docs(11-07): record plan 11-07 progress, decisions and requirements

.planning/ROADMAP.md

@@ -505,7 +505,7 @@ Plans:
   4. A channel-namespace authorizer registry re-validates on every subscribe; a broadcastable model interface with bulk-write suppression emits exactly one summary event for a bulk operation.
   5. Typesense sync is scoped by `collection_id` behind a settings kill-switch and degrades gracefully without DB/config.
 
-**Plans:** 6/7 plans executed
+**Plans:** 7/7 plans executed
 **Research flag:** yes
 
 Plans:
@@ -525,7 +525,7 @@ Plans:
 - [x] 11-04-PLAN.md — Web Push (flare VAPID driver, RFC 8291/8292) and websockets:health, websockets:generate-vapid-keys, websockets:test-push
 
 **Wave 5** *(blocked on Wave 4 completion)*
-- [ ] 11-07-PLAN.md — Unit tests last: full coverage, failing-when-broken T-11 evidence, check-phase11.sh gate, security review and validation map
+- [x] 11-07-PLAN.md — Unit tests last: full coverage, failing-when-broken T-11 evidence, check-phase11.sh gate, security review and validation map
 
 ### Phase 11.1: SummerCMS documentation for humans and AI agents (INSERTED)
 
@@ -654,7 +654,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 8. OAuth2.1 authorization server | 10/10 | Complete   | 2026-09-23 |
 | 9. Backend admin authentication and schema pipeline | 12/12 | In Progress|  |
 | 10. Admin Vue SPA | 5/5 | Complete    | 2026-09-27 |
-| 11. Jobs, realtime and search infrastructure | 6/7 | In Progress|  |
+| 11. Jobs, realtime and search infrastructure | 7/7 | In Progress|  |
 | 11.1. SummerCMS documentation for humans and AI agents | 0/TBD | Not started | - |
 | 11.2. Ready to share: summercms.io website and newsletter plugin | 0/TBD | Not started | - |
 | 12. Płytarium API — Collections and Albums | 0/TBD | Not started | - |