diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index efb75be..9019b65 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -748,7 +748,7 @@ Plans:
   6. Feedback submissions, widget config and the hide preference work (sitemap dropped for this application, D-14); the oauth-client, prune-notifications and reindex commands all run correctly.
      `oauth-identities` GET/DELETE and token `GET /api/v1/fonoteka/me` stay pending in this phase (D-09, todo orphan-pending-routes).
 
-**Plans:** 3/6 plans executed
+**Plans:** 4/6 plans executed
 
 Plans:
 
@@ -762,7 +762,7 @@ Plans:
 - [x] 14-03-PLAN.md — Discogs routes: album and wishlist match/apply-release, albums/match, albums/import/discogs, token cover-price (AlbumCoverFetcher, host-locked), discogs-credential/test; inbound limiters; recordings with sidecars (165 ported)
 
 **Wave 4** *(blocked on Wave 3 completion)*
-- [ ] 14-04-PLAN.md — sm-golem-plugin (models table, admin, importer, Anthropic/OpenAI-compatible adapters, AIService, SSRF guard) mounted as a submodule; admin vision tier; AlbumRecognitionService, recognize on both groups and ai-credential/test (168 ported)
+- [x] 14-04-PLAN.md — sm-golem-plugin (models table, admin, importer, Anthropic/OpenAI-compatible adapters, AIService, SSRF guard) mounted as a submodule; admin vision tier; AlbumRecognitionService, recognize on both groups and ai-credential/test (168 ported)
 
 **Wave 5** *(blocked on Wave 4 completion)*
 - [ ] 14-05-PLAN.md — sm-feedback-plugin: config, submit, preflight, me/hidden, getApiArray hook, embed.js, settings and submissions admin, importer, G15Office River job; feedback parity section (175 routes, 172 ported)
@@ -828,7 +828,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 11.2. summercms.io Alpha 0.1 landing page on SummerCMS | 3/3 | In Progress|  |
 | 12. Płytarium API — Collections and Albums | 5/5 | Complete   | 2026-10-02 |
 | 13. Płytarium API — wishlist, notifications, CSV, credentials, public routes | 6/6 | In Progress|  |
-| 14. Domain jobs and external integrations | 3/6 | In Progress|  |
+| 14. Domain jobs and external integrations | 4/6 | In Progress|  |
 | 14.1. OAuth identities and fonoteka me routes (INSERTED) | 0/TBD | Not started | - |
 | 15. Cutover | 0/TBD | Not started | - |
 
diff --git a/.planning/STATE.md b/.planning/STATE.md
index 07cbf1e..731b0ba 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: 14
 current_phase_name: Domain jobs and external integrations
 status: executing
-stopped_at: Completed 14-03-PLAN.md
-last_updated: "2026-10-03T20:25:22.551Z"
+stopped_at: Completed 14-04-PLAN.md
+last_updated: "2026-10-03T21:39:25.280Z"
 last_activity: 2026-10-03
 last_activity_desc: Phase 14 execution started
-state_head: 5101ecb49cae4e1bcceecc91491c198175ce71c1
+state_head: b3e4626d2df317c1b0297c1d0c2b39ca9bb07ab0
 progress:
   total_phases: 22
   completed_phases: 11
   total_plans: 118
-  completed_plans: 115
+  completed_plans: 116
 milestone_name: milestone
 ---
 
@@ -29,7 +29,7 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 14 (Domain jobs and external integrations) — EXECUTING
-Plan: 4 of 6
+Plan: 5 of 6
 Status: Ready to execute
 Last activity: 2026-10-03 — Phase 14 execution started
 
@@ -169,6 +169,7 @@ Progress: [██████░░░░] 60%
 | Phase 14 P01 | 25min | 5 tasks | 42 files |
 | Phase 14 P02 | 80 min | 4 tasks | 81 files |
 | Phase 14 P03 | 54min | 3 tasks | 122 files |
+| Phase 14 P04 | 69 min | 4 tasks | 144 files |
 
 ## Accumulated Context
 
@@ -519,6 +520,11 @@ Recent decisions affecting current work:
 - [Phase 14]: apply-release runs without an enclosing transaction, as PHP, so cover downloads never hold the album row lock
 - [Phase 14]: Discogs-route covers go through classes.NewGuardedCoverImporter (fetchguard.Client, GuzzleHttp/7 UA) so the replay answers them; Phase 12 cover imports deferred
 - [Phase 14]: discogs is an additive parity seed extra; A Love Supreme carries discogs_id 2002 with the album state
+- [Phase 14]: sm-golem-plugin is a shared core plugin repo mounted at plugins/golem15/golem; app tests are made bump-neutral first so pointer bumps stay gitlink-only (14-04)
+- [Phase 14]: ai-credential/test tests the caller's own stored key only, as PHP UserAiConfig (14-04)
+- [Phase 14]: AdminVisionModel(ctx, db) is a stateless seam fed by the golem vision model; only the admin tier sets AIConfig.Trusted (14-04)
+- [Phase 14]: User and org AI base_url overrides pass security.AssertSafeURL at resolve time; a refusal is Winter's 500 page (14-04)
+- [Phase 14]: fetchguard.IsPrivateAddr exported for resolve-time address checks (14-04)
 
 ### Pending Todos
 
@@ -567,6 +573,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-03T20:25:22.043Z
-Stopped at: Completed 14-03-PLAN.md
+Last session: 2026-10-03T21:39:24.721Z
+Stopped at: Completed 14-04-PLAN.md
 Resume file: None
diff --git a/.planning/state.json b/.planning/state.json
index d1e7b0e..9275d26 100644
--- a/.planning/state.json
+++ b/.planning/state.json
@@ -99,5 +99,5 @@
     "label": "Advance to the next step",
     "reason": "Phase 14 of 22 · executing"
   },
-  "updated_at": "2026-10-03T20:25:11.892Z"
+  "updated_at": "2026-10-03T21:39:12.842Z"
 }