diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index ac3141e..ae9c084 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -709,7 +709,7 @@ Plans:
   4. Per-user and per-org Discogs/AI credentials CRUD store encrypted values, honor the org-lock flag, and resolve env-to-org-to-user correctly. The live `ai-credential/test` and `discogs-credential/test` routes move to Phase 14 (D-02).
   5. Onboarding, public and invitation-inspection routes, including the anonymous collection views `public/{token}`, `public/{token}/albums` and `public/{token}/albums/{id}`, are reachable without auth and enforce their own public rate-limit buckets.
 
-**Plans:** 1/6 plans executed
+**Plans:** 2/6 plans executed
 
 Plans:
 
@@ -717,7 +717,7 @@ Plans:
 - [x] 13-01-PLAN.md — Framework gaps (summercms.go): surf overlap dispatch, conga workerless job kinds, lagoon prohibited, tide date and publication masks; the pinned job contract; parity scaffolding (queue override, rows dump, share:wishlist, D-15, ported case-status check); ROADMAP/REQUIREMENTS rewording
 
 **Wave 2** *(blocked on Wave 1 completion)*
-- [ ] 13-02-PLAN.md — Notifications, credentials CRUD with the AI/Discogs resolution order, onboarding bootstrap, invitation inspection, sm-user-plugin RegisterEvent.Payload and registration exports, the register listener, onboarding flow (14 routes)
+- [x] 13-02-PLAN.md — Notifications, credentials CRUD with the AI/Discogs resolution order, onboarding bootstrap, invitation inspection, sm-user-plugin RegisterEvent.Payload and registration exports, the register listener, onboarding flow (14 routes)
 
 **Wave 3** *(blocked on Wave 2 completion)*
 - [ ] 13-03-PLAN.md — Wishlist (30 routes): resolver, visibility, subscriptions, secret reservations, share/settings/household, purchase with transactional mail, item-added bell and digest queue, nuxt-wishlist and mcp-wishlist flows, publication goldens
@@ -787,7 +787,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 11.1. SummerCMS documentation for humans and AI agents | 7/7 | In Progress|  |
 | 11.2. summercms.io Alpha 0.1 landing page on SummerCMS | 3/3 | In Progress|  |
 | 12. Płytarium API — Collections and Albums | 5/5 | Complete   | 2026-10-02 |
-| 13. Płytarium API — wishlist, notifications, CSV, credentials, public routes | 1/6 | In Progress|  |
+| 13. Płytarium API — wishlist, notifications, CSV, credentials, public routes | 2/6 | In Progress|  |
 | 14. Domain jobs and external integrations | 0/TBD | Not started | - |
 | 15. Cutover | 0/TBD | Not started | - |
 
diff --git a/.planning/STATE.md b/.planning/STATE.md
index 518988d..4addabc 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: 13
 current_phase_name: Płytarium API — wishlist, notifications, CSV, credentials, public routes
 status: executing
-stopped_at: Completed 13-01-PLAN.md
-last_updated: "2026-10-03T04:42:17.083Z"
+stopped_at: Completed 13-02-PLAN.md
+last_updated: "2026-10-03T05:30:00.796Z"
 last_activity: 2026-10-03
 last_activity_desc: Phase 13 execution started
-state_head: 1c303f1511c7b4a45cc49b070dea3cbb400b6ccd
+state_head: 69019c33d0128cc790b5645ee4fb6ca94ffba1cd
 progress:
   total_phases: 21
   completed_phases: 11
   total_plans: 112
-  completed_plans: 107
+  completed_plans: 108
 milestone_name: milestone
 ---
 
@@ -29,7 +29,7 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 13 (Płytarium API — wishlist, notifications, CSV, credentials, public routes) — EXECUTING
-Plan: 2 of 6
+Plan: 3 of 6
 Status: Ready to execute
 Last activity: 2026-10-03 — Phase 13 execution started
 
@@ -161,6 +161,7 @@ Progress: [██████░░░░] 60%
 | Phase 12.2 P03 | 45min | 3 tasks | 26 files |
 | Phase 12.2 P04 | 2h | 4 tasks | 31 files |
 | Phase 13 P01 | 29 min | 4 tasks | 31 files |
+| Phase 13 P02 | 42min | 3 tasks | 30 files |
 
 ## Accumulated Context
 
@@ -481,6 +482,9 @@ Recent decisions affecting current work:
 - [Phase 13]: 13-01: River rejects dotted queue names, so the D-03 workerless queues are fonoteka_csv_import, fonoteka_csv_match and fonoteka_wishlist_digest; the dotted PHP names stay the summer_jobs labels and the kinds are unchanged (pending user confirmation before 13-03/13-04 dispatch)
 - [Phase 13]: 13-01: conga refuses an unregistered job kind's empty or served queue only while a worker runs; unregistered kinds always insert through the insert-only River client
 - [Phase 13]: 13-01: surf registers ServeMux-conflicting, constraint-separated routes as overlap families under one method-less pattern, tried in registration order; same-shape, multi-segment and shadowed members stay boot errors
+- [Phase 13]: 13-02: the Discogs store follows PHP's rules (token nullable|string|regex, shared nullable|boolean); a manager's not-shared store deletes the org Discogs credential
+- [Phase 13]: 13-02: test secrets, onboarding passwords and an unknown invite token are {{secret:...}} vars set by both seeds, so fixtures hold no literal
+- [Phase 13]: 13-02: RegisterEvent.Payload is the register input minus password keys (no IP columns); onboarding routes replay on their own databases for the empty state
 
 ### Pending Todos
 
@@ -529,6 +533,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-03T04:42:16.578Z
-Stopped at: Completed 13-01-PLAN.md
+Last session: 2026-10-03T05:29:44.846Z
+Stopped at: Completed 13-02-PLAN.md
 Resume file: None
diff --git a/.planning/state.json b/.planning/state.json
index 647cebb..8d14fac 100644
--- a/.planning/state.json
+++ b/.planning/state.json
@@ -76,7 +76,7 @@
     {
       "number": "13",
       "name": "Płytarium API — wishlist, notifications, CSV, credentials, public routes",
-      "status": "pending"
+      "status": "in_progress"
     },
     {
       "number": "14",
@@ -94,5 +94,5 @@
     "label": "Advance to the next step",
     "reason": "Phase 13 of 21 · executing"
   },
-  "updated_at": "2026-10-03T04:42:13.032Z"
+  "updated_at": "2026-10-03T05:29:49.270Z"
 }