Merge remote-tracking branch 'origin/main' into feat/journal-post-form

# Conflicts:
#	user

docs/working/plans/2026-07-04-grav-2.0.4-upgrade.md

@@ -2,7 +2,7 @@
 
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 
-**Status:** ✅ Complete (2026-07-04) — Phase 1 (local) and Phase 2 (remote test env) both validated and shipped; git-sync re-enabled on test. Phase 3 (prod) is documentation-only per design. See "Known issue" below re: Form 9.1.10 filepond.
+**Status:** ✅ Complete — Phase 1 (local), Phase 2 (test env), and **Phase 3 (production) all executed and shipped**. Phase 3 was run for real on 2026-07-05 (see the Phase 3 section for the execution outcome and the three `docs/solutions/` gotchas it produced). git-sync re-enabled on test and set up on prod. See "Known issue" below re: Form 9.1.10 filepond.
 
 **Goal:** Upgrade Grav core `2.0.0-rc.10` → `2.0.4` stable and promote `admin2`/`api`/`flex-objects` to GPM management, validated on local then the remote test env (prod is documented-only).
 
@@ -539,11 +539,32 @@ Content, config, and accounts are in git, so no data restore is required — but
 
 ---
 
-## Phase 3 — Production (fresh install, NOT executed)
+## Phase 3 — Production (fresh install) — EXECUTED 2026-07-05
 
-Production is empty, so this is a **fresh install**, not an upgrade — and it is **documentation only**. Do not run it as part of this plan.
+> **Execution outcome (2026-07-05):** the fresh prod install was run for real
+> (`make remote-install-prod`) and the site is live at `https://intotheeast.com`.
+> The runbook below was followed, but three non-obvious gotchas surfaced — each
+> now has its own learning in `docs/solutions/`:
+> - **Stale `.env.prod GRAV_VERSION`** installed Grav rc.10, so GPM wouldn't
+>   serve the `api` plugin (needs ≥2.0.4) → Admin2 login 404'd silently. Fixed
+>   via `make remote-upgrade-grav-prod` (→ 2.0.7) + reinstall. See
+>   `docs/solutions/integration-issues/stale-grav-version-blocks-api-plugin-install.md`.
+>   **TODO: bump `.env.prod GRAV_VERSION` to `2.0.4`** so a future fresh install
+>   doesn't repeat the RC.
+> - **Double `Content-Encoding` header** (non-FastCGI host + mod_deflate)
+>   rendered a garbage page once prod switched to `twig.debug: false`. Fixed via
+>   `debugger.shutdown.close_connection: false` in the prod env override. See
+>   `docs/solutions/integration-issues/grav-double-content-encoding-garbage-page.md`.
+> - **Plugin config stranded in the untracked `user/plugins/`** doesn't deploy.
+>   See `docs/solutions/conventions/grav-plugin-config-must-be-tracked-override.md`.
+>
+> Twig prod-mode is applied as a per-environment override (`deploy/env/prod/system.yaml`
+> via `make remote-apply-env-prod`); git-sync is installed, configured, and enabled
+> (see `docs/working/git-sync-notes.md`). Remaining minor follow-ups: gitignore
+> `config/security-private.php` (committed salt); optional `popularity.salt` strip.
 
-When prod is provisioned:
+The original runbook (production was empty, so this was a **fresh install**, not
+an upgrade):
 
 1. **Provision creds:** copy the REMOTE section of `.env.example` into `.env.prod` with production values (never commit it). Run `make remote-env-setup-prod`.
 2. **Fresh install at 2.0.4:** `make remote-install-prod` with `GRAV_VERSION=2.0.4` in `.env.prod`. `scripts/server-install.sh` installs core, then all of `plugins.txt` — `admin2`/`api`/`flex-objects` now install purely via `php bin/gpm install` (no zip-stash; that special-casing was removed in Task 4). The `gpm.releases: stable` channel arrives with the `user/` content clone.