne.pl after the 33-14 deploy (steps 1 to 12) and before the release is called done:
+
+1. **Sitemap index and one file.** `/sitemap.xml` is a `<sitemapindex>` listing `sitemap-posts-1.xml`, `sitemap-categories-1.xml`, `sitemap-authors-1.xml`, `sitemap-pages-1.xml` and `sitemap-images-1.xml` on `https://grzybyfunkcjonalne.pl/`. `/sitemap-posts-1.xml` lists the 62 published posts, each once, with lastmod, with no `/en/` address and no hreflang. `/sitemap.xsl` answers 404.
+2. **A post's head and breadcrumbs.** For example `/blog/blogchaga-wprowadzenie`:
+   - title and description as before;
+   - one canonical on the apex;
+   - `index, follow`;
+   - one JSON-LD script;
+   - no `hreflang="en"`;
+   - visible breadcrumbs Strona główna › category › post.
+3. **SEO › Pages in /gfadmin:**
+   - lists `/`, `/blog` ("Artykuły"), `/kontakt` and `/trwaja-prace` ("Trwają prace");
+   - none of them is marked Not on the site;
+   - their SEO tabs show the CSV descriptions.
+4. **Settings › Sitemaps in /gfadmin:**
+   - the files table shows the five files with their counts;
+   - the Additional addresses are empty;
+   - IndexNow is off;
+   - the HTML sitemap is on at `/mapa-strony`, and that page lists the pages.
+5. **A crawl.** SEO › Site audit, Start crawl. It finishes, and its issues are read. Expected: no `/en/` 404s and no duplicate sitemap entries. `/uncategorized` is an open editorial decision (deferred-items.md).
+6. **The visual check of the 0.8 card and title markup.** Look at the home page, `/blog`, a category, a post and `/autor/admin`, on desktop and mobile. The post cards are now clickable as a whole and have no "more" link. Check the post title markup, the breadcrumbs at the top of the journal pages, and the footer link "Mapa strony".
+7. **Resubmit the sitemap in Search Console.** Submit `https://grzybyfunkcjonalne.pl/sitemap.xml` (same address, now an index) and check that Google reads its files.
+8. **libwebp on the server.** Run `ls /usr/lib/x86_64-linux-gnu/libwebp.so*`. If present, the Journal's WebP thumbnails use the fast encoder; if absent, the slower built-in one. Either works with the dynamically linked binary, unless 33-14 builds with `-tags nodynamic`.

.planning/phases/33-seo-output-audit-and-content/33-13-local-wiring.md

@@ -0,0 +1,116 @@
+# 33-13 local wiring (P33-46)
+
+How grzybyfunkcjonalne.pl was run on the phase 33 stack before any tag, on 2026-11-04. Nothing here is committed in the app repositories: the wiring lives only in the scratch worktrees, and the two patches leave it out (P33-47).
+
+## Directories
+
+| What | Path |
+|------|------|
+| Scratch directory (shared with 33-12) | `/media/nvme/dev/golem15/summercms.io/scratch-33` |
+| App worktree, detached at `35d3664` | `/media/nvme/dev/golem15/summercms.io/scratch-33/sm-grzybyfunkcjonalne-app` |
+| Nuxt worktree, detached at `e45ffe8` | `/media/nvme/dev/golem15/summercms.io/scratch-33/sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app` |
+| The plan's name for the Nuxt worktree | `/media/nvme/dev/golem15/summercms.io/scratch-33/vue-grzybyfunkcjonalne-app`, a symlink to the path above |
+
+vue-grzybyfunkcjonalne-app is not a top-level sibling: it is the submodule `vue-grzybyfunkcjonalne-app` of sm-grzybyfunkcjonalne-app (`git@git.golem15.com:golem15/vue-grzybyfunkcjonalne-app.git`, git dir `sm-grzybyfunkcjonalne-app/.git/modules/vue-grzybyfunkcjonalne-app`). Its worktree sits at the submodule path inside the app worktree, because `scripts/build.sh` builds `$ROOT/vue-grzybyfunkcjonalne-app` and git refuses a symlink at a submodule path (`expected submodule path ... not to be a symbolic link`).
+
+## Commands
+
+```sh
+S=/media/nvme/dev/golem15/summercms.io/summercms
+SC=/media/nvme/dev/golem15/summercms.io/scratch-33
+APP=$S/sm-grzybyfunkcjonalne-app
+W=$SC/sm-grzybyfunkcjonalne-app
+
+mkdir -p $SC
+git -C $APP worktree add --detach $W HEAD                                     # 35d3664
+git -C $APP/vue-grzybyfunkcjonalne-app worktree add --detach $SC/vue-grzybyfunkcjonalne-app HEAD   # e45ffe8
+rmdir $W/vue-grzybyfunkcjonalne-app
+git -C $APP/vue-grzybyfunkcjonalne-app worktree move $SC/vue-grzybyfunkcjonalne-app $W/vue-grzybyfunkcjonalne-app
+ln -s $W/vue-grzybyfunkcjonalne-app $SC/vue-grzybyfunkcjonalne-app
+
+# Go: the sibling plugin checkouts at their committed HEADs, copied into the
+# (uninitialised) submodule paths; a symlink there breaks git status.
+for p in faq journal menu seo sitemap translate user; do
+  rmdir $W/plugins/golem15/$p && mkdir $W/plugins/golem15/$p
+  git -C $S/sm-$p-plugin archive HEAD | tar -x -C $W/plugins/golem15/$p
+done
+sed -i "s#^replace git.golem15.com/golem15/summercms => ../summercms.go#replace git.golem15.com/golem15/summercms => $S/summercms.go#" $W/go.work
+# summer build records the copies as local sources (new descriptions, no
+# versions): plugins.gen.go drifts by wiring only, so build.sh's drift
+# check is told to look away in this worktree's index. 33-14 regenerates
+# plugins.gen.go after the real submodule bumps.
+git -C $W update-index --assume-unchanged plugins.gen.go
+
+# Nuxt: the four layers linked to the sibling checkouts.
+cat >> $W/vue-grzybyfunkcjonalne-app/pnpm-workspace.yaml <<EOF
+overrides:
+  vue-seo-layer: link:$S/vue-seo-layer
+  vue-journal-layer: link:$S/vue-journal-layer
+  vue-menu-layer: link:$S/vue-menu-layer
+  vue-faq-layer: link:$S/vue-faq-layer
+EOF
+pnpm -C $W/vue-grzybyfunkcjonalne-app install --no-frozen-lockfile
+
+# Build, check, rehearse (Docker for Postgres).
+cd $W
+SUMMERCMS_FRAMEWORK=$S/summercms.go bash scripts/build.sh
+bash scripts/check-deploy.sh
+bash scripts/smoke.sh                                                   # default ports 18096 and 13016
+SMOKE_KEEP=1 SMOKE_GO_PORT=18196 SMOKE_NUXT_PORT=3016 bash scripts/smoke.sh &   # held stack for the SEO checks
+bash scripts/smoke-seo.sh http://127.0.0.1:3016
+go test ./... ./plugins/grzyby/... && go test -tags summercms_mcp ./...
+pnpm -C vue-grzybyfunkcjonalne-app test
+pnpm -C vue-grzybyfunkcjonalne-app smoke:ssr && pnpm -C vue-grzybyfunkcjonalne-app smoke:ga
+```
+
+Stop a held rehearsal with SIGTERM to its own `bash scripts/smoke.sh` (the parent of the Go process on its port), never by pattern: 33-12 runs its own smoke at the same time.
+
+## Inputs at the time
+
+| Repository | Commit |
+|------------|--------|
+| summercms.go | `617e15d` (v0.6.0 plus phase 33) |
+| sm-seo-plugin | `49cc241` |
+| sm-sitemap-plugin | `9e5c393` |
+| sm-journal-plugin | `4f5bd19` |
+| sm-menu-plugin, sm-faq-plugin, sm-translate-plugin, sm-user-plugin | `98df4c7`, `3bf54cd`, `7e64224`, `97f83cc` (their tags v0.1.2, v0.1.2, v0.1.3, v0.1.19) |
+| vue-seo-layer, vue-journal-layer, vue-menu-layer, vue-faq-layer | `7af91fc`, `1080a3f`, `8b5da67`, `f7ec4fe` (linked, working trees clean) |
+
+## Ports
+
+| Use | Go | Nuxt |
+|-----|----|------|
+| `scripts/smoke.sh` defaults | 18096 | 13016 |
+| Held rehearsal for `smoke-seo.sh` | 18196 | 3016 (the plan's port) |
+| Baseline of the 2026-10-31 production build | 18296 | 13996 |
+
+The demo stack of 33-12 used 3020 (Nuxt) and its own Go port at the same time; none of these clash with it or with the other local services (8080, 8120, 3000, 5432).
+
+## Baseline ("before") run
+
+To compare the heads with what production serves today, the live checkout's own Oct 31 build (`bin/grzybyfunkcjonalne`, `build/nuxt/.output`) ran in its unchanged rehearsal from a scratchpad copy (`git archive HEAD config deploy scripts`, symlinks to `bin/`, `build/nuxt` and `plugins/grzyby`, a hold loop appended to the copied `smoke.sh`): `smoke: ok (107 urls)`. The live repository was only read.
+
+## Patches
+
+```sh
+cd $W && git add -N config/golem15.journal.yaml config/golem15.sitemap.yaml deploy/seo-pages.csv scripts/smoke-seo.sh
+git diff --binary -- . ':(exclude)go.work' ':(exclude)vue-grzybyfunkcjonalne-app' ':(exclude)plugins/golem15' ':(exclude)plugins.gen.go' \
+  > $S/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-13-sm-grzybyfunkcjonalne-app.patch
+cd $W/vue-grzybyfunkcjonalne-app && git add -N tests/fixtures/api/seo
+git diff --binary -- . ':(exclude)pnpm-lock.yaml' ':(exclude)pnpm-workspace.yaml' \
+  > $S/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-13-vue-grzybyfunkcjonalne-app.patch
+git -C $APP apply --check <app patch> && git -C $APP/vue-grzybyfunkcjonalne-app apply --check <nuxt patch>   # both pass
+```
+
+Left out on purpose: `go.work` (framework replace), `plugins.gen.go` (wiring drift), the submodule pointers, `pnpm-lock.yaml` and `pnpm-workspace.yaml` (link overrides). The pin bumps (go.mod requires, submodule pointers, `package.json` layer tags, the lockfile) are 33-14's.
+
+## Cleanup (after Task 4 or the deferral)
+
+```sh
+unlink $SC/vue-grzybyfunkcjonalne-app                                # the symlink
+git -C $APP/vue-grzybyfunkcjonalne-app worktree remove --force $W/vue-grzybyfunkcjonalne-app
+git -C $APP worktree remove --force $W
+git -C $APP worktree list; git -C $APP/vue-grzybyfunkcjonalne-app worktree list
+```
+
+`--force` because both worktrees hold the uncommitted wiring and patch sources; the patches are committed in summercms.go first.

.planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-journal-plugin-v0.4.0.md

@@ -0,0 +1,28 @@
+Excerpt: One H1 per post page, a heading outline and link attributes in the editor, WebP and resized variants of featured images, opt-in scored related posts, and richer content facts for SEO.
+
+## Highlights
+
+- **One H1 per page.** With the new setting on (the default), H1 headings in post and category content are saved as H2, so the page title stays the only H1. `journal:fix-headings` converts stored content.
+- **Featured images in WebP.** After an upload, a job writes resized variants (480, 800 and 1200 px by default) and a WebP copy of each; the API lists them and the journal layer serves them through `<picture>`.
+- **A better editor.** Heading levels follow the setting, an outline flags skipped, empty and link-only headings, links get `rel` options and a warning for generic link texts, and uploaded image names are slugged.
+
+## Added
+
+- Settings › Journal, tab Headings and links: Convert H1 to H2 (`content_h1_to_h2`) and the generic link texts; the settings API and MCP tools for settings, headings and image alt texts.
+- Content facts for other plugins: publication date, categories as parents, authors, images (with alt and decorative), YouTube embeds and the heading outline; a `journal-author` content type.
+- `journal:image-variants` to backfill variants of existing featured images, and the `golem15.journal.image_widths` config key.
+- Opt-in scored related posts (`golem15.journal.related_mode: scored`, shared tags and categories) with the previous and next post in the category.
+
+## Changed
+
+- **Requires SummerCMS v0.6.1.**
+- **Content descriptors list only locales with content.** Posts, categories, tags and authors still describe every enabled locale, but a locale gets an address (and so an hreflang link and a sitemap address) only when the record has content in it: a post or a category when its own translation in that locale holds text (title, content or excerpt; a category's name or description; a translated slug alone does not count), a tag or an author when at least one of its published posts is translated into it, and the default locale always. Sites with an enabled but untranslated locale stop advertising its fallback pages. Menu items keep every locale.
+- The H1 to H2 conversion leaves code samples alone: in a markdown body an `<h1>` inside a code block or code span keeps its tag, also when the body starts with an HTML block, and a raw `<h1>` elsewhere is converted as in the rendered page (API saves, imports, `journal:fix-headings` and translations).
+- Setting an image's alt text through the API or MCP on a markdown post writes it into the markdown (`![alt](src)`, or a raw `<img>` outside code), also when the markdown starts with an HTML tag, so the next save keeps it; an image the markdown does not hold that way is refused with a validation error. A translation that holds only HTML gets the alt in its HTML.
+- **Upgrade:** run the migrations, then `journal:fix-headings` (dry run first) to convert H1s already stored, and `journal:image-variants` once to write the variants of existing featured images. For the faster WebP encoder install libwebp on the server; the binary is now dynamically linked against glibc (see SummerCMS v0.6.1).
+
+## Fixed
+
+- `journal:image-variants` runs from the application's CLI: without a running server it opens the database and the uploads bucket itself instead of stopping with "database is not configured".
+- `journal:fix-headings` runs from the application's CLI too.
+- A very tall featured image (taller than 4096 px at a variant's width) no longer stops the image variants job or the `journal:image-variants` backfill: those widths are skipped with a warning.

.planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-seo-plugin-v0.2.0.md

@@ -0,0 +1,33 @@
+Excerpt: Structured data, breadcrumbs, hreflang and pagination in every resolve answer, a page registry, a site audit crawler with fix routes, auto-links and an internal links widget.
+
+## Highlights
+
+- **Complete SEO output from the CMS.** The resolve answer now carries one JSON-LD `@graph` per page (built per content kind, with the publisher or local business), breadcrumbs with a primary category, hreflang alternates, `<html lang>`, the pagination form and the page's outbound link rules.
+- **Site audit.** A crawler reads the site like a search engine (statuses, sitemaps, canonicals, titles, headings, JSON-LD, hreflang, links, images, orphan pages, content that appears only after JavaScript) and stores issues that name the tool that fixes them.
+- **Auto-links.** Phrases link to their pages in post bodies, fed from focus keyphrases, with an internal links widget in the SEO tab.
+
+## Added
+
+- A page registry (SEO › Pages) for the frontend's own pages, filled by the frontend's route report, with addresses and names per locale and a kind (page, offer, service, landing).
+- `GET /_seo/api/v1/site` for the frontend layer, `llms.txt`, and the sitemap index in robots.txt.
+- Publisher, local business and home crumb settings; per-record schema type, Service fields and custom JSON-LD with validation and a graph preview in the SEO tab.
+- Pagination in the query or path form with title and description suffixes.
+- Site audit settings, a nightly crawl, Site audit and Crawls screens and their MCP tools. With `golem15.seo.crawl_chrome_path` set, a rendered comparison through headless Chrome (chromedp).
+- Crawl cancel and time limits: cancelling a running crawl shows it as **Cancelling** until its job stops, then it ends cancelled with the pages fetched so far; no other crawl starts before that. A crawl that reaches the 6-hour job limit ends failed and keeps what it fetched, and a crawl whose job disappeared (for example after a worker restart) is ended by the next start instead of staying "running". When storing a crawl's results takes longer than 10 minutes, the crawl still ends at once, failed with that error, instead of staying "running" until the next start.
+- A sitemap filter for sm-sitemap-plugin that leaves noindex, canonicalised and redirected addresses out.
+- The route report takes an optional `noindex` list: the static paths the frontend serves noindex (pages behind a login, pages with a noindex robots meta). The sitemaps leave them out, Additional addresses included, and a changed list asks the sitemap for a rebuild. vue-seo-layer v0.2.0 sends it; a frontend that sends no list keeps working.
+- Links settings (outbound rules, new tab) and site cache purges after SEO writes.
+
+## Changed
+
+- **Requires SummerCMS v0.6.1 and sm-sitemap-plugin v0.2.0** (its filter contract).
+- **Upgrade:** set `golem15.seo.site_url` to the public origin. Give the frontend a route report token (`golem15.seo.route_report_token`, else the 404 token is used). After the first frontend start, check SEO › Pages and give the reported pages their titles and their addresses in other locales.
+
+## Fixed
+
+- Registry pages store their created and updated times in UTC, so a page without a content date no longer gets a sitemap lastmod in the future on a server east of UTC.
+- A content type's plain label is named untranslated in the address-owned refusal.
+- The crawler and its headless Chrome stay on the site's own port, so page code cannot reach other services on the server's address, and a link to another port is no longer reported as a page of the site.
+- Addresses with non-ASCII characters (for example `/blog/zażółć`) match their CMS records, focus keyphrases and link counts in the audit.
+- A Chrome that hangs while opening a tab no longer stalls the crawl: opening the tab and rendering the page share one 25-second limit.
+- A noindex Additional address of the sitemap found by the audit names `sitemap_update_settings` (remove it there) instead of a tool that cannot fix it.

.planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-sitemap-plugin-v0.2.0.md

@@ -0,0 +1,28 @@
+Excerpt: The sitemap is now an index of per-type files with real lastmod, hreflang, image and News sitemaps, IndexNow and an HTML sitemap. Breaking: the WinterCMS-format sitemap, its definitions screen and the XSL are gone.
+
+## Highlights
+
+- **A sitemap index of per-type files.** `/sitemap.xml` (same address) lists `/sitemap-<type>-<n>.xml` files built from every content type's published records and the additional addresses. Addresses keep their file between rebuilds; only a change of the file size renumbers.
+- **Real lastmod.** A record's lastmod moves only when a save changes something that matters (configurable ignore list), and rebuilds are debounced after record events and run nightly.
+- **Image and News sitemaps, IndexNow and an HTML sitemap.**
+
+## Added
+
+- hreflang alternates for records with more than one translated locale, with `x-default`.
+- Image sitemap files from each page's images, and a Google News sitemap (`sitemap-news.xml`) for articles published in the last 48 hours, limited to chosen types or categories.
+- IndexNow: a key, its key file and pings of added, changed and removed addresses in production, including a record deleted in the admin and a content edit that keeps its address.
+- An HTML sitemap API (groups, category trees, paging) for the site's sitemap page.
+- One settings screen (Settings › Sitemaps) with the files table, the addresses left out by reason, the content types (include, file name, headings) and the additional addresses; a management API and MCP tools.
+- A filter contract (`contract.Filter`) that lets another plugin leave addresses out (noindex, canonical elsewhere, redirect) and group them.
+- `contract.Rebuilder`, which lets another plugin ask for a debounced rebuild (the SEO plugin does when the frontend reports new noindex pages).
+
+## Changed
+
+- **Breaking.** The WinterCMS byte-format sitemap, priority tiers, the definitions screen, the old settings tile and `/sitemap.xsl` are removed. `<priority>` and `<changefreq>` are no longer written. The config keys `golem15.sitemap.cache_seconds` and `golem15.sitemap.priority_tiers` and the events `BeforeAddItem` and `AddItem` are gone.
+- **Upgrade:** run the migrations: the definition's url items move to the additional addresses (a relative path such as `o-nas` gets its leading slash, spaces are percent-encoded, a duplicate is copied once), `frontend_url` to the site address, `frontend_default_locale` to the default locale; the old table stays, unread. An item that cannot be an additional address (an absolute URL with `&`, another scheme, a malformed item) is not copied: the startup log names each one as `golem15.sitemap: definition url item not copied` with the item, its value and the reason, so check the log after the upgrade and add those addresses by hand if they are still wanted. Serve the root file names from `/_sitemap/files/<name>` (vue-seo-layer v0.2.0 does it; with nginx, a proxy rule) and remove any nginx `/sitemap*` location. Run `sitemap:rebuild` once after the release. Additional addresses that the site serves noindex are left out automatically once the frontend reports its noindex pages (sm-seo-plugin v0.2.0 with vue-seo-layer v0.2.0); otherwise remove them.
+- **Requires SummerCMS v0.6.1.**
+
+## Fixed
+
+- An additional address that a content record already lists is written once (it is counted as "Already listed by a content type" on the settings screen).
+- An HTML sitemap heading follows each language until an editor sets one; saving the settings no longer stores the type's name in the admin's language as every language's heading.

.planning/phases/33-seo-output-audit-and-content/33-14-notes-summercms-v0.6.1.md

@@ -0,0 +1,26 @@
+Excerpt: Content descriptors carry dates, parents, authors, media and headings; plugin field types get per-request options; attachments get WebP variants; validation now checks string, url and min/max length the Laravel way, with Polish messages.
+
+## Highlights
+
+- **Richer content descriptors.** A content type can now tell other plugins what a record is and what it holds: its kind (article, collection, profile, page), the MCP tools that fix it, its first publication date, its parents, its authors, its top heading level, and per locale its images, videos and heading outline. Sitemaps, structured data and site audits read these facts without knowing the plugin behind them.
+- **WebP variants of thumbnails.** `attach/webp` writes a WebP copy next to any attachment thumbnail, once, and `attach.VariantKey` names it.
+- **Validation that matches Laravel.** `lagoon.Validate` accepts the `string` and `url` rules and checks `min`/`max` as a length on every field that is not numeric.
+
+## Added
+
+- `pact.ContentDescriptor.Kind` and `Tools`, with the `ContentKind*` and `ContentTool*` constants.
+- `pact.ContentRecord.PublishedAt`, `Parents`, `Authors` and `TopHeading`; `pact.ContentLocale.Images`, `Videos` and `Headings`; the value types `ContentRef`, `ContentPerson`, `ContentImage`, `ContentVideo` and `ContentHeading`. All are optional: a descriptor that sets none behaves as before.
+- `pact.FormFieldType.RequestOptions`: a plugin field type can add options that change per request (for example values read from the database). They join the field's `fields.yaml` options, which win on the same key; an error keeps the `fields.yaml` options.
+- `attach.VariantKey(thumbKey, format)` and the `lagoon/attach/webp` package (`Encode`, `Variant`). Only binaries that import the package link the encoder.
+- Polish messages for the `string` rule and numeric wording for the Polish `min` and `max` messages.
+
+## Changed
+
+- `lagoon.Validate` checks `min` and `max` as a length on every field that is not `integer` or `numeric`: characters for a string, items for a list. **A stored value longer than its rule's `max` now fails its next admin save until it is shortened.** Before upgrading, check the long text columns your plugins validate with a `max` (for example a description with `max:5000` on a TEXT column).
+- A `min` or `max` bound that is not a whole number is now an error instead of being ignored.
+- **Binaries are no longer fully static when they link `attach/webp`.** The WebP encoder loads the system libwebp through purego, so a `CGO_ENABLED=0` build is dynamically linked against glibc (`ld-linux-x86-64.so.2`, `libc.so.6`, `libdl.so.2`, `libpthread.so.0`). It runs on Debian and Ubuntu servers, not in `scratch`, distroless-static or Alpine images. With libwebp installed the fast encoder is used; without it, a slower built-in one. Build with `-tags nodynamic` for a static binary that always uses the built-in encoder.
+- **`attach/webp` also decodes WebP.** Importing it registers the encoder library's WebP decoder ahead of the pure Go one for the whole process, so WebP uploads (thumbnails, size checks) are decoded by the system libwebp when it is installed. Keep libwebp patched, or build with `-tags nodynamic`, which decodes with the built-in copy.
+
+## Fixed
+
+- Settings forms whose rules use `string` or `url` (for example the Journal settings) can be saved from the admin again; they failed with "unrecognized validation rule".

.planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-faq-layer-v0.5.0.md

@@ -0,0 +1,16 @@
+Excerpt: FAQ blocks add a FAQPage node to the page's one JSON-LD graph and can render their title as styled text for widgets; the layer now extends vue-seo-layer.
+
+## Highlights
+
+- **FAQPage structured data.** `FaqBlock` adds a `FAQPage` node with the questions and plain-text answers to the page's single JSON-LD graph (prop `schema`, default on).
+- **Widget headings.** `headingLevel` 0 renders the FAQ name as a styled `<p>` that still labels the section, for sidebars and footers.
+
+## Added
+
+- `faqSchema()` and `faqAnswerText()` helpers.
+
+## Changed
+
+- **Breaking:** the layer extends vue-seo-layer, and the copied site cache purge route, library and plugin are removed (vue-seo-layer provides them with the same environment variables).
+- **Upgrade:** set `NUXT_SEO_API_BASE`, or `seo: { cms: false }` for a site without the SEO plugin. The layer brings vue-seo-layer's HTML sitemap pages (pl `/mapa-strony`, en `/sitemap` by default). An app that renders its pages through a root catch-all (`[...slug].vue`) gets none, so a CMS page at such a path stays visible, unless it sets `seo.htmlSitemap.overCatchAll: true`; an app with its own page at such a path keeps it; `seo: { htmlSitemap: false }` turns them off. When a page shows several FAQs, set `schema` false on all but one.
+- Requires vue-seo-layer v0.2.0.

.planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-journal-layer-v0.8.0.md

@@ -0,0 +1,26 @@
+Excerpt: The journal layer now runs on vue-seo-layer: one H1 per post page, breadcrumbs, CMS pagination, ItemList nodes, WebP srcsets and category neighbours. Breaking: @nuxtjs/seo is gone and post cards have one link.
+
+## Highlights
+
+- **Built on the SEO layer.** Every journal page takes its head, hreflang and JSON-LD from the SEO plugin; listings add an `ItemList` node, post pages a `BlogPosting`, all in one graph.
+- **One H1 in both Journal H1 modes.** The post title is the H1 while body H1s become H2s, and a `p` when the body keeps its own (`journal.postTitleTag` forces either).
+- **Faster images.** Featured images are served through `<picture>` with WebP and srcset from the Journal's variants.
+
+## Added
+
+- Breadcrumbs at the top of journal pages (`journal.breadcrumbs: false` when the layout renders them), CMS pagination links, a category's pillar content on its first page.
+- Previous and next posts in the category when the Journal's scored mode answers them.
+- Auto-links, outbound link rules and image attributes applied to the post body.
+- With `seo.pagination.form: 'path'`, listing pages get routes for the SEO layer's segments, its defaults included (`/blog/strona/2`, `/blog/page/2`), matching the pagination links.
+
+## Changed
+
+- **Breaking: `@nuxtjs/seo` is removed.** Remove `site: { url, name }` and the `ogImage`, `seo.canonicalQueryWhitelist`, `sitemap`, `robots` and `schemaOrg` keys; set `NUXT_SEO_API_BASE`, or `seo: { cms: false }` for a site without the SEO plugin. The journal sitemap source is gone; the sitemap plugin builds the sitemaps.
+- **Breaking: post cards have one link.** The read-more link and the image link are removed; the whole card is clickable. The post title may be a `p.journal-post__title`, related post cards are `h3`. Adjust app CSS that targets the old elements.
+- The shared site cache purge route moved to vue-seo-layer with the same path and variables.
+- **Upgrade:** The layer brings vue-seo-layer's HTML sitemap pages (pl `/mapa-strony`, en `/sitemap` by default). An app that renders its pages through a root catch-all (`[...slug].vue`) gets none, so a CMS page at such a path stays visible, unless it sets `seo.htmlSitemap.overCatchAll: true`; an app with its own page at such a path keeps it; `seo: { htmlSitemap: false }` turns them off. Post pages keep `og:type` article and their publish and update times next to the CMS head.
+- Requires vue-seo-layer v0.2.0.
+
+## Fixed
+
+- No more `Duplicated imports "JournalImageVariant"` warning on every build of an app with the layer.

.planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-menu-layer-v0.5.0.md

@@ -0,0 +1,11 @@
+Excerpt: The menu layer now extends vue-seo-layer, so every page of a menu-only site takes its head from the SEO plugin. Breaking: the copied site cache purge route is gone.
+
+## Highlights
+
+- **SEO head on every page.** The layer extends vue-seo-layer: pages resolve through the SEO plugin and take their title, canonical, hreflang and JSON-LD from it.
+
+## Changed
+
+- **Breaking:** `server/api/__site__/cache/purge.post.ts`, `server/lib/siteCachePurge.ts` and `server/plugins/site-cache-purge.ts` are removed from this layer; vue-seo-layer provides the same route, library and plugin with the same environment variables. An app that imported the library from this layer imports it from vue-seo-layer.
+- **Upgrade:** set `NUXT_SEO_API_BASE` when the backend is not on `http://127.0.0.1:8096`, or `seo: { cms: false }` for a site without the SEO plugin. The layer brings vue-seo-layer's HTML sitemap pages (pl `/mapa-strony`, en `/sitemap` by default). An app that renders its pages through a root catch-all (`[...slug].vue`) gets none, so a CMS page at such a path stays visible, unless it sets `seo.htmlSitemap.overCatchAll: true`; an app with its own page at such a path keeps it; `seo: { htmlSitemap: false }` turns them off.
+- Requires vue-seo-layer v0.2.0.

.planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-seo-layer-v0.2.0.md

@@ -0,0 +1,25 @@
+Excerpt: hreflang and one JSON-LD graph on every page, robots.txt and sitemaps served from the CMS, server-rendered breadcrumbs, pagination and HTML sitemap, a build guard against browser-only indexable pages, and a route report to the page registry.
+
+## Highlights
+
+- **The whole SEO head from the CMS.** Besides title, description, canonical and Open Graph, every server-rendered page now gets `<html lang>`, hreflang links, `og:locale` and exactly one JSON-LD `@graph`, which app components extend through `useSchemaNode`.
+- **Root files from the backend.** robots.txt, the sitemap index and files, llms.txt and the IndexNow key file are served from the SEO and sitemap plugins.
+- **No accidental client-only pages.** The build fails when an indexable route would render only in the browser; declared and signed-in routes are sent `noindex`.
+
+## Added
+
+- `<SeoBreadcrumbs>`, `<SeoPagination>` with `usePagination()` (prev and next links, `%pages%` in the CMS title), and HTML sitemap pages with a footer link (`<SeoSitemapLink>`), in English and Polish.
+- The route report: at server start the site's static pages go to the CMS page registry. With `@nuxtjs/i18n` prefix strategies only the default-locale pages are reported; their translations are set in SEO › Pages. The same report lists the static pages the site serves noindex (signed-in pages, a noindex `seo.robots`, `seo.noindexRoutes`, and their translations), so the CMS leaves them out of the XML and HTML sitemaps.
+- A startup drift check that logs when the CMS's URL patterns, pagination or HTML sitemap paths differ from the build.
+- Body link utilities for auto-links, outbound rules and image attributes.
+- HTML sitemap pages exist once per locale with `@nuxtjs/i18n`, at the configured path, and never take a path from an app's catch-all page unless `seo.htmlSitemap.overCatchAll` is on.
+- `seo.noindexRoutes`, `seo.htmlSitemap` (with `overCatchAll`), `seo.pagination` and `seo.routeReport` options.
+
+## Changed
+
+- **Upgrade:** set `NUXT_SEO_ROUTE_REPORT_TOKEN` (or keep `NUXT_SEO_NOTFOUND_TOKEN`), declare browser-only routes in `seo.noindexRoutes` or render them on the server, and remove nginx locations for `/sitemap*` and `/robots.txt` so the site serves them. An app with `@nuxtjs/i18n` gives each locale its full HTML sitemap path in `seo.htmlSitemap.paths`. An app that renders its pages through a root catch-all (`[...slug].vue`) gets no HTML sitemap pages unless it sets `seo.htmlSitemap.overCatchAll: true`; an app with its own page at a sitemap path keeps it.
+- Works best with sm-seo-plugin v0.2.0 and sm-sitemap-plugin v0.2.0; against an older backend the new parts stay off.
+
+## Fixed
+
+- robots.txt, sitemap.xml and llms.txt answer 503 with `Retry-After` while the backend has not answered since the server started, so a crawler retries instead of reading a missing robots.txt as allow-all; this also keeps a staging site's `Disallow` in force. Once the backend has answered, its last answer is used while it is down, so on a site whose backend has no SEO plugin these files keep coming from the app during an outage.

.planning/phases/33-seo-output-audit-and-content/33-14-risk-max.sql

@@ -0,0 +1,35 @@
+-- RISK-MAX check (quick task 261104-fx1): rows whose stored value is longer
+-- than the max of its lagoon.Validate rule, so their next admin save fails.
+-- Read-only: SELECT only. Tables a database lacks are reported as absent.
+\pset format unaligned
+\pset tuples_only on
+\pset fieldsep '|'
+DO $$
+DECLARE r record; n bigint; mx bigint;
+BEGIN
+  FOR r IN SELECT * FROM (VALUES
+ ('backend_user_roles', 'name', 255, 'name'),
+ ('backend_user_roles', 'code', 255, 'code'),
+ ('backend_users', 'login', 255, 'login'),
+ ('backend_users', 'email', 255, 'email'),
+ ('jz_bm_checklists', 'description', 10000, 'description'),
+ ('jz_bm_checklist_items', 'notes', 10000, 'notes'),
+ ('golem15_feedback_submissions', 'email', 255, 'email'),
+ ('golem15_oauthserver_clients', 'redirect_uris (joined by newline)', 20000, $q$array_to_string(ARRAY(SELECT jsonb_array_elements_text(CASE WHEN jsonb_typeof(redirect_uris::jsonb) = 'array' THEN redirect_uris::jsonb ELSE '[]'::jsonb END)), E'\n')$q$),
+ ('golem15_oauthserver_clients', 'sector_identifier', 255, 'sector_identifier'),
+ ('golem15_oauthserver_settings', 'custom_css', 20000, 'custom_css'),
+ ('golem15_user_organisations', 'name', 255, 'name'),
+ ('golem15_user_organisations', 'description', 5000, 'description'),
+ ('golem15_sociallogin_settings', 'microsoft_tenant', 255, 'microsoft_tenant')) AS t(tbl, col, lim, expr) LOOP
+    IF to_regclass(r.tbl) IS NULL THEN
+      RAISE NOTICE '%|%|%|absent', r.tbl, r.col, r.lim;
+      CONTINUE;
+    END IF;
+    BEGIN
+      EXECUTE format('SELECT count(*) FILTER (WHERE char_length(v) > %s), coalesce(max(char_length(v)), 0) FROM (SELECT (%s)::text AS v FROM %I) s', r.lim, r.expr, r.tbl) INTO n, mx;
+      RAISE NOTICE '%|%|%|over=% longest=%', r.tbl, r.col, r.lim, n, mx;
+    EXCEPTION WHEN others THEN
+      RAISE NOTICE '%|%|%|error %', r.tbl, r.col, r.lim, SQLERRM;
+    END;
+  END LOOP;
+END $$;

.planning/phases/33-seo-output-audit-and-content/33-14-sm-demo-app-locale.patch

@@ -0,0 +1,371 @@
+diff --git a/DEPLOY.md b/DEPLOY.md
+index f2f4d0b..4209ab6 100644
+--- a/DEPLOY.md
++++ b/DEPLOY.md
+@@ -707,13 +707,21 @@ the 404 log, robots.txt with AI bot switches, history and the `seo_` MCP tools (
+   (`config/golem15.sitemap.yaml`, or **Settings › Sitemaps**); without one `/sitemap.xml` answers 404. The
+   demo has no tag pages (`config/golem15.journal.yaml`, `tag_pages: false`), so no tag address is listed.
+   Rebuilds run as jobs in the serve process after each Journal save and nightly. The footer links the
+-  HTML sitemap (`/sitemap`, `/mapa-strony` in Polish).
++  HTML sitemap (`/sitemap`, `/pl/mapa-strony` in Polish; `demo:seed` sets both addresses in
++  **Settings › Sitemaps** while they are the plugin's defaults).
++- **Languages.** English is at `/`, Polish under `/pl/` (`vue-demo-app/nuxt.config.ts`,
++  `prefix_except_default`), the prefix the Journal, sitemap and SEO plugins give every non-default locale.
++  The language switcher links to the same page in the other language; the `i18n_redirected` cookie keeps
++  the last choice and sends a returning visitor of `/` to `/pl`. Before this release Polish was served
++  from a cookie at the English addresses, so every Polish address is new; nothing redirects the old way,
++  which had no addresses of its own. The reported pages (SEO › Pages) are the English ones; give a page
++  its Polish address there to list it in the sitemaps with hreflang.
+ - **Page titles.** A reported page takes its name from its path ("Home", "Faq") until it has its own SEO
+   title; `deploy/seo-pages.csv` holds the titles and descriptions the pages had before (records by URL,
+   imported once, below).
+ - **Verify** after the release: `curl -s https://demo.summercms.io/robots.txt` shows the copied lines and
+   the `Sitemap:` line; `curl -sI https://demo.summercms.io/robots.txt` answers 200 `text/plain`; and from
+-  the build machine `SMOKE_SEO_API=… scripts/smoke-seo.sh https://demo.summercms.io` (below) ends with
++  the build machine `SMOKE_SEO_STRICT=1 SMOKE_SEO_API=… scripts/smoke-seo.sh https://demo.summercms.io` (below) ends with
+   `smoke-seo: ok`.
+ 
+ **Before the first release with Phase 33** (the SEO layer and the new sitemap format), on rome as root
+@@ -770,10 +778,10 @@ the registry; and a 404 reaching the 404 log (removed again). Locally after `scr
+ `scripts/smoke-seo.sh http://127.0.0.1:3020`. Against rome, from the build machine with the admin
+ password in a 0600 file and the Go port reached over an SSH tunnel
+ (`$RSH -N -L 18098:127.0.0.1:8098 $ROME &`):
+-`SMOKE_SEO_API=http://127.0.0.1:18098 SMOKE_SEO_ADMIN_PASSWORD_FILE=… scripts/smoke-seo.sh https://demo.summercms.io`.
+-An alternate or sitemap address that does not answer 200 is a `WARN` line (`SMOKE_SEO_STRICT=1` makes it
+-a failure): the Polish addresses (`/pl/…`) the CMS names answer 404 while the site keeps the language in a
+-cookie at one address (D-13).
++`SMOKE_SEO_STRICT=1 SMOKE_SEO_API=http://127.0.0.1:18098 SMOKE_SEO_ADMIN_PASSWORD_FILE=… scripts/smoke-seo.sh https://demo.summercms.io`.
++An alternate or sitemap address that does not answer 200 is a `WARN` line; `SMOKE_SEO_STRICT=1` makes it
++a failure, and the demo runs it so, since the Polish addresses (`/pl/…`) the CMS names are pages of the
++site.
+ 
+ ## Build
+ 
+@@ -888,12 +896,11 @@ shell on `/smbackend` and 200 JSON from its public `/smbackend/api/v1/lang`, tha
+ (including the client-only deck page, which carries `window.__NUXT_SITE_CONFIG__`) carries a
+ site-cache purge key (`cachePurgeToken`, `cacheAllowProxied`; it prints the key name only), 200 JSON from
+ `/_journal/api/v1/posts`, 404 for `/oauth/authorize` (it must not reach Go), the Turnstile widget
+-container on `/register`, 200 on `/contact`, the Płatności tour card on `/` with the `i18n_redirected=pl`
+-cookie, and a 422 `turnstile_failed` for a token-less `POST /_user/api/v1/register` (a 503
++container on `/register`, 200 on `/contact`, the Płatności tour card on `/pl`, and a 422 `turnstile_failed` for a token-less `POST /_user/api/v1/register` (a 503
+ `turnstile_unavailable` means `.env` has no `SUMMER_TURNSTILE__SECRET`). For the presentations and
+-quizzes it checks the `/roadmap` redirect to `/p/roadmap-{hash}` (and `roadmap-pl` with the Polish
+-cookie), 200 on that public deck page, the public quiz list (no answers) and the Polish quiz on
+-`/quizzes`, 401 without a JWT on `/api/realtime/token` and the deck API, that the subscribe proxy never
++quizzes it checks the `/roadmap` redirect to `/p/roadmap-{hash}` (and `/pl/p/roadmap-pl-{hash}` from
++`/pl/roadmap`), 200 on that public deck page, the public quiz list (no answers) and the Polish quiz on
++`/pl/quizzes`, 401 without a JWT on `/api/realtime/token` and the deck API, that the subscribe proxy never
+ reaches Go, and a WebSocket upgrade on `/ws` (101 from the demo's Centrifugo; a foreign `Origin` is
+ refused). Last, `scripts/check-back.cjs` (the global Playwright, as `deck-snapshot.cjs`) checks the
+ browser history: the home page's Presentations card links straight to the deck of the language (with a
+diff --git a/README.md b/README.md
+index 78aa580..411e5a6 100644
+--- a/README.md
++++ b/README.md
+@@ -119,6 +119,7 @@ any number of times:
+   twin `summercms-podstawy` (context `demo:pl`); the site lists the quizzes of its language by context;
+ - the subscription plans Starter (19 PLN, 5 EUR, 5 USD) and Professional (29 PLN, 7 EUR, 8 USD);
+ - the sitemap definition;
++- the HTML sitemap addresses `/sitemap` and `/pl/mapa-strony` (Settings › Sitemaps), while the settings hold the sitemap plugin's defaults;
+ - the chat family (below): personas, channels with history, a welcome DM to the visitor, the forum,
+   friends, the moderator group and the default moderation lists;
+ - the roadmap decks `roadmap` (English) and `roadmap-pl` (Polish), regenerated on every run (below).
+diff --git a/plugins/demo/console/seed.go b/plugins/demo/console/seed.go
+index 7d19304..1e3188d 100644
+--- a/plugins/demo/console/seed.go
++++ b/plugins/demo/console/seed.go
+@@ -60,6 +60,7 @@ func runSeed(ctx context.Context, app *backpack.App, db *gorm.DB, out bonfire.Ou
+ 		{"subscription plans starter and professional", created(seedPlans)},
+ 		{"feedback settings", func(tx *gorm.DB) (string, error) { return seedFeedbackSettings(ctx, app, tx) }},
+ 		{"sitemap definition", created(seedSitemap)},
++		{"HTML sitemap addresses (en, pl)", seedSitemapHTMLPaths},
+ 		{"chat personas", created(seedPersonas(ctx))},
+ 		{"chat channels and history (en)", created(seedChannels(ctx, channelsEN))},
+ 		{"chat channels and history (pl)", created(seedChannels(ctx, channelsPL))},
+@@ -362,6 +363,26 @@ func seedSitemap(tx *gorm.DB) (bool, error) {
+ 	return true, tx.Exec(`INSERT INTO golem15_sitemap_definitions (theme, data, created_at, updated_at) VALUES ('default', ?, now(), now())`, data).Error
+ }
+ 
++// demoHTMLSitemapPaths are the HTML sitemap's addresses on the demo: English
++// at /sitemap and Polish under the site's /pl/ prefix (vue-demo-app
++// i18n.strategy prefix_except_default and seo.htmlSitemap.paths).
++const demoHTMLSitemapPaths = `{"en":"/sitemap","pl":"/pl/mapa-strony"}`
++
++// seedSitemapHTMLPaths gives the HTML sitemap the demo's addresses while the
++// settings hold none or the sitemap plugin's defaults ({"pl":"/mapa-strony",
++// "en":"/sitemap"}); addresses an editor changed in Settings › Sitemaps stay.
++func seedSitemapHTMLPaths(tx *gorm.DB) (string, error) {
++	res := tx.Exec(`UPDATE golem15_sitemap_settings SET html_paths = ?::jsonb
++		WHERE id = 1 AND (html_paths IS NULL OR html_paths = '{}'::jsonb OR html_paths = '{"pl":"/mapa-strony","en":"/sitemap"}'::jsonb)`, demoHTMLSitemapPaths)
++	if res.Error != nil {
++		return "", res.Error
++	}
++	if res.RowsAffected == 0 {
++		return "exists", nil
++	}
++	return "updated", nil
++}
++
+ // The plan codes are distinct from other local apps' plans: Stripe price
+ // lookup keys are <code>_<currency> per Stripe account, and a plan sync moves
+ // a lookup key to its own new price.
+diff --git a/scripts/check-back.cjs b/scripts/check-back.cjs
+index 2953394..3b8ae47 100644
+--- a/scripts/check-back.cjs
++++ b/scripts/check-back.cjs
+@@ -67,7 +67,7 @@ async function cardHref(page, base) {
+   await page.goto(`${base}/`, { waitUntil: 'networkidle' })
+   return page.evaluate(() => {
+     const links = Array.from(document.querySelectorAll('#tour .tour-card__link'))
+-    const deck = links.find((a) => /^\/(p\/roadmap|roadmap)/.test(a.getAttribute('href') || ''))
++    const deck = links.find((a) => /^\/(pl\/)?(p\/roadmap|roadmap)/.test(a.getAttribute('href') || ''))
+     return deck ? deck.getAttribute('href') : ''
+   })
+ }
+@@ -81,23 +81,24 @@ const TOKEN_COOKIE = 'summercms_demo_token'
+ async function memberHome(browser, base, host, locale, mine) {
+   const ctx = await browser.newContext({ viewport: { width: 1440, height: 900 } })
+   const cookies = [{ name: TOKEN_COOKIE, value: 'check-back', domain: host, path: '/' }]
+-  if (locale) cookies.push({ name: 'i18n_redirected', value: locale, domain: host, path: '/' })
+   await ctx.addCookies(cookies)
+   const page = await ctx.newPage()
+   const errors = []
+   page.on('console', (m) => { if (m.type() === 'error' || /hydration/i.test(m.text())) errors.push(m.text()) })
+   const what = `member home${locale ? ` (${locale})` : ''}`
+   try {
+-    const res = await page.goto(`${base}/`, { waitUntil: 'networkidle' })
++    // Polish lives under /pl/ (prefix_except_default).
++    const prefix = locale ? `/${locale}` : ''
++    const res = await page.goto(`${base}${prefix || '/'}`, { waitUntil: 'networkidle' })
+     const html = res ? await res.text() : ''
+-    if (!/href="\/presentations"[^>]*class="tour-card__link"/.test(html)) bad(`${what}: the server's Presentations card does not link to /presentations`)
++    if (!new RegExp(`href="${prefix}/presentations"[^>]*class="tour-card__link"`).test(html)) bad(`${what}: the server's Presentations card does not link to ${prefix}/presentations`)
+     if (!html.includes(`site-header__mine">${mine}<`)) bad(`${what}: the server's header has no '${mine}' link`)
+     const hydrated = await page.evaluate(() => ({
+       card: Array.from(document.querySelectorAll('#tour .tour-card__link')).map((a) => a.getAttribute('href')),
+       mine: (document.querySelector('.site-header__mine') || {}).textContent || '',
+     }))
+-    if (!hydrated.card.includes('/presentations') || hydrated.card.some((h) => /^\/(p\/)?roadmap/.test(h || ''))) {
+-      bad(`${what}: after hydration the card links are ${hydrated.card.join(',')}, want /presentations and no deck`)
++    if (!hydrated.card.includes(`${prefix}/presentations`) || hydrated.card.some((h) => /^\/(pl\/)?(p\/)?roadmap/.test(h || ''))) {
++      bad(`${what}: after hydration the card links are ${hydrated.card.join(',')}, want ${prefix}/presentations and no deck`)
+     }
+     if (hydrated.mine.trim() !== mine) bad(`${what}: after hydration the header link reads '${hydrated.mine.trim()}', want '${mine}'`)
+     const mismatch = errors.filter((e) => /hydration/i.test(e))
+@@ -114,9 +115,8 @@ async function main() {
+   try {
+     // The Polish card links to the Polish deck.
+     const pl = await browser.newContext({ viewport: { width: 1440, height: 900 } })
+-    await pl.addCookies([{ name: 'i18n_redirected', value: 'pl', domain: host, path: '/' }])
+-    const plHref = await cardHref(await pl.newPage(), base)
+-    if (!/^\/p\/roadmap-pl-[0-9a-f]+$/.test(plHref)) bad(`pl home: the Presentations card links to '${plHref}', want /p/roadmap-pl-{hash}`)
++    const plHref = await cardHref(await pl.newPage(), `${base}/pl`)
++    if (!/^\/pl\/p\/roadmap-pl-[0-9a-f]+$/.test(plHref)) bad(`pl home: the Presentations card links to '${plHref}', want /pl/p/roadmap-pl-{hash}`)
+     await pl.close()
+ 
+     const ctx = await browser.newContext({ viewport: { width: 1440, height: 900 } })
+diff --git a/scripts/check-live.sh b/scripts/check-live.sh
+index c2bed87..b91e815 100755
+--- a/scripts/check-live.sh
++++ b/scripts/check-live.sh
+@@ -179,14 +179,14 @@ code="$(get /contact)"
+ no_admin_link /contact
+ no_purge_key /contact
+ 
+-# The @nuxtjs/i18n cookie that selects the language (vue-demo-app/nuxt.config.ts).
+-code="$(get / -b i18n_redirected=pl)"
++# Polish lives under /pl/ (vue-demo-app/nuxt.config.ts, prefix_except_default).
++code="$(get /pl)"
+ if [[ "$code" != 200 ]]; then
+-	bad "GET $BASE/ (pl cookie): status $code, want 200"
++	bad "GET $BASE/pl: status $code, want 200"
+ else
+-	grep -qF 'Płatności' "$TMP/body" || bad "GET $BASE/ (pl cookie): no Płatności tour card (Polish not served)"
+-	no_admin_link "/ (pl cookie)"
+-	no_purge_key "/ (pl cookie)"
++	grep -qF 'Płatności' "$TMP/body" || bad "GET $BASE/pl: no Płatności tour card (Polish not served)"
++	no_admin_link "/pl"
++	no_purge_key "/pl"
+ fi
+ 
+ email="check-live-$(date +%s)-$RANDOM@example.test"
+@@ -200,15 +200,17 @@ else
+ 	grep -qF turnstile_failed "$TMP/body" || bad "POST $BASE/_user/api/v1/register without a token: 422 but not turnstile_failed ($(head -c 200 "$TMP/body"))"
+ fi
+ 
+-# Presentations (D-14, D-16): /roadmap redirects to the deck of the language.
++# Presentations (D-14, D-16): /roadmap redirects to the deck of the language
++# (/pl/roadmap to the Polish deck under /pl/).
+ for lang in en pl; do
+ 	want=/p/roadmap-
+-	[[ "$lang" == pl ]] && want=/p/roadmap-pl-
+-	code="$(get /roadmap -b "i18n_redirected=$lang")"
++	path=/roadmap
++	[[ "$lang" == pl ]] && want=/pl/p/roadmap-pl- && path=/pl/roadmap
++	code="$(get "$path")"
+ 	location="$(header Location)"
+ 	location="${location#"$BASE"}"
+ 	if [[ "$code" != 302 || "$location" != "$want"* ]]; then
+-		bad "GET $BASE/roadmap ($lang cookie): status $code location '$location', want 302 $want{hash}"
++		bad "GET $BASE$path: status $code location '$location', want 302 $want{hash}"
+ 	elif [[ "$lang" == en ]]; then
+ 		code="$(get "$location")"
+ 		[[ "$code" == 200 ]] || bad "GET $BASE$location: status $code, want 200 (the public deck page)"
+@@ -225,13 +227,13 @@ else
+ 	grep -qF '"summercms-basics"' "$TMP/body" || bad "GET $BASE/_demo/api/v1/quizzes?context=demo:en: no summercms-basics"
+ 	! grep -qiF 'is_correct' "$TMP/body" || bad "GET $BASE/_demo/api/v1/quizzes: the public list leaks correctness"
+ fi
+-code="$(get /quizzes -b i18n_redirected=pl)"
++code="$(get /pl/quizzes)"
+ if [[ "$code" != 200 ]]; then
+-	bad "GET $BASE/quizzes (pl cookie): status $code, want 200"
++	bad "GET $BASE/pl/quizzes: status $code, want 200"
+ else
+-	grep -qF 'Podstawy SummerCMS' "$TMP/body" || bad "GET $BASE/quizzes (pl cookie): the Polish quiz is not listed"
+-	no_admin_link "/quizzes (pl cookie)"
+-	no_purge_key "/quizzes (pl cookie)"
++	grep -qF 'Podstawy SummerCMS' "$TMP/body" || bad "GET $BASE/pl/quizzes: the Polish quiz is not listed"
++	no_admin_link "/pl/quizzes"
++	no_purge_key "/pl/quizzes"
+ fi
+ 
+ # Realtime (D-17) and the deck API (D-15) need a JWT.
+diff --git a/scripts/check-local.sh b/scripts/check-local.sh
+index 7a81987..1b1d808 100755
+--- a/scripts/check-local.sh
++++ b/scripts/check-local.sh
+@@ -107,8 +107,8 @@ cd "$(dirname "$0")/.."
+ GO="http://${GO_ADDR:-127.0.0.1:8097}"
+ NUXT="http://${NUXT_ADDR:-127.0.0.1:3020}"
+ ALL_CHECKS=(turnstile tour journal contact reset roadmap realtime decks quizzes back remote chat forum friends call herald chatlive callmedia moderation)
+-# The @nuxtjs/i18n cookie that selects the language (nuxt.config.ts).
+-LOCALE_COOKIE=i18n_redirected
++# Polish lives under /pl/ (vue-demo-app/nuxt.config.ts, prefix_except_default).
++PL=/pl
+ # Cloudflare's test token: the always-pass test secret accepts it.
+ DUMMY_TOKEN=XXXX.DUMMY.TOKEN.XXXX
+ 
+@@ -191,24 +191,24 @@ check_tour() {
+ 		! grep -qx Subscriptions <<<"$titles" || bad "tour: a tour card is titled Subscriptions, want Payments"
+ 	fi
+ 
+-	code="$(request GET "$NUXT/" -b "$LOCALE_COOKIE=pl")"
++	code="$(request GET "$NUXT$PL")"
+ 	if [[ "$code" != 200 ]]; then
+-		bad "tour: GET / (pl) status $code, want 200"
++		bad "tour: GET $PL status $code, want 200"
+ 	else
+-		card_titles | grep -qx 'Płatności' || bad "tour: GET / with the pl cookie has no Płatności card"
+-		card_titles | grep -qx 'Czat' || bad "tour: GET / with the pl cookie has no Czat card"
++		card_titles | grep -qx 'Płatności' || bad "tour: GET $PL has no Płatności card"
++		card_titles | grep -qx 'Czat' || bad "tour: GET $PL has no Czat card"
+ 		for want in Forum Znajomi 'Rozmowy wideo'; do
+-			card_titles | grep -qx "$want" || bad "tour: GET / with the pl cookie has no $want card"
++			card_titles | grep -qx "$want" || bad "tour: GET $PL has no $want card"
+ 		done
+-		grep -qF 'Dane mogą zostać zresetowane w każdej chwili' "$TMP/body" || bad "tour: GET / with the pl cookie has no Polish banner"
+-		grep -q 'lang="pl' "$TMP/body" || bad "tour: GET / with the pl cookie does not render html lang=pl"
++		grep -qF 'Dane mogą zostać zresetowane w każdej chwili' "$TMP/body" || bad "tour: GET $PL has no Polish banner"
++		grep -q 'lang="pl' "$TMP/body" || bad "tour: GET $PL does not render html lang=pl"
+ 	fi
+ 
+-	code="$(request GET "$NUXT/faq" -b "$LOCALE_COOKIE=pl")"
++	code="$(request GET "$NUXT$PL/faq")"
+ 	if [[ "$code" != 200 ]]; then
+-		bad "tour: GET /faq (pl) status $code, want 200"
++		bad "tour: GET $PL/faq status $code, want 200"
+ 	else
+-		grep -qF 'Czym jest SummerCMS?' "$TMP/body" || bad "tour: GET /faq with the pl cookie has no Polish question"
++		grep -qF 'Czym jest SummerCMS?' "$TMP/body" || bad "tour: GET $PL/faq has no Polish question"
+ 	fi
+ }
+ 
+@@ -221,11 +221,11 @@ check_journal() {
+ 		json_has subtitle description avatar || bad "journal: the author payload lacks subtitle, description or avatar ($(head -c 300 "$TMP/body"))"
+ 	fi
+ 
+-	code="$(request GET "$NUXT/blog/welcome-to-summercms" -b "$LOCALE_COOKIE=pl")"
++	code="$(request GET "$NUXT$PL/blog/welcome-to-summercms")"
+ 	if [[ "$code" != 200 ]]; then
+-		bad "journal: GET /blog/welcome-to-summercms (pl) status $code, want 200"
++		bad "journal: GET $PL/blog/welcome-to-summercms status $code, want 200"
+ 	else
+-		grep -qF 'Witaj w SummerCMS' "$TMP/body" || bad "journal: the post with the pl cookie has no Polish title"
++		grep -qF 'Witaj w SummerCMS' "$TMP/body" || bad "journal: the Polish post has no Polish title"
+ 		grep -qF 'Golem15' "$TMP/body" || bad "journal: the post has no author card subtitle"
+ 	fi
+ 
+@@ -305,9 +305,9 @@ check_roadmap() {
+ 		bad "roadmap: the roadmap decks are not published (run scripts/dev.sh seed)"
+ 		return
+ 	fi
+-	got="$(location_of GET "$NUXT/roadmap" -b "$LOCALE_COOKIE=pl")"
+-	[[ "$(cat "$TMP/status")" == 302 && "$got" == "/p/roadmap-pl-$pl" ]] ||
+-		bad "roadmap: GET /roadmap (pl): status $(cat "$TMP/status") location '$got', want 302 /p/roadmap-pl-$pl"
++	got="$(location_of GET "$NUXT$PL/roadmap")"
++	[[ "$(cat "$TMP/status")" == 302 && "$got" == "$PL/p/roadmap-pl-$pl" ]] ||
++		bad "roadmap: GET $PL/roadmap: status $(cat "$TMP/status") location '$got', want 302 $PL/p/roadmap-pl-$pl"
+ 	got="$(location_of GET "$NUXT/roadmap")"
+ 	[[ "$(cat "$TMP/status")" == 302 && "$got" == "/p/roadmap-$en" ]] ||
+ 		bad "roadmap: GET /roadmap: status $(cat "$TMP/status") location '$got', want 302 /p/roadmap-$en"
+@@ -444,9 +444,9 @@ check_quizzes() {
+ 	fi
+ 	code="$(request GET "$GO/_demo/api/v1/quizzes?context=xx")"
+ 	[[ "$code" == 422 ]] || bad "quizzes: context xx: status $code, want 422"
+-	code="$(request GET "$NUXT/quizzes" -b "$LOCALE_COOKIE=pl")"
++	code="$(request GET "$NUXT$PL/quizzes")"
+ 	if [[ "$code" != 200 ]]; then
+-		bad "quizzes: GET /quizzes (pl) on Nuxt: status $code, want 200"
++		bad "quizzes: GET $PL/quizzes on Nuxt: status $code, want 200"
+ 	else
+ 		grep -qF 'Podstawy SummerCMS' "$TMP/body" || bad "quizzes: GET /quizzes with the pl cookie does not list the Polish quiz"
+ 	fi
+diff --git a/seed_test.go b/seed_test.go
+index 42f5806..77b7042 100644
+--- a/seed_test.go
++++ b/seed_test.go
+@@ -2,6 +2,7 @@ package main
+ 
+ import (
+ 	"bytes"
++	"encoding/json"
+ 	"os"
+ 	"path/filepath"
+ 	"strconv"
+@@ -184,6 +185,36 @@ var seededContent = []string{
+ 	"golem15_pgsub_subscription_plans", "golem15_sitemap_definitions", "golem15_feedback_settings", "users",
+ }
+ 
++// TestSeedHTMLSitemapPaths pins the HTML sitemap's addresses: demo:seed
++// sets /sitemap and /pl/mapa-strony over the sitemap plugin's defaults, and
++// keeps addresses an editor changed.
++func TestSeedHTMLSitemapPaths(t *testing.T) {
++	d := bootDemo(t, visitorEnv, nil)
++	mustSeed(t, d)
++	paths := func() map[string]string {
++		t.Helper()
++		var raw string
++		if err := d.DB.Raw(`SELECT html_paths::text FROM golem15_sitemap_settings WHERE id = 1`).Scan(&raw).Error; err != nil {
++			t.Fatal(err)
++		}
++		out := map[string]string{}
++		if err := json.Unmarshal([]byte(raw), &out); err != nil {
++			t.Fatalf("html_paths %q: %v", raw, err)
++		}
++		return out
++	}
++	if got := paths(); got["en"] != "/sitemap" || got["pl"] != "/pl/mapa-strony" || len(got) != 2 {
++		t.Fatalf("html_paths after demo:seed = %v, want /sitemap and /pl/mapa-strony", got)
++	}
++	if err := d.DB.Exec(`UPDATE golem15_sitemap_settings SET html_paths = '{"en":"/site-map","pl":"/pl/mapa"}'::jsonb WHERE id = 1`).Error; err != nil {
++		t.Fatal(err)
++	}
++	mustSeed(t, d)
++	if got := paths(); got["en"] != "/site-map" || got["pl"] != "/pl/mapa" {
++		t.Fatalf("html_paths after a second demo:seed = %v, want the editor's addresses kept", got)
++	}
++}
++
+ // TestSeedLocales pins D-13 and the journal author (todo esrp4qtx): after
+ // demo:seed the home FAQ exists in English and Polish, the main menu has
+ // its entries, every demo post has a Polish title and the SummerCMS Team

.planning/phases/33-seo-output-audit-and-content/33-14-vue-demo-app-locale.patch

@@ -0,0 +1,757 @@
+diff --git a/app/components/BackendCta.vue b/app/components/BackendCta.vue
+index 962aab2..2823553 100644
+--- a/app/components/BackendCta.vue
++++ b/app/components/BackendCta.vue
+@@ -10,5 +10,5 @@ const { t } = useI18n()
+ </script>
+ 
+ <template>
+-  <NuxtLink class="backend-cta" to="/contact">{{ short ? t('cta.button') : t('cta.link') }}</NuxtLink>
++  <NuxtLinkLocale class="backend-cta" to="/contact">{{ short ? t('cta.button') : t('cta.link') }}</NuxtLinkLocale>
+ </template>
+diff --git a/app/components/DemoBanner.vue b/app/components/DemoBanner.vue
+index 0534b1f..24806c5 100644
+--- a/app/components/DemoBanner.vue
++++ b/app/components/DemoBanner.vue
+@@ -13,7 +13,7 @@ const { t } = useI18n()
+   <div v-if="compact" class="demo-banner demo-banner--compact" role="note">
+     <p>
+       <strong>{{ t('banner.strong') }}</strong> {{ t('banner.compact') }}
+-      <NuxtLink to="/">{{ t('banner.home') }}</NuxtLink>
++      <NuxtLinkLocale to="/">{{ t('banner.home') }}</NuxtLinkLocale>
+     </p>
+   </div>
+   <div v-else class="demo-banner" role="note">
+diff --git a/app/components/Journal/AuthorCard.vue b/app/components/Journal/AuthorCard.vue
+index 61554a7..4e73eb6 100644
+--- a/app/components/Journal/AuthorCard.vue
++++ b/app/components/Journal/AuthorCard.vue
+@@ -20,7 +20,7 @@ const href = computed(() => links.authorLink(props.author.slug))
+     <div class="author-card__text">
+       <p class="author-card__label">{{ t('journalAuthor.about') }}</p>
+       <p class="author-card__name">
+-        <NuxtLink v-if="href" :to="href">{{ name }}</NuxtLink>
++        <NuxtLinkLocale v-if="href" :to="href">{{ name }}</NuxtLinkLocale>
+         <template v-else>{{ name }}</template>
+         <span v-if="author.subtitle" class="author-card__subtitle">{{ author.subtitle }}</span>
+       </p>
+diff --git a/app/components/Journal/PostMeta.vue b/app/components/Journal/PostMeta.vue
+index c3ec9e9..0f9dff2 100644
+--- a/app/components/Journal/PostMeta.vue
++++ b/app/components/Journal/PostMeta.vue
+@@ -31,12 +31,12 @@ const { data: author } = await useAsyncData(`journal-author-card-${login}`, () =
+     </span>
+     <span v-if="authorName" class="journal-post-meta__author">
+       {{ $t('journal.post.by') }}
+-      <NuxtLink v-if="authorHref" :to="authorHref">{{ authorName }}</NuxtLink>
++      <NuxtLinkLocale v-if="authorHref" :to="authorHref">{{ authorName }}</NuxtLinkLocale>
+       <template v-else>{{ authorName }}</template>
+     </span>
+     <ul v-if="post.categories.length" class="journal-post-meta__categories">
+       <li v-for="cat in post.categories" :key="cat.id">
+-        <NuxtLink v-if="links.categoryLink(cat.slug)" :to="links.categoryLink(cat.slug)!">{{ cat.name }}</NuxtLink>
++        <NuxtLinkLocale v-if="links.categoryLink(cat.slug)" :to="links.categoryLink(cat.slug)!">{{ cat.name }}</NuxtLinkLocale>
+         <span v-else>{{ cat.name }}</span>
+       </li>
+     </ul>
+diff --git a/app/components/LanguageSwitcher.vue b/app/components/LanguageSwitcher.vue
+index 4862703..e7600ea 100644
+--- a/app/components/LanguageSwitcher.vue
++++ b/app/components/LanguageSwitcher.vue
+@@ -1,27 +1,22 @@
+-<!-- English or Polish (D-13). setLocale writes the i18n cookie, which the server reads on the next request. -->
++<!-- English or Polish: a link to the same page in the other locale (English at /, Polish under /pl/). -->
+ <script setup lang="ts">
+-const { t, locale, locales, setLocale } = useI18n()
+-// Journal posts are localized when fetched (useJournalApi), so the page data
+-// is fetched again in the new language; FAQ and menu keys carry the locale.
+-async function choose(code: string) {
+-  await setLocale(code)
+-  await refreshNuxtData()
+-}
++const { t, locale, locales } = useI18n()
++const switchLocalePath = useSwitchLocalePath()
+ const options = computed(() => locales.value.map((l) => (typeof l === 'string' ? { code: l } : { code: l.code })))
+ </script>
+ 
+ <template>
+   <div class="lang-switch" role="group" :aria-label="t('lang.label')">
+-    <button
++    <NuxtLink
+       v-for="l in options"
+       :key="l.code"
+-      type="button"
++      :to="switchLocalePath(l.code) || '/'"
+       class="lang-switch__option"
+       :class="{ 'lang-switch__option--active': locale === l.code }"
+-      :aria-pressed="locale === l.code ? 'true' : 'false'"
++      :aria-current="locale === l.code ? 'true' : undefined"
+       :lang="l.code"
++      :hreflang="l.code"
+       :title="t(`lang.${l.code}`)"
+-      @click="choose(l.code)"
+-    >{{ l.code.toUpperCase() }}</button>
++    >{{ l.code.toUpperCase() }}</NuxtLink>
+   </div>
+ </template>
+diff --git a/app/components/SiteHeader.vue b/app/components/SiteHeader.vue
+index 5b19e34..49fb013 100644
+--- a/app/components/SiteHeader.vue
++++ b/app/components/SiteHeader.vue
+@@ -8,26 +8,27 @@
+ <script setup lang="ts">
+ const { t } = useI18n()
+ const { loggedIn, logout } = useDemoAuth()
++const localePath = useLocalePath()
+ 
+ async function signOut() {
+   await logout()
+-  await navigateTo('/')
++  await navigateTo(localePath('/'))
+ }
+ </script>
+ 
+ <template>
+   <header class="site-header">
+     <div class="wrap site-header__inner">
+-      <NuxtLink to="/" class="brand" :aria-label="t('header.home')">
++      <NuxtLinkLocale to="/" class="brand" :aria-label="t('header.home')">
+         <img src="/sun-logo.webp" alt="" width="30" height="30" class="brand__sun">
+         <span>Summer<span class="brand__cms">CMS</span></span>
+         <span class="brand__pill">{{ t('header.pill') }}</span>
+-      </NuxtLink>
++      </NuxtLinkLocale>
+       <SiteNav :member="loggedIn" />
+       <div class="site-header__tools">
+         <LanguageSwitcher />
+         <button v-if="loggedIn" type="button" class="link-button" @click="signOut">{{ t('header.logout') }}</button>
+-        <NuxtLink v-else to="/login" class="button button--small">{{ t('header.login') }}</NuxtLink>
++        <NuxtLinkLocale v-else to="/login" class="button button--small">{{ t('header.login') }}</NuxtLinkLocale>
+       </div>
+     </div>
+   </header>
+diff --git a/app/components/SiteNav.vue b/app/components/SiteNav.vue
+index 83f35f6..0d55fda 100644
+--- a/app/components/SiteNav.vue
++++ b/app/components/SiteNav.vue
+@@ -28,7 +28,21 @@ function entryTitle(entry: { url?: string | null; title: string }) {
+ }
+ 
+ const { data: menu, error } = await useMenu('main', { locale: () => locale.value })
+-const entries = computed(() => (error.value ? [] : (menu.value?.items ?? [])))
++const localePath = useLocalePath()
++
++/**
++ * A menu entry in the visitor's locale: an address on the site (a path) gets
++ * the locale's prefix (/blog is /pl/blog in Polish); an entry that already
++ * carries it, an absolute URL and an entry without an address stay. The
++ * title is looked up by the entry's own address first.
++ */
++interface NavEntry { url?: string | null; title: string; items?: NavEntry[] }
++function localizeEntry<T extends NavEntry>(entry: T): T {
++  const url = entry.url
++  const local = typeof url === 'string' && url.startsWith('/') && !url.startsWith('//') && !/^\/pl(\/|$)/.test(url) ? localePath(url) : url
++  return { ...entry, title: entryTitle(entry), url: local, items: entry.items?.map((child) => localizeEntry(child)) }
++}
++const entries = computed(() => (error.value ? [] : (menu.value?.items ?? []).map((entry) => localizeEntry(entry))))
+ 
+ /**
+  * The feature links after the menu entries; the last three for members only.
+@@ -37,14 +51,14 @@ const entries = computed(() => (error.value ? [] : (menu.value?.items ?? [])))
+  */
+ const links = computed(() => {
+   const out = [
+-    { to: '/chat', label: t('header.chat'), mine: false },
+-    { to: '/forum', label: t('header.forum'), mine: false },
++    { to: localePath('/chat'), label: t('header.chat'), mine: false },
++    { to: localePath('/forum'), label: t('header.forum'), mine: false },
+   ]
+   if (props.member) {
+     out.push(
+-      { to: '/presentations', label: t('header.mine'), mine: true },
+-      { to: '/friends', label: t('header.friends'), mine: true },
+-      { to: '/account/security', label: t('header.security'), mine: true },
++      { to: localePath('/presentations'), label: t('header.mine'), mine: true },
++      { to: localePath('/friends'), label: t('header.friends'), mine: true },
++      { to: localePath('/account/security'), label: t('header.security'), mine: true },
+     )
+   }
+   return out
+@@ -126,15 +140,15 @@ onBeforeUnmount(() => document.removeEventListener('pointerdown', onPointerDown)
+         submenu-label="Show submenu: :title"
+         @update:open="(value: boolean) => setOpen(i, value)"
+       >
+-        <template #item="{ entry: e }">{{ entryTitle(e) }}</template>
++        <template #item="{ entry: e }">{{ e.title }}</template>
+       </MenuNavItem>
+       <li v-for="link in links" :key="link.to" class="menu-nav__item" data-depth="0">
+-        <NuxtLink
++        <NuxtLinkLocale
+           :to="link.to"
+           :aria-current="linkActive(link.to) ? 'page' : undefined"
+           class="menu-nav__link"
+           :class="{ 'site-header__mine': link.mine, 'menu-nav__link--active': linkActive(link.to) }"
+-        >{{ link.label }}</NuxtLink>
++        >{{ link.label }}</NuxtLinkLocale>
+       </li>
+     </ul>
+   </nav>
+diff --git a/app/components/TourCard.vue b/app/components/TourCard.vue
+index 9a44cbd..a4a8614 100644
+--- a/app/components/TourCard.vue
++++ b/app/components/TourCard.vue
+@@ -40,7 +40,7 @@ const ICONS: Record<string, string> = {
+     </span>
+     <h3 class="tour-card__title">{{ title }}</h3>
+     <p class="tour-card__text">{{ text }}</p>
+-    <NuxtLink v-if="available" :to="to" class="tour-card__link">{{ t('tour.try') }} <span aria-hidden="true">→</span></NuxtLink>
++    <NuxtLinkLocale v-if="available" :to="to" class="tour-card__link">{{ t('tour.try') }} <span aria-hidden="true">→</span></NuxtLinkLocale>
+     <p v-else class="tour-card__soon">{{ t('tour.soon') }}</p>
+   </article>
+ </template>
+diff --git a/app/components/deck/DeckForm.vue b/app/components/deck/DeckForm.vue
+index a1355a1..2021c84 100644
+--- a/app/components/deck/DeckForm.vue
++++ b/app/components/deck/DeckForm.vue
+@@ -12,6 +12,7 @@ import { DECK_THEMES, deckApi, type DeckSlideInput } from '~/lib/api/demo'
+ import { parseSourceTodo, slideBodyHTML, slideSayHTML, slugify, sourceTodo } from '~/lib/deckSource'
+ import { formError } from '~/lib/forms'
+ import { renderMarkdown } from '~/lib/markdown'
++const localePath = useLocalePath()
+ 
+ const props = defineProps<{ slug?: string }>()
+ 
+@@ -97,7 +98,7 @@ async function load(value: string) {
+     if (!slides.value.length) slides.value = [row()]
+   } catch (e) {
+     if (e instanceof ApiError && e.status === 404) {
+-      await navigateTo({ path: '/presentations', query: { denied: '1' } }, { replace: true })
++      await navigateTo(localePath({ path: '/presentations', query: { denied: '1' } }), { replace: true })
+       return
+     }
+     error.value = e instanceof ApiError && e.message ? e.message : t('auth.genericError')
+@@ -117,7 +118,7 @@ async function save() {
+       await deckApi.create({ title: title.value, slug: slug.value, theme: theme.value, slides: payloadSlides() })
+     }
+     toast.show(t('deckForm.saved'))
+-    await navigateTo('/presentations')
++    await navigateTo(localePath('/presentations'))
+   } catch (e) {
+     if (e instanceof ApiError && e.status === 409) {
+       fields.value = { slug: t('deckForm.slugTaken') }
+@@ -142,7 +143,7 @@ if (props.slug) void load(props.slug)
+       <p class="eyebrow">{{ t('mine.eyebrow') }}</p>
+       <div class="page-head__row">
+         <h1>{{ editing ? t('deckForm.editTitle') : t('deckForm.newTitle') }}</h1>
+-        <NuxtLink to="/presentations" class="button button--small button--ghost">{{ t('deckForm.back') }}</NuxtLink>
++        <NuxtLinkLocale to="/presentations" class="button button--small button--ghost">{{ t('deckForm.back') }}</NuxtLinkLocale>
+       </div>
+       <p>{{ t('deckForm.lead') }}</p>
+     </header>
+diff --git a/app/components/remote/RemoteDrawer.vue b/app/components/remote/RemoteDrawer.vue
+index a96e7c1..11a14b9 100644
+--- a/app/components/remote/RemoteDrawer.vue
++++ b/app/components/remote/RemoteDrawer.vue
+@@ -190,7 +190,7 @@ watch(
+             </li>
+           </ol>
+           <footer class="list-foot">
+-            <NuxtLink class="back-link" to="/presentations">{{ t('remote.backToMine') }}</NuxtLink>
++            <NuxtLinkLocale class="back-link" to="/presentations">{{ t('remote.backToMine') }}</NuxtLinkLocale>
+             <p v-if="wakeLockMissing" class="hint">{{ t('remote.noWakeLock') }}</p>
+           </footer>
+         </template>
+diff --git a/app/composables/useDeckSession.ts b/app/composables/useDeckSession.ts
+index 5efdd3a..540d6ec 100644
+--- a/app/composables/useDeckSession.ts
++++ b/app/composables/useDeckSession.ts
+@@ -9,11 +9,12 @@ import { DEMO_TOKEN_COOKIE } from '~/utils/authCookie'
+ 
+ export function useDeckSession() {
+   const route = useRoute()
++  const localePath = useLocalePath()
+   const token = useCookie<string | null>(DEMO_TOKEN_COOKIE)
+   const loggedIn = computed(() => !!token.value)
+ 
+   function toLogin() {
+-    return navigateTo({ path: '/login', query: { next: route.fullPath } }, { replace: true })
++    return navigateTo(localePath({ path: '/login', query: { next: route.fullPath } }), { replace: true })
+   }
+ 
+   // The API client runs in the browser only; its hook is module state.
+diff --git a/app/layouts/default.vue b/app/layouts/default.vue
+index 3e4bcb0..2d9ebc9 100644
+--- a/app/layouts/default.vue
++++ b/app/layouts/default.vue
+@@ -6,11 +6,14 @@ useHead({ htmlAttrs: { lang: locale } })
+ // users on every page but the chat itself and the full-screen decks.
+ const { loggedIn } = useDemoAuth()
+ const route = useRoute()
++const localePath = useLocalePath()
++// The page's path without the Polish prefix (/pl/chat is /chat).
++const barePath = computed(() => route.path.replace(/^\/pl(?=\/|$)/, '') || '/')
+ // The incoming-call prompt (vue-chatvideo-layer) for logged-in users: it hears
+ // the ring through the chat store, which the floating panel or /chat runs.
+-const callPath = (id: number | string) => `/call/${id}`
++const callPath = (id: number | string) => localePath(`/call/${id}`)
+ const floatingChat = computed(
+-  () => loggedIn.value && route.path !== '/chat' && !route.path.startsWith('/p/') && !route.path.startsWith('/presentations/'),
++  () => loggedIn.value && barePath.value !== '/chat' && !barePath.value.startsWith('/p/') && !barePath.value.startsWith('/presentations/'),
+ )
+ </script>
+ 
+diff --git a/app/pages/account/security.vue b/app/pages/account/security.vue
+index d09f776..d3ce5c9 100644
+--- a/app/pages/account/security.vue
++++ b/app/pages/account/security.vue
+@@ -6,6 +6,7 @@
+ -->
+ <script setup lang="ts">
+ import { isTotpCode, svgDataUrl, type TotpSetup, type TwoFactorStatus } from '~/lib/twoFactor'
++const localePath = useLocalePath()
+ 
+ const { t } = useI18n()
+ // A signed-in page: vue-seo-layer marks it noindex, nofollow from this meta.
+@@ -104,7 +105,7 @@ async function turnOff() {
+     </header>
+ 
+     <p v-if="!loggedIn" class="notice notice--muted">
+-      <NuxtLink to="/login?next=/account/security">{{ t('security.loginFirst') }}</NuxtLink>
++      <NuxtLinkLocale :to="{ path: '/login', query: { next: localePath('/account/security') } }">{{ t('security.loginFirst') }}</NuxtLinkLocale>
+     </p>
+ 
+     <div v-else class="panel">
+@@ -143,6 +144,6 @@ async function turnOff() {
+     </div>
+ 
+     <!-- The account area links the friends page (D-15; the demo has no profile page). -->
+-    <p v-if="loggedIn" class="muted"><NuxtLink to="/friends">{{ t('security.friendsLink') }}</NuxtLink></p>
++    <p v-if="loggedIn" class="muted"><NuxtLinkLocale to="/friends">{{ t('security.friendsLink') }}</NuxtLinkLocale></p>
+   </div>
+ </template>
+diff --git a/app/pages/call/[conversation].vue b/app/pages/call/[conversation].vue
+index 7db746e..0410e25 100644
+--- a/app/pages/call/[conversation].vue
++++ b/app/pages/call/[conversation].vue
+@@ -36,8 +36,8 @@ const loginLink = computed(() => ({ path: '/login', query: { next: route.path }
+     <div v-else class="card card--static call-prompt">
+       <p>{{ t('call.anonymous') }}</p>
+       <div class="deck-card__actions">
+-        <NuxtLink class="button" :to="registerLink">{{ t('call.registerToCall') }}</NuxtLink>
+-        <NuxtLink class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLink>
++        <NuxtLinkLocale class="button" :to="registerLink">{{ t('call.registerToCall') }}</NuxtLinkLocale>
++        <NuxtLinkLocale class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLinkLocale>
+       </div>
+     </div>
+   </div>
+diff --git a/app/pages/chat.vue b/app/pages/chat.vue
+index c125978..1825f01 100644
+--- a/app/pages/chat.vue
++++ b/app/pages/chat.vue
+@@ -33,15 +33,15 @@ const startCallPath = (id: number | string) => `/call/${id}?start=1`
+           <ChatvideoCallButton :conversation-id="conversation.id" :call-path="startCallPath" />
+         </template>
+         <template #sidebar-footer>
+-          <NuxtLink to="/friends" class="chat-sidebar-link">{{ t('chat.friendsLink') }}</NuxtLink>
++          <NuxtLinkLocale to="/friends" class="chat-sidebar-link">{{ t('chat.friendsLink') }}</NuxtLinkLocale>
+         </template>
+       </ChatPage>
+     </ClientOnly>
+     <div v-else class="card card--static chat-prompt">
+       <p>{{ t('chat.anonymous') }}</p>
+       <div class="deck-card__actions">
+-        <NuxtLink class="button" :to="registerLink">{{ t('chat.registerToChat') }}</NuxtLink>
+-        <NuxtLink class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLink>
++        <NuxtLinkLocale class="button" :to="registerLink">{{ t('chat.registerToChat') }}</NuxtLinkLocale>
++        <NuxtLinkLocale class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLinkLocale>
+       </div>
+     </div>
+   </div>
+diff --git a/app/pages/connect.vue b/app/pages/connect.vue
+index 2c5f540..2434fe1 100644
+--- a/app/pages/connect.vue
++++ b/app/pages/connect.vue
+@@ -8,6 +8,7 @@
+ // the admin shown; when the link changed meanwhile the server answers 409
+ // and the page loads the request again.
+ import { BACKEND_LINK_CHANGED, consentDecisionBody } from '~/lib/consent'
++const localePath = useLocalePath()
+ 
+ type ConsentRequest = {
+   request_id: string
+@@ -51,7 +52,7 @@ async function load() {
+     return
+   }
+   if (!loggedIn.value) {
+-    await navigateTo('/login?next=' + encodeURIComponent('/connect?request=' + requestId.value))
++    await navigateTo(localePath({ path: '/login', query: { next: localePath({ path: '/connect', query: { request: requestId.value } }) } }))
+     return
+   }
+   try {
+@@ -60,7 +61,7 @@ async function load() {
+   } catch (e) {
+     const status = statusOf(e)
+     if (status === 401) {
+-      await navigateTo('/login?next=' + encodeURIComponent('/connect?request=' + requestId.value))
++      await navigateTo(localePath({ path: '/login', query: { next: localePath({ path: '/connect', query: { request: requestId.value } }) } }))
+       return
+     }
+     state.value = status === 404 || status === 410 ? 'expired' : 'error'
+diff --git a/app/pages/contact.vue b/app/pages/contact.vue
+index 0ae15b8..e608133 100644
+--- a/app/pages/contact.vue
++++ b/app/pages/contact.vue
+@@ -60,7 +60,7 @@ async function submit() {
+         <h1>{{ t('contact.heading') }}</h1>
+         <div v-if="sent">
+           <p class="notice" role="status">{{ t('contact.thanks') }}</p>
+-          <NuxtLink to="/" class="button">{{ t('contact.backHome') }}</NuxtLink>
++          <NuxtLinkLocale to="/" class="button">{{ t('contact.backHome') }}</NuxtLinkLocale>
+         </div>
+         <form v-else class="form" @submit.prevent="submit">
+           <p v-if="error" class="form__error" role="alert">{{ error }}</p>
+diff --git a/app/pages/forum/index.vue b/app/pages/forum/index.vue
+index f0b2536..5506d61 100644
+--- a/app/pages/forum/index.vue
++++ b/app/pages/forum/index.vue
+@@ -31,8 +31,8 @@ const threadPath = (id: number) => `/forum/t/${id}`
+     <div v-else class="card card--static forum-prompt">
+       <p>{{ t('forum.anonymous') }}</p>
+       <div class="deck-card__actions">
+-        <NuxtLink class="button" :to="registerLink">{{ t('forum.registerToJoin') }}</NuxtLink>
+-        <NuxtLink class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLink>
++        <NuxtLinkLocale class="button" :to="registerLink">{{ t('forum.registerToJoin') }}</NuxtLinkLocale>
++        <NuxtLinkLocale class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLinkLocale>
+       </div>
+     </div>
+   </div>
+diff --git a/app/pages/forum/t/[id].vue b/app/pages/forum/t/[id].vue
+index 8c5a66f..786a0d7 100644
+--- a/app/pages/forum/t/[id].vue
++++ b/app/pages/forum/t/[id].vue
+@@ -49,8 +49,8 @@ onMounted(async () => {
+     <div v-else class="card card--static forum-prompt">
+       <p>{{ t('forum.anonymous') }}</p>
+       <div class="deck-card__actions">
+-        <NuxtLink class="button" :to="registerLink">{{ t('forum.registerToJoin') }}</NuxtLink>
+-        <NuxtLink class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLink>
++        <NuxtLinkLocale class="button" :to="registerLink">{{ t('forum.registerToJoin') }}</NuxtLinkLocale>
++        <NuxtLinkLocale class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLinkLocale>
+       </div>
+     </div>
+   </div>
+diff --git a/app/pages/friends.vue b/app/pages/friends.vue
+index 11d9bd9..0a452fe 100644
+--- a/app/pages/friends.vue
++++ b/app/pages/friends.vue
+@@ -30,8 +30,8 @@ const loginLink = { path: '/login', query: { next: '/friends' } }
+     <div v-else class="card card--static friends-prompt">
+       <p>{{ t('friends.anonymous') }}</p>
+       <div class="deck-card__actions">
+-        <NuxtLink class="button" :to="registerLink">{{ t('friends.registerToJoin') }}</NuxtLink>
+-        <NuxtLink class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLink>
++        <NuxtLinkLocale class="button" :to="registerLink">{{ t('friends.registerToJoin') }}</NuxtLinkLocale>
++        <NuxtLinkLocale class="button button--ghost" :to="loginLink">{{ t('header.login') }}</NuxtLinkLocale>
+       </div>
+     </div>
+   </div>
+diff --git a/app/pages/link-admin.vue b/app/pages/link-admin.vue
+index e4205fb..1c5cb05 100644
+--- a/app/pages/link-admin.vue
++++ b/app/pages/link-admin.vue
+@@ -157,7 +157,7 @@ onMounted(load)
+               </p>
+               <button type="button" class="button" :disabled="busy" @click="confirm">{{ t('linkAdmin.confirm') }}</button>
+             </template>
+-            <NuxtLink v-else class="button" :to="signIn">{{ t('linkAdmin.signIn') }}</NuxtLink>
++            <NuxtLinkLocale v-else class="button" :to="signIn">{{ t('linkAdmin.signIn') }}</NuxtLinkLocale>
+             <p v-if="message" class="form__error" role="alert">{{ message }}</p>
+           </div>
+         </template>
+diff --git a/app/pages/login.vue b/app/pages/login.vue
+index fba22a4..6aea037 100644
+--- a/app/pages/login.vue
++++ b/app/pages/login.vue
+@@ -6,6 +6,7 @@ const { t } = useI18n()
+ definePageMeta({ seo: { robots: 'noindex, nofollow' } })
+ useSeoMeta({ title: () => t('auth.login.title') })
+ const route = useRoute()
++const localePath = useLocalePath()
+ const { loggedIn, login, verifyChallenge, recoverChallenge, logout } = useDemoAuth()
+ const email = ref('')
+ const password = ref('')
+@@ -24,7 +25,7 @@ const appAvailable = computed(() => !!challenge.value?.available_methods.include
+ 
+ function nextPath() {
+   const next = route.query.next
+-  return typeof next === 'string' && next.startsWith('/') && !next.startsWith('//') ? next : '/subscriptions'
++  return typeof next === 'string' && next.startsWith('/') && !next.startsWith('//') ? next : localePath('/subscriptions')
+ }
+ 
+ async function submit() {
+@@ -108,7 +109,7 @@ function startOver() {
+           <TurnstileWidget ref="widget" @token="turnstileToken = $event" />
+           <button class="button" :disabled="busy || !turnstileToken">{{ busy ? t('auth.login.busy') : t('auth.login.submit') }}</button>
+           <p v-if="error" class="form__error" role="alert">{{ error }}</p>
+-          <p class="muted">{{ t('auth.login.noAccount') }} <NuxtLink to="/register">{{ t('auth.login.createOne') }}</NuxtLink></p>
++          <p class="muted">{{ t('auth.login.noAccount') }} <NuxtLinkLocale to="/register">{{ t('auth.login.createOne') }}</NuxtLinkLocale></p>
+         </form>
+       </div>
+       <aside class="card card--static login__about">
+diff --git a/app/pages/presentations/[slug]/index.vue b/app/pages/presentations/[slug]/index.vue
+index fc70adb..65696fa 100644
+--- a/app/pages/presentations/[slug]/index.vue
++++ b/app/pages/presentations/[slug]/index.vue
+@@ -35,6 +35,7 @@ import {
+ import { forgetPilot, rememberPilot } from '~/lib/pilot'
+ import { openChannel, type ChannelHandle } from '~/lib/realtime'
+ import speakerCss from '~/assets/deck/deck-speaker.css?inline'
++const localePath = useLocalePath()
+ 
+ const SpeakerTools = defineAsyncComponent(() => import('~/components/deck/SpeakerTools.vue'))
+ 
+@@ -380,7 +381,7 @@ function syncRemote() {
+ 
+ function closeTab() {
+   window.close()
+-  void navigateTo('/presentations', { replace: true })
++  void navigateTo(localePath('/presentations'), { replace: true })
+ }
+ 
+ function clearTimer() {
+@@ -473,7 +474,7 @@ async function load(slug: string) {
+     clearTimer()
+     if (err instanceof ApiError && err.status === 404) {
+       forgetPilot(slug)
+-      await navigateTo({ path: '/presentations', query: { denied: '1' } }, { replace: true })
++      await navigateTo(localePath({ path: '/presentations', query: { denied: '1' } }), { replace: true })
+       return
+     }
+     if (err instanceof ApiError && err.status === 401) return
+diff --git a/app/pages/presentations/[slug]/pilot.vue b/app/pages/presentations/[slug]/pilot.vue
+index a4ed87e..0af4493 100644
+--- a/app/pages/presentations/[slug]/pilot.vue
++++ b/app/pages/presentations/[slug]/pilot.vue
+@@ -34,6 +34,7 @@ import {
+ } from '~/lib/deck/remote'
+ import { forgetPilot, rememberPilot } from '~/lib/pilot'
+ import { openChannel, type ChannelHandle, type ConnectionState } from '~/lib/realtime'
++const localePath = useLocalePath()
+ 
+ definePageMeta({ layout: false })
+ 
+@@ -444,7 +445,7 @@ async function load(slug: string) {
+     clearTimer()
+     if (err instanceof ApiError && err.status === 404) {
+       forgetPilot(slug)
+-      await navigateTo({ path: '/presentations', query: { denied: '1' } }, { replace: true })
++      await navigateTo(localePath({ path: '/presentations', query: { denied: '1' } }), { replace: true })
+       return
+     }
+     if (err instanceof ApiError && err.status === 401) return
+diff --git a/app/pages/presentations/index.vue b/app/pages/presentations/index.vue
+index 94c353a..1f4416c 100644
+--- a/app/pages/presentations/index.vue
++++ b/app/pages/presentations/index.vue
+@@ -67,7 +67,7 @@ onMounted(() => {
+       <p class="eyebrow">{{ t('mine.eyebrow') }}</p>
+       <div class="page-head__row">
+         <h1>{{ t('mine.title') }}</h1>
+-        <NuxtLink to="/presentations/new" class="button">{{ t('mine.newDeck') }}</NuxtLink>
++        <NuxtLinkLocale to="/presentations/new" class="button">{{ t('mine.newDeck') }}</NuxtLinkLocale>
+       </div>
+       <p>{{ t('mine.lead') }}</p>
+       <p class="notice notice--muted">{{ t('mine.privateNote') }}</p>
+@@ -103,9 +103,9 @@ onMounted(() => {
+             {{ t('mine.pilot') }}
+             <span class="sr-only">{{ t('mine.onPhone') }}</span>
+           </a>
+-          <NuxtLink v-if="!card.is_published" class="button button--small button--ghost" :to="editHref(card.slug)">
++          <NuxtLinkLocale v-if="!card.is_published" class="button button--small button--ghost" :to="editHref(card.slug)">
+             {{ t('mine.edit') }}
+-          </NuxtLink>
++          </NuxtLinkLocale>
+           <a
+             v-if="card.is_published && card.public_path"
+             class="button button--small button--ghost"
+diff --git a/app/pages/quizzes/[slug].vue b/app/pages/quizzes/[slug].vue
+index 0170ae2..f319dbe 100644
+--- a/app/pages/quizzes/[slug].vue
++++ b/app/pages/quizzes/[slug].vue
+@@ -171,7 +171,7 @@ const score = (a: { score_points: number; max_points: number }) => `${Math.round
+       <p class="eyebrow">{{ t('quiz.eyebrow') }}</p>
+       <div class="page-head__row">
+         <h1>{{ quiz?.title ?? t('quiz.listTitle') }}</h1>
+-        <NuxtLink to="/quizzes" class="button button--small button--ghost">{{ t('quiz.backToList') }}</NuxtLink>
++        <NuxtLinkLocale to="/quizzes" class="button button--small button--ghost">{{ t('quiz.backToList') }}</NuxtLinkLocale>
+       </div>
+       <p v-if="quiz?.description">{{ quiz.description }}</p>
+     </header>
+@@ -248,7 +248,7 @@ const score = (a: { score_points: number; max_points: number }) => `${Math.round
+         <p v-if="actionError" class="form__error" role="alert">{{ actionError }}</p>
+         <div class="quiz-actions">
+           <button class="button" type="button" :disabled="busy" @click="start">{{ t('quiz.again') }}</button>
+-          <NuxtLink to="/quizzes" class="button button--ghost">{{ t('quiz.backToList') }}</NuxtLink>
++          <NuxtLinkLocale to="/quizzes" class="button button--ghost">{{ t('quiz.backToList') }}</NuxtLinkLocale>
+         </div>
+       </section>
+ 
+diff --git a/app/pages/quizzes/index.vue b/app/pages/quizzes/index.vue
+index df5e639..a086741 100644
+--- a/app/pages/quizzes/index.vue
++++ b/app/pages/quizzes/index.vue
+@@ -63,10 +63,10 @@ const registerLink = (slug: string) => ({ path: '/register', query: { next: quiz
+           <p class="deck-card__meta">{{ t('quiz.questions', { n: q.question_count }) }}</p>
+         </div>
+         <div class="deck-card__actions">
+-          <NuxtLink v-if="loggedIn" class="button button--small" :to="quizPath(q.slug)">{{ t('quiz.start') }}</NuxtLink>
++          <NuxtLinkLocale v-if="loggedIn" class="button button--small" :to="quizPath(q.slug)">{{ t('quiz.start') }}</NuxtLinkLocale>
+           <template v-else>
+-            <NuxtLink class="button button--small" :to="registerLink(q.slug)">{{ t('quiz.registerToTake') }}</NuxtLink>
+-            <NuxtLink class="button button--small button--ghost" :to="{ path: '/login', query: { next: quizPath(q.slug) } }">{{ t('header.login') }}</NuxtLink>
++            <NuxtLinkLocale class="button button--small" :to="registerLink(q.slug)">{{ t('quiz.registerToTake') }}</NuxtLinkLocale>
++            <NuxtLinkLocale class="button button--small button--ghost" :to="{ path: '/login', query: { next: quizPath(q.slug) } }">{{ t('header.login') }}</NuxtLinkLocale>
+           </template>
+         </div>
+       </article>
+diff --git a/app/pages/register.vue b/app/pages/register.vue
+index fc5836c..a4bb09d 100644
+--- a/app/pages/register.vue
++++ b/app/pages/register.vue
+@@ -1,4 +1,5 @@
+ <script setup lang="ts">
++const localePath = useLocalePath()
+ // Self-registration (D-05), ported from bm's RegisterView: the user plugin's
+ // POST /_user/api/v1/register behind Cloudflare Turnstile (D-07). No field is
+ // pre-filled and there is no e-mail verification step.
+@@ -41,7 +42,7 @@ async function submit() {
+       },
+       turnstileToken.value,
+     )
+-    if (res.signedIn) await navigateTo(next.value || '/subscriptions')
++    if (res.signedIn) await navigateTo(next.value || localePath('/subscriptions'))
+     else done.value = res.message || t('auth.register.done')
+   } catch (e) {
+     error.value = authErrors(e, t, t('auth.genericError'))
+@@ -57,10 +58,10 @@ async function submit() {
+     <div class="login">
+       <div class="panel">
+         <h1>{{ t('auth.register.title') }}</h1>
+-        <p v-if="loggedIn">{{ t('auth.loggedIn') }} <NuxtLink to="/subscriptions">{{ t('auth.seePlans') }}</NuxtLink></p>
++        <p v-if="loggedIn">{{ t('auth.loggedIn') }} <NuxtLinkLocale to="/subscriptions">{{ t('auth.seePlans') }}</NuxtLinkLocale></p>
+         <div v-else-if="done">
+           <p class="notice" role="status">{{ done }}</p>
+-          <NuxtLink :to="loginLink" class="button">{{ t('auth.login.submit') }}</NuxtLink>
++          <NuxtLinkLocale :to="loginLink" class="button">{{ t('auth.login.submit') }}</NuxtLinkLocale>
+         </div>
+         <form v-else class="form" novalidate @submit.prevent="submit">
+           <p v-if="error?.message" class="form__error" role="alert">{{ error.message }}</p>
+@@ -75,7 +76,7 @@ async function submit() {
+           <label>{{ t('auth.register.confirmation') }} <input v-model="confirmation" type="password" autocomplete="new-password" required></label>
+           <TurnstileWidget ref="widget" @token="turnstileToken = $event" />
+           <button class="button" :disabled="busy || !turnstileToken">{{ busy ? t('auth.register.busy') : t('auth.register.submit') }}</button>
+-          <p class="muted">{{ t('auth.register.haveAccount') }} <NuxtLink :to="loginLink">{{ t('auth.login.submit') }}</NuxtLink></p>
++          <p class="muted">{{ t('auth.register.haveAccount') }} <NuxtLinkLocale :to="loginLink">{{ t('auth.login.submit') }}</NuxtLinkLocale></p>
+         </form>
+       </div>
+       <aside class="card card--static login__about">
+diff --git a/app/pages/roadmap.vue b/app/pages/roadmap.vue
+index 5b83e96..8c70b8d 100644
+--- a/app/pages/roadmap.vue
++++ b/app/pages/roadmap.vue
+@@ -8,6 +8,7 @@
+ -->
+ <script setup lang="ts">
+ import { DEMO_API, fetchRoadmap, roadmapPath } from '~/lib/api/demo'
++const localePath = useLocalePath()
+ 
+ const { t, locale } = useI18n()
+ // Only a redirect to the roadmap deck (/p/..., declared noindex), so the
+@@ -19,7 +20,7 @@ const base = import.meta.server ? useRuntimeConfig().demo.apiBase : DEMO_API
+ const { data: deck, error } = await useAsyncData(`roadmap-${locale.value}`, () => fetchRoadmap(base, locale.value))
+ 
+ if (deck.value) {
+-  await navigateTo(roadmapPath(deck.value), { redirectCode: 302, replace: true })
++  await navigateTo(localePath(roadmapPath(deck.value)), { redirectCode: 302, replace: true })
+ }
+ </script>
+ 
+@@ -31,6 +32,6 @@ if (deck.value) {
+       <p v-if="error" class="notice notice--muted">{{ t('roadmap.unavailable') }}</p>
+       <p v-else>{{ t('roadmap.opening') }}</p>
+     </header>
+-    <NuxtLink to="/" class="button button--ghost">{{ t('roadmap.back') }}</NuxtLink>
++    <NuxtLinkLocale to="/" class="button button--ghost">{{ t('roadmap.back') }}</NuxtLinkLocale>
+   </div>
+ </template>
+diff --git a/app/pages/subscriptions.vue b/app/pages/subscriptions.vue
+index 9a49ea2..c277f1b 100644
+--- a/app/pages/subscriptions.vue
++++ b/app/pages/subscriptions.vue
+@@ -1,4 +1,5 @@
+ <script setup lang="ts">
++const localePath = useLocalePath()
+ const { t } = useI18n()
+ // A signed-in page: vue-seo-layer marks it noindex, nofollow from this meta.
+ definePageMeta({ requiresAuth: true })
+@@ -22,9 +23,9 @@ const notice = computed(() => {
+ 
+     <p v-if="notice" class="notice">{{ notice }}</p>
+     <p v-if="!loggedIn" class="notice notice--muted">
+-      <NuxtLink to="/login?next=/subscriptions">{{ t('subscriptions.loginFirst') }}</NuxtLink>
++      <NuxtLinkLocale :to="{ path: '/login', query: { next: localePath('/subscriptions') } }">{{ t('subscriptions.loginFirst') }}</NuxtLinkLocale>
+       {{ t('subscriptions.or') }}
+-      <NuxtLink to="/register">{{ t('subscriptions.register') }}</NuxtLink>
++      <NuxtLinkLocale to="/register">{{ t('subscriptions.register') }}</NuxtLinkLocale>
+       {{ t('subscriptions.toSubscribe') }}
+     </p>
+ 
+diff --git a/nuxt.config.ts b/nuxt.config.ts
+index 6cb0c97..746cb0d 100644
+--- a/nuxt.config.ts
++++ b/nuxt.config.ts
+@@ -74,12 +74,14 @@ export default defineNuxtConfig({
+     sort: 'published_at desc',
+   },
+ 
+-  // English and Polish (D-13). No path prefix, so the layers' routes keep
+-  // their paths: the choice lives in a cookie that the server reads, so SSR
+-  // renders the chosen language. A first visit without the cookie follows
+-  // the browser's language on the home page.
++  // English at / and Polish under /pl/ (prefix_except_default; 2026-11-04,
++  // replacing the cookie-only no_prefix of D-13): the Journal, sitemap and
++  // SEO plugins give every non-default locale the /<code> prefix, so the
++  // hreflang links and the sitemap addresses they publish are pages here.
++  // The cookie keeps the last choice; a first visit to / follows the
++  // browser's language.
+   i18n: {
+-    strategy: 'no_prefix',
++    strategy: 'prefix_except_default',
+     defaultLocale: 'en',
+     locales: [
+       { code: 'en', language: 'en-US', name: 'English', file: 'en.json' },
+@@ -98,10 +100,12 @@ export default defineNuxtConfig({
+   // layer sends them X-Robots-Tag: noindex, nofollow and its build guard
+   // (D-70) accepts them; any other browser-only route fails the build. Auth
+   // and signed-in pages mark themselves in their page meta (seo.robots,
+-  // requiresAuth). The HTML sitemap pages keep the layer's paths
+-  // (/sitemap, /mapa-strony), which the SEO plugin's site answer names.
++  // requiresAuth). The HTML sitemap pages are /sitemap and /pl/mapa-strony,
++  // the paths Settings › Sitemaps names (DEPLOY.md), so the SEO plugin's site
++  // answer and the build agree.
+   seo: {
+-    noindexRoutes: ['/p/**', '/presentations/**'],
++    noindexRoutes: ['/p/**', '/presentations/**', '/pl/p/**', '/pl/presentations/**'],
++    htmlSitemap: { paths: { en: '/sitemap', pl: '/pl/mapa-strony' } },
+   },
+ 
+   runtimeConfig: {
+@@ -164,6 +168,8 @@ export default defineNuxtConfig({
+   routeRules: {
+     '/p/**': { ssr: false },
+     '/presentations/**': { ssr: false },
++    '/pl/p/**': { ssr: false },
++    '/pl/presentations/**': { ssr: false },
+   },
+ 
+   // tokens.css is summercms.io's (copied as is); site.css holds the demo's rules.

.planning/phases/33-seo-output-audit-and-content/33-15-PLAN.md

@@ -0,0 +1,595 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 15
+type: execute
+wave: 10
+depends_on: ["33-13"]
+gap_closure: true
+files_modified:
+  - ../sm-sitemap-plugin/contract/contract.go
+  - ../sm-sitemap-plugin/classes/listing.go
+  - ../sm-sitemap-plugin/plugin.go
+  - ../sm-sitemap-plugin/classes/lastmod.go
+  - ../sm-sitemap-plugin/classes/rebuild.go
+  - ../sm-sitemap-plugin/classes/indexnow.go
+  - ../sm-sitemap-plugin/classes/typesettings.go
+  - ../sm-sitemap-plugin/models/url.go
+  - ../sm-sitemap-plugin/models/legacy.go
+  - ../sm-sitemap-plugin/models/legacy_test.go
+  - ../sm-sitemap-plugin/updates/202610280002_update_golem15_sitemap_settings.go
+  - ../sm-sitemap-plugin/updates/202611040001_add_golem15_sitemap_urls_indexnow_pending.go
+  - ../sm-sitemap-plugin/extensions_settings.go
+  - ../sm-sitemap-plugin/controllers/api/settings.go
+  - ../sm-sitemap-plugin/lang/en/lang.yaml
+  - ../sm-sitemap-plugin/lang/pl/lang.yaml
+  - ../sm-sitemap-plugin/README.md
+  - ../sm-sitemap-plugin/content_fixture_test.go
+  - ../sm-sitemap-plugin/filter_fixture_test.go
+  - ../sm-sitemap-plugin/sitemap_extras_test.go
+  - ../sm-sitemap-plugin/sitemap_index_test.go
+  - ../sm-sitemap-plugin/classes/lastmod_test.go
+  - ../sm-seo-plugin/models/noindex_path.go
+  - ../sm-seo-plugin/models/crawl.go
+  - ../sm-seo-plugin/updates/202611040001_create_golem15_seo_noindex_paths.go
+  - ../sm-seo-plugin/updates/202611040002_add_golem15_seo_crawls_heartbeat.go
+  - ../sm-seo-plugin/classes/registry.go
+  - ../sm-seo-plugin/classes/sitemap_filter.go
+  - ../sm-seo-plugin/classes/linkgraph.go
+  - ../sm-seo-plugin/classes/crawl/checks.go
+  - ../sm-seo-plugin/classes/crawl/fix.go
+  - ../sm-seo-plugin/classes/crawl/job.go
+  - ../sm-seo-plugin/classes/crawl/store.go
+  - ../sm-seo-plugin/classes/crawl/actions.go
+  - ../sm-seo-plugin/classes/crawl/crawler.go
+  - ../sm-seo-plugin/classes/crawl/fetch.go
+  - ../sm-seo-plugin/classes/crawl/compare.go
+  - ../sm-seo-plugin/classes/crawl/render.go
+  - ../sm-seo-plugin/classes/crawl/render_chrome.go
+  - ../sm-seo-plugin/jobs.go
+  - ../sm-seo-plugin/controllers/api/registry.go
+  - ../sm-seo-plugin/controllers/api/crawls.go
+  - ../sm-seo-plugin/controllers/crawls.go
+  - ../sm-seo-plugin/mcp.go
+  - ../sm-seo-plugin/lang/en/lang.yaml
+  - ../sm-seo-plugin/lang/pl/lang.yaml
+  - ../sm-seo-plugin/README.md
+  - ../sm-seo-plugin/sitemap_filter_test.go
+  - ../sm-seo-plugin/registry_test.go
+  - ../sm-seo-plugin/crawler_test.go
+  - ../sm-seo-plugin/crawl_lifecycle_test.go
+  - ../sm-seo-plugin/classes/alternates_test.go
+  - ../sm-seo-plugin/classes/crawl/checks_test.go
+  - ../sm-seo-plugin/classes/crawl/render_test.go
+  - ../sm-seo-plugin/classes/crawl/fetch_test.go
+  - ../sm-journal-plugin/classes/image_variants.go
+  - ../sm-journal-plugin/classes/headings.go
+  - ../sm-journal-plugin/classes/image_alt.go
+  - ../sm-journal-plugin/classes/content_descriptors.go
+  - ../sm-journal-plugin/classes/menu_item_types.go
+  - ../sm-journal-plugin/console/fix_headings.go
+  - ../sm-journal-plugin/controllers/api/maintenance.go
+  - ../sm-journal-plugin/mcp.go
+  - ../sm-journal-plugin/README.md
+  - ../sm-journal-plugin/classes/headings_test.go
+  - ../sm-journal-plugin/classes/image_alt_test.go
+  - ../sm-journal-plugin/headings_test.go
+  - ../sm-journal-plugin/related_media_test.go
+  - ../sm-journal-plugin/image_variants_cli_test.go
+  - ../sm-journal-plugin/content_descriptors_test.go
+  - modules/lagoon/README.md
+  - docs/database/attachments.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-journal-plugin-v0.4.0.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-seo-plugin-v0.2.0.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-sitemap-plugin-v0.2.0.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-notes-summercms-v0.6.1.md
+  - .planning/phases/33-seo-output-audit-and-content/33-release-log.md
+  - .planning/phases/33-seo-output-audit-and-content/deferred-items.md
+autonomous: true
+requirements: [SC-1, SC-2, SC-3, D-14, D-24, D-30, D-31, D-32, D-33, D-34, D-50, D-55, D-57, D-85, D-95, D-10]
+
+estimate:
+  tokens: 210000
+  raw_tokens: 210000
+  tasks: 6
+  confidence: low
+
+must_haves:
+  truths:
+    - "G1 (D-24, D-33, D-95, SC-1): POST /_seo/api/v1/registry/routes accepts the optional noindex array of the gap-2 contract below; the stored set is replaced when the key is present (also []), unchanged when it is absent; the SEO sitemap filter leaves every candidate whose normalized path is in the set out of the XML and HTML sitemaps with reason noindex; a changed set requests one debounced sitemap rebuild through the new contract.Rebuilder"
+    - "G1 (SC-3, D-14): a sitemap_noindex finding on a listed address without a CMS record names sitemap_update_settings (removing the Additional address) while the sitemap plugin is mounted, and fix: code otherwise; one on a CMS record keeps seo_set_url_seo"
+    - "L3 CR-01 (D-14): a crawl whose job context is cancelled or reaches the job timeout stores the pages, links and issues fetched so far through a context detached from the job with its own 10-minute bound, and ends cancelled (a requested cancel) or failed with a time-limit error (the timeout), with finished_at set; a LoadLimits failure in finish falls back to the default limits; a fetch cut short by the cancellation is recorded as canceled, not network_error"
+    - "L3 CR-01: a running crawl whose heartbeat (written every minute by its job) is older than 10 minutes is ended (cancelled when a cancel was requested, else failed with a no-heartbeat error) before a crawl starts or crawls are deleted, so a row whose job is gone never stays running"
+    - "L3 WR-01: cancelling a running crawl records the request (cancel_requested_at, cancelled_by) and leaves the row running until its job stops and writes cancelled; until then Start answers 409 crawls.already_running, DeleteCrawls refuses it and Prune keeps it"
+    - "L3 WR-06: chromeRenderer.Render bounds opening the tab and rendering the page with one deadline (TabOpenTimeout 5 s plus RenderTimeout 20 s), so the crawl's render lock is never held longer than that"
+    - "L3 WR-03: Fetcher.Allowed and Fetcher.Key and the Chrome request guard allowRequest accept a URL only on the site's effective port (explicit, else 443 for https and 80 for http); a link to https://<site>:8443/x is neither fetched nor reported as https://<site>/x"
+    - "L3 WR-04: crawl keys, the rendered comparison, CMS lookups (Lookup, Keyphrases) and the link graph (LinksOfURL, LinksOfRecord) use one decoded path form; a non-ASCII address matches its CMS record and its stored crawl links; Fetcher.Absolute escapes the path for the request; a path that does not decode to valid UTF-8 text without NUL keeps its escaped form"
+    - "L2 WR-01 (D-31): IndexNow is notified of a record deleted through pact.RecordDeleted (its listed addresses as removed) and of a content edit through pact.RecordSaved that moves lastmod (its listed addresses as changed): the listeners mark the rows indexnow_pending_at and the next rebuild sends them; TestIndexNow fires both events"
+    - "L2 WR-02 (D-30): every rebuild reads settings, types and records and applies them under one transaction-scoped advisory lock, so a second rebuild collects only after the first has committed and an older snapshot never overwrites a newer one"
+    - "L2 WR-03 (D-30): a rebuild never writes lastmod for a content row it did not create, so a lastmod that RecordSaved moved while the rebuild ran stays"
+    - "L2 WR-04 (D-32): migration 202610280002 copies every convertible url item of the Phase 17 definition (a relative path gets its leading slash; spaces and the bytes \" < > \\ are percent-encoded), keeps the other items of a definition with one malformed item, and logs one warning per url item it cannot convert with the item and the reason; the v0.2.0 release-note draft says so"
+    - "L2 WR-05 (D-34): Settings › Sitemaps loads no heading for a content type without a stored one, so a save that did not touch a heading stores none and each locale's HTML sitemap keeps its translated type label"
+    - "L2 IN-01: classes.RecordSaved returns nil for a nil event without reading it"
+    - "L1 CR-01 (D-85): a width whose variant height would exceed 4096 px is skipped with a warning and counted in Skipped; the image variants job and journal:image-variants go on with the next widths and images"
+    - "L1 CR-02 (D-50): with the H1 setting on, ConvertContentH1 rewrites content only when it is HTML (classes.LooksLikeHTML); markdown content, fenced and inline code samples included, is kept byte for byte while content_html is converted; the count is content_html's headings; this holds for API saves, imports, journal:fix-headings and translations"
+    - "L1 WR-03: ConvertH1 and SetImageAlt keep the bytes of an unfinished tag at the end of the input (input without a match comes back identical)"
+    - "L1 WR-01 (D-50): journal:fix-headings runs from the generated application CLI: without a published database it opens database.dsn (lookupDB), and without a DSN it names SUMMER_DATABASE__DSN"
+    - "L1 WR-05 (D-85, D-10): POST /_journal/api/v1/images/alt on a markdown post writes the alt into the markdown source (an inline image whose destination is the src, or a raw img tag, outside code), so the next content save keeps it; an image the markdown does not hold that way is refused with 422 changes.N.src and nothing is written"
+    - "G3 (D-55, D-57, SC-2): the Journal post, category, tag and author descriptors give a non-default enabled locale a URL only when the record has content in it (P33-64); every other enabled locale keeps its entry with URL \"\" (pact: no public page); the menu item types' Resolve alternates are unchanged"
+    - "G3: TestAlternates (sm-seo-plugin) and TestHreflangAlternates (sm-sitemap-plugin) use Journal-shaped records (every enabled locale present in sort order, an untranslated one with URL \"\" and the default locale's title, description and word count) and still emit no hreflang for the untranslated locale"
+    - "L1 WR-02 (docs only): the lagoon README and docs/database/attachments.md say that importing attach/webp also takes over WebP decoding for the whole process and what -tags nodynamic changes; no framework Go file changes"
+    - "G2 is not fixed, with the reason recorded in deferred-items.md and the SUMMARY: signpost.Activate refuses a menu item type without a DefaultPattern starting with /, so the change needs the framework"
+  prohibitions:
+    - requirement_id: "D-106"
+      category: compatibility
+      status: resolved
+      verification: test
+      statement: "sm-journal-plugin is a core plugin: no exported identifier is removed or renamed and no exported signature changes; the menu item types' Resolve output is unchanged (TestMenuItemTypesSmoke and menu_item_types_test.go pass unchanged)"
+    - requirement_id: "D-90"
+      category: scope
+      status: resolved
+      verification: test
+      statement: "No Go file of summercms.go changes; the framework gets docs lines only (scripts/check-phase33.sh --additive --marker --docs pass)"
+    - requirement_id: "D-95"
+      category: safety
+      status: resolved
+      verification: test
+      statement: "sm-seo-plugin still imports only sm-sitemap-plugin/contract outside tests, and sm-journal-plugin imports no SEO or sitemap package"
+  artifacts:
+    - path: "../sm-seo-plugin/updates/202611040001_create_golem15_seo_noindex_paths.go"
+      provides: "the stored noindex paths of the route report"
+      contains: "golem15_seo_noindex_paths"
+    - path: "../sm-sitemap-plugin/contract/contract.go"
+      provides: "contract.Rebuilder"
+      contains: "Rebuilder interface"
+    - path: "../sm-seo-plugin/updates/202611040002_add_golem15_seo_crawls_heartbeat.go"
+      provides: "heartbeat_at and cancel_requested_at on golem15_seo_crawls"
+      contains: "heartbeat_at"
+    - path: "../sm-sitemap-plugin/updates/202611040001_add_golem15_sitemap_urls_indexnow_pending.go"
+      provides: "indexnow_pending_at on golem15_sitemap_urls"
+      contains: "indexnow_pending_at"
+    - path: "../sm-seo-plugin/crawl_lifecycle_test.go"
+      provides: "running cancel, timeout and stale recovery tests"
+      contains: "TestCrawlCancelRunning"
+  key_links:
+    - from: "../sm-seo-plugin/controllers/api/registry.go"
+      to: "../sm-seo-plugin/classes/registry.go"
+      via: "RouteReport decodes noindex and calls ReportNoindex in the same write transaction"
+      pattern: "ReportNoindex"
+    - from: "../sm-seo-plugin/classes/sitemap_filter.go"
+      to: "golem15_seo_noindex_paths"
+      via: "newFilterBatch loads the set; decideTarget excludes with contract.ReasonNoindex"
+      pattern: "noindex"
+    - from: "../sm-seo-plugin/classes/registry.go"
+      to: "../sm-sitemap-plugin/contract/contract.go"
+      via: "after commit, app.Lookup[contract.Rebuilder]().RequestRebuild when the set changed"
+      pattern: "contract.Rebuilder"
+    - from: "../sm-seo-plugin/classes/crawl/job.go"
+      to: "context.WithoutCancel"
+      via: "finish runs on a detached, bounded context"
+      pattern: "WithoutCancel"
+    - from: "../sm-sitemap-plugin/classes/rebuild.go"
+      to: "pg_advisory_xact_lock"
+      via: "collect and apply inside one locked transaction"
+      pattern: "pg_advisory_xact_lock"
+---
+
+<!-- planner-discipline-allow: seo -->
+
+## Phase Goal
+
+**As a** site editor and as an SEO specialist auditing a SummerCMS site, **I want to** have the rendered sites emit complete SEO output (sitemaps, structured data, pagination, hreflang, headings, breadcrumbs) from the CMS, and an audit that finds the remaining problems, **so that** sites are indexed correctly and issues can be fixed through MCP.
+
+This gap-closure plan fixes the Go side of the gaps and review findings that block the 33-14 release: G1 (CMS side), G3 and the in-scope findings of review lanes L1 (Journal), L2 (sitemap) and L3 (SEO). Plan 33-16 fixes the Nuxt layers in parallel (same wave, no shared files; the gap-2 contract below is fixed in both plans). 33-14 Task 4 (the release) resumes after both, followed by re-verification.
+
+<objective>
+Fix, each with a test that fails before the fix, in three plugin repositories (each main, not pushed, not tagged):
+- sm-seo-plugin: the route report's noindex paths and the sitemap filter (G1, D-24, D-33); the crawl lifecycle (L3 CR-01, WR-01, WR-06, D-14); the crawl's port and path form (L3 WR-03, WR-04);
+- sm-sitemap-plugin: contract.Rebuilder (G1, D-95); IndexNow for deletes and edits, the rebuild lock, kept lastmods (L2 WR-01 to WR-03, IN-01, D-30, D-31); the definitions migration and the HTML sitemap headings (L2 WR-04, WR-05, D-32, D-34);
+- sm-journal-plugin (core plugin: additive and non-breaking): tall images (L1 CR-01, D-85), markdown left alone by the H1 conversion (L1 CR-02, D-50), the tokenizer tails (L1 WR-03), journal:fix-headings in the CLI (L1 WR-01), alt texts on markdown posts (L1 WR-05), descriptors listing only locales with content (G3, D-57);
+- summercms.go: docs lines only (L1 WR-02 decoder note) and the planning docs (release-note drafts, release log, deferred items).
+
+Purpose: close G1 (CMS side) and G3 and the release-blocking L1 to L3 findings before the tags.
+
+Output: commits in sm-seo-plugin, sm-sitemap-plugin, sm-journal-plugin and summercms.go (docs, then planning docs as a separate commit).
+
+**Plan size (Jakub, 2026-11-04):** the gap fixes are two plans, fewer and larger, by Jakub's explicit choice (project rule "lean planning"); the plan checker's recommendation to split this plan is overridden by that decision, and the six tasks stay here. Earlier phase-33 executors ran plans of this size. Each task is independently committable and leaves every repository green (see the executor note under "Execution units").
+
+**Planner decisions recorded here (P33-58 to P33-66; 33-16 continues at P33-67):**
+- **P33-58 (noindex paths):** table `golem15_seo_noindex_paths` (`path text PRIMARY KEY`, `reported_at timestamp NOT NULL`), model `models.NoindexPath`, migration 202611040001. `classes.(*Service).ReportNoindex(ctx, tx, paths []string) (stored int, skipped int, changed bool, err error)` replaces the set inside the route report's write transaction; entries are checked with `ValidPagePath` and stored through `normalPagePath(path, opts)` exactly like `routes`. `ReportRoutes` keeps its signature. The filter checks the set after the normalisation and redirect checks and before `resolveAt`.
+- **P33-59 (rebuild on request):** `contract.Rebuilder` with `RequestRebuild(ctx context.Context) error`: "queue one debounced rebuild, the same one a record event queues". `classes.Listing` implements it with `RequestDebouncedRebuild`; the sitemap plugin publishes it with `app.Publish[contract.Rebuilder]` in `Register`, next to `contract.Listing`. Absent (an older sitemap plugin) means no request; the nightly rebuild still picks the set up.
+- **P33-60 (crawl lifecycle):** `crawl.JobTimeout = 6 * time.Hour` (jobs.go uses it), `crawl.FinishTimeout = 10 * time.Minute`, `crawl.HeartbeatEvery = time.Minute`, `crawl.StaleAfter = 10 * time.Minute`; migration 202611040002 adds `heartbeat_at timestamp NULL` and `cancel_requested_at timestamp NULL` to `golem15_seo_crawls`. The job owns every terminal status of a running crawl; `RecoverStale(tx, now)` ends running rows whose `COALESCE(heartbeat_at, started_at, created_at)` is older than StaleAfter.
+- **P33-61 (one crawl path form):** the decoded `u.Path` ("/" when empty) plus `?` and the raw query is the crawl key everywhere; `Fetcher.Absolute` escapes it; a path whose decoded form is not valid UTF-8 without NUL (the resolver's `safeText` rule) keeps its escaped form.
+- **P33-62 (IndexNow pending):** column `golem15_sitemap_urls.indexnow_pending_at timestamp NULL` (migration 202611040001); the listeners set it, `apply` reads it into `RebuildResult.Changed` (listed rows) or `Removed` (rows that were listed), and clears it with `WHERE id = ? AND indexnow_pending_at = <the value read>`, so a mark made after the read survives for the next rebuild.
+- **P33-63 (rebuild lock):** `SELECT pg_advisory_xact_lock(hashtext('golem15.sitemap.rebuild'))` at the start of one transaction that loads the settings and types, runs `collect` and then `apply` (with the existing `FOR UPDATE` of the settings row before `apply`).
+- **P33-64 (G3 rule, "has content in a locale"):** the locale whose values are the host columns (translate's default code, else the unprefixed locale, else the first enabled one) always has content. Posts and categories: a non-default locale has content when the record's translate row in it holds a truthy (`phpTruthy`) value of a text field (post: title, content, content_html, excerpt; category: name, description). Tags and authors are not translatable: a non-default locale has content when at least one of their published posts has such a translation. The descriptors keep one entry per enabled locale (as now) and set `URL: ""` for the others, which is pact's documented "no public page" form that the SEO and sitemap plugins already drop; `menuAlternates` and every menu Resolve stay as they are.
+- **P33-65 (alt texts on markdown):** `classes.SetMarkdownImageAlt(md, src, alt string) (string, int, *string)`: inline images `![label](dest)` and `![label](dest "title")` outside fenced and indented code blocks and code spans (ranges from goldmark's AST, the FormatHTML engine) match when the destination, escaped as goldmark's HTML renderer escapes it, equals src, or equals src as written; the label is replaced by alt with `\`, `[` and `]` backslash-escaped and line breaks folded to spaces. For markdown content the raw-`<img>` rewrite (SetImageAlt) also runs only on the text outside those code ranges.
+- **P33-66 (legacy url items):** `models.ConvertLegacyItems(data []byte) (rows []ExtraURL, dropped []DroppedItem)` (pure): url items only; a value without a scheme and without a leading `/` gets one; spaces and `"`, `<`, `>`, `\` in the path are percent-encoded; the result must pass `models.AllowedAddress` (an absolute URL with `&` still does not, so it is dropped with that reason); duplicates are kept once without a log line; a malformed item is dropped with its parse error and the others are kept. The migration logs each dropped item at warn level as `golem15.sitemap: definition url item not copied` with the item label, the value and the reason.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/33-seo-output-audit-and-content/33-VERIFICATION.md
+@.planning/phases/33-seo-output-audit-and-content/33-REVIEW.md
+@.planning/phases/33-seo-output-audit-and-content/deferred-items.md
+@.planning/phases/33-seo-output-audit-and-content/33-CONTEXT.md
+@.planning/phases/33-seo-output-audit-and-content/33-PATTERNS.md
+@.planning/phases/33-seo-output-audit-and-content/33-05-SUMMARY.md
+@.planning/phases/33-seo-output-audit-and-content/33-10-SUMMARY.md
+@CLAUDE.md
+
+<interfaces>
+sm-seo-plugin:
+- controllers/api/registry.go: `routeReport{Routes []string}`, `maxRouteReportBody = MaxReportedRoutes*(MaxRouteBytes+8)+1024`, `RouteReport` handler (constant-time token, `write(ctx, svc, fn)` transaction, 422 `too_many_routes`).
+- classes/registry.go: `ReportRoutes(ctx, tx, paths) (RouteReport, error)`, `RouteReport{Inserted, Updated, Skipped, ReportedAt}`, `normalPagePath(path, opts)`, `ValidPagePath`, `MaxReportedRoutes` (2000), `MaxRouteBytes` (2048), `SettingsRow`, `NormalizeOptionsOf`.
+- classes/sitemap_filter.go: `SitemapFilter.Decide`, `newFilterBatch` (settings, redirect set, site), `decideTarget` (Normalize → redirect chain → `resolveAt` → robots/canonical), `candidatePath`.
+- classes/crawl/job.go: `Run` (db on the job ctx), `run`, `finish(ctx, svc, db, row, res, runErr)`, `Start` (settings row FOR UPDATE, `ActiveCrawl`), `Cancel` (writes status cancelled at once), `Lookup`, `Keyphrases`; store.go `LatestCrawl`, `ActiveCrawl`; actions.go `DeleteCrawls`, `Prune`; crawler.go worker loop (`pace.wait`, `f.Get`, `renderMu`, `opt.Progress`); fetch.go `Fetcher.Allowed`, `Key` (EscapedPath), `Absolute`, `Get` (`network_error`); render.go `allowRequest(rawURL, hosts, trusted)`; render_chrome.go `newChromeRenderer(path, hosts, trusted, ua)`, `Render` (`chromedp.NewContext(r.browserCtx)`, `context.AfterFunc(ctx, closeTab)`, `chromedp.Do(tab)`, then `RenderTimeout`); compare.go `same` (EscapedPath); checks.go `Env{Lookup, Staging, GenericAnchors, Keyphrases}`, `checkSitemaps` (sitemap_noindex with `ToolSetURLSEO`); fix.go tool constants and `Route`.
+- jobs.go `conga.Job(p.crawl, conga.MaxAttempts(1), conga.Timeout(6*time.Hour))`; mcp.go `cancel_crawl` description; controllers/crawls.go status labels; linkgraph.go `sitePath` (EscapedPath for absolute input).
+sm-sitemap-plugin:
+- contract/contract.go `Filter`, `Listing`, `ListingSettings`; plugin.go `Register` publishes `contract.Listing` (classes.Listing{App: app}).
+- classes/lastmod.go `RecordSaved` (nil check after reading ev), `RecordDeleted`, `RequestDebouncedRebuild(ctx, app, db)`, `contentTypeOf`.
+- classes/rebuild.go `Rebuild` (collect before the FOR UPDATE transaction), `collect`, `apply` (reads every slot row, writes every column of a dirty row including lastmod; skips a deleted row whose reason did not change before appending Removed), `RebuildResult{Added, Changed, Removed, Listed, Files}`; classes/indexnow.go `NotifyIndexNow`, `SiteURLs`.
+- updates/202610280002 `copyDefinitions` (ParseLegacyItems fails the whole definition on one bad item; AllowedAddress silently drops items); models/legacy.go `ParseLegacyItems`, `LegacyEntries`, `ParseLegacyItem`, `LegacyItemURL`; models/url.go `AllowedAddress`; models/settings.go `AllowedFrontendURL`.
+- extensions_settings.go `typeSettingsTab` Load (prefills a missing title with `{def: Phrase(ctx, tr, typ.Label)}` in the admin's UI locale); classes/typesettings.go `SaveTypeSettings`; classes/htmlgroups.go `pickTitle`, `translateIn`.
+- Tests: content_fixture_test.go `store.put/remove` (remove fires no event), filter_fixture_test.go `fakeFilter`/`theFilter`, sitemap_index_test.go fires events with `e.app.Events.Fire(ctx, &pact.RecordDeleted{Model: pageModel, ID: "1"})`, `TestIndexNow` (sitemap_extras_test.go), `TestHreflangAlternates`, `TestMigrateDefinitions`.
+sm-journal-plugin:
+- classes/image_variants.go `GenerateImageVariants` (h = sh*w/sw, `f.ThumbKey` errors above 4096 px abort the batch), `MaxImageWidth = 4096`, `variantsLog`.
+- classes/headings.go `ConvertH1`, `ConvertContentH1` (converts content too), `ConvertTranslationH1`; classes/image_alt.go `SetImageAlt` (both loops break on ErrorToken without writing the rest); classes/blog_editor.go `LooksLikeHTML`; classes/format_html.go `markdownEngine`, `FormatHTML`.
+- console/fix_headings.go uses `mustDB(app)`; console/database.go `lookupDB(ctx, app)`; image_variants_cli_test.go `TestImageVariantsCommandCLI` (pattern for the CLI test).
+- controllers/api/maintenance.go `SetImageAlt` (rewrites content_html, and content only when it holds a literal img), `loadImageAltText`, `writeImageAltTexts`.
+- classes/content_descriptors.go `describePosts`, `describeCategories`, `describeTags`; classes/menu_item_types.go `describeAuthors`, `menuAlternates`, `loadMenuLocales`, `menuTranslations.value`, `phpTruthy`, `publishedPosts`; models/post.go pivot `golem15_journal_posts_tags`; models Post/Category `Translatable()`, Tag not translatable.
+- signpost (framework, read only): `signpost.Activate` refuses an empty DefaultPattern (modules/signpost/signpost.go:85-86), the G2 reason.
+</interfaces>
+</context>
+
+## Gap-2 contract (fixed; identical in 33-15 and 33-16)
+
+The route report gains an optional `noindex` array of static paths, sent with the same token on the same request:
+
+```
+POST /_seo/api/v1/registry/routes
+Authorization: Bearer <golem15.seo.route_report_token, else golem15.seo.notfound_token>
+Content-Type: application/json
+
+{"routes": ["/", "/blog", "/kontakt"], "noindex": ["/konto", "/pl/konto", "/szkic"]}
+```
+
+1. `routes`: unchanged (required array of strings).
+2. `noindex`: optional array of strings, at most 2000 entries, each starting with `/`, without a `:` parameter or `*`, at most 2048 bytes in UTF-8. It lists every static path the frontend's build serves noindex: pages whose meta has `requiresAuth: true` or a `seo.robots` value with `noindex` or `none`, and static pages under a `seo.noindexRoutes` pattern. The `@nuxtjs/i18n` copies of those pages in other locales are listed as their own locale-prefixed paths (`/pl/konto`). Patterns (`/p/**`) are never sent, the layer's HTML sitemap pages never, and a path is never in both lists.
+3. Plugin semantics: key absent → the stored set is unchanged; key present (also `[]`) → the stored set becomes exactly its valid entries, normalised like `routes` (`normalPagePath` with the site's address options); an invalid entry is skipped and counted in `skipped`; more than 2000 entries → 422 `{"error":"too_many_routes","max":2000}` and nothing is stored.
+4. The answer gains one key, the number of stored paths: `{"inserted":1,"updated":3,"skipped":0,"reported_at":"2026-11-04T20:00:00Z","noindex":3}`.
+5. The SEO sitemap filter excludes any candidate (record, registry page, additional address) whose normalised path is in the set, with reason `noindex`, from the XML and HTML sitemaps. A changed set requests one debounced sitemap rebuild.
+6. Compatibility: a layer that sends no `noindex` keeps working (the set stays as it is). A plugin built before this contract decodes the body into `{routes}` and ignores the unknown key (encoding/json without DisallowUnknownFields), and it reads at most `MaxReportedRoutes*(MaxRouteBytes+8)+1024` = 2000*(2048+8)+1024 = 4,113,024 bytes of body (sm-seo-plugin controllers/api/registry.go:21, `maxRouteReportBody`). The layer therefore keeps the serialised JSON body at or under 4,113,024 bytes: it drops `noindex` entries from the end first, and only when the body is still too large `routes` entries from the end, so an older plugin never refuses the body for its size. A plugin built with this contract accepts at least that size (its cap covers both lists). The layer ignores the answer body.
+
+## Execution units and resume points
+
+- Run from summercms.go. Commit groups per repository, staged by explicit path (never `git add -A`); no attribution trailers; code and planning docs in separate commits; a README or docs change goes in the same commit as the API change it describes. Nothing is pushed or tagged. STATE.md changes only through `msd_run query state.*` handlers and is never committed.
+- Every commit keeps that repository's `go vet ./...` and `go test -short ./...` green; the Docker suites (`go test ./...`) run per task. If the Docker socket is denied although the user is in the docker group, run the Docker tests through `sudo -u golem` (CLAUDE.md).
+- 33-16 runs in parallel and commits planning docs to summercms.go too: if git reports `.git/index.lock`, wait and retry; never remove another session's lock or stage its files. Leave other sessions' uncommitted edits (STATE.md, state.json, G15OFFICE.md) alone.
+- Resume check per repository: `git -C <repo> log --format=%s | grep -Fx '<subject>'`.
+- Before Task 1, record each repository's HEAD as BASE in the SUMMARY draft (summercms.go, sm-seo-plugin, sm-sitemap-plugin, sm-journal-plugin); the dependency and compatibility checks compare against it.
+- **Executor note (context budget):** if the context runs low, stop only after a complete task (all its commit groups committed and its verify green), never inside one; write the SUMMARY with the finished tasks and list the remaining tasks, with their resume points from the table below, for a continuation run. Every task is independently committable.
+- **Gate stages:** this plan runs only its own stages of `scripts/check-phase33.sh` (self-test, go, plugins, docker, admin, docs, marker, additive, compat), never layers or consumers, because 33-16 changes the layers in parallel. The orchestrator runs the full `PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --all` once, after both 33-15-SUMMARY.md and 33-16-SUMMARY.md exist and before 33-14 Task 4.
+- Every `<automated>` command starts with `set -o pipefail`, or chains with `&&`, so a failing command is never hidden by a later pipe stage.
+
+| Task | Commit groups, in order | Resume point |
+|------|-------------------------|--------------|
+| 1 | sitemap: A `feat: contract.Rebuilder asks for a debounced rebuild`; seo: B `feat: noindex paths from the route report leave the sitemaps (tracer)` | TestNoindexPathsTracer passes |
+| 2 | seo: A `fix: a cancelled or timed-out crawl stores what it fetched and ends`; B `fix: a crawl cancel waits for its job, and a stale crawl is ended`; C `fix: bound opening a Chrome tab` | TestCrawlCancelRunning, TestCrawlTimeout, TestCrawlStaleRecovery, TestRenderTabTimeout pass |
+| 3 | seo: A `fix: the crawler and the Chrome guard keep to the site's port`; B `fix: one decoded path form for crawl keys and CMS lookups` | TestFetcherPortAndKey and TestCrawlerNonASCII pass |
+| 4 | sitemap: A `fix: IndexNow hears of deleted and edited records`; B `fix: rebuilds collect under one lock and keep moved lastmods`; C `fix: the definitions migration keeps and logs every url item`; D `fix: HTML sitemap headings follow each locale until an editor sets one` | TestIndexNow, TestConcurrentRebuilds, TestRebuildKeepsMovedLastmod, TestConvertLegacyItems, TestTypeTitlesNotPinned pass |
+| 5 | journal: A `fix: tall originals no longer stop the image variants job`; B `fix: H1 conversion leaves markdown and unfinished tags alone`; C `fix: journal:fix-headings runs from the application CLI`; D `fix: image alt texts on markdown posts are written into the markdown` | TestImageVariantsTallOriginal, TestFixHeadingsCommandCLI, TestSetMarkdownImageAlt pass |
+| 6 | journal: A `fix: content descriptors list only locales with content`; seo: B `test: Journal-shaped records in the hreflang test`; sitemap: C `test: Journal-shaped records in the hreflang test`; framework: D `docs(lagoon): attach/webp also decodes WebP`; here: E `docs(33-15): release notes, release log and deferred items for the gap fixes` | plan complete |
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: End-to-end "a route report names /subscriptions noindex and the next sitemap rebuild leaves that Additional address out" — one path only (G1, CMS side)</name>
+  <files>../sm-sitemap-plugin/contract/contract.go, ../sm-sitemap-plugin/classes/listing.go, ../sm-sitemap-plugin/plugin.go, ../sm-sitemap-plugin/README.md, ../sm-seo-plugin/updates/202611040001_create_golem15_seo_noindex_paths.go, ../sm-seo-plugin/models/noindex_path.go, ../sm-seo-plugin/classes/registry.go, ../sm-seo-plugin/controllers/api/registry.go, ../sm-seo-plugin/classes/sitemap_filter.go, ../sm-seo-plugin/classes/crawl/checks.go, ../sm-seo-plugin/classes/crawl/fix.go, ../sm-seo-plugin/classes/crawl/job.go, ../sm-seo-plugin/README.md, ../sm-seo-plugin/sitemap_filter_test.go, ../sm-seo-plugin/registry_test.go, ../sm-seo-plugin/classes/crawl/checks_test.go</files>
+  <read_first>
+    - ../sm-seo-plugin/controllers/api/registry.go (RouteReport) and ../sm-seo-plugin/classes/registry.go (ReportRoutes, normalPagePath, ValidPagePath, RouteReport struct)
+    - ../sm-seo-plugin/classes/sitemap_filter.go (newFilterBatch, decideTarget) and ../sm-seo-plugin/sitemap_filter_test.go (TestSitemapFilterTracer: how the test boots the sitemap plugin and calls sitemapclasses.Rebuild)
+    - ../sm-seo-plugin/registry_test.go (TestRouteReport: token, body, answer)
+    - ../sm-sitemap-plugin/contract/contract.go, ../sm-sitemap-plugin/plugin.go (Register publishes contract.Listing), ../sm-sitemap-plugin/classes/lastmod.go (RequestDebouncedRebuild)
+    - ../sm-seo-plugin/classes/crawl/checks.go (checkSitemaps, Env) and fix.go (tool constants, Route)
+    - ../sm-seo-plugin/updates/202610280007_create_golem15_seo_autolinks.go (migration pattern)
+    - the "Gap-2 contract" section of this plan
+  </read_first>
+  <action>
+    Per G1, D-24, D-33, D-95 and the gap-2 contract above (P33-58, P33-59), in this order:
+       - (A, sitemap) Add `contract.Rebuilder` (`RequestRebuild(ctx context.Context) error`, doc comment: asks for one debounced rebuild, the same one a record event queues; the sitemap plugin publishes it with `app.Publish[contract.Rebuilder]` in its Register). `classes.Listing` implements it by looking up the app's `*gorm.DB` and calling `RequestDebouncedRebuild`; plugin.go publishes it next to `contract.Listing`. README: contract section names the interface. Add an assertion to an existing Docker test that publishes and calls it (for example TestListing: after `RequestRebuild`, `rebuild_pending_until` is set). Commit A.
+       - (B, seo) Migration 202611040001 creates `golem15_seo_noindex_paths` (P33-58, with Rollback); model `models.NoindexPath`. `ReportNoindex` (P33-58) replaces the set in the caller's transaction and reports whether it changed; on a change it registers `lagoon.AfterCommit` that looks up `contract.Rebuilder` and calls `RequestRebuild` (a missing Rebuilder does nothing; an error is logged at warn). The handler decodes `noindex` as `*[]string` (absent vs present), raises the body cap to cover both arrays (two lists of MaxReportedRoutes entries), refuses more than MaxReportedRoutes noindex entries with the same 422, calls ReportNoindex in the same `write` transaction only when the key is present, and adds `noindex` (the stored count) to the answer; the handler doc comment states the semantics. `newFilterBatch` loads the set once per batch; `decideTarget` excludes a candidate whose normalised path (`norm.Path` after the normalisation and redirect checks) is in the set with `contract.ReasonNoindex`, before `resolveAt`. Crawler: add `ToolSitemapSettings = "sitemap_update_settings"` to fix.go; `Env` gains `SitemapTool string`, which the job fills (in `finish`) with ToolSitemapSettings when `svc.App()` publishes `contract.Listing`; in `checkSitemaps` a sitemap_noindex finding with a CMS record keeps ToolSetURLSEO, one without a record names `env.SitemapTool`, and with an empty SitemapTool gets no tool (Route then answers fix: code with What "the address list of the sitemap that names this page"); details gain `"extra": true` when there is no record. README: the route report section gets the exact JSON of the gap-2 contract and the filter's new reason source; the crawler section names the tool. Tests first: `TestNoindexPathsTracer` (Docker, in sitemap_filter_test.go): Additional address `/subscriptions` listed; a route report with `"noindex": ["/subscriptions"]` answers 200 with `"noindex": 1` and sets the sitemap's `rebuild_pending_until`; a rebuild leaves `/subscriptions` out with reason noindex (XML file and the HTML API); a report without the key keeps it out; a report with `"noindex": []` lists it again after the next rebuild; a second identical report requests no rebuild. TestRouteReport gains: a body with an invalid noindex entry counts it in `skipped`; 2001 noindex entries answer 422 and store nothing; a body with only `routes` answers as before plus `noindex`. checks_test.go `TestSitemapNoindexTool`: the three routes above. Commit B.
+  </action>
+  <verify>
+    <automated>set -o pipefail; go -C ../sm-seo-plugin test ./... -run 'TestNoindexPathsTracer|TestRouteReport|TestSitemapFilterTracer|TestFilterReasons' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -20</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or no "--- PASS: TestNoindexPathsTracer" line</fails_when>
+    <automated>set -o pipefail; go -C ../sm-seo-plugin test ./classes/crawl -run 'TestSitemapNoindexTool|TestRoute|TestRouteEveryKind' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -10</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or no "--- PASS: TestSitemapNoindexTool" line</fails_when>
+    <automated>set -o pipefail; go -C ../sm-sitemap-plugin test ./... -run 'TestListing' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -6</automated>
+    <fails_when>non-zero exit, a "FAIL" line, "no tests to run", or no "--- PASS: TestListing" line</fails_when>
+    <automated>go -C ../sm-sitemap-plugin vet ./... && go -C ../sm-sitemap-plugin test -short ./... && go -C ../sm-seo-plugin vet ./... && go -C ../sm-seo-plugin test -short ./...</automated>
+    <fails_when>non-zero exit or a "FAIL" line</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "Rebuilder interface" ../sm-sitemap-plugin/contract/contract.go` prints one line; `grep -n "contract.Rebuilder" ../sm-sitemap-plugin/plugin.go` prints a line
+    - `grep -n 'json:"noindex' ../sm-seo-plugin/controllers/api/registry.go` prints a line and `grep -n "ReportNoindex" ../sm-seo-plugin/controllers/api/registry.go ../sm-seo-plugin/classes/registry.go` prints a line in each
+    - `grep -n "golem15_seo_noindex_paths" ../sm-seo-plugin/updates/202611040001_create_golem15_seo_noindex_paths.go` prints at least one line
+    - `grep -n "sitemap_update_settings" ../sm-seo-plugin/classes/crawl/fix.go` prints one line
+    - `grep -n '"noindex"' ../sm-seo-plugin/README.md` prints a line (the contract JSON)
+    - `go -C ../sm-seo-plugin list -deps . | grep sm-sitemap-plugin` lists only `.../sm-sitemap-plugin/contract` (D-95)
+  </acceptance_criteria>
+  <done>A noindex static path the frontend reports leaves the sitemaps on the next rebuild, and the crawler names the tool that really removes a listed noindex address.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Crawl lifecycle: detached finish, timeout and stale recovery, cancel owned by the job, bounded Chrome tab (L3 CR-01, WR-01, WR-06)</name>
+  <files>../sm-seo-plugin/updates/202611040002_add_golem15_seo_crawls_heartbeat.go, ../sm-seo-plugin/models/crawl.go, ../sm-seo-plugin/classes/crawl/job.go, ../sm-seo-plugin/classes/crawl/store.go, ../sm-seo-plugin/classes/crawl/actions.go, ../sm-seo-plugin/classes/crawl/crawler.go, ../sm-seo-plugin/classes/crawl/render_chrome.go, ../sm-seo-plugin/jobs.go, ../sm-seo-plugin/controllers/api/crawls.go, ../sm-seo-plugin/controllers/crawls.go, ../sm-seo-plugin/mcp.go, ../sm-seo-plugin/lang/en/lang.yaml, ../sm-seo-plugin/lang/pl/lang.yaml, ../sm-seo-plugin/README.md, ../sm-seo-plugin/crawl_lifecycle_test.go, ../sm-seo-plugin/classes/crawl/render_test.go</files>
+  <read_first>
+    - ../sm-seo-plugin/classes/crawl/job.go (Run, run, finish, Start, Cancel, LoadLimits) and store.go (LatestCrawl, ActiveCrawl), actions.go (DeleteCrawls, Prune)
+    - ../sm-seo-plugin/classes/crawl/crawler.go (the worker loop: pace.wait, f.Get, renderMu, Progress)
+    - ../sm-seo-plugin/classes/crawl/render_chrome.go (Render) and render_test.go (package crawl)
+    - ../sm-seo-plugin/crawl_admin_test.go (how a crawl is started, run with crawl.Run and a fetchguard.WithTransport fixture, and cancelled) and crawler_test.go (TestCrawlerTracer fixture site)
+    - ../summercms.go/modules/conga/conga.go (CancelJob, CheckIfCanceled, FailJob, StopJob)
+    - 33-REVIEW.md lane 3 CR-01, WR-01, WR-06
+  </read_first>
+  <behavior>
+    - TestCrawlCancelRunning (Docker): a crawl whose fixture transport blocks on its third page is cancelled through POST /_seo/api/v1/crawls/{id}/cancel; the row stays running with cancel_requested true; a Start answers 409 crawls.already_running; DELETE /crawls?ids= refuses it; Prune keeps it; then the job context is cancelled (as River does) and the transport released: the row ends cancelled with finished_at set, the two pages fetched before are stored with their issues, LatestCrawl returns it, and no page is stored as network_error
+    - TestCrawlTimeout (Docker): crawl.Run under a context that reaches its deadline mid-crawl stores the pages fetched so far and ends failed with an error naming the time limit and finished_at set; a later Start succeeds
+    - TestCrawlStaleRecovery (Docker): a running row with heartbeat_at 11 minutes old is ended failed (no-heartbeat error, finished_at) by the next Start, which then queues a new crawl; a running row with cancel_requested_at and an old heartbeat ends cancelled; a running row with a fresh heartbeat still blocks Start with 409
+    - TestRenderTabTimeout (package crawl, no Chrome): a chromeRenderer whose tab opener blocks returns an error within TabOpenTimeout (set to 50 ms in the test) plus a margin, and a second Render call is not blocked by the first
+  </behavior>
+  <action>
+    Per L3 CR-01, WR-01, WR-06, D-14 and P33-60, tests first, three commit groups:
+       - (A, CR-01) jobs.go uses `crawl.JobTimeout`. `Run`: after `run`, finish on `fctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), FinishTimeout)` with `gdb.WithContext(fctx)`, passing the job context's `ctx.Err()`; `finish` decides: runErr → failed; `context.DeadlineExceeded` → failed with the error "the crawl reached its time limit of 6h"; a requested cancel (fresh read of the row's cancel_requested_at or status), `context.Canceled` or `res.Canceled` → cancelled; a `LoadLimits` error falls back to the defaults (DefaultMaxPages, DefaultDelay, DefaultKeep) with a warn log instead of returning; conga FailJob/StopJob/CompleteJob and Prune run on fctx. crawler.go: a page whose `f.Get` returned an error while `ctx.Err() != nil` gets `Err "canceled"` (the checks already skip it). Commit A.
+       - (B, WR-01 and stale recovery) Migration 202611040002 adds `heartbeat_at` and `cancel_requested_at` (P33-60, with Rollback); the model gains both fields. `Run` writes heartbeat_at with started_at and starts a heartbeat goroutine (every HeartbeatEvery, each update on `context.WithoutCancel` with a 10 s timeout) stopped after finish returns. `Cancel`: a queued row becomes cancelled with finished_at through an update conditioned on `status = 'queued'`; when that matches nothing, or the row is running, it sets cancel_requested_at and cancelled_by on the running row only and cancels the conga job; the status stays running. The run's `Canceled` callback also stops on cancel_requested_at. `RecoverStale(tx, now)` (store.go) ends running rows per P33-60 (cancelled when cancel_requested_at is set, else failed with the error "the crawl job stopped without finishing (no heartbeat since <time>)"), finished_at now, and fails or stops their conga jobs best effort; `Start` calls it after locking the settings row and before ActiveCrawl, `DeleteCrawls` before its active check. `crawlMap` (API and MCP) adds `cancel_requested` (bool); the Crawls list shows the new label `crawls.st_cancelling` (en "Cancelling", pl "Anulowanie") for a running row with a requested cancel; the `cancel_crawl` MCP description says the crawl keeps running until its job stops, then ends cancelled with the pages fetched so far, and that no other crawl starts before that; README crawl section likewise. Commit B.
+       - (C, WR-06) render_chrome.go: `TabOpenTimeout = 5 * time.Second` (a package var the test may lower); Render derives `rctx, cancel := context.WithTimeout(ctx, TabOpenTimeout+RenderTimeout)` and registers `context.AfterFunc(rctx, closeTab)` instead of the crawl context, so a hung `chromedp.Do(tab)` returns when rctx ends; a tab that did not open in time answers "Chrome did not open a tab within 5 s". Add a seam for the test (a renderer field for the tab opener, defaulting to chromedp.NewContext and chromedp.Do). The crawler's renderMu section is then bounded by the same deadline. Commit C.
+  </action>
+  <verify>
+    <automated>set -o pipefail; go -C ../sm-seo-plugin test ./... -run 'TestCrawlCancelRunning|TestCrawlTimeout|TestCrawlStaleRecovery|TestCrawlAdmin|TestCrawlTools|TestCrawlSchedule|TestCrawlerTracer|TestCrawlerChecks' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -20</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or any of TestCrawlCancelRunning, TestCrawlTimeout, TestCrawlStaleRecovery missing from the "--- PASS" lines</fails_when>
+    <automated>set -o pipefail; go -C ../sm-seo-plugin test ./classes/crawl -run 'TestRenderTabTimeout|TestNewRenderer|TestRenderMax' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -8</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or no "--- PASS: TestRenderTabTimeout" line</fails_when>
+    <automated>go -C ../sm-seo-plugin vet ./... && go -C ../sm-seo-plugin test -short ./...</automated>
+    <fails_when>non-zero exit or a "FAIL" line</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "WithoutCancel" ../sm-seo-plugin/classes/crawl/job.go` prints at least one line
+    - `grep -n "heartbeat_at\|cancel_requested_at" ../sm-seo-plugin/updates/202611040002_add_golem15_seo_crawls_heartbeat.go` prints at least two lines
+    - `grep -n "JobTimeout" ../sm-seo-plugin/jobs.go` prints one line
+    - `grep -n "func RecoverStale" ../sm-seo-plugin/classes/crawl/store.go` prints one line
+    - `grep -n "st_cancelling" ../sm-seo-plugin/lang/en/lang.yaml ../sm-seo-plugin/lang/pl/lang.yaml` prints a line in each
+    - `grep -n "TabOpenTimeout" ../sm-seo-plugin/classes/crawl/render_chrome.go` prints at least two lines
+  </acceptance_criteria>
+  <done>A cancelled or timed-out crawl keeps what it fetched and ends; no crawl stays running after its job is gone; a second crawl cannot start while a cancelled one is still stopping; a hung Chrome cannot stall the crawl.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Crawl addresses: the site's port and one decoded path form (L3 WR-03, WR-04)</name>
+  <files>../sm-seo-plugin/classes/crawl/fetch.go, ../sm-seo-plugin/classes/crawl/render.go, ../sm-seo-plugin/classes/crawl/render_chrome.go, ../sm-seo-plugin/classes/crawl/compare.go, ../sm-seo-plugin/classes/linkgraph.go, ../sm-seo-plugin/classes/crawl/fetch_test.go, ../sm-seo-plugin/classes/crawl/render_test.go, ../sm-seo-plugin/crawler_test.go, ../sm-seo-plugin/README.md</files>
+  <read_first>
+    - ../sm-seo-plugin/classes/crawl/fetch.go (NewFetcher, Allowed, Key, Absolute, Get) and render.go (allowRequest, resolver rules), render_chrome.go (newChromeRenderer, NewRenderer callers)
+    - ../sm-seo-plugin/classes/crawl/compare.go (same) and ../sm-seo-plugin/classes/linkgraph.go (sitePath, LinksOfURL, LinksOfRecord)
+    - ../sm-seo-plugin/classes/resolver.go (safeText) and classes/crawl/job.go (Lookup, Keyphrases)
+    - ../sm-seo-plugin/classes/crawl/render_test.go (TestAllowRequest table) and ../sm-seo-plugin/crawler_test.go (fixture site, fetchguard.WithTransport)
+    - 33-REVIEW.md lane 3 WR-03, WR-04
+  </read_first>
+  <behavior>
+    - TestAllowRequest gains rows: https://example.test:8443/x refused; https://example.test:443/x allowed; trusted http on the site's port allowed, on another port refused; data: and blob: unchanged
+    - TestFetcherPortAndKey (package crawl): Allowed and Key refuse https://site:8443/x and accept https://site:443/x as /x; Key of https://site/blog/za%C5%BC%C3%B3%C5%82%C4%87?a=1 is /blog/zażółć?a=1; Absolute of that key is https://site/blog/za%C5%BC%C3%B3%C5%82%C4%87?a=1; Key of https://site/%FF keeps /%FF
+    - TestCrawlerNonASCII (Docker): the fixture site links /blog/zażółć percent-encoded from / and lists it encoded in its sitemap; the crawl fetches it once under the key /blog/zażółć, Lookup finds the fixture CMS record at that address (its record-content finding names the record type's tool), no false content_js links finding appears, and LinksOfURL with the encoded absolute URL reports one inbound link; a link to the site host on port 8443 is neither fetched nor stored
+  </behavior>
+  <action>
+    Per L3 WR-03, WR-04, D-14 and P33-61, tests first:
+       - (A, WR-03) NewFetcher records the site's effective port (explicit, else 443 for https and 80 for http) through a small `effectivePort(u *url.URL) string` helper; `Fetcher.Allowed` compares it (so Key refuses another port too); NewRenderer and newChromeRenderer take the port and `allowRequest(rawURL, hosts, port, trusted)` refuses any http(s) request on another effective port (data: and blob: unchanged); compare.go keeps using Key. README: the Chrome guard paragraph names the port rule. Commit A.
+       - (B, WR-04) `Fetcher.Key` returns the decoded `u.Path` ("/" when empty) plus `?` and the raw query, keeping the escaped path when the decoded one is not valid UTF-8 without NUL (P33-61); `Fetcher.Absolute` escapes the path part with `(&url.URL{Path: p}).EscapedPath()` and appends the query as is; compare.go `same` and linkgraph.go `sitePath` (both the `/…` and the absolute input, parsed with url.Parse) produce the same form. Nothing else changes: Lookup, Keyphrases and LinksOfRecord already work on decoded paths. Commit B.
+  </action>
+  <verify>
+    <automated>set -o pipefail; go -C ../sm-seo-plugin test ./classes/crawl -run 'TestAllowRequest|TestFetcherPortAndKey|TestCompareRendered|TestResolverRules' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -10</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or no "--- PASS: TestFetcherPortAndKey" line</fails_when>
+    <automated>set -o pipefail; go -C ../sm-seo-plugin test ./... -run 'TestCrawlerNonASCII|TestCrawlerTracer|TestCrawlerChecks|TestLinkSuggestions|TestChromeRenderer|TestRendererGuards' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -12</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or no "--- PASS: TestCrawlerNonASCII" line (TestChromeRenderer may skip only on a host without Chrome)</fails_when>
+    <automated>go -C ../sm-seo-plugin vet ./... && go -C ../sm-seo-plugin test -short ./...</automated>
+    <fails_when>non-zero exit or a "FAIL" line</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func effectivePort" ../sm-seo-plugin/classes/crawl/*.go` prints one line
+    - `grep -n "func allowRequest" ../sm-seo-plugin/classes/crawl/render.go` prints one line whose parameters include the port
+    - `grep -n "u.Path" ../sm-seo-plugin/classes/crawl/fetch.go` prints at least one line (Key builds the decoded form)
+  </acceptance_criteria>
+  <done>The crawler and headless Chrome stay on the site's port, and addresses with non-ASCII characters match their CMS records and link counts.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 4: Sitemap: IndexNow for deletes and edits, one rebuild lock, kept lastmods, the definitions migration, unpinned HTML headings (L2 WR-01 to WR-05, IN-01)</name>
+  <files>../sm-sitemap-plugin/updates/202611040001_add_golem15_sitemap_urls_indexnow_pending.go, ../sm-sitemap-plugin/models/url.go, ../sm-sitemap-plugin/classes/lastmod.go, ../sm-sitemap-plugin/classes/rebuild.go, ../sm-sitemap-plugin/classes/indexnow.go, ../sm-sitemap-plugin/updates/202610280002_update_golem15_sitemap_settings.go, ../sm-sitemap-plugin/models/legacy.go, ../sm-sitemap-plugin/models/legacy_test.go, ../sm-sitemap-plugin/extensions_settings.go, ../sm-sitemap-plugin/classes/typesettings.go, ../sm-sitemap-plugin/controllers/api/settings.go, ../sm-sitemap-plugin/lang/en/lang.yaml, ../sm-sitemap-plugin/lang/pl/lang.yaml, ../sm-sitemap-plugin/README.md, ../sm-sitemap-plugin/content_fixture_test.go, ../sm-sitemap-plugin/filter_fixture_test.go, ../sm-sitemap-plugin/sitemap_extras_test.go, ../sm-sitemap-plugin/sitemap_index_test.go, ../sm-sitemap-plugin/classes/lastmod_test.go</files>
+  <read_first>
+    - ../sm-sitemap-plugin/classes/rebuild.go (Rebuild, collect, apply, rowChanged) and classes/lastmod.go (RecordSaved, RecordDeleted, RequestDebouncedRebuild), classes/indexnow.go (NotifyIndexNow)
+    - ../sm-sitemap-plugin/sitemap_extras_test.go (TestIndexNow, TestHTMLGroups), sitemap_index_test.go (event firing at ~504-600, TestMigrateDefinitions, TestSettingsSingleton for the admin settings API), content_fixture_test.go (store.put/remove), filter_fixture_test.go (fakeFilter)
+    - ../sm-sitemap-plugin/updates/202610280002_update_golem15_sitemap_settings.go (copyDefinitions) and models/legacy.go, models/url.go (AllowedAddress)
+    - ../sm-sitemap-plugin/extensions_settings.go (typeSettingsTab Load), classes/typesettings.go (SaveTypeSettings), classes/htmlgroups.go (pickTitle, translateIn), controllers/api/settings.go (GET types)
+    - 33-REVIEW.md lane 2 WR-01 to WR-05, IN-01
+  </read_first>
+  <behavior>
+    - TestIndexNow (production fixture) through the fixed fixture: a record deleted with a fired pact.RecordDeleted and a content-only edit with a fired pact.RecordSaved (title change, same URL) lead the next rebuild to queue one IndexNow job holding the deleted address and the edited address; a following rebuild with nothing new queues nothing; outside production nothing is queued and the marks are cleared
+    - TestConcurrentRebuilds (Docker): rebuild A blocks inside the fake Filter's Decide; record X is published; rebuild B starts and waits on the advisory lock (a not-granted advisory lock shows in pg_locks); A is released; both finish; X is listed and is not in any queued IndexNow removal
+    - TestRebuildKeepsMovedLastmod (Docker): through a test seam called right after apply reads the slot rows, a RecordSaved moves the lastmod of a row the same rebuild also changes (title); after the rebuild the stored lastmod is the moved one
+    - TestConvertLegacyItems (models, no Docker): o-nas becomes /o-nas; "/blog/zażółć gęślą" becomes "/blog/zażółć%20gęślą"; a duplicate is kept once without a dropped entry; https://site/x?a=1&b=2 is dropped with a reason naming the &; a malformed item is dropped with its parse error while the other items are kept; a non-url item is neither kept nor reported
+    - TestMigrateDefinitions extended: a definition mixing those items migrates the convertible ones into extra_urls
+    - TestTypeTitlesNotPinned (Docker): an English-UI admin loads Settings › Sitemaps and saves it back unchanged; no type title is stored; the HTML groups API answers the pl group title from the pl translation of the type label and the en one from en
+    - TestRecordSavedNilEvent (classes): RecordSaved(ctx, app, nil) returns nil without a panic
+  </behavior>
+  <action>
+    Per L2 WR-01 to WR-05, IN-01, D-30, D-31, D-32, D-34, P33-62, P33-63 and P33-66, tests first, four commit groups:
+       - (A, WR-01, IN-01) Migration 202611040001 adds `indexnow_pending_at` (with Rollback); the model gains it. RecordSaved checks `ev == nil` before reading ev (IN-01) and, with the lastmod move, sets indexnow_pending_at on the record's rows; RecordDeleted sets indexnow_pending_at only on rows that were listed (excluded_reason '') in the same update that excludes them. `apply` turns pending rows into `Changed` (listed after this rebuild and not already Added or Changed) or `Removed` (no longer listed; handled before the "reason did not change" skip), and clears the mark per P33-62. Fixture fix: content_fixture_test.go gets helpers that delete or edit a record and fire `pact.RecordDeleted` or `pact.RecordSaved` through `e.app.Events.Fire`, as the admin does; TestIndexNow uses them. Commit A.
+       - (B, WR-02, WR-03) Rebuild runs per P33-63: the advisory lock, then settings, types, `collect`, the settings row `FOR UPDATE` and `apply`, all in one transaction; the Rebuild doc comment says what is serialised. `apply` writes `lastmod` only for a created row or an additional address (`w.extra`), never for an existing content row (WR-03). Add a context seam (for example `classes.WithAfterSlotRead(ctx, fn)`, nil in production) called after apply reads the slot rows, and a hook on `fakeFilter` that can block Decide. Commit B.
+       - (C, WR-04) `models.ConvertLegacyItems` and `DroppedItem` per P33-66 (parse the entries one by one with LegacyEntries and ParseLegacyItem); copyDefinitions uses it and logs each dropped item (`diary.For("sitemap")` Warn `golem15.sitemap: definition url item not copied` with item, url and reason), and a definition that is not a list logs one line. Editing the migration in place is safe: v0.2.0 is untagged and no production database has run 202610280002 (deploys follow the 33-14 tags). Local rehearsal databases that already ran the old 202610280002 (the 33-12 demo and 33-13 grzyby rehearsals) keep its old result: recreate them from their source dumps before the 33-14 rehearsal, and say so in the SUMMARY so 33-14 Task 4 does it. README upgrade paragraph states the conversion and the log line. Commit C.
+       - (D, WR-05) typeSettingsTab Load answers only stored titles (an empty map for a type without one) and the field shows the type's label as its comment or placeholder (reuse the existing `type_title` comment if it fits; a new phrase goes into en and pl); `controllers/api/settings.go` GET answers stored titles only if it prefills too. Commit D.
+  </action>
+  <verify>
+    <automated>set -o pipefail; go -C ../sm-sitemap-plugin test ./... -run 'TestIndexNow|TestIndexNowStaging|TestConcurrentRebuilds|TestRebuildKeepsMovedLastmod|TestMigrateDefinitions|TestTypeTitlesNotPinned|TestHTMLGroups|TestLastmod|TestDebouncedRebuild|TestSitemapIndex|TestStableNumbering' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -20</automated>
+    <fails_when>non-zero exit, a "FAIL" line, "no tests to run", or any of TestIndexNow, TestMigrateDefinitions, TestConcurrentRebuilds, TestRebuildKeepsMovedLastmod, TestTypeTitlesNotPinned missing from the "--- PASS" lines</fails_when>
+    <automated>set -o pipefail; go -C ../sm-sitemap-plugin test ./classes ./models -run 'TestRecordSavedNilEvent|TestConvertLegacyItems|TestRealChanges' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -8</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or TestConvertLegacyItems or TestRecordSavedNilEvent missing from the "--- PASS" lines</fails_when>
+    <automated>go -C ../sm-sitemap-plugin vet ./... && go -C ../sm-sitemap-plugin test -short ./...</automated>
+    <fails_when>non-zero exit or a "FAIL" line</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "pg_advisory_xact_lock" ../sm-sitemap-plugin/classes/rebuild.go` prints one line
+    - `grep -n "indexnow_pending_at" ../sm-sitemap-plugin/updates/202611040001_add_golem15_sitemap_urls_indexnow_pending.go ../sm-sitemap-plugin/classes/lastmod.go ../sm-sitemap-plugin/classes/rebuild.go` prints a line in each
+    - `grep -n "definition url item not copied" ../sm-sitemap-plugin/updates/202610280002_update_golem15_sitemap_settings.go` prints one line
+    - `grep -n "func ConvertLegacyItems" ../sm-sitemap-plugin/models/legacy.go` prints one line
+    - `grep -n "RecordDeleted\|RecordSaved" ../sm-sitemap-plugin/sitemap_extras_test.go` prints at least two lines (the fixture fires the events in TestIndexNow)
+  </acceptance_criteria>
+  <done>IndexNow hears of every removal and content edit, concurrent rebuilds and record saves never leave stale state, migrated url items are kept or reported, and HTML sitemap headings stay per language.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 5: Journal content fixes: tall images, markdown left alone, unfinished tags, fix-headings in the CLI, alt texts on markdown (L1 CR-01, CR-02, WR-03, WR-01, WR-05)</name>
+  <files>../sm-journal-plugin/classes/image_variants.go, ../sm-journal-plugin/classes/headings.go, ../sm-journal-plugin/classes/image_alt.go, ../sm-journal-plugin/console/fix_headings.go, ../sm-journal-plugin/controllers/api/maintenance.go, ../sm-journal-plugin/mcp.go, ../sm-journal-plugin/README.md, ../sm-journal-plugin/classes/headings_test.go, ../sm-journal-plugin/classes/image_alt_test.go, ../sm-journal-plugin/headings_test.go, ../sm-journal-plugin/related_media_test.go, ../sm-journal-plugin/image_variants_cli_test.go</files>
+  <read_first>
+    - ../sm-journal-plugin/classes/image_variants.go (GenerateImageVariants) and related_media_test.go (TestImageVariants, jpegOf)
+    - ../sm-journal-plugin/classes/headings.go, image_alt.go, blog_editor.go (LooksLikeHTML), format_html.go (markdownEngine), heading_fix.go (fixPost), console/import_posts.go (ConvertContentH1 call sites), controllers/api/posts_helpers.go (h1Conversion)
+    - ../sm-journal-plugin/classes/headings_test.go and image_alt_test.go (TestConvertH1, TestConvertContentH1, TestConvertTranslationH1, TestSetImageAlt, TestSetImageAltEdges: the gate requires these names)
+    - ../sm-journal-plugin/console/fix_headings.go, console/database.go (lookupDB) and image_variants_cli_test.go (TestImageVariantsCommandCLI)
+    - ../sm-journal-plugin/controllers/api/maintenance.go (SetImageAlt, loadImageAltText, writeImageAltTexts) and headings_test.go (TestHeadingConversion, TestFixHeadingsCommand, TestSetImageAlt)
+    - 33-REVIEW.md lane 1 CR-01, CR-02, WR-01, WR-03, WR-05
+  </read_first>
+  <behavior>
+    - TestImageVariantsTallOriginal (Docker): one job with a 1000×9000 original and then a 900×600 one returns no error; the tall one gets no variant above 4096 px and is counted skipped; the normal one gets its variants; journal:image-variants --all over both finishes with exit code 0
+    - TestConvertContentH1 gains: markdown with a fenced html sample holding h1 tags and an inline code h1 comes back byte for byte, its content_html (from FormatHTML) has the real heading converted and the code still escaped, and the count is 1; HTML content converts as before; TestConvertTranslationH1 gains the same markdown case
+    - TestConvertH1 and TestSetImageAltEdges gain: input without a match (for example "p a <b" cut inside a tag, "x<y") comes back identical; an h1 followed by an unfinished tag keeps the tail
+    - TestHeadingConversion, TestFixHeadingsCommand (Docker) gain a markdown post with a fenced h1 sample: an API save, an import and journal:fix-headings --apply keep its content byte for byte and convert its content_html
+    - TestFixHeadingsCommandCLI (Docker): in the generated CLI without a published database the command names SUMMER_DATABASE__DSN without a DSN and prints the dry-run line with one
+    - TestSetMarkdownImageAlt (classes): ![](/a.jpg) and ![old](/a.jpg "t") get the alt; a destination written unescaped matches its goldmark-escaped src; an alt with ] and a line break is escaped and folded; the same image inside a fence or a code span is left alone; a reference-style image is not matched
+    - TestSetImageAlt (Docker) gains: on a markdown post the alt lands in content and content_html and survives a following PUT that saves the same content; a markdown post whose image is reference-style answers 422 changes.0.src and writes nothing; an HTML post behaves as before
+  </behavior>
+  <action>
+    Per L1 CR-01, CR-02, WR-01, WR-03, WR-05, D-50, D-85, D-10 and P33-65, tests first; core plugin rules: no exported identifier removed or renamed, no exported signature changed (new functions only):
+       - (A, CR-01) In GenerateImageVariants, a width whose computed height exceeds MaxImageWidth (4096, the thumbnailer's edge limit) is skipped with `variantsLog.Warn` (file, width, height) and `out.Skipped++` before ThumbKey runs, so neither ThumbKey nor webp.Variant can fail the batch on it; storage and database errors still return (the job retries). Commit A.
+       - (B, CR-02, WR-03) `ConvertContentH1` converts `content` only when `LooksLikeHTML(content)`; content_html is always converted; the count is content_html's, or content's when content_html has none and content is HTML; doc comments of ConvertContentH1 and ConvertTranslationH1 say markdown is never rewritten (every render path re-derives and re-converts content_html). In ConvertH1 and SetImageAlt, the loop tracks the bytes consumed and on the tokenizer's EOF appends the unconsumed rest of the input before returning. Update the tests that pinned converting a markdown source. Commit B.
+       - (C, WR-01) journal:fix-headings opens the database with `lookupDB` (defer done) as journal:image-variants does; README command list notes it runs from the application CLI. Commit C.
+       - (D, WR-05) `SetMarkdownImageAlt` per P33-65 in image_alt.go, plus a helper that runs a rewrite only on the text outside goldmark code ranges. In the images/alt handler, for each locale's text: HTML content (LooksLikeHTML) keeps today's behaviour; markdown content gets SetMarkdownImageAlt and SetImageAlt outside code; when neither matched while content_html did, the change is refused with 422 `changes.N.src` "The image is not an inline image of the post's markdown; edit the post." and nothing is written (the batch stays all or nothing). The images/alt API and the MCP tool are new in the unreleased v0.4.0, so the refusal is no break. mcp.go set_image_alt description and the README API section state the markdown rule. Commit D.
+  </action>
+  <verify>
+    <automated>set -o pipefail; go -C ../sm-journal-plugin test ./classes -run 'TestConvertH1|TestConvertContentH1|TestConvertTranslationH1|TestSetImageAlt|TestSetImageAltEdges|TestSetMarkdownImageAlt' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -10</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or no "--- PASS: TestSetMarkdownImageAlt" line</fails_when>
+    <automated>set -o pipefail; go -C ../sm-journal-plugin test ./... -run 'TestImageVariants|TestImageVariantsTallOriginal|TestImageVariantsCommandCLI|TestFixHeadingsCommand|TestFixHeadingsCommandCLI|TestHeadingConversion|TestHeadingConversionTracer|TestSetImageAlt|TestJournalSettingsTools' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -16</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or TestImageVariantsTallOriginal or TestFixHeadingsCommandCLI missing from the "--- PASS" lines</fails_when>
+    <automated>set -o pipefail; go -C ../sm-journal-plugin vet ./... && go -C ../sm-journal-plugin test -short ./... && npm --prefix ../sm-journal-plugin run test 2>&1 | tail -6</automated>
+    <fails_when>non-zero exit, a "FAIL" line, or a failed count above 0 in the vitest summary</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "lookupDB" ../sm-journal-plugin/console/fix_headings.go` prints one line
+    - `grep -n "LooksLikeHTML" ../sm-journal-plugin/classes/headings.go` prints at least one line
+    - `grep -n "func SetMarkdownImageAlt" ../sm-journal-plugin/classes/image_alt.go` prints one line
+    - `grep -n "MaxImageWidth" ../sm-journal-plugin/classes/image_variants.go` prints at least two lines (the bound and the new height check)
+    - with BASE the journal HEAD recorded before Task 5, `git -C ../sm-journal-plugin diff BASE..HEAD -U0 -- '*.go' ':!*_test.go' | grep -E '^-func [A-Z]|^-func \([^)]*\) [A-Z]'` prints nothing (no exported function removed or its signature changed)
+  </acceptance_criteria>
+  <done>Tall images, markdown code samples, cut-off tags and markdown alt texts are handled without corrupting content or stopping jobs, and journal:fix-headings runs from the application CLI.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 6: Journal descriptors list only locales with content (G3), Journal-shaped hreflang fixtures, the WebP decoder docs line, release notes and the record of G2</name>
+  <files>../sm-journal-plugin/classes/content_descriptors.go, ../sm-journal-plugin/classes/menu_item_types.go, ../sm-journal-plugin/content_descriptors_test.go, ../sm-journal-plugin/README.md, ../sm-seo-plugin/classes/alternates_test.go, ../sm-sitemap-plugin/sitemap_index_test.go, modules/lagoon/README.md, docs/database/attachments.md, .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-journal-plugin-v0.4.0.md, .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-seo-plugin-v0.2.0.md, .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-sitemap-plugin-v0.2.0.md, .planning/phases/33-seo-output-audit-and-content/33-14-notes-summercms-v0.6.1.md, .planning/phases/33-seo-output-audit-and-content/33-release-log.md, .planning/phases/33-seo-output-audit-and-content/deferred-items.md</files>
+  <read_first>
+    - ../sm-journal-plugin/classes/content_descriptors.go (describePosts, describeCategories, describeTags) and classes/menu_item_types.go (describeAuthors, menuAlternates, loadMenuLocales, menuTranslations, phpTruthy, publishedPosts)
+    - ../sm-journal-plugin/content_descriptors_test.go (bootMenuItemTypes with translate, TestContentDescriptors, TestJournalTagType) and menu_item_types_smoke_test.go
+    - ../sm-seo-plugin/classes/alternates_test.go (TestAlternates) and ../sm-sitemap-plugin/sitemap_index_test.go (TestHreflangAlternates)
+    - ../summercms.go/modules/signpost/signpost.go (lines 80-90: the DefaultPattern rule, the G2 reason)
+    - modules/lagoon/README.md (attach/webp lines 9, 15, 45) and docs/database/attachments.md (the WebP variants section)
+    - the four 33-14-notes-sm-*/summercms drafts, 33-release-log.md ("Planned contents"), deferred-items.md, 33-VERIFICATION.md (G1, G2, G3, info rows)
+  </read_first>
+  <behavior>
+    - TestContentDescriptorsTranslatedLocales (Docker, translate with pl default, en and de enabled): a post with an en translation row (title, content) and none in de describes pl and en with URLs and de with URL "" and the pl title; a post without translations has only the pl URL; a category with a translated en name gets the en URL, one without gets ""; a tag whose only published post is translated into en gets the en URL and "" for de; an author likewise; the journal-post and journal-category menu Resolve of the same records still lists all three locales with URLs
+    - TestAlternates (sm-seo-plugin) runs on a Journal-shaped record (pl default, en translated, de enabled and untranslated with URL "" and the pl title, description and word count) and answers pl, en and x-default only
+    - TestHreflangAlternates (sm-sitemap-plugin) uses the same shape for its de entry and still writes no hreflang="de"
+  </behavior>
+  <action>
+    Per G3, D-55, D-57, SC-2 and P33-64, then the docs and planning records:
+       - (A, journal, G3) A helper decides per record and locale whether it has content (P33-64): posts and categories through the menuTranslations already loaded (a new method, for example `has(locale, id, fields...)`, using phpTruthy); tags and authors through one query per describe batch that loads their published posts (the posts-tags pivot `golem15_journal_posts_tags`, posts by user_id, `publishedPosts`) and those posts' translations (loadMenuTranslations). describePosts, describeCategories, describeTags and describeAuthors keep one entry per alternate and set URL "" for a locale without content; menuAlternates, the Resolve functions and the Match functions stay unchanged. README: the "Every resolved record carries alternates…" paragraph gains the descriptor rule. Commit A.
+       - (B, seo) TestAlternates gets a `journalShaped` fixture per the behaviour above. Commit B.
+       - (C, sitemap) TestHreflangAlternates gets the same shape for its untranslated entry. Commit C.
+       - (D, framework, L1 WR-02 docs only) modules/lagoon/README.md (the attach/webp feature line) and docs/database/attachments.md (the encoder paragraph): importing attach/webp also registers the encoder library's WebP decoder ahead of the pure Go one, so decoding WebP uploads (thumbnails, size checks) goes through the system libwebp when it is installed; keep libwebp patched, or build with -tags nodynamic so decoding uses the transpiled copy. Use no new backticked identifiers outside lagoon and no SEO, sitemap or application words (marker stage). `go test ./cmd/summer -run TestDocsTree` and `summer docs:build --check` pass. Commit D (docs only; no Go file changes).
+       - (E, planning docs) Release-note drafts: sm-seo-plugin v0.2.0 (route report noindex paths and the filter, crawl cancel and timeout behaviour with the stale recovery, port and non-ASCII crawl fixes), sm-sitemap-plugin v0.2.0 (contract.Rebuilder; IndexNow of removed and edited addresses now true; the corrected migration wording per P33-66 with the log line; the upgrade line about noindex Additional addresses: left out automatically when the frontend reports them, otherwise remove them), sm-journal-plugin v0.4.0 (descriptors list only locales with content, a behaviour change for hreflang and sitemaps, with the rule stated explicitly: posts and categories by their own translation in the locale, tags and authors when at least one of their published posts is translated into it, the default locale always; markdown never rewritten by the H1 conversion; alt texts on markdown posts; tall images; fix-headings from the CLI under Fixed), summercms v0.6.1 (the WebP decoder note under Changed). 33-release-log.md: add the docs commit of D under "Framework commits of later Phase 33 plans". deferred-items.md: G3's 33-13 entry and the 33-12 "noindex additional address" entry resolved (CMS side here, layer side 33-16), the "journal-tag pattern" entry deferred to v0.6.2 with the G2 reason (signpost.Activate refuses an empty DefaultPattern; dropping the descriptor would remove the tag form's SEO tab and the sitemap types row), the fix-headings note of "journal:image-variants cannot run" resolved, and the stale "Saving Settings › Journal answers 500" entry resolved (d2ce3a2); a new "From 33-15" section lists the v0.6.2 items of the Deferred section below. Commit E in summercms.go as planning docs.
+  </action>
+  <verify>
+    <automated>set -o pipefail; go -C ../sm-journal-plugin test ./... -run 'TestContentDescriptorsTranslatedLocales|TestContentDescriptors|TestContentDescriptorsMatrix|TestJournalTagType|TestJournalDescriptorFields|TestMenuItemTypesSmoke' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' | tail -12</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or no "--- PASS: TestContentDescriptorsTranslatedLocales" line</fails_when>
+    <automated>set -o pipefail; go -C ../sm-seo-plugin test ./classes -run 'TestAlternates' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)' && go -C ../sm-sitemap-plugin test ./... -run 'TestHreflangAlternates' -count=1 -v 2>&1 | grep -E '^(--- |FAIL|ok)'</automated>
+    <fails_when>a "FAIL" line, "no tests to run", or TestAlternates or TestHreflangAlternates missing from the "--- PASS" lines</fails_when>
+    <automated>set -o pipefail; go test ./cmd/summer -run TestDocsTree -count=1 && sha=$(git log --format=%H -n1 --grep='^docs(lagoon): attach/webp also decodes WebP$') && test -n "$sha" && files=$(git show --name-only --format= "$sha") && printf '%s\n' "$files" | awk '/\.go$/ {n++} END {print "go-files=" n+0}'</automated>
+    <fails_when>non-zero exit, a "FAIL" line, no "go-files=" line (the docs commit is missing), or a value other than go-files=0 (the framework commit of this plan changes a Go file)</fails_when>
+    <automated>set -o pipefail; PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --self-test --go --plugins --docker --admin --docs --marker --additive --compat 2>&1 | tail -20</automated>
+    <fails_when>non-zero exit, a "FAIL" or "refuse:" line, or a missing "PASS <stage>" line for any of self-test, go, plugins, docker, admin, docs, marker, additive and compat (this plan never runs the layers or consumers stage; the orchestrator runs --all after both SUMMARYs)</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "has content" ../sm-journal-plugin/README.md` prints a line stating the descriptor rule (a locale gets an address only when the record has content in it)
+    - `grep -n "nodynamic" modules/lagoon/README.md docs/database/attachments.md` prints a line in each with the decoding note
+    - `grep -n "not copied" .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-sitemap-plugin-v0.2.0.md` prints a line
+    - deferred-items.md has a "From 33-15" section and the journal-tag entry names signpost's DefaultPattern rule
+    - `git -C ../sm-seo-plugin status --short`, `git -C ../sm-sitemap-plugin status --short` and `git -C ../sm-journal-plugin status --short` print no tracked change left uncommitted by this plan
+  </acceptance_criteria>
+  <done>Untranslated locales leave hreflang and sitemaps for Journal records on the real descriptor path, the fixtures prove it with Journal-shaped records, and the release notes, release log and deferred items match the code.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| frontend server → route report | token-authenticated POST whose noindex list now changes what the sitemaps list |
+| site pages (untrusted HTML and JS) → headless Chrome | page code asks the browser to load URLs |
+| crawl job ↔ database | final writes after a cancel or timeout, stale rows |
+| admin/MCP → images/alt | untrusted alt text written into markdown source |
+| Phase 17 definition data → migration | admin-entered legacy URLs copied and logged |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-33-71 | Elevation of privilege (SSRF) | Chrome request guard and Fetcher (L3 WR-03) | high | mitigate | allowRequest and Fetcher.Allowed compare the effective port with the site's, so page code can no longer reach other TLS services on the site host's address; TestAllowRequest and TestFetcherPortAndKey pin it (Task 3) |
+| T-33-72 | Tampering | route report noindex paths | medium | mitigate | constant-time token as for routes; each entry validated (ValidPagePath, 2048 bytes) and capped at 2000; the set only feeds the sitemap filter (robots, canonical and the resolve answer are untouched); the README recommends a dedicated route_report_token over the 404 token fallback (Task 1) |
+| T-33-73 | Denial of service | stuck "running" crawls | medium | mitigate | detached bounded finish, heartbeat every minute, RecoverStale before Start and DeleteCrawls, cancel owned by the job (Task 2) |
+| T-33-74 | Tampering (content injection) | SetMarkdownImageAlt | medium | mitigate | only the matched label is replaced; `\`, `[` and `]` are escaped and line breaks folded, so an alt cannot close the image or add a link; code regions are never touched (Task 5) |
+| T-33-75 | Information disclosure | migration warn log of dropped url items | low | accept | the values are admin-entered site addresses written to the server log once at migration time |
+| T-33-76 | Tampering (integrity) | concurrent sitemap rebuilds | medium | mitigate | one transaction-scoped advisory lock around collect and apply; lastmod of existing content rows never rewritten (Task 4) |
+| T-33-SC | Tampering | npm/pip/cargo/Go installs | high | mitigate | no dependency is added in any repository (goldmark, conga and River are already required); go.mod, go.sum and package.json of the four repositories do not change, and the SUMMARY shows `git diff BASE..HEAD -- go.mod go.sum package.json` empty per repository |
+</threat_model>
+
+<verification>
+- sm-seo-plugin: vet, `test -short`, the Docker suites TestNoindexPathsTracer, TestRouteReport, TestCrawlCancelRunning, TestCrawlTimeout, TestCrawlStaleRecovery, TestCrawlerNonASCII and the existing crawler and filter suites; package crawl tests TestRenderTabTimeout, TestFetcherPortAndKey, TestAllowRequest, TestSitemapNoindexTool; TestAlternates.
+- sm-sitemap-plugin: vet, `test -short`, TestIndexNow, TestConcurrentRebuilds, TestRebuildKeepsMovedLastmod, TestMigrateDefinitions, TestTypeTitlesNotPinned, TestHreflangAlternates, TestConvertLegacyItems, TestRecordSavedNilEvent.
+- sm-journal-plugin: vet, `test -short`, vitest, TestImageVariantsTallOriginal, TestFixHeadingsCommandCLI, TestSetMarkdownImageAlt, TestContentDescriptorsTranslatedLocales and the existing heading, alt and descriptor suites.
+- summercms.go: TestDocsTree, no Go file changed; finally `PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --self-test --go --plugins --docker --admin --docs --marker --additive --compat` (never layers or consumers). The full `--all` gate is run by the orchestrator once, after both 33-15 and 33-16 SUMMARYs exist and before 33-14 Task 4.
+</verification>
+
+<success_criteria>
+- G1 is closed on the CMS side and G3 is closed; G2 is recorded as not fixable without the framework.
+- Every in-scope L1, L2 and L3 finding has a fix and a test that fails before it.
+- No repository is pushed or tagged; the release resumes in 33-14 Task 4 after 33-16, followed by re-verification.
+</success_criteria>
+
+## Deferred (v0.6.2 backlog item, grouped by repository)
+
+- **sm-sitemap-plugin:** L2 WR-06 (default slug collisions), WR-07 (no 50 MB byte guard), WR-08 (Additional addresses on other hosts); info IN-02 to IN-11.
+- **sm-seo-plugin:** L3 WR-02 (crawl limits beyond the job timeout and memory), WR-05 (recheck fetches inside a write transaction); info IN-01 to IN-07; G2 (journal-tag pattern while tag pages are off: needs an additive pact field such as ContentDescriptor.Routable, a framework change, or a signpost rule for an empty DefaultPattern).
+- **sm-journal-plugin:** L1 WR-04 (images/alt locale keying), WR-06 (author pages publish admin logins), WR-07 (settings API string/url workaround); info IN-01 to IN-04, IN-08; an untranslated locale's address still answers with the default-locale content and a self canonical (no longer advertised in hreflang or sitemaps); a canonical to the default locale or a 404 is a separate decision.
+- **summercms.go:** L1 WR-02 code change (decode WebP in attach with the pure Go decoder explicitly, or a decision note); info IN-05, IN-06, IN-07, IN-09; verifier warnings W1 (home title template once / is registered), W2 (swr localhost canonicals), W3 (route report names without diacritics), W4 (GORM local timestamps), W5 (min/max length change in a patch release, a release decision).
+- **Nuxt layers (planned in 33-16, deferred there):** L4 WR-06, WR-07 and the L4 info items.
+
+## Artifacts this phase produces
+
+- sm-seo-plugin: table `golem15_seo_noindex_paths` (migration 202611040001), model `models.NoindexPath`, `(*classes.Service).ReportNoindex`, route report key `noindex` (request and answer), filter reason source; crawl columns `heartbeat_at`, `cancel_requested_at` (migration 202611040002), `crawl.JobTimeout`, `crawl.FinishTimeout`, `crawl.HeartbeatEvery`, `crawl.StaleAfter`, `crawl.RecoverStale`, `crawl.TabOpenTimeout`, `crawl.ToolSitemapSettings`, `Env.SitemapTool`, API and MCP key `cancel_requested`, phrase `crawls.st_cancelling`; `allowRequest` port parameter.
+- sm-sitemap-plugin: `contract.Rebuilder` (published by the plugin), column `indexnow_pending_at` (migration 202611040001), `models.ConvertLegacyItems`, `models.DroppedItem`, the rebuild advisory lock, the `WithAfterSlotRead` test seam.
+- sm-journal-plugin: `classes.SetMarkdownImageAlt`; descriptor rule for locales with content; images/alt 422 for markdown images it cannot rewrite.
+- summercms.go: docs lines in modules/lagoon/README.md and docs/database/attachments.md; updated release-note drafts, release log and deferred items.
+- Tests: TestNoindexPathsTracer, TestSitemapNoindexTool, TestCrawlCancelRunning, TestCrawlTimeout, TestCrawlStaleRecovery, TestRenderTabTimeout, TestFetcherPortAndKey, TestCrawlerNonASCII, TestConcurrentRebuilds, TestRebuildKeepsMovedLastmod, TestConvertLegacyItems, TestTypeTitlesNotPinned, TestRecordSavedNilEvent, TestImageVariantsTallOriginal, TestFixHeadingsCommandCLI, TestSetMarkdownImageAlt, TestContentDescriptorsTranslatedLocales; extended TestRouteReport, TestIndexNow, TestMigrateDefinitions, TestConvertH1, TestConvertContentH1, TestConvertTranslationH1, TestSetImageAltEdges, TestHeadingConversion, TestFixHeadingsCommand, TestSetImageAlt, TestAlternates, TestHreflangAlternates, TestAllowRequest.
+
+<output>
+Create `.planning/phases/33-seo-output-audit-and-content/33-15-SUMMARY.md` when done: the commits per repository, the finding-to-test table, the number of framework Go files changed since v0.6.0 before and after (unchanged), the G2 record, the gate stages' result, and, if the context ran low, the remaining tasks with their resume points.
+</output>

.planning/phases/33-seo-output-audit-and-content/33-15-SUMMARY.md

@@ -0,0 +1,227 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 15
+subsystem: go-plugins
+tags: [seo, sitemap, journal, crawler, indexnow, hreflang, route-report, gap-closure, postgres, goldmark]
+status: complete
+
+requires:
+  - phase: 33-13
+    provides: the release decision (after-tags) and the review and verification findings this plan closes
+  - phase: 33-16
+    provides: the layer side of the gap-2 contract (vue-seo-layer sends the route report's noindex list)
+provides:
+  - "sm-seo-plugin: route report key noindex (golem15_seo_noindex_paths, models.NoindexPath, ReportNoindex, NoindexPathCount), the sitemap filter's noindex reason source, crawl.ToolSitemapSettings and Env.SitemapTool"
+  - "sm-seo-plugin: crawl lifecycle (JobTimeout, FinishTimeout, HeartbeatEvery, StaleAfter, RecoverStale, heartbeat_at and cancel_requested_at, cancel owned by the job, API/MCP cancel_requested, crawls.st_cancelling), TabOpenTimeout, effectivePort and the port-aware allowRequest, classes.PathKey and classes.EscapeKeyPath"
+  - "sm-sitemap-plugin: contract.Rebuilder (published by the plugin), indexnow_pending_at, the rebuild advisory lock, WithAfterSlotRead, models.ConvertLegacyItems and models.DroppedItem, unpinned HTML sitemap headings"
+  - "sm-journal-plugin: tall-original skip, markdown-safe ConvertContentH1, tokenizer tails kept, journal:fix-headings via lookupDB, SetMarkdownImageAlt and SetImageAltOutsideCode, descriptors with URLs only for locales with content"
+  - "summercms.go: the attach/webp decoder note in the lagoon README and docs/database/attachments.md (docs only)"
+affects: [33-14, 33-VERIFICATION, v0.6.2 backlog]
+
+actuals:
+  tokens: 45521
+  tasks: 6
+  commits: 20
+plan_head_before: 8d562004cb05d8d40d12253c23e406259de61006
+plan_head_after: fec697b
+plan_heads:
+  summercms.go: { before: 8d56200, after: fec697b, commits: 2, note: "0e95127 and the two 33-16 commits between are 33-16's" }
+  sm-seo-plugin: { before: 075cf17, after: 2a288a9, commits: 7 }
+  sm-sitemap-plugin: { before: 1048c01, after: b2b3a1d, commits: 6 }
+  sm-journal-plugin: { before: 311c28a, after: 0a62090, commits: 5 }
+
+tech-stack:
+  added: []
+  patterns:
+    - "A job's terminal writes run on context.WithoutCancel(jobCtx) with their own bound; the job owns the terminal status, a cancel only records the request"
+    - "Heartbeat column plus stale recovery inside the start lock, so a row whose job is gone never blocks the one-at-a-time guard"
+    - "Listener marks (indexnow_pending_at) read and cleared by the next rebuild with a <= read-value condition, so a later mark survives"
+    - "Whole read-modify-write rebuild under pg_advisory_xact_lock(hashtext(...)) in one transaction"
+    - "Markdown rewrites only outside goldmark AST code ranges; HTML rewrites only when LooksLikeHTML"
+
+key-files:
+  created:
+    - ../sm-seo-plugin/updates/202611040001_create_golem15_seo_noindex_paths.go
+    - ../sm-seo-plugin/updates/202611040002_add_golem15_seo_crawls_heartbeat.go
+    - ../sm-seo-plugin/models/noindex_path.go
+    - ../sm-seo-plugin/crawl_lifecycle_test.go
+    - ../sm-seo-plugin/classes/crawl/fetch_test.go
+    - ../sm-sitemap-plugin/updates/202611040001_add_golem15_sitemap_urls_indexnow_pending.go
+    - ../sm-sitemap-plugin/models/legacy_test.go
+    - ../sm-sitemap-plugin/rebuild_lock_test.go
+    - ../sm-sitemap-plugin/type_titles_test.go
+  modified:
+    - ../sm-seo-plugin/classes/registry.go
+    - ../sm-seo-plugin/classes/sitemap_filter.go
+    - ../sm-seo-plugin/controllers/api/registry.go
+    - ../sm-seo-plugin/classes/crawl/job.go
+    - ../sm-seo-plugin/classes/crawl/store.go
+    - ../sm-seo-plugin/classes/crawl/fetch.go
+    - ../sm-seo-plugin/classes/crawl/render.go
+    - ../sm-seo-plugin/classes/crawl/render_chrome.go
+    - ../sm-seo-plugin/classes/linkgraph.go
+    - ../sm-sitemap-plugin/contract/contract.go
+    - ../sm-sitemap-plugin/classes/rebuild.go
+    - ../sm-sitemap-plugin/classes/lastmod.go
+    - ../sm-sitemap-plugin/models/legacy.go
+    - ../sm-sitemap-plugin/updates/202610280002_update_golem15_sitemap_settings.go
+    - ../sm-sitemap-plugin/extensions_settings.go
+    - ../sm-journal-plugin/classes/image_variants.go
+    - ../sm-journal-plugin/classes/headings.go
+    - ../sm-journal-plugin/classes/image_alt.go
+    - ../sm-journal-plugin/classes/content_descriptors.go
+    - ../sm-journal-plugin/classes/menu_item_types.go
+    - ../sm-journal-plugin/controllers/api/maintenance.go
+    - ../sm-journal-plugin/console/fix_headings.go
+    - modules/lagoon/README.md
+    - docs/database/attachments.md
+
+key-decisions:
+  - "P33-58 to P33-66 implemented as planned; noindex entries that are patterns (* or a :param segment) are skipped and counted, and a percent-encoded entry is stored decoded when that is a valid address (the filter compares decoded paths)"
+  - "The crawl key's decoded path form lives in classes.PathKey (shared by Fetcher.Key and linkgraph.sitePath); a decoded path holding % or ? keeps its encoded form so Absolute can tell the two forms apart"
+  - "compareRendered takes the fetcher's Key function, so the rendered comparison inherits the port and path rules"
+  - "NewRenderer keeps its signature and derives the site's port from its site argument; newChromeRenderer takes the port"
+  - "G2 not fixed: signpost.Activate refuses a menu item type whose DefaultPattern does not start with /, so the change needs the framework (v0.6.2)"
+
+patterns-established:
+  - "Gap-closure tests that pin a fix are checked to fail on the old code by swapping the old line back in before committing"
+
+requirements-completed: [SC-1, SC-2, SC-3, D-14, D-24, D-30, D-31, D-32, D-33, D-34, D-50, D-55, D-57, D-85, D-95, D-10]
+
+duration: 2h15m
+completed: 2026-11-04
+---
+
+# Phase 33 Plan 15: Go plugin gap fixes before the release Summary
+
+**Noindex paths from the route report leave the sitemaps (G1, CMS side), Journal descriptors give only locales with content an address (G3), and every in-scope L1 to L3 review finding is fixed with a test that fails on the old code, in sm-seo-plugin, sm-sitemap-plugin and sm-journal-plugin, plus one framework docs note.**
+
+## Performance
+
+- **Duration:** about 2 h 15 min
+- **Started:** 2026-11-04T21:37:51Z
+- **Tasks:** 6 of 6
+- **Commits:** 20 (seo 7, sitemap 6, journal 5, summercms.go 2), nothing pushed or tagged
+
+## BASE (recorded before Task 1)
+
+| Repository | BASE |
+|---|---|
+| summercms.go | 8d562004cb05d8d40d12253c23e406259de61006 |
+| sm-seo-plugin | 075cf1700797722f35ba77daa2ed408790e4c898 |
+| sm-sitemap-plugin | 1048c01fd913173866efd678d0e4bfc28b52dade |
+| sm-journal-plugin | 311c28af3adecfabde8bc142703777779590fb35 |
+
+## Commits
+
+**sm-sitemap-plugin** (main)
+- 6b67ab7 feat: contract.Rebuilder asks for a debounced rebuild (Task 1 A)
+- f58d555 fix: IndexNow hears of deleted and edited records (Task 4 A)
+- 2200e46 fix: rebuilds collect under one lock and keep moved lastmods (Task 4 B)
+- b37b226 fix: the definitions migration keeps and logs every url item (Task 4 C)
+- da32044 fix: HTML sitemap headings follow each locale until an editor sets one (Task 4 D)
+- b2b3a1d test: Journal-shaped records in the hreflang test (Task 6 C)
+
+**sm-seo-plugin** (main)
+- 9de6b2e feat: noindex paths from the route report leave the sitemaps (tracer) (Task 1 B)
+- d7597bb fix: a cancelled or timed-out crawl stores what it fetched and ends (Task 2 A)
+- cd71823 fix: a crawl cancel waits for its job, and a stale crawl is ended (Task 2 B)
+- cfeb3df fix: bound opening a Chrome tab (Task 2 C)
+- 3fdb44b fix: the crawler and the Chrome guard keep to the site's port (Task 3 A)
+- e2af5b4 fix: one decoded path form for crawl keys and CMS lookups (Task 3 B)
+- 2a288a9 test: Journal-shaped records in the hreflang test (Task 6 B)
+
+**sm-journal-plugin** (main)
+- 45d66f6 fix: tall originals no longer stop the image variants job (Task 5 A)
+- 0e739c8 fix: H1 conversion leaves markdown and unfinished tags alone (Task 5 B)
+- 5f683cb fix: journal:fix-headings runs from the application CLI (Task 5 C)
+- 7662d54 fix: image alt texts on markdown posts are written into the markdown (Task 5 D)
+- 0a62090 fix: content descriptors list only locales with content (Task 6 A)
+
+**summercms.go** (master)
+- 1f96899 docs(lagoon): attach/webp also decodes WebP (Task 6 D, docs only, no Go file)
+- fec697b docs(33-15): release notes, release log and deferred items for the gap fixes (Task 6 E)
+
+## Finding to test
+
+| Finding | Fix | Test (fails on the old code) |
+|---|---|---|
+| G1 (D-24, D-33, D-95, SC-1) | route report `noindex`, stored set, filter reason, `contract.Rebuilder` | TestNoindexPathsTracer, TestRouteReport (extended), TestListing (Rebuilder) |
+| G1 (SC-3, D-14) crawler tool | `sitemap_update_settings` / fix: code for a listed noindex address without a record | TestSitemapNoindexTool |
+| G3 (D-55, D-57, SC-2) | descriptors give a locale a URL only with content (P33-64) | TestContentDescriptorsTranslatedLocales; TestAlternates and TestHreflangAlternates on Journal-shaped records |
+| L1 CR-01 (D-85) | skip a width whose height exceeds 4096 px | TestImageVariantsTallOriginal |
+| L1 CR-02 (D-50) | ConvertContentH1 rewrites content only when LooksLikeHTML | TestConvertContentH1, TestConvertTranslationH1, TestHeadingConversion (markdown subtest), TestFixHeadingsCommand (markdown post) |
+| L1 WR-01 (D-50) | journal:fix-headings uses lookupDB | TestFixHeadingsCommandCLI |
+| L1 WR-02 | docs only (lagoon README, attachments.md) | TestDocsTree, docs:build --check |
+| L1 WR-03 | tokenizer tails kept in ConvertH1 and SetImageAlt | TestConvertH1, TestSetImageAltEdges |
+| L1 WR-05 (D-85, D-10) | SetMarkdownImageAlt and SetImageAltOutsideCode; 422 changes.N.src otherwise | TestSetMarkdownImageAlt, TestSetImageAlt (markdown part) |
+| L2 WR-01 (D-31) | indexnow_pending_at set by RecordDeleted/RecordSaved, read by apply | TestIndexNow (fires the record events), TestIndexNowStaging |
+| L2 WR-02 (D-30) | pg_advisory_xact_lock around settings, collect and apply | TestConcurrentRebuilds |
+| L2 WR-03 (D-30) | apply writes lastmod only for extras and created rows | TestRebuildKeepsMovedLastmod |
+| L2 WR-04 (D-32) | ConvertLegacyItems, per-item warn log | TestConvertLegacyItems, TestMigrateDefinitions (extended) |
+| L2 WR-05 (D-34) | the form loads stored headings only | TestTypeTitlesNotPinned |
+| L2 IN-01 | nil check before reading ev | TestRecordSavedNilEvent |
+| L3 CR-01 (D-14) | detached bounded finish, time-limit failure, LoadLimits fallback, canceled fetches | TestCrawlTimeout, TestCrawlCancelRunning |
+| L3 CR-01 stale | heartbeat_at, RecoverStale before Start and DeleteCrawls | TestCrawlStaleRecovery |
+| L3 WR-01 | cancel_requested_at; the job writes cancelled | TestCrawlCancelRunning |
+| L3 WR-03 | effective-port check in Fetcher.Allowed, Key, allowRequest | TestAllowRequest (new rows), TestFetcherPortAndKey, TestCrawlerNonASCII (8443 link) |
+| L3 WR-04 | one decoded path form (classes.PathKey), Absolute escapes | TestFetcherPortAndKey, TestCrawlerNonASCII |
+| L3 WR-06 | one deadline for tab open and render | TestRenderTabTimeout |
+
+TestCrawlerNonASCII (L3 WR-04), TestRebuildKeepsMovedLastmod (L2 WR-03) and TestTypeTitlesNotPinned (L2 WR-05) were also run with the old code swapped back in and failed there; the other new tests assert behaviour or schema the old code did not have (new columns, keys, functions), so they cannot pass on it.
+
+## Framework Go files changed since v0.6.0
+
+22 at BASE, 22 at HEAD: this plan changed no framework Go file (1f96899 changes two markdown files).
+
+## G2 (not fixed)
+
+G2 (the site answer lists the journal-tag pattern while `golem15.journal.tag_pages` is false) stays open for v0.6.2: `signpost.Activate` refuses a menu item type whose DefaultPattern does not start with `/` (modules/signpost/signpost.go), so sm-journal-plugin cannot drop the pattern while tag pages are off, and dropping the descriptor would remove the tag form's SEO tab and the sitemap types row. It needs an additive pact field (for example `ContentDescriptor.Routable`) or a signpost rule. Recorded in deferred-items.md ("From 33-12" entry and "From 33-15").
+
+## Gate stages
+
+`PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --self-test --go --plugins --docker --admin --docs --marker --additive --compat`: exit 0, `PASS` for self-test, go, plugins, docker, admin, docs, marker, additive and compat. The compat stage prints `refuse:` lines for sm-feedback-plugin, sm-presentations-plugin and sm-quizzes-plugin and skips them because they fail at v0.6.0 too (they do not resolve the framework through a workspace); every other consumer builds. The layers and consumers stages were not run (33-16's and the orchestrator's `--all`).
+
+Per task, each repository's `go vet ./...` and `go test -short ./...` stayed green, the plan's Docker suites passed (the full sm-seo-plugin suite in 116 s, the full sm-sitemap-plugin and sm-journal-plugin suites), sm-journal-plugin's vitest passed (257 tests), and `go test ./cmd/summer -run TestDocsTree` and `summer docs:build --check` passed. `go.mod`, `go.sum` and `package.json` of all four repositories are unchanged since BASE (T-33-SC). `go list -deps` of sm-seo-plugin lists only `sm-sitemap-plugin/contract` (D-95). No exported Journal function was removed or changed its signature (`git diff 311c28a..HEAD` check empty, D-106); menu_item_types_test.go and menu_item_types_smoke_test.go are unchanged and pass.
+
+## For 33-14 Task 4
+
+- **New migrations:** sm-seo-plugin `202611040001_create_golem15_seo_noindex_paths`, `202611040002_add_golem15_seo_crawls_heartbeat`; sm-sitemap-plugin `202611040001_add_golem15_sitemap_urls_indexnow_pending`.
+- **Edited migration:** sm-sitemap-plugin `202610280002_update_golem15_sitemap_settings` now converts the url items through `models.ConvertLegacyItems`. Untagged, so no production database ran the old one; the local rehearsal databases of 33-12 (demo) and 33-13 (grzyby) ran it and keep its old result. **Recreate them from their source dumps before the 33-14 rehearsal.**
+- **Release notes:** the drafts of sm-seo-plugin v0.2.0, sm-sitemap-plugin v0.2.0, sm-journal-plugin v0.4.0 and summercms v0.6.1 carry the fixes (fec697b); the sitemap draft names the `definition url item not copied` log line and the automatic noindex exclusion; the Journal draft states the descriptor rule as a behaviour change.
+- **Release log:** 1f96899 is listed under "Framework commits of later Phase 33 plans".
+- **Version pins:** sm-seo-plugin now needs `contract.Rebuilder`, so its go.mod must require sm-sitemap-plugin v0.2.0 when tagged (development resolves it through go.work).
+
+## Deviations from Plan
+
+### Auto-fixed and adjusted
+
+**1. [Rule 2] Route report noindex entries that are patterns are refused, and encoded entries stored decoded.** The contract says entries carry no `:` parameter or `*`; ReportNoindex skips such entries and counts them in `skipped`, and stores a percent-encoded path decoded when that is a valid address, because the filter compares decoded paths. Commit 9de6b2e.
+
+**2. [Rule 3] Decoded path form shared in sm-seo-plugin's classes package.** `Fetcher.Key` and `linkgraph.sitePath` both use `classes.PathKey`, with `classes.EscapeKeyPath` for request URLs; a decoded path holding `%` or `?` keeps its encoded form so the two forms never collide. The acceptance grep for `u.Path` in fetch.go therefore finds it in classes/linkgraph.go instead. Commit e2af5b4.
+
+**3. [Rule 3] compareRendered takes the fetcher's Key function** instead of a host list, so the rendered comparison inherits the port and path rules. NewRenderer keeps its exported signature and derives the port from its site argument; only the unexported newChromeRenderer and allowRequest take the port. Commit 3fdb44b.
+
+**4. [Rule 3] Tests added in their own files:** rebuild_lock_test.go and type_titles_test.go (sm-sitemap-plugin, the latter with a fake plugin whose type label has en and pl translations), crawl_lifecycle_test.go (sm-seo-plugin); TestCrawlerNonASCII is in crawler_test.go, TestFixHeadingsCommandCLI in image_variants_cli_test.go.
+
+**5. [Rule 1] Existing Journal descriptor tests updated for the G3 behaviour change.** `seedContent` now gives the category a pl name and the tag a translated published post; TestContentDescriptorsMatrix expects `pl=` for the untranslated draft and tag, and TestJournalAuthorType translates Ada's post and expects `pl=` for Bob. menu_item_types_test.go and the smoke test are untouched (D-106). Commit 0a62090.
+
+**6. Task 2 commit split.** Groups A and B were written together and then split: A (d7597bb) carries the detached finish, the time-limit status, the LoadLimits fallback and canceled fetches, with TestCrawlTimeout; B (cd71823) adds the columns, heartbeat, job-owned cancel and RecoverStale with TestCrawlCancelRunning and TestCrawlStaleRecovery. Each commit was green on its own.
+
+**7. SetImageAltOutsideCode exported** next to SetMarkdownImageAlt (the plan's "helper that runs a rewrite only outside goldmark code ranges"); additive.
+
+### Not done
+
+- `requirements.mark-complete` was not run: it would leave REQUIREMENTS.md modified outside the ROADMAP-only tracking commit.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None beyond the plan's threat register: T-33-71 (port guard), T-33-72 (noindex entries validated, capped, token as for routes), T-33-73 (crawl lifecycle), T-33-74 (escaped alt labels, code untouched) and T-33-76 (rebuild lock) are mitigated as planned.
+
+## Self-Check: PASSED
+
+All created files exist; every commit hash above is in its repository's `git log`.

.planning/phases/33-seo-output-audit-and-content/33-16-PLAN.md

@@ -0,0 +1,405 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 16
+type: execute
+wave: 10
+depends_on: ["33-13"]
+gap_closure: true
+files_modified:
+  - ../vue-seo-layer/lib/routes.ts
+  - ../vue-seo-layer/lib/seo-module.ts
+  - ../vue-seo-layer/lib/options.ts
+  - ../vue-seo-layer/lib/sitemapPages.ts
+  - ../vue-seo-layer/server/seo-routes.d.ts
+  - ../vue-seo-layer/server/lib/routeReport.ts
+  - ../vue-seo-layer/server/lib/site.ts
+  - ../vue-seo-layer/server/middleware/seo-root.ts
+  - ../vue-seo-layer/server/plugins/seo-route-report.ts
+  - ../vue-seo-layer/app/components/global/SeoHtmlSitemapPage.vue
+  - ../vue-seo-layer/app/components/Seo/SitemapLink.vue
+  - ../vue-seo-layer/app/utils/pageHref.ts
+  - ../vue-seo-layer/.playground/nuxt.config.ts
+  - ../vue-seo-layer/testing/smoke-ssr.mjs
+  - ../vue-seo-layer/testing/expect-seo.txt
+  - ../vue-seo-layer/testing/expect-seo-down.txt
+  - ../vue-seo-layer/tests/routes.test.ts
+  - ../vue-seo-layer/tests/sitemapPages.test.ts
+  - ../vue-seo-layer/tests/pageHref.test.ts
+  - ../vue-seo-layer/tests/rootFiles.test.ts
+  - ../vue-seo-layer/package.json
+  - ../vue-seo-layer/README.md
+  - ../vue-journal-layer/.playground/nuxt.config.ts
+  - ../vue-journal-layer/app/journal-pages/PostPage.vue
+  - ../vue-journal-layer/app/utils/seo.ts
+  - ../vue-journal-layer/app/utils/routes.ts
+  - ../vue-journal-layer/lib/journal-module.ts
+  - ../vue-journal-layer/tests/seo.test.ts
+  - ../vue-journal-layer/tests/routes.test.ts
+  - ../vue-journal-layer/testing/expect-acme.txt
+  - ../vue-journal-layer/scripts/check-git-install.sh
+  - ../vue-journal-layer/package.json
+  - ../vue-journal-layer/README.md
+  - ../vue-menu-layer/package.json
+  - ../vue-menu-layer/README.md
+  - ../vue-faq-layer/package.json
+  - ../vue-faq-layer/README.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-seo-layer-v0.2.0.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-journal-layer-v0.8.0.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-menu-layer-v0.5.0.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-faq-layer-v0.5.0.md
+autonomous: true
+requirements: [SC-1, SC-2, D-08, D-22, D-23, D-24, D-33, D-34, D-40, D-42, D-97]
+
+estimate:
+  tokens: 150000
+  raw_tokens: 150000
+  tasks: 4
+  confidence: low
+
+must_haves:
+  truths:
+    - "G1 layer side (D-23, D-24, D-33, SC-1): the route report body carries noindex, the static paths the build serves noindex (requiresAuth, a noindex or none seo.robots, a static page under seo.noindexRoutes), including the @nuxtjs/i18n locale-prefixed copies, never patterns and never the layer's sitemap pages, within 2000 entries of at most 2048 bytes, and the whole JSON body stays at or under 4,113,024 bytes (the older plugin's limit), dropping noindex entries first, exactly as the gap-2 contract below; it is always sent (also []), with the same token and request"
+    - "L4 WR-01 (D-34, D-42): a path-form group page 1 of the HTML sitemap (/mapa-strony/<group>/strona/1) answers one 301 to the unnumbered group page, using the locale's segment; the page never redirects to its own URL"
+    - "L4 WR-04 (D-34): when an app page renders the sitemap path through a catch-all (a root /** page, or a prefixed one covering the path), the layer registers no sitemap pages for that locale and logs it at build, unless seo.htmlSitemap.overCatchAll is true; the switch and the upgrade note are documented in the vue-seo-layer README and the journal, menu and FAQ upgrade notes"
+    - "L4 WR-05 (D-34): with @nuxtjs/i18n the HTML sitemap pages exist once per locale, at the configured path, named for that locale (no copy under another locale's prefix or name); SitemapLink goes to the visitor's locale route and renders only when that path is the layer's sitemap page"
+    - "L4 WR-08 (D-08, D-22): while the backend has not answered since the server started, /robots.txt, /sitemap.xml and /llms.txt answer 503 with Retry-After: 60 instead of falling through to the app; a backend that answers 404 for the site endpoint (older than SEO v0.2.0) still passes through; a staging site therefore never exposes an allow-all robots.txt"
+    - "L4 WR-02 (D-97, SC-2): a journal post page emits exactly one og:type article and article:published_time and article:modified_time from the post data whether or not the CMS answers; the CMS-owned keys still come from the CMS when it answers"
+    - "L4 WR-03 (D-40, D-42): the journal registers its path-form listing routes from the SEO module's resolved pagination option (defaults included), so with seo.pagination.form path alone the Polish listings get /<listing>/strona/:page routes"
+    - "L4 CR-01 (release guard): vue-journal-layer/scripts/check-git-install.sh --check-links <layer dirs> fails while any given layer's package.json has a link:, file:, workspace: or portal: dependency, the tag mode fails when the installed tag still has one, and --self-test covers both; the swap itself stays in 33-14 Task 4"
+    - "L4 CR-01: the version fields read vue-seo-layer 0.2.0, vue-journal-layer 0.8.0, vue-menu-layer 0.5.0 and vue-faq-layer 0.5.0, and each README's install line pins that tag"
+    - "The 33-14-notes-vue-*.md drafts describe the changed behaviour (route report noindex, root files 503, sitemap pages per locale and over a catch-all, journal pagination routes)"
+  prohibitions:
+    - requirement_id: "D-97"
+      category: compatibility
+      status: resolved
+      verification: test
+      statement: "The route report stays compatible both ways: an SEO plugin built before the gap-2 contract still answers 200 to the new body (the fixture API ignores noindex like encoding/json), and the layer still works against a backend without the registry (404, not retried)"
+    - requirement_id: "D-70"
+      category: safety
+      status: resolved
+      verification: test
+      statement: "No change weakens the build guard or the noindex headers: guard:check and the expect-seo.txt noindex lines pass unchanged"
+  artifacts:
+    - path: "../vue-seo-layer/lib/sitemapPages.ts"
+      provides: "the pure builder of the HTML sitemap routes (per locale, i18n names, catch-all rule)"
+      contains: "overCatchAll"
+    - path: "../vue-seo-layer/lib/routes.ts"
+      provides: "noindexStaticRoutes for the route report"
+      contains: "noindexStaticRoutes"
+    - path: "../vue-journal-layer/scripts/check-git-install.sh"
+      provides: "the --check-links release guard"
+      contains: "--check-links"
+  key_links:
+    - from: "../vue-seo-layer/server/plugins/seo-route-report.ts"
+      to: "#seo-routes noindexPaths"
+      via: "routeReportBody(staticRoutes, noindexPaths) posts {routes, noindex}"
+      pattern: "noindexPaths"
+    - from: "../vue-seo-layer/lib/seo-module.ts"
+      to: "../vue-seo-layer/lib/sitemapPages.ts"
+      via: "a pages:resolved hook registered at modules:done, after @nuxtjs/i18n has localised the routes"
+      pattern: "modules:done"
+    - from: "../vue-journal-layer/lib/journal-module.ts"
+      to: "runtimeConfig.public.seo.pagination"
+      via: "journalPaginationSource inside the extendPages callback"
+      pattern: "journalPaginationSource"
+---
+
+<!-- planner-discipline-allow: seo -->
+
+## Phase Goal
+
+**As a** site editor and as an SEO specialist auditing a SummerCMS site, **I want to** have the rendered sites emit complete SEO output (sitemaps, structured data, pagination, hreflang, headings, breadcrumbs) from the CMS, and an audit that finds the remaining problems, **so that** sites are indexed correctly and issues can be fixed through MCP.
+
+This gap-closure plan fixes the Nuxt-layer side of the gaps and review findings that block the 33-14 release: G1 (layer side) and the in-scope findings of review lane L4. Plan 33-15 fixes the Go plugins in parallel (same wave, no shared files; the gap-2 contract below is fixed in both plans). 33-14 Task 4 (the release, including the `link:../vue-seo-layer` swap) resumes after both, followed by re-verification.
+
+<objective>
+Fix, each with a test, in the four Nuxt layers (each main, not pushed, not tagged):
+- vue-seo-layer: the route report's noindex paths (G1, D-23, D-24, D-33); the HTML sitemap pages: the page-1 redirect, catch-all apps, i18n copies, the footer link (L4 WR-01, WR-04, WR-05, D-34); root files while the backend is down (L4 WR-08, D-08, D-22);
+- vue-journal-layer: article meta on post pages (L4 WR-02, D-97) and path-form pagination routes from the SEO module's resolved option (L4 WR-03, D-40, D-42);
+- all four layers: the release guard against link: dependencies, the version fields and the README install pins (L4 CR-01), and the catch-all upgrade notes (L4 WR-04);
+- summercms.go: the four vue release-note drafts (planning docs).
+
+Purpose: close G1 on the layer side and the release-blocking L4 findings before the tags.
+
+Output: commits in vue-seo-layer, vue-journal-layer, vue-menu-layer, vue-faq-layer, and a planning-docs commit in summercms.go.
+
+**Planner decisions recorded here (P33-67 to P33-72; 33-15 used P33-58 to P33-66):**
+- **P33-67 (noindex paths in the build artefact):** `noindexStaticRoutes(pages, noindexRoutes)` in lib/routes.ts takes the same flattened page list as `staticRoutes` and keeps the paths without `:` or `*` that are noindex by meta (`pageMetaRobots` with `robotsNoindex`) or under `seo.noindexRoutes` (`isNoindex`), client-only pages included, the layer's `seo-sitemap-` pages excluded, i18n copies kept (no `localeCopySuffixes` filter), sorted. `#seo-routes` exports it as `noindexPaths`; `routeReportBody(paths, noindex)` answers `{routes, noindex}` with the same limits for both lists; the report always sends `noindex`, so the plugin's set follows each build.
+- **P33-68 (sitemap page registration):** a pure builder `seoSitemapPages(input)` in lib/sitemapPages.ts answers the routes to add and the skipped locales with a reason (`taken`, `catch-all`). The module calls it from a `pages:resolved` hook that it registers in `modules:done`, so it runs after @nuxtjs/i18n has localised the app's routes in either `scanPageMeta` mode, and it first removes routes it added before (dev regeneration). Per locale of `htmlSitemap.paths`: the overview at the path, the group page at `<path>/:group` and, in the path form, `<path>/:group/<segment>/:page(\d+)` with the locale's segment; with i18n active (strategy other than `no_prefix`) each name gets `<routesNameSeparator, default ___><locale>` so i18n reads the right locale; a final page at the same path is `taken`; a catch-all page whose pattern covers the path (`patternCovers` from lib/guard.ts) makes it `catch-all` unless `htmlSitemap.overCatchAll` is true. Skips are logged at build with the reason and the switch.
+- **P33-69 (first page of a group):** `seoFirstPageRedirect(fullPath, form, segment, param): string | null` in app/utils/pageHref.ts answers the unnumbered target, or null when the target equals `fullPath`; SeoHtmlSitemapPage passes the locale's segment from the site answer's `pagination.segments`, else the build option's, else the param.
+- **P33-70 (root files while unknown):** `rootFileTargets` answers the backend target of the fixed names (robots.txt, sitemap.xml, llms.txt) also in state `unknown` without a last answer, so the fetch fails and the middleware's 503 with Retry-After applies; `absent` (an older backend) passes through as before; sitemap files and verification files keep needing a site answer.
+- **P33-71 (journal pagination source):** `journalPaginationSource(nuxtOptions)` in app/utils/routes.ts answers `runtimeConfig.public.seo.pagination` (written by the SEO module's setup with its defaults) when present, else the raw `seo.pagination`; the journal module calls it inside its `extendPages` callback, which runs after every module's setup. No import from vue-seo-layer (33-09: a git-installed layer's .ts under node_modules is not type-stripped by Node).
+- **P33-72 (release guard):** `scripts/check-git-install.sh --check-links DIR...` reads each `DIR/package.json` with node and prints `check-git-install: <dir>: <name> depends on <spec>` for every dependencies, devDependencies, peerDependencies or optionalDependencies entry whose spec starts with `link:`, `file:`, `workspace:` or `portal:`, exiting 1 when any is found; the tag mode runs the same check on the installed `node_modules/vue-journal-layer` before building; `--self-test` adds planted package.json cases.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/phases/33-seo-output-audit-and-content/33-VERIFICATION.md
+@.planning/phases/33-seo-output-audit-and-content/33-REVIEW.md
+@.planning/phases/33-seo-output-audit-and-content/deferred-items.md
+@.planning/phases/33-seo-output-audit-and-content/33-CONTEXT.md
+@.planning/phases/33-seo-output-audit-and-content/33-08-SUMMARY.md
+@.planning/phases/33-seo-output-audit-and-content/33-09-SUMMARY.md
+@CLAUDE.md
+
+<interfaces>
+vue-seo-layer:
+- lib/seo-module.ts: `SEO_MODULE_DEFAULTS` (pagination `{form:'query', param:'page', segments:{pl:'strona', en:'page'}}`, htmlSitemap `{paths:{pl:'/mapa-strony', en:'/sitemap'}}`); setup: guard hooks (`nitro:config`, `nitro:init`, `pages:resolved`, `nitro:build:before`), `extendPages` registering `seo-sitemap-<locale>`, `seo-sitemap-group-<locale>`, `seo-sitemap-group-page-<locale>` with `meta.seoSitemap.locale` (a `taken` exact-path check only), `addServerTemplate('#seo-routes')` from `staticRoutes(pages, noindexRoutes, localeCopySuffixes(i18n))` and `routePatterns(pages)`, `runtime.public.seo = {…, pagination, htmlSitemap}`.
+- lib/routes.ts: `robotsNoindex`, `pageMetaRobots`, `isLayerPage`, `localeCopySuffixes`, `staticRoutes`, `routePatterns`, `routesTemplate(staticPaths, patterns)`; lib/guard.ts: `flattenPages`, `isNoindex`, `patternCovers`, `pagePattern`; lib/options.ts: `paginationOption`, `htmlSitemapOption`, `SeoHtmlSitemapOption`.
+- server/lib/routeReport.ts: `ROUTE_REPORT_MAX_ROUTES` 2000, `ROUTE_REPORT_MAX_BYTES` 2048, `routeReportBody(paths)`, `routeReportOutcome`; server/plugins/seo-route-report.ts posts `body` once per start with one retry; server/seo-routes.d.ts types `#seo-routes`.
+- server/lib/site.ts: `SeoSiteState` (ok, absent, unknown), `siteAnswer` (keeps lastOk), `rootFileTargets(path, site, backendBase, apiBase)` (null unless state ok), `FIXED`; server/middleware/seo-root.ts (503 with Retry-After on a failed fetch).
+- app/components/global/SeoHtmlSitemapPage.vue: `explicitFirst` → `navigateTo(seoPageHref(route.fullPath, 1, form, '', param), {redirectCode: 301})`; app/components/Seo/SitemapLink.vue: locale from props, the resolve answer, html_lang, the site default; href from `config.public.seo.htmlSitemap.paths[locale]`; app/utils/pageHref.ts `seoPageHref`, `seoPageNumber`.
+- testing/smoke-ssr.mjs grammar `routereport N [has=PATH]... [lacks=PATH]...` (checks the last report's routes; the token); expect-seo.txt line `routereport 1 has=/ … lacks=/konto lacks=/szkic lacks=/prywatne lacks=/mapa-strony`; expect-seo-down.txt expects `404 /robots.txt noheader=Retry-After`; the playground has a root `[...slug].vue`, `konto.vue` (requiresAuth), `szkic.vue` (seo.robots noindex, follow), `/prywatne/**` in noindexRoutes, htmlSitemap paths pl `/mapa-strony`, en `/en/sitemap`.
+vue-journal-layer:
+- app/journal-pages/PostPage.vue: `fallback` null when `cmsHeadPresent(answer)`, every `useSeoMeta` key from it (og:type and article times lost when the CMS answers); app/utils/seo.ts `postSeoMeta`, `cmsHeadPresent`.
+- lib/journal-module.ts: `journalPagedRoutes(routes, nuxt.options.seo?.pagination)` computed in setup from the raw option; app/utils/routes.ts `journalPagedRoutes`, `journalPagedRouteName`.
+- .playground: i18n `prefix_except_default`, en default, pl prefixed; no pages of its own; its built server today contains the route names seo-sitemap-en___pl and seo-sitemap-pl___en (the WR-05 evidence).
+- scripts/check-git-install.sh: `--self-test` (lockfile reading), tag mode (scratch app, `pnpm install`, lockfile pin, build, expect-acme.txt); package.json version 0.7.1 and `"vue-seo-layer": "link:../vue-seo-layer"`.
+vue-menu-layer, vue-faq-layer: package.json version 0.4.0 with the same link dependency; README install lines pin #v0.2.0; "Upgrading from 0.4" sections.
+Gate: `scripts/check-phase33.sh --layers` runs every layer's `npm run test`, `build:playground`, vue-seo-layer's `smoke:ssr`, `guard:check`, `purge:check`, the journal's expect-acme*.txt runs and `check-git-install.sh --self-test`, menu and FAQ `smoke:ssr`.
+</interfaces>
+</context>
+
+## Gap-2 contract (fixed; identical in 33-15 and 33-16)
+
+The route report gains an optional `noindex` array of static paths, sent with the same token on the same request:
+
+```
+POST /_seo/api/v1/registry/routes
+Authorization: Bearer <golem15.seo.route_report_token, else golem15.seo.notfound_token>
+Content-Type: application/json
+
+{"routes": ["/", "/blog", "/kontakt"], "noindex": ["/konto", "/pl/konto", "/szkic"]}
+```
+
+1. `routes`: unchanged (required array of strings).
+2. `noindex`: optional array of strings, at most 2000 entries, each starting with `/`, without a `:` parameter or `*`, at most 2048 bytes in UTF-8. It lists every static path the frontend's build serves noindex: pages whose meta has `requiresAuth: true` or a `seo.robots` value with `noindex` or `none`, and static pages under a `seo.noindexRoutes` pattern. The `@nuxtjs/i18n` copies of those pages in other locales are listed as their own locale-prefixed paths (`/pl/konto`). Patterns (`/p/**`) are never sent, the layer's HTML sitemap pages never, and a path is never in both lists.
+3. Plugin semantics: key absent → the stored set is unchanged; key present (also `[]`) → the stored set becomes exactly its valid entries, normalised like `routes` (`normalPagePath` with the site's address options); an invalid entry is skipped and counted in `skipped`; more than 2000 entries → 422 `{"error":"too_many_routes","max":2000}` and nothing is stored.
+4. The answer gains one key, the number of stored paths: `{"inserted":1,"updated":3,"skipped":0,"reported_at":"2026-11-04T20:00:00Z","noindex":3}`.
+5. The SEO sitemap filter excludes any candidate (record, registry page, additional address) whose normalised path is in the set, with reason `noindex`, from the XML and HTML sitemaps. A changed set requests one debounced sitemap rebuild.
+6. Compatibility: a layer that sends no `noindex` keeps working (the set stays as it is). A plugin built before this contract decodes the body into `{routes}` and ignores the unknown key (encoding/json without DisallowUnknownFields), and it reads at most `MaxReportedRoutes*(MaxRouteBytes+8)+1024` = 2000*(2048+8)+1024 = 4,113,024 bytes of body (sm-seo-plugin controllers/api/registry.go:21, `maxRouteReportBody`). The layer therefore keeps the serialised JSON body at or under 4,113,024 bytes: it drops `noindex` entries from the end first, and only when the body is still too large `routes` entries from the end, so an older plugin never refuses the body for its size. A plugin built with this contract accepts at least that size (its cap covers both lists). The layer ignores the answer body.
+
+## Execution units and resume points
+
+- Run from summercms.go. Commit groups per repository, staged by explicit path (never `git add -A`); no attribution trailers; code and planning docs in separate commits; a README change goes in the same commit as the behaviour or option it describes. Nothing is pushed or tagged. STATE.md changes only through `msd_run query state.*` handlers and is never committed.
+- Each layer commit keeps that layer's `npm run test` green; a task's verify adds the playground build and smokes. Node ≥ 22.18 as in the layers' engines.
+- 33-15 runs in parallel and commits to summercms.go too: if git reports `.git/index.lock`, wait and retry; never remove another session's lock or stage its files. deferred-items.md and 33-release-log.md belong to 33-15 in this wave; report the layer-side statuses in this plan's SUMMARY instead of editing them.
+- Do not replace the `link:../vue-seo-layer` dependencies: 33-14 Task 4 does that before tagging.
+- **Gate stages:** this plan runs only `scripts/check-phase33.sh --self-test --layers`, because 33-15 changes the Go plugins in parallel. It does not run consumers: that stage builds the four apps' Go binaries from their own plugin submodules (`plugins/golem15/*` in each app's go.work) and their Nuxt apps against the layer tags pinned in their package.json (git+https, not these checkouts), and checks the 33-12/33-13/33-14 patches against the apps, so no change of this plan reaches it. The orchestrator runs the full `PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --all` once, after both 33-15-SUMMARY.md and 33-16-SUMMARY.md exist and before 33-14 Task 4.
+- Every `<automated>` command starts with `set -o pipefail`, chains with `&&`, or captures the exit status explicitly, so a failing command is never hidden by a later pipe stage.
+- **Executor note (context budget):** if the context runs low, stop only after a complete task (all its commit groups committed and its verify green), write the SUMMARY with the remaining tasks and their resume points for a continuation run. Every task is independently committable.
+- Resume check per repository: `git -C <repo> log --format=%s | grep -Fx '<subject>'`.
+
+| Task | Commit groups, in order | Resume point |
+|------|-------------------------|--------------|
+| 1 | seo-layer: `feat: the route report sends the noindex static paths (tracer)` | the routereport noindex smoke line passes |
+| 2 | seo-layer: A `fix: HTML sitemap page 1 redirects with the locale's segment`; B `fix: HTML sitemap pages once per locale, never over a catch-all by default`; C `fix: root files answer 503 while the backend has not answered`; journal-layer: D `test: the playground's HTML sitemap paths per locale` | sitemapPages.test.ts passes and the journal playground build has one sitemap route per locale |
+| 3 | journal-layer: A `fix: post pages keep og:type article and their article times`; B `fix: path-form listing routes use the SEO module's resolved pagination` | the og:type smoke line and the routes test pass |
+| 4 | journal-layer: A `feat: check-git-install --check-links refuses local dependencies`; each layer: B `chore: version <x.y.z> and install pin` with its README notes; here: C `docs(33-16): release-note drafts for the layer fixes` | plan complete |
+
+<tasks>
+
+<task type="tracer">
+  <name>Task 1: End-to-end "the Nuxt server's route report tells the CMS which static paths it serves noindex" — one path only (G1, layer side)</name>
+  <files>../vue-seo-layer/lib/routes.ts, ../vue-seo-layer/lib/seo-module.ts, ../vue-seo-layer/server/seo-routes.d.ts, ../vue-seo-layer/server/lib/routeReport.ts, ../vue-seo-layer/server/plugins/seo-route-report.ts, ../vue-seo-layer/testing/smoke-ssr.mjs, ../vue-seo-layer/testing/expect-seo.txt, ../vue-seo-layer/tests/routes.test.ts, ../vue-seo-layer/README.md</files>
+  <read_first>
+    - ../vue-seo-layer/lib/routes.ts and lib/guard.ts (flattenPages, isNoindex)
+    - ../vue-seo-layer/lib/seo-module.ts (the #seo-routes server template) and server/seo-routes.d.ts
+    - ../vue-seo-layer/server/lib/routeReport.ts and server/plugins/seo-route-report.ts
+    - ../vue-seo-layer/testing/smoke-ssr.mjs (the routereport grammar, lines ~15 and ~236-257) and testing/expect-seo.txt (the routereport line), testing/fixture-api.mjs (records the request body)
+    - ../vue-seo-layer/tests/routes.test.ts (staticRoutes, localeCopySuffixes, routeReportBody cases)
+    - the "Gap-2 contract" section of this plan
+  </read_first>
+  <behavior>
+    - noindexStaticRoutes: a requiresAuth page, a page with seo.robots "noindex, follow" and a static page under /prywatne/** are listed; an ordinary page, a page with parameters, a catch-all and a layer seo-sitemap- page are not; with i18n copies (names ending in ___pl) the /pl/... copy of a noindex page is listed too; the result is sorted and has no path that staticRoutes lists
+    - routesTemplate exports noindexPaths; routeReportBody(paths, noindex) answers {routes, noindex}, both filtered to paths starting with / within 2048 bytes and cut to 2000
+    - routeReportBody keeps the serialised JSON at or under ROUTE_REPORT_MAX_BODY (2000*(2048+8)+1024 = 4,113,024 bytes, the older plugin's limit): 2000 routes of 2048 bytes plus 100 noindex paths of 200 bytes answer all 2000 routes and only the leading noindex entries that fit (a prefix of the input); small lists come back whole; routes that alone exceed the limit (paths full of characters JSON escapes) are cut from the end with noindex empty
+    - Smoke: routereport 1 has=/ lacks=/konto noindex=/konto noindex=/szkic noindex=/prywatne lacksnoindex=/ lacksnoindex=/mapa-strony
+  </behavior>
+  <action>
+    Per G1, D-23, D-24, D-33 and the gap-2 contract above (P33-67): tests first; `noindexStaticRoutes` in lib/routes.ts; `routesTemplate(staticPaths, patterns, noindexPaths)` adds `export const noindexPaths`; the module passes it; server/seo-routes.d.ts declares it; `routeReportBody(paths, noindex)` applies the same filter and limits to both lists and then keeps `Buffer.byteLength(JSON.stringify(body))` at or under the new `ROUTE_REPORT_MAX_BODY = ROUTE_REPORT_MAX_ROUTES * (ROUTE_REPORT_MAX_BYTES + 8) + 1024` (the older plugin's `maxRouteReportBody`, gap-2 contract point 6) by dropping `noindex` entries from the end first and then `routes` entries, with tests first in tests/routes.test.ts (the behaviour above); the server plugin imports `noindexPaths` and logs "route report: N routes and M noindex paths sent". smoke-ssr.mjs: the routereport line accepts `noindex=PATH` (present in the last report's noindex list) and `lacksnoindex=PATH`, and the header comment documents them; expect-seo.txt's routereport line gains the checks of the behaviour above. README: the route report paragraph gets the exact JSON of the gap-2 contract and says which pages land in `noindex`; the `routeReport` option row mentions it. Commit as listed.
+  </action>
+  <verify>
+    <automated>set -o pipefail; npm --prefix ../vue-seo-layer run test 2>&1 | tail -8</automated>
+    <fails_when>non-zero exit, a "not ok" line, or a "# fail" count above 0</fails_when>
+    <automated>set -o pipefail; npm --prefix ../vue-seo-layer run build:playground 2>&1 | tail -3 && node ../vue-seo-layer/testing/smoke-ssr.mjs --output ../vue-seo-layer/.playground/.output --fixtures ../vue-seo-layer/testing/fixtures --expect ../vue-seo-layer/testing/expect-seo.txt 2>&1 | tail -10</automated>
+    <fails_when>non-zero exit, or a "not ok", "FAIL" or "routereport" failure line</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "export function noindexStaticRoutes" ../vue-seo-layer/lib/routes.ts` prints one line
+    - `grep -n "ROUTE_REPORT_MAX_BODY" ../vue-seo-layer/server/lib/routeReport.ts ../vue-seo-layer/tests/routes.test.ts` prints a line in each
+    - `grep -n "noindexPaths" ../vue-seo-layer/server/plugins/seo-route-report.ts ../vue-seo-layer/server/seo-routes.d.ts` prints a line in each
+    - `grep -n "noindex=/konto" ../vue-seo-layer/testing/expect-seo.txt` prints one line
+    - `grep -n '"noindex"' ../vue-seo-layer/README.md` prints a line (the contract JSON)
+  </acceptance_criteria>
+  <done>Each server start tells the CMS the static paths it serves noindex, so the sitemaps can leave them out.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: HTML sitemap pages: page-1 redirect, catch-all apps, once per locale with i18n, the footer link; root files 503 while the backend is down (L4 WR-01, WR-04, WR-05, WR-08)</name>
+  <files>../vue-seo-layer/lib/sitemapPages.ts, ../vue-seo-layer/lib/seo-module.ts, ../vue-seo-layer/lib/options.ts, ../vue-seo-layer/app/components/global/SeoHtmlSitemapPage.vue, ../vue-seo-layer/app/components/Seo/SitemapLink.vue, ../vue-seo-layer/app/utils/pageHref.ts, ../vue-seo-layer/server/lib/site.ts, ../vue-seo-layer/server/middleware/seo-root.ts, ../vue-seo-layer/.playground/nuxt.config.ts, ../vue-seo-layer/testing/expect-seo-down.txt, ../vue-seo-layer/tests/sitemapPages.test.ts, ../vue-seo-layer/tests/pageHref.test.ts, ../vue-seo-layer/tests/rootFiles.test.ts, ../vue-seo-layer/README.md, ../vue-journal-layer/.playground/nuxt.config.ts</files>
+  <read_first>
+    - ../vue-seo-layer/lib/seo-module.ts (the extendPages block, the guard hooks, runtime.public.seo) and lib/options.ts (htmlSitemapOption), lib/guard.ts (patternCovers, flattenPages, pagePattern), lib/routes.ts (localeCopySuffixes)
+    - ../vue-seo-layer/app/components/global/SeoHtmlSitemapPage.vue, app/components/Seo/SitemapLink.vue, app/seo-pages/SitemapPage.vue and SitemapGroupPage.vue (route.meta.seoSitemap), app/utils/pageHref.ts and tests/pageHref.test.ts
+    - ../vue-seo-layer/server/lib/site.ts (rootFileTargets, siteAnswer), server/middleware/seo-root.ts, tests/rootFiles.test.ts, testing/expect-seo-down.txt, testing/expect-seo.txt (the /mapa-strony lines)
+    - ../vue-journal-layer/.playground/nuxt.config.ts (i18n prefix_except_default) and node_modules/@nuxtjs/i18n/dist/module.mjs around the pages:extend / pages:resolved localisation hook
+    - 33-REVIEW.md lane 4 WR-01, WR-04, WR-05, WR-08; 33-09-SUMMARY deviation 7 (an app without pages)
+  </read_first>
+  <behavior>
+    - seoFirstPageRedirect: ('/mapa-strony/posty/strona/1', 'path', 'strona', 'page') → '/mapa-strony/posty'; ('/sitemap/posts/page/1', 'path', 'page', 'page') → '/sitemap/posts'; ('/mapa-strony/posty?page=1', 'query', '', 'page') → '/mapa-strony/posty'; a target equal to fullPath (for example the segment missing) → null
+    - seoSitemapPages: without i18n the names are seo-sitemap-<locale>, seo-sitemap-group-<locale> (and the page route in the path form with the locale's segment); with i18n prefix_except_default and locales en, pl each route is named <name>___<locale> at the configured path and no route exists for another locale; an app page at the path skips the locale as taken; a root catch-all page skips every locale as catch-all unless overCatchAll is true; a /pl/** catch-all skips only a pl path under /pl/; htmlSitemap false answers nothing
+    - rootFileTargets: state unknown without a site answer gives the backend target for /robots.txt, /sitemap.xml and /llms.txt and null for sitemap files and verification files; state absent stays null; state ok unchanged
+    - Smokes: expect-seo-down.txt answers 503 /robots.txt and 503 /sitemap.xml with Retry-After: 60; expect-seo.txt's /mapa-strony lines still pass with the playground's overCatchAll: true
+    - Journal playground build: the built server's seo-sitemap route names are exactly seo-sitemap-en___en, seo-sitemap-group-en___en, seo-sitemap-pl___pl and seo-sitemap-group-pl___pl, at /sitemap and /pl/mapa-strony
+  </behavior>
+  <action>
+    Per L4 WR-01, WR-04, WR-05, WR-08, D-08, D-22, D-34, D-42 and P33-68 to P33-70, tests first:
+       - (A, WR-01) `seoFirstPageRedirect` in app/utils/pageHref.ts (P33-69); SeoHtmlSitemapPage takes the locale's segment (site answer `pagination.segments[locale]`, else `config.public.seo.pagination.segments[locale]`, else the param) and redirects only when the helper answers a target. Commit A.
+       - (B, WR-04, WR-05) `htmlSitemapOption` accepts `overCatchAll` (boolean, default false) and keeps it in the runtime option; lib/sitemapPages.ts `seoSitemapPages` (P33-68, pure, unit-tested); seo-module.ts drops the extendPages registration and calls the builder from a `pages:resolved` hook registered in `modules:done`, removing its earlier routes first, pushing the result into the resolved list and logging each skip ("HTML sitemap: <locale> <path> is rendered by the app's catch-all page; the layer's page is not registered (set seo.htmlSitemap.overCatchAll to serve it ahead of the catch-all)"). SitemapLink: the locale falls back to the i18n current locale (`useNuxtApp().$i18n?.locale?.value`, guarded: the layer does not depend on i18n) before the site default, and the link renders only when `useRouter().resolve(href)` matches a route whose `meta.seoSitemap.locale` is that locale. The vue-seo-layer playground sets `htmlSitemap.overCatchAll: true` (its root `[...slug].vue`) with a comment; the journal playground sets `seo.htmlSitemap.paths` to en `/sitemap`, pl `/pl/mapa-strony` (the README's full-path rule for i18n apps) — commit D in vue-journal-layer. README: the `htmlSitemap` option row documents `overCatchAll`, the catch-all rule, one route per locale with i18n, and the footer link rule. After the change, build the menu playground once without `htmlSitemap: false` to see whether the 33-09 "app without pages" item is gone; record the result in the SUMMARY and keep both playgrounds' config unchanged. Commit B.
+       - (C, WR-08) rootFileTargets per P33-70, with its doc comment and the seo-root.ts header comment updated; expect-seo-down.txt answers 503 with `header=Retry-After: 60` for /robots.txt and /sitemap.xml and keeps 404 for a sitemap file and a verification file, and its comment states the staging reason; tests/rootFiles.test.ts splits the unknown and absent cases. README root files paragraph. Commit C.
+  </action>
+  <verify>
+    <automated>set -o pipefail; npm --prefix ../vue-seo-layer run test 2>&1 | tail -8</automated>
+    <fails_when>non-zero exit, a "not ok" line, a "# fail" count above 0, or sitemapPages.test.ts missing from the run</fails_when>
+    <automated>set -o pipefail; npm --prefix ../vue-seo-layer run build:playground 2>&1 | tail -3 && npm --prefix ../vue-seo-layer run smoke:ssr 2>&1 | tail -12 && npm --prefix ../vue-seo-layer run guard:check 2>&1 | tail -4 && npm --prefix ../vue-seo-layer run purge:check 2>&1 | tail -4</automated>
+    <fails_when>non-zero exit from any command, or a "not ok" or "FAIL" line</fails_when>
+    <automated>set -o pipefail; npm --prefix ../vue-journal-layer run build:playground 2>&1 | tail -2 && grep -rhoE '"seo-sitemap-[a-z-]+(___[a-z]+)?"' ../vue-journal-layer/.playground/.output/server | sort -u</automated>
+    <fails_when>non-zero exit, any printed name whose suffix differs from its locale (en___pl, pl___en), or the list differs from exactly "seo-sitemap-en___en", "seo-sitemap-group-en___en", "seo-sitemap-group-pl___pl", "seo-sitemap-pl___pl"</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "export function seoSitemapPages" ../vue-seo-layer/lib/sitemapPages.ts` prints one line
+    - `grep -n "modules:done" ../vue-seo-layer/lib/seo-module.ts` prints one line
+    - `grep -n "export function seoFirstPageRedirect" ../vue-seo-layer/app/utils/pageHref.ts` prints one line
+    - `grep -n "overCatchAll" ../vue-seo-layer/README.md ../vue-seo-layer/.playground/nuxt.config.ts` prints a line in each
+    - `grep -n "^503 /robots.txt" ../vue-seo-layer/testing/expect-seo-down.txt` prints one line
+  </acceptance_criteria>
+  <done>The HTML sitemap pages never loop, never shadow CMS pages behind a catch-all unless asked, exist once per locale with i18n, and robots.txt never reads as allow-all while the backend is down.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Journal post meta and path-form pagination routes (L4 WR-02, WR-03)</name>
+  <files>../vue-journal-layer/app/journal-pages/PostPage.vue, ../vue-journal-layer/app/utils/seo.ts, ../vue-journal-layer/app/utils/routes.ts, ../vue-journal-layer/lib/journal-module.ts, ../vue-journal-layer/tests/seo.test.ts, ../vue-journal-layer/tests/routes.test.ts, ../vue-journal-layer/testing/expect-acme.txt, ../vue-journal-layer/README.md</files>
+  <read_first>
+    - ../vue-journal-layer/app/journal-pages/PostPage.vue (fallback and useSeoMeta) and app/utils/seo.ts (postSeoMeta, cmsHeadPresent), tests/seo.test.ts
+    - ../vue-seo-layer/app/utils/seo.ts (seoHeadInput: which head keys the CMS answer sets) to confirm the layer never writes og:type or article:*
+    - ../vue-journal-layer/lib/journal-module.ts (setup, extendPages) and app/utils/routes.ts (journalPagedRoutes), tests/routes.test.ts
+    - ../vue-seo-layer/lib/seo-module.ts (runtime.public.seo.pagination is written in its setup)
+    - ../vue-journal-layer/testing/expect-acme.txt (heading-on and uncategorised-note lines) and testing/fixtures/acme/posts.json (published_at, updated_at)
+    - 33-REVIEW.md lane 4 WR-02, WR-03
+  </read_first>
+  <behavior>
+    - seo.test.ts: journalArticleMeta(post) answers ogType article with the post's published_at and updated_at, and leaves a missing date out
+    - Smoke (expect-acme.txt): /blog/heading-on (a CMS answer) has exactly one og:type, of value article, and an article:published_time; /blog/uncategorised-note (no CMS answer) still has exactly one og:type
+    - routes.test.ts: journalPaginationSource answers runtimeConfig.public.seo.pagination when present and the raw seo.pagination otherwise; journalPagedRoutes of the resolved option for an app that set only form path lists /blog/strona/:page(\d+) and /blog/page/:page(\d+)
+  </behavior>
+  <action>
+    Per L4 WR-02, WR-03, D-40, D-42, D-97 and P33-71, tests first:
+       - (A, WR-02) `journalArticleMeta(post)` in app/utils/seo.ts (prefixed, auto-imported); PostPage always sets `ogType`, `articlePublishedTime` and `articleModifiedTime` from it, and only the CMS-owned keys (title, description, og title, og description, og image) keep the fallback; README SEO section states which head keys the post page always sets. Commit A.
+       - (B, WR-03) `journalPaginationSource(nuxtOptions)` in app/utils/routes.ts (P33-71); journal-module.ts computes the paged routes inside its extendPages callback from it instead of in setup from the raw option; README pagination paragraph says the segments follow vue-seo-layer's resolved option (defaults pl strona, en page). Commit B.
+  </action>
+  <verify>
+    <automated>set -o pipefail; npm --prefix ../vue-journal-layer run test 2>&1 | tail -8</automated>
+    <fails_when>non-zero exit, a "not ok" line or a "# fail" count above 0</fails_when>
+    <automated>set -o pipefail; npm --prefix ../vue-journal-layer run build:playground 2>&1 | tail -2 && npm --prefix ../vue-journal-layer run smoke:ssr 2>&1 | tail -10</automated>
+    <fails_when>non-zero exit, or a "not ok" or "FAIL" line in any of the five expectation runs</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "export function journalArticleMeta" ../vue-journal-layer/app/utils/seo.ts` prints one line
+    - `grep -n 'og:type' ../vue-journal-layer/testing/expect-acme.txt` prints at least two lines
+    - `grep -n "journalPaginationSource" ../vue-journal-layer/lib/journal-module.ts ../vue-journal-layer/app/utils/routes.ts` prints a line in each
+  </acceptance_criteria>
+  <done>Post pages keep their article metadata next to the CMS head, and Polish path-form listing pages have routes.</done>
+</task>
+
+<task type="auto">
+  <name>Task 4: Release guard against link: dependencies, version fields and install pins, upgrade notes and release-note drafts (L4 CR-01, WR-04 docs)</name>
+  <files>../vue-journal-layer/scripts/check-git-install.sh, ../vue-journal-layer/package.json, ../vue-journal-layer/README.md, ../vue-seo-layer/package.json, ../vue-seo-layer/README.md, ../vue-menu-layer/package.json, ../vue-menu-layer/README.md, ../vue-faq-layer/package.json, ../vue-faq-layer/README.md, .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-seo-layer-v0.2.0.md, .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-journal-layer-v0.8.0.md, .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-menu-layer-v0.5.0.md, .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-faq-layer-v0.5.0.md</files>
+  <read_first>
+    - ../vue-journal-layer/scripts/check-git-install.sh (usage, --self-test, the tag mode's scratch install)
+    - the four layers' package.json and README (Install line, "Upgrading from …" sections, Releasing)
+    - the four 33-14-notes-vue-*.md drafts
+    - 33-REVIEW.md lane 4 CR-01 and WR-04; 33-14-PLAN.md Task 4 step 5 (read only: the swap and `check-git-install.sh <tag>` run there)
+  </read_first>
+  <action>
+    Per L4 CR-01, WR-04, D-97 and P33-72:
+       - (A, journal) check-git-install.sh gains `--check-links DIR...` (P33-72, with the usage comment) and runs the same check on the installed layer in the tag mode before building ("the tag's package.json still depends on <name> through <spec>"); `--self-test` adds a planted package.json with a link: dependency (reported, exit 1) and one with a git+https pin (passes), next to the lockfile case. README Releasing: before tagging any content layer, replace the link dependency with the vue-seo-layer tag pin, run `bash scripts/check-git-install.sh --check-links ../vue-seo-layer ../vue-journal-layer ../vue-menu-layer ../vue-faq-layer`, then the tag mode after pushing. Commit A.
+       - (B, each layer) version fields: vue-seo-layer 0.2.0, vue-journal-layer 0.8.0, vue-menu-layer 0.5.0, vue-faq-layer 0.5.0; README install lines pin `#v0.2.0`, `#v0.8.0`, `#v0.5.0`, `#v0.5.0` (and any other pin of these tags in the READMEs). Upgrade notes (WR-04): the journal's "Upgrading from 0.7" and the menu and FAQ "Upgrading from 0.4" sections say that the layer brings vue-seo-layer's HTML sitemap pages (pl /mapa-strony, en /sitemap by default), that an app rendering pages through a root catch-all gets none unless it sets `seo.htmlSitemap.overCatchAll: true`, that an app with an editor page at such a path keeps its page, and that `seo: { htmlSitemap: false }` turns them off; the journal note also states that the post page keeps og:type article and its article times. Leave the link: dependency in place (33-14 Task 4). One commit per layer.
+       - (C, here) Release-note drafts: vue-seo-layer v0.2.0 (the route report sends the noindex static paths; the HTML sitemap pages once per locale with i18n, not over a catch-all unless overCatchAll; the "Fixed" line about root files becomes: robots.txt, sitemap.xml and llms.txt answer 503 with Retry-After while the backend has not answered since the server started, so a crawler retries); vue-journal-layer v0.8.0 (path-form listing routes follow the SEO layer's segments; the catch-all upgrade note); vue-menu-layer and vue-faq-layer v0.5.0 (the catch-all upgrade note). Commit C in summercms.go as planning docs.
+  </action>
+  <verify>
+    <automated>bash ../vue-journal-layer/scripts/check-git-install.sh --self-test</automated>
+    <fails_when>non-zero exit or no "self-test ok" line</fails_when>
+    <automated>out=$(bash ../vue-journal-layer/scripts/check-git-install.sh --check-links ../vue-seo-layer ../vue-journal-layer ../vue-menu-layer ../vue-faq-layer 2>&1); code=$?; printf '%s\n' "$out"; echo "exit=$code"</automated>
+    <fails_when>"exit=0" (the guard missed the link dependencies that stay until 33-14 Task 4), fewer than three lines naming vue-seo-layer through link:, or a line naming ../vue-seo-layer itself (the exit status is captured on purpose: the guard must fail here)</fails_when>
+    <automated>set -o pipefail; for d in seo journal menu faq; do v=$(node -p "require('../vue-$d-layer/package.json').version") && pins=$(grep -oE "vue-$d-layer\.git#v[0-9.]+" "../vue-$d-layer/README.md" | sort -u | tr '\n' ' ') && echo "$d $v $pins" || echo "missing $d"; done</automated>
+    <fails_when>a "missing" line, a version other than seo 0.2.0, journal 0.8.0, menu 0.5.0, faq 0.5.0, or a README pin other than that version's tag</fails_when>
+    <automated>set -o pipefail; bash scripts/check-phase33.sh --self-test --layers 2>&1 | tail -12</automated>
+    <fails_when>non-zero exit, a "FAIL" or "refuse:" line, or a missing "PASS self-test" or "PASS layers" line (this plan never runs the go, plugins, docker or consumers stages; the orchestrator runs --all after both SUMMARYs)</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n -- "--check-links" ../vue-journal-layer/scripts/check-git-install.sh ../vue-journal-layer/README.md` prints a line in each
+    - `grep -n "overCatchAll" ../vue-journal-layer/README.md ../vue-menu-layer/README.md ../vue-faq-layer/README.md` prints a line in each
+    - `grep -n "503" .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-seo-layer-v0.2.0.md` prints a line
+    - each content layer's package.json still holds its `link:../vue-seo-layer` dependency (the swap belongs to 33-14 Task 4)
+  </acceptance_criteria>
+  <done>A layer cannot be tagged with a local dependency unnoticed, the versions and install lines match the release, and the upgrade and release notes describe the new behaviour.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Nuxt server → CMS route report | server-to-server POST with a private token, now also carrying noindex paths |
+| crawler → robots.txt via the layer | a missing robots.txt reads as allow-all |
+| tagged layer → consuming app install | a local link: dependency resolves outside the package |
+| visitor → HTML sitemap pages | request paths drive redirects |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-33-77 | Information disclosure | route report noindex paths | low | accept | the paths are the site's public route names (signed-in pages included) sent server-side to the configured apiBase only, with the token kept in the server-only runtime config; no visitor data |
+| T-33-78 | Tampering (supply chain) | content layers with a link: dependency | medium | mitigate | `--check-links` before tagging and the same check in the tag mode of check-git-install.sh; --self-test in the gate's layers stage (Task 4) |
+| T-33-79 | Information disclosure / integrity | robots.txt while the backend is down | medium | mitigate | 503 with Retry-After for the fixed root files in the unknown state, so a staging site's Disallow is never replaced by an app 404 (Task 2) |
+| T-33-80 | Denial of service | HTML sitemap page-1 redirect | low | mitigate | the redirect uses the locale's segment and never targets the current URL (seoFirstPageRedirect), so no 301 loop (Task 2) |
+| T-33-SC | Tampering | npm/pip/cargo/Go installs | high | mitigate | no npm package is added or upgraded; package.json changes are the version fields only; pnpm-lock.yaml files do not change (the SUMMARY shows `git diff BASE..HEAD -- pnpm-lock.yaml` empty per layer) |
+</threat_model>
+
+<verification>
+- vue-seo-layer: `npm run test`, `build:playground`, `smoke:ssr` (all seven expectation runs, including expect-seo-down.txt), `guard:check`, `purge:check`.
+- vue-journal-layer: `npm run test`, `build:playground`, `smoke:ssr` (five runs), the built route-name check, `check-git-install.sh --self-test` and `--check-links`.
+- vue-menu-layer, vue-faq-layer: `npm run test`, `build:playground`, `smoke:ssr` (through the gate's layers stage).
+- summercms.go: `check-phase33.sh --self-test --layers`. The full `--all` gate is run by the orchestrator once, after both 33-15 and 33-16 SUMMARYs exist and before 33-14 Task 4.
+</verification>
+
+<success_criteria>
+- G1 is closed on the layer side (together with 33-15 on the CMS side).
+- Every in-scope L4 finding has a fix and a test or a gate check.
+- No layer is pushed or tagged and no link: dependency is swapped; 33-14 Task 4 resumes after 33-15 and 33-16, followed by re-verification.
+</success_criteria>
+
+## Deferred (v0.6.2 backlog item, grouped by repository)
+
+- **vue-journal-layer:** L4 WR-06 (`sizes` on cards and the post image do not match the grid); info IN-03, IN-07.
+- **vue-seo-layer:** L4 WR-07 (sitemap group-page breadcrumbs use the default locale's home crumb); info IN-01, IN-02, IN-04, IN-05, IN-06, IN-08, IN-09.
+- **vue-faq-layer:** info IN-07 (host-header origins in FaqBlock).
+- **Go plugins and framework (planned in 33-15, deferred there):** L1 WR-02 code change, WR-04, WR-06, WR-07; L2 WR-06, WR-07, WR-08; L3 WR-02, WR-05; G2; the L1 to L3 info items; verifier warnings W1 to W5.
+
+## Artifacts this phase produces
+
+- vue-seo-layer: `noindexStaticRoutes`, `#seo-routes` export `noindexPaths`, `routeReportBody(paths, noindex)`, route report key `noindex`; `lib/sitemapPages.ts` with `seoSitemapPages`; option `seo.htmlSitemap.overCatchAll`; `seoFirstPageRedirect`; root files 503 in the unknown state; smoke grammar `noindex=` and `lacksnoindex=`; version 0.2.0.
+- vue-journal-layer: `journalArticleMeta`, `journalPaginationSource`; `check-git-install.sh --check-links` and the tag-mode guard; the playground's per-locale HTML sitemap paths; version 0.8.0.
+- vue-menu-layer, vue-faq-layer: version 0.5.0, install pins, upgrade notes.
+- summercms.go: updated 33-14-notes-vue-*.md drafts.
+- Tests: tests/sitemapPages.test.ts; new cases in tests/routes.test.ts, tests/pageHref.test.ts, tests/rootFiles.test.ts (vue-seo-layer) and tests/seo.test.ts, tests/routes.test.ts (vue-journal-layer); smoke lines in expect-seo.txt, expect-seo-down.txt, expect-acme.txt; check-git-install.sh self-test cases.
+
+<output>
+Create `.planning/phases/33-seo-output-audit-and-content/33-16-SUMMARY.md` when done: the commits per layer, the finding-to-test table, the built route names of the journal playground, whether the 33-09 "app without pages" item is gone, the layer-side status of G1 and the 33-09 check-git-install item for deferred-items.md (edited by 33-15), and the `--self-test --layers` gate result.
+</output>

.planning/phases/33-seo-output-audit-and-content/33-16-SUMMARY.md

@@ -0,0 +1,224 @@
+---
+phase: 33-seo-output-audit-and-content
+plan: 16
+subsystem: nuxt-layers
+tags: [seo, nuxt, vue-seo-layer, vue-journal-layer, vue-menu-layer, vue-faq-layer, gap-closure, route-report, html-sitemap, i18n, release-guard]
+status: complete
+
+requires:
+  - phase: 33-07..33-09
+    provides: vue-seo-layer v0.2.0 features (route report, root files, HTML sitemap pages, build guard) and the content layers on it
+  - phase: 33-13
+    provides: the release decision (after-tags) and the 33-14 release checkpoint this plan unblocks
+provides:
+  - "vue-seo-layer: noindexStaticRoutes, #seo-routes noindexPaths, routeReportBody(paths, noindex) with ROUTE_REPORT_MAX_BODY, route report key noindex (gap-2 contract), smoke grammar noindex= / lacksnoindex="
+  - "vue-seo-layer: lib/sitemapPages.ts (seoSitemapPages, isSitemapRoute, sitemapSkipMessage), option seo.htmlSitemap.overCatchAll, seoFirstPageRedirect, SitemapLink route check and i18n locale fallback, root files 503 in the unknown state"
+  - "vue-journal-layer: journalArticleMeta, journalPaginationSource, check-git-install.sh --check-links and the tag-mode guard, the playground's per-locale HTML sitemap paths"
+  - "version fields seo 0.2.0, journal 0.8.0, menu 0.5.0, faq 0.5.0 with README install pins and upgrade notes; the four 33-14-notes-vue-*.md drafts updated"
+affects: [33-14, 33-15]
+
+actuals:
+  tokens: 16400
+  tasks: 4
+  commits: 13
+plan_head_before: 8d562004cb05d8d40d12253c23e406259de61006
+plan_head_after: c2e56ef
+plan_heads:
+  vue-seo-layer: { before: b3a0078, after: 973142a, commits: 5 }
+  vue-journal-layer: { before: e8f307b, after: 761c7fc, commits: 5 }
+  vue-menu-layer: { before: 8b5da67, after: a7602c9, commits: 1 }
+  vue-faq-layer: { before: 7d952fa, after: 5e5950a, commits: 1 }
+  summercms.go: { before: 8d56200, after: c2e56ef, commits: 1 }
+
+tech-stack:
+  added: []
+  patterns:
+    - "Layer routes that must not be localised by @nuxtjs/i18n are added from a pages:resolved hook registered on ready (after every module's modules:done handler), named <name><routesNameSeparator><locale>"
+    - "Report bodies bounded by the older consumer's read limit: drop the optional list from the end first, then the required one"
+    - "Release guard for git-installed layers: package.json local-spec scan (link:, file:, workspace:, portal:) before tagging and on the installed tag"
+
+key-files:
+  created:
+    - ../vue-seo-layer/lib/sitemapPages.ts
+    - ../vue-seo-layer/tests/sitemapPages.test.ts
+  modified:
+    - ../vue-seo-layer/lib/routes.ts
+    - ../vue-seo-layer/lib/seo-module.ts
+    - ../vue-seo-layer/lib/options.ts
+    - ../vue-seo-layer/server/seo-routes.d.ts
+    - ../vue-seo-layer/server/lib/routeReport.ts
+    - ../vue-seo-layer/server/lib/site.ts
+    - ../vue-seo-layer/server/middleware/seo-root.ts
+    - ../vue-seo-layer/server/plugins/seo-route-report.ts
+    - ../vue-seo-layer/app/components/global/SeoHtmlSitemapPage.vue
+    - ../vue-seo-layer/app/components/Seo/SitemapLink.vue
+    - ../vue-seo-layer/app/utils/pageHref.ts
+    - ../vue-seo-layer/.playground/nuxt.config.ts
+    - ../vue-seo-layer/testing/smoke-ssr.mjs
+    - ../vue-seo-layer/testing/expect-seo.txt
+    - ../vue-seo-layer/testing/expect-seo-down.txt
+    - ../vue-seo-layer/tests/routes.test.ts
+    - ../vue-seo-layer/tests/pageHref.test.ts
+    - ../vue-seo-layer/tests/rootFiles.test.ts
+    - ../vue-seo-layer/package.json
+    - ../vue-seo-layer/README.md
+    - ../vue-journal-layer/.playground/nuxt.config.ts
+    - ../vue-journal-layer/app/journal-pages/PostPage.vue
+    - ../vue-journal-layer/app/utils/seo.ts
+    - ../vue-journal-layer/app/utils/routes.ts
+    - ../vue-journal-layer/lib/journal-module.ts
+    - ../vue-journal-layer/tests/seo.test.ts
+    - ../vue-journal-layer/tests/routes.test.ts
+    - ../vue-journal-layer/testing/expect-acme.txt
+    - ../vue-journal-layer/scripts/check-git-install.sh
+    - ../vue-journal-layer/package.json
+    - ../vue-journal-layer/README.md
+    - ../vue-menu-layer/package.json
+    - ../vue-menu-layer/README.md
+    - ../vue-faq-layer/package.json
+    - ../vue-faq-layer/README.md
+    - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-seo-layer-v0.2.0.md
+    - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-journal-layer-v0.8.0.md
+    - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-menu-layer-v0.5.0.md
+    - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-faq-layer-v0.5.0.md
+
+key-decisions:
+  - "The HTML sitemap pages are added from a pages:resolved hook registered on ready, not in modules:done: vue-seo-layer's module is set up before @nuxtjs/i18n, so a hook added from its modules:done handler ran before i18n's and i18n localised the layer's routes again (seo-sitemap-en___en___pl)"
+  - "routeReportBody drops every noindex entry before it cuts routes (gap-2 contract point 6): when routes alone exceed 4,113,024 bytes, noindex is [] even if a short entry would fit in the slack"
+  - "An app with only app.vue no longer needs seo.htmlSitemap: false: without the pages module no pages:resolved runs, so no sitemap route is added and the router stays off; such an app has no HTML sitemap pages"
+  - "check-git-install --check-links prints `check-git-install: <dir>: depends on <name> through <spec> (<section>)`, one wording for both modes"
+
+requirements-completed: [SC-1, SC-2, D-08, D-22, D-23, D-24, D-33, D-34, D-40, D-42, D-97]
+
+metrics:
+  duration: "19 min (2026-11-04T21:38:00Z to 21:57:35Z by the session clock)"
+  completed: 2026-11-04
+---
+
+# Phase 33 Plan 16: Nuxt layers gap closure Summary
+
+The Nuxt layers now send the noindex static paths in the route report, inside the older plugin's body limit. The HTML sitemap pages exist once per locale with @nuxtjs/i18n, are never put over a catch-all unless `overCatchAll` is set, and page 1 never redirects to itself. robots.txt, sitemap.xml and llms.txt answer 503 while the backend is unknown. Journal post pages keep og:type article, and the journal registers its path-form routes from the SEO module's resolved pagination. A `--check-links` guard blocks tags with `link:` dependencies, and the versions and pins match the release.
+
+## Commits
+
+| Repo | Commit | Subject |
+|------|--------|---------|
+| vue-seo-layer | 7a26692 | feat: the route report sends the noindex static paths (tracer) |
+| vue-seo-layer | 7588aa5 | fix: HTML sitemap page 1 redirects with the locale's segment |
+| vue-seo-layer | a651de4 | fix: HTML sitemap pages once per locale, never over a catch-all by default |
+| vue-seo-layer | 8cdf359 | fix: root files answer 503 while the backend has not answered |
+| vue-seo-layer | 973142a | chore: version 0.2.0 and install pin |
+| vue-journal-layer | 1e05efc | test: the playground's HTML sitemap paths per locale |
+| vue-journal-layer | 839db51 | fix: post pages keep og:type article and their article times |
+| vue-journal-layer | d64fe47 | fix: path-form listing routes use the SEO module's resolved pagination |
+| vue-journal-layer | d4ba3e2 | feat: check-git-install --check-links refuses local dependencies |
+| vue-journal-layer | 761c7fc | chore: version 0.8.0 and install pin |
+| vue-menu-layer | a7602c9 | chore: version 0.5.0 and install pin |
+| vue-faq-layer | 5e5950a | chore: version 0.5.0 and install pin |
+| summercms.go | c2e56ef | docs(33-16): release-note drafts for the layer fixes |
+
+All on each repo's default branch (layers `main`, summercms.go `master`). Nothing was pushed or tagged, and no `link:../vue-seo-layer` dependency was swapped. `git diff <base>..HEAD -- pnpm-lock.yaml` is empty in all four layers, and package.json changed only in its `version` field.
+
+## Finding to test
+
+| Finding | Fix | Proving test |
+|---------|-----|--------------|
+| G1 layer side (D-23, D-24, D-33) | `noindexStaticRoutes`, `#seo-routes` `noindexPaths`, `routeReportBody(paths, noindex)` with `ROUTE_REPORT_MAX_BODY` = 4,113,024 | tests/routes.test.ts: `noindexStaticRoutes: the static paths the build serves noindex`, `…client-only noindex pages kept, patterns never sent`, `…the i18n copies of a noindex page`, `routeReportBody: within the plugin limits, both lists`, `…the JSON body stays within the older plugin limit, noindex dropped first`, `…routes alone over the limit are cut from the end`; smoke expect-seo.txt `routereport 1 … noindex=/konto noindex=/szkic noindex=/prywatne lacksnoindex=/ lacksnoindex=/mapa-strony` |
+| L4 WR-01 page-1 self-redirect | `seoFirstPageRedirect`, locale segment in SeoHtmlSitemapPage | tests/pageHref.test.ts: `seoFirstPageRedirect: page 1 goes to the unnumbered URL with the locale segment`, `…never a redirect to the URL itself`; smoke `301 /mapa-strony/posts?page=1` still passes |
+| L4 WR-04 sitemap pages over a catch-all | `seoSitemapPages` catch-all rule, `htmlSitemap.overCatchAll`, build log line | tests/sitemapPages.test.ts: `a root catch-all skips every locale unless overCatchAll`, `a prefixed catch-all skips only the paths it covers`, `an app page at the path keeps it (taken)`; smoke expect-seo.txt /mapa-strony lines pass with the playground's `overCatchAll: true` |
+| L4 WR-05 i18n cross-locale copies | pages added after i18n, names `<name>___<locale>`; SitemapLink route check | tests/sitemapPages.test.ts `with i18n each route is named for its own locale, once`; built journal playground route names (below); smoke footer link line |
+| L4 WR-08 root files while unknown | `rootFileTargets` targets the fixed names in state unknown | tests/rootFiles.test.ts `a backend never reached since start (unknown) still owns the fixed root files` and `an older backend (absent) passes every path through`; expect-seo-down.txt `503 /robots.txt`, `503 /sitemap.xml`, `503 /llms.txt` with `Retry-After: 60`; expect.txt (`--no-site`) keeps `404 /robots.txt` |
+| L4 WR-02 post og:type and article times | `journalArticleMeta`, always set in PostPage | tests/seo.test.ts `journalArticleMeta: og:type article and the post times`; expect-acme.txt `/blog/heading-on count=property="og:type":1 …article:published_time…` (failed before the fix) and `/blog/uncategorised-note` |
+| L4 WR-03 journal path-form routes | `journalPaginationSource`, computed in the extendPages callback | tests/routes.test.ts `journalPaginationSource: the SEO module's resolved option, else the raw seo.pagination` and `an app that set only form path gets the default pl and en segments`; a probe build with only `pagination: { form: 'path' }` had `/blog/strona/:page(\d+)`, `/blog/page/:page(\d+)` and the `/pl/` copies |
+| L4 CR-01 link: dependency, versions, pins | `check-git-install.sh --check-links`, tag-mode guard, version fields and install pins | `check-git-install.sh --self-test` (planted link:, git+https, file:/workspace:/portal:, missing and mixed cases); `--check-links ../vue-seo-layer ../vue-journal-layer ../vue-menu-layer ../vue-faq-layer` exits 1 with the three link: lines and none for vue-seo-layer; version/pin loop prints seo 0.2.0 #v0.2.0, journal 0.8.0 #v0.8.0, menu 0.5.0 #v0.5.0, faq 0.5.0 #v0.5.0 |
+
+Prohibitions: the route report stays compatible both ways. The fixture API ignores `noindex`, and the smoke with the routereport line passes. `--no-site` (404, not retried) passes in expect.txt. The guard and the noindex headers are unchanged: guard:check passes (16 checks), and the expect-seo.txt `/konto`, `/szkic`, `/prywatne` noindex lines pass.
+
+## Journal playground route names (WR-05 evidence)
+
+`grep -rhoE '"seo-sitemap-[a-z-]+(___[a-z]+)*"' .playground/.output/server | sort -u` after the fix:
+
+```
+"seo-sitemap-en___en"        /sitemap
+"seo-sitemap-group-en___en"  /sitemap/:group
+"seo-sitemap-group-pl___pl"  /pl/mapa-strony/:group
+"seo-sitemap-pl___pl"        /pl/mapa-strony
+```
+
+Before the fix the build held seo-sitemap-en___pl and seo-sitemap-pl___en. With the first `modules:done` attempt it held `___en___en` / `___en___pl` doubles (see deviation 1).
+
+## The 33-09 "app without pages" item
+
+It is gone. I built the menu playground (only `app.vue`) once without `seo: { htmlSitemap: false }`: it registered no `seo-sitemap-` route and its smoke passed (17 checks). The config was restored afterwards, and both the menu and FAQ playgrounds keep `htmlSitemap: false` as the plan asked. The vue-seo-layer README and the menu and FAQ upgrade notes now say that such an app gets no sitemap pages and needs no setting.
+
+## Status for deferred-items.md (owned by 33-15, not edited here)
+
+- **G1, layer side:** closed. Each server start sends `noindex` with the static paths the build serves noindex, including the i18n copies, under the gap-2 contract. The CMS side (the filter and the stored set) belongs to 33-15.
+- **33-09 check-git-install item (no guard against link:):** closed on the script side. `--check-links` and the tag-mode check are in vue-journal-layer d4ba3e2, and `--self-test` covers them. The swap itself is still open and belongs to 33-14 Task 4.
+- **33-09 "app without pages":** closed (see above).
+
+## For 33-14 Task 4
+
+- **Link swap:** not done. `link:../vue-seo-layer` is still in vue-journal-layer, vue-menu-layer and vue-faq-layer. Step order (also in the journal README, Releasing): tag vue-seo-layer v0.2.0, then in each content layer replace the link with `git+https://git.golem15.com/golem15/vue-seo-layer.git#v0.2.0` and run `pnpm install`. Then run `bash ../vue-journal-layer/scripts/check-git-install.sh --check-links ../vue-seo-layer ../vue-journal-layer ../vue-menu-layer ../vue-faq-layer`, which must exit 0, then tag and push.
+- **check-git-install `<tag>`:** now also fails when the installed tag's package.json has a local dependency, before building. Its `--self-test` is part of the gate's layers stage.
+- **Versions:** already bumped (seo 0.2.0, journal 0.8.0, menu 0.5.0, faq 0.5.0), so Task 4 does not bump them again.
+- **Release notes:** the four 33-14-notes-vue-*.md drafts changed (c2e56ef):
+  - seo: the route report's noindex list, the sitemap pages per locale and not over a catch-all, `overCatchAll`, the upgrade line, and the Fixed line about the root-file 503s;
+  - journal: path-form listing routes, plus an upgrade line on the catch-all and the article meta;
+  - menu and FAQ: the catch-all upgrade note replaces the `htmlSitemap: false` advice.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] The sitemap page hook is registered on `ready`, not in `modules:done`**
+- **Found during:** Task 2 B (journal playground build).
+- **Issue:** vue-seo-layer's module is set up before @nuxtjs/i18n, so its `modules:done` handler runs first. A `pages:resolved` hook added there ran before the one i18n adds in its own `modules:done`. i18n then localised the layer's routes again (`seo-sitemap-en___en___pl`), which is the WR-05 bug once more.
+- **Fix:** the hook is added from `ready`, which Nuxt calls after every `modules:done` handler and before the build resolves the pages. The plan's acceptance grep `grep -n "modules:done" lib/seo-module.ts` now matches two comment lines that explain the choice, not the hook.
+- **Files:** ../vue-seo-layer/lib/seo-module.ts. **Commit:** a651de4.
+
+**2. [Rule 1 - Bug] routeReportBody: routes too large means noindex is empty**
+- **Found during:** Task 1 (the unit test for routes alone over the limit).
+- **Issue:** my first version cut routes to fit and then filled the slack with noindex entries. That breaks contract point 6, which drops noindex first.
+- **Fix:** when routes alone exceed the limit, noindex is `[]`. **Commit:** 7a26692.
+
+**3. [Rule 1 - Docs] README notes that were wrong after the fix**
+- The vue-seo-layer README `htmlSitemap` row and the menu and FAQ "Upgrading from 0.4" bullets said that an app with only `app.vue` must set `htmlSitemap: false`. They now describe the new behaviour.
+- The journal README "Fallback meta" bullet no longer lists the article times, which are now always set.
+- **Commits:** a651de4, 839db51, a7602c9, 5e5950a.
+
+**4. Minor wording/placement choices**
+- **`--check-links` line:** it reads `check-git-install: <dir>: depends on <name> through <spec> (<section>)` instead of `<dir>: <name> depends on <spec>`, one wording for both modes.
+- **SeoHtmlSitemapPage form:** the redirect form comes from the route (path when `:page` is set, else query) instead of from the site answer. A path-form route under a query-form site answer would otherwise self-redirect too.
+- **Journal "Upgrading from 0.7":** besides the catch-all and og:type notes, it also mentions the path-form segments.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None. No new endpoint or auth path. The route report carries one more list on the existing request, as recorded in T-33-77.
+
+## Gate
+
+`bash scripts/check-phase33.sh --self-test --layers` from summercms.go, exit 0. Log: /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/gate-33-16.log
+
+- `PASS self-test` (45 checks, `phase33 self-test passed`)
+- `PASS layers` (`phase33 layers passed`):
+  - unit tests: vue-seo-layer 152/152, vue-journal-layer 202/202, vue-menu-layer 24/24, vue-faq-layer 19/19 (tap, `# fail 0`);
+  - the four playground builds;
+  - vue-seo-layer `smoke:ssr` (7 runs), `guard:check`, `purge:check`;
+  - the five journal smoke runs, its purge-check and purge-token-check, and `check-git-install: self-test ok`;
+  - the menu and FAQ `smoke:ssr`.
+
+The go, plugins, docker and consumers stages were not run. The orchestrator runs `--all` after both SUMMARYs exist.
+
+Task verifies run separately along the way:
+- vue-seo-layer: `smoke:ssr` all seven runs ok (expect-seo.txt 64 checks, expect-seo-down.txt 9), guard:check 16, purge:check 18, purge-token-check 53.
+- vue-journal-layer: `smoke:ssr` five runs ok (expect-acme.txt 89 checks), plus the built route-name check above.
+- `--check-links` over the four layers: exit 1 with three link: lines (journal, menu, FAQ), as required until 33-14 Task 4.
+
+## Self-Check: PASSED
+
+Both created files exist; all 13 commits exist in their repos; the plan's acceptance greps match (noindexStaticRoutes, ROUTE_REPORT_MAX_BODY in code and tests, noindexPaths in plugin and types, the README contract JSON, `^503 /robots.txt`, seoFirstPageRedirect, overCatchAll in README and playground, og:type lines in expect-acme.txt, --check-links in script and README); the `modules:done` grep matches comments only (deviation 1).

.planning/phases/33-seo-output-audit-and-content/33-REVIEW-GAPFIX.md

@@ -0,0 +1,197 @@
+---
+phase: 33-seo-output-audit-and-content
+scope: gap-closure re-review (33-15, 33-16)
+reviewed: 2026-11-04T23:30:00Z
+depth: deep (targeted)
+files_reviewed: 52
+files_reviewed_list:
+  - sm-sitemap-plugin (1048c01..HEAD): contract/contract.go, plugin.go, classes/rebuild.go, classes/lastmod.go, classes/listing.go, models/legacy.go, models/url.go, extensions_settings.go, updates/202610280002_update_golem15_sitemap_settings.go, updates/202611040001_add_golem15_sitemap_urls_indexnow_pending.go
+  - sm-seo-plugin (075cf17..HEAD): classes/crawl/job.go, classes/crawl/store.go, classes/crawl/actions.go, classes/crawl/crawler.go, classes/crawl/fetch.go, classes/crawl/render.go, classes/crawl/render_chrome.go, classes/crawl/compare.go, classes/crawl/checks.go, classes/crawl/fix.go, classes/linkgraph.go, classes/registry.go, classes/sitemap_filter.go, controllers/api/registry.go, controllers/api/crawls.go, controllers/crawls.go, models/crawl.go, models/noindex_path.go, jobs.go, mcp.go, updates/202611040001_create_golem15_seo_noindex_paths.go, updates/202611040002_add_golem15_seo_crawls_heartbeat.go
+  - sm-journal-plugin (311c28a..HEAD): classes/headings.go, classes/image_alt.go, classes/image_variants.go, classes/content_descriptors.go, classes/menu_item_types.go, console/fix_headings.go, controllers/api/maintenance.go, mcp.go
+  - vue-seo-layer (b3a0078..HEAD): lib/seo-module.ts, lib/sitemapPages.ts, lib/routes.ts, lib/options.ts, server/lib/routeReport.ts, server/lib/site.ts, server/middleware/seo-root.ts, server/plugins/seo-route-report.ts, server/seo-routes.d.ts, app/components/Seo/SitemapLink.vue, app/components/global/SeoHtmlSitemapPage.vue, app/utils/pageHref.ts, package.json
+  - vue-journal-layer (e8f307b..HEAD): app/journal-pages/PostPage.vue, app/utils/seo.ts, app/utils/routes.ts, lib/journal-module.ts, scripts/check-git-install.sh, package.json
+  - vue-menu-layer (a7602c9), vue-faq-layer (5e5950a): package.json, README.md
+findings:
+  critical: 0
+  warning: 4
+  info: 0
+  total: 4
+status: issues_found
+---
+
+# Phase 33 gap-closure re-review (33-15, 33-16)
+
+Paths are relative to `/media/nvme/dev/golem15/summercms.io/summercms/`.
+
+## Summary
+
+Most fixes do what their findings asked. Three are only partly done:
+
+- **L1 CR-02.** A markdown body that starts with `<` is still rewritten by the tokenizer. I confirmed this by running the code.
+- **L1 WR-05.** Bodies stored as content_html only now get a 422 where they used to succeed (a regression), and the `<`-prefixed markdown subset still goes down the HTML path.
+- **L4 CR-01.** The guard, the version fields and the install pins are done. The `link:` swap was deliberately left to 33-14 Task 4, so the layers still cannot be tagged from HEAD.
+
+I found no critical defects in the new code. There are four new warnings (below).
+
+Things I checked that hold up:
+- **Advisory lock.** It does not deadlock. The pool is unbounded (lagoon sets no `MaxOpenConns`), the lock order is the same on every path (advisory lock, then the settings row), and the lock wait is bounded by the job context (conga's default 300 s).
+- **Crawl heartbeat.** The heartbeat goroutine stops cleanly (closed channel, then wait), and it keeps writing during `finish` because `stop` is deferred after it.
+- **River rescuer.** It honours the worker's 6 h timeout, so it does not rescue a crawl that is still running.
+- **Cancel.** `Cancel` keeps the guard: the row stays `running` until the job ends it, and `ActiveCrawl`, `DeleteCrawls` and `Prune` all see it as active.
+- **Migrations.** The new migrations only add a table or nullable columns and have rollbacks. `202610280002` keeps its ID, and no production database has run it (33-13 deployed nothing; the rehearsal databases are to be recreated, as the 33-15 SUMMARY says).
+- **Gap-2 contract.** Both directions work. When `noindex` is absent (or `null`), the stored set stays unchanged. The layer keeps the body at or under 4,113,024 bytes and drops `noindex` entries first. The new plugin accepts twice that.
+- **Concurrent route reports.** Two at once end up with the union of both sets (`ON CONFLICT DO NOTHING`), not with an error.
+- **noindex input.** It is validated:
+  - same bearer token, compared in constant time;
+  - at most 2000 entries, checked before the transaction (422 and nothing stored);
+  - each entry passes `ValidPagePath` and the 2048-byte cap;
+  - patterns (`*`, `:param`) are refused;
+  - the body is capped with `MaxBytesReader`.
+- **i18n hook.** Registering `pages:resolved` from `ready` puts it after i18n's `modules:done` hook, and the function strips its own routes again on dev regenerations.
+- **sm-journal-plugin compatibility.** Exported signatures are unchanged. The behaviour changes (descriptor URL `""` for locales without content, the 422 for markdown images the tool cannot reach) are deliberate and in the v0.4.0 notes.
+
+## Verdicts
+
+| Finding | Verdict | Evidence |
+|---|---|---|
+| L1 CR-01 tall original | Resolved | `sm-journal-plugin/classes/image_variants.go:195-202` skips a width whose height is over 4096 and continues. `MaxImageWidth` (4096) equals `attach` `maxThumbEdge` (`summercms.go/modules/lagoon/attach/thumb.go:29`) only by coincidence. Other `ThumbKey` errors still abort the batch (`:203-206`); that was outside the plan |
+| L1 CR-02 H1 rewrite of markdown | **Partially resolved** | `classes/headings.go:79-82` skips `content` only when `!LooksLikeHTML(content)`, and `LooksLikeHTML` only checks for a leading `<` (`classes/blog_editor.go:129-132`). The API always renders `content` as markdown (`controllers/api/posts_helpers.go:537,593`), so a markdown body that starts with an HTML block still has `<h1>` rewritten inside its code fences. See new WR-01 |
+| L1 WR-01 fix-headings CLI | Resolved | `console/fix_headings.go:51-55` uses `lookupDB` |
+| L1 WR-03 tokenizer tail | Resolved | `classes/headings.go:26-36`, `classes/image_alt.go:31-40` write `html[consumed:]` on `ErrorToken`; `Raw()` slices are contiguous, so the offset is exact |
+| L1 WR-05 alt on markdown | **Partially resolved** | `controllers/api/maintenance.go:172-188`: an inline `![..](src)` image or a raw img outside code is written into the markdown. But a body with empty `content` (a content_html-only translation) now always gets a 422, and markdown that starts with `<` goes down the HTML branch. See new WR-02 |
+| L2 WR-01 IndexNow deletes/edits | Resolved | `classes/lastmod.go:135,158-162` set `indexnow_pending_at`; `classes/rebuild.go:516-524,539-546` add the row to Changed/Removed; `:631-637` clear only marks that are not newer than the value read |
+| L2 WR-02 concurrent rebuilds | Resolved | `classes/rebuild.go:144-170`: `pg_advisory_xact_lock` is taken before the settings, type settings and `collect` |
+| L2 WR-03 lastmod revert | Resolved | `classes/rebuild.go:621-626`: `lastmod` is written only for `ExtraTypeKey` rows |
+| L2 WR-04 migration drops items | Resolved (as scoped in P33-66) | `models/legacy.go:202-278` and the migration at `updates/202610280002_…go:84-92`: leading slash added, spaces and unsafe bytes encoded, items parsed one by one, one warn log per dropped item. Absolute URLs with `&` are still dropped, but now logged |
+| L2 WR-05 pinned headings | Resolved | `extensions_settings.go:128-135` loads stored titles only; `pickTitle` ignores empty strings (`classes/htmlgroups.go:193-201`) |
+| L2 IN-01 nil event | Resolved | `classes/lastmod.go:114-116` |
+| L3 CR-01 cancel/timeout loses results | Resolved (one gap, new WR-03) | `classes/crawl/job.go:222-228`: detached `FinishTimeout` context; `:342-356` maps a deadline to failed; `:365-368` falls back to default limits; `crawler.go:250-253` marks cut-short fetches "canceled"; `store.go:199-239` adds `RecoverStale`. The terminal write shares the store's deadline (WR-03) |
+| L3 WR-01 cancel clears guard | Resolved | `job.go:541-556` sets `cancel_requested_at` and leaves the status `running`; `finish` writes `cancelled`; `controllers/crawls.go:84` hides the action while cancelling |
+| L3 WR-03 any port | Resolved | `fetch.go:150-152` (`Allowed`), `render.go:184` (`allowRequest`), `compare.go:29-33` uses `Fetcher.Key` |
+| L3 WR-04 two path forms | Resolved | `classes/linkgraph.go:261-287` (`PathKey`, `EscapeKeyPath`), `fetch.go:176-196`, `sitePath` handles both inputs. Residual edge case: `%2F` decodes to `/` |
+| L3 WR-06 tab-open timeout | Resolved | `render_chrome.go:126-160`: one deadline (`TabOpenTimeout+RenderTimeout`), a 5 s open timer, the tab closed on timeout; the result channel is buffered, so the goroutine does not leak |
+| G1 CMS side | Resolved | `classes/registry.go:821-925` (`ReportNoindex`, `Rebuilder` called after commit), `classes/sitemap_filter.go:174-176`, `controllers/api/registry.go:19-29,78-97`, `crawl/checks.go:338-354` (sitemap tool for extras) |
+| G3 descriptors per locale | Resolved | `classes/content_descriptors.go:177-182,497-500,664`, `classes/menu_item_types.go:1046,1108-1228`; the sitemap skips `URL ""` (`sm-sitemap-plugin/classes/rebuild.go:250-252`), so older rows for those locales drop out as holes |
+| L4 CR-01 link: dependency | **Partially resolved (deferred by plan)** | `check-git-install.sh --check-links` and the tag-mode guard are in place, versions are 0.2.0/0.8.0/0.5.0/0.5.0 and the README pins match. All three content layers still have `"vue-seo-layer": "link:../vue-seo-layer"` (checked with `package.json` grep). Do not tag before the 33-14 Task 4 swap |
+| L4 WR-01 page-1 self-redirect | Resolved | `app/utils/pageHref.ts:38-41` (`target === fullPath` gives `null`), `SeoHtmlSitemapPage.vue:71-83`. Note: the CMS segment wins over the segment the route was registered with; if they differ, the page is served without a redirect (no loop) |
+| L4 WR-02 og:type article | Resolved | `vue-journal-layer/app/journal-pages/PostPage.vue:56-68`, `app/utils/seo.ts:78-83` |
+| L4 WR-03 path-form segments | Resolved | `vue-journal-layer/lib/journal-module.ts:58-64`, `app/utils/routes.ts:101-107` read `runtimeConfig.public.seo.pagination`, which the SEO module's `setup` writes (`vue-seo-layer/lib/seo-module.ts:206-221`) |
+| L4 WR-04 catch-all shadowing | Resolved | `lib/sitemapPages.ts:362-373`; the `overCatchAll` opt-in is documented in all four READMEs |
+| L4 WR-05 i18n copies | Resolved | `lib/seo-module.ts:259-269` (`ready`, then `pages:resolved`), `lib/sitemapPages.ts:348-381` (`<name><sep><locale>`), `SitemapLink.vue:39-46` checks the route |
+| L4 WR-08 root files while unknown | Resolved for the reported case (new WR-04) | `server/lib/site.ts:96-99`: FIXED names are proxied in state `unknown`; a failing fetch gives 503. Side effect in WR-04 |
+| G1 layer side | Resolved | `lib/routes.ts:161-171`, `lib/seo-module.ts:283-287`, `server/lib/routeReport.ts:428-478` (bounded body, `noindex` dropped first, `[]` always sent) |
+
+Counts: 26 verdict rows. 19 resolved (L3 CR-01 and L4 WR-08 each with a new warning attached), 3 partially resolved (L1 CR-02, L1 WR-05, L4 CR-01), 0 not resolved.
+
+## Narrative Findings (AI reviewer)
+
+## Warnings
+
+### WR-01: Markdown that starts with `<` still gets `<h1>` rewritten inside code samples (CR-02 residual)
+
+**File:** `sm-journal-plugin/classes/headings.go:79-87` (with `classes/blog_editor.go:129-132`, `controllers/api/posts_helpers.go:537,593`, and the call sites in `posts_helpers.go:865`, `console/import_posts.go`, `classes/heading_fix.go`)
+
+**Issue:** `ConvertContentH1` treats `content` as HTML whenever its first non-space byte is `<`. The API, however, always renders `content` as markdown (`FormatHTML`), so a markdown post that opens with an HTML block (`<p class="lead">…</p>`, `<img …>`, `<!-- … -->`, an autolink `<https://…>`) is still run through the `x/net/html` tokenizer. Every `<h1>` token in its fenced or inline code samples becomes `<h2>`, silently and with the default-on setting, on every API or MCP save, on import and on `journal:fix-headings --apply`. It is worse than before: the count now comes from `content`, so the corruption is counted as a conversion. This is the same defect class as CR-02, with a narrower trigger.
+
+**Evidence:** I ran the shipped `headings.go` (copied into the scratchpad, `GOWORK=off go run`):
+```
+in : "<p class=\"lead\">Intro</p>\n\nExample:\n\n```html\n<h1>Hello</h1>\n```\n"
+out: "<p class=\"lead\">Intro</p>\n\nExample:\n\n```html\n<h2>Hello</h2>\n```\n"   n=1, content_html unchanged
+```
+
+**Fix:** Decide by the render path, not by the first byte. Where the body is rendered as markdown (the API, import, fix-headings of an API post), rewrite only outside goldmark's code ranges. The helper for that already exists (`markdownCodeRanges` in `classes/image_alt.go`):
+```go
+func ConvertContentH1(content, contentHTML string) (string, string, int) {
+    contentHTML, nHTML := ConvertH1(contentHTML)
+    var nContent int
+    content, nContent = convertH1OutsideCode(content) // split on markdownCodeRanges(content), ConvertH1 on the parts
+    if nHTML == 0 { nHTML = nContent }
+    return content, contentHTML, nHTML
+}
+```
+For a real HTML body, `markdownCodeRanges` finds no fences, so the result is the same as today. Add a regression case with a leading `<p>` to `headings_test.go`.
+
+### WR-02: `images/alt` now refuses images in bodies stored as content_html only (regression), and misses markdown that starts with `<`
+
+**File:** `sm-journal-plugin/controllers/api/maintenance.go:172-188` (with `loadImageAltText` at `:263-282`)
+
+**Issue:** The markdown branch runs whenever `!LooksLikeHTML(text.content)`, and that includes `content == ""`. A translation that carries only `content_html` is a supported shape:
+- `classes/format_html.go:101-102`;
+- `classes/blog_editor.go:292`;
+- `controllers/api/posts_helpers.go:802-804`.
+
+For such a body, `SetMarkdownImageAlt("")` and `SetImageAltOutsideCode("")` both return 0, so every change for it is refused with 422 `changes.N.src` ("The image is not an inline image of the post's markdown"). The batch is all or nothing, so one such image fails the whole MCP `set_image_alt` call. Before this change it succeeded and stuck, because no markdown re-derives that `content_html`.
+
+Markdown that starts with `<` takes the HTML branch instead. There, `SetImageAlt` finds no raw `<img>` for a `![..](src)` image, so `m == 0`, yet the change is answered `changed: true` and is reverted on the next save (the original WR-05). A raw `<img>` shown inside a code fence is also rewritten.
+
+**Fix:** Treat an empty `content` as "content_html is the body", and route markdown by the same rule as WR-01:
+```go
+switch {
+case strings.TrimSpace(text.content) == "":
+    // content_html-only body: nothing to keep in sync
+case classes.LooksLikeHTML(text.content) && !hasMarkdownImage(text.content, c.src):
+    if content, m, _ := classes.SetImageAlt(text.content, c.src, c.alt); m > 0 { text.content = content }
+default:
+    content, m, _ := classes.SetMarkdownImageAlt(text.content, c.src, c.alt)
+    content, r, _ := classes.SetImageAltOutsideCode(content, c.src, c.alt)
+    if m+r == 0 { /* 422 */ }
+    text.content = content
+}
+```
+Add a test with a translation that has only `content_html`.
+
+### WR-03: The crawl's terminal status write shares the store's 10-minute deadline
+
+**File:** `sm-seo-plugin/classes/crawl/job.go:225-228, 383-397`
+
+**Issue:** `finish` runs the store transaction and then the terminal `UPDATE … status/finished_at` on the same `fctx` (`FinishTimeout` = 10 min). A large crawl can run out that budget inside `SavePages`/`SaveIssues`: up to 50 000 pages and 1000 links per page in one transaction (L3 WR-02 left it unbounded). The store then fails with `context deadline exceeded`, and the terminal update fails on the same expired context, so `finish` returns at `:397`. Three things follow:
+- the row stays `running`, and the real error is lost;
+- the conga record is not ended by `finish`;
+- the guard blocks new crawls until `RecoverStale` runs another 10 minutes later (heartbeat plus `StaleAfter`) and records a misleading "no heartbeat since …" error.
+
+**Fix:** Give the final state its own fresh, short bound, separate from the store's:
+```go
+if err := lagoon.Transaction(ctx, db, store); err != nil { status, errText = models.CrawlFailed, err.Error() }
+wctx, wcancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
+defer wcancel()
+wdb := db.WithContext(wctx)
+if err := wdb.Model(&models.Crawl{}).Where("id = ?", row.ID).Updates(updates).Error; err != nil { return err }
+// FailJob/StopJob/CompleteJob and Prune on wctx too
+```
+Add a test with a store that blocks past a small `FinishTimeout`, which checks for `failed` with the store error.
+
+### WR-04: The root-file 503 also catches sites whose backend has no SEO plugin, after any outage longer than the cache TTL
+
+**File:** `vue-seo-layer/server/lib/site.ts:47-63, 96-99`
+
+**Issue:** `lastOk` remembers only an `ok` answer. An `absent` answer (a backend without SEO v0.2.0, for which the layer promises v0.1.1 behaviour) is cached for 5 minutes only. Once it expires, any moment the backend is unreachable or answers something other than 200 or 404 is `unknown` with `lastOk == null`. The new branch then proxies `/robots.txt`, `/sitemap.xml` and `/llms.txt` to a backend that never served them:
+- if the fetch fails or answers 5xx, the layer serves 503;
+- if the backend answers 404, the layer passes that 404 on.
+
+Before 33-16 these requests reached the app. That covers robots.txt or sitemaps produced by a Nuxt server route or module (`@nuxtjs/robots`, `@nuxtjs/sitemap`), or the app's own 404. Files in Nuxt's `public/` are still served first by Nitro's static handler.
+
+A 5xx robots.txt is read by Google as a site-wide disallow for up to about 12 hours. So on an SEO-less site, every short backend outage now stops crawling of the whole site. The same happens to a backend whose `/site` answers 200 with HTML (a catch-all) or 401/403 from an auth gateway: it is `unknown` for good, and its root files get hijacked.
+
+**Fix:** Remember the last definite answer, not only `ok`, and narrow `unknown` to "never answered":
+```ts
+let lastKnown: SeoSiteState | null = null
+...
+if (got.state !== 'unknown') lastKnown = got
+if (got.state === 'unknown' && lastKnown) return lastKnown
+```
+`rootFileTargets` then returns null for a remembered `absent`. Add a `rootFiles.test.ts` case: absent, then unknown, should still pass through.
+
+## Notes below the warning bar (not counted)
+
+- **Shutdown during a crawl.** A graceful worker shutdown (`conga.Worker.Stop` falls back to `StopAndCancel` with 5 s, `summercms.go/modules/conga/worker.go:219-226`) cancels the job context. `finalStatus` maps that to `cancelled` with no actor (`job.go:345-346`), so a deploy during a nightly crawl can leave a partial "cancelled" crawl as the current audit. The `Canceled → cancelled` mapping also covers `Cancel` calling `CancelJob` before its own transaction commits (`job.go:557-562`). Moving `CancelJob` to `AfterCommit` would allow a separate "interrupted" status.
+- **DeleteCrawls stale rows.** `DeleteCrawls` calls `RecoverStale` but not `endStaleJobs` (`actions.go:81-83`), so the conga records of those crawls are never ended.
+- **Open transaction during collect.** `Rebuild` keeps its transaction open (idle) for all of `collect` (`rebuild.go:144-170`). A database with `idle_in_transaction_session_timeout` set would kill long rebuilds.
+- **Parameter limit.** `postContentLocales` passes every published post id of a page of tags or authors as one `IN ?` list (`menu_item_types.go:1150-1162`, `786-805`). Past about 65k posts, Postgres's parameter limit fails the descriptor call and with it the rebuild.
+- **Repeat IndexNow pings.** `RecordSaved` marks rows that are already excluded (an unpublished record's old rows), and `apply` then sends them as removed again on every edit (`rebuild.go:539-545`).
+- **Version pin.** sm-seo-plugin's go.mod still requires sm-sitemap-plugin v0.1.2, which has no `contract` package (`GOWORK=off go build` fails). The v0.2.0 pin is a 33-14 step, as the SUMMARY records.
+
+---
+
+_Reviewed: 2026-11-04_
+_Reviewer: Claude (msd-code-reviewer)_
+_Depth: deep (targeted re-review of the 33-15 and 33-16 ranges)_

.planning/phases/33-seo-output-audit-and-content/33-VALIDATION.md

@@ -3,9 +3,9 @@ phase: "33"
 slug: "seo-output-audit-and-content"
 # status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
 # audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
-status: draft
-nyquist_compliant: false
-wave_0_complete: false
+status: validated
+nyquist_compliant: true
+wave_0_complete: true
 created: "2026-10-28"
 ---
 
@@ -42,36 +42,37 @@ Filled by the planner per task. Decision → test map from research:
 
 | Decision | Behavior | Test Type | Automated Command | File Exists | Status |
 |----------|----------|-----------|-------------------|-------------|--------|
-| D-30 | index + per-type files, stable numbering after delete, lastmod only on real change | integration | `go test ./... -run 'TestSitemapIndex\|TestStableNumbering\|TestLastmod'` (sm-sitemap-plugin) | ❌ W0 | ⬜ pending |
-| D-31 | image ≤1000/url, news 2-day window, IndexNow ping on diff | unit + integration | `go test ./... -run 'TestImageSitemap\|TestNewsSitemap\|TestIndexNow'` | ❌ W0 | ⬜ pending |
-| D-32 | no priority/changefreq/XSL; url items migrated | integration | `go test ./... -run TestMigrateDefinitions` | ❌ W0 | ⬜ pending |
-| D-95/D-24 | SEO filter excludes noindex/canonicalised/redirected; sitemap works without SEO | integration | `go test ./... -run 'TestFilterExcludes\|TestNoFilter'` | ❌ W0 | ⬜ pending |
-| D-33 | registry pages resolve; route report upserts | integration | `go test ./... -run TestRegistry` (sm-seo-plugin) | ❌ W0 | ⬜ pending |
-| D-43..46 | @graph per kind with @id links; invalid custom JSON-LD refused | unit | `go test ./classes/schema/...` | ❌ W0 | ⬜ pending |
-| D-55..57 | alternates only for translated locales; x-default = default | integration | `go test ./... -run TestAlternates` | ❌ W0 | ⬜ pending |
-| D-40..42 | `?page=1` → 301; form normalisation; suffix templates | integration | `go test ./... -run TestPagination` | ❌ W0 | ⬜ pending |
-| D-50/51 | H1→H2 on every write path; command dry run | integration | `go test ./... -run TestHeadingConversion` (Journal) | ❌ W0 | ⬜ pending |
-| D-70 | build fails for indexable `ssr:false` / `.client.vue`; passes when noindex | build smoke | fixture playground builds (expect exit 1/0) | ❌ W0 | ⬜ pending |
-| D-20a/D-08/D-103 | middleware 301/410, X-Robots-Tag, verification file at root, cache purge | SSR smoke | `node testing/smoke-ssr.mjs --expect testing/expect-seo.txt` | ❌ W0 | ⬜ pending |
-| D-43 (layer) | exactly one ld+json script, one canonical | SSR smoke | same expect file | ❌ W0 | ⬜ pending |
-| D-80/81/52 | one anchor per card, H2 cards, no generic anchor | SSR smoke + unit | journal layer `pnpm test` + smoke | ❌ W0 | ⬜ pending |
-| D-14 | crawler finds planted issues; each issue has a tool or `fix: code` | integration | `go test ./... -run TestCrawler` | ❌ W0 | ⬜ pending |
-| D-10 | every new admin operation has an MCP tool | unit | `go test -short ./... -run TestEveryAdminOperationHasTool` | ✅ (extend) | ⬜ pending |
-| D-82/83 | autolink rules; outbound rel | unit | `pnpm test` (vue-seo-layer / journal layer) | ❌ W0 | ⬜ pending |
-| D-72 | bm serves `Disallow: /` and noindex | smoke | `curl -sI` in check script | ❌ W0 | ⬜ pending |
-| D-90/D-106 | framework additions generic and additive | gate | `scripts/check-phase33.sh --marker --additive` | ❌ W0 | ⬜ pending |
+| D-30 | index + per-type files, stable numbering after delete, lastmod only on real change | integration + unit | sm-sitemap-plugin: `go test -count=1 -run 'TestSitemapIndex\|TestStableNumbering\|TestLastmod\|TestExtraDuplicates' .`; `go test -short ./classes -run 'TestAssignSlots\|TestRealChanges\|TestWriteURLSet'` | ✅ | ✅ green |
+| D-31 | image ≤1000/url, news 2-day window, IndexNow ping on diff | unit + integration | sm-sitemap-plugin: `go test -count=1 -run 'TestImageSitemap\|TestNewsSitemap\|TestIndexNow' .`; `go test -short ./classes -run 'TestWriteImageURLSet\|TestNewsLimits\|TestIndexNowBatches\|TestIndexNowOutcome'` | ✅ | ✅ green |
+| D-32 | no priority/changefreq/XSL; url items migrated | integration + unit | sm-sitemap-plugin: `go test -count=1 -run TestMigrateDefinitions .`; `go test -short ./classes -run TestWriteURLSet` | ✅ | ✅ green |
+| D-95/D-24 | SEO filter excludes noindex/canonicalised/redirected; sitemap works without SEO | integration | sm-sitemap-plugin `go test -count=1 -run 'TestFilterExcludes\|TestNoFilter' .`; sm-seo-plugin `go test -count=1 -run 'TestSitemapFilterTracer\|TestFilterReasons' .` | ✅ | ✅ green |
+| D-33 | registry pages resolve; route report upserts | integration + unit | sm-seo-plugin `go test -count=1 -run 'TestRegistry\|TestRegistryTimestampsUTC\|TestRouteReport' .`; vue-seo-layer `npm run test` (routes.test.ts, locale copies left out) | ✅ | ✅ green |
+| D-43..46 | @graph per kind with @id links; invalid custom JSON-LD refused | unit + integration | sm-seo-plugin `go test -short ./classes/schema/...`; `go test -count=1 -run 'TestGraphTracer\|TestGraphPerKind\|TestCustomJSONLD' .`; elements `npm run test` (schema, graph) | ✅ | ✅ green |
+| D-55..57 | alternates only for translated locales; x-default = default | unit + integration | sm-seo-plugin `go test -short ./classes -run TestAlternates`; `go test -count=1 -run TestPagedAlternates .`; sm-sitemap-plugin `go test -count=1 -run TestHreflangAlternates .` | ✅ | ✅ green |
+| D-40..42 | `?page=1` → 301; form normalisation; suffix templates | unit + integration | sm-seo-plugin `go test -short ./classes -run 'TestParsePage\|TestPageLocation'`; `go test -count=1 -run TestPagination .`; vue-seo-layer usePagination.test.ts | ✅ | ✅ green |
+| D-50/51 | H1→H2 on every write path; command dry run | unit + integration | sm-journal-plugin `go test -short ./classes -run 'TestConvertH1\|TestConvertContentH1\|TestConvertTranslationH1'`; `go test -count=1 -run 'TestHeadingConversion\|TestFixHeadingsCommand' .`; vue-journal-layer postTitle.test.ts | ✅ | ✅ green |
+| D-70 | build fails for indexable `ssr:false` / `.client.vue`; passes when noindex; rendered comparison | build smoke + integration | vue-seo-layer `npm run guard:check`; sm-seo-plugin `go test -count=1 -run 'TestRenderSkipped\|TestChromeRenderer' .`, `go test -short ./classes/crawl -run 'TestCompareRendered\|TestAllowRequest\|TestResolverRules\|TestNewRenderer'` | ✅ | ✅ green |
+| D-20a/D-08/D-103 | middleware 301/410, X-Robots-Tag, verification file at root, cache purge | SSR smoke | vue-seo-layer `npm run smoke:ssr` and `npm run purge:check` | ✅ | ✅ green |
+| D-43 (layer) | exactly one ld+json script, one canonical | SSR smoke | vue-seo-layer `npm run smoke:ssr` (expect-seo.txt); demo `SMOKE_SEO_STRICT=1 scripts/smoke-seo.sh` (33-14 rehearsal) | ✅ | ✅ green |
+| D-80/81/52 | one anchor per card, H2 cards, no generic anchor | SSR smoke + unit | vue-journal-layer `npm run test` and its five smoke expectation files (check-phase33.sh --layers); vue-faq-layer block.test.ts; sm-journal-plugin editor outline/forms tests | ✅ | ✅ green |
+| D-14 | crawler finds planted issues; each issue has a tool or `fix: code` | unit + integration | sm-seo-plugin `go test -short ./classes/crawl/...`; `go test -count=1 -run 'TestCrawlerTracer\|TestCrawlerChecks' .` | ✅ | ✅ green |
+| D-10 | every new admin operation has an MCP tool | unit | sm-seo-plugin `go test -short -run TestEveryAdminOperationHasTool .`; sm-sitemap-plugin `go test -count=1 -run TestSitemapTools .`; sm-journal-plugin `go test -count=1 -run TestJournalSettingsTools .` | ✅ | ✅ green |
+| D-82/83 | autolink rules; outbound rel | unit + integration | sm-seo-plugin `go test -short ./classes -run 'TestValidAutolinkURL\|TestNormalizeAutolink'`, `go test -count=1 -run 'TestAutolinks\|TestLinkSuggestions' .`; vue-seo-layer and vue-journal-layer `npm run test` | ✅ | ✅ green |
+| D-72 | bm serves `Disallow: /` and noindex | smoke | sm-bm-app `scripts/check-noindex.sh` (33-12) | ✅ | ✅ green |
+| D-90/D-106 | framework additions generic and additive | gate | `scripts/check-phase33.sh --marker --additive --compat` | ✅ | ✅ green |
+| SC-4 | unit tests for the phase's code | gate | `scripts/check-phase33.sh --all` (required test names per repository in the go, plugins, layers and docker stages) | ✅ | ✅ green |
 
-*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+*Status key: ✅ green · ❌ red · ⚠️ flaky; no row is pending* (filled by plan 33-14 from `scripts/check-phase33.sh --all` on 2026-11-04, Docker and Chromium on the host)
 
 ---
 
 ## Wave 0 Requirements
 
-- [ ] `scripts/check-phase33.sh` — stage engine from check-phase32.sh plus a `layers` stage
-- [ ] sm-sitemap-plugin: retire `classes/golden_test.go` + `testdata/*.golden`; multi-type, multi-locale fixtures
-- [ ] vue-seo-layer: `.playground`, `testing/` (smoke-ssr, fixture-api, nuxt-server), fixture resolve answers
-- [ ] Build-guard fixture playgrounds (indexable ssr:false → fail; noindex → pass; `.client.vue` → fail)
-- [ ] Crawler httptest site with planted issues
+- [x] `scripts/check-phase33.sh` — stage engine from check-phase32.sh plus a `layers` stage
+- [x] sm-sitemap-plugin: retire `classes/golden_test.go` + `testdata/*.golden`; multi-type, multi-locale fixtures
+- [x] vue-seo-layer: `.playground`, `testing/` (smoke-ssr, fixture-api, nuxt-server), fixture resolve answers
+- [x] Build-guard fixture playgrounds (indexable ssr:false → fail; noindex → pass; `.client.vue` → fail)
+- [x] Crawler httptest site with planted issues
 
 ---
 
@@ -87,11 +88,11 @@ Filled by the planner per task. Decision → test map from research:
 
 ## Validation Sign-Off
 
-- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
-- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
-- [ ] Wave 0 covers all MISSING references
-- [ ] No watch-mode flags
-- [ ] Feedback latency < 120s
-- [ ] `nyquist_compliant: true` set in frontmatter
+- [x] All tasks have `<automated>` verify or Wave 0 dependencies
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all MISSING references
+- [x] No watch-mode flags
+- [x] Feedback latency < 120s
+- [x] `nyquist_compliant: true` set in frontmatter
 
-**Approval:** pending
+**Approval:** automated map green (33-14, 2026-11-04); the manual-only rows above are checked at and after the release.

.planning/phases/33-seo-output-audit-and-content/33-VERIFICATION.md

@@ -0,0 +1,457 @@
+---
+phase: 33-seo-output-audit-and-content
+verified: 2026-11-04T23:53:40Z
+status: human_needed
+score: "Roadmap success criteria 3/4 verified (SC2, SC3, SC4); SC1 verified at code level, its production part (grzybyfunkcjonalne.pl on the new format) pending the 33-14 Task 4 release. Plan must-haves 226/235 truths verified (202 of 33-01..33-14 plus 23 of 33-15 and 10 of 33-16): 0 failed, 5 pending the release, 3 superseded by Jakub's 2026-11-04 decisions, 1 human (visual)"
+covered_files:
+  - .planning/phases/33-seo-output-audit-and-content/33-01-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-01-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-02-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-02-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-03-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-03-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-04-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-04-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-05-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-05-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-06-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-06-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-07-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-07-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-08-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-08-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-09-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-09-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-10-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-10-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-11-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-11-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-12-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-12-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-13-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-13-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-14-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-15-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-15-SUMMARY.md
+  - .planning/phases/33-seo-output-audit-and-content/33-16-PLAN.md
+  - .planning/phases/33-seo-output-audit-and-content/33-16-SUMMARY.md
+  - admin/openapi/admin.json
+  - admin/src/api/schema.d.ts
+  - docs/backend/field-types.md
+  - docs/database/attachments.md
+  - docs/database/casts-and-validation.md
+  - docs/plugins/menu-item-types.md
+  - go.mod
+  - go.sum
+  - modules/cabana/README.md
+  - modules/cabana/admin_openapi.go
+  - modules/cabana/backend_users_admin.go
+  - modules/cabana/field_type.go
+  - modules/cabana/http.go
+  - modules/cabana/schema_types.go
+  - modules/lagoon/README.md
+  - modules/lagoon/attach/variant.go
+  - modules/lagoon/attach/webp/webp.go
+  - modules/lagoon/validate.go
+  - modules/pact/README.md
+  - modules/pact/capabilities.go
+  - modules/pact/content.go
+  - modules/phrasebook/lang/en/validate.yaml
+  - modules/phrasebook/lang/pl/validate.yaml
+  - modules/phrasebook/lang/pl/validation.yaml
+  - modules/signpost/README.md
+  - scripts/check-phase33.sh
+covered_digest: "v2:sha256:9f0a6381baf9ae704a9f2f164e838bafb0b226dbe0b2b7461fe028436b0532d3"
+behavior_unverified: 0
+overrides_applied: 2
+overrides:
+  - must_have: "G2 (33-08 drift check): no false journal-tag drift warning while golem15.journal.tag_pages is false"
+    reason: "Log noise only, no must-have violated. The fix needs a framework change: signpost.Activate refuses a menu item type whose DefaultPattern does not start with /, so sm-journal-plugin cannot drop the journal-tag pattern while tag pages are off (an additive pact field such as ContentDescriptor.Routable, or a signpost rule). Deferred to v0.6.2 (deferred-items.md, 33-12 entry and 'From 33-15')"
+    accepted_by: "Jakub Zych"
+    accepted_at: "2026-11-04"
+  - must_have: "D-106 / W5: framework v0.6.1 is strictly additive (patch); lagoon.Validate's stricter min/max length check ships in it"
+    reason: "Kept in v0.6.1 with an explicit 'Changed' entry in 33-14-notes-summercms-v0.6.1.md (a stored value longer than its max fails its next admin save) and a production SQL check (33-14-risk-max.sql) on every production database before the tag"
+    accepted_by: "Jakub Zych"
+    accepted_at: "2026-11-04"
+re_verification:
+  previous_status: gaps_found
+  previous_verified: 2026-11-04T20:20:34Z
+  previous_commit: 97abc77
+  previous_score: "Roadmap SC 2/4; plan must-haves 191/202 (2 failed: G3)"
+  gaps_closed:
+    - "D-57 / SC2 hreflang: a page without a translation has no hreflang for that locale (G3; sm-journal-plugin 0a62090, TestContentDescriptorsTranslatedLocales on the real descriptor path)"
+    - "SC1 / D-24: the sitemaps stay consistent with noindex (G1; sm-seo-plugin 9de6b2e, sm-sitemap-plugin 6b67ab7, vue-seo-layer 7a26692; TestNoindexPathsTracer, TestSitemapNoindexTool, routes.test.ts, smoke routereport noindex=)"
+  gaps_remaining: []
+  regressions: []
+human_verification:
+  - test: "33-14 Task 4 release steps, in the release-log order: framework v0.6.1, sm-journal-plugin v0.4.0, sm-sitemap-plugin v0.2.0, sm-seo-plugin v0.2.0 (its go.mod must require sm-sitemap-plugin v0.2.0: today it requires v0.1.2, which has no contract package, so GOWORK=off builds fail), vue-seo-layer v0.2.0, then the link:../vue-seo-layer swap in vue-journal-layer, vue-menu-layer and vue-faq-layer, `check-git-install.sh --check-links` over the four layers (must exit 0) and `check-git-install.sh <tag>`, then their tags; app pins and patches (33-12, 33-13, then 33-14-*-locale.patch on the demo); -tags nodynamic in the WebP-linking app builds with the 33-13 DEPLOY.md 'Binary' row corrected; recreate the 33-12 and 33-13 rehearsal databases from their source dumps before the rehearsal (migration 202610280002 was edited); changelog posts"
+    expected: "Every step logged in 33-release-log.md; release binaries statically linked; nothing tagged off the default branch"
+    why_human: "Pending the release by design: Task 4 runs after this verification and needs Jakub's go-ahead for tags, pushes and deploys"
+  - test: "W5 before the v0.6.1 tag: run 33-14-risk-max.sql (read-only) against every production database whose app takes v0.6.1"
+    expected: "No row longer than its rule's max, or each listed row shortened or accepted; results logged in 33-release-log.md"
+    why_human: "Condition of the accepted W5 override; needs production database access"
+  - test: "SC1 production, after the tags (33-13 after-tags decision): deploy grzybyfunkcjonalne.pl per its DEPLOY.md, first the scripts/urls.txt check on the tagged build, then the 33-13-deploy-log.md checklist items 1-8"
+    expected: "Every urls.txt line passes; /sitemap.xml is a sitemapindex of sitemap-posts-1, -categories-1, -authors-1, -pages-1 and -images-1; the posts file lists the 62 posts once each with lastmod and no /en/ or hreflang; /sitemap.xsl 404; a post has one canonical, one JSON-LD script, no hreflang=en, breadcrumbs; SEO › Pages and Settings › Sitemaps as listed; a crawl finishes without /en/ 404s or duplicates; GSC reads the index"
+    why_human: "Pending the release (production deploy after the tags), not a failure"
+  - test: "G1 on a deployed site (demo after its patches): check the server log line 'route report: N routes and M noindex paths sent', then that the migrated Additional address /subscriptions (noindex in Nuxt) is excluded with reason noindex on Settings › Sitemaps and absent from sitemap-pages-1.xml without the manual DEPLOY.md removal"
+    expected: "The noindex address leaves the XML and HTML sitemaps after the debounced rebuild; a crawl reports no sitemap_noindex for it"
+    why_human: "Proven by TestNoindexPathsTracer and the layer smoke on fixtures; the live round trip needs the released versions on a running site"
+  - test: "SC3 live workflow: run a crawl from SEO › Crawls on a deployed site, then from a real Claude client linked over MCP ask it to fix the reported issues with dry_run, review the preview, apply"
+    expected: "Every data issue names a tool the client can call (sitemap_update_settings for a noindex Additional address); dry runs write nothing; applying fixes the data issues; fix: code issues are named as template work"
+    why_human: "External agent-driven workflow (33-VALIDATION.md manual-only row)"
+  - test: "D-46: Google's Rich Results Test for a post, a category and an FAQ page from the admin's Rich Results link"
+    expected: "No errors for BlogPosting, CollectionPage/ItemList and FAQPage"
+    why_human: "External Google tool (33-VALIDATION.md manual-only row)"
+  - test: "Visual check after the deploys: grzyby home, /blog, a category, a post, /autor/admin on desktop and mobile; the demo on prefix_except_default (/pl/... addresses, LanguageSwitcher, /pl/mapa-strony and /sitemap each in its own locale, footer link to the visitor's locale); the new admin screens (SEO tab, Site audit, Crawls with the cancelling state, Auto-links, Pages, Settings › Sitemaps with the headings left empty) including the Blog Editor outline with long headings at 360px (33-02 J2)"
+    expected: "Layouts render as in 33-UI-SPEC.md; long outline headings wrap with a hanging indent and are not truncated"
+    why_human: "Visual rendering; element tests run under happy-dom without layout"
+---
+
+# Phase 33: SEO output, audit and content Verification Report
+
+**Phase Goal:** As a site editor and as an SEO specialist auditing a SummerCMS site, I want to have the rendered sites emit complete SEO output (sitemaps, structured data, pagination, hreflang, headings, breadcrumbs) from the CMS, and an audit that finds the remaining problems, so that sites are indexed correctly and issues can be fixed through MCP.
+**Verified:** 2026-11-04T23:53:40Z
+**Status:** human_needed
+**Re-verification:** Yes, after gap closure (33-15, 33-16, quick 261104-xae). The initial verification (2026-11-04T20:20:34Z, gaps_found, commit 97abc77) is kept below.
+**Mode:** mvp.
+
+Repository HEADs checked (none tagged, nothing pushed; commits since the base tag): summercms.go 6e99b18 (84 since v0.6.0, planning docs included), sm-sitemap-plugin b2b3a1d (23 since v0.1.2), sm-seo-plugin c71b58e (37 since v0.1.1), sm-journal-plugin cf13c60 (21 since v0.3.1), vue-seo-layer 3868f3d (24 since v0.1.1), vue-journal-layer 761c7fc (16 since v0.7.1), vue-menu-layer a7602c9 (2 since v0.4.0), vue-faq-layer 5e5950a (4 since v0.4.0).
+
+## Re-verification result (2026-11-04T23:53:40Z)
+
+Both gaps are closed in code, each with a test on the production path. No earlier must-have regressed. The full gate passed again in this run. G2 and W5 are recorded as accepted overrides, following Jakub's decisions of 2026-11-04. What remains is the release (33-14 Task 4) and the checks that can only run after it, so the status is human_needed.
+
+### User Flow Coverage
+
+| Step | Expected | Evidence | Status |
+|------|----------|----------|--------|
+| Editor publishes content | Sitemap index with per-type files, real lastmod, stable numbering | as before; plus the rebuild lock (TestConcurrentRebuilds) and kept lastmods (TestRebuildKeepsMovedLastmod) | ✓ |
+| Crawler/visitor opens a page | SSR head from the CMS, one JSON-LD @graph, hreflang for translated locales only, breadcrumbs, pagination | G3 closed: Journal descriptors give a URL only to locales with content (TestContentDescriptorsTranslatedLocales, Postgres); the SEO and sitemap plugins drop URL "" (alternates.go:72, rebuild.go:251) | ✓ |
+| Nuxt-only noindex page | Leaves the XML and HTML sitemaps | G1 closed: the route report sends `noindex`, and the plugin stores the set and excludes those paths with reason noindex (TestNoindexPathsTracer) | ✓ (live round trip: human) |
+| SEO specialist runs the audit | Issues per URL, each with an MCP tool or fix: code | sitemap_noindex on an Additional address names sitemap_update_settings (TestSitemapNoindexTool); the crawl lifecycle is fixed (TestCrawlTimeout, TestCrawlCancelRunning, TestCrawlStaleRecovery, TestCrawlStoreTimeout) | ✓ (live MCP session: human) |
+| Outcome | "sites are indexed correctly and issues can be fixed through MCP" | Holds in code and on the fixture and rehearsal sites; production grzybyfunkcjonalne.pl is pending the release | ⚠ pending the release (human) |
+
+### Roadmap Success Criteria
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| SC1 | Sitemap index with per-type files, configurable size, stable numbering, real lastmod, consistent with noindex and robots.txt; grzybyfunkcjonalne.pl on the new format | ✓ code level; production ⚠ PENDING RELEASE (human) | Noindex consistency now covers Nuxt-only noindex pages: vue-seo-layer `noindexStaticRoutes` (lib/routes.ts) → `#seo-routes` `noindexPaths` → `routeReportBody(staticRoutes, noindexPaths)` (server/plugins/seo-route-report.ts:26) → controllers/api/registry.go `Noindex *[]string` → `ReportNoindex` (classes/registry.go:832, `golem15_seo_noindex_paths`, Rebuilder after commit) → filter `b.noindex[norm.Path]` (classes/sitemap_filter.go:174). The grzyby deploy happens after the tags |
+| SC2 | Server-side head, one JSON-LD @graph, hreflang, breadcrumbs from the CMS; build fails on an indexable ssr:false route | ✓ VERIFIED | G3 closed: `tr.hasContent` (classes/menu_item_types.go:1134) sets URL "" for a locale without content in describePosts (content_descriptors.go:178) and describeCategories (:498); tags and authors go through `postContentLocales`. The real-path Postgres test asserts `de=` (no URL) for untranslated records and still gives Resolve all three locales. Post pages also keep og:type article (L4 WR-02) |
+| SC3 | Crawler reports issues per URL, each fixable through MCP | ✓ VERIFIED (automated) | The caveat recorded inside G1 is gone: sitemap_noindex on a listed address without a record names `sitemap_update_settings` (`crawl.SitemapTool`, checks.go:351). Live client session: human item |
+| SC4 | New code has unit tests in the phase's last plan | ✓ VERIFIED | 33-14's 39 test files as before. Each gap-closure fix carries its own test (33-15 table of 21 findings, 33-16 table of 8, xae RED/GREEN for WR-01 to WR-04); `check-phase33.sh --all` green in this run |
+
+**Score:** 3/4 roadmap criteria verified, SC1's production part pending the release. Plan must-haves: 226/235 truths verified, 0 failed, 0 present-but-behaviour-unverified.
+
+### Previously failed truths
+
+| Plan | Truth | Now | Evidence |
+|------|-------|-----|----------|
+| 33-03 #4 | "…xhtml:link alternates for each translated locale…; a locale without a URL gets no alternate…" | ✓ VERIFIED | The Journal descriptors now produce URL "" for untranslated locales on the real path (TestContentDescriptorsTranslatedLocales passed in this run). TestHreflangAlternates (sm-sitemap-plugin b2b3a1d) now uses Journal-shaped records with every enabled locale present; it passed in this run. The fixture-only reliance recorded in the first verification is gone |
+| 33-06 #7 | "hreflang comes from one source…; a locale without a translation is absent…" | ✓ VERIFIED | Same descriptor rule; `translatedLocales` (sm-seo-plugin classes/alternates.go:65-79) drops URL ""; TestAlternates (sm-seo-plugin 2a288a9, Journal-shaped records) passed in this run |
+
+### Plan must-haves of the gap-closure plans
+
+| Plan | Truths | Result | Notes |
+|------|--------|--------|-------|
+| 33-15 Go plugins | 23 | 23 verified | One wording superseded. The L1 CR-02 truth said markdown content is "kept byte for byte". Quick 261104-xae (WR-01) reworded it: content is always read as markdown, code ranges stay untouched (also when the body starts with an HTML block), and a raw `<h1>` outside code is converted, as in v0.3.1. The intent (no code sample rewritten) holds and is tested (TestConvertContentH1HTMLLead, TestConvertTranslationH1, Docker TestHeadingConversion). The v0.4.0 notes state the rule. The G2 truth holds as worded: the reason is recorded in deferred-items.md and the SUMMARY |
+| 33-16 Nuxt layers | 10 | 10 verified | L4 WR-08 (503 while the backend has not answered since start) keeps its meaning after xae WR-04, which remembers the last definite answer (`lastKnown`, server/lib/site.ts:32-66). The L4 CR-01 release guard is in place. The link: swap is a Task 4 step (human item 1) |
+
+Totals (235): 191 earlier + 2 previously failed (now verified) + 23 + 10 = 226 verified. Still pending the release: 5 (33-13 truth 1 repeated on the tags; 33-14 release order, patches with app builds and check-pins, changelog post, release-log steps). Superseded by Jakub's 2026-11-04 decisions: 3 (two uat truths of 33-13, the uat check of 33-14). Human: 1 (J2 at 360px).
+
+### Overrides applied
+
+| Item | Kind | Disposition |
+|------|------|-------------|
+| G2 false journal-tag drift warning | warning (no must-have violated) | Accepted deferral to v0.6.2 (Jakub, 2026-11-04). It needs a framework change in signpost.Activate or an additive pact field. Not a gap |
+| W5 stricter min/max length check in v0.6.1 (D-106 "strictly additive") | judgment-tier prohibition | Accepted for v0.6.1 (Jakub, 2026-11-04). The "Changed" note is present in 33-14-notes-summercms-v0.6.1.md:19, and 33-14-risk-max.sql exists. Running it on production before the tag is human item 2 |
+
+### Review findings in scope
+
+**33-REVIEW.md, as filtered by the 33-15 and 33-16 plans.** In scope were:
+- L1: CR-01, CR-02, WR-01, WR-02 (docs), WR-03, WR-05;
+- L2: WR-01 to WR-05, IN-01;
+- L3: CR-01, WR-01, WR-03, WR-04, WR-06;
+- L4: CR-01, WR-01 to WR-05, WR-08;
+- G1 and G3.
+
+All are resolved, with these three notes:
+- **L1 CR-02 and L1 WR-05.** The re-review rated them partial. Quick 261104-xae completed them (WR-01 and WR-02 below).
+- **L4 CR-01.** The guard, the versions and the pins are done. The link: swap is a Task 4 step by plan.
+
+The 33-REVIEW-GAPFIX.md verdict table has 26 rows: 19 resolved and 3 partial, and the 3 partial ones are now closed as described above.
+
+**33-REVIEW-GAPFIX.md warnings:**
+
+| Finding | Fix (commit) | Code checked | Test (passed in this run) |
+|---------|--------------|--------------|---------------------------|
+| WR-01 `<`-prefixed markdown, h1 in code | sm-journal-plugin a41d537 | `ConvertContentH1` calls `convertH1OutsideCode(content)` without a first-byte gate (classes/headings.go:79-93) | TestConvertContentH1HTMLLead (named run), plus the Docker suite |
+| WR-02 images/alt content_html-only and `<`-prefixed markdown | sm-journal-plugin cf13c60 | `strings.TrimSpace(text.content) == ""` branch, else SetMarkdownImageAlt and SetImageAltOutsideCode (controllers/api/maintenance.go:173-195) | TestSetImageAltBodyShapes (named run, Postgres) |
+| WR-03 terminal write shares the store deadline | sm-seo-plugin c71b58e | `finalWriteTimeout` 30 s on a detached parent, `WithFinishTimeout` seam, error "storing the crawl results took longer than …" (classes/crawl/job.go:62-74, 426-429) | TestCrawlStoreTimeout (named run, Postgres) |
+| WR-04 root files hijacked after an outage on SEO-less backends | vue-seo-layer 3868f3d | `lastKnown` remembers ok or absent; unknown answers the remembered state (server/lib/site.ts:32-66) | rootFiles.test.ts (vue-seo-layer 156/156 in the layers stage) |
+
+Out of scope, deferred to the v0.6.2 backlog by the plans (deferred-items.md "From 33-15"):
+- L1 WR-04, WR-06, WR-07;
+- L2 WR-06 to WR-08;
+- L3 WR-02 and WR-05;
+- L4 WR-06 and WR-07;
+- the info items;
+- the verifier warnings W1 to W4.
+
+### Behavioral spot-checks, gate and patches
+
+| Behavior | Command | Result | Status |
+|----------|---------|--------|--------|
+| Full phase gate, Docker and Chromium present | `PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --all` | All 11 stages PASS: self-test, go, plugins, layers (seo 156, journal 202, menu 24, faq 19 TAP, no failures; smokes; check-git-install self-test), consumers, admin, docs, marker, docker (sitemap 62, seo 154, journal 142 top-level tests on full `./...` runs that refuse any skip; framework attach 57), additive (5 packages against v0.6.0), compat. Ends "Phase 33 gate passed", exit 0. Compat skipped sm-feedback-plugin as before (fails at v0.6.0 too) | ✓ PASS |
+| G1, G3 and xae tests by name | `go test -count=1 -run '^(…)$' ./...` in each plugin | PASS: TestContentDescriptorsTranslatedLocales, TestSetImageAltBodyShapes, TestConvertContentH1HTMLLead, TestNoindexPathsTracer, TestCrawlStoreTimeout, TestAlternates, TestSitemapNoindexTool, TestHreflangAlternates, TestListing | ✓ PASS |
+| Gap-closure tests exist | `go test -short -list` | Present: TestCrawlTimeout, TestCrawlCancelRunning, TestCrawlStaleRecovery, TestRenderTabTimeout, TestFetcherPortAndKey, TestCrawlerNonASCII, TestAllowRequest, TestConcurrentRebuilds, TestRebuildKeepsMovedLastmod, TestIndexNowStaging, TestTypeTitlesNotPinned, TestRecordSavedNilEvent, TestConvertLegacyItems, TestFixHeadingsCommandCLI, TestImageVariantsTallOriginal, TestSetMarkdownImageAlt, TestSetImageAltEdges (all run inside the green docker and short suites) | ✓ PASS |
+| App patches on current HEADs | `git apply --check --allow-empty` | OK for each patch on its app's HEAD: 33-12-sm-demo-app (sm-demo-app da481c9), 33-12-vue-demo-app (vue-demo-app 9a12701), 33-12-sm-summercmsio-app (ca06049), 33-12-vue-summercmsio-app (f36cbf1), 33-13-sm-grzybyfunkcjonalne-app (35d3664), 33-13-vue-grzybyfunkcjonalne-app (e45ffe8) | ✓ PASS |
+| Demo locale patches stacked | scratch worktrees: apply the 33-12 patch, then `git apply --check` of 33-14-*-locale.patch | OK for both; vue-demo-app ends on `strategy: 'prefix_except_default'` with the `/pl/mapa-strony` sitemap path; worktrees removed | ✓ PASS |
+| Journal stays additive | `git diff v0.3.1..HEAD` of non-test Go files: removed or changed exported `func` lines | 0; menu_item_types_test.go and the smoke test unchanged since 311c28a | ✓ PASS |
+
+### Anti-patterns and remaining notes
+
+| File | Pattern | Severity | Impact |
+|------|---------|----------|--------|
+| all phase repositories | No TBD/FIXME/XXX/TODO/HACK added since each base tag | — | — |
+| sm-journal-plugin controllers/api/posts.go | `gofmt -l`: import order (`compass` above `bouncer`), introduced by phase 33 (the file was gofmt-clean at v0.3.1) | ℹ️ Info (known leftover) | Formatting only; fix with `gofmt -w` before the v0.4.0 tag |
+| sm-journal-plugin classes/blog_editor_test.go | `gofmt -l`: map literal alignment. The file was already unformatted at v0.3.1, and phase 33 changed it | ℹ️ Info (known leftover) | Test file, formatting only |
+| sm-seo-plugin go.mod | Requires sm-sitemap-plugin v0.1.2, which has no `contract` package; works only through go.work | ⚠️ Release step | Pin v0.2.0 in Task 4 (human item 1); the 33-15 SUMMARY records it |
+| vue-journal-layer, vue-menu-layer, vue-faq-layer package.json | `"vue-seo-layer": "link:../vue-seo-layer"` | ⚠️ Release step | Do not tag before the Task 4 swap; `--check-links` blocks it |
+| sm-journal-plugin (G3 follow-up) | An untranslated locale's address still answers with the default-locale content and a self canonical; it is no longer advertised in hreflang or the sitemaps | ℹ️ Info | Deferred decision (canonical to the default locale or a 404), deferred-items "From 33-15" |
+| xae residuals | images/alt answers 422 for an `<img>` in an HTML body after a blank line and 4+ spaces of indent (an indented code block to goldmark). A backend whose /site answers 200 HTML or 401/403 stays unknown | ℹ️ Info | Recorded in the 261104-xae SUMMARY; the workarounds are documented there |
+| W1 to W4 | Home title template, swr localhost canonicals, route-report names without diacritics, GORM local timestamps | ℹ️ Info | Deferred to v0.6.2 as before |
+| 33-REVIEW-GAPFIX notes below the warning bar | Shutdown during a crawl maps to cancelled; DeleteCrawls does not end stale conga records; collect runs inside an idle transaction; the `IN` list in postContentLocales hits the parameter limit past about 65k posts; repeat IndexNow pings for excluded rows | ℹ️ Info | Not counted by the reviewer; candidates for the v0.6.2 backlog |
+
+The first verification's info rows are settled. The stale "Saving Settings › Journal answers 500" entry is now marked resolved (deferred-items.md:14). The W5 warning became the override above.
+
+### Human Verification Required
+
+These are listed in the frontmatter `human_verification`. Everything except item 7 depends on the release.
+1. 33-14 Task 4 release steps: tags in order, the sm-seo-plugin pin, the link: swap with `--check-links`, app pins and patches, `-tags nodynamic` with the DEPLOY.md row fixed, rehearsal databases recreated, changelog posts.
+2. W5: 33-14-risk-max.sql on the production databases before the v0.6.1 tag.
+3. SC1 on production grzybyfunkcjonalne.pl after the tags: the urls.txt check first, then deploy-log items 1-8.
+4. G1 live round trip on the deployed demo (noindex Additional address leaves the sitemap without manual removal).
+5. SC3 live MCP crawl, dry run and apply.
+6. D-46 Rich Results Test.
+7. Visual checks (grzyby, demo on prefix_except_default, admin screens, J2 at 360px).
+
+### Gaps Summary
+
+None. G1 and G3 are closed in code, each with a test on the production path. G2 and W5 are accepted overrides. The phase can proceed to the release step (33-14 Task 4), followed by the human items above.
+
+---
+
+# Initial verification (2026-11-04T20:20:34Z, gaps_found, commit 97abc77)
+
+The report below is kept unchanged, with its headings moved down one level. Its frontmatter `gaps:` block is reproduced here, and the gaps it lists are closed above.
+
+```yaml
+gaps:
+  - truth: "D-57 / SC2 hreflang: a page without a translation has no hreflang for that locale (33-06: 'a locale without a translation is absent'; 33-03: alternates 'for each translated locale')"
+    status: failed
+    artifacts: [../sm-journal-plugin/classes/content_descriptors.go, ../sm-journal-plugin/classes/menu_item_types.go]
+  - truth: "SC1 / D-24: the sitemaps stay consistent with noindex (noindex pages leave the XML and HTML sitemaps)"
+    status: partial
+    artifacts: [../vue-seo-layer/server/plugins/seo-route-report.ts, ../sm-seo-plugin/classes/sitemap_filter.go, ../sm-seo-plugin/classes/crawl/checks.go]
+```
+
+## Phase 33: SEO output, audit and content Verification Report
+
+**Phase Goal:** As a site editor and as an SEO specialist auditing a SummerCMS site, I want to have the rendered sites emit complete SEO output (sitemaps, structured data, pagination, hreflang, headings, breadcrumbs) from the CMS, and an audit that finds the remaining problems, so that sites are indexed correctly and issues can be fixed through MCP.
+**Verified:** 2026-11-04T20:20:34Z
+**Status:** gaps_found
+**Re-verification:** No, initial verification (plan 33-14 paused at its release checkpoint; Tasks 1 and 2 done)
+**Mode:** mvp. The ROADMAP goal reads "I want the rendered sites"; the plans' normalised form above passes `user-story.validate`.
+
+Repositories checked (commits since the base tag; none tagged, all ahead of origin): summercms.go 72 since v0.6.0, sm-sitemap-plugin 17 since v0.1.2, sm-seo-plugin 29 since v0.1.1, sm-journal-plugin 14 since v0.3.1, vue-seo-layer 18 since v0.1.1, vue-journal-layer 11 since v0.7.1, vue-menu-layer 1 and vue-faq-layer 3 since v0.4.0, sm-bm-app bd7ee84 (local D-72 commit).
+
+### User Flow Coverage
+
+| Step | Expected | Evidence | Status |
+|------|----------|----------|--------|
+| Editor publishes content | Sitemap index with per-type files, real lastmod, stable numbering | sm-sitemap-plugin classes/{slots,writer,lastmod,rebuild}.go; TestSitemapIndex, TestStableNumbering, TestLastmod (docker stage PASS) | ✓ |
+| Crawler/visitor opens a page | SSR head from the CMS, one JSON-LD @graph, hreflang, breadcrumbs, pagination | vue-seo-layer useCmsSeo.ts, seo.ts, Breadcrumbs.vue, Pagination.vue; smoke:ssr expect-seo.txt (count=1 canonical/ld+json); layers stage PASS | ✓ except hreflang on untranslated Journal locales (G3) |
+| Build of an indexable client-only route | Build fails | lib/guard.ts, testing/guard-check.mjs (guard:check in layers stage PASS) | ✓ |
+| SEO specialist runs the audit | Issues per URL, each with an MCP tool or fix: code | classes/crawl/{crawler,checks,fix}.go; TestCrawlerChecks, TestCrawlerTracer; MCP seo_start_crawl … seo_unignore_issues | ✓ (live MCP session: human) |
+| Outcome | "sites are indexed correctly and issues can be fixed through MCP" | Holds on the code and fixture sites; production grzybyfunkcjonalne.pl pending the release; G1 and G3 remain | ⚠ gaps + pending release |
+
+### Goal Achievement
+
+#### Roadmap Success Criteria
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| SC1 | Every site serves a sitemap index with per-type files of a configurable size, stable numbering and real lastmod, consistent with noindex and robots.txt, and grzybyfunkcjonalne.pl runs on the new format | ⚠ PENDING RELEASE + partial gap G1 | Index, per-type files, file_size 1–50 000, stable slots, real lastmod, filter, robots.txt `Sitemap:` line, sitemap_blocked issue: code and Docker suites green. **grzybyfunkcjonalne.pl on the new format is pending the post-tag production deploy (33-13 after-tags decision, no uat any more): human_needed, not failed.** Noindex consistency fails for Nuxt-only noindex pages listed as Additional addresses (G1, recorded by Jakub as a gap) |
+| SC2 | Indexable pages render server-side with head tags, one JSON-LD @graph, hreflang and breadcrumbs from the CMS, and a build fails when an indexable route has ssr: false | ✗ PARTIAL (G3) | Head, one @graph, breadcrumbs, pagination, build guard: verified (layers stage: tests, playground builds, smokes, guard:check; demo strict smoke rehearsal in 33-14). hreflang is emitted from the CMS, but for Journal records it lists every enabled locale, translated or not (D-57 violated, G3) |
+| SC3 | The crawler reports SEO issues per URL, and each issue can be fixed through MCP | ✓ VERIFIED (automated) | Per-URL issues of every C23 kind; `Route()` in classes/crawl/fix.go gives every finding a tool or fix: code (Jakub's 2026-10-28 reading of SC3); TestCrawlerChecks finds each planted issue once and none on /clean; TestEveryAdminOperationHasTool. Caveat inside G1: sitemap_noindex on a Nuxt-only noindex address names a tool that does not fix it. Live agent session: human item |
+| SC4 | The new code has unit tests, delivered in the phase's last plan | ✓ VERIFIED | All 39 unit test files of 33-14 exist (Go table tests; TS files with 4–15 cases) in commits 513793a, eb8a028, fbe9816 (framework), 1048c01 (sitemap), 82b0dac, 075cf17 (seo), e7832a8, 311c28a (journal), 75cc100 (vue-seo-layer), 9e66cbe (journal layer), 7d952fa (faq layer); `check-phase33.sh --all` green in this run with required test names per repository |
+
+**Score:** 2/4 roadmap criteria verified; plan must-haves 191/202 truths verified (0 present-but-behaviour-unverified).
+
+#### Plan Must-Haves (202 truths, 15 backstops, 27 prohibitions)
+
+| Plan | Truths | Result | Exceptions |
+|------|--------|--------|-----------|
+| 33-01 framework seams, gate | 12 | 12 verified | WR-02 meaning recorded in 33-01-SUMMARY; version text v0.5.1/v0.5.2 superseded by v0.6.0/v0.6.1 (release log, 2026-11-04) |
+| 33-02 Journal H1 setting, editor, descriptors | 18 | 17 verified, 1 human | J2 long-text wrap at 360px (planner assumption, visual) |
+| 33-03 sitemap index | 15 | 14 verified, 1 failed | Truth 4 (alternates only for translated locales) fails on Journal records: G3 |
+| 33-04 images, News, IndexNow, HTML API | 13 | 13 verified | IndexNow only in production and only on the site host (TestIndexNow, NotifyIndexNow) |
+| 33-05 filter, registry, site endpoint | 16 | 16 verified | G1 is outside its wording ("effective SEO"), but limits SC1 |
+| 33-06 graph, breadcrumbs, hreflang, pagination | 20 | 19 verified, 1 failed | Truth 7 (hreflang from translated locales only) fails on Journal records: G3 |
+| 33-07 vue-seo-layer head and root files | 14 | 14 verified | |
+| 33-08 build guard, route report, drift check | 15 | 15 verified | Drift check emits a false journal-tag warning while tag_pages is false (G2, warning) |
+| 33-09 journal, menu, FAQ layers | 17 | 17 verified | |
+| 33-10 crawler and issue report | 22 | 22 verified | TestChromeRenderer ran against /usr/bin/chromium |
+| 33-11 auto-links, WebP | 13 | 13 verified | `go test -tags nodynamic ./modules/lagoon/attach/webp` passes |
+| 33-12 apps I | 8 | 8 verified | Patches apply; sm-bm-app check-noindex ok |
+| 33-13 grzyby | 8 | 5 verified, 1 pending, 2 superseded | Truth 1 (urls.txt identical) proven on local links, repeat on tags pending; truths 7–8 (uat) superseded: no uat, production after tags |
+| 33-14 tests, gate, release | 11 | 6 verified, 4 pending, 1 superseded | Pending Task 4: release order, patches applied with app builds and check-pins, changelog post, release log steps. Superseded: the uat check. Verified: nothing pushed or tagged yet (0 tags contain HEAD in any repository) |
+
+Backstop truths (15): each has a named passing test in the green gate (for example paginationWindow.test.ts `[1,'gap',3,4,5,6,7,'gap',14]`, expect-seo.txt `count=<nav class="seo-breadcrumbs":1`, lru.test.ts concurrent load, TestVariantStoredWithContentType second call, TestRouteReport repeated report, TestCrawlerChecks control page, signpost "nil and empty slices are handed through alike").
+
+Prohibitions (27): test-tier items have wired enforcement in green suites (marker and additive stages for D-90/D-106; TestStableNumbering D-30; TestIndexNow D-31; TestRouteReport D-33; TestCustomJSONLD D-44; headings_test.go "switching the setting never rewrites stored content" D-50; crawler_test.go refusing evil.example.com, 169.254.169.254 and plain http D-14; TestRendererGuards D-70; related_media_test.go upload answers before encoding D-85; guard:check D-70; check-noindex.sh D-72). Judgment-tier (non-authoritative LLM check): D-96 Journal imports no SEO plugin (holds); D-95 SEO imports only `sm-sitemap-plugin/contract` outside tests (holds); D-70 demo noindexRoutes cover only `/p/**` and `/presentations/**` (holds); D-32/D-106 nothing deployed, pushed or tagged (holds so far); changelog token never printed (not exercised yet).
+
+#### Required Artifacts
+
+All 64 artifacts named in the plans exist and contain their patterns (checked by script): framework pact/content.go, capabilities.go, signpost and cabana smoke tests, attach/webp; sm-journal-plugin headings.go, fix_headings.go, content_facts.go, image_variants.go; sm-sitemap-plugin contract.go, slots.go, writer.go, indexnow.go, htmlgroups.go, mcp.go, migration 202610280002; sm-seo-plugin sitemap_filter.go, registry.go, site.go, schema/graph.go, validate.go, pagination.go, crawl/{crawler,checks,compare,render_chrome}.go, autolinks.go, elements/links.ts, _issue_details.htm; vue-seo-layer middleware, useCmsSeo.ts, seo-root.ts, guard.ts, Pagination.vue, Breadcrumbs.vue, bodyLinks.ts; vue-journal-layer htmlGate.ts, PostCard.vue; vue-faq-layer faqSchema.ts; the patches, notes, COVERAGE.md and release log. None is a stub (no TBD/FIXME/XXX added in any repository since its base tag).
+
+#### Key Link Verification
+
+| From | To | Status | Details |
+|------|----|--------|---------|
+| pact content fields | signpost Describe/Records | WIRED | signpost/content.go:102,122 |
+| pact RequestOptions | cabana form schema | WIRED | http.go:862 mergeRequestOptions (field_type.go:279) |
+| Journal blog editor | ConvertH1 | WIRED | blog_editor.go:181 (plan named decodeBlogHTML) |
+| Journal API posts | content_h1_to_h2 | WIRED | controllers/api/posts.go:197 |
+| sitemap rebuild | signpost Records, Lookup[contract.Filter] | WIRED | rebuild.go:142, 212 |
+| sitemap rebuild | IndexNow job | WIRED | rebuild.go:164 NotifyIndexNow → indexnow.go:146 Enqueue IndexNowArgs → fetchguard client (indexnow.go:209) |
+| sitemap listeners | RecordSaved | WIRED | listeners.go:21 |
+| seo plugin | contract.Filter | WIRED | plugin.go:64 app.Publish[contract.Filter] |
+| seo history | site-cache purge | WIRED | history.go:285 cooler.PurgeSiteCacheAfterCommit |
+| resolver | schema.Build, autolinks | WIRED | structured.go:249; resolver.go:74 |
+| crawler | fetchguard, compareRendered, schema.Validate, Tools[] | WIRED | crawl/fetch.go:100, checks.go:711, 515, fix.go:51 |
+| render_chrome | fetchguard.IsPrivateAddr | WIRED | render_chrome.go:202 |
+| image variants job | webp.Variant | WIRED | image_variants.go:199 |
+| vue-seo-layer middleware, head plugin, purge, guard, route report, pagination | resolveCached, useCmsSeo, clearSeoCaches, nitro:config, /registry/routes, pageHref | WIRED | all found |
+| journal, menu, FAQ layers | vue-seo-layer | WIRED | `extends: ['vue-seo-layer']` in all three |
+| FeaturedImage.vue | variants | WIRED | `<source type="image/webp">` |
+| bm nginx | every response | WIRED | `add_header X-Robots-Tag "noindex, nofollow" always` |
+
+#### Data-Flow Trace (Level 4)
+
+| Artifact | Data | Source | Real data | Status |
+|----------|------|--------|-----------|--------|
+| Sitemap files | URLs, lastmod, alternates | signpost Records of each content type + slot table | Yes (Docker suites) | FLOWING; alternates inherit Journal fallback (G3) |
+| SEO layer head | title, canonical, robots, alternates, @graph | GET /_seo/api/v1/resolve via resolveCached | Yes (smoke:ssr against fixture API; demo rehearsal against the Go backend in 33-12/33-14) | FLOWING |
+| Breadcrumbs, pagination | crumbs, page form | resolve answer and /_seo/api/v1/site | Yes | FLOWING |
+| Site audit | issues | crawl tables + CMS checks | Yes (TestCrawlerTracer) | FLOWING |
+
+#### Behavioral Spot-Checks and Gate
+
+| Behavior | Command | Result | Status |
+|----------|---------|--------|--------|
+| Full phase gate, Docker and Chromium present | `PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --all` | PASS self-test, go, plugins, layers, consumers, admin, docs, marker, docker, additive (5 packages against v0.6.0), compat; "Phase 33 gate passed", exit 0; compat skipped sm-feedback/presentations/quizzes-plugin (fail at v0.6.0 too) | ✓ PASS |
+| WebP with -tags nodynamic | `go test -tags nodynamic ./modules/lagoon/attach/webp` | ok | ✓ PASS |
+| bm noindex | `sm-bm-app/scripts/check-noindex.sh` | check-noindex: ok | ✓ PASS |
+| App patches apply | `git apply --check` of the 33-12/33-13 patches on each app's HEAD (summercmsio note patch with `--allow-empty`) | all OK | ✓ PASS |
+| Demo locale patches stack | 33-12 demo patches applied in scratch copies, then `git apply --check` of 33-14-sm-demo-app-locale.patch and 33-14-vue-demo-app-locale.patch | OK; vue-demo-app ends on `strategy: 'prefix_except_default'` and `/pl/mapa-strony` | ✓ PASS |
+
+#### Probe Execution
+
+No `probe-*.sh` declared by the phase; the phase gate is `scripts/check-phase33.sh` (run above).
+
+#### Requirements Coverage
+
+REQUIREMENTS.md holds no Phase 33 IDs (ROADMAP: Requirements TBD). The IDs are the SC-n of the ROADMAP and the D-n decisions of 33-CONTEXT.md (text in 32-CONTEXT.md). Every one of the 48 decision IDs listed in 33-CONTEXT.md is claimed by at least one plan; the plans add D-90 and D-106 (named in CONTEXT's planning section) and SC-1..SC-4. No orphaned ID.
+
+| Requirement | Plans | Status | Evidence |
+|-------------|-------|--------|----------|
+| SC-1 | 03, 04, 05, 12, 13, 14 | PENDING RELEASE + G1 | see SC1 |
+| SC-2 | 01, 02, 06, 07, 08, 09, 11, 12, 13, 14 | ✗ PARTIAL | G3 |
+| SC-3 | 01, 02, 05, 06, 10, 11, 14 | ✓ | see SC3 |
+| SC-4 | 14 | ✓ | gate green |
+| D-30, D-32, D-22, D-93, D-95 | 03, 05, 12, 13 | ✓ | sitemap Docker suites |
+| D-24 | 03, 04, 05, 10, 13 | ✗ PARTIAL | G1 (CMS noindex excluded; Nuxt-only noindex address stays) |
+| D-31, D-34 | 04, 08, 12 | ✓ | TestImageSitemap, TestNewsSitemap, TestIndexNow, TestHTMLGroups, HTML sitemap smoke |
+| D-55, D-56 | 03, 06, 07 | ✓ | one source, x-default to default locale |
+| D-57 | 03, 06 | ✗ FAILED for Journal records | G3 |
+| D-33, D-12, D-25, D-94 | 05, 06, 08, 10, 12, 13 | ✓ | TestRegistry, TestRouteReport, TestLLMSTxt, TestNoindexPublishedConflict |
+| D-03, D-40, D-41, D-42, D-43, D-44, D-45, D-46, D-86, D-21 | 06, 08, 09 | ✓ (D-46 Rich Results link: human) | structured_data_test.go, schema tests, usePagination tests |
+| D-05, D-08, D-20, D-20a, D-20b, D-20c, D-103, D-97 | 07, 08, 09 | ✓ | smoke:ssr, purge:check, drift check |
+| D-23, D-70, D-71 | 08, 10, 12 | ✓ | guard:check, route meta noindex, TestRenderSkipped, TestChromeRenderer |
+| D-50, D-51, D-52, D-80, D-81, D-82, D-83, D-85, D-96 | 02, 09, 10, 11 | ✓ | headings_test.go, outline/forms tests, layer smokes (headings=strict, cardlinks), bodyLinks tests, TestAutolinks, image variants |
+| D-14, D-10 | 10, 04, 05, 06, 11 | ✓ | crawler suites, TestEveryAdminOperationHasTool, TestSitemapTools, TestJournalSettingsTools |
+| D-72 | 12 | ✓ | check-noindex.sh |
+| D-90, D-106 | 01, 11, 14 | ✓ (see warning W5) | marker and additive stages PASS |
+
+#### Decision Coverage
+
+The `check.decision-coverage-verify` handler could not parse 33-CONTEXT.md (decisions are tables, not `- **D-NN:**` bullets). Checked by hand: 48/48 CONTEXT decision IDs appear in plan `requirements:` fields. The 2026-10-28 planning decisions (Journal H1 setting, postTitleTag, links_new_tab, journal.breadcrumbs, WebP in Go, optional chromedp, SC3 reading, release cadence) are all present in code. Jakub's 2026-11-04 decisions: no uat (production after tags), demo on prefix_except_default (patches ready), WebP builds with -tags nodynamic (not yet in any app patch or build script: Task 4), the two recorded gaps (G1 here, G2 under warnings).
+
+#### Anti-Patterns and Warnings
+
+| File | Pattern | Severity | Impact |
+|------|---------|----------|--------|
+| (none) | No TBD/FIXME/XXX/TODO added in any phase repository since its base tag | — | — |
+| sm-seo-plugin classes/site.go:121 | G2: the site answer lists every content type's pattern, so with `golem15.journal.tag_pages` false the layer logs a false `journal-tag` drift warning at every start | ⚠️ Warning | Log noise only; recorded by Jakub as a gap. No must-have violated |
+| sm-seo-plugin resolver | W1: once the route report registers `/`, the home page title uses title_template instead of home_template (deferred-items, open) | ⚠️ Warning | Changes the home title on every site with the route report; grzyby sets it by CSV, the demo does not |
+| vue-seo-layer seoAbsolute | W2: path canonicals under swr become `http://localhost/...` when the backend has no site URL (pre-existing since v0.1.1) | ℹ️ Info | README requires the site URL |
+| sm-seo-plugin route report | W3: page names lose diacritics ("Trwaja prace") | ℹ️ Info | Fixed per site in SEO › Pages |
+| lagoon (framework) | W4: GORM auto timestamps in local time on hosts east of UTC (registry fixed in dfc85bc; other models not) | ℹ️ Info | Servers run in UTC |
+| framework v0.6.1 contents | W5: quick-task commits 335f8e6/d166f1c make `lagoon.Validate` check `min`/`max` as length on every non-numeric field; the notes say a stored value longer than `max` now fails its next admin save. This is a behaviour change in a release D-106 calls "strictly additive (patch)"; the additive stage checks API surface only | ⚠️ Warning | Release decision; affects core plugins in every consuming project (CLAUDE.md: no breaking changes in core plugins) |
+| deferred-items.md | Stale: "Saving Settings › Journal answers 500" is fixed on master by d2ce3a2 (ships in v0.6.1) but still says open | ℹ️ Info | Update the entry |
+| 33-13-sm-grzybyfunkcjonalne-app.patch | Its DEPLOY.md "Binary" row describes a dynamically linked build, contrary to the -tags nodynamic decision | ⚠️ Warning | Correct in Task 4 when adding the tag |
+
+#### Test Quality Audit
+
+| Area | Active | Skipped | Circular | Assertion level | Verdict |
+|------|--------|---------|----------|-----------------|---------|
+| 33-14 Go unit tests (29 files) | all | conditional `-short` and no-Chrome skips only; the gate refuses any skip and ran Docker and Chromium | none found | value / behavioural | OK |
+| 33-14 TS tests (10 files) | all | none (`it.skip`/`.todo` absent) | none | value | OK |
+| D-57 tests (TestHreflangAlternates, TestAlternates) | yes | no | no | value | INSUFFICIENT for the production path: the precondition (empty URL for an untranslated locale) exists only in the fixture (G3) |
+
+#### Human Verification Required
+
+Listed in frontmatter `human_verification`. In short:
+1. Escalation: fix or override G3 and G1 before the tags.
+2. SC1 on production grzybyfunkcjonalne.pl after Task 4: **pending the release, not a failure** (no uat; production since 2026-10-31; deploy after tags).
+3. urls.txt check on the tagged grzyby build before its deploy (pending the release).
+4. SC3 live MCP crawl → dry-run → apply session.
+5. Rich Results Test per page kind (D-46).
+6. Visual checks after the deploys (grzyby, demo on prefix_except_default, admin screens, J2 at 360px).
+7. Task 4 items not yet in any patch: -tags nodynamic in the app builds, locale patches, check-git-install.sh on the tag, changelog posts.
+
+#### Gaps Summary
+
+Two must-have truths fail, with different roots:
+
+- **G3 (D-57, SC2).** The SEO and sitemap plugins are correct for what the descriptor tells them, but the Journal descriptor reports every enabled locale with fallback content, so "no hreflang for a missing translation" does not hold for the main content type. The only proof is fixture-based. Not one of the two gaps Jakub recorded; deferred-items lists it as open ("the site is fixed by its data"). The fix is in sm-journal-plugin (a core plugin), so it is a decision: fix in the descriptors only (menu item alternates unchanged) before the v0.4.0 tag, or accept the data mitigation.
+- **G1 (D-24, SC1).** Recorded by Jakub as a gap, not fixed: a Nuxt-only noindex page listed as an Additional address stays in the sitemap; the crawler flags it but names a tool that cannot fix it.
+
+G2 (false drift warning) is the second gap Jakub recorded; it violates no must-have and is listed as a warning.
+
+If Jakub accepts either gap for this release, add an override and re-run verification; with both accepted, the expected status is human_needed (the release-time items above).
+
+```yaml
+overrides:
+  - must_have: "D-57 / SC2 hreflang: a page without a translation has no hreflang for that locale"
+    reason: "Journal descriptors report every enabled locale with fallback; sites disable locales without content (grzyby: pl only). Descriptor fix deferred to a follow-up (deferred-items 33-13)"
+    accepted_by: "{name}"
+    accepted_at: "{ISO timestamp}"
+  - must_have: "SC1 / D-24: the sitemaps stay consistent with noindex (noindex pages leave the XML and HTML sitemaps)"
+    reason: "Nuxt-only noindex pages listed as Additional addresses stay in the sitemap until the route report carries noindex paths (contract change); the crawler reports them as sitemap_noindex and the deploy steps remove the migrated addresses"
+    accepted_by: "{name}"
+    accepted_at: "{ISO timestamp}"
+```
+
+Regression check against Phase 32 (32-VERIFICATION.md, human_needed): the Phase 32 suites of sm-seo-plugin and sm-journal-plugin run inside the plugins and docker stages and pass; the Phase 32 human items (real-admin SEO tab walk-through, live MCP batch session, layout at 320/360px) remain open in 32-UAT.md and are not affected by a failing test here.
+
+---
+
+_Verified: 2026-11-04T20:20:34Z_
+_Verifier: Claude (msd-verifier)_
+
+---
+
+_Re-verified: 2026-11-04T23:53:40Z_
+_Verifier: Claude (msd-verifier)_

.planning/phases/33-seo-output-audit-and-content/33-release-log.md

@@ -0,0 +1,68 @@
+# Phase 33 release log
+
+The phase's release ledger. Plan 33-01 wrote the planned contents; plan 33-14 executes the releases and appends each step to "Executed steps" as it finishes, so a resumed run confirms each `step <n> done` row and skips it: no tag is created twice, no push is forced, a changelog post is published once. Nothing is pushed or tagged before 33-14 (2026-10-28 release cadence: all tags in 33-14).
+
+## Version base (Jakub, 2026-11-04)
+
+The plan text was written against v0.5.1 / v0.5.2. Tags v0.5.2, v0.5.3 and v0.6.0 were released in the meantime, so:
+
+- This phase delivers **SummerCMS v0.6.1**, a patch release: strictly additive (D-106).
+- `scripts/check-phase33.sh --additive` compares against the newest tag that does not contain HEAD (computed, currently **v0.6.0**).
+- `scripts/check-phase33.sh --marker` diffs from **v0.6.0** (`PHASE33_BASE`).
+- Wherever a Phase 33 plan says "v0.5.1" as the base or "v0.5.2" as the target, read v0.6.0 and v0.6.1.
+
+## Planned contents
+
+### Framework v0.6.1 (git.golem15.com/golem15/summercms)
+
+Plan 33-01 seams:
+
+- `feat(signpost): content descriptor fields for dates, parents, authors, media and outline` (561a56c): `pact.ContentDescriptor.Kind` and `Tools` with the `ContentKind*` and `ContentTool*` constants; `pact.ContentRecord.PublishedAt`, `Parents`, `Authors`, `TopHeading`; `pact.ContentLocale.Images`, `Videos`, `Headings`; the value types `ContentRef`, `ContentPerson`, `ContentImage`, `ContentVideo`, `ContentHeading`.
+- `feat(cabana): per-request options for plugin field types` (4cd35c9): `pact.FormFieldType.RequestOptions`, merged under the fields.yaml options of each form schema request.
+- `test: phase 33 gate script` (6ea43bb, `scripts/check-phase33.sh`).
+- Framework commits of later Phase 33 plans, if any, are added here by those plans.
+  - `docs(lagoon): attach/webp also decodes WebP` (1f96899, plan 33-15, L1 WR-02): docs only, the lagoon README and docs/database/attachments.md; no Go file changes.
+
+Also on master since v0.6.0, carried by the tag: 22 planning-docs commits of Phase 20 (677e30f..399efed); no code, module or docs change.
+
+Already released, not planned contents (the six Phase 32 fix commits, all in v0.5.2 and every later tag):
+
+- 676ca53 CR-01 check required extension fields on the lifted value (already released in v0.5.2)
+- 5471b66 CR-02 gate field type uploads on extension visibility (already released in v0.5.2)
+- d660cd0 CR-04 take widget actions dispatched from connectedCallback (already released in v0.5.2)
+- 468af06 WR-01 fire record events for hasMany link, unlink and deferred children (already released in v0.5.2)
+- 1583651 WR-02 report the request locale's primary tag on record events (already released in v0.5.2; meaning accepted by Jakub on 2026-11-04, see 33-01-SUMMARY)
+- 0e187cf WR-07 close the relation and partial routes of hidden owner fields (already released in v0.5.2)
+
+### Plugins and layers
+
+Newest tags when 33-01 ran, and the commits on HEAD since them:
+
+| Repository | Newest tag | Unreleased commits |
+|------------|------------|--------------------|
+| sm-sitemap-plugin | v0.1.2 | none |
+| sm-seo-plugin | v0.1.1 | none (the 22 commits since v0.1.0 are released in v0.1.1) |
+| sm-journal-plugin | v0.3.1 | none (the 6 commits since v0.2.5 are released in v0.2.6 to v0.3.1) |
+| vue-seo-layer | v0.1.1 | none |
+| vue-journal-layer | v0.7.1 | none |
+| vue-menu-layer | v0.4.0 | none |
+| vue-faq-layer | v0.4.0 | none |
+
+The versions each repository releases in this phase are read from `git tag` in 33-14 (next patch or minor after the newest tag, by what the phase changed there), not fixed here.
+
+## Release order
+
+1. Framework v0.6.1 (tag on master; changelog post on summercms.io/changelog).
+2. sm-journal-plugin (requires v0.6.1).
+3. sm-sitemap-plugin (requires v0.6.1).
+4. sm-seo-plugin (requires v0.6.1 and the sitemap plugin's filter seam).
+5. vue-seo-layer.
+6. vue-journal-layer, vue-menu-layer, vue-faq-layer.
+7. Applications: pointer and pin bumps (sm-demo-app, sm-grzybyfunkcjonalne-app, sm-summercmsio-app, sm-bm-app), each a separate commit after its plugin is pushed; deploys only with Jakub's go-ahead.
+
+Each plugin tag gets a post on summercms.io/changelog/plugins the same day.
+
+## Executed steps
+
+| Step | Repository | Action | Result |
+|------|------------|--------|--------|

.planning/phases/33-seo-output-audit-and-content/COVERAGE.md

@@ -6,12 +6,13 @@
 |---|---|---|
 | bulk URL submission (POST JSON {host, key, urlList} to api.indexnow.org) | INTEGRATE | |
 | key generation (32 hex characters from crypto/rand) and key rotation | INTEGRATE | |
-| key file served at the site root (/<key>.txt) | INTEGRATE | |
+| key file served at the site root (/<key>.txt; the plugin serves GET /_sitemap/indexnow/<key>.txt, the SEO layer maps the root name) | INTEGRATE | |
 | success answers 200 and 202 recorded as the last notification | INTEGRATE | |
 | 400 bad request recorded in the last status | INTEGRATE | |
 | 403 key not valid shown in the admin (S2 err_key) | INTEGRATE | |
 | 422 URLs not matching the host shown in the admin (S2 err_host) | INTEGRATE | |
 | 429 too many requests: retry with the job's attempts, shown in S2 (err_rate) | INTEGRATE | |
+| 5xx server errors and network failures: retry with the job's attempts (five) | INTEGRATE | |
 | batching at most 10 000 URLs per request | INTEGRATE | |
 | notification of new, changed and removed URLs (rebuild diff) | INTEGRATE | |
 | keyLocation parameter (key file elsewhere on the host) | OPT-OUT | the key file is served at the root, which covers every URL of the host; a key file elsewhere would narrow the URLs the key may submit |

.planning/phases/33-seo-output-audit-and-content/deferred-items.md

@@ -0,0 +1,197 @@
+# Phase 33 deferred items
+
+Out-of-scope discoveries logged during execution; not fixed in the plan that found them.
+
+## From 33-07 (vue-seo-layer)
+
+- **Path canonicals under swr become `http://localhost/...` (pre-existing since v0.1.1).** A route-cached (swr) render runs on a copy of the request without the Host header. `seoAbsolute(value, useRequestURL().origin)` then makes a canonical, og:url or og:image that the backend answers as a path (a backend without `golem15.seo.site_url` or `app.url`) absolute on `http://localhost`. Sites with the site URL set on the backend are not affected; the layer README already requires it.
+  - **Possible fix:** record the request origin in `event.context` in the `request` hook, as `seo-client-address.ts` does for the visitor address, and use it in `seoHeadInput`.
+  - **Why deferred:** it changes v0.1.1 output, so it needs a decision. The 33-07 playground keeps `'/blog/**'` swr instead of `'/**'` so the v0.1.1 `/relative` check stays meaningful.
+
+## From 33-02 (sm-journal-plugin)
+
+- **Saving Settings › Journal in the admin answers 500 (pre-existing, framework).** The admin settings save (`cabana` `settingsPut`) runs `lagoon.Validate` over every rule in `models.Settings.Rules()`. `lagoon.Validate` does not know the `string` and `url` rule tokens and returns `lagoon: unrecognized validation rule "string"`. The Journal rules have used `string` (`rss_title`) and `url` (`rss_image_url`) since before Phase 33, so the screen could not be saved before 33-02 either. The same tokens appear in sm-feedback-plugin and sm-paymentgateway-plugin models. Because of this, the new Headings and links switch cannot be saved from the admin until the framework is fixed. `PUT /_journal/api/v1/settings` and MCP `journal_update_settings` work: the 33-02 handler checks `string` and `url` itself.
+  status: resolved (framework d2ce3a2, `feat(lagoon): accept string and url rules in lagoon.Validate`, carried by v0.6.1; the stale entry closed in 33-15)
+  - **Possible fix:** teach `lagoon.Validate` the `string` and `url` tokens (`lagoon.ValidateRequest` already knows `string`). This is a framework change and belongs in v0.6.1 or a follow-up patch.
+  - **Why deferred:** 33-02 commits only to sm-journal-plugin, and the fix belongs in the framework. Dropping the tokens from Journal's `Rules()` would loosen validation in a core plugin.
+
+## From 33-03 (sm-sitemap-plugin)
+
+- **A repeater row takes no datepicker (framework).** cabana compiles a `datepicker` inside a `repeater` as an error ("type datepicker is not supported in a repeater (want text, textarea, number, checkbox, switch, dropdown or richeditor)"). The sitemap's Additional addresses row (UI-SPEC C26: `url` text left, `lastmod` datepicker right) therefore uses a text field read as `YYYY-MM-DD`, checked on save (`errors.lastmod`). WINDOWS.md #30.
+  status: open
+  - **Possible fix:** support `datepicker` (mode date) in repeater rows in cabana and the SPA's RepeaterField, then switch the field type in `sm-sitemap-plugin/models/settings/fields.yaml`.
+  - **Why deferred:** 33-03 commits only to sm-sitemap-plugin; the gap is generic framework work (additive, but its own change).
+- **A partial cannot link off the admin's origin (by design).** cabana's partial renderer keeps only root-relative `a[href]` values (`safePartialURL`), so the S1 files table links each file to the backend route that serves it (`/sitemap.xml`, `/_sitemap/files/<name>`) instead of the public site URL; the note under the table names the public index address. No change needed unless public links in partials become a requirement.
+
+## From 33-08 (vue-seo-layer)
+
+- **`scripts/check-phase33.sh --layers` cannot pass (gate script).** Its `npm_vitest` step runs `npm run test` in each layer and then requires a vitest summary (`detect_vitest`). All four layers (vue-seo-layer, vue-journal-layer, vue-menu-layer, vue-faq-layer) run `node --test --test-reporter=tap`, so the stage refuses on the first layer although every test passes ("refuse: no all-passing vitest summary", `test=0 detect=3`).
+  status: resolved (33-14: `node_tap` with a TAP detector and self-tests in scripts/check-phase33.sh; `--all` green)
+  - **What 33-08 ran instead:** each step of the stage by hand: `npm run test`, `npm run build:playground` and the smokes of all four layers, `testing/guard-check.mjs` in vue-seo-layer. All passed.
+  - **Possible fix:** a `node_tap` helper in the gate (TAP `# fail 0` and no `not ok`) used for the layers, keeping `npm_vitest` for sm-seo-plugin and sm-journal-plugin.
+  - **Why deferred:** 33-08 commits only to vue-seo-layer; the gate script is framework planning tooling of 33-01.
+
+## From 33-04 (sm-sitemap-plugin)
+
+- **A taglist cannot offer per-request options (framework).** C26 asks for the News sources taglist with `customTags: false` and options from the article types and their categories. cabana compiles taglist `options` as a fixed YAML list, and a form extension may not add a taglist field, so the options cannot come from the records. The field accepts custom tags; the `news_sources` partial under it lists the values the site has, each value is checked on save (`errors.news_source`), and MCP `sitemap_get_settings` answers them as `news_source_options`. WINDOWS.md #31.
+  status: open
+  - **Possible fix:** per-request options for core taglist fields (as `pact.FormFieldType.RequestOptions` does for plugin field types), or taglist support in form extensions; then set `customTags: false` with those options in `sm-sitemap-plugin/models/settings/fields.yaml`.
+  - **Why deferred:** 33-04 commits only to sm-sitemap-plugin; the gap is generic, additive framework work.
+
+## From 33-09 (journal, menu and FAQ layers)
+
+- **Extending vue-seo-layer turns the router on in an app without pages (vue-seo-layer, 33-08 behaviour).** The SEO layer registers its HTML sitemap pages through `extendPages`, and Nuxt counts pages added that way when it decides whether the app has pages. An app that only has `app.vue` (the menu and FAQ playgrounds) therefore gets vue-router, and every path answers "Page not found". 33-09 sets `seo: { htmlSitemap: false }` in those two playgrounds and documents the switch in the vue-seo-layer, vue-menu-layer and vue-faq-layer READMEs. Real sites have pages and are not affected.
+  status: open
+  - **Possible fix:** register the sitemap pages only when the app has pages of its own (in `pages:extend`, skip when the list holds only the layer's), or set `pages: true` only when the app has a pages directory.
+  - **Why deferred:** a change to 33-08's registration logic in vue-seo-layer, outside 33-09's scope; the documented switch covers the case.
+- **vue-journal-layer `scripts/check-git-install.sh` will not pass as it is (release tooling, 33-14).** Its lockfile check (`grep … commit: [0-9a-f]{40}`, exactly one commit) fails once vue-seo-layer is a git dependency too (two commits in the lockfile). Its scratch app also lacks the playground config the expectations rely on: `journal.routes.search` (the search lines, already since the search page), `journal.perPage.category: 1` and the layout breadcrumb trail (33-09 lines). And during development the layer depends on `link:../vue-seo-layer`, which a git install cannot resolve.
+  status: partly resolved (33-14, vue-journal-layer e8f307b: the lockfile check counts only the layer's commit, the scratch app takes the playground's nuxt.config.ts and app.vue, `--self-test`); the `link:../vue-seo-layer` dependency is replaced by the tag pin in 33-14 Task 4, after which the script runs against the tag
+  - **Possible fix (33-14):** switch the link to the git tag pin first, filter the lockfile check to the vue-journal-layer entry, and give the scratch app the playground's `journal` options and `app.vue` (or run a subset expectation file).
+  - **Why deferred:** 33-14 replaces the link dependency and tags the layers; the script is part of that release step.
+- **The journal fixture API's previous_post/next_post direction is the opposite of the Go API's (test fixture).** `testing/fixture-api.mjs` answers `previous_post` with the next older post; sm-journal-plugin's `siblingPost` answers it with the next newer one (`previous` → `published_at >` ascending). The layer renders whatever it gets, so no page is wrong. The fixture is less faithful than it looks.
+  status: open
+  - **Possible fix:** swap the two in the fixture API and adjust the expectation lines that name a neighbour.
+  - **Why deferred:** pre-existing, not caused by 33-09; changing it changes existing expectations.
+
+## From 33-06 (sm-seo-plugin)
+
+- **A repeater cannot carry a trigger (framework).** cabana refuses `trigger` on `type: repeater`, so the SEO settings' opening hours (`local_hours`, UI-SPEC C20) stay visible while the Local business switch is off; every other local field hides.
+  status: open
+  - **Possible fix:** allow `trigger` (hide/disable) on repeater fields in cabana and the SPA, then add it to `local_hours` in `sm-seo-plugin/models/settings/fields.yaml`.
+  - **Why deferred:** 33-06 commits only to sm-seo-plugin; the gap is generic, additive framework work.
+
+## From 33-10 (sm-seo-plugin)
+
+- **A list filter cannot have a default value (framework).** UI-SPEC C23 asks the Site audit's status filter to default to Open so ignored issues stay hidden until chosen. cabana's `config_filter.yaml` scopes take no default and `ListExtendQuery` does not see the filter values, so the list shows every current issue and marks ignored ones with the **Ignored** row badge; choosing **Open** hides them. GET `/_seo/api/v1/issues` and `seo_list_issues` do default to `status=open`. WINDOWS.md #32.
+  status: open
+  - **Possible fix:** a `default` key on filter scopes in cabana and the SPA, then `default: open` on `status` in `sm-seo-plugin/controllers/issues/config_filter.yaml`.
+  - **Why deferred:** 33-10 commits only to sm-seo-plugin; the gap is generic, additive framework work.
+- **A partial cannot link to another site (framework).** P7 should link **Open the page** (new tab) and **Check in Google's Rich Results Test**. The partial allowlist keeps `a[href]` only for same-origin paths, and the site is on another origin than the admin, so P7 shows both as labelled addresses in DM Mono. WINDOWS.md #33.
+  status: open
+  - **Possible fix:** let partials carry an absolute http(s) link that the SPA opens in a new tab with `rel="noopener noreferrer"` (the account contributions already accept such URLs), then turn the two lines into links.
+  - **Why deferred:** a change to cabana's sanitizer and the SPA, outside 33-10's repository.
+- **The settings tile description and the permission comment still have the Phase 32 text (sm-seo-plugin).** UI-SPEC's replacement texts name auto-links, which arrive in 33-11, together with the site audit.
+  status: resolved (33-11, sm-seo-plugin `ab4e834`: `settings.description` and `permissions.manage_comment` in en and pl carry the UI-SPEC texts)
+  - **Possible fix:** 33-11 replaces `settings.description` and `permissions.manage_comment` in both phrasebooks with the UI-SPEC texts once Auto-links exists.
+  - **Why deferred:** the new texts describe a screen that does not exist yet.
+
+## From 33-11 (sm-seo-plugin, framework, sm-journal-plugin)
+
+- **Binaries that mount sm-journal-plugin are dynamically linked against glibc (framework `attach/webp`, decision needed in 33-14).** `github.com/gen2brain/webp` loads the system libwebp through purego, and purego's no-cgo runtime makes an importing binary dynamically linked even with `CGO_ENABLED=0`: it needs `/lib64/ld-linux-x86-64.so.2`, `libc.so.6`, `libdl.so.2` and `libpthread.so.0`. It runs on the Debian servers. It does not run in a `scratch`, distroless-static or musl (Alpine) image. `-tags nodynamic` keeps the binary static and uses only the transpiled encoder (about five times slower). Recorded in `.planning/notes/2026-10-28-webp-gen2brain.md`.
+  status: open
+  - **Possible fix:** none needed for the current deploys. For a static deploy, add `-tags nodynamic` to the app's `scripts/build.sh` (or `build.tags` in `summer.yaml`). For the fast path, install `libwebp-dev` on the server: the package opens the unversioned `libwebp.so` and `libwebpdemux.so`.
+  - **Why deferred:** a deployment choice per application; 33-14 bumps the apps and decides.
+- **E10 is left out by content kind, not by the descriptor's `Words` (sm-seo-plugin).** UI-SPEC C16 row 14 omits `seo_links` for types whose descriptor supplies no body (`Words` null). `Words` is a per-record, per-locale fact (`pact.ContentLocale.Words`), so the SEO tab, compiled per type at boot, cannot read it. 33-11 omits E10 for the kinds `collection` and `profile` and for the page registry (`seo-page`), and shows it for every other type.
+  status: open
+  - **Possible fix:** a type-level fact such as `pact.ContentDescriptor.HasBody` (framework, additive), read by `hasBody` in `sm-seo-plugin/extensions.go`.
+  - **Why deferred:** a framework change, outside 33-11's repositories for this task.
+- **The Auto-links list sorts by phrase in the database's byte order (framework).** cabana's sortable column orders by the raw column, so with the test database's collation "Lwia grzywa" comes before "boczniak". `GET /_seo/api/v1/autolinks` sorts by `lower(phrase)`.
+  status: open
+  - **Possible fix:** a case-insensitive or collated sort option on list columns in cabana (`lagoon.Collate` exists for queries), then use it on `phrase` in `sm-seo-plugin/models/autolink/columns.yaml`.
+  - **Why deferred:** generic, additive framework work.
+- **Variant rows of a featured image removed in the admin stay in `golem15_journal_image_variants` (sm-journal-plugin).** The table has no foreign key to `system_files`, because the plugin's migration tests run without the framework tables. `DELETE /_journal/api/v1/posts/{id}/featured-images/{fileId}` deletes the rows. A file removed through the admin's file field leaves them; they are never listed, because the API joins on the post's current files, and their blobs go with the thumbnail prefix.
+  status: open
+  - **Possible fix:** delete rows whose `file_id` no longer exists in the posts controller's save hook, or in `journal:image-variants`.
+  - **Why deferred:** harmless leftovers; a cleanup belongs with the next Journal media change.
+- **A post whose featured image is narrower than every configured width queues a no-op job on each admin save (sm-journal-plugin).** Such an image never gets a variant row, so `DispatchPostImageVariantsAfterCommit` counts it as missing. The job reads its header and writes nothing.
+  status: open
+  - **Possible fix:** record the original's size for files without variants (for example a row with width 0), and skip them in `featuredFiles`.
+  - **Why deferred:** cheap and rare (featured images are usually wider than 480 px).
+
+## From 33-12 (demo, summercms.io and bm on local links)
+
+- **The demo's Polish addresses answer 404 (sm-demo-app, decision needed before 33-14 applies the demo patches).** The demo serves Polish from a cookie at the same address (vue-demo-app `i18n.strategy: 'no_prefix'`, D-13 of the demo). The Journal, sitemap and SEO plugins give every non-default locale a `/<code>` prefix (sm-journal-plugin README, "Every resolved record carries alternates…"). So the CMS answers have three consequences on the demo:
+  - every post, category and author page carries `<link rel="alternate" hreflang="pl" href="…/pl/blog/…">`;
+  - the sitemaps list 8 of 23 addresses under `/pl/…`, and each of those answers 404;
+  - a visitor with the Polish cookie gets the English CMS title and description over a Polish body, because the resolve goes by address and answers `en`.
+  `scripts/smoke-seo.sh` prints these as WARN lines; with `SMOKE_SEO_STRICT=1` they fail.
+  status: patch ready (33-14: 33-14-vue-demo-app-locale.patch and 33-14-sm-demo-app-locale.patch on top of the 33-12 demo patches; rehearsed with `SMOKE_SEO_STRICT=1 scripts/smoke-seo.sh`: ok, 23 sitemap addresses, 0 not 200); applied in Task 4
+  - **Possible fix:** move the demo to `strategy: 'prefix_except_default'` (Polish at `/pl/…`, the HTML sitemap path `/pl/mapa-strony`, locale-aware links in the demo's pages and LanguageSwitcher). The other way is a framework, Journal and SEO option for "every locale at one address", which would give the site no hreflang at all.
+  - **Why deferred:** it reverses a recorded demo decision and changes every Polish URL of the demo (Rule 4); 33-12 runs without a human.
+- **Additional addresses are not de-duplicated against content records (sm-sitemap-plugin).** On a database migrated from the old definition (rome), migration `202610280002` copies its url items (`/`, `/blog`, `/faq`, `/subscriptions`) into the additional addresses. Once the route report has put `/`, `/blog` and `/faq` into the page registry, `sitemap-pages-1.xml` lists each of them twice. The demo patch's DEPLOY.md removes the copied addresses after the first release. sm-grzybyfunkcjonalne-app's companion items (33-13) can meet the same case.
+  status: resolved (33-14, sm-sitemap-plugin 096b6f6: an additional address a listed record has is left out as `duplicate`, counted on the settings screen)
+  - **Possible fix:** in `classes.Rebuild`, skip an additional address whose absolute URL a content type already lists, or report the overlap on the settings screen.
+  - **Why deferred:** a plugin change in sm-sitemap-plugin, outside 33-12's repositories; the demo works around it in its deploy steps.
+- **An additional address that the site serves noindex stays in the sitemap (sm-sitemap-plugin, sm-seo-plugin).** The SEO filter judges the CMS's effective SEO only, while `requiresAuth` and `seo.robots` page meta (D-23) live in Nuxt. A page marked that way and also listed as an additional address (the demo's migrated `/subscriptions`) appears in the sitemap with `X-Robots-Tag: noindex, nofollow`. smoke-seo.sh fails on it, and the demo's DEPLOY.md removes the address.
+  status: resolved (gap G1; CMS side 33-15: sm-seo-plugin 9de6b2e stores the route report's `noindex` paths in `golem15_seo_noindex_paths` and the sitemap filter leaves them out with the reason noindex, sm-sitemap-plugin 6b67ab7 `contract.Rebuilder` rebuilds on a changed set, and the audit names `sitemap_update_settings` for a noindex Additional address; layer side 33-16: vue-seo-layer sends the list)
+  - **Possible fix:** the route report also sends the noindex static paths (as `noindex` entries), and the filter leaves them out of the sitemaps.
+  - **Why deferred:** a contract change across vue-seo-layer and sm-seo-plugin.
+- **The site answer lists the `journal-tag` pattern while `golem15.journal.tag_pages` is false (sm-seo-plugin).** `classes/site.go` adds every content type's pattern. vue-seo-layer then logs `[vue-seo-layer] drift: the CMS's journal-tag URLs (/blog/tag/:slug) match no Nuxt route` at every start of the demo, although tag paths no longer resolve (TestSEOOutput).
+  status: deferred to v0.6.2 (gap G2, 33-15): it needs the framework. `signpost.Activate` refuses a menu item type whose DefaultPattern does not start with `/` (modules/signpost/signpost.go), so sm-journal-plugin cannot register journal-tag without a pattern while tag pages are off; dropping the tag descriptor instead would remove the tag form's SEO tab and the sitemap's types row. Possible fixes: an additive `pact.ContentDescriptor` field (for example `Routable func(ctx) bool`) read by `classes/site.go`, or a signpost rule that accepts an empty DefaultPattern for a type that resolves no URL
+  - **Possible fix:** leave out a type whose descriptor resolves no URL (the Journal could report tag pages off on its descriptor).
+  - **Why deferred:** log noise only; a plugin change outside 33-12.
+- **`Duplicated imports "JournalImageVariant"` on every build of an app with vue-journal-layer (vue-journal-layer).** The type is declared in `app/utils/srcset.ts` and re-exported from `app/utils/types.ts`, both auto-imported.
+  status: resolved (33-14, vue-journal-layer c6ffa6c: types.ts no longer re-exports it; tests/autoImports.test.ts checks every auto-imported name has one home)
+  - **Possible fix:** drop the re-export from `types.ts`, or move the interface to `types.ts` only.
+  - **Why deferred:** a warning only; a layer change, best done before the v0.8.0 tag in 33-14.
+- **Both DEPLOY.md files call the binary "static" (sm-demo-app, sm-summercmsio-app).** Once the apps require the new sm-journal-plugin, their `CGO_ENABLED=0` release builds are dynamically linked (`file bin/demo`: "dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2"). With `-tags nodynamic` they are static again. Checked in 33-12 on both scratch builds.
+  status: open, decision at the 33-14 release checkpoint (per-app options and a recommendation in the checkpoint report)
+  - **Possible fix:** 33-14 decides per app: add `nodynamic` to `scripts/build.sh` (and summer.yaml `build.tags`), or change the DEPLOY.md table to "dynamically linked (glibc)".
+  - **Why deferred:** the linking decision is 33-14's (33-11).
+
+## From 33-13 (grzybyfunkcjonalne.pl on local links)
+
+- **An enabled locale without content gives every page an `/en/` hreflang link and sitemap address (sm-seo-plugin, sm-sitemap-plugin).** sm-grzybyfunkcjonalne-app's translate plugin kept its seeded `en` row enabled (migrate.sh only made `pl` the default). Every record then counts as available in `en` through fallback: post pages render `<link rel="alternate" hreflang="en" href="…/en/blog/…">` and `sitemap-posts-1.xml` lists each post twice, with `x-default` on the `/en/` address, all 404 on the Polish-only site. The 33-13 patch makes `pl` the only enabled locale in migrate.sh step 3 and in a DEPLOY.md release step (`UPDATE golem15_translate_locales SET is_enabled = (code = 'pl')`).
+  status: resolved (gap G3, 33-15, sm-journal-plugin 0a62090: the Journal descriptors give a locale a URL only when the record has content in it; posts and categories by their own translation, tags and authors through a published post translated into it, the default locale always; an untranslated locale keeps its entry with URL "", which the SEO and sitemap plugins drop). The grzyby data fix in migrate.sh and DEPLOY.md stays valid; an untranslated address still answers with the default-locale content (see "From 33-15")
+  - **Possible fix:** list a locale's address only when the record has content in it (a translation row, or the default locale), not through fallback.
+  - **Why deferred:** a plugin behaviour change; the site is fixed by its data.
+- **Saving a registry page through `PUT /_seo/api/v1/pages/{id}` writes `updated_at` in local time (sm-seo-plugin).** In the 33-13 rehearsal (database in UTC, machine in CET), the renamed `/trwaja-prace` got `updated_at` 17:58:54 while the route-reported pages got 16:58:54, so `sitemap-pages-1.xml` and the index carried a lastmod one hour in the future.
+  status: resolved (33-14, sm-seo-plugin dfc85bc: `Page.BeforeSave` stamps both timestamps in UTC for the admin's and the API's saves; the admin create had the same problem). The cause is framework-wide: GORM's default NowFunc is local time, so every model's auto timestamps on a server east of UTC are local (see "From 33-14")
+  - **Possible fix:** write UTC (or a `timestamptz` column) on the page update path, as the route report does.
+  - **Why deferred:** a plugin bug outside 33-13's files; the lastmod corrects itself on the next content change.
+- **`/` as a registry page loses the home title template (sm-seo-plugin).** Once the route report registers `/` ("Strona główna"), its title comes from the record through `title_template` ("Strona główna | Grzyby Funkcjonalne") instead of `home_template` ("Witamy | %site%"). 33-13's `deploy/seo-pages.csv` sets the home title explicitly.
+  status: open
+  - **Possible fix:** the home page keeps `home_template` unless its record sets a title.
+  - **Why deferred:** a resolver precedence question for the plugin.
+- **The route report names pages without diacritics (sm-seo-plugin).** `/trwaja-prace` becomes "Trwaja prace", shown in the HTML sitemap, the breadcrumbs and the WebPage node. 33-13 renames it in SEO › Pages (DEPLOY.md step).
+  status: open
+  - **Possible fix:** the layer reports each static page's title (its page meta) with the path.
+  - **Why deferred:** a contract change across vue-seo-layer and sm-seo-plugin.
+- **No personal-token scope covers the SEO or sitemap management API (sm-seo-plugin, sm-sitemap-plugin).** `admin:token:scopes` lists `*`, `admin:read`, `journal` and `journal:read` only, so a script that imports a CSV or edits sitemap settings needs a full-scope token. smoke.sh creates one and revokes it after its steps.
+  status: open
+  - **Possible fix:** declare `seo`, `seo:read`, `sitemap` and `sitemap:read` scopes.
+  - **Why deferred:** a plugin feature.
+- **`journal:image-variants` cannot run from the generated CLI (framework or sm-journal-plugin).** It stops with `journal: database is not configured`, like `journal:reindex` (which grzyby wraps as `grzyby:reindex`). The one-time backfill of existing featured images that 33-11 names needs a wrapper or a framework fix; new uploads get their variants from the worker in `serve`.
+  status: resolved (33-14, sm-journal-plugin fc3c255: without a published database or bucket the command opens `database.dsn` and `storage.uploads.bucket_url` itself; 33-15, sm-journal-plugin 5f683cb: `journal:fix-headings` does the same, L1 WR-01). `journal:reindex`, `journal:import-posts` and `journal:export-posts` still use the published database only
+  - **Possible fix:** the generated CLI opens the database for plugin commands, or the app adds `grzyby:image-variants`.
+  - **Why deferred:** decided with 33-14's release steps.
+- **The Journal's seeded `uncategorized` category is listed in `sitemap-categories-1.xml` (sm-grzybyfunkcjonalne-app data).** It has no posts and the PHP sitemap never listed it (7 categories), but `/uncategorized` answers 200 and the per-type file lists every published category.
+  status: open
+  - **Possible fix:** delete the empty seeded category on the server, or mark it noindex in its SEO tab.
+  - **Why deferred:** an editorial data decision for Jakub.
+
+## Decided for 33-14 (Jakub, 2026-11-04)
+
+- **The demo moves to `prefix_except_default` (sm-demo-app, vue-demo-app; reverses demo D-13).** Answers 33-12's "The demo's Polish addresses answer 404". English stays at `/`, Polish moves to `/pl/…`. This matches the `/<code>` prefix that the Journal, sitemap and SEO plugins give every non-default locale, so the hreflang links and the `/pl/…` sitemap addresses answer 200.
+  status: decided
+  - **Apply in 33-14, on top of the 33-12 demo patches:**
+    - `i18n.strategy: 'prefix_except_default'` in vue-demo-app;
+    - the HTML sitemap path `/pl/mapa-strony`;
+    - locale-aware links in the demo's pages and the LanguageSwitcher;
+    - the demo's urls and smoke expectations moved to the `/pl/…` addresses;
+    - run `smoke-seo.sh` with `SMOKE_SEO_STRICT=1` so the WARN lines fail.
+  - **Notice:** every Polish URL of the demo changes; the cookie-at-the-same-address behaviour of D-13 is gone.
+
+## From 33-14 (release preparation)
+
+- **GORM stamps `created_at` and `updated_at` in the process's local time (framework, lagoon).** No module sets `gorm.Config.NowFunc`, so GORM's default (`time.Now().Local()`) fills every model's auto timestamps; a `timestamp` column keeps the wall clock, so on a machine east of UTC every auto-stamped row is ahead by the offset. The registry page path is fixed in sm-seo-plugin (dfc85bc); auto-links, rules, entries and every other plugin's models are not. The servers run in UTC, so production is not affected today.
+  status: open
+  - **Possible fix:** `lagoon.Open` sets `NowFunc: func() time.Time { return time.Now().UTC() }` (a behaviour change for non-UTC hosts; needs a decision), or each plugin stamps UTC itself.
+  - **Why deferred:** framework-wide behaviour, not one of the six fixes.
+- **The route report sent the i18n copies of every page as pages of their own (vue-seo-layer).** Found by the demo locale rehearsal: with `prefix_except_default` the report sent `/pl`, `/pl/contact`, … next to `/`, `/contact`, and the registry made seven untranslated pages of them.
+  status: resolved (33-14, vue-seo-layer b3a0078: routes named with another locale's suffix are left out; their translations are set per page in SEO › Pages). A follow-up could report the locale paths so the plugin fills each page's addresses itself (a contract change).
+
+## From 33-15 (Go plugins: gap fixes before the release)
+
+Deferred to the v0.6.2 backlog item, by repository. Fixed in 33-15: G1 (CMS side), G3, L1 CR-01, CR-02, WR-01, WR-03, WR-05 (WR-02 as docs), L2 WR-01 to WR-05 and IN-01, L3 CR-01, WR-01, WR-03, WR-04 and WR-06.
+
+- **sm-sitemap-plugin:** L2 WR-06 (a default file slug can collide with a reserved or another type's slug), WR-07 (no 50 MB byte guard on image and hreflang files), WR-08 (Additional addresses on other hosts); info IN-02 to IN-11.
+  status: open (v0.6.2)
+- **sm-seo-plugin:** L3 WR-02 (crawl limits beyond the job timeout and memory: validate `crawl_max_pages × crawl_delay`, cap the frontier, store pages in chunks), WR-05 (recheck fetches inside a write transaction); info IN-01 to IN-07; G2 (the journal-tag pattern while tag pages are off, see the 33-12 entry: needs an additive pact field such as `ContentDescriptor.Routable`, a framework change, or a signpost rule for an empty DefaultPattern).
+  status: open (v0.6.2)
+- **sm-journal-plugin:** L1 WR-04 (images/alt keys `""` and the default locale code apart), WR-06 (author pages publish backend logins as slugs and names), WR-07 (the settings API's stale `string`/`url` workaround); info IN-01 to IN-04, IN-08. An untranslated locale's address still answers with the default-locale content and a self canonical; it is no longer advertised in hreflang or the sitemaps, and a canonical to the default locale or a 404 there is a separate decision.
+  status: open (v0.6.2)
+- **summercms.go:** L1 WR-02 as code (decode WebP in `attach` with the pure Go decoder explicitly, or a decision note; 33-15 documents the behaviour only); info IN-05, IN-06, IN-07, IN-09; verifier warnings W1 (the home title template once `/` is registered), W2 (swr localhost canonicals), W3 (route report names without diacritics), W4 (GORM local timestamps), W5 (the min/max length change in a patch release, a release decision).
+  status: open (v0.6.2)
+- **Nuxt layers:** L4 WR-06, WR-07 and the L4 info items, planned and deferred in 33-16.
+  status: open (v0.6.2)

.planning/phases/34-plugin-marketplace/34-release-log.md

@@ -356,7 +356,18 @@ If a rebase or a check changes a plugin's version before tagging, update this li
 
 | Step | Date | What was done | Result (SHA, tag object, URL) |
 |------|------|---------------|-------------------------------|
-| | | | |
+| 1 | 2026-10-30 | `scripts/check-phase34.sh --all` | `Phase 34 gate passed` |
+| 2 | 2026-10-30 | Framework master pushed, `v0.6.0` tagged (message above) and pushed; changelog post | master 76288cd, tag object c8241c8; https://summercms.io/changelog/summercms-0-6-0 (post 57) |
+| 3 | 2026-10-30 | 21 plugin tags on the commits of the table (no rebase needed), pushed with their branches; no plugin posts | tags as in the table, each on its listed commit |
+| 3 | 2026-10-30 | sm-chat-plugin: manifest commit rebuilt on origin/main 51c9e17 (go.mod requires v0.6.0, plugin.yaml regenerated), `v0.1.4` | db3b518 (old commit kept as branch `backup/manifest-pre-rebase`) |
+| 3 | 2026-10-30 | sm-chatchannels-plugin and sm-chatbots-plugin: same on origin/main, sm-chat-plugin v0.1.3 kept, `v0.1.0` each | chatchannels 017843a, chatbots 24eadf6 (backups as above) |
+| 4 | 2026-10-30 | sm-summercmsio-plugin `v0.1.0` on 0b3fbf4 (includes the review fixes after c52e721); vue-summercmsio-app master pushed | tag on 0b3fbf4; vue 8267c55 |
+| 5 | 2026-10-30 | sm-summercmsio-app: pointer bumps (journal v0.2.6, translate v0.1.3, user v0.1.19, site plugin v0.1.0, vue 8267c55) 668a773, regeneration c3f2027; release build (framework v0.6.0), `smoke: ok`, pushed | master c3f2027 |
+| deploy | 2026-10-30 | summercms.io on rome: migrate (registry tables), swap, new changelog supervisor program and nginx vhost, restart; `registry-add` of the fourteen launch repositories and first ingest (15 plugins: pgstripe carries two) | API 200 with CORS/cache headers, `/marketplace` 200, POST ingest 401, POST plugins 403; landing shows 0.6 |
+| 5 | 2026-10-30 | sm-demo-app: go.mod requires v0.6.0 and all 17 plugin tags 2133309, pointer bumps 5ec5941, regeneration 2ea5be3, roadmap snapshot 56c1141; release build, `smoke: ok`, `check-deploy: ok`, pushed | master 56c1141 |
+| deploy | 2026-10-30 | demo.summercms.io on rome: migrate (21, first release with seo, mfa, sociallogin, oauthserver mounted), seed, swap, restart, new vhost (MCP and robots.txt locations); SEO robots.txt rules written from the Nuxt `goPaths` list plus `/_seo` | `check-live: ok`, MCP metadata 200 and POST /mcp 401, robots.txt served by golem15.seo |
+
+Not done in this run (outside the requested scope): the pointer bumps of sm-grzybyfunkcjonalne-app, sm-bm-app (including the three rebased chat plugins: chat db3b518, chatchannels 017843a, chatbots 24eadf6) and fonoteka.go, which carry unpushed work of their own and deploy separately; adding the ten other tagged repositories (chatvideo, forum, herald, userfriends, chatchannels, chatbots, golem, feedback, quizzes, presentations) to the registry; the registry token.
 
 
 **Note (2026-10-30, presentations):** sm-bm-app's mount had an unpushed commit `d205cd7 feat: offer the sztab presentation theme` (gitlink committed in sm-bm-app 9929195). The README and manifest commits were rebased onto it in `../sm-presentations-plugin` (new SHAs cfa0c40, 3eb4de7), so v0.1.2 includes the theme and both app bumps are fast-forwards. Push `../sm-presentations-plugin` master (it carries d205cd7); the mount in sm-bm-app then fast-forwards to 3eb4de7.

.planning/quick/261104-f4x-lagoon-validate-string-and-url-rules/261104-f4x-PLAN.md

@@ -0,0 +1,199 @@
+---
+phase: quick-261104-f4x
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/en/validate.yaml
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validate.yaml
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/settings_string_url_test.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/README.md
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/docs/database/casts-and-validation.md
+autonomous: true
+requirements:
+  - quick-261104-f4x
+
+estimate:
+  tokens: 45000
+  raw_tokens: 45000
+  tasks: 2
+  confidence: low
+
+must_haves:
+  truths:
+    - "Saving an admin settings model whose Rules() hold nullable|string|max:255 and nullable|url|max:500 through cabana's SettingsService.Put succeeds for valid values, empty strings and null; the lagoon: unrecognized validation rule \"string\" / \"url\" error is gone (the Settings > Journal bug)"
+    - "A value that is not a string under string gets \"The <attribute> must be a string.\"; a value that is not a URL under url (Laravel's pattern, the urlPattern lagoon.ValidateRequest already uses) gets \"The <attribute> format is invalid.\"; with the pl translator they are the Polish lagoon::validate lines"
+    - "string and url skip an empty or blank value (nil, nil pointer, pointer to empty string, whitespace-only string); required stays the rule that rejects emptiness, and required|string on an empty value reports only the required message"
+    - "On a string or url field that is not numeric/integer, min:N and max:N compare the length in characters (runes): 256 characters fail max:255 with \"The <attribute> may not be greater than 255 characters.\", 255 Polish letters (510 bytes) pass"
+    - "Rule strings without string or url give exactly the results they gave before: every existing lagoon and cabana test passes unchanged, between keeps its existing check, and an unknown token still returns the unrecognized-rule error"
+    - "modules/lagoon/README.md and docs/database/casts-and-validation.md list string and url among the lagoon.Validate rules and describe their empty-value and length behaviour; the docs checker passes"
+  artifacts:
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go
+      provides: "string and url cases in validateField, ruleString helper, min/max character-length check for string/url fields, string/url/min.string/max.string messages in validateMessage"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/en/validate.yaml
+      provides: "lagoon::validate.string and lagoon::validate.url (en)"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validate.yaml
+      provides: "lagoon::validate.string and lagoon::validate.url (pl)"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go
+      provides: "table tests: pass / fail / nullable-empty / pointer / translated / length"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/settings_string_url_test.go
+      provides: "TestSettingsStringURLRules (no Docker, the Put validation sequence) and TestSettingsStringURLRulesPostgres (SettingsService.Put end to end)"
+  key_links:
+    - from: "modules/cabana/settings.go SettingsService.Put (line ~267)"
+      to: "lagoon.Validate -> validateField string/url cases"
+      via: "settingRules(setting, model) + valuesForRules(model, rules) (model struct field values: string, *string, named string types)"
+    - from: "validateField url case"
+      to: "urlPattern in modules/lagoon/validate_rules.go (~line 1223)"
+      via: "direct reuse of the package-level regexp, no new pattern"
+    - from: "validateMessage"
+      to: "lagoon::validate.string / lagoon::validate.url and lagoon::validation.min.string / lagoon::validation.max.string"
+      via: "phrasebook keys with English fallbacks for a nil translator (cabana passes nil)"
+---
+
+<objective>
+Teach `lagoon.Validate` (the model/settings validator) the Laravel rule tokens `string` and `url`, so admin settings screens whose model rules use them save again.
+
+Purpose: `modules/cabana/settings.go:267` validates a settings save with `lagoon.Validate` and the model's `Rules()`. The Journal settings model (and reportedly feedback and payment gateway models) uses `nullable|string|max:255` and `nullable|url|max:500`; `validateField` rejects any token it does not know before looking at the value, so Settings > Journal fails with `lagoon: unrecognized validation rule "string"`. The change is additive and generic: only rule strings that contain `string` or `url` (which errored until now) get new behaviour. Target release is framework v0.6.1 (phase 33 in progress): do not tag, push or touch sibling repos.
+
+Output: two framework commits (Task 1 the tokens, Task 2 the length semantics), each with its tests and doc updates, per the CLAUDE.md rule that a module API change updates its README and docs in the same commit.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/CLAUDE.md
+@/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go
+@/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go
+
+Working repo: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go (framework, branch master). Do not edit ../sm-journal-plugin or any other sibling repo, STATE.md or state.json.
+
+Facts gathered during planning (do not re-derive):
+- validate.go `validateField` (lines 44-204): the token switch (54-114) sets flags or checks immediately; `default:` returns `fmt.Errorf("lagoon: unrecognized validation rule %q", tok)`. Then: nullable short-circuit `if nullable && isEmptyValue(val) && !required` (115-117); numeric range block (118-154); `if required && isEmptyValue(val)` returns the required message (155-157); then the tags loop (158-193), which SKIPS tags named required, min and max (line 163), plus the non-numeric `between` length check in bytes (176-189); then unique (194-202).
+- Consequence, verified by a probe on HEAD: `min`/`max` on a field that is not numeric/integer are currently NOT enforced at all (`max:5` with a 10-character value passes), although docs/database/casts-and-validation.md line 111 says "on other fields they compare the length". This plan does not change that for rule strings without `string`/`url` (no behaviour change for existing rules); it is reported as a follow-up in the summary.
+- validate_rules.go (request validator): `string` passes when `value.(string)` (line ~299); `url` passes when it is a string and `urlPattern.MatchString(s)` (line ~301); `urlPattern` is a package-level regexp at line ~1223 (Laravel 9 validateUrl, RE2, linear time). Probe results: "https://example.com/feed.png", "http://localhost:8080/x?y=1#z", "https://przykład.pl/ścieżka", "ftp://a.b" match; "not a url", "example.com", "javascript:alert(1)", " https://example.com", "https://example.com " do not.
+- Values reaching lagoon.Validate from cabana come from model struct fields (`valuesForRules`, modules/cabana/crud.go:1449): types like string, *string (nil or pointing to ""), named string types. `isEmptyValue` treats a non-nil pointer to "" as NOT empty, so the new checks must dereference and treat a blank string themselves.
+- validateMessage (424-472): key is "lagoon::validate." + rule, except "between.numeric" -> "lagoon::validation.between.numeric"; when the translator is nil or has no line, an English fallback switch answers. cabana passes a nil translator, so the fallbacks are what admin users see.
+- Catalogs: modules/phrasebook/lang/{en,pl}/validate.yaml are flat (required, email, between, ... mimes) and have no string/url keys. modules/phrasebook/lang/{en,pl}/validation.yaml (the request catalog) already have max.string ("The :attribute may not be greater than :max characters." / ":attribute nie może być dłuższy niż :max znaków."), min.string ("The :attribute must be at least :min characters." / ":attribute musi mieć przynajmniej :min znaków."), en url "The :attribute format is invalid.", pl url "Format :attribute jest nieprawidłowy.". Do NOT edit validation.yaml (pl `string` there is still English; out of scope, report it).
+- Test helpers in package lagoon (validate_request_test.go): `requestTranslator(t)` loads both en/pl validate.yaml and validation.yaml from modules/phrasebook/lang; `inLocale("pl")` gives a context with that locale. Example of a translated assertion: TestValidateNumericRangeMessageTranslated in validate_test.go.
+- cabana settings test patterns: modules/cabana/settings_secret_test.go (a settings model type, `secretSettingsItem` building a pact.SettingsItem with NewModel and an fstest.MapFS fields.yaml, `compileSetting("acme.unit", item, fsys)`, and the DB-free sequence `lagoon.Fill(model, settingWritable(setting), projectSettingBody(setting, body), false)`); modules/cabana/metadata_settings_test.go TestSettingsSingletonLifecycle (Postgres: `_, db := newListService(t)` which skips under -short, DropTable + AutoMigrate the model, `SettingsService{DB: db}.Put(ctx, setting, body)`, `assertSettingCount`-style row count). A failed Put returns `*ValidationError` whose `Details` is `map[string]any` holding `[]string` per field (`validationDetails`).
+- Baseline at planning time (2026-11-04): `go test -short -count=1 ./modules/lagoon -run TestValidate`, `go test -short -count=1 ./modules/cabana -run 'TestSettingsSecret|TestSettingsSingletonLifecycle'` and `go test -count=1 ./cmd/summer -run TestDocsTree` all pass; Docker 29.9.1 is reachable from this shell (if the socket is denied, run the Docker tests through `sudo -u golem` per CLAUDE.md). modules/ was clean.
+- Several sessions work in this repo: run `git status --short` before editing and before staging; stage only the files listed in each task by path; leave other uncommitted edits alone. Commit messages carry no co-author trailer (user rule).
+</context>
+
+<tasks>
+
+<task type="tracer" tdd="true">
+  <name>Task 1: string and url tokens in lagoon.Validate, proven through a cabana settings save</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/en/validate.yaml, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validate.yaml, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/settings_string_url_test.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/README.md, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/docs/database/casts-and-validation.md</files>
+  <read_first>modules/lagoon/validate.go (whole file), modules/lagoon/validate_rules.go lines 285-310 and 1215-1225, modules/lagoon/validate_test.go, modules/lagoon/validate_request_test.go lines 20-50, modules/cabana/settings_secret_test.go lines 1-60 and 209-230, modules/cabana/metadata_settings_test.go lines 40-60 and 109-160, modules/cabana/settings.go lines 200-275 and 330-407, modules/phrasebook/lang/en/validate.yaml, modules/phrasebook/lang/pl/validate.yaml, modules/lagoon/README.md line 32, docs/database/casts-and-validation.md line 111</read_first>
+  <behavior>
+    - nullable|string|max:255 on field title: "hello", nil, "", "   ", (*string)(nil), pointer to "", pointer to "x", a named string type value all pass; int 5, bool true, []string{"a"} fail with exactly ["The title must be a string."].
+    - string without nullable: "" and nil pass (blank values skip string); 5 fails.
+    - required|string on "" gives exactly ["The title field is required."] (no string message).
+    - nullable|url|max:500 on field website: "https://example.com/feed.png", "http://localhost:8080/x?y=1#z", "https://przykład.pl/ścieżka", nil, "", "   ", pointer to "" pass; "not a url", "example.com", "javascript:alert(1)", pointer to "nope", int 42 fail with exactly ["The website format is invalid."].
+    - Translated (requestTranslator + inLocale("pl")): string failure on title is "title musi być ciągiem znaków."; url failure on website is "Format website jest nieprawidłowy.".
+    - TestValidateUnrecognizedRule and every other existing test in validate_test.go pass unchanged.
+    - cabana TestSettingsStringURLRules (no Docker): a compiled settings model with title *string (nullable|string|max:255), website *string (nullable|url|max:500), language string (nullable|string|max:10), run through the same sequence Put uses (lagoon.Fill with settingWritable/projectSettingBody, then lagoon.Validate with settingRules and valuesForRules, nil tx, nil translator): body {title: "Feed", website: "https://example.com/feed.png", language: "pl"} gives no errors and no error return; {website: ""} and {website: nil, title: nil} give no errors; {website: "not a url"} gives {"website": ["The website format is invalid."]}.
+    - cabana TestSettingsStringURLRulesPostgres (skips under -short via newListService): SettingsService.Put with the valid body succeeds (Exists true, row count 1); Put with {website: "not a url"} returns a *ValidationError whose Details["website"] is []string{"The website format is invalid."}, and the stored row still holds the earlier website.
+  </behavior>
+  <action>
+Write the tests first, run them red (the string/url tokens currently return the unrecognized-rule error), then implement. Commit once at the end of this task.
+
+Tests in modules/lagoon/validate_test.go: add TestValidateStringRule, TestValidateURLRule and TestValidateStringURLTranslated as table tests covering every lagoon behavior row above (Validate with nil tx, nil model, nil translator unless stated; for pointer cases build local string variables and pass their addresses; for the named type declare a local type over string inside the test). Assert exact message slices, not just non-empty.
+
+New file modules/cabana/settings_string_url_test.go (package cabana, internal test like settings_secret_test.go): declare a settings model type stringURLSettings with ID uint primary key, Title *string column title, Website *string column website, Language string column language; TableName cabana_string_url_settings; Fillable title, website, language; Rules() returning the three rule strings from the behavior list (the Journal shapes). Build the pact.SettingsItem with NewModel and an fstest.MapFS models/settings/fields.yaml declaring the three fields as type text, compile it with compileSetting, then write TestSettingsStringURLRules (DB-free sequence, table of bodies) and TestSettingsStringURLRulesPostgres (newListService, DropTable then AutoMigrate the model, SettingsService{DB: db}.Put, errors.As to *ValidationError, read the row back with db.First). Name helpers so they do not collide with existing cabana test helpers (grep before naming).
+
+Implementation in modules/lagoon/validate.go:
+- In validateField add locals hasString and hasURL; add `case "string":` and `case "url":` to the token switch that only set those flags (no immediate check, so the nullable short-circuit and the required check keep their order). Do not change any other case or the default branch.
+- Add an unexported helper ruleString(val any) (string, bool): dereference pointers and interfaces (a nil one gives "", false), return the reflect String() and true when the Kind is reflect.String (named string types included), otherwise "", false.
+- Insert a new block right after the `if required && isEmptyValue(val)` return and before `usedBetween :=`, entered only when hasString or hasURL: compute s, isStr from ruleString; the value is blank when isEmptyValue(val) is true or isStr and strings.TrimSpace(s) is empty; a blank value skips this block entirely (Laravel skips non-implicit rules for a blank string; required already handled emptiness). Otherwise: if hasString and not isStr, return only the "string" message; if hasURL and (not isStr or urlPattern does not match s), collect the "url" message (reuse urlPattern from validate_rules.go as is: no trimming, no new pattern). Return the collected messages when there are any; otherwise fall through to the existing tags loop and unique check untouched.
+- validateMessage: add fallback cases "string" -> "The " + attr + " must be a string." and "url" -> "The " + attr + " format is invalid." (the en lines of the request catalog).
+- Update the Validate doc comment only if it lists tokens (it does not today; leave it otherwise).
+
+Catalogs: append to modules/phrasebook/lang/en/validate.yaml the keys string ("The :attribute must be a string.") and url ("The :attribute format is invalid."); append to modules/phrasebook/lang/pl/validate.yaml string (":attribute musi być ciągiem znaków.") and url ("Format :attribute jest nieprawidłowy."), keeping the files' quoting style. Do not touch validation.yaml.
+
+Docs, same commit (CLAUDE.md documentation rule): in modules/lagoon/README.md line 32 add `string` and `url` to the lagoon.Validate rule list and one sentence: `string` requires a string value (a pointer to one included) and `url` a URL matching Laravel's pattern, the one lagoon.ValidateRequest uses; both skip an empty or blank value, which is left to `required`. In docs/database/casts-and-validation.md line 111 add the two rules to "The supported rules are ..." and the same empty-value sentence in plain prose. Do not rewrite the min/max length sentence in this task (Task 2 owns it).
+
+Run `git status --short`, stage exactly the seven files of this task by path, and commit as: feat(lagoon): accept string and url rules in lagoon.Validate (quick-261104-f4x). No co-author trailer.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && go vet ./modules/lagoon ./modules/cabana && go test -short -count=1 ./modules/lagoon -run 'TestValidate' && go test -short -count=1 ./modules/cabana -run 'TestSettingsStringURLRules|TestSettingsSecret' && go test -count=1 ./modules/cabana -run 'TestSettingsStringURLRulesPostgres|TestSettingsSingletonLifecycle' && go test -count=1 ./cmd/summer -run TestDocsTree && git diff --quiet HEAD -- modules/phrasebook/lang/en/validation.yaml modules/phrasebook/lang/pl/validation.yaml</automated>
+  </verify>
+  <done>The Journal-shaped rules validate through the cabana settings save path, with and without Postgres; string/url failures give the exact en messages and the pl lines with a translator; blank values pass; all existing lagoon/cabana tests touched by the run are green; README and the docs page list string and url; validation.yaml files are unchanged; one commit with the seven files exists.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: min and max as character length on string and url fields</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/settings_string_url_test.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/README.md, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/docs/database/casts-and-validation.md</files>
+  <read_first>modules/lagoon/validate.go (the block added in Task 1, validateMessage), modules/phrasebook/lang/en/validation.yaml max/min sections (lines 62-73), modules/phrasebook/lang/pl/validation.yaml lines 36-46, modules/cabana/settings_string_url_test.go</read_first>
+  <behavior>
+    - nullable|string|max:255: a 255-character ASCII value passes; 256 characters fail with exactly ["The title may not be greater than 255 characters."]; 255 letters "ż" (510 bytes) pass; 256 "ż" fail.
+    - string|min:3: "ab" fails with exactly ["The title must be at least 3 characters."]; "abc" passes; "" and nil pass (blank skip); required|string|min:3 on "" gives only the required message.
+    - nullable|url|max:30: "https://example.com/feed.png" passes; "https://example.com/a-very-long-path/feed.png" fails with exactly ["The website may not be greater than 30 characters."]; "this is not a url and it is far too long" (40 characters) fails with ["The website format is invalid.", "The website may not be greater than 30 characters."] in that order.
+    - string with a non-string value and max (string|max:3 on int 12345) gives only the string message.
+    - string|max:abc returns a non-nil error containing "max:abc" (malformed argument fails loudly, like a malformed between).
+    - Translated with pl: 256 characters under max:255 gives "title nie może być dłuższy niż 255 znaków."; "ab" under min:3 gives "title musi mieć przynajmniej 3 znaków.".
+    - Unchanged behaviour: max:5 and nullable|max:5 WITHOUT string/url on a 10-character value still give no error (assert it, so the no-behaviour-change guarantee is pinned); string|between:1,5 keeps the existing between check; numeric|min:0|max:10 and integer|between rules give the same results as before (existing tests).
+    - cabana TestSettingsStringURLRules gains a case: title of 256 characters gives {"title": ["The title may not be greater than 255 characters."]}; TestSettingsStringURLRulesPostgres gains the same refused Put, leaving the stored title unchanged.
+  </behavior>
+  <action>
+Tests first: add TestValidateStringLength (table) and extend TestValidateStringURLTranslated in modules/lagoon/validate_test.go with every behavior row above, including the pinned no-change rows for max without string/url; extend both cabana tests with the too-long title case. Run red, then implement. Commit once at the end.
+
+In validateField's string/url block from Task 1, after the string and url checks and only when the field is not numeric or integer (numericRange false) and the dereferenced value is a non-blank string: count characters with utf8.RuneCountInString (Laravel's mb_strlen; add the unicode/utf8 import). When minArg is set, parse it with strconv.Atoi after trimming; when maxArg is set, likewise; a parse failure returns nil and fmt.Errorf("lagoon: unrecognized validation rule %q", "min:"+minArg) or the max equivalent. A count below min appends the "min.string" message, above max the "max.string" message, both with params min and max set from minArg and maxArg. The messages collected in the block keep the order string, url, min/max. The string-type failure still returns alone. Leave `between` exactly as it is (its existing check in the tags block), and leave min/max on fields without string/url untouched: the tags loop keeps skipping them.
+
+validateMessage: route "min.string" and "max.string" to the keys lagoon::validation.min.string and lagoon::validation.max.string the same way "between.numeric" is routed (one condition covering the three), and add English fallback cases "min.string" -> "The " + attr + " must be at least " + params["min"] + " characters." and "max.string" -> "The " + attr + " may not be greater than " + params["max"] + " characters.".
+
+Docs, same commit: in modules/lagoon/README.md line 32 add that on a `string` or `url` field `min` and `max` compare the length in characters with the `lagoon::validation` string size messages. In docs/database/casts-and-validation.md line 111 replace "On a field that is `integer` or `numeric`, `min`, `max` and `between` compare the number; on other fields they compare the length." with an accurate statement: on an `integer` or `numeric` field `min`, `max` and `between` compare the number; on a `string` or `url` field `min` and `max` compare the length in characters (`The title may not be greater than 255 characters.`); `between` compares the length on any other field. Keep the rest of the paragraph.
+
+Final gate before committing: go vet ./... and go test -short ./... stay green (report any failure that is pre-existing and unrelated rather than fixing it). Run `git status --short`, stage exactly the five files of this task by path, and commit as: feat(lagoon): check min and max as character length on string and url fields (quick-261104-f4x). No co-author trailer. No tag, no push.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && go vet ./... && go test -short -count=1 ./modules/lagoon ./modules/cabana ./modules/phrasebook && go test -count=1 ./modules/cabana -run 'TestSettingsStringURLRules|TestSettingsSingletonLifecycle' && go test -count=1 ./modules/lagoon -run 'TestValidate' && go test -count=1 ./cmd/summer -run TestDocsTree && go test -short -count=1 ./...</automated>
+  </verify>
+  <done>string|max:255 and url|max:500 enforce character length with Laravel's string size messages in en and pl; malformed min/max arguments on string/url fields fail loudly; rule strings without string or url behave exactly as before (pinned by a test); between is unchanged; README and docs describe the length behaviour accurately; vet and the short suite are green; one commit with the five files exists.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| admin client -> cabana settings Put | Settings form values (title, URL, free text) are client-controlled strings validated by lagoon.Validate before they are stored and later rendered by plugins (for example an RSS image URL) |
+| plugin author -> model Rules() | Rule strings are code, compiled into the binary; a malformed argument must fail loudly rather than silently accept input |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-261104f4x-01 | Tampering | validateField url case | medium | mitigate | url reuses Laravel's urlPattern (scheme allowlist plus ://), so javascript:, schemeless and whitespace-padded values are refused; tests pin "javascript:alert(1)" and padded URLs as failures. Output escaping stays the rendering plugin's job |
+| T-261104f4x-02 | Denial of service | urlPattern match and rune count | low | mitigate | RE2 regexp and utf8.RuneCountInString are linear in input length; request bodies are already bounded by the server's body limits; no backtracking pattern is added |
+| T-261104f4x-03 | Tampering | min/max arguments on string/url fields | low | mitigate | A non-integer min/max argument returns the unrecognized-rule error instead of being treated as 0 or skipped, so a typo in Rules() cannot disable a length limit unnoticed |
+| T-261104f4x-04 | Information disclosure | validation messages | low | accept | Messages name only the attribute and the rule bound, never the submitted value |
+| T-261104f4x-SC | Tampering | go module installs | low | accept | No new dependency; standard library (unicode/utf8, strconv, reflect) and the existing urlPattern only |
+</threat_model>
+
+<verification>
+- No Docker: go test -short -count=1 ./modules/lagoon ./modules/cabana ./modules/phrasebook and go test -short ./... pass; go vet ./... is clean.
+- Docker (testcontainers Postgres): TestSettingsStringURLRulesPostgres, TestSettingsSingletonLifecycle and the lagoon TestValidate* tests pass (through sudo -u golem if the Docker socket is denied; the summary says which ran).
+- Docs: go test -count=1 ./cmd/summer -run TestDocsTree passes.
+- The two task commits (git show --stat on each) touch only the seven listed files (other sessions may commit in between; check by commit, not by HEAD~2); modules/phrasebook/lang/*/validation.yaml and every sibling repo are untouched.
+</verification>
+
+<success_criteria>
+- Saving Settings > Journal (rules nullable|string|max:255, nullable|url|max:500) no longer fails with the unrecognized-rule error; invalid URLs and over-long values get Laravel-shaped messages.
+- Existing rule strings give the same results as before.
+- Two commits on master in summercms.go (tokens; length), each with its tests and doc updates, no co-author trailer, no tag or push.
+- The summary reports two follow-ups for the user to decide: (1) min/max on fields without string/url (for example the README example required|max:255|unique:posts, or nullable|max:255) are still not enforced although the old docs claimed they compared the length; (2) modules/phrasebook/lang/pl/validation.yaml still has an English `string` line.
+</success_criteria>
+
+<output>
+Create `/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/quick/261104-f4x-lagoon-validate-string-and-url-rules/261104-f4x-SUMMARY.md` when done
+</output>

.planning/quick/261104-f4x-lagoon-validate-string-and-url-rules/261104-f4x-SUMMARY.md

@@ -0,0 +1,102 @@
+---
+phase: quick-261104-f4x
+plan: 01
+subsystem: lagoon
+tags: [validation, lagoon, cabana, settings, phrasebook]
+status: complete
+requires: []
+provides:
+  - "lagoon.Validate accepts the Laravel rule tokens string and url"
+  - "min/max as character length on string and url fields"
+affects:
+  - modules/cabana settings saves (SettingsService.Put) and controller saves that use lagoon.Validate
+tech-stack:
+  added: []
+  patterns:
+    - "reuse of validate_rules.go urlPattern (Laravel 9 validateUrl) in the model validator"
+key-files:
+  created:
+    - modules/cabana/settings_string_url_test.go
+  modified:
+    - modules/lagoon/validate.go
+    - modules/lagoon/validate_test.go
+    - modules/phrasebook/lang/en/validate.yaml
+    - modules/phrasebook/lang/pl/validate.yaml
+    - modules/lagoon/README.md
+    - docs/database/casts-and-validation.md
+decisions:
+  - "string and url skip an empty or blank value (nil, nil pointer, pointer to empty string, whitespace-only); required stays the rule that rejects emptiness"
+  - "On a string or url field, a min/max argument that is not a whole number is the unrecognized-rule error whatever the value (checked right after the token loop, not only on non-blank values)"
+  - "min/max on fields without string/url stay unenforced (no behaviour change for existing rule strings); left to the user as a follow-up"
+metrics:
+  duration: ~25min
+  completed: 2026-11-04
+estimate:
+  tokens: 45000
+  tasks: 2
+actuals:
+  tokens: 7111
+  tasks: 2
+  commits: 2
+plan_head_before: 1e38cb2
+plan_head_after: d166f1c
+---
+
+# Quick 261104-f4x: lagoon.Validate string and url rules Summary
+
+`lagoon.Validate` now accepts Laravel's `string` and `url` rule tokens. `url` uses the same Laravel 9 `urlPattern` as `lagoon.ValidateRequest`. On a string or url field, `min` and `max` compare the length in characters (runes). Settings > Journal saves (`nullable|string|max:255`, `nullable|url|max:500`) no longer fail with `lagoon: unrecognized validation rule "string"`.
+
+## Commits
+
+| Task | Commit | Message |
+|------|--------|---------|
+| 1 | d2ce3a2 | feat(lagoon): accept string and url rules in lagoon.Validate (quick-261104-f4x) |
+| 2 | d166f1c | feat(lagoon): check min and max as character length on string and url fields (quick-261104-f4x) |
+
+`git rev-list --count 1e38cb2..HEAD` is 3. The extra commit is 617eaef (`docs: capture todo - Enforce min/max length on text fields in lagoon.Validate`), made by another session between the two task commits. It is not part of this plan, so `commits: 2` counts only the commits tagged `quick-261104-f4x` in that range. Each task commit touches only its listed files (checked with `git show --stat`). There are no co-author trailers, no tag and no push.
+
+## What changed
+
+- `validateField` has new `string` and `url` cases. They only set flags, so the nullable short-circuit and the required check keep their order. The new check runs after the required check. A blank value skips it. A value that is not a string fails `string` alone. `url` fails a non-string or a value that does not match `urlPattern` (no trimming, so `" https://example.com"` fails).
+- The new `ruleString` helper dereferences pointers and interfaces and accepts named string types.
+- Length check (Task 2): when the rules contain `string` or `url` but not `numeric` or `integer`, min and max are parsed with `lengthBound`. The length is `utf8.RuneCountInString`. The messages come in the order string, url, min/max, and use `lagoon::validation.min.string` and `lagoon::validation.max.string`, with English fallbacks for a nil translator (which is what cabana passes).
+- New catalog keys `lagoon::validate.string` and `lagoon::validate.url` in en and pl. `validation.yaml` is unchanged.
+- `modules/lagoon/README.md` and `docs/database/casts-and-validation.md` list `string` and `url`, explain how blank values are handled, and describe the length behaviour accurately.
+
+## Test results
+
+- `go vet ./...` clean at both commits.
+- `go test -short -count=1 ./...` green at both commits.
+- `go test -count=1 ./modules/lagoon/... ./modules/cabana/...` with Docker passed (lagoon 21s, lagoon/attach 50s, cabana 97s). Docker was reachable directly; `sudo -u golem` was not needed.
+- `TestSettingsStringURLRulesPostgres` and `TestSettingsSingletonLifecycle` ran against testcontainers Postgres and passed (they were not skipped).
+- `go test -count=1 ./cmd/summer -run TestDocsTree` passed.
+- New tests: `TestValidateStringRule`, `TestValidateURLRule`, `TestValidateStringURLTranslated` (pl), `TestValidateStringLength` (lagoon); `TestSettingsStringURLRules` and `TestSettingsStringURLRulesPostgres` (cabana). In each task the tests failed first with the unrecognized-rule error or the missing length message.
+
+## Deviations from Plan
+
+**1. [Rule 2 - Correctness] A malformed min/max bound fails whatever the value**
+- **Found during:** Task 2
+- **Issue:** The plan parses min/max inside the block that runs only for non-blank string values. A typo like `string|max:abc` would then go unnoticed while the field is empty or null, which is weaker than threat T-261104f4x-03 asks for.
+- **Fix:** `lengthBound` runs right after the token loop for every rule string that contains `string` or `url` without `numeric`/`integer`. A negative bound is refused too. Only rule strings that errored before this change are affected. The test pins the error for both `"x"` and `nil`.
+- **Files modified:** modules/lagoon/validate.go, modules/lagoon/validate_test.go
+- **Commit:** d166f1c
+
+There were no other deviations. The tracer gate after Task 1 re-ran the verify chain end to end and it passed.
+
+## Follow-ups (user decision)
+
+1. **min/max are not enforced on non-numeric fields that have no `string`/`url`.** For example, `required|max:255|unique:posts` or `nullable|max:5` with a 10-character value still passes. The old docs line said those rules "compare the length", which was wrong; the docs now describe the actual behaviour. Changing this changes results for existing rule strings, so the user should decide. Another session has already captured it as a todo: `.planning/todos/pending/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md` (commit 617eaef).
+2. **The `string` line in `modules/phrasebook/lang/pl/validation.yaml` (the request catalog) is still English.** It was left alone because it is out of scope. The new `lagoon::validate.string` key in `pl/validate.yaml` is in Polish.
+
+## Known Stubs
+
+None.
+
+## Threat Flags
+
+None. No new endpoints or trust-boundary surface: the change only tightens validation on an existing save path.
+
+## Self-Check: PASSED
+
+- FOUND: modules/cabana/settings_string_url_test.go, modules/lagoon/validate.go, modules/phrasebook/lang/{en,pl}/validate.yaml
+- FOUND: d2ce3a2, d166f1c in git log

.planning/quick/261104-fx1-lagoon-validate-min-max-length-on-text-f/261104-fx1-PLAN.md

@@ -0,0 +1,215 @@
+---
+phase: quick-261104-fx1
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/settings_string_url_test.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/backend_users_admin.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/README.md
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/docs/database/casts-and-validation.md
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validation.yaml
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validate.yaml
+autonomous: true
+requirements:
+  - quick-261104-fx1
+
+estimate:
+  tokens: 70000
+  raw_tokens: 70000
+  tasks: 3
+  confidence: low
+
+must_haves:
+  truths:
+    - "lagoon.Validate checks min:N and max:N as a length on every field whose rules contain neither numeric nor integer (Laravel semantics): nullable|max:5 and max:5 refuse a 10-character string with exactly [\"The title may not be greater than 5 characters.\"] (this reverses the 261104-f4x pin), and required|max:255|unique:posts now limits the title as the README example implies"
+    - "The length is Laravel's getSize without a numeric rule: characters (utf8 runes) of a string, of a pointer to one or of a named string type; characters of a number's decimal form (int, uint, float); the element count of a slice or map (not a []byte), with the min.array / max.array messages (\"The tags may not have more than 2 items.\"); booleans, dates, structs, fixed-size arrays and byte slices are not measured"
+    - "Fields with numeric or integer keep their numeric range behaviour and messages; between keeps its existing check; an empty or blank value (nil, nil pointer, pointer to \"\", \"\", whitespace-only string, empty slice or map) skips min/max, and required stays the rule that rejects emptiness"
+    - "A min/max bound that is not a non-negative whole number is the unrecognized-rule error on every non-numeric field, whatever the value (max:abc on nil errors)"
+    - "Through cabana's settings save sequence a rule without string (nullable|max:5) refuses a 6-character value with a message on the field; the Administrators screen still refuses a 3-character password with a message containing \"at least 4 characters\""
+    - "With the pl translator the request validator's string failure reads \":attribute musi być ciągiem znaków.\" and lagoon.Validate's numeric min/max failures read \":attribute musi być nie mniejszy od :min.\" / \":attribute nie może być większy niż :max.\" (no longer \"znaków\")"
+    - "modules/lagoon/README.md and docs/database/casts-and-validation.md describe the new min/max behaviour accurately; the docs checker passes"
+    - "The SUMMARY lists every non-numeric min/max rule without string/url in the sibling plugins and app plugins (lagoon.Validate sources only), with the DB column size and a SAFE/RISK verdict, plus a release-note line for v0.6.1"
+  artifacts:
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go
+      provides: "lengthRange on every non-numeric field, ruleLength helper (runes / decimal form / element count), min.array and max.array message routing and fallbacks"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go
+      provides: "reversed pin in TestValidateStringLength, new TestValidateLengthWithoutStringRule, translated length and catalog cases"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/settings_string_url_test.go
+      provides: "code field with nullable|max:5 proving the change through the settings save sequence"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validation.yaml
+      provides: "Polish string line and a header note on the deliberate divergence from Winter's pl file"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validate.yaml
+      provides: "numeric wording for lagoon::validate.min and lagoon::validate.max"
+  key_links:
+    - from: "modules/cabana/crud.go:882, relation.go:1220, relation_child.go:126, settings.go:267"
+      to: "lagoon.Validate -> validateField length block"
+      via: "valuesForRules(model, rules) model field values (string, *string, ints, slices) and FormRules virtual values (password)"
+    - from: "validateField length block"
+      to: "ruleLength + lengthBound"
+      via: "minLen/maxLen parsed right after the token loop for every non-numeric rule string"
+    - from: "validateMessage"
+      to: "lagoon::validation.min.string / max.string / min.array / max.array"
+      via: "phrasebook keys with English fallbacks (cabana passes a nil translator)"
+---
+
+<objective>
+Make `lagoon.Validate` (the model validator behind every cabana admin save and settings save) apply Laravel's `min`/`max` semantics on all non-numeric fields: compare a string's length in characters and a list's element count, not only when `string` or `url` is present. Translate the remaining English line of the pl request catalog that these rules touch (`string:`), fix the pl numeric `min`/`max` lines of the model catalog that wrongly say "znaków", and audit the sibling plugins for rules that will start enforcing a limit.
+
+Purpose: `nullable|max:255`, `required|max:255|unique:posts` (the README example) and `required|min:4|confirmed` (the Administrators password) currently accept any length, although the docs and the request validator (`validate_rules.go` `size()`) say min/max compare length. Quick 261104-f4x fixed this only for `string`/`url` fields and pinned the gap with a test; this task closes it (source todo `.planning/todos/pending/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md`). Risk: a stored value longer than its declared limit fails its next admin save, hence the read-only audit. Framework target v0.6.1 (in progress): no tag, no push, no sibling repo edits.
+
+Output: two framework commits (Task 1 behaviour + tests + docs; Task 2 pl catalogs + test), then a read-only audit and the full gates whose findings go into the SUMMARY.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/CLAUDE.md
+@/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go
+@/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/quick/261104-f4x-lagoon-validate-string-and-url-rules/261104-f4x-SUMMARY.md
+
+Working repo: /media/nvme/dev/golem15/summercms.io/summercms/summercms.go (framework, branch master). Do not edit any sibling repo (`../sm-*`, `../fonoteka.go`), STATE.md or state.json.
+
+Facts gathered during planning (do not re-derive):
+- validate.go `validateField` (HEAD 7e6c426): token switch lines 57-121 (sets hasNumeric, hasInteger, hasString, hasURL, minArg, maxArg, betweenMin/Max; `confirmed`, `boolean`, `integer`, `mimes`, `different` return early inside the loop). Lines 122-135: `lengthRange := (hasString || hasURL) && !hasNumeric && !hasInteger`, then `lengthBound("min", minArg)` / `lengthBound("max", maxArg)` (absent = -1, malformed or negative = `lagoon: unrecognized validation rule "max:abc"`). Line 136: nullable short-circuit. Lines 139-161: numericRange; the non-numeric `else` branch (151-161) appends `min=`/`max=` tags for between AND for minArg/maxArg, but the tags loop (line 211) skips every tag named required, min or max, so the minArg/maxArg tags are dead; the between tags only keep `len(tags) > 0` true so the between length check (224-237, counts BYTES with `len(s)`, or `len(fmt.Sprint(val))` for non-strings) runs. Lines 176-178: required. Lines 179-205: the string/url block (blank skip via ruleString + TrimSpace, string-type failure returns alone, url message, then min.string/max.string only when `lengthRange && isStr`; returns early when it has messages, before the tags loop and unique). Helpers: lengthBound 378-389, ruleString 391-409, validateMessage 505-562 (key routing at 511-514 sends "between.numeric", "min.string", "max.string" to `lagoon::validation.`; English fallbacks below).
+- The request validator (`validate_rules.go` 364-387, `size()`): a number under a numeric rule is the number; `arrayLen` (442-458: slices and maps) is the element count; an UploadedFile is KB; otherwise `utf8.RuneCountInString` of the PHP string form. This plan mirrors the string / number-string / slice-map parts only (no files in lagoon.Validate).
+- `between` on non-numeric fields is already length-checked (bytes). Per the task brief it stays exactly as it is; report the byte-vs-character difference as a follow-up, do not change it.
+- Pin to reverse: validate_test.go TestValidateStringLength lines 418-460; doc comment 418-420 says rule strings without string or url keep their old results; rows 438-441 pin `max:5` and `nullable|max:5` on "0123456789" as passing. Test helpers: `runRuleCases(t, field, []ruleCase{{name, rule, value, want}})` (validate_test.go 320-340, exact message slices, nil tx/model/translator); `requestTranslator(t)` and `inLocale("pl")` and `mustValidate(t, ctx, input, []RequestRule)` in validate_request_test.go 22-55.
+- Message catalogs: en validation.yaml has `min.array` "The :attribute must have at least :min items." and `max.array` "The :attribute may not have more than :max items."; pl validation.yaml has `min.array` ":attribute musi mieć przynajmniej :min elementów." and `max.array` ":attribute nie może mieć więcej niż :max elementów.". pl validation.yaml line 64 `string: "The :attribute must be a string."` is English because Winter's own pl/validation.php line 80 is English (the file header says text is copied verbatim from Winter). Other English lines in pl validation.yaml (dimensions, distinct, file, in_array, json, present, required_unless) belong to rules this task does not touch: leave them, list them in the SUMMARY. pl validate.yaml lines 10-11 `max: ":attribute nie może być dłuższy niż :max znaków."` / `min: ":attribute musi mieć przynajmniej :min znaków."` are only used by `numericRangeMessage` (numeric/integer bounds), so a Polish numeric failure reads "znaków" (characters); the correct Winter numeric lines are in pl validation.yaml lines 37 and 43. No test in this repo or the siblings pins the pl validate.yaml min/max text.
+- Framework callers of lagoon.Validate: modules/cabana/crud.go:882 (form saves, FormRules virtual values), relation.go:1220 (pivot), relation_child.go:126, settings.go:267; all pass a nil translator, and crud.go turns a returned error into a `CapabilityError` (so a malformed bound breaks the save). Framework rule strings affected: cabana/contracts.go:49-50 BackendUserRole name/code `required|max:255`; contracts.go:169-170 BackendUser login/email `required|max:255`; backend_users_admin.go:476-482 usersAdmin FormRules password `nullable|min:4|confirmed` / `required|min:4|confirmed`, login/email `required|max:255`; docs/examples/blog/models/post.go:34-35; lagoon example_test.go:163 ExampleValidate `required|max:10` on "" (output unchanged: required) and 294. account.go uses lagoon.ParseRules (request validator), not affected.
+- backend_users_admin.go:868-874 (storePassword doc comment) says the length is checked in the hook "because the form's min:4 rule is a string rule, which the model validator does not apply" — false after this change. storePassword runs in the form hooks after lagoon.Validate (lines 753, 814), so lagoon.Validate's English message now wins for a too-short password; TestAdministratorsPasswordAndIdentity (administrators_postgres_test.go:496, Docker) expects the substring "at least 4 characters", which the new message contains.
+- cabana settings_string_url_test.go: model stringURLSettings (Title *string, Website *string, Language string), stringURLSettingsFields YAML const, compileStringURLSetting, TestSettingsStringURLRules (DB-free table, reflect.DeepEqual on map[string][]string) and TestSettingsStringURLRulesPostgres (AutoMigrate, Put).
+- Several sessions work in this repo: run `git status --short` before editing and before staging; stage only the listed files by path; leave other uncommitted edits (STATE.md, state.json, G15OFFICE.md, WINDOWS.md, phase 33 files) alone. No co-author trailer in commit messages (user rule). Docker is normally reachable directly; if the socket is denied, run the Docker tests through `sudo -u golem` (CLAUDE.md).
+</context>
+
+<tasks>
+
+<task type="tracer" tdd="true">
+  <name>Task 1: min and max as length on every non-numeric field in lagoon.Validate, proven through a cabana settings save</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/settings_string_url_test.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/cabana/backend_users_admin.go, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/README.md, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/docs/database/casts-and-validation.md</files>
+  <read_first>modules/lagoon/validate.go (already in context), modules/lagoon/validate_test.go lines 1-35 and 230-460, modules/lagoon/validate_rules.go lines 364-387 and 442-458, modules/lagoon/validate_request_test.go lines 20-56, modules/cabana/settings_string_url_test.go (whole file), modules/cabana/backend_users_admin.go lines 864-892, modules/lagoon/README.md line 32, docs/database/casts-and-validation.md line 111</read_first>
+  <behavior>
+    - Reversed pin (TestValidateStringLength): max:5 and nullable|max:5 on "0123456789" give exactly ["The title may not be greater than 5 characters."]; the string/url rows and the two between rows keep their expectations.
+    - New TestValidateLengthWithoutStringRule, field title: required|max:255 passes 255 "ż" and fails 256 "ż" with ["The title may not be greater than 255 characters."]; nullable|max:5 passes nil, "", "   ", (*string)(nil), pointer to "", "abcde" and fails "abcdef" and a pointer to "abcdef"; min:4 fails "abc" with ["The title must be at least 4 characters."] and passes "", nil, "   "; required|min:4 on "" gives only ["The title field is required."]; required|email|max:255 passes "a@example.com".
+    - Numbers without numeric/integer (field title): max:4 fails int 12345 with ["The title may not be greater than 4 characters."]; passes int 2024 and float64(2024); max:2 fails float64(1.5) ("1.5" is 3 characters).
+    - Not measured (field title): max:0 on true, max:1 on a time.Date value, max:1 on NewDate(2026, 11, 4) all pass.
+    - Lists (field tags): max:2 fails []string{"a","b","c"} with ["The tags may not have more than 2 items."]; passes []any{"a","b"}; min:2 fails []string{"a"} with ["The tags must have at least 2 items."]; min:2 passes an empty []string{} (blank skip); max:1 fails map[string]any{"a":1,"b":2} with ["The tags may not have more than 1 items."]; max:3 passes []byte("abcdef") (byte slices are not measured).
+    - Numeric unchanged (field views): integer|max:10 on 11 gives ["The views may not be greater than 10."]; numeric|min:0|max:10 on "5" passes; all existing TestValidateNumericRange* and TestValidateBetweenYear cases pass unchanged.
+    - Malformed bounds without string: max:abc on "x" and on nil return a non-nil error containing "max:abc"; nullable|min:-1 on "abc" returns an error containing "min:-1".
+    - Translated (requestTranslator + inLocale("pl")): max:5 on "abcdef" gives "title nie może być dłuższy niż 5 znaków."; max:2 on tags []string{"a","b","c"} gives "tags nie może mieć więcej niż 2 elementów.".
+    - cabana TestSettingsStringURLRules: with a new code field (rule nullable|max:5, no string), body {code: "abcde"} and {code: ""} give no errors, {code: "abcdef"} gives {"code": ["The code may not be greater than 5 characters."]}; every existing case keeps its result; TestSettingsStringURLRulesPostgres still passes with the extra column.
+    - ExampleValidate output is unchanged.
+  </behavior>
+  <action>
+Run `git status --short modules/ docs/` first. If modules/cabana/backend_users_admin.go or modules/cabana/settings_string_url_test.go carry another session's uncommitted edits, leave that file alone and report it in the SUMMARY instead of editing it.
+
+Tests first (RED): in modules/lagoon/validate_test.go update the TestValidateStringLength doc comment (drop the claim that rule strings without string or url keep their old results; say min and max compare the length on every non-numeric field) and change the two pinned rows to expect the max message; add TestValidateLengthWithoutStringRule as runRuleCases tables (fields title, tags, views) covering every behavior row above, plus the malformed-bound loop (Validate with nil tx/model/translator, assert err contains the token) and a translated table in the style of TestValidateStringURLTranslated (or extend that test) for the two pl rows. In modules/cabana/settings_string_url_test.go add `Code *string` with gorm column code to stringURLSettings, "code" to Fillable, rule "code": "nullable|max:5" to Rules(), a `code` text field to stringURLSettingsFields, and the three code cases to TestSettingsStringURLRules; update the type's doc comment to say one rule has no string token. Run the lagoon and cabana tests and confirm the new rows fail for the expected reason (no message where one is wanted) before implementing.
+
+Implementation in modules/lagoon/validate.go (GREEN):
+- Lines 122-135: set lengthRange to "neither numeric nor integer" (drop the hasString/hasURL condition) and keep the two lengthBound calls, so a malformed or negative bound fails loudly on every non-numeric rule string whatever the value. Rewrite the comment above: on a field that is not numeric or integer, min and max are a length (Laravel's getSize); a malformed bound fails loudly so a typo in Rules() cannot disable a limit unnoticed.
+- Non-numeric else branch (lines 151-161): delete the two appends of the minArg and maxArg tags (dead, the tags loop skips min and max); keep the two between appends, which keep the between length check running. Do not change the between check itself.
+- Replace the `if hasString || hasURL` block (lines 179-205) with a block that always runs after the required check: compute s, isStr from ruleString and blank as isEmptyValue(val) or (isStr and strings.TrimSpace(s) is empty). A blank value skips the whole block (Laravel skips non-implicit rules for a blank value; required has already handled emptiness). Otherwise, in this order: hasString and not isStr returns only the "string" message (unchanged); hasURL with a non-string or a value urlPattern does not match appends the "url" message (unchanged); then, when lengthRange and minLen or maxLen is set, call the new helper ruleLength(val) and when it measures the value append "min."+kind when the length is below minLen and "max."+kind when above maxLen, with params min and max from minArg and maxArg. Return the collected messages when there are any (early return, as today); otherwise fall through to the tags loop and unique check untouched.
+- New unexported helper ruleLength(val any) (n int, kind string, ok bool), next to ruleString, with a doc comment naming it Laravel's getSize without a numeric rule: dereference pointers and interfaces (a nil one is not measured); Kind String gives utf8.RuneCountInString and kind "string"; signed and unsigned integer kinds give the rune count of strconv.FormatInt / strconv.FormatUint base 10, and float kinds of strconv.FormatFloat with format 'f' and precision -1 (the form numericString already uses), kind "string"; Slice (except one whose element Kind is Uint8, i.e. []byte, json.RawMessage) and Map give rv.Len() and kind "array"; everything else (bool, structs including time.Time, Date, TimeOfDay, fixed-size arrays such as UUIDs, byte slices) returns ok false. Grep modules/lagoon for an existing ruleLength before naming; pick another name if it collides.
+- validateMessage: add "min.array" and "max.array" to the case that routes keys to lagoon::validation., and add English fallbacks "min.array" giving "The " + attr + " must have at least " + params["min"] + " items." and "max.array" giving "The " + attr + " may not have more than " + params["max"] + " items." (the en validation.yaml lines).
+
+cabana comment: in modules/cabana/backend_users_admin.go rewrite the last sentence of the storePassword doc comment (lines 869-873): the form's min:4 rule already refuses a shorter password in lagoon.Validate before the hook runs; the hook repeats the check so it never hashes one, and adds bcrypt's 72-byte limit. Comment only, no code change.
+
+Docs, same commit (CLAUDE.md documentation rule): in modules/lagoon/README.md line 32 replace the sentence starting "On a `string` or `url` field `min` and `max` compare" with: on a field without `integer` or `numeric`, `min` and `max` compare the length in characters of a string or of a number's decimal form (`max.string`, `min.string` messages) and the element count of a slice or map (`max.array`, `min.array`); an empty or blank value, a boolean and a date are not measured, and a bound that is not a whole number is an error. In docs/database/casts-and-validation.md line 111 replace "On a `string` or `url` field `min` and `max` compare the length in characters (`The title may not be greater than 255 characters.`), and a bound that is not a whole number is an error." with plain prose saying the same as the README (any field that is not `integer` or `numeric`; characters of a string or of a number, with the 255-characters example message; elements of a list, with the example `The tags may not have more than 5 items.`; empty or blank values, booleans and dates are not measured, use `required` to refuse an empty value; a bound that is not a whole number is an error). Keep the existing sentence "`between` compares the length on any other field." and the rest of the paragraph.
+
+Run `git status --short`, stage exactly the six files of this task by path (fewer if a cabana file was skipped), and commit: feat(lagoon): check min and max as length on every non-numeric field (quick-261104-fx1). No co-author trailer.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && go vet ./modules/lagoon ./modules/cabana && go test -short -count=1 ./modules/lagoon && go test -short -count=1 ./modules/cabana -run 'TestSettingsStringURLRules|TestSettingsSecret' && go test -count=1 ./modules/cabana -run 'TestSettingsStringURLRulesPostgres|TestAdministratorsPasswordAndIdentity' && go test -count=1 ./cmd/summer -run TestDocsTree</automated>
+  </verify>
+  <done>min/max are enforced as a length on every non-numeric field (characters of strings and numbers, items of slices and maps) with Laravel's string and array messages; numeric/integer ranges and between behave as before; blank values skip; malformed bounds error on any non-numeric field; the pin is reversed; the cabana settings sequence refuses an over-long code; the Administrators password test still passes; README, docs and the storePassword comment are accurate; one commit with the task's files exists.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Polish string line in the request catalog and numeric min/max lines in the model catalog</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validation.yaml, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/phrasebook/lang/pl/validate.yaml, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/validate_test.go</files>
+  <read_first>modules/phrasebook/lang/pl/validation.yaml (whole file, 69 lines), modules/phrasebook/lang/pl/validate.yaml (15 lines), modules/lagoon/validate_test.go TestValidateNumericRangeMessageTranslated (lines 264-273), modules/lagoon/validate_request_test.go lines 150-160 (a pl mustValidate assertion)</read_first>
+  <behavior>
+    - Request validator, pl: ValidateRequest with rule string on input {"s": 123} under inLocale("pl") gives {"s": ["s musi być ciągiem znaków."]}; the same under inLocale("en") still gives "The s must be a string.".
+    - lagoon.Validate, pl: integer|max:10 on 11 gives "views nie może być większy niż 10."; integer|min:0 on -1 gives "views musi być nie mniejszy od 0."; the existing pl between assertion ("year musi zawierać się w granicach 1889 - 2100.") and the pl max.string/min.string rows from Task 1 and 261104-f4x are unchanged.
+  </behavior>
+  <action>
+Tests first: add TestValidatePolishStringAndNumericLines to modules/lagoon/validate_test.go covering the behavior rows (requestTranslator, inLocale, mustValidate with []RequestRule{{Field: "s", Rules: ParseRules("string")}}, and Validate with the translator for the views rows). Run it red.
+
+Catalogs: in modules/phrasebook/lang/pl/validation.yaml set `string:` to ":attribute musi być ciągiem znaków." (the wording pl validate.yaml already uses), keeping the file's quoting; extend the header comment (lines 1-3) with one sentence saying `string`, which Winter's pl file leaves in English, is translated here, so a pl request gets a Polish line where the PHP backend answers in English. Leave every other English line (dimensions, distinct, file, in_array, json, present, required_unless) untouched. In modules/phrasebook/lang/pl/validate.yaml set `max:` to ":attribute nie może być większy niż :max." and `min:` to ":attribute musi być nie mniejszy od :min." (Winter's max.numeric / min.numeric lines; these keys only serve numeric/integer bounds). Do not touch the en catalogs.
+
+Run `git status --short`, stage exactly the three files by path and commit: fix(phrasebook): translate the pl string message and the numeric min/max lines (quick-261104-fx1). No co-author trailer.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && go test -short -count=1 ./modules/lagoon -run 'TestValidate' && go test -short -count=1 ./modules/phrasebook && grep -c 'ciągiem znaków' modules/phrasebook/lang/pl/validation.yaml</automated>
+  </verify>
+  <done>pl request responses use the Polish string message, pl numeric min/max failures from lagoon.Validate read as numbers, all other catalog lines are unchanged, the new test passes, one commit with the three files exists.</done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Read-only risk audit of sibling rules and the full gates</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/quick/261104-fx1-lagoon-validate-min-max-length-on-text-f/261104-fx1-SUMMARY.md</files>
+  <read_first>/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/modules/lagoon/backend_admin_migrations.go (column definitions of backend_users and backend_user_roles only, grep login/email/name/code), /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/docs/examples/blog (its migration for acme_blog_posts title/slug)</read_first>
+  <action>
+Audit (read-only; never edit, stage or commit in a sibling repo). Roots, relative to /media/nvme/dev/golem15/summercms.io/summercms: every `sm-*-plugin` directory, plus the app-owned plugin directories that have no `sm-<name>-plugin` sibling: fonoteka.go/plugins/golem15/fonoteka, sm-bm-app/plugins/jz/bm, sm-summercmsio-app/plugins/golem15/summercms, sm-demo-app/plugins/demo, sm-grzybyfunkcjonalne-app/plugins/grzyby. Confirm that list with `ls -d fonoteka.go/plugins/*/* sm-*-app/plugins/*/*`, dropping directories whose basename has an `sm-<basename>-plugin` sibling (those are submodule copies of the canonical repo) and add any app-owned plugin directory the list misses.
+
+Only lagoon.Validate sources count: methods `Rules() map[string]string` (used by cabana crud, relation and settings saves), `FormRules(ctx, op)` on admin controllers, and rule maps passed to a direct `lagoon.Validate(` call (grep for it in the roots and in the whole of fonoteka.go and sm-*-app, excluding plugin submodule copies). Rules built with lagoon.ParseRules or lagoon.RequestRule are the request validator (already Laravel semantics) and are out of scope. Skip _test.go files.
+
+For every rule entry whose tokens include min: or max: but none of numeric, integer, string, url, record: repo, file:line, field, rule string, the Go field type on the model (string, *string, int, slice, ...), the column definition (grep the column name in the plugin's updates/ or migrations/ directory for varchar(N), text, size:N, or the gorm tag on the model; settings models may live in their own table), and a verdict: SAFE when the column is varchar(N) with N less than or equal to the rule's max (stored data cannot exceed the rule) and there is no min; RISK-MAX when the column is text, unbounded varchar or wider than the rule's max (existing rows may exceed and would fail their next admin save); RISK-MIN when there is a min (existing short values fail their next save); NUMERIC-SUSPECT when the Go field is a number (the rule now compares digit count, probably meant numeric/integer); BROKEN when an argument is not a non-negative whole number or is built at runtime (now an unrecognized-rule error, which cabana turns into a CapabilityError on save). Count `between` entries separately as unchanged (already length-checked, in bytes) without per-row detail. Note any plugin-side code that duplicates a rule's length check (for example sm-oauthserver-plugin console/import_settings.go keeps its own length map) as a later simplification candidate. Do the same for the framework-internal rules listed in the context (cabana contracts.go, backend_users_admin.go FormRules, docs/examples/blog/models/post.go) against modules/lagoon/backend_admin_migrations.go and the example migration.
+
+Gates: go vet ./...; go test -short -count=1 ./...; go test -count=1 ./modules/lagoon/... ./modules/cabana/... with Docker (through sudo -u golem if the socket is denied; say which way ran); go test -count=1 ./cmd/summer -run TestDocsTree; cd examples/hello and go test ./... (separate workspace module). A failure that is pre-existing and unrelated is reported, not fixed; anything caused by this change is fixed within Tasks 1-2's files and committed as a follow-up fix commit with the same quick id.
+
+Write the SUMMARY (template from execute-plan) with: commits; the audit table grouped by repo with totals per verdict; the framework-internal findings; a draft v0.6.1 release-note line (Changed: lagoon.Validate checks min and max as a length on every field that is not integer or numeric, characters of a string and items of a list, as Laravel does; a stored value longer than its rule's max fails its next admin save until shortened; a min/max bound that is not a whole number is now an error); follow-ups for the user: (1) non-numeric between counts bytes, not characters (Laravel's mb_strlen), so Polish text hits the limit early; (2) cabana passes a nil translator to lagoon.Validate (crud.go:882, relation.go:1220, relation_child.go:126, settings.go:267), so every model-rule message in the admin is English, and a pl admin's too-short password message, previously translated by storePassword, is now English; (3) the remaining English lines of pl validation.yaml; (4) the pl string translation deliberately diverges from the PHP backend's English pl response; (5) the source todo can move to done. No STATE.md edit (the orchestrator handles state).
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && go vet ./... && go test -short -count=1 ./... && go test -count=1 ./modules/lagoon/... ./modules/cabana/... && go test -count=1 ./cmd/summer -run TestDocsTree && (cd examples/hello && go test -count=1 ./...) && test -f .planning/quick/261104-fx1-lagoon-validate-min-max-length-on-text-f/261104-fx1-SUMMARY.md</automated>
+  </verify>
+  <done>All gates are green (or pre-existing failures are reported); the SUMMARY holds the per-repo audit table with column sizes and verdicts, the framework-internal findings, the release-note line and the follow-ups; no sibling repo was modified.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| admin client -> cabana form/settings/relation saves | Field values (titles, codes, passwords, tag lists) are client-controlled and validated by lagoon.Validate before they are stored |
+| plugin author -> model Rules() / FormRules() | Rule strings are compiled code; a declared limit must be enforced, and a malformed one must fail loudly |
+| stored rows -> next admin save | Rows written while limits were unenforced may already exceed them |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-261104fx1-01 | Tampering | validateField min/max on non-numeric fields | medium | mitigate | min/max are now enforced on every non-numeric field (runes for strings, element count for lists), so an admin client can no longer store values past a plugin's declared limit (for example a 3-character administrator password or a 10 000-character role name); tests pin the boundaries |
+| T-261104fx1-02 | Denial of service | admin re-save of rows that already exceed a limit | medium | mitigate | Task 3 audits every lagoon.Validate rule in the sibling plugins against its column size and lists RISK rows; the release-note line tells operators that an over-long stored value must be shortened on its next save |
+| T-261104fx1-03 | Tampering | malformed min/max bounds | low | mitigate | A bound that is not a non-negative whole number returns the unrecognized-rule error on every non-numeric field, so a typo cannot silently disable a limit; the audit flags BROKEN rules before the release |
+| T-261104fx1-04 | Denial of service | rune count and element count | low | accept | utf8.RuneCountInString and reflect Len are linear or constant time; request bodies are bounded by the server's body limits |
+| T-261104fx1-05 | Information disclosure | validation messages | low | accept | Messages name only the attribute and the bound, never the submitted value |
+| T-261104fx1-SC | Tampering | go module installs | low | accept | No new dependency; standard library (unicode/utf8, strconv, reflect) only |
+</threat_model>
+
+<verification>
+- No Docker: go vet ./... clean; go test -short -count=1 ./... green; examples/hello tests green.
+- Docker (testcontainers Postgres): go test ./modules/lagoon/... ./modules/cabana/... green, including TestSettingsStringURLRulesPostgres and TestAdministratorsPasswordAndIdentity (the SUMMARY says whether sudo -u golem was needed).
+- Docs: go test -count=1 ./cmd/summer -run TestDocsTree passes.
+- `git show --stat` on each task commit lists only that task's files; other sessions' uncommitted files are untouched; no sibling repo has changes from this task.
+</verification>
+
+<success_criteria>
+- nullable|max:255, required|max:255 and required|min:4|confirmed enforce their limits in admin saves, with Laravel's character and item messages in en and pl.
+- Numeric/integer ranges, between and blank-value handling behave as before.
+- The pl request catalog's string line is Polish; the pl model catalog's numeric min/max lines no longer say "znaków".
+- Two commits on master in summercms.go (behaviour; catalogs), no co-author trailer, no tag or push.
+- The SUMMARY gives the user a complete, verdict-tagged list of sibling rules that start enforcing a limit, a release-note line and the follow-ups.
+</success_criteria>
+
+<output>
+Create `/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/quick/261104-fx1-lagoon-validate-min-max-length-on-text-f/261104-fx1-SUMMARY.md` when done
+</output>

.planning/quick/261104-fx1-lagoon-validate-min-max-length-on-text-f/261104-fx1-SUMMARY.md

@@ -0,0 +1,211 @@
+---
+phase: quick-261104-fx1
+plan: 01
+subsystem: lagoon
+tags: [validation, laravel-compat, phrasebook, i18n]
+status: complete
+requires: [quick-261104-f4x]
+provides:
+  - lagoon.Validate min/max as length on every non-numeric field (characters of strings and numbers, items of slices and maps)
+  - min.array / max.array messages in lagoon.Validate
+  - Polish string line in the pl request catalog, numeric wording for pl lagoon::validate.min/max
+affects: [cabana admin form, settings and relation saves, plugin APIs that call lagoon.Validate directly]
+tech-stack:
+  added: []
+  patterns: [Laravel getSize without a numeric rule (ruleLength)]
+key-files:
+  created: []
+  modified:
+    - modules/lagoon/validate.go
+    - modules/lagoon/validate_test.go
+    - modules/cabana/settings_string_url_test.go
+    - modules/cabana/backend_users_admin.go
+    - modules/lagoon/README.md
+    - docs/database/casts-and-validation.md
+    - modules/phrasebook/lang/pl/validation.yaml
+    - modules/phrasebook/lang/pl/validate.yaml
+decisions:
+  - "lagoon.Validate applies min/max as a length on every field without numeric or integer (Laravel's getSize): runes of a string or of a number's decimal form, element count of a slice or map; blank values, booleans, structs (dates), fixed arrays and byte slices are not measured"
+  - "A malformed min/max bound is the unrecognized-rule error on every non-numeric rule string, whatever the value"
+  - "pl validation.yaml translates the string line although Winter's pl file leaves it English (deliberate divergence, noted in the file header)"
+metrics:
+  duration: ~45min
+  completed: 2026-11-04
+actuals:
+  tokens: 7650
+  tasks: 3
+  commits: 2
+commits: 2
+plan_head_before: 0785336a502fce29c8c349a7b72ecfda9455661a
+plan_head_after: 145251481b40cddce31bb47c34f3a41b8323c6f2
+---
+
+# Quick 261104-fx1: lagoon.Validate min/max length on text fields Summary
+
+`lagoon.Validate` now applies Laravel's `min`/`max` semantics on every field that is not `integer` or `numeric`: the character count (runes) of a string or of a number's decimal form with the `min.string`/`max.string` messages, and the element count of a slice or map with the new `min.array`/`max.array` messages. Before this, the check ran only when the rule string held `string` or `url`. The pl catalogs now give a Polish `string` message for requests and numeric wording for the `lagoon::validate.min`/`max` lines.
+
+## Commits
+
+| Task | Commit | Message |
+|------|--------|---------|
+| 1 | 335f8e6 | feat(lagoon): check min and max as length on every non-numeric field (quick-261104-fx1) |
+| 2 | 1452514 | fix(phrasebook): translate the pl string message and the numeric min/max lines (quick-261104-fx1) |
+| 3 | (none) | Read-only audit plus gates, results below |
+
+## What changed
+
+- `validateField`: `lengthRange` is now `!hasNumeric && !hasInteger`. `lengthBound` parses both bounds before the nullable short-circuit, so `max:abc` fails on a nil value too. The dead `min=`/`max=` tags in the non-numeric branch are gone. The `between` tags stay, so the `between` length check (still in bytes) runs as before.
+- The string/url block now always runs after `required`. A blank value (nil, nil pointer, `""`, whitespace, empty slice or map) skips it. Otherwise the order is: the `string` type failure (returned alone), the `url` format failure, then `min.<kind>`/`max.<kind>` from the new `ruleLength` helper.
+- `ruleLength(val) (n, kind, ok)`: Laravel's getSize without a numeric rule. Strings, named string types and pointers to them give runes, kind `string`. Signed and unsigned integers and floats give the runes of their base-10 form (`FormatFloat 'f', -1`), kind `string`. Slices (except byte slices) and maps give `Len()`, kind `array`. Everything else is not measured.
+- `validateMessage` sends `min.array`/`max.array` to `lagoon::validation.` and has English fallbacks for both.
+- pl `validation.yaml` `string:` is now ":attribute musi być ciągiem znaków." and the header says why. pl `validate.yaml` `max:`/`min:` are now ":attribute nie może być większy niż :max." / ":attribute musi być nie mniejszy od :min.".
+- The README, `docs/database/casts-and-validation.md` and the storePassword doc comment are updated.
+
+## Tests
+
+- TDD: the new rows (reversed pin, `TestValidateLengthWithoutStringRule`, `...Translated`, the cabana `code` cases, `TestValidatePolishStringAndNumericLines`) failed for the expected reason first ("[] want [...]"), then passed after the change.
+- Task 1 verify: `go vet` on lagoon and cabana is clean. `go test -short ./modules/lagoon` and the cabana `TestSettingsStringURLRules|TestSettingsSecret` tests pass. The Docker tests `TestSettingsStringURLRulesPostgres` and `TestAdministratorsPasswordAndIdentity` (all subtests, including too_short) pass. `TestDocsTree` passes.
+- Task 2 verify: `go test -short ./modules/lagoon -run TestValidate` and `./modules/phrasebook` pass. `grep -c 'ciągiem znaków'` gives 1.
+- Full gates: see "Gates" below.
+
+## Audit: rules that start enforcing a limit
+
+Scope: lagoon.Validate sources only, meaning `Rules()`, `FormRules()` and maps passed directly to `lagoon.Validate(`. `_test.go` files are excluded. The roots are the 25 `sm-*-plugin` repos plus the app-owned plugins `fonoteka.go/plugins/golem15/fonoteka`, `sm-bm-app/plugins/jz/bm`, `sm-summercmsio-app/plugins/golem15/summercms`, `sm-demo-app/plugins/demo` and `sm-grzybyfunkcjonalne-app/plugins/grzyby`. The other `plugins/*/*` entries in the apps are submodule copies of `sm-*-plugin` repos. Rule entries holding min/max but none of numeric/integer/string/url: **57**.
+
+Verdict key:
+- SAFE: varchar(N) with N <= max. Postgres varchar counts characters, the same unit as the rule.
+- RISK-MAX: text, or a varchar wider than the rule's max.
+- RISK-MIN: the rule has a min.
+- No NUMERIC-SUSPECT or BROKEN rows were found. No Go number field carries a bare min/max, and every bound is a literal whole number.
+
+### RISK rows (first)
+
+| Repo | file:line | Field | Rule | Go type | Column | Verdict | Note |
+|------|-----------|-------|------|---------|--------|---------|------|
+| framework (summercms.go) | modules/cabana/contracts.go:49 | name (BackendUserRole) | required\|max:255\|unique:backend_user_roles | string | backend_user_roles.name TEXT | RISK-MAX | Winter's column is varchar(255), so imported data fits; only names saved through the Go admin could exceed |
+| framework | modules/cabana/contracts.go:50 | code (BackendUserRole) | required\|max:255 | string | backend_user_roles.code TEXT | RISK-MAX | same |
+| framework | modules/cabana/contracts.go:169 | login (BackendUser) | required\|max:255 | string | backend_users.login TEXT | RISK-MAX | same |
+| framework | modules/cabana/contracts.go:170 | email (BackendUser) | required\|email\|max:255 | string | backend_users.email TEXT | RISK-MAX | same |
+| framework | modules/cabana/backend_users_admin.go:479/482/483 | login, email (usersAdmin FormRules) | required\|max:255, required\|email\|max:255 | string | backend_users TEXT | RISK-MAX | same as above |
+| framework | modules/cabana/backend_users_admin.go:477-479 | password (usersAdmin FormRules) | nullable\|min:4\|confirmed / required\|min:4\|confirmed | virtual string | not stored (bcrypt hash) | RISK-MIN | Only a typed password is checked (blank skips), so no stored-row risk. The message is now lagoon.Validate's English one (see follow-up 2) |
+| sm-bm-app (jz/bm, app-owned) | models/checklist.go:36 | description | nullable\|max:10000 | *string | jz_bm_checklists.description TEXT | RISK-MAX | manage_records.go:234 validates the whole row on every PATCH, so an over-long description blocks unrelated edits too |
+| sm-bm-app (jz/bm) | models/checklist_item.go:52 | notes | nullable\|max:10000 | *string | jz_bm_checklist_items.notes TEXT | RISK-MAX | same whole-row PATCH effect |
+| sm-feedback-plugin | models/submission.go:80 | email | nullable\|email\|max:255 | *string | golem15_feedback_submissions.email TEXT | RISK-MAX | The public submit path (ValidateRequest SubmitRules) already enforces max:255, so only pre-port data could exceed |
+| sm-oauthserver-plugin | models/client.go:77 | redirect_uris_text | nullable\|max:20000 | string (virtual, gorm `-`) | built from redirect_uris TEXT | RISK-MAX | A client whose joined redirect URIs exceed 20000 characters fails its next save |
+| sm-oauthserver-plugin | models/client.go:79 | sector_identifier | nullable\|max:255 | *string | sector_identifier TEXT | RISK-MAX | |
+| sm-oauthserver-plugin | models/settings.go:70 | custom_css | nullable\|max:20000 | *string | custom_css TEXT | RISK-MAX | The importer (console/import_settings.go settingsColumns) already skips values over 20000 characters, and branding.go caps at MaxCustomCSS. Only CSS saved through the admin before this change could exceed |
+| sm-user-plugin | models/organisation.go:57 | name | required\|max:255 | string | organisations.name TEXT | RISK-MAX | |
+| sm-user-plugin | models/organisation.go:59 | description | nullable\|max:5000 | *string | organisations.description TEXT | RISK-MAX | |
+| sm-sociallogin-plugin | models/settings.go:68 | microsoft_tenant | nullable\|max:255 | *string | microsoft_tenant TEXT | RISK-MAX | tenantPattern `^[A-Za-z0-9.-]+$` sets no length, so a long value is possible but very unlikely |
+
+### SAFE rows
+
+| Repo | file:line | Field | Rule | Go type | Column |
+|------|-----------|-------|------|---------|--------|
+| framework | docs/examples/blog/models/post.go:34 | title | required\|max:255 | string | VARCHAR(255) |
+| framework | docs/examples/blog/models/post.go:35 | slug | required\|max:255\|unique:acme_blog_posts | string | VARCHAR(255) |
+| fonoteka.go (app plugin) | controllers/api/token_api_controller.go:37 | name | required\|max:255 | JSON request value | api_tokens.name VARCHAR(255) (create only; a >255 name is now a 422 instead of a DB error) |
+| sm-bm-app (jz/bm) | models/checklist.go:35 | title | required\|max:255 | string | VARCHAR(255) |
+| sm-bm-app | models/checklist_item.go:51 | title | required\|max:500 | string | VARCHAR(500) |
+| sm-bm-app | models/checklist_item.go:53 | url | nullable\|max:2048 | *string | VARCHAR(2048) |
+| sm-bm-app | models/checklist_item.go:54 | presentation_slug | nullable\|max:255 | *string | VARCHAR(255) |
+| sm-bm-app | models/class_session.go:43 | room | nullable\|max:100 | *string | VARCHAR(100) |
+| sm-bm-app | models/class_session.go:44 | kind | nullable\|max:100 | *string | VARCHAR(100) |
+| sm-bm-app | models/class_session.go:45 | lecturer | nullable\|max:255 | *string | VARCHAR(255) |
+| sm-bm-app | models/course.go:60 | code | nullable\|max:50 | *string | VARCHAR(50) |
+| sm-bm-app | models/course.go:61 | name | required\|max:255 | string | VARCHAR(255) |
+| sm-bm-app | models/course.go:63 | lecturer | nullable\|max:255 | *string | VARCHAR(255) |
+| sm-bm-app | models/course.go:66 | assessment | nullable\|max:100 | *string | VARCHAR(100) |
+| sm-bm-app | models/course.go:67 | elective_group | nullable\|max:100 | *string | VARCHAR(100) |
+| sm-bm-app | models/course.go:68 | syllabus_url | nullable\|max:2048 | *string | VARCHAR(2048) |
+| sm-bm-app | models/deadline.go:39 | title | required\|max:255 | string | VARCHAR(255) |
+| sm-bm-app | models/material.go:54 | title | required\|max:255 | string | VARCHAR(255) |
+| sm-bm-app | models/material.go:56 | source | nullable\|max:500 | *string | VARCHAR(500) |
+| sm-bm-app | models/material.go:57 | url | nullable\|max:2048 | *string | VARCHAR(2048) |
+| sm-bm-app | models/reading.go:39 | title | required\|max:500 | string | VARCHAR(500) |
+| sm-bm-app | models/reading.go:40 | author | nullable\|max:255 | *string | VARCHAR(255) |
+| sm-bm-app | models/reading.go:41 | source | nullable\|max:500 | *string | VARCHAR(500) |
+| sm-bm-app | models/reading.go:42 | url | nullable\|max:2048 | *string | VARCHAR(2048) |
+| sm-bm-app | models/tag.go:25 | name | required\|max:100 | string | VARCHAR(100) |
+| sm-bm-app | models/tag.go:26 | slug | required\|max:100\|unique:jz_bm_tags | string | VARCHAR(100) |
+| sm-oauthserver-plugin | models/client.go:76 | name | required\|max:255 | string | VARCHAR(255) |
+| sm-oauthserver-plugin | models/settings.go:60 | site_name | nullable\|max:120 | *string | VARCHAR(120) |
+| sm-oauthserver-plugin | models/settings.go:61-67 | page_background, surface_color, text_color, muted_text_color, border_color, accent_color, accent_text_color (7 rows) | nullable\|max:32 | *string | VARCHAR(32) |
+| sm-oauthserver-plugin | models/settings.go:68 | font_css_url | nullable\|max:512 | *string | VARCHAR(512) |
+| sm-oauthserver-plugin | models/settings.go:69 | font_family | nullable\|max:200 | *string | VARCHAR(200) |
+| sm-paymentgatewaysubscriptions-plugin | models/subscription_plan.go:70 | code | required\|max:50\|unique:golem15_pgsub_subscription_plans | string | VARCHAR(50) |
+| sm-paymentgatewaysubscriptions-plugin | models/subscription_plan.go:71 | name | required\|max:255 | string | VARCHAR(255) |
+| sm-presentations-plugin | models/presentation.go:59 | title | required\|max:255 | string | VARCHAR(255) |
+| sm-presentations-plugin | models/presentation.go:60 | slug | required\|max:255\|unique:golem15_presentations_presentations | string | VARCHAR(255) |
+| sm-presentations-plugin | models/presentation.go:61 | context | nullable\|max:255 | *string | VARCHAR(255) |
+| sm-presentations-plugin | models/presentation.go:65 | theme | nullable\|max:32 | *string | VARCHAR(32) |
+| sm-presentations-plugin | models/slide.go:77 | title | max:255 | string | VARCHAR(255) |
+| sm-presentations-plugin | models/slide.go:78 | css_class | max:60 | string | VARCHAR(60) |
+| sm-presentations-plugin | models/slide.go:79 | section_label | nullable\|max:120 | *string | VARCHAR(120) |
+| sm-quizzes-plugin | models/question.go:49 | category | nullable\|max:255 | *string | VARCHAR(255) |
+| sm-quizzes-plugin | models/quiz.go:46 | title | required\|max:255 | string | VARCHAR(255) |
+| sm-quizzes-plugin | models/quiz.go:47 | slug | required\|max:255\|unique:golem15_quizzes_quizzes | string | VARCHAR(255) |
+| sm-quizzes-plugin | models/quiz.go:48 | context | nullable\|max:255 | *string | VARCHAR(255) |
+
+### Totals
+
+| Verdict | Plugin / app rows | Framework rows | Total |
+|---------|-------------------|----------------|-------|
+| SAFE | 48 (fonoteka 1, bm 23, oauthserver 11, pgsub 2, presentations 7, quizzes 4) | 2 (blog example) | 50 |
+| RISK-MAX | 9 (bm 2, feedback 1, oauthserver 3, user 2, sociallogin 1) | 6 (contracts.go 4, usersAdmin FormRules login/email 2) | 15 |
+| RISK-MIN | 0 | 1 (usersAdmin password, virtual) | 1 |
+| NUMERIC-SUSPECT | 0 | 0 | 0 |
+| BROKEN | 0 | 0 | 0 |
+
+The plugin and app rows add up to the 57 entries the scan found (48 + 9).
+
+Unchanged rules:
+- `between` on non-numeric fields: 15 entries, all already length-checked in bytes and unchanged. 14 are literal: fonoteka style slug, journal tag slug, pgsub plan currency, user.go email/password/password_confirmation, user_group name, users_admin_controller email, api_controller 456/500/672/673/674/771. One more is built at runtime: users_admin_controller password `between:<min_length>,255`, a valid whole-number bound. Separately, 4 `between` entries with integer/numeric are numeric ranges.
+- min/max together with `string`/`url`: 17 entries (feedback settings and submission, journal settings), unchanged since 261104-f4x.
+- min/max together with `numeric`/`integer`: 26 entries, unchanged.
+
+Behaviour notes:
+- Direct non-admin callers: `sm-bm-app` `manage_records.go:234` validates the whole row on every API PATCH, and fonoteka `token_api_controller.go` validates a request body. Their frontends now get a 422 for over-long values. In bm this happens on any PATCH of a row that already holds one.
+- Duplicate length checks, candidates for later simplification: `sm-oauthserver-plugin/console/import_settings.go` `settingsColumns` repeats the settings Rules() maxima, and `classes/branding.go` `MaxCustomCSS` caps the CSS. The bound in `storePassword` (`adminPasswordMinChars`) now repeats the FormRules min:4.
+- Not a finding of this change: `sm-paymentgateway-plugin` `Currency.Rules()` and `Order.Rules()` use `size:3`, which lagoon.Validate does not implement (an unrecognized-rule error). Neither is reached today: there is no currency screen, and the orders FormRules return an empty map and FormBeforeUpdate refuses saves. Logged for awareness, nothing changed.
+- `ruleLength` does not measure `sql.NullString` or other struct wrappers. No audited rule uses one.
+
+## Draft v0.6.1 release-note line
+
+**Changed:** `lagoon.Validate` now checks `min` and `max` as a length on every field that is not `integer` or `numeric`, the way Laravel does: characters for a string, items for a list. A stored value longer than its rule's `max` fails its next admin save until it is shortened. A `min`/`max` bound that is not a whole number is now an error.
+
+## Deviations from Plan
+
+None. The plan was executed as written. One small implementation detail: `ruleLength` also measures `reflect.Uintptr`, so every unsigned kind is covered (commit 335f8e6). Neither cabana file had uncommitted edits from other sessions, so both were edited.
+
+## Follow-ups for the user
+
+1. A non-numeric `between` counts bytes (`len(s)`), not characters (Laravel's `mb_strlen`), so Polish text reaches the limit early. Example: `between:3,64` on journal tag slugs, user names and group names.
+2. cabana passes a nil translator to lagoon.Validate (crud.go:882, relation.go:1220, relation_child.go:126, settings.go:267), so every model-rule message in the admin is English. A too-short password in a pl admin used to get storePassword's translated message; it now gets lagoon.Validate's English "The password must be at least 4 characters.".
+3. pl `validation.yaml` still has English lines, all for rules this task does not touch: dimensions, distinct, file, in_array, json, present, required_unless.
+4. The pl `string` translation deliberately differs from the PHP backend, whose pl response is English (the file header records this).
+5. The source todo `.planning/todos/pending/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md` can move to done.
+6. Before tagging v0.6.1, operators of apps with RISK-MAX rows (oauthserver custom_css/redirect URIs, bm checklist descriptions/notes, user organisations, backend roles/users) may want to check for over-long stored values. For example: `SELECT id FROM jz_bm_checklists WHERE char_length(description) > 10000`.
+
+## Gates
+
+Docker was reachable directly; `sudo -u golem` was not needed.
+
+| Gate | Result |
+|------|--------|
+| `go vet ./...` | clean |
+| `go test -short -count=1 ./...` | all ok |
+| `go test -count=1 ./modules/lagoon/... ./modules/cabana/... ./modules/phrasebook/...` (Docker, testcontainers) | ok: lagoon 47s, lagoon/attach 84s, cabana 137s, phrasebook |
+| `go test -count=1 ./cmd/summer -run TestDocsTree` | ok |
+| `examples/hello`: `go test -count=1 ./...` | ok |
+
+No sibling repo was modified; the audit was read-only. The pre-existing dirt in `../sm-oauthserver-plugin/go.work` (dated 2026-10-23), `../sm-journal-plugin/go.work.sum` and `../sm-grzybyfunkcjonalne-app/.gsd/` was already there. The `examples/hello` test regenerates `examples/hello/plugins.gen.go`, setting FrameworkVersion from v0.5.3 to v0.6.0. That file was restored with `git checkout --`, so it stays uncommitted. Follow-up: either commit the bumped stamp or stop the test from writing into the tree.
+
+## Known Stubs
+
+None.
+
+## Self-Check: PASSED
+
+- FOUND: modules/lagoon/validate.go, modules/lagoon/validate_test.go, modules/cabana/settings_string_url_test.go, modules/cabana/backend_users_admin.go, modules/lagoon/README.md, docs/database/casts-and-validation.md, modules/phrasebook/lang/pl/validation.yaml, modules/phrasebook/lang/pl/validate.yaml
+- FOUND: 335f8e6, 1452514 (`git rev-list --count 0785336..HEAD` = 2)

.planning/quick/261104-xae-phase-33-gap-fix-follow-ups/261104-xae-PLAN.md

@@ -0,0 +1,361 @@
+---
+phase: quick-261104-xae
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/classes/headings.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/classes/headings_test.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/headings_test.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/controllers/api/maintenance.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/README.md
+  - /media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin/classes/crawl/job.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin/crawl_lifecycle_test.go
+  - /media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin/README.md
+  - /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/server/lib/site.ts
+  - /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/server/middleware/seo-root.ts
+  - /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/tests/rootFiles.test.ts
+  - /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/README.md
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-journal-plugin-v0.4.0.md
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-seo-plugin-v0.2.0.md
+  - /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-seo-layer-v0.2.0.md
+autonomous: true
+requirements:
+  - quick-261104-xae
+
+estimate:
+  tokens: 100000
+  raw_tokens: 100000
+  tasks: 4
+  confidence: low
+
+must_haves:
+  truths:
+    - "ConvertContentH1 rewrites <h1> in content only outside goldmark's code ranges (fenced and indented code blocks, code spans), whatever the body's first byte, on every caller (API and MCP saves, journal:import-posts, journal:fix-headings, translations): the reviewer's probe \"<p class=\\\"lead\\\">Intro</p>\\n\\n```html\\n<h1>Hello</h1>\\n```\" comes back byte-identical with n=0, a raw <h1> outside code becomes <h2>, and an HTML body (no code ranges) is converted as before"
+    - "POST /_journal/api/v1/images/alt on a locale whose content is blank (a translation that holds only content_html) answers 200 with changed true and writes the alt into content_html alone, so a batch holding such a change is no longer refused with 422"
+    - "images/alt reads every non-blank content as markdown: a markdown body that starts with < gets its inline image label set, its code samples untouched, and keeps the alt after the next save of the same content; an image it does not hold as an inline image or a raw <img> outside code is refused with 422 changes.N.src (never answered changed true and reverted later)"
+    - "A crawl whose result store runs past its bound ends at once as failed, with finished_at and the error \"storing the crawl results took longer than <bound>: <store error>\"; the final status write and the end of the conga record run on their own 30-second bound, the job returns nil, and the next Start is accepted"
+    - "vue-seo-layer's siteAnswer remembers the last definite site answer (ok or absent): after the cache expires while the backend is unreachable or answers neither 200-object nor 404, the remembered answer is used, so on a site without the SEO plugin /robots.txt, /sitemap.xml and /llms.txt keep passing through to the app; a backend that has not answered since start (or since the last purge) is still unknown and those three files still get 503"
+    - "No exported Go signature of sm-journal-plugin changes; sm-seo-plugin only adds crawl.WithFinishTimeout; each changed behaviour is in its README and in the three 33-14 release-note drafts"
+    - "Every new test failed on the code before its fix, for the reason the finding describes"
+  artifacts:
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/classes/headings.go
+      provides: "unexported convertH1OutsideCode on markdownCodeRanges; ConvertContentH1 without the first-byte gate"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/controllers/api/maintenance.go
+      provides: "images/alt body rule: blank content means content_html is the body, any other content is markdown"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin/classes/crawl/job.go
+      provides: "finish with a store bound, a 30 s final-write bound and a prune bound; WithFinishTimeout test seam"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/server/lib/site.ts
+      provides: "lastKnown memory of the last ok or absent answer; the cache clock read at call time"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin/crawl_lifecycle_test.go
+      provides: "TestCrawlStoreTimeout (Docker)"
+    - path: /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/tests/rootFiles.test.ts
+      provides: "siteAnswer memory cases with a stubbed $fetch and a mocked Date.now"
+  key_links:
+    - from: "controllers/api/posts_helpers.go:865,875, console/import_posts.go:229,367, classes/heading_fix.go:155,180"
+      to: "classes.ConvertContentH1 / ConvertTranslationH1 -> convertH1OutsideCode -> markdownCodeRanges (classes/image_alt.go)"
+      via: "every content H1 conversion except the admin rich editor's decode (ConvertH1 on HTML) and category host content"
+    - from: "controllers/api/maintenance.go SetImageAlt"
+      to: "classes.SetMarkdownImageAlt + classes.SetImageAltOutsideCode"
+      via: "the switch on strings.TrimSpace(text.content)"
+    - from: "crawl.Run"
+      to: "finish(detached ctx, ..., finishTimeoutFrom(ctx))"
+      via: "store on its own bound, then terminal UPDATE + conga FailJob/StopJob/CompleteJob on finalWriteTimeout, then Prune"
+    - from: "server/middleware/seo-root.ts"
+      to: "rootFileTargets(path, siteAnswer(...))"
+      via: "a remembered absent returns null (pass-through); unknown without memory proxies the FIXED names (503 on failure)"
+---
+
+<objective>
+Close the four new warnings of the Phase 33 gap-closure re-review (`.planning/phases/33-seo-output-audit-and-content/33-REVIEW-GAPFIX.md`, WR-01 to WR-04), one task per fix, in three sibling repositories, before the 33-14 release:
+
+1. sm-journal-plugin WR-01: `ConvertContentH1` rewrites `<h1>` inside code samples of a markdown body that starts with an HTML block.
+2. sm-journal-plugin WR-02: `images/alt` refuses images of content_html-only translations (a 422 regression from 33-15), and sends markdown starting with `<` down the HTML branch (answered `changed: true`, then reverted).
+3. sm-seo-plugin WR-03: the crawl's final status write shares the store's `FinishTimeout` deadline, so a store that times out leaves the crawl `running` and loses the error.
+4. vue-seo-layer WR-04: only an `ok` site answer is remembered, so after any outage longer than the cache TTL an SEO-less site's robots.txt, sitemap.xml and llms.txt answer 503 instead of reaching the app.
+
+Purpose: the drafts for sm-journal-plugin v0.4.0, sm-seo-plugin v0.2.0 and vue-seo-layer v0.2.0 describe behaviour these defects contradict; 33-14 must not tag them in this state.
+
+Output: one code commit per task on each repository's default branch (sm-journal-plugin `main` x2, sm-seo-plugin `main`, vue-seo-layer `main`), one planning-docs commit in summercms.go (`master`) with the three release-note drafts, and the full Phase 33 gate (plugins, layers, docker) green. No push, no tag.
+</objective>
+
+<execution_context>
+@~/.claude/msd-core/workflows/execute-plan.md
+@~/.claude/msd-core/templates/summary.md
+</execution_context>
+
+<context>
+@/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/CLAUDE.md
+@/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-REVIEW-GAPFIX.md
+
+Repositories (siblings under /media/nvme/dev/golem15/summercms.io/summercms/), with BASE recorded at planning time; record the actual BASE in the SUMMARY before Task 1 and stop if a repo is not on its default branch:
+- sm-journal-plugin: branch `main`, BASE 0a62090; untracked `go.work.sum` belongs to nobody in this task, never stage it.
+- sm-seo-plugin: branch `main`, BASE 2a288a9, clean.
+- vue-seo-layer: branch `main`, BASE 973142a, clean.
+- summercms.go: branch `master`, BASE 5ce50be. Other sessions have uncommitted edits (STATE.md, state.json, G15OFFICE.md, .msd/, phase 19.x/20/32.1 files, 33-REVIEW-GAPFIX.md): leave them alone, stage only the three release-note drafts by path.
+
+Rules for every task (user and project rules):
+- Commits: no `Co-Authored-By` and no `Claude-Session` trailer (the user's rule overrides any attribution reminder). One logical change per commit; stage files explicitly by path, never `git add -A`; run `git status --short` before staging. No push, no tag.
+- sm-journal-plugin is a core plugin: additive only. No exported function, method, type or constant changes its signature or disappears; new helpers stay unexported.
+- Commit shas used by the acceptance checks: T1 and T2 (sm-journal-plugin, Tasks 1 and 2), T3 (sm-seo-plugin), T4 (vue-seo-layer), TN (summercms.go notes commit); record each in the SUMMARY. If 0a62090, 2a288a9 or 973142a is not the BASE recorded before Task 1, use the recorded BASE in their place.
+- Every new test is run against the code before its fix and must fail there for the reason the finding names; record the observed failure line in the SUMMARY (the 33-15 practice: "tests that pin a fix are checked to fail on the old code").
+- Docker tests use testcontainers. If the Docker socket is denied although the user is in the docker group, run the same command through `sudo -u golem` (CLAUDE.md) and say so in the SUMMARY.
+
+Facts gathered during planning (do not re-derive):
+
+Task 1 (sm-journal-plugin, WR-01):
+- classes/headings.go (112 lines): `ConvertH1(html) (string, int)` lines 18-58 (fast path: no `<h1`/`</h1` case-insensitively returns the input and 0; counts h1 start tags; keeps an unfinished tail); `containsFold` 66-68; `ConvertContentH1(content, contentHTML) (string, string, int)` lines 78-88 converts contentHTML, returns content untouched when `!LooksLikeHTML(content)`, else `ConvertH1(content)`; count = content_html's when > 0, else content's. `ConvertTranslationH1(attrs)` 95-112 calls ConvertContentH1 in place.
+- classes/image_alt.go: `markdownCodeRanges(md) [][2]int` line 335 returns the sorted, merged byte ranges of fenced code block lines and info string, indented code blocks and code spans (backticks included), offsets into the untrimmed md; HTML blocks are NOT ranges there (html=false), so an HTML body has no ranges. `SetImageAltOutsideCode` lines 162-190 is the pattern to copy: walk the ranges, apply the rewrite to each gap, copy each range verbatim.
+- `LooksLikeHTML` (classes/blog_editor.go:129) stays exported and in use elsewhere (blog editor load); only headings.go stops calling it.
+- Callers of ConvertContentH1/ConvertTranslationH1: controllers/api/posts_helpers.go:865,875 (API and MCP saves, after FormatHTML), console/import_posts.go:229,367 (import, after FormatHTML), classes/heading_fix.go:155,180 (journal:fix-headings). classes/blog_editor.go:181 (admin rich editor decode, HTML) and heading_fix.go:128 (category host content, HTML) call ConvertH1 directly and are not touched.
+- At v0.3.1 (the last tag) ConvertContentH1 ran ConvertH1 on content unconditionally (code samples included); 33-15 (untagged) stopped rewriting content whenever its first byte is not `<`. The new rule (convert outside code, no first-byte gate) keeps v0.3.1's conversion of real headings and drops only the code-sample corruption.
+- classes/headings_test.go: TestConvertContentH1 lines 48-82, TestConvertTranslationH1 88-107. Line 79 pins `ConvertContentH1("plain <h1>x</h1> text", "")` as unchanged with n=0; under the new rule that raw `<h1>` is outside code, so the pin flips to `"plain <h2>x</h2> text"`, n=1 (deliberate; say so in the commit body and SUMMARY).
+- headings_test.go (root, package journal_test, Docker): TestHeadingConversion line 192; its 33-15 subtest "markdown with a fenced h1 sample keeps its source" (around lines 295-322) posts markdown through the API with `posts` and `token` and imports it with `console.ImportPosts(env.app)`; copy its shape. Helpers: apiPostID, storedPost, setH1ToH2, cmdInput, bonfire.NewOutput.
+- README.md: line 181 (the "On." bullet, the parenthetical after "markdown content"), line 183 (the "Stored content." bullet, parenthetical "default and translated; of a markdown post only `content_html`"), line 495 (API row for ConvertContentH1/ConvertTranslationH1).
+
+Task 2 (sm-journal-plugin, WR-02):
+- controllers/api/maintenance.go: handler doc comment lines 96-113; the branch at lines 172-188 (`if classes.LooksLikeHTML(text.content) { SetImageAlt on content, accepted with m == 0 } else { SetMarkdownImageAlt, then SetImageAltOutsideCode; m+r == 0 -> 422 changes.N.src errMarkdownImage }`); `loadImageAltText` 263-283 reads content and content_html per locale (translations through translate.TranslatedExact; an absent translated content is ""); `writeImageAltTexts` writes only attributes that changed.
+- A translation that carries only content_html is a supported API shape: `validateTranslations` (posts_helpers.go:665) does not require content, and `FormatTranslation` (classes/format_html.go:304-320) sanitizes a supplied content_html when content is blank.
+- The admin rich editor stores HTML in content and the same HTML in content_html (controllers/posts.go preparePostWrite). goldmark reads such HTML as HTML blocks, which markdownCodeRanges does not list, so `SetImageAltOutsideCode` finds its `<img>` as a raw img outside code: the markdown branch covers HTML bodies too. TestSetImageAlt (headings_test.go:582) already posts an HTML-shaped default body `<p><img src=a></p><p><img src=b alt="old"></p>` and a pl translation `<p><img src=a></p>` and asserts the alt lands in both content and content_html; it must keep passing unchanged and is the proof for HTML bodies.
+- Residual edge accepted (same as Task 1): an admin HTML body in which a blank line is followed by a line indented 4 or more spaces holding the `<img>` is an indented code block to goldmark, so that one image would get 422. Note it in the SUMMARY; do not special-case it.
+- Test helpers (root package): newPostsEnv, env.admin, env.expect, apiPostID, storedPost, translatedAttrs (posts_admin_smoke_test.go:304), listenRecords; the endpoint path is journalAPIPrefix + "/images/alt"; editor permissions `controllers.PermissionAccessPosts, controllers.PermissionAccessOtherPosts`.
+- README.md line 187 (the "Image alt." bullet). The MCP tool description in mcp.go:232 stays as it is (still accurate; tests may pin it).
+
+Task 3 (sm-seo-plugin, WR-03):
+- classes/crawl/job.go: const block lines 46-55 (JobTimeout 6h, FinishTimeout 10m, HeartbeatEvery 1m, StaleAfter 10m, exported); `heartbeatWrite = 10 * time.Second` line 58 (unexported, the style for the new bound); Run lines 200-228 builds `fctx := context.WithTimeout(context.WithoutCancel(ctx), FinishTimeout)` and calls `finish(fctx, svc, gdb.WithContext(fctx), row, res, runErr, ctx.Err())`; `finish` lines 361-420 reads cancelRequested and LoadLimits on db, runs `lagoon.Transaction(ctx, db, store)` (SavePages, Keyphrases, Check with Lookup, svc.Issues, SaveIssues), then the terminal `db.Model(&models.Crawl{}).Where("id = ?", row.ID).Updates(updates)` (returns its error), then conga FailJob/StopJob/CompleteJob on ctx, the failed-crawl warn log, then `Prune(db, limits.Keep)` (warn on error). `errors` is already imported (finalStatus).
+- classes/crawl/render.go lines 38-55: `rendererKey`, `WithRenderer(ctx, r)` and `rendererFrom(ctx)` are the precedent for a code-only test seam carried by the job context ("settable only from Go code: no config key, setting, request or MCP call reaches it"). jobs.go:28 passes the job context straight to crawl.Run, so a value set by a test on the context given to `job.Work` reaches Run.
+- classes/crawl/actions.go:97-103 Prune is one DELETE on golem15_seo_crawls beyond Keep (cascading to pages, links and issues of old crawls); it can be large, so it keeps a store-sized bound of its own after the final state is written (the reviewer suggested the 30 s bound; a large cascade would then never finish).
+- classes/crawl/store.go:19 SavePages builds the rows in memory and then inserts the crawl's pages into golem15_seo_crawl_pages before its links; its first write is the one the test blocks.
+- crawl_lifecycle_test.go (root, package seo_test, Docker): helpers newBlockingSite, lifecycleSite, env.crawlRow, env.runCrawlAsync(t, ctx, id), waitJob (30 s), env.storedPages; TestCrawlTimeout lines 225-255 is the model. crawl_site_test.go: bootCrawlEnv(t) line 310, env.startCrawl(t, token) 333, newFakeSite 48, site.sitemap 97, site.plant 176 with doc{path, title}; env.admin(t, true) gives a token; env.db is the *gorm.DB on the test database. lagoon sets no MaxOpenConns, so a test transaction holding a lock does not starve the job.
+- README.md line 250 (the "Limits." paragraph: "bounded by `crawl.FinishTimeout` (10 min)") and the API reference rows 341-346 (row 345 lists `crawl.WithRenderer`).
+
+Task 4 (vue-seo-layer, WR-04):
+- server/lib/site.ts (110 lines): header comment 1-17 (the three states); `cache = createLru<SeoSiteState>({ max: 1, ttlMs: SITE_CACHE_TTL_MS })` line 27 (createLru's default clock `now = Date.now` is captured when the cache is created, so a test cannot move it); `let lastOk` line 28; `clearSiteCache()` 31-34 clears the cache and lastOk; `siteState(status, body)` 41-45 (200 object ok, 404 absent, anything else unknown); `siteAnswer(cfg, headers)` 48-64 fetches with `$fetch.raw('/site', ...)` (Nitro global, resolved at call time, so a test can stub `globalThis.$fetch`), caches only ok/absent, sets lastOk on ok and returns lastOk for unknown; `FIXED` line 72; `rootFileTargets` 95-110 with its doc comment 80-94 (absent returns null; FIXED names are targeted in any other state; everything else needs ok).
+- server/lib/lru.ts: `createLru({ max, ttlMs, now })`, `now` is the documented test clock option; `clear()` bumps a generation so no request after a purge sees an answer fetched before it.
+- Consumers of siteAnswer: server/middleware/seo-root.ts (rootFileTargets; comment lines 10-19 describes the states), seo-verification.ts and seo-drift.ts and api/__seo__/site.get.ts (act only on ok; absent and unknown behave the same there), api/__seo__/sitemap.get.ts (unknown 503, absent 404: with a remembered absent the HTML sitemap API answers 404 during an outage, as it does while the backend is up; acceptable, note it in the SUMMARY).
+- Purge semantics (planner's choice): `clearSiteCache` keeps clearing the memory, as it cleared lastOk, so a purge still drops every answer fetched before it (lru.ts contract); the backend that sent the purge is up, and the next request learns its state again. "Never answered" therefore means since the server started or since the last purge.
+- A backend whose /site always answers 200 with HTML or 401/403 never gives a definite answer and stays unknown, so its fixed root files are still proxied (reviewer's last WR-04 paragraph). Out of scope (the brief keeps 503 for a site that has never answered); list it as a residual in the SUMMARY with the operator workaround (`seo.rootFiles: false` or `seo.cms: false`).
+- tests/rootFiles.test.ts (86 lines) imports rootFileTargets, siteState and the SeoSiteState type from '../server/lib/site.ts' and seoBackendBase, seoServerConfig from '../server/lib/config.ts'; constants B (backend base) and A (api base). `seoServerConfig({})` yields apiBase A and timeoutMs 1500. `npm test` runs `node --test --test-reporter=tap tests/*.test.ts` (Node 24 here, type stripping; one process per file).
+- README.md line 32 (the "Root files." bullet: "while the backend is down the last one seen is used. While the backend has not answered since the server started, ...").
+
+Release notes (Task 4, summercms.go): .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-journal-plugin-v0.4.0.md lines 20-21 (Changed: the H1 bullet and the image-alt bullet), 33-14-notes-sm-seo-plugin-v0.2.0.md line 16 (Added: crawl cancel and time limits), 33-14-notes-vue-seo-layer-v0.2.0.md line 25 (Fixed: the root-file 503s). User-facing markdown, no planning IDs, no H1.
+
+Gate: `scripts/check-phase33.sh` with several stages prints `PASS plugins`, `PASS layers`, `PASS docker` (or `FAIL <stage>` and exit 1). --plugins runs vet and short tests of the three Go plugins plus JOURNAL_UNIT_TESTS (includes ./classes:TestConvertContentH1) and the plugins' vitest; --layers runs the four layers' node --test, playground builds and smoke runs (vue-seo-layer smoke:ssr includes expect-seo-down.txt, the never-answered 503 case); --docker runs each Go plugin's full `go test ./...` with Postgres.
+</context>
+
+<tasks>
+
+<task type="tracer" tdd="true">
+  <name>Task 1: H1 conversion rewrites markdown content only outside code (sm-journal-plugin, WR-01)</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/classes/headings.go, /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/classes/headings_test.go, /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/headings_test.go, /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/README.md</files>
+  <precondition>sm-journal-plugin is on branch main at 0a62090 (or a descendant with no change to classes/headings.go), and `docker info` succeeds (else use sudo -u golem for the Docker tests).</precondition>
+  <read_first>classes/headings.go (whole), classes/image_alt.go lines 158-190 and 320-418, classes/headings_test.go (whole), headings_test.go lines 186-330 (TestHeadingConversion and its 33-15 markdown subtest), README.md lines 178-190 and 495</read_first>
+  <behavior>
+    - Probe (the reviewer's input): `ConvertContentH1(probe, FormatHTML(probe))` and `ConvertContentH1(probe, "")`, with probe = "<p class=\"lead\">Intro</p>\n\n```html\n<h1>Hello</h1>\n```", both return content identical to probe, content_html unchanged and n=0. On the current code they return "<h2>Hello</h2>" inside the fence and n=1 (RED).
+    - A raw heading outside code in a body that starts with an HTML block is still converted: "<p class=\"lead\">Intro</p>\n\n<h1>Real</h1>\n\n```html\n<h1>Hello</h1>\n```" with "" gives the same text with "<h2>Real</h2>" and the fenced "<h1>Hello</h1>" kept, n=1.
+    - A code span is kept: "<p>x</p>\n\nUse `<h1>` here" with "" is unchanged, n=0.
+    - ConvertTranslationH1 on {content: probe, content_html: FormatHTML(probe)} returns 0 and leaves content identical to probe.
+    - Existing rows keep their results: "# Title\n\ntext" with "<h1>Title</h1><p>text</p>"; "<h1>a</h1><h1>b</h1>" with "" (both converted, n=2); "<p>x</p>" pair (n=0); the 33-15 fenced/inline markdown sample; every TestConvertH1 and TestConvertTranslationH1 row.
+    - Deliberate flip of the pin at classes/headings_test.go:79: "plain <h1>x</h1> text" with "" now gives "plain <h2>x</h2> text", n=1 (a raw h1 outside code is a heading in the rendered page; v0.3.1 converted it too). Update the comment above that assertion accordingly.
+    - Docker, TestHeadingConversion, new subtest "markdown that starts with an HTML block keeps its h1 samples": with the H1 setting on, POST md = "<p class=\"lead\">Intro</p>\n\n# Title\n\n```html\n<h1>Hello</h1>\n```" through the API: the stored content equals md byte for byte, content_html has no "<h1" and contains "&lt;h1&gt;Hello&lt;/h1&gt;" and "<h2"; the same md imported with console.ImportPosts (slug imported-html-lead) stores content equal to md and content_html without "<h1". On the current code the stored content holds "<h2>Hello</h2>" (RED).
+  </behavior>
+  <action>
+Record BASE (`git -C ../sm-journal-plugin rev-parse HEAD`) and run `git status --short` there.
+
+Tests first (RED): in classes/headings_test.go add the behavior rows to TestConvertContentH1 and TestConvertTranslationH1 (or a new TestConvertContentH1HTMLLead next to them; keep TestConvertContentH1 as the name the gate requires), flip the line-79 pin as described, and add the Docker subtest to TestHeadingConversion in headings_test.go next to the 33-15 markdown subtest, using its helpers. Run `go test -short -count=1 -run 'TestConvertContentH1|TestConvertTranslationH1' ./classes` and the subtest, and record the failure lines (the probe comes back with "<h2>Hello</h2>" and n=1; the flipped pin fails the other way).
+
+Implementation (GREEN), classes/headings.go only:
+- Add the unexported helper `convertH1OutsideCode(md string) (string, int)` after ConvertContentH1 (grep classes/ for the name first; pick another if it exists). It returns md and 0 at once when md contains neither "<h1" nor "</h1" case-insensitively (reuse containsFold, so goldmark only parses bodies that have an h1); otherwise it takes `markdownCodeRanges(md)`, applies ConvertH1 to each gap between ranges and to the tail, copies every range byte for byte, sums the counts, and returns the original md (same string) with 0 when nothing was converted. Model it on SetImageAltOutsideCode in classes/image_alt.go. Doc comment: ConvertH1 on the parts of markdown md outside its fenced and indented code blocks and code spans (goldmark's AST, the engine of FormatHTML); an h1 shown in a code sample keeps its tag; HTML blocks are not code, so an HTML body is converted whole.
+- ConvertContentH1: keep the signature and the count rule (content_html's count when > 0, else content's). Convert contentHTML with ConvertH1 and content with convertH1OutsideCode, with no first-byte (LooksLikeHTML) gate. Rewrite its doc comment: content is read as markdown, as every render path reads it (FormatHTML passes raw HTML through, so an HTML body is HTML blocks and is converted as before); an `<h1>` inside a code block or code span keeps its tag whatever the body's first character, so a markdown post that opens with an HTML block keeps its code samples (33-REVIEW-GAPFIX WR-01); a raw `<h1>` outside code becomes `<h2>`, as in the rendered HTML.
+- ConvertTranslationH1 doc comment: replace its sentence about markdown content with "content is rewritten outside code only (ConvertContentH1)".
+- No other file in classes/ changes; LooksLikeHTML stays where it is.
+
+README.md (same commit): in the "On." bullet (line 181) replace the parenthetical after "markdown content" with: its source is converted outside code only (`classes.ConvertContentH1` reads `content` as markdown, as the renderer does): an `<h1>` in a code block or code span keeps its tag, also when the body starts with an HTML block, and a raw `<h1>` elsewhere becomes `<h2>`, as in the rendered HTML. In the "Stored content." bullet (line 183) replace "of a markdown post only `content_html`" with "in a markdown source outside code only". In the API row at line 495 say `ConvertH1` over a post's `content` (outside markdown code) and `content_html`, and over one locale's translated attributes.
+
+After the commit below, check additivity in two steps so a failing git is not read as clean: `git diff 0a62090..$T1 -- . ':!*_test.go' > <scratchpad>/xae-journal-api.diff` must exit 0, then `grep -E '^-func [A-Z]|^-func \([^)]*\) [A-Z]|^-type [A-Z]' <scratchpad>/xae-journal-api.diff` must find nothing (<scratchpad> is the session scratchpad directory).
+
+Run `git status --short`, stage exactly classes/headings.go, classes/headings_test.go, headings_test.go and README.md by path, and commit: `fix: H1 conversion leaves code alone in markdown that starts with HTML`, body: ConvertContentH1 reads content as markdown on every path and converts it outside goldmark's code ranges only; a body opening with an HTML block keeps the h1 tags of its code samples, a raw h1 outside code is converted as in v0.3.1 (the 33-15 test pin for that case is reversed). quick-261104-xae, review WR-01. No trailer.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin && go vet ./... && go test -short -count=1 ./... && go test -count=1 -run 'TestConvertH1|TestConvertContentH1|TestConvertTranslationH1' ./classes && go test -count=1 -run 'TestHeadingConversion|TestFixHeadingsCommand' .</automated>
+    <fails_when>The probe is rewritten or counted (n != 0) by ConvertContentH1 or ConvertTranslationH1; a raw h1 outside code stays h1; the API or import subtest stores a content different from the submitted markdown; any existing heading test regresses; go vet or a short test fails.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func convertH1OutsideCode" classes/headings.go` and `grep -n "convertH1OutsideCode(content)" classes/headings.go` each match once.
+    - `grep -c 'lead' classes/headings_test.go` is at least 1 and the probe assertion expects n == 0; the line-79 assertion expects "plain <h2>x</h2> text" and 1.
+    - The SUMMARY quotes the RED failure line of the probe case on the old code and of the Docker subtest.
+    - The additivity diff check exits 0 and its grep finds nothing; `git show --stat $T1` lists exactly the four files (record T1 in the SUMMARY).
+    - README.md line 181, 183 and 495 describe the outside-code rule (`grep -c "outside code" README.md` grew by at least 2).
+  </acceptance_criteria>
+  <done>Markdown content is converted outside code only, whatever its first byte; the probe is untouched with n=0; HTML bodies convert as before; the README matches; one commit on sm-journal-plugin main.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: images/alt on content_html-only translations and on markdown that starts with a tag (sm-journal-plugin, WR-02)</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/controllers/api/maintenance.go, /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/headings_test.go, /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin/README.md</files>
+  <precondition>Task 1 is committed on sm-journal-plugin main; `docker info` succeeds (else sudo -u golem).</precondition>
+  <read_first>controllers/api/maintenance.go lines 80-283, classes/format_html.go lines 300-320, headings_test.go lines 576-700 (TestSetImageAlt), posts_admin_smoke_test.go lines 300-320 (translatedAttrs), README.md line 187</read_first>
+  <behavior>
+    New Docker test TestSetImageAltBodyShapes in headings_test.go (package journal_test), with a = "https://cdn.example.test/a.jpg", the editor token of TestSetImageAlt and POST journalAPIPrefix + "/images/alt":
+    - (a) content_html-only translation: create a post with content "Intro\n\n![](" + a + ")" and translations {"pl": {"title": "Obrazy", "content_html": "<p><img src=\"" + a + "\"></p>"}}. One batch [{post_id, src: a, alt: "Grzyb"}, {post_id, locale: "pl", src: a, alt: "Lew"}] answers 200; the pl change has changed true and old_alt nil; the pl content_html holds alt="Lew"; the pl content is still blank (absent or whitespace); the default content became "Intro\n\n![Grzyb](" + a + ")". On the current code the batch answers 422 with changes.1.src and "not an inline image" (RED).
+    - (b) markdown starting with a tag: content "<p class=\"lead\">Intro</p>\n\n![](" + a + ")\n\n```html\n<img src=\"" + a + "\">\n```\n" gets alt "Grzyb": 200; the stored content equals "<p class=\"lead\">Intro</p>\n\n![Grzyb](" + a + ")\n\n```html\n<img src=\"" + a + "\">\n```\n" (label set, code sample untouched); content_html holds alt="Grzyb"; after PUT /posts/{id} with that same content the content_html still holds alt="Grzyb". On the current code the code sample's img is rewritten and the label stays empty (RED).
+    - (c) markdown starting with a tag that holds the image only by reference: content "<p>Lead</p>\n\n![old][r]\n\n[r]: " + a + "\n" answers 422 with changes.0.src and "not an inline image"; content and content_html are unchanged. On the current code it answers 200 with changed true (RED).
+    - TestSetImageAlt passes unchanged (its HTML-shaped default body and pl translation still get the alt in content and content_html).
+  </behavior>
+  <action>
+Tests first (RED): add TestSetImageAltBodyShapes after TestSetImageAlt in headings_test.go with the three cases, reusing TestSetImageAlt's env setup, decode helper shape and assertions style (copy the small decode closure). Run `go test -count=1 -run 'TestSetImageAltBodyShapes' .` and record the three RED failures.
+
+Implementation (GREEN) in controllers/api/maintenance.go: replace the two-way branch on the first byte of text.content (lines 172-188) with a switch on the body shape, per 33-REVIEW-GAPFIX WR-02:
+- `strings.TrimSpace(text.content) == ""`: content_html is the body (a translation that holds only content_html, or a host row without content); nothing else to keep in sync, so only content_html gets the alt and the change is answered as usual.
+- default: the existing markdown rule, unchanged: SetMarkdownImageAlt, then SetImageAltOutsideCode on its result; m+r == 0 refuses the change with 422 changes.N.src and errMarkdownImage; otherwise text.content takes the result. Comment: content is read as markdown, as FormatHTML renders it on every API path; an HTML body (the rich editor's) is HTML blocks to goldmark, so its img is a raw img outside code and gets the alt here too; the first character no longer picks the branch, so markdown that opens with a tag keeps its code samples and is never answered changed and reverted later.
+Keep everything else (the content_html SetImageAlt before the switch, the answer map, the transaction) as it is. Rewrite the handler doc comment (lines 96-113) to say: the post's content gets the alt too, read as markdown (an HTML body included): its inline image or a raw img outside code; a locale whose content is blank (a translation that carries only content_html) gets it in content_html alone. Run `go vet ./...`; if the classes import or any helper became unused, the build says so.
+
+README.md line 187 ("Image alt." bullet): replace the part from "and in `content`" to "so the next content save keeps the alt" with: and in `content`, read as markdown as the renderer reads it (an HTML body included, whose `<img>` is a raw image outside code): its inline image `![alt](src)` (with or without a title, outside code; `classes.SetMarkdownImageAlt`) or a raw `<img>` outside code (`classes.SetImageAltOutsideCode`), also when the markdown starts with an HTML tag, so the next content save keeps the alt; a locale whose `content` is blank (a translation that carries only `content_html`) gets the alt in `content_html` alone. Keep the rest of the bullet.
+
+Run `git status --short`, stage exactly controllers/api/maintenance.go, headings_test.go and README.md, and commit: `fix: image alt on HTML-only translations and on markdown that starts with a tag`, body: blank content means content_html is the body (no 422 for content_html-only translations, a regression from the markdown alt fix); any other content is handled as markdown, so a body opening with a tag gets its inline image label and keeps its code samples. quick-261104-xae, review WR-02. No trailer.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/sm-journal-plugin && go vet ./... && go test -short -count=1 ./... && go test -count=1 -run 'TestSetImageAlt' . && go test -count=1 -run 'TestSetImageAlt|TestSetMarkdownImageAlt' ./classes</automated>
+    <fails_when>A content_html-only translation's change is refused (422) or writes a content value; a markdown body starting with a tag keeps an empty label, has its code-sample img rewritten, or loses the alt after the next save; a reference-only image is answered 200; TestSetImageAlt's HTML-shaped bodies stop getting the alt in content; go vet or a short test fails.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n 'strings.TrimSpace(text.content) == ""' controllers/api/maintenance.go` matches once.
+    - `grep -n "func TestSetImageAltBodyShapes" headings_test.go` matches once; the SUMMARY quotes its three RED failures on the Task 1 commit.
+    - TestSetImageAlt's body is unchanged: `git diff $T1..$T2 -- headings_test.go > <scratchpad>/xae-t2-tests.diff` exits 0 and the file has no removed line inside TestSetImageAlt; the test passes.
+    - No exported Go identifier changed: `git diff $T1..$T2 -- controllers/api/maintenance.go > <scratchpad>/xae-t2-api.diff` exits 0 and `grep -E '^-func [A-Z]' <scratchpad>/xae-t2-api.diff` finds nothing; `git show --stat $T2` lists exactly the three files.
+    - README.md line 187 names the blank-content case (`grep -c "is blank (a translation that carries only" README.md` is at least 1).
+  </acceptance_criteria>
+  <done>images/alt accepts content_html-only translations again, handles every non-blank body as markdown, and refuses what the markdown cannot hold; one commit on sm-journal-plugin main.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: the crawl's final status gets its own bound (sm-seo-plugin, WR-03)</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin/classes/crawl/job.go, /media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin/crawl_lifecycle_test.go, /media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin/README.md</files>
+  <precondition>sm-seo-plugin is on branch main at 2a288a9 (or a descendant with no change to classes/crawl/job.go); `docker info` succeeds (else sudo -u golem).</precondition>
+  <read_first>classes/crawl/job.go lines 40-60, 190-230 and 355-420, classes/crawl/render.go lines 36-55, classes/crawl/store.go lines 19-85, classes/crawl/actions.go lines 95-103, crawl_lifecycle_test.go (whole), crawl_site_test.go lines 40-120, 170-200 and 305-360, README.md line 250 and lines 340-347</read_first>
+  <behavior>
+    New Docker test TestCrawlStoreTimeout in crawl_lifecycle_test.go, after TestCrawlTimeout:
+    - A fake site with "/" (title Home) and "/a" in its sitemap; a crawl started through the API (env.startCrawl with env.admin(t, true)).
+    - A separate transaction on env.db runs `LOCK TABLE golem15_seo_crawl_pages IN SHARE MODE` before the job starts, so the store's first write (SavePages' insert of the pages) waits; it is rolled back as soon as the row has left running, and in t.Cleanup in any case.
+    - The job runs through env.runCrawlAsync with ctx = crawl.WithFinishTimeout(fetchguard.WithTransport(t.Context(), site), 2*time.Second).
+    - Within 20 s the row leaves running: status failed, error containing "storing the crawl results took longer than 2s", error not containing "time limit", finished_at set. After the lock is released the job returns nil (waitJob), no page of the crawl is stored (the store rolled back), and a second env.startCrawl succeeds.
+    - RED on the old finish: the row stays running (the terminal UPDATE runs on the expired store context) and the job returns a deadline error.
+    - TestCrawlTimeout, TestCrawlCancelRunning, TestCrawlStaleRecovery and TestCrawlerTracer pass unchanged.
+  </behavior>
+  <action>
+Step A, seam only (no behaviour change yet): in classes/crawl/job.go add `type finishTimeoutKey struct{}`, the exported `WithFinishTimeout(ctx context.Context, d time.Duration) context.Context` and the unexported `finishTimeoutFrom(ctx context.Context) time.Duration` (the ctx value when it is a positive duration, else FinishTimeout), modelled on WithRenderer/rendererFrom with the same doc wording: the test seam of the store bound, settable only from Go code, no config key, setting, request or MCP call reaches it. Make Run use `finishTimeoutFrom(ctx)` in place of FinishTimeout for its existing fctx. Write TestCrawlStoreTimeout as in behavior and run `go test -count=1 -run TestCrawlStoreTimeout .`: it must fail because the row stays running (record the line).
+
+Step B, the fix (per 33-REVIEW-GAPFIX WR-03):
+- Next to heartbeatWrite add the unexported `finalWriteTimeout = 30 * time.Second`, documented as the bound of a crawl's final status write and the end of its conga record, on a context of their own, so a store that used up its bound still ends the crawl.
+- Run: stop building fctx; call `finish(context.WithoutCancel(ctx), svc, gdb, row, res, runErr, ctx.Err(), finishTimeoutFrom(ctx))`. finish (unexported) takes the detached parent context, the undecorated *gorm.DB and the store bound.
+- finish: create the store context `context.WithTimeout(parent, storeBound)` (deferred cancel) and use `gdb.WithContext` of it for cancelRequested, LoadLimits (with its existing default fallback) and `lagoon.Transaction(storeCtx, storeDB, store)`; the store closure is unchanged. When the transaction fails, status is failed and errText is the error; when the store context's error is context.DeadlineExceeded, errText becomes "storing the crawl results took longer than " + storeBound.String() + ": " + the error. Then create a fresh `context.WithTimeout(parent, finalWriteTimeout)` (deferred cancel) and run the terminal Updates on `gdb.WithContext` of it (still returning its error), and FailJob/StopJob/CompleteJob on that context. The failed-crawl warn log stays. Then Prune on its own `context.WithTimeout(parent, storeBound)` (deferred cancel) with the existing warn on error; comment that Prune deletes old crawls with their pages and links, keeps a store-sized bound and runs after the final state is written, so it never holds a crawl running.
+- Update the doc comments: the const block (FinishTimeout bounds storing what a crawl found; the final status is then written on a 30-second bound of its own), Run's paragraph about the detached context, and finish's (its contexts and bounds).
+
+README.md: in the "Limits." paragraph (line 250), after "bounded by `crawl.FinishTimeout` (10 min)" add: the crawl's final status is then written on a 30-second bound of its own, so a crawl whose results take longer to store still ends at once, failed with "storing the crawl results took longer than 10m0s: …". Add an API row after the `crawl.WithRenderer` row: `crawl.WithFinishTimeout` | A code-only test override of `crawl.FinishTimeout`, like `crawl.WithRenderer`.
+
+Run `go vet ./...` and the verify command, then `git status --short`, stage exactly classes/crawl/job.go, crawl_lifecycle_test.go and README.md, and commit: `fix: a crawl whose store runs out of time still ends failed`, body: the store keeps FinishTimeout, the final status write and the conga job end get their own 30 s bound and prune its own store-sized bound, so the row no longer stays running with the error lost until RecoverStale; adds the code-only crawl.WithFinishTimeout seam. quick-261104-xae, review WR-03. No trailer.
+  </action>
+  <verify>
+    <automated>cd /media/nvme/dev/golem15/summercms.io/summercms/sm-seo-plugin && go vet ./... && go test -short -count=1 ./... && go test -count=1 -run 'TestCrawlStoreTimeout|TestCrawlTimeout|TestCrawlCancelRunning|TestCrawlStaleRecovery|TestCrawlerTracer' .</automated>
+    <fails_when>The crawl row stays running after its store ran past the bound, its error lacks "storing the crawl results took longer than 2s", finished_at is unset, the job returns an error, the next Start is refused, or an existing crawl lifecycle test regresses; go vet or a short test fails.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -n "func WithFinishTimeout" classes/crawl/job.go` matches once; `grep -c "finalWriteTimeout" classes/crawl/job.go` is at least 2; `grep -n "took longer than" classes/crawl/job.go` matches once.
+    - `grep -n "func TestCrawlStoreTimeout" crawl_lifecycle_test.go` matches once; the SUMMARY quotes its Step A RED line.
+    - The only new exported identifier is WithFinishTimeout: `git diff 2a288a9..$T3 -- classes/crawl/job.go > <scratchpad>/xae-t3.diff` exits 0, `grep -E '^\+func [A-Z]' <scratchpad>/xae-t3.diff` shows only WithFinishTimeout and `grep -E '^-func [A-Z]' <scratchpad>/xae-t3.diff` finds nothing.
+    - README.md mentions `crawl.WithFinishTimeout` and the 30-second final write; `git show --stat $T3` lists exactly the three files.
+  </acceptance_criteria>
+  <done>A store that times out no longer strands a running crawl: the crawl ends failed with the real error right away; one commit on sm-seo-plugin main.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 4: remember the last definite site answer, absent included (vue-seo-layer, WR-04); release notes; full gate</name>
+  <files>/media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/server/lib/site.ts, /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/server/middleware/seo-root.ts, /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/tests/rootFiles.test.ts, /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer/README.md, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-journal-plugin-v0.4.0.md, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-seo-plugin-v0.2.0.md, /media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-seo-layer-v0.2.0.md</files>
+  <precondition>vue-seo-layer is on branch main at 973142a (or a descendant with no change to server/lib/site.ts); Tasks 1-3 are committed; Docker is reachable for the gate's docker stage (else sudo -u golem).</precondition>
+  <read_first>server/lib/site.ts (whole), server/lib/lru.ts lines 1-40, server/middleware/seo-root.ts lines 1-40, server/api/__seo__/sitemap.get.ts lines 1-45, tests/rootFiles.test.ts (whole), README.md line 32, the three 33-14 release-note drafts (whole, 21-33 lines each)</read_first>
+  <behavior>
+    New node --test cases in tests/rootFiles.test.ts driving siteAnswer(seoServerConfig({}), {}) with a stubbed `globalThis.$fetch = { raw }` (records calls; answers {status, _data} objects or throws) and `t.mock.method(Date, 'now', () => clock)`; each case calls clearSiteCache() first and restores the previous $fetch at its end:
+    - "a remembered absent outlives the cache while the backend is down (WR-04)": 404 gives absent; clock moves past SITE_CACHE_TTL_MS; then a thrown error, 500 {}, 200 "<html>" and 401 {} each give state absent, each call fetches again (the call count grows by one per call), and rootFileTargets for /robots.txt, /sitemap.xml and /llms.txt with that state is null. On the old code (with only the clock change below) the state is unknown (RED).
+    - "the latest definite answer wins": ok, expire, 404, expire, failure gives absent; expire, ok, expire, failure gives ok and rootFileTargets('/robots.txt') is the root target. On the old code the first failure gives ok (RED).
+    - Guard (passes before and after): never answered, a failure gives unknown, rootFileTargets('/robots.txt', ...) is [{kind: 'root', url: B + '/robots.txt'}] (the middleware's failing fetch then answers 503), and a second failure fetches again (unknown is never cached).
+    - Guard (passes before and after): absent, then clearSiteCache(), then a failure gives unknown (a purge forgets the remembered answer).
+    - Every existing rootFiles.test.ts case passes unchanged.
+  </behavior>
+  <action>
+Step A (no behaviour change): in server/lib/site.ts pass `now: () => Date.now()` to the site cache's createLru options, so the clock is read at call time and tests can move it. Write the four cases as in behavior (import siteAnswer, clearSiteCache and SITE_CACHE_TTL_MS from '../server/lib/site.ts'). Run `npm test` in vue-seo-layer: the two WR-04 cases fail with state unknown / ok (record the lines), the guards pass.
+
+Step B, the fix (per 33-REVIEW-GAPFIX WR-04): rename lastOk to lastKnown, store every answer that is not unknown in it (ok or absent), and return it for an unknown answer when set; clearSiteCache still clears it (a purge drops every answer fetched before it, as the cache does). Rewrite the header comment's state list: unknown means the backend did not answer or answered something other than a 200 object or a 404; the last definite answer (ok or absent) seen since the server started or the last purge is then used; with none, robots.txt, sitemap.xml and llms.txt still go to the backend (a failure is a 503 with Retry-After) and every other path behaves as with absent. Update the rootFileTargets doc comment (a site answer or an absent one may be the remembered one; unknown here means never answered) and the seo-root.ts comment lines 10-19 (the last answer, ok or absent, is kept while the backend is down, so on a backend without the SEO plugin the files keep reaching the app during an outage; only a backend that has not answered since start or the last purge gets the fixed names proxied). No other server file changes.
+
+README.md "Root files." bullet (line 32): say the site answer is cached for 300 seconds and cleared by the purge, and while the backend is down the last answer it gave is used, a 404 included, so on a site whose backend has no SEO plugin robots.txt and the sitemaps keep coming from the app during an outage; the 503 sentence then applies while the backend has not answered since the server started or since the last purge.
+
+Run `npm test` (all files, `# fail 0`), then `git status --short`, stage exactly server/lib/site.ts, server/middleware/seo-root.ts, tests/rootFiles.test.ts and README.md, and commit in vue-seo-layer: `fix: root files follow the last site answer, a 404 included, while the backend is down`, body: an SEO-less site's robots.txt, sitemap.xml and llms.txt keep reaching the app during an outage longer than the cache TTL; a backend that never answered still gets the 503. quick-261104-xae, review WR-04. No trailer.
+
+Release notes in summercms.go (user-facing wording, no planning IDs):
+- 33-14-notes-sm-journal-plugin-v0.4.0.md, Changed: replace the H1 bullet (line 20) with: The H1 to H2 conversion leaves code samples alone: in a markdown body an `<h1>` inside a code block or code span keeps its tag, also when the body starts with an HTML block, and a raw `<h1>` elsewhere is converted as in the rendered page (API saves, imports, `journal:fix-headings` and translations). Replace the alt bullet (line 21) with: Setting an image's alt text through the API or MCP on a markdown post writes it into the markdown (`![alt](src)`, or a raw `<img>` outside code), also when the markdown starts with an HTML tag, so the next save keeps it; an image the markdown does not hold that way is refused with a validation error. A translation that holds only HTML gets the alt in its HTML.
+- 33-14-notes-sm-seo-plugin-v0.2.0.md, Added, the crawl cancel and time limits bullet (line 16): append: When storing a crawl's results takes longer than 10 minutes, the crawl still ends at once, failed with that error, instead of staying "running" until the next start.
+- 33-14-notes-vue-seo-layer-v0.2.0.md, Fixed (line 25): keep the sentence and append: Once the backend has answered, its last answer is used while it is down, so on a site whose backend has no SEO plugin these files keep coming from the app during an outage.
+Run `git -C <summercms.go> status --short`, stage exactly the three files by path, and commit: `docs(33): release notes for the gap-fix follow-ups (quick-261104-xae)`. No trailer.
+
+Full gate from summercms.go: `set -o pipefail; PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --plugins --layers --docker 2>&1 | tee <scratchpad>/gate-xae.log`, where <scratchpad> is the session scratchpad directory; it must exit 0 and the log must hold the lines `PASS plugins`, `PASS layers` and `PASS docker`. A failure caused by these changes is fixed in the task's own files and committed as a follow-up fix commit in the affected repo (same quick id); a pre-existing, unrelated failure is reported in the SUMMARY with its log line, not fixed.
+  </action>
+  <verify>
+    <automated>set -o pipefail && cd /media/nvme/dev/golem15/summercms.io/summercms/vue-seo-layer && npm test 2>&1 | tee /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/xae-node-test.log | tail -5 && grep -q '^# fail 0$' /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/xae-node-test.log && cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --plugins --layers --docker 2>&1 | tee /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/gate-xae.log && grep -qx 'PASS plugins' /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/gate-xae.log && grep -qx 'PASS layers' /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/gate-xae.log && grep -qx 'PASS docker' /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/gate-xae.log</automated>
+    <fails_when>After an absent answer and an expired cache a failing backend yields unknown or targets /robots.txt, /sitemap.xml or /llms.txt; an ok answer outlives a later absent one; a never-answered backend stops targeting the fixed names; any node --test case fails; the gate exits non-zero or lacks a PASS line for plugins, layers or docker.</fails_when>
+  </verify>
+  <acceptance_criteria>
+    - `grep -c "lastKnown" server/lib/site.ts` is at least 3 and `grep -c "now: () => Date.now()" server/lib/site.ts` is 1; `grep -c "siteAnswer" tests/rootFiles.test.ts` is at least 4.
+    - The SUMMARY quotes the two WR-04 RED lines from Step A.
+    - vue-seo-layer `git show --stat $T4` lists exactly the four files; `git diff --quiet 973142a..$T4 -- package.json pnpm-lock.yaml` exits 0.
+    - The drafts hold the new text: `grep -c "code block or code span" 33-14-notes-sm-journal-plugin-v0.4.0.md` is 1, `grep -c "holds only HTML" 33-14-notes-sm-journal-plugin-v0.4.0.md` is 1, `grep -c "longer than 10 minutes" 33-14-notes-sm-seo-plugin-v0.2.0.md` is 1, `grep -c "no SEO plugin these files keep coming from the app" 33-14-notes-vue-seo-layer-v0.2.0.md` is 1; summercms.go `git show --stat $TN` lists exactly those three files.
+    - gate-xae.log holds `PASS plugins`, `PASS layers` and `PASS docker`; the command exited 0.
+  </acceptance_criteria>
+  <done>The layer keeps an SEO-less site's root files with the app during outages and still answers 503 for a backend that never answered; the three drafts describe all four fixes; every repo's tests and the Phase 33 gate stages pass.</done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| API/MCP client -> Journal post writes and images/alt | Markdown content, translations and alt texts are client-controlled; conversions must not corrupt code samples and alt text must stay escaped |
+| crawl job -> Postgres | The crawl's terminal state and the one-at-a-time guard depend on the final write landing |
+| search-engine crawler -> Nuxt root files | robots.txt answers decide whether a whole site is crawled |
+| test code -> crawl job context | WithFinishTimeout is a context value only Go code can set |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
+|-----------|----------|-----------|----------|-------------|-----------------|
+| T-261104xae-01 | Tampering | classes.ConvertContentH1 on markdown that starts with an HTML block | medium | mitigate | Task 1 converts content outside goldmark code ranges only; the probe test and the API/import subtest pin byte-identical code samples |
+| T-261104xae-02 | Tampering | images/alt on markdown that starts with a tag | low | mitigate | Task 2 routes every non-blank content through SetMarkdownImageAlt and SetImageAltOutsideCode, whose labels are backslash-escaped and whose img attributes are re-encoded by the tokenizer (T-33-74 unchanged); code samples are not touched |
+| T-261104xae-03 | Denial of service | images/alt batch with a content_html-only translation | low | mitigate | Blank content no longer refuses the whole batch; the alt still goes only through SetImageAlt's tokenizer encoding |
+| T-261104xae-04 | Denial of service | crawl finish after a store timeout | medium | mitigate | Task 3 writes the final state on its own 30 s bound, so the guard is released at once instead of after RecoverStale; prune keeps a store-sized bound after the final write |
+| T-261104xae-05 | Elevation of privilege | crawl.WithFinishTimeout seam | low | accept | A context value settable only from Go code, like WithRenderer and fetchguard.WithTransport; no config key, setting, request or MCP call reaches it |
+| T-261104xae-06 | Denial of service | robots.txt 503 on a site without the SEO plugin | medium | mitigate | Task 4 remembers an absent answer, so a backend outage no longer turns the site's robots.txt into a 5xx that crawlers read as a site-wide disallow; never-answered backends keep the 503 that protects a staging Disallow |
+| T-261104xae-07 | Information disclosure | remembered site answer across purges | low | accept | The purge still clears the memory; the remembered answer is only the backend's own public site answer and is used only while the backend is unreachable |
+| T-261104xae-SC | Tampering | go modules / npm packages | low | accept | No dependency added or changed; go.mod, go.sum, package.json and pnpm-lock.yaml stay untouched in all repos |
+</threat_model>
+
+<verification>
+- sm-journal-plugin: go vet ./... clean; go test -short ./... green; Docker TestHeadingConversion, TestFixHeadingsCommand, TestSetImageAlt, TestSetImageAltBodyShapes green; no exported signature changed since 0a62090.
+- sm-seo-plugin: go vet ./... clean; go test -short ./... green; Docker TestCrawlStoreTimeout and the crawl lifecycle tests green.
+- vue-seo-layer: npm test `# fail 0`.
+- summercms.go: `PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --plugins --layers --docker` under pipefail exits 0 with PASS plugins, PASS layers, PASS docker.
+- Every new test's RED failure on the pre-fix code is quoted in the SUMMARY.
+- Commits: sm-journal-plugin 2, sm-seo-plugin 1, vue-seo-layer 1, summercms.go 1 (notes only), each listing only its task's files, no trailer; nothing pushed or tagged; other sessions' uncommitted files untouched.
+</verification>
+
+<success_criteria>
+- WR-01: the reviewer's probe is left unchanged with n=0 on every conversion path; real raw H1s outside code are still converted.
+- WR-02: content_html-only translations get their alt (200), markdown starting with a tag gets its label set and keeps code samples, unsupported images get 422.
+- WR-03: a store timeout ends the crawl failed with the store error at once; the next crawl can start.
+- WR-04: an SEO-less site's root files keep reaching the app during an outage; a never-answered backend still gets 503 for robots.txt, sitemap.xml and llms.txt.
+- Release-note drafts updated in one planning-docs commit; the Phase 33 gate stages plugins, layers and docker pass.
+</success_criteria>
+
+<output>
+Create `/media/nvme/dev/golem15/summercms.io/summercms/summercms.go/.planning/quick/261104-xae-phase-33-gap-fix-follow-ups/261104-xae-SUMMARY.md` when done, with: BASE and HEAD per repo; the commit list; per finding, the test and its quoted RED line; the planner choices (no first-byte gate and the reversed line-79 pin; the markdown branch covering HTML bodies and its indented-code residual; the WithFinishTimeout seam, the error prefix and prune's own bound; the purge still clearing the remembered answer, and a remembered absent making /api/__seo__/sitemap answer 404 during an outage); the residuals (a backend whose /site answers 200 HTML or 401/403 stays unknown, workaround seo.rootFiles false or seo.cms false; the review's notes below the warning bar, untouched); the gate log path with its PASS lines. Do not edit STATE.md (the orchestrator handles state and the g15office comment).
+</output>

.planning/quick/261104-xae-phase-33-gap-fix-follow-ups/261104-xae-SUMMARY.md

@@ -0,0 +1,149 @@
+---
+phase: quick-261104-xae
+plan: 01
+subsystem: seo, journal
+tags: [sm-journal-plugin, sm-seo-plugin, vue-seo-layer, goldmark, crawl, nitro]
+status: complete
+requires:
+  - phase: 33-seo-output-audit-and-content
+    provides: "33-15 / 33-16 gap closure, re-reviewed in 33-REVIEW-GAPFIX.md"
+provides:
+  - "WR-01: ConvertContentH1 converts markdown content outside goldmark code ranges only, with no first-byte gate"
+  - "WR-02: images/alt treats blank content as content_html-only and every other content as markdown"
+  - "WR-03: the crawl's final status write and conga end run on their own 30 s bound; crawl.WithFinishTimeout seam"
+  - "WR-04: siteAnswer remembers the last definite answer (ok or absent)"
+  - "Release-note drafts for sm-journal-plugin v0.4.0, sm-seo-plugin v0.2.0, vue-seo-layer v0.2.0 updated"
+affects: [33-14]
+actuals:
+  tokens: 7598
+  tasks: 4
+  commits: 5
+tech-stack:
+  added: []
+  patterns:
+    - "Code-only test seam carried by the job context (crawl.WithFinishTimeout, like WithRenderer)"
+    - "Split timeouts: store bound, final-write bound, prune bound, all on a detached parent"
+key-files:
+  created: []
+  modified:
+    - ../sm-journal-plugin/classes/headings.go
+    - ../sm-journal-plugin/classes/headings_test.go
+    - ../sm-journal-plugin/headings_test.go
+    - ../sm-journal-plugin/controllers/api/maintenance.go
+    - ../sm-journal-plugin/README.md
+    - ../sm-seo-plugin/classes/crawl/job.go
+    - ../sm-seo-plugin/crawl_lifecycle_test.go
+    - ../sm-seo-plugin/README.md
+    - ../vue-seo-layer/server/lib/site.ts
+    - ../vue-seo-layer/server/middleware/seo-root.ts
+    - ../vue-seo-layer/tests/rootFiles.test.ts
+    - ../vue-seo-layer/README.md
+    - .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-journal-plugin-v0.4.0.md
+    - .planning/phases/33-seo-output-audit-and-content/33-14-notes-sm-seo-plugin-v0.2.0.md
+    - .planning/phases/33-seo-output-audit-and-content/33-14-notes-vue-seo-layer-v0.2.0.md
+key-decisions:
+  - "ConvertContentH1 has no first-byte gate: content is always read as markdown and converted outside code; the 33-15 pin 'plain <h1>x</h1> text' flips to converted (v0.3.1 behaviour for raw h1 outside code)"
+  - "images/alt markdown branch also covers rich-editor HTML bodies (HTML blocks are not code ranges)"
+  - "Prune keeps a store-sized bound of its own after the final write; error prefix 'storing the crawl results took longer than <bound>: '"
+  - "clearSiteCache (purge) still clears the remembered site answer"
+requirements-completed: [quick-261104-xae]
+duration: 16min
+completed: 2026-11-05
+---
+
+# Quick 261104-xae: Phase 33 gap-fix follow-ups Summary
+
+Closed the four warnings of the Phase 33 gap-closure re-review (33-REVIEW-GAPFIX WR-01 to WR-04). H1 conversion now skips markdown code wherever the body starts. Image alt works on content_html-only translations and on markdown that opens with a tag. A crawl whose store times out ends failed straight away. The SEO layer remembers an absent site answer through outages.
+
+## BASE and HEAD per repo
+
+| Repo | Branch | BASE | HEAD |
+|------|--------|------|------|
+| sm-journal-plugin | main | 0a62090 | cf13c60 |
+| sm-seo-plugin | main | 2a288a9 | c71b58e |
+| vue-seo-layer | main | 973142a | 3868f3d |
+| summercms.go | master | 5ce50be | 9d299a4 |
+
+All four BASEs matched the planning-time values. Nothing pushed or tagged. The untracked `go.work.sum` in sm-journal-plugin and the other sessions' files in summercms.go were not staged.
+
+## Commits
+
+- T1 sm-journal-plugin `a41d537` fix: H1 conversion leaves code alone in markdown that starts with HTML (classes/headings.go, classes/headings_test.go, headings_test.go, README.md)
+- T2 sm-journal-plugin `cf13c60` fix: image alt on HTML-only translations and on markdown that starts with a tag (controllers/api/maintenance.go, headings_test.go, README.md)
+- T3 sm-seo-plugin `c71b58e` fix: a crawl whose store runs out of time still ends failed (classes/crawl/job.go, crawl_lifecycle_test.go, README.md)
+- T4 vue-seo-layer `3868f3d` fix: root files follow the last site answer, a 404 included, while the backend is down (server/lib/site.ts, server/middleware/seo-root.ts, tests/rootFiles.test.ts, README.md)
+- TN summercms.go `9d299a4` docs(33): release notes for the gap-fix follow-ups (quick-261104-xae) (the three 33-14 drafts)
+
+None of the commits has a trailer.
+
+## RED / GREEN per finding
+
+**WR-01 (Task 1).** The tests are TestConvertContentH1HTMLLead (new), new rows in TestConvertTranslationH1, the flipped pin in TestConvertContentH1, and the Docker subtest "markdown that starts with an HTML block keeps its h1 samples".
+- RED (old code):
+  - `headings_test.go:99: probe with content_html "<p class=\"lead\">Intro</p>\n<pre><code class=\"language-html\">&lt;h1&gt;Hello&lt;/h1&gt;\n</code></pre>\n" = "<p class=\"lead\">Intro</p>\n\n```html\n<h2>Hello</h2>\n```" ... n=1`
+  - `headings_test.go:141: markdown with an HTML lead was rewritten: ... <h2>Hello</h2> ... n=1`
+  - The flipped pin failed the other way: `headings_test.go:82: markdown without HTML = "plain <h1>x</h1> text" "" 0`.
+  - Docker: `headings_test.go:330: API save: content = "<p class=\"lead\">Intro</p>\n\n# Title\n\n```html\n<h2>Hello</h2>\n```", content_html = ...`.
+- GREEN: TestConvertH1, TestConvertContentH1, TestConvertContentH1HTMLLead and TestConvertTranslationH1 pass. The Docker TestHeadingConversion and TestFixHeadingsCommand pass. go vet and the short tests are clean.
+- Additivity: `git diff 0a62090..a41d537 -- . ':!*_test.go'` exited 0, and the grep for removed exported func/type lines found nothing.
+
+**WR-02 (Task 2).** The test is TestSetImageAltBodyShapes (Docker). RED on T1:
+- (a) `headings_test.go:750: POST /_journal/api/v1/images/alt = 422, want 200: {"error":"Validation failed","errors":{"changes.1.src":["The image is not an inline image of the post's markdown; edit the post."]}}`
+- (b) `headings_test.go:782: after the alt = "<p class=\"lead\">Intro</p>\n\n![](https://cdn.example.test/a.jpg)\n\n```html\n<img src=\"https://cdn.example.test/a.jpg\" alt=\"Grzyb\">\n```\n" / ...`: the label stays empty and the code sample is rewritten.
+- (c) `headings_test.go:794: POST /_journal/api/v1/images/alt = 200, want 422: {"changes":[{"alt":"new","changed":true,...,"old_alt":"old",...}]}`
+- GREEN: TestSetImageAlt (body unchanged; the diff removes no line from it) and TestSetImageAltBodyShapes pass, as do the classes TestSetImageAlt and TestSetMarkdownImageAlt. The grep for removed exported functions in maintenance.go found nothing.
+
+**WR-03 (Task 3).** The test is TestCrawlStoreTimeout (Docker). It holds a `LOCK TABLE golem15_seo_crawl_pages IN SHARE MODE` transaction and runs with `crawl.WithFinishTimeout(..., 2s)`.
+- RED (Step A, seam only): `crawl_lifecycle_test.go:286: the crawl is still running 20 s after its store bound: {ID:1 Status:running ... Error: ... FinishedAt:<nil> ...}`.
+- GREEN: the row ends failed with "storing the crawl results took longer than 2s: ..." and finished_at set. The job returns nil, no pages are stored, and the next Start is accepted. TestCrawlTimeout, TestCrawlCancelRunning, TestCrawlStaleRecovery and TestCrawlerTracer pass.
+- `git diff 2a288a9..c71b58e -- classes/crawl/job.go`: the only `+func [A-Z]` is WithFinishTimeout, and there is no `-func [A-Z]`.
+
+**WR-04 (Task 4).** These are new node --test cases in tests/rootFiles.test.ts, run with a stubbed `globalThis.$fetch` and `t.mock.method(Date, 'now')`.
+- RED (Step A, clock read at call time only):
+  - `not ok 84 - siteAnswer: a remembered absent outlives the cache while the backend is down (WR-04)`: `+ 'unknown' - 'absent'`
+  - `not ok 85 - siteAnswer: the latest definite answer wins (WR-04)`: `+ 'ok' - 'absent'`
+- The two guard cases (never answered stays unknown, a purge forgets) passed before and after the fix.
+- GREEN: `npm test` reports `# pass 156`, `# fail 0` (log: /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/xae-node-test.log). package.json and pnpm-lock.yaml are unchanged.
+
+## Gate
+
+`PHASE33_REQUIRE_DOCKER=1 bash scripts/check-phase33.sh --plugins --layers --docker` exited 0 under pipefail. Docker was reachable directly, so `sudo -u golem` was not needed. The log is /tmp/claude-1000/-media-nvme-dev-golem15-summercms-io-summercms-summercms-go/cc746d7e-76ce-49f4-ae43-0e1debb2bbea/scratchpad/gate-xae.log and holds:
+
+```
+PASS plugins
+PASS layers
+PASS docker
+```
+
+## Planner choices (as accepted)
+
+- **No first-byte gate.** ConvertContentH1 always reads content as markdown and converts outside goldmark code ranges, through the unexported `convertH1OutsideCode`. The 33-15 pin `ConvertContentH1("plain <h1>x</h1> text", "")` is deliberately reversed to `"plain <h2>x</h2> text"`, n=1, which matches v0.3.1 for a raw h1 outside code.
+- **HTML bodies.** The images/alt markdown branch covers rich-editor HTML bodies too, because HTML blocks are not code ranges. TestSetImageAlt's HTML-shaped bodies keep passing unchanged. Residual: an admin HTML body in which a blank line is followed by a line indented 4 or more spaces holding the `<img>` is an indented code block to goldmark, so that image gets 422. This is not special-cased.
+- **Crawl bounds.**
+  - `crawl.WithFinishTimeout` is a code-only seam carried by the job context, like WithRenderer.
+  - The store runs on its own bound and the error prefix is "storing the crawl results took longer than <bound>: ".
+  - The final UPDATE and the conga FailJob/StopJob/CompleteJob run on `finalWriteTimeout` (30 s).
+  - Prune runs last, on its own store-sized bound.
+- **Purge.** A purge (`clearSiteCache`) still clears the remembered answer, so "never answered" means since the server started or since the last purge. With a remembered absent, `/api/__seo__/sitemap` answers 404 during an outage, as it does while the backend is up.
+
+## Deviations from Plan
+
+1. **Doc comment reworded in Task 3 (acceptance wording).** The first finish doc comment quoted the literal "storing the crawl results took longer than", so `grep -n "took longer than" classes/crawl/job.go` matched twice where the plan asked for once. I reworded the comment ("an error that names the bound and the store error") and amended the unpushed local commit (0953294 became c71b58e). The code did not change.
+2. **Test helper typing.** In tests/rootFiles.test.ts the stub helper takes `TestContext` (a type-only import from node:test), so the test needs no loose `Function` type. This is cosmetic.
+
+No other deviations. Pre-existing `gofmt -l` hits in sm-journal-plugin (classes/blog_editor_test.go, controllers/api/posts.go) are in files this task does not touch and were left alone.
+
+## Residuals
+
+- A backend whose `/site` always answers 200 HTML or 401/403 never gives a definite answer and stays unknown, so its fixed root files are still proxied and a failure is a 503. The workaround is `seo.rootFiles: false` or `seo.cms: false`. This is out of scope per the brief.
+- The review's notes below the warning bar are untouched.
+
+## Known Stubs
+
+None.
+
+## Self-Check: PASSED
+
+- The commits exist: a41d537 and cf13c60 (sm-journal-plugin), c71b58e (sm-seo-plugin), 3868f3d (vue-seo-layer), 9d299a4 (summercms.go).
+- Each commit's `git show --stat` lists exactly its task's files.
+- The acceptance greps match: convertH1OutsideCode (definition and call), the TrimSpace switch, WithFinishTimeout, finalWriteTimeout (5 matches), lastKnown (4), siteAnswer in the test (7), `now: () => Date.now()` (1), and every release-note phrase (1 each).

.planning/research/STACK.md

@@ -47,6 +47,8 @@ This extends `.planning/research/go-ecosystem.md` (2026-09-16 GitHub-API-verifie
 | air-verse/air | v1.67.4 (Aug 1, 2026), actively maintained | Dev watch-rebuild loop | This is the "watch loop that rebuilds the compiled-plugin binary on change" the plugin architecture already calls for. Config via `.air.toml`; point `cmd`/`bin` at `go build -o ./tmp/summer ./cmd/summer && ./tmp/summer serve`. |
 | golangci-lint | v2.13.2 (Aug 27, 2026) | Linting | v2's config schema (`version: "2"` in `.golangci.yml`) is a breaking change from v1 — do not copy a v1 config from an older Go project without migrating it. |
 | `github.com/markbates/goth` (core plus providers google, facebook, github, azureadv2; never gothic) | v1.82.0 | OAuth 2.0 client for social sign-in in sm-sociallogin-plugin | Decided in .planning/notes/2026-10-20-sociallogin-goth.md (Phase 19.5 D-02); plugin-only, the framework go.mod does not require it. |
+| `github.com/chromedp/chromedp` | v0.21.0 (Oct 11, 2026; pinned exactly, newer tags deliberately not used) | Optional raw-versus-rendered comparison of the SEO site audit in sm-seo-plugin, driving an operator-installed Chrome or Chromium (`golem15.seo.crawl_chrome_path`) | Decided in .planning/notes/2026-10-28-chromedp-rendered-crawl.md (Phase 33 D-70, P33-55); pure Go, no cgo or Node; plugin-only, the framework go.mod does not require it. |
+| `github.com/gen2brain/webp` | v0.6.4 (Jul 1, 2026; pinned exactly, with `github.com/ebitengine/purego` v0.10.1) | WebP variants of attachment thumbnails (`modules/lagoon/attach/webp`, quality 80), encoded in a conga job of sm-journal-plugin | Decided in .planning/notes/2026-10-28-webp-gen2brain.md (Phase 33 D-85, P33-42); no cgo: the system libwebp through purego, else libwebp transpiled to Go (wasm2go). Only binaries that import the sub-package link it, and they are dynamically linked against glibc unless built with `-tags nodynamic`. |
 | `github.com/jimsmart/grobotstxt` | v1.0.3 | Google-faithful robots.txt matching (longest match, allow wins ties, `*` and `$`, matching line) for the robots.txt tester and the noindex-blocked warning in sm-seo-plugin | Decided in .planning/notes/2026-10-27-robots-txt-grobotstxt.md (Phase 32 D-99); plugin-only, the framework go.mod does not require it. |
 | `charm.land/lipgloss/v2` | v2.0.6 | Console styles, layout and tables (bonfire palette, diary console handler) | Decided in .planning/notes/2026-10-21-console-charm-stack.md (Phase 19.8 D-02); imported only by modules/bonfire and modules/diary |
 | `charm.land/bubbletea/v2` | v2.1.0 | Runtime for the live spinner, process and progress views | Decided in .planning/notes/2026-10-21-console-charm-stack.md (Phase 19.8 D-02); imported only by modules/bonfire and modules/diary |

.planning/todos/completed/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md

@@ -0,0 +1,37 @@
+---
+created: 2026-11-04T10:05:42.444Z
+title: Enforce min/max length on text fields in lagoon.Validate
+area: database
+severity: major
+files:
+  - modules/lagoon/validate.go:163
+  - modules/lagoon/README.md
+  - docs/database/casts-and-validation.md
+  - modules/phrasebook/lang/pl/validation.yaml
+---
+
+## Problem
+
+`lagoon.Validate` (the model validator used by cabana admin saves, including
+settings screens at `modules/cabana/settings.go:267`) does not check `min`/`max`
+on non-numeric fields: the tags loop around `validate.go:163` skips them. So
+`nullable|max:255`, or the README example `required|max:255|unique:posts`,
+accept a value of any length, although the docs say min/max compare length.
+
+Quick task 261104-f4x (adds the `string` and `url` rules) enforces length only
+when `string` or `url` is present, to avoid changing behaviour for existing
+rules. The general gap remains.
+
+The request validator (`validate_rules.go`, Laravel semantics) already treats
+min/max as length on strings; the two validators disagree.
+
+Also: `modules/phrasebook/lang/pl/validation.yaml` still has an English
+`string:` message.
+
+## Solution
+
+Decide whether to enforce length for every non-numeric `min`/`max` (Laravel
+behaviour). Risk: a plugin whose stored values already exceed a declared limit
+would start failing admin saves for those records; audit plugin `Rules()` and
+`fields.yaml` rules (core plugins: user, blog, pages, payment, journal) before
+switching, and call it out in release notes. Translate the pl `string:` line.

.planning/todos/done/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md

@@ -14,3 +14,5 @@ Found by 19.6-03 Task 6, which left both unstaged and pushed sm-demo-app at `bb2
 - `TestGoModRequiresTags` and `scripts/check-pins.sh` need each submodule on the exact commit of the tag go.mod requires. So the bump moves each checkout to the tag, not to the current HEAD, and raises the go.mod requires (`GOWORK=off go get …@vX.Y.Z`, then `go mod tidy`).
 - Make one `chore: bump <plugin> to <tag>` commit per plugin.
 - Until then, `scripts/check-pins.sh` reports both mismatches and `scripts/build.sh release` refuses the dirty tree.
+
+Done in Phase 20 plan 02 (2026-10-30): nothing left to commit. sm-demo-app `2133309` (go.mod) and `5ec5941` (pointers) had already moved both past the stale commits: oauthserver to v0.1.6 (contains `b6a9586`) and journal to v0.2.6, with `scripts/check-pins.sh` reporting ok. They were not moved back to v0.1.3/v0.2.4.

.planning/todos/pending/chat-slash-text-escape.md

@@ -0,0 +1,19 @@
+---
+title: Chat messages that start with "/" but name no command are posted as text
+date: 2026-11-03
+priority: low
+area: vue-chat-layer app/composables/useChat.ts
+files:
+  - ../vue-chat-layer/app/composables/useChat.ts
+g15office:
+---
+
+## Problem
+
+Every text starting with "/" (for example "/r/golang is great", or a path) is dispatched as a slash command and refused as unknown, so it can never be posted.
+
+## Solution
+
+Dispatch only when the first token matches a known trigger from the command catalog, or support a "//" escape.
+
+Source: phase 20 code review (20-REVIEW.md IN-04).

.planning/todos/pending/chatchannels-pin-policy.md

@@ -0,0 +1,21 @@
+---
+title: Make pinning in public channels a manage action, and check the pinned message belongs to the channel
+date: 2026-11-03
+priority: high
+area: sm-chatchannels-plugin (classes/channel_service.go, api/pins.go), sm-demo-app plugins/demo/classes/chat_context.go
+files:
+  - ../sm-chatchannels-plugin/classes/channel_service.go
+  - ../sm-chatchannels-plugin/api/pins.go
+  - ../sm-demo-app/plugins/demo/classes/chat_context.go
+g15office:
+---
+
+## Problem
+
+chatchannels gates PinMessage and UnpinMessage only with channel access, which the demo grants every member. So any visitor can unpin the seeded welcome pins or flood the pins panel. PinMessage also never checks that the message belongs to the channel's conversation.
+
+## Solution
+
+Additively in chatchannels: PinMessage and UnpinMessage require CanManageContext, or an optional contracts.PinPolicy the host implements; the demo answers it from its moderator group. Verify message.conversation_id equals the channel's conversation before creating the pin. Meanwhile the demo layer can hide pin actions for non-moderators, but the server must enforce the rule.
+
+Source: phase 20 code review (20-REVIEW.md WR-02).

.planning/todos/pending/chatvideo-dm-only-host-hook.md

@@ -0,0 +1,20 @@
+---
+title: A server-side DM-only rule for calls, not the seeded participant count
+date: 2026-11-03
+priority: medium
+area: sm-chatvideo-plugin classes/video_service.go, sm-demo-app config/golem15.chatvideo.yaml
+files:
+  - ../sm-chatvideo-plugin/classes/video_service.go
+  - ../sm-demo-app/config/golem15.chatvideo.yaml
+g15office:
+---
+
+## Problem
+
+The server has no DM-only rule; channel calls are refused today only because the seeded personas plus a visitor exceed max_participants: 4. Raising the cap, or a channel with fewer participants, would let any member ring everyone who opened that channel.
+
+## Solution
+
+Add an optional host hook in chatvideo (for example CanStartCall(conversationType)), or check conversation.type == dm in the demo, so the rule does not depend on seed data.
+
+Source: phase 20 code review (20-REVIEW.md IN-01).

.planning/todos/pending/chatvideo-incoming-handle-leak.md

@@ -0,0 +1,19 @@
+---
+title: The incoming-call runtime closes stale session handles
+date: 2026-11-03
+priority: medium
+area: vue-chatvideo-layer app/composables/useIncomingCalls.ts
+files:
+  - ../vue-chatvideo-layer/app/composables/useIncomingCalls.ts
+g15office:
+---
+
+## Problem
+
+Two video:call:incoming events for the same session, both pending in subscribe, both pass the pending-session check; the second overwrites rt.channel and the first handle is never closed. The logout half of this finding was fixed in phase 20 plan 08 (the demo's sign-out dismisses the ring); the handle leak remains.
+
+## Solution
+
+Keep a sequence number per watchSession and close the handle unless it is the latest.
+
+Source: phase 20 code review (20-REVIEW.md IN-07).

.planning/todos/pending/chatvideo-live-membership.md

@@ -0,0 +1,20 @@
+---
+title: chatvideo honours live membership, so a ban ends call access at once
+date: 2026-11-03
+priority: medium
+area: sm-chatvideo-plugin classes/video_service.go, classes/authorizer.go
+files:
+  - ../sm-chatvideo-plugin/classes/video_service.go
+  - ../sm-chatvideo-plugin/classes/authorizer.go
+g15office:
+---
+
+## Problem
+
+chatvideo checks participant rows only. A ban revokes the user's JWTs, but an already minted LiveKit join token (900 s) and an open video:session subscription survive it, because chatvideo never consults contracts.LiveMembership as chat does.
+
+## Solution
+
+Have chatvideo honour LiveMembership (through chat's Service.IsParticipant) in requireParticipant and the authorizer, and remove the participant from the LiveKit room on a ban.
+
+Source: phase 20 code review (20-REVIEW.md IN-02).

.planning/todos/pending/check-local-jwt-out-of-argv.md

@@ -0,0 +1,19 @@
+---
+title: check-local passes member JWTs to curl through a config on stdin, not argv
+date: 2026-11-03
+priority: low
+area: sm-demo-app scripts/check-local.sh
+files:
+  - ../sm-demo-app/scripts/check-local.sh
+g15office:
+---
+
+## Problem
+
+check-local still puts member JWTs into -H "Authorization: Bearer ..." arguments, readable by other local users in /proc/*/cmdline. The LiveKit join token and the new check-moderation.sh already use a curl config on stdin. Local and throwaway users only, but inconsistent with the stated pattern.
+
+## Solution
+
+Give request() an optional JWT that it writes as header = "Authorization: Bearer ..." into a curl config on stdin (curl -K -), as check-moderation.sh does, and drop every -H Authorization argument.
+
+Source: phase 20 code review (20-REVIEW.md IN-03).

.planning/todos/pending/demo-chat-members-read-only.md

@@ -0,0 +1,19 @@
+---
+title: GET /_demo/api/v1/chat/members is read-only and needs no id list
+date: 2026-11-03
+priority: medium
+area: sm-demo-app plugins/demo/chat_api.go
+files:
+  - ../sm-demo-app/plugins/demo/chat_api.go
+g15office:
+---
+
+## Problem
+
+The GET assigns handles to members that lack one (two concurrent first loads race on the same rows) and expands every member id into id IN ?, which fails with 500 past Postgres' 65535 bind-parameter limit. The production reset schedule is off, so users accumulate.
+
+## Solution
+
+Select with the memberWhere subquery (WHERE id <> ? AND <memberWhere>) instead of an id list, and assign missing handles at registration or in demo:seed, not in a GET.
+
+Source: phase 20 code review (20-REVIEW.md IN-09).

.planning/todos/pending/demo-nginx-livekit-rtc-only.md

@@ -0,0 +1,20 @@
+---
+title: nginx proxies only LiveKit's /rtc paths, not its whole HTTP surface
+date: 2026-11-03
+priority: low
+area: sm-demo-app deploy/nginx/demo.summercms.io.conf, scripts/check-deploy.sh
+files:
+  - ../sm-demo-app/deploy/nginx/demo.summercms.io.conf
+  - ../sm-demo-app/scripts/check-deploy.sh
+g15office:
+---
+
+## Problem
+
+Browsers need only /rtc and /rtc/validate, but the /livekit/ location also exposes LiveKit's Twirp RoomService on the public origin. It is protected by admin JWTs signed with the API secret, so exposing it is unnecessary.
+
+## Solution
+
+Use location ^~ /livekit/rtc { proxy_pass http://127.0.0.1:7890/rtc; ... } and answer 404 for the rest of /livekit/; adjust check-deploy and check-live. A vhost change on rome needs its own go-ahead.
+
+Source: phase 20 code review (20-REVIEW.md IN-06).

.planning/todos/pending/demo-seed-moderation-lists-once.md

@@ -0,0 +1,19 @@
+---
+title: demo:seed fills the default moderation lists only on the first run
+date: 2026-11-03
+priority: low
+area: sm-demo-app plugins/demo/console/seed_friends.go
+files:
+  - ../sm-demo-app/plugins/demo/console/seed_friends.go
+g15office:
+---
+
+## Problem
+
+seedModerationLists refills both lists whenever both are empty, and every release runs demo:seed. An admin who deliberately empties both lists gets the defaults back at the next deploy.
+
+## Solution
+
+Seed only once: insert the lists when the settings row is created, or record a seeded flag.
+
+Source: phase 20 code review (20-REVIEW.md IN-05).

.planning/todos/pending/demo-vapid-runbook-pipefail.md

@@ -0,0 +1,19 @@
+---
+title: The VAPID runbook step runs with pipefail and appends the keys only when both exist
+date: 2026-11-03
+priority: low
+area: sm-demo-app DEPLOY.md (Chat family, VAPID keys)
+files:
+  - ../sm-demo-app/DEPLOY.md
+g15office:
+---
+
+## Problem
+
+The remote script uses set -e without pipefail. If herald:vapid-generate fails, nothing is appended but the SUBJECT line, and the re-run guard then refuses ("already in .env") although no key pair exists; recovery needs a hand edit. The keys are already on rome; this matters for a rebuild.
+
+## Solution
+
+Use set -eo pipefail, generate into a variable first, check both keys are non-empty, then append all three lines in one tee.
+
+Source: phase 20 code review (20-REVIEW.md IN-08).

.planning/todos/pending/forum-friends-client-401-refresh.md

@@ -0,0 +1,21 @@
+---
+title: Single-flight 401 refresh in the forum and friends clients, and a signed-out message instead of not found
+date: 2026-11-03
+priority: medium
+area: vue-forum-layer app/utils/forumClient.ts, vue-userfriends-layer app/utils/friendsClient.ts
+files:
+  - ../vue-forum-layer/app/utils/forumClient.ts
+  - ../vue-forum-layer/app/components/Forum/Thread.vue
+  - ../vue-userfriends-layer/app/utils/friendsClient.ts
+g15office:
+---
+
+## Problem
+
+The chat and video clients refresh once on 401; the forum and friends hooks are bare token getters and never retry. After the JWT expires, /forum/t/{id} shows "thread not found" (Thread.vue maps 401 to notFound) and posting fails, while /chat keeps working in the same tab.
+
+## Solution
+
+Give both auth hooks the {token, refresh, unauthorized} shape (the demo can pass its chat auth), add the chat client's single-flight refresh-and-retry to request(), and map 401 to its own signed-out message.
+
+Source: phase 20 code review (20-REVIEW.md WR-06).

.planning/todos/pending/moderation-profile-group-and-filenames.md

@@ -0,0 +1,19 @@
+---
+title: Moderate profile names, friend-group names and chat attachment filenames
+date: 2026-11-03
+priority: high
+area: sm-demo-app plugins/demo/moderation.go (with seams in user, userfriends and chat)
+files:
+  - ../sm-demo-app/plugins/demo/moderation.go
+g15office:
+---
+
+## Problem
+
+The filter runs only on chat message content and forum titles and bodies. Profile name and surname (shown in /chat/members, mentions, DM headers, forum author_name and the incoming-call prompt), userfriends group names and descriptions, and chat attachment filenames reach other members unmoderated.
+
+## Solution
+
+Run Filter.Check on name and surname at registration and profile update (a user-plugin saving event if one exists, otherwise the demo's own route, without breaking the core user plugin). Do the same for userfriends group create and update (an additive GroupSaving seam if needed) and for attachment filenames (MessageSaving could carry them additively). Document any path left out as an explicit exception.
+
+Source: phase 20 code review (20-REVIEW.md WR-03).

admin/openapi/admin.json

@@ -1708,7 +1708,7 @@
                     },
                     "typeOptions": {
                         "additionalProperties": {},
-                        "description": "TypeOptions are a plugin field type's own fields.yaml keys and values;\nthe admin hands them to the element as JSON.",
+                        "description": "TypeOptions are a plugin field type's own fields.yaml keys and values,\nplus the options its RequestOptions supplies for the request (a key set\nin fields.yaml wins); the admin hands them to the element as JSON.",
                         "type": "object"
                     },
                     "useCaption": {
@@ -5913,7 +5913,7 @@
         },
         "/{vendor}/{plugin}/{controller}/schema/form": {
             "get": {
-                "description": "The form of a controller, localized. `preview` is present when config_form.yaml declares a preview block: the form then has a read-only preview screen, which shows the fields whose context allows preview, the record actions and, when preview.headerPartial is set, that partial as a status hint. A `type: password` field and every other field the controller lists as virtual is sent in a save body and never has a value in a record response. `preset` on a text or mltext field names the text or mltext field it follows on the create form (type slug or exact; an mltext pair follows per locale) until the administrator edits it. A `type: permissioneditor` field carries `permissionOptions`, the permissions the controller offers the requesting administrator; its value in a record response and in a save body is an object of permission code to integer (radio mode 1 or -1, checkbox mode 1). A `type: relation` field over a protected foreign key is `readOnly` unless its contract declares the key writable. A field whose type a plugin registers carries `element` (the custom-element tag the admin renders), `translatable` (its value is an object of content locale to string) and `typeOptions` (the type's own fields.yaml keys). A `type: dropdown` field with `dependsOn` names the sibling field whose value selects its options and carries no options: they come from the field's dependent-options route. `trigger` ({action, field, condition}) disables (action disable: shown read-only) or hides (action hide) the field while the switch or checkbox `field` of the same form is checked or unchecked; the admin leaves such a field out of the save body and the server keeps its stored value, so the trigger is a display rule only. A `type: richeditor` field's value is a string of HTML, sanitized on every save; what the sanitizer removed is reported in the save response's `meta.notices`. A `type: repeater` field carries `form.fields` (the fields of one row), `prompt`, `maxItems`, `minItems` and `titleFrom`; its value in a record response and in a save body is a list of row objects keyed by the nested field names, and a row's errors are keyed `\u003cfield\u003e.\u003cindex\u003e.\u003cnested\u003e`.",
+                "description": "The form of a controller, localized. `preview` is present when config_form.yaml declares a preview block: the form then has a read-only preview screen, which shows the fields whose context allows preview, the record actions and, when preview.headerPartial is set, that partial as a status hint. A `type: password` field and every other field the controller lists as virtual is sent in a save body and never has a value in a record response. `preset` on a text or mltext field names the text or mltext field it follows on the create form (type slug or exact; an mltext pair follows per locale) until the administrator edits it. A `type: permissioneditor` field carries `permissionOptions`, the permissions the controller offers the requesting administrator; its value in a record response and in a save body is an object of permission code to integer (radio mode 1 or -1, checkbox mode 1). A `type: relation` field over a protected foreign key is `readOnly` unless its contract declares the key writable. A field whose type a plugin registers carries `element` (the custom-element tag the admin renders), `translatable` (its value is an object of content locale to string) and `typeOptions` (the type's own fields.yaml keys, plus per-request options the type supplies; a key set in fields.yaml wins). A `type: dropdown` field with `dependsOn` names the sibling field whose value selects its options and carries no options: they come from the field's dependent-options route. `trigger` ({action, field, condition}) disables (action disable: shown read-only) or hides (action hide) the field while the switch or checkbox `field` of the same form is checked or unchecked; the admin leaves such a field out of the save body and the server keeps its stored value, so the trigger is a display rule only. A `type: richeditor` field's value is a string of HTML, sanitized on every save; what the sanitizer removed is reported in the save response's `meta.notices`. A `type: repeater` field carries `form.fields` (the fields of one row), `prompt`, `maxItems`, `minItems` and `titleFrom`; its value in a record response and in a save body is a list of row objects keyed by the nested field names, and a row's errors are keyed `\u003cfield\u003e.\u003cindex\u003e.\u003cnested\u003e`.",
                 "parameters": [
                     {
                         "description": "Vendor",

admin/src/api/schema.d.ts

@@ -2474,7 +2474,7 @@ export interface paths {
         };
         /**
          * Admin form schema
-         * @description The form of a controller, localized. `preview` is present when config_form.yaml declares a preview block: the form then has a read-only preview screen, which shows the fields whose context allows preview, the record actions and, when preview.headerPartial is set, that partial as a status hint. A `type: password` field and every other field the controller lists as virtual is sent in a save body and never has a value in a record response. `preset` on a text or mltext field names the text or mltext field it follows on the create form (type slug or exact; an mltext pair follows per locale) until the administrator edits it. A `type: permissioneditor` field carries `permissionOptions`, the permissions the controller offers the requesting administrator; its value in a record response and in a save body is an object of permission code to integer (radio mode 1 or -1, checkbox mode 1). A `type: relation` field over a protected foreign key is `readOnly` unless its contract declares the key writable. A field whose type a plugin registers carries `element` (the custom-element tag the admin renders), `translatable` (its value is an object of content locale to string) and `typeOptions` (the type's own fields.yaml keys). A `type: dropdown` field with `dependsOn` names the sibling field whose value selects its options and carries no options: they come from the field's dependent-options route. `trigger` ({action, field, condition}) disables (action disable: shown read-only) or hides (action hide) the field while the switch or checkbox `field` of the same form is checked or unchecked; the admin leaves such a field out of the save body and the server keeps its stored value, so the trigger is a display rule only. A `type: richeditor` field's value is a string of HTML, sanitized on every save; what the sanitizer removed is reported in the save response's `meta.notices`. A `type: repeater` field carries `form.fields` (the fields of one row), `prompt`, `maxItems`, `minItems` and `titleFrom`; its value in a record response and in a save body is a list of row objects keyed by the nested field names, and a row's errors are keyed `<field>.<index>.<nested>`.
+         * @description The form of a controller, localized. `preview` is present when config_form.yaml declares a preview block: the form then has a read-only preview screen, which shows the fields whose context allows preview, the record actions and, when preview.headerPartial is set, that partial as a status hint. A `type: password` field and every other field the controller lists as virtual is sent in a save body and never has a value in a record response. `preset` on a text or mltext field names the text or mltext field it follows on the create form (type slug or exact; an mltext pair follows per locale) until the administrator edits it. A `type: permissioneditor` field carries `permissionOptions`, the permissions the controller offers the requesting administrator; its value in a record response and in a save body is an object of permission code to integer (radio mode 1 or -1, checkbox mode 1). A `type: relation` field over a protected foreign key is `readOnly` unless its contract declares the key writable. A field whose type a plugin registers carries `element` (the custom-element tag the admin renders), `translatable` (its value is an object of content locale to string) and `typeOptions` (the type's own fields.yaml keys, plus per-request options the type supplies; a key set in fields.yaml wins). A `type: dropdown` field with `dependsOn` names the sibling field whose value selects its options and carries no options: they come from the field's dependent-options route. `trigger` ({action, field, condition}) disables (action disable: shown read-only) or hides (action hide) the field while the switch or checkbox `field` of the same form is checked or unchecked; the admin leaves such a field out of the save body and the server keeps its stored value, so the trigger is a display rule only. A `type: richeditor` field's value is a string of HTML, sanitized on every save; what the sanitizer removed is reported in the save response's `meta.notices`. A `type: repeater` field carries `form.fields` (the fields of one row), `prompt`, `maxItems`, `minItems` and `titleFrom`; its value in a record response and in a save body is a list of row objects keyed by the nested field names, and a row's errors are keyed `<field>.<index>.<nested>`.
          */
         get: {
             parameters: {
@@ -6220,8 +6220,9 @@ export interface components {
             twelveHour?: boolean;
             type: string;
             /**
-             * @description TypeOptions are a plugin field type's own fields.yaml keys and values;
-             *     the admin hands them to the element as JSON.
+             * @description TypeOptions are a plugin field type's own fields.yaml keys and values,
+             *     plus the options its RequestOptions supplies for the request (a key set
+             *     in fields.yaml wins); the admin hands them to the element as JSON.
              */
             typeOptions?: {
                 [key: string]: unknown;

cmd/summer/main.go

@@ -155,7 +155,7 @@ overwritten.`,
 			{Command: "make:model acme.blog Post", Description: "A Post model and its create-table migration"},
 			{Command: "make:model Post --no-migration", Description: "Inside plugins/acme/blog: only the model"},
 		},
-		Args:        makeArtifactArgs(),
+		Args: makeArtifactArgs(),
 		Flags: []bonfire.Flag{{
 			Name:        "no-migration",
 			Description: "Omit the create-table migration",
@@ -192,7 +192,7 @@ to apply it.`,
 			{Command: "make:migration acme.blog AddSlugToPosts", Description: "An empty migration in acme.blog"},
 			{Command: "make:migration AddSlugToPosts", Description: "The same from inside plugins/acme/blog"},
 		},
-		Args:        makeArtifactArgs(),
+		Args: makeArtifactArgs(),
 		Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
 			dir, err := os.Getwd()
 			if err != nil {
@@ -226,7 +226,7 @@ from the plugin's Commands by hand.`,
 			{Command: "make:command acme.blog Publish", Description: "A blog:publish command in acme.blog"},
 			{Command: "make:command Publish", Description: "The same from inside plugins/acme/blog"},
 		},
-		Args:        makeArtifactArgs(),
+		Args: makeArtifactArgs(),
 		Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
 			dir, err := os.Getwd()
 			if err != nil {
@@ -257,7 +257,7 @@ conga.Manager.Dispatch; queue:work or serve runs it.`,
 			{Command: "make:job acme.blog SendDigest", Description: "A SendDigest job in acme.blog"},
 			{Command: "make:job SendDigest", Description: "The same from inside plugins/acme/blog"},
 		},
-		Args:        makeArtifactArgs(),
+		Args: makeArtifactArgs(),
 		Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
 			dir, err := os.Getwd()
 			if err != nil {

cmd/summer/runtime.go

@@ -27,7 +27,7 @@ func delegateCommands() []bonfire.Command {
 	ex := func(cmd, desc string) bonfire.Example { return bonfire.Example{Command: cmd, Description: desc} }
 	rows := []struct {
 		name, description, hint string
-		examples                 []bonfire.Example
+		examples                []bonfire.Example
 	}{
 		{"migrate", "Run plugin migrations in the app binary", "--pretend, --force", []bonfire.Example{
 			ex("migrate", "Apply every pending migration"),

cmd/summer/runtime_test.go

@@ -81,11 +81,11 @@ func TestDelegateCommandsPassArgs(t *testing.T) {
 
 func TestDelegateCommandsHelp(t *testing.T) {
 	hints := map[string][]string{
-		"migrate:rollback":  {"--plugin"},
-		"queue:work":        {"--queue"},
-		"schedule:run":      {"--once"},
-		"serve":             {"--addr"},
-		"admin:create":      {"--email", "--superuser"},
+		"migrate:rollback":   {"--plugin"},
+		"queue:work":         {"--queue"},
+		"schedule:run":       {"--once"},
+		"serve":              {"--addr"},
+		"admin:create":       {"--email", "--superuser"},
 		"admin:token:create": {"--name", "--scope", "--expires"},
 	}
 	cmds := delegateCommands()

docs/backend/field-types.md

@@ -70,7 +70,30 @@ A plugin-typed field accepts the general keys `label`, `comment`, `span`, `type`
 
 `CheckOptions`, when set, checks a field's options at start-up, as the `rows` check in the example above does. An error stops it and names the field and the type.
 
-The form schema carries a plugin field with `element`, `translatable` (only when true) and `typeOptions` (only when the field sets options). `cabana.CompileFormWithTypes` compiles a form with one plugin's types outside a running application, which is how a plugin tests its `fields.yaml`.
+### Per-request options
+
+Options in `fields.yaml` are compiled once at start-up. A type whose element follows something that changes while the application runs, such as a site setting that decides which heading levels an editor offers, sets `RequestOptions` to a function such as this one:
+
+```go src=modules/cabana/example_field_type_test.go#headingLevels
+// headingLevels is a RequestOptions func: the editor offers the heading
+// levels from the site's top heading down to level 4, read on every form
+// schema request, so a changed setting needs no restart.
+func headingLevels(ctx context.Context, db *gorm.DB) (map[string]any, error) {
+	top, err := siteTopHeading(ctx, db)
+	if err != nil {
+		return nil, err
+	}
+	levels := []int{}
+	for level := top; level <= 4; level++ {
+		levels = append(levels, level)
+	}
+	return map[string]any{"headingLevels": levels}, nil
+}
+```
+
+The form schema route calls it once per request for each type the form uses, however many fields use the type, with the application's database (nil when none is configured), and merges the answer into the `typeOptions` of every field of the type, a form extension's fields included. A key the field sets in `fields.yaml` wins over the same key from `RequestOptions`. The element therefore reads the value from its `options` attribute and needs no request, token or route of its own. An error does not fail the form: the schema is served with the `fields.yaml` options only and the error is logged once as a warning naming the type. Every administrator who may open the form receives the options, so they must hold no secret. A type without `RequestOptions` is served exactly as before.
+
+The form schema carries a plugin field with `element`, `translatable` (only when true) and `typeOptions` (only when the field sets options or `RequestOptions` answers some). `cabana.CompileFormWithTypes` compiles a form with one plugin's types outside a running application, which is how a plugin tests its `fields.yaml`.
 
 ## Decode, notices and refusals
 

docs/database/attachments.md

@@ -89,6 +89,46 @@ Originals in JPEG, PNG, GIF and WebP can be thumbnailed. The thumbnailer cannot
 > [!WARNING]
 > Serve uploads from a separate origin, or at least never mount the ungated handler on the application's own origin. An uploaded file served with its own content type from the API's origin can run script in that origin.
 
+## WebP variants
+
+The `attach/webp` package writes a WebP copy of a thumbnail next to it, so a page can offer WebP with the original format as fallback. `webp.Variant` takes the same width, height and mode as `attach.File.ThumbKey`, makes the thumbnail first when it is missing, encodes it at quality 80 and stores it under `attach.VariantKey`: `thumb_42_480_0_0_0_auto.jpg` gets `thumb_42_480_0_0_0_auto.webp`, with the `image/webp` content type. A thumbnail of a `.webp` original already ends in `.webp`, so its variant is `thumb_42_480_0_0_0_auto.webp.webp`. Variants live under the file's thumbnail prefix, so `attach.DeleteKeys` removes them with the thumbnails.
+
+```go src=modules/lagoon/attach/webp/webp_smoke_test.go#ExampleVariant
+ctx := context.Background()
+bucket := memblob.OpenBucket(nil)
+defer bucket.Close()
+
+// The system_files row of a cover image and its stored original.
+f := &attach.File{ID: 42, DiskName: "5f1d0c2e9a7b4c3d8e6f.jpg", FileName: "cover.jpg"}
+var img bytes.Buffer
+if err := jpeg.Encode(&img, image.NewRGBA(image.Rect(0, 0, 1600, 1200)), nil); err != nil {
+	fmt.Println(err)
+	return
+}
+if err := bucket.WriteAll(ctx, attach.BlobKey(f.DiskName), img.Bytes(), nil); err != nil {
+	fmt.Println(err)
+	return
+}
+
+// In a background job: the 800 px thumbnail and its WebP copy.
+key, err := webp.Variant(ctx, bucket, f, 800, 800, "auto")
+if err != nil {
+	fmt.Println(err)
+	return
+}
+fmt.Println(key)
+fmt.Println(attach.PublicURL(key))
+// Output:
+// 5f1/d0c/2e9/thumb_42_800_800_0_0_auto.webp
+// /storage/uploads/5f1/d0c/2e9/thumb_42_800_800_0_0_auto.webp
+```
+
+A variant that exists is returned without writing, so a job can run again safely. The encode happens in memory before anything is written, and a failed write deletes the key, so a failure never leaves a partial file. Encoding takes tens to hundreds of milliseconds per image, so run it in a background [job](../services/jobs.md), never inside an upload request. The original upload is never re-encoded.
+
+The encoder is `github.com/gen2brain/webp`. It loads the system libwebp (`libwebp.so`, `libwebpdemux.so`) through purego when the library is installed, without cgo, and otherwise falls back to libwebp transpiled to Go, about five times slower. Only binaries that import `attach/webp` link it. Such a binary is dynamically linked against glibc, even with `CGO_ENABLED=0`, so it runs on Debian or Ubuntu hosts but not in a `scratch` or musl image. Build it with `-tags nodynamic` for a static binary that always uses the transpiled encoder.
+
+Importing `attach/webp` also takes over WebP decoding for the whole process: the encoder library registers its own WebP decoder ahead of the pure Go one, so every WebP decode, user uploads included (thumbnails, the size check before thumbnailing), goes through the system libwebp when it is installed. Keep libwebp patched on such hosts, or build with `-tags nodynamic`, which also decodes with the transpiled copy.
+
 ## Storing an upload
 
 `attach.Store` turns an upload into a `system_files` row. It takes an `attach.Upload` (the client's file name, the body and the public flag) and an `attach.Limits`, writes the bytes under the WinterCMS partition key and inserts an unattached row whose `sort_order` equals its id, as WinterCMS's Sortable trait does. The caller attaches the row later by setting `Field`, `AttachmentType` and `AttachmentID`, usually when the record's form is saved. When the row insert fails, the blob is deleted again.

docs/database/casts-and-validation.md

@@ -108,7 +108,7 @@ fmt.Println(string(out))
 // {"title":["The title field is required."],"views":["The views may not be greater than 1000."]}
 ```
 
-A zero `time.Time`, `lagoon.Date` or `lagoon.TimeOfDay`, or a pointer to one, is empty for `required`, so a required date field with no value fails instead of saving year 1. The supported rules are `required`, `nullable`, `integer`, `numeric`, `between`, `min`, `max`, `in`, `unique`, `boolean`, `email`, `confirmed`, `different` and `mimes`. Any other rule is an error, so a rule that SummerCMS does not implement cannot be skipped by accident. On a field that is `integer` or `numeric`, `min`, `max` and `between` compare the number; on other fields they compare the length. A number below the lower bound gets the `min` message, one above the upper bound the `max` message, and a bound that came from `between` gets the numeric `between` message (`The views must be between 0 and 10.`).
+A zero `time.Time`, `lagoon.Date` or `lagoon.TimeOfDay`, or a pointer to one, is empty for `required`, so a required date field with no value fails instead of saving year 1. The supported rules are `required`, `nullable`, `integer`, `numeric`, `between`, `min`, `max`, `in`, `unique`, `boolean`, `email`, `string`, `url`, `confirmed`, `different` and `mimes`. Any other rule is an error, so a rule that SummerCMS does not implement cannot be skipped by accident. `string` accepts a string or a pointer to one, and `url` a URL that matches Laravel's pattern (the same one request validation uses, so `javascript:` links and addresses without a scheme are refused). Both skip a missing, empty or blank value; use `required` to refuse those. On an `integer` or `numeric` field `min`, `max` and `between` compare the number. On any field that is not `integer` or `numeric`, `min` and `max` compare a length: the characters of a string or of a number (`The title may not be greater than 255 characters.`) and the elements of a list (`The tags may not have more than 5 items.`). Empty or blank values, booleans and dates are not measured; use `required` to refuse an empty value. A bound that is not a whole number is an error. `between` compares the length on any other field. A number below the lower bound gets the `min` message, one above the upper bound the `max` message, and a bound that came from `between` gets the numeric `between` message (`The views must be between 0 and 10.`).
 
 `unique:<table>` runs a query to check that no other row of the table has the value in the field's column, so it needs a database handle; pass the transaction you are writing in. Soft-deleted rows do not count, and when the model you pass has an ID, its own row does not count either, so the same rules work for create and update. Pass a `phrasebook.Translator` as the last argument to get the messages in the request locale from the `lagoon::validate` catalog; with `nil` they are in English. See [Localization](../services/localization.md).
 

docs/plugins/menu-item-types.md

@@ -131,7 +131,8 @@ Menus point at single records. Consumers such as sitemaps, search indexers and m
 
 ```go src=modules/signpost/example_content_test.go#NewsPlugin.MenuItemTypes
 // MenuItemTypes registers acme-article with a content descriptor: the
-// controller that edits articles, their morph type, Describe and Match.
+// controller that edits articles, their morph type, what kind of record an
+// article is, the MCP tool that edits one, Describe and Match.
 func (p NewsPlugin) MenuItemTypes() []pact.MenuItemType {
 	return []pact.MenuItemType{{
 		Key:            "acme-article",
@@ -142,6 +143,8 @@ func (p NewsPlugin) MenuItemTypes() []pact.MenuItemType {
 		Content: &pact.ContentDescriptor{
 			Controller: "acme.news.articles",
 			Model:      "acme_news_articles",
+			Kind:       pact.ContentKindArticle,
+			Tools:      map[string]string{pact.ContentToolEdit: "acme_update_article"},
 			Describe:   p.describe,
 			Match:      p.match,
 		},
@@ -155,6 +158,22 @@ The descriptor names:
 - `Describe` (required): one record by ID as a `pact.ContentRecord`, drafts included. `Published` tells whether visitors see it and `LastMod` is its last change. `Locales` lists the record per locale in the site's locale order, each with its `URL` (built from the pattern the function receives, exactly as `Resolve` builds alternates), `Title`, `Description`, `Image` and the body's `Words`. A type whose host has no public page for it, such as tags on a site without tag pages, answers an empty `URL`.
 - `Records` (optional): the records in pages, in a stable order. It receives a `pact.ContentList` with `After`, the last ID of the previous page, and `Limit`, and answers a `pact.ContentPage` whose `Next` is the following page's `After`, "" on the last page. `signpost.Registry.Records` answers an empty page for a type without it.
 - `Match` (optional): the record a public path belongs to, as a `pact.ContentMatchResult` with its ID and the locale the path addresses. It answers nil when the path names no record visitors can see.
+- `Kind` (optional): what a record of the type is, one of `pact.ContentKindArticle` (a dated piece with authors), `pact.ContentKindCollection` (a record that lists others, such as a category), `pact.ContentKindProfile` (a person or an organisation) and `pact.ContentKindPage` (a standalone page); "" when the type does not say.
+- `Tools` (optional): the MCP tools that change the type's records, keyed by operation: `pact.ContentToolEdit` (fields and body), `pact.ContentToolHeadings` (the body's headings) and `pact.ContentToolImageAlt` (the alternative text of the body's images). Each value is a full tool name such as `acme_update_article`, so a consumer that finds a problem in a record can name the tool that fixes it without importing the content plugin.
+
+`Describe` and `Records` may also report facts that feeds, search indexers and audit tools read. All of them are optional, and a nil slice means the same as an empty one:
+
+| Field | Meaning |
+|-------|---------|
+| `pact.ContentRecord.PublishedAt` | The first publication, nil when unknown or never published (`LastMod` stays the last change). |
+| `pact.ContentRecord.Parents` | The records this one sits under as `pact.ContentRef` values (a menu item type key and a record ID), in order of preference: the first is the default primary parent. |
+| `pact.ContentRecord.Authors` | The people who wrote the record, in byline order, as `pact.ContentPerson` values: a `Name` and a `Ref` to the person's own record, whose `Type` is "" when the person has none. |
+| `pact.ContentRecord.TopHeading` | The highest heading level the body may use: 2 when the page renders the title as its only level-1 heading, 0 when the type sets no rule. |
+| `pact.ContentLocale.Images` | The record's images in that locale (the featured image first, then the body's in document order) as `pact.ContentImage` values: `URL`, `Alt`, `Decorative` (an image without content, whose empty `Alt` is intended), `Width` and `Height` in pixels (0 when unknown). |
+| `pact.ContentLocale.Videos` | The videos the body embeds, as `pact.ContentVideo` values: a `Provider` such as `youtube` and the video's `ID` there. |
+| `pact.ContentLocale.Headings` | The body's heading outline in document order, as `pact.ContentHeading` values with a `Level` (1 to 6) and the `Text`. |
+
+The registry hands these values through as the type answers them; a type that sets none of them describes, lists and matches exactly as before.
 
 A content type reads a path's placeholder values with `signpost.MatchPattern`, which matches whole segments only: a literal segment must be equal, the segment count must be equal and a placeholder never matches an empty segment. Every value must then fit the record. When the path names a record but a segment does not fit it (another category, a stale locale prefix, the slug of another locale), the result's `Exact` is false, so the caller can redirect to the record's own URL instead of answering a duplicate page:
 
@@ -182,7 +201,11 @@ The registry layers the pattern for every call, like `Resolve`. `signpost.Regist
 
 ```go src=modules/signpost/example_content_test.go#ExampleRegistry_MatchPath
 app := exampleApp() // its menu_items.yaml overrides acme-post of BlogPlugin
-news := NewsPlugin{articles: []Article{{ID: "7", Slug: "launch", Title: "Launch", Published: true}}}
+news := NewsPlugin{articles: []Article{{
+	ID: "7", Slug: "launch", Title: "Launch", Published: true,
+	PublishedAt: time.Date(2026, 10, 1, 9, 0, 0, 0, time.UTC),
+	Author:      "Ada", Headings: []string{"Why", "How"},
+}}}
 plugins := []interface{ ID() string }{BlogPlugin{}, news}
 if err := signpost.Activate(app, plugins); err != nil {
 	fmt.Println(err)
@@ -195,11 +218,17 @@ typ, _ := reg.ContentTypeForModel("acme_news_articles")
 rec, _ := reg.Describe(context.Background(), typ.Key, "7", "")
 fmt.Println(typ.Key, rec.Locales[0].URL)
 
+// The descriptor's optional facts reach every consumer as given.
+fmt.Println(typ.Content.Kind, typ.Content.Tools[pact.ContentToolEdit])
+fmt.Println(rec.PublishedAt.Format(time.DateOnly), rec.Authors[0].Name, rec.TopHeading, len(rec.Locales[0].Headings))
+
 // A visitor's path maps back to the record.
 key, res, _ := reg.MatchPath(context.Background(), "/news/launch", "")
 fmt.Println(key, res.ID, res.Exact)
 // Output:
 // acme-article /news/launch
+// article acme_update_article
+// 2026-10-01 Ada 2 2
 // acme-article 7 true
 ```
 

go.mod

@@ -16,6 +16,7 @@ require (
 	github.com/charmbracelet/x/ansi v0.11.9
 	github.com/disintegration/imaging v1.6.2
 	github.com/fsnotify/fsnotify v1.10.1
+	github.com/gen2brain/webp v0.6.4
 	github.com/go-gormigrate/gormigrate/v2 v2.1.7
 	github.com/go-playground/validator/v10 v10.30.4
 	github.com/goccy/go-yaml v1.19.2

go.sum

@@ -173,6 +173,8 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
 github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
+github.com/gen2brain/webp v0.6.4 h1:SUDdmxADOAiPQ+5ylNmuHhuYf2dOi0KgKZHL5vpVCNU=
+github.com/gen2brain/webp v0.6.4/go.mod h1:iGWMaCSw7t3I/Cv9llzEKmpnR36S8lS8VL/ZVjxU0JE=
 github.com/go-gormigrate/gormigrate/v2 v2.1.7 h1:PdT4jVPbRb4R+0Ey2R0yJOdctVf4Whiq1Qi4necaZdg=
 github.com/go-gormigrate/gormigrate/v2 v2.1.7/go.mod h1:3ouXglTuPrKF5+7cQyVGfvAXTU4vLMaYh9+EPl03uog=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=

modules/bonfire/output.go

@@ -50,7 +50,7 @@ type console struct {
 	// errStream is the stream the root's error block goes to, when the
 	// console belongs to a root (ErrWriter); nil means err.
 	errStream io.Writer
-	lookup func(string) string
+	lookup    func(string) string
 	// tty is true when stdout is a terminal; it picks animated widgets
 	// and boxed tables.
 	tty bool

modules/cabana/README.md

@@ -36,7 +36,7 @@ Use cases:
 - Row state: a controller implementing `pact.ListRowStates` is called once per list page with the page's records and the list's database handle. The list response carries `meta.row_states`, keyed by row id, with values from the fixed set `deleted`, `negative`, `disabled` in that order; a value outside the set is dropped and logged, rows without a state are left out, and a controller without the hook sends no `row_states` key. The badge texts are the list messages `rowStateDeleted`, `rowStateNegative` and `rowStateDisabled`, defaulting to `backend::lang.messages.list.row_state_*`. A soft-deleted record that the controller's `pact.ListExtendQuery` and `pact.FormExtendQuery` include can be shown, updated (it stays soft-deleted), targeted by bulk and record actions and removed for good by the controller's `pact.FormAfterDelete`.
 - Record actions: `recordActions` in `config_form.yaml` lists names the controller registers through `pact.HasAdminRecordActions`, a third action namespace with the same reserved names. It needs the form's `preview` block: record actions are offered on the preview screen, and a form that declares them without one fails boot. The show response's `meta.actions` (`cabana.RecordAction` entries with localized `label` and `confirm`) carries only the declared actions the requesting administrator may run and whose `Applies` reports true for the record; the key is absent when none is offered, and create and update responses never carry it. The action route loads the record through `pact.FormExtendQuery` with a row lock in one transaction (one 404 for a missing and an out-of-scope id), checks `Applies` again (409 when it reports false) and then runs the action. An unknown or duplicate name, or an action without a label, fails boot. Each run is logged with the controller, action, administrator and record id.
 - Preview screen: a `preview` mapping in `config_form.yaml` (`preview: {}`, or with `headerPartial: <name>` for a status hint) gives the form a read-only record screen in the admin SPA. The form schema reports it as `preview` (`cabana.FormPreview`), fields with `context: preview` are shown only there and are never written by a save, `messages.preview` and `messages.edit` name the screen's subtitle and edit button, and `recordUrl` and the form redirects may point at it as `.../preview/:id`. An empty `preview:` key or an unknown key inside it fails boot.
-- Plugin field types: a plugin implementing `pact.HasFormFieldTypes` registers admin form field types under short aliases that any controller's `fields.yaml` uses as `type:`. Boot checks the aliases (no built-in type, no alias claimed by two plugins), the element prefix, the scripts and styles and each field's option keys and `CheckOptions`. A save runs the type's `Decode` inside the save transaction after the record is loaded: the decoded value is stored, a `pact.FormFieldError` is a 422 on the field, any other error an opaque 500, and the notices a type returns are localized into the response's `meta.notices` (`cabana.FieldNotice`), which is absent when no type reported anything. Show and save responses serve the value through the type's `Load`. A translatable type's value is a locale map stored through the same lift, `cabana.TranslationWriter` and hydrate path as `mlmarkdown`, decoded and loaded per locale. On update, a value equal to the one the form was served for that field and locale is neither decoded nor written. Form hooks read what a save wrote through `cabana.FieldWritesFromContext`. A list column may name a plugin alias as its `type` and shows the type's `ListValue`. The cabana-owned upload route hands an element's file to the type's `Upload`. The form schema carries `element`, `translatable` and `typeOptions` for such a field. Settings and relation forms refuse plugin field types (supported in controller forms only). See [Plugin field types](../../docs/backend/field-types.md).
+- Plugin field types: a plugin implementing `pact.HasFormFieldTypes` registers admin form field types under short aliases that any controller's `fields.yaml` uses as `type:`. Boot checks the aliases (no built-in type, no alias claimed by two plugins), the element prefix, the scripts and styles and each field's option keys and `CheckOptions`. A save runs the type's `Decode` inside the save transaction after the record is loaded: the decoded value is stored, a `pact.FormFieldError` is a 422 on the field, any other error an opaque 500, and the notices a type returns are localized into the response's `meta.notices` (`cabana.FieldNotice`), which is absent when no type reported anything. Show and save responses serve the value through the type's `Load`. A translatable type's value is a locale map stored through the same lift, `cabana.TranslationWriter` and hydrate path as `mlmarkdown`, decoded and loaded per locale. On update, a value equal to the one the form was served for that field and locale is neither decoded nor written. Form hooks read what a save wrote through `cabana.FieldWritesFromContext`. A list column may name a plugin alias as its `type` and shows the type's `ListValue`. The cabana-owned upload route hands an element's file to the type's `Upload`. The form schema carries `element`, `translatable` and `typeOptions` for such a field; a type's `pact.FormFieldType.RequestOptions`, called once per schema request for each type the form uses, adds per-request options under the fields.yaml ones (a fields.yaml key wins, an error is logged and serves the fields.yaml options only). Settings and relation forms refuse plugin field types (supported in controller forms only). See [Plugin field types](../../docs/backend/field-types.md).
 - Form-only fields: a controller implementing `pact.FormVirtualFields` lists fields of its `fields.yaml` that are not columns of the form. They are exempt from the column binding, never filled into the model and never part of a record response; the values an administrator submits reach the Form hooks through `cabana.VirtualFieldsFromContext`, only for fields whose `context` allows the operation, and a nested value is a 422 on the field. `type: password` is a masked field that must be listed this way, so a password is sent in a save body and never comes back. A controller implementing `pact.FormRules` supplies the validation rules per operation (`create` or `update`), which replace the model's `Rules()` for admin saves; a rule on a virtual field is checked against the submitted value, never against a model column of the same name. Neither is available on settings forms or relation forms.
 - Field triggers: fields.yaml `trigger` (`action: disable|hide`, `field`, `condition: checked|unchecked`) makes the admin disable or hide a field while a switch or checkbox of the same form is on or off; the schema carries it as `trigger` (`cabana.FieldTrigger`), a disabled or hidden field is left out of the save body, and an invalid trigger, or one in a repeater row, settings form or relation form, stops boot.
 - Permission editor: a `type: permissioneditor` field with `mode: radio` (allow `1`, inherit, deny `-1`) or `mode: checkbox` (allow `1`) edits a record's permission set as a JSON object of code to integer. The controller implements `cabana.PermissionEditorProvider`: it returns the offered `cabana.PermissionOption` list per request (served on the field as `permissionOptions`, with `locked` for permissions the administrator may not change) and reads and stores the record's values, so the storage shape is the plugin's. A save answers 422 on the field for a value that is not an object of integers, a code that is not offered or a value outside the mode's set, and 403 `forbidden` when a locked code's value changes; stored codes that are not offered are kept. A controller that also implements `cabana.PermissionRecordLockProvider` fixes some values of one stored record (a role's code-declared grants, an administrator's own overrides): the record response carries them as `meta.permissionLocks`, the admin shows them locked with their note and never sends them, and a save keeps their stored values. The widget fill contract is unchanged: a widget still writes scalar fields only.

modules/cabana/account_tokens_test.go

@@ -155,8 +155,8 @@ func TestAccountTokens(t *testing.T) {
 
 	// 422 rules with server message text.
 	cases := []struct {
-		name string
-		body map[string]any
+		name  string
+		body  map[string]any
 		field string
 		msg   string
 	}{

modules/cabana/admin_openapi.go

@@ -592,7 +592,7 @@ func AdminListSchema() {}
 // AdminFormSchema documents the form schema route.
 //
 // @Summary Admin form schema
-// @Description The form of a controller, localized. `preview` is present when config_form.yaml declares a preview block: the form then has a read-only preview screen, which shows the fields whose context allows preview, the record actions and, when preview.headerPartial is set, that partial as a status hint. A `type: password` field and every other field the controller lists as virtual is sent in a save body and never has a value in a record response. `preset` on a text or mltext field names the text or mltext field it follows on the create form (type slug or exact; an mltext pair follows per locale) until the administrator edits it. A `type: permissioneditor` field carries `permissionOptions`, the permissions the controller offers the requesting administrator; its value in a record response and in a save body is an object of permission code to integer (radio mode 1 or -1, checkbox mode 1). A `type: relation` field over a protected foreign key is `readOnly` unless its contract declares the key writable. A field whose type a plugin registers carries `element` (the custom-element tag the admin renders), `translatable` (its value is an object of content locale to string) and `typeOptions` (the type's own fields.yaml keys). A `type: dropdown` field with `dependsOn` names the sibling field whose value selects its options and carries no options: they come from the field's dependent-options route. `trigger` ({action, field, condition}) disables (action disable: shown read-only) or hides (action hide) the field while the switch or checkbox `field` of the same form is checked or unchecked; the admin leaves such a field out of the save body and the server keeps its stored value, so the trigger is a display rule only. A `type: richeditor` field's value is a string of HTML, sanitized on every save; what the sanitizer removed is reported in the save response's `meta.notices`. A `type: repeater` field carries `form.fields` (the fields of one row), `prompt`, `maxItems`, `minItems` and `titleFrom`; its value in a record response and in a save body is a list of row objects keyed by the nested field names, and a row's errors are keyed `<field>.<index>.<nested>`.
+// @Description The form of a controller, localized. `preview` is present when config_form.yaml declares a preview block: the form then has a read-only preview screen, which shows the fields whose context allows preview, the record actions and, when preview.headerPartial is set, that partial as a status hint. A `type: password` field and every other field the controller lists as virtual is sent in a save body and never has a value in a record response. `preset` on a text or mltext field names the text or mltext field it follows on the create form (type slug or exact; an mltext pair follows per locale) until the administrator edits it. A `type: permissioneditor` field carries `permissionOptions`, the permissions the controller offers the requesting administrator; its value in a record response and in a save body is an object of permission code to integer (radio mode 1 or -1, checkbox mode 1). A `type: relation` field over a protected foreign key is `readOnly` unless its contract declares the key writable. A field whose type a plugin registers carries `element` (the custom-element tag the admin renders), `translatable` (its value is an object of content locale to string) and `typeOptions` (the type's own fields.yaml keys, plus per-request options the type supplies; a key set in fields.yaml wins). A `type: dropdown` field with `dependsOn` names the sibling field whose value selects its options and carries no options: they come from the field's dependent-options route. `trigger` ({action, field, condition}) disables (action disable: shown read-only) or hides (action hide) the field while the switch or checkbox `field` of the same form is checked or unchecked; the admin leaves such a field out of the save body and the server keeps its stored value, so the trigger is a display rule only. A `type: richeditor` field's value is a string of HTML, sanitized on every save; what the sanitizer removed is reported in the save response's `meta.notices`. A `type: repeater` field carries `form.fields` (the fields of one row), `prompt`, `maxItems`, `minItems` and `titleFrom`; its value in a record response and in a save body is a list of row objects keyed by the nested field names, and a row's errors are keyed `<field>.<index>.<nested>`.
 // @Tags admin
 // @Produce json
 // @Security BackendBearer

modules/cabana/backend_users_admin.go

@@ -868,9 +868,10 @@ const adminPasswordMinChars = 4
 
 // storePassword hashes a typed password onto user and reports whether one
 // was typed. A password under adminPasswordMinChars characters or over
-// bcrypt's 72-byte limit is a 422 on the field. The length is checked here
-// because the form's min:4 rule is a string rule, which the model validator
-// does not apply.
+// bcrypt's 72-byte limit is a 422 on the field. The form's min:4 rule
+// already refuses a shorter password in lagoon.Validate before this hook
+// runs; the hook repeats the check so it never hashes one, and adds bcrypt's
+// 72-byte limit.
 func (c usersAdmin) storePassword(ctx context.Context, user *BackendUser) (bool, error) {
 	plain := submittedPassword(ctx)
 	if plain == "" {