SPEC.md: note Phase 18 cell-markup hotfix

Annotate the §9 Phase 18 entry with hotfix SHA 3e115f5 + a paragraph
explaining what the wrapper bug was (inline-flex span around an input
inside a <td> caused the day inputs to collapse on blur in production)
and what the fix is (color class and data attrs directly on <td>, input
as direct child, select as sibling). Append the hotfix SHA to §13.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

SPEC.md

@@ -612,14 +612,22 @@ with a `BOOTSTRAP_ADMIN` audit row.
       schema / route / PHP changes; tests untouched at 88 / 208.
 
 - [x] **Phase 18 — Per-cell task-status colours + filter +
-      global toggle** (`9cb7669`). Each task-assignment cell on
-      both `/sprints/{id}` and `/sprints/{id}/present` now carries
-      a workflow status — `zugewiesen` (transparent, default),
-      `gestartet` (yellow), `abgeschlossen` (green), `abgebrochen`
-      (red) — picked from a chevron-only `<select
-      data-assign-status>` next to the day input/span. The cell is
-      wrapped in `<span class="assign-cell assign-status-{state}"
-      data-assign-cell data-status="{state}">`; `sprint-planner.js`
+      global toggle** (`9cb7669`, hotfix `3e115f5`). Each task-
+      assignment cell on both `/sprints/{id}` and
+      `/sprints/{id}/present` now carries a workflow status —
+      `zugewiesen` (transparent, default), `gestartet` (yellow),
+      `abgeschlossen` (green), `abgebrochen` (red) — picked from a
+      chevron-only `<select data-assign-status>` next to the day
+      input/span. The status colour class (`assign-status-{state}`)
+      and `data-assign-cell` / `data-status` / `data-sw-id` attrs
+      live directly on the `<td>` — the original commit's
+      `<span class="assign-cell">` wrapper turned out to be a
+      layout trap inside table cells (display:inline-flex on a
+      span around an input with a sibling select made the day
+      inputs collapse on blur in production), so the hotfix
+      flattened the structure: the day input is now a direct
+      child of the `<td>`, the status select sits as a sibling,
+      no wrapper. `sprint-planner.js`
       mirrors the chosen value into the wrapper class + `data-
       status` and queues a save through a new
       `pendingStatus`/`flushStatus` debounced pipeline that hits
@@ -754,6 +762,8 @@ before acting — nothing here is load-bearing once it grows stale.
 ## 13. Git history (as of this writing)
 
 ```
+3e115f5 Fix: Phase 18 cell markup — drop span wrapper, color goes on <td>
+205876a SPEC.md: mark Phase 18 shipped (task-status colours + filter)
 9cb7669 Phase 18: per-cell task-status colours + filter + global toggle
 da726bd SPEC.md: note number-stepper popover removal
 e551705 Remove number-stepper slider popover