diff --git a/.planning/phases/19-chat-and-chatchannels/19-04-PLAN.md b/.planning/phases/19-chat-and-chatchannels/19-04-PLAN.md
index 853d96d7..4b8fa5f6 100644
--- a/.planning/phases/19-chat-and-chatchannels/19-04-PLAN.md
+++ b/.planning/phases/19-chat-and-chatchannels/19-04-PLAN.md
@@ -248,7 +248,7 @@ Commit sm-user-plugin on its own (core-plugins-own-repos). Push only if the huma
 |-----------|----------|-----------|----------|-------------|-----------------|
 | T-19-07 | Information disclosure | user.Deleting → SeverUserFromContext | high | mitigate | Fire Deleting in the delete tx; TestDeletingCascade |
 | T-19-10 | Elevation of privilege | user namespace authorizer | high | mitigate | Allow only user:{id} for that user; skip-if-registered; TestUserAuthorizer |
-| T-19-06 | Elevation of privilege | mention resolve (completed here) | high | mitigate | Participant-only handle match; TestHandleMention |
+| T-19-14 | Elevation of privilege | mention resolve (completed here) | high | mitigate | Participant-only handle match; TestHandleMention |
 | T-19-SC | Tampering | go.mod requires | high | mitigate | No new packages; analog handle migration only |
 
 </threat_model>
diff --git a/.planning/phases/19-chat-and-chatchannels/19-05-PLAN.md b/.planning/phases/19-chat-and-chatchannels/19-05-PLAN.md
index 5f0f128f..e652ecae 100644
--- a/.planning/phases/19-chat-and-chatchannels/19-05-PLAN.md
+++ b/.planning/phases/19-chat-and-chatchannels/19-05-PLAN.md
@@ -141,7 +141,7 @@ scripts/check-phase19.3.sh
   <read_first>/media/nvme/dev/jz/wavepath.org/plugins/golem15/chat/models/Message.php, /media/nvme/dev/jz/wavepath.org/plugins/golem15/chat/traits/ChatBroadcasting.php, ../sm-chat-plugin/models/message.go, ../sm-chat-plugin/harness_test.go, modules/lighthouse/drivers.go, ../sm-paymentgatewaysubscriptions-plugin/fixture_plugin_test.go</read_first>
   <action>Per SC-19-3 and D-21, land one production golden pair that the rest of the suite will copy. Author testdata/goldens/message_to_api_array.json from PHP toApiArray keys (id, conversation_id, sender_id, sender_name, sender_avatar, content, type, attachments[{id,url,filename,size,mime_type,kind,width,height}], created_at, created_at_human, edited_at, deleted_at, is_mine) plus root_id (RESEARCH Q2). Author created_chat_message.json from ChatBroadcasting: event created.chat.message, channels = context BroadcastChannel + chat:conversation:{id}, payload id, conversation_id, sender_id, root_id, type, action, created_at. Prefer a live Wavepath capture when one is on disk; otherwise freeze the PHP source at 943b712 and record `_source` in the JSON. Normalize URL prefix to /_chat/api/v1 before compare (D-10).
 
-golden_test.go TestToAPIArray (short): build a message with one image attachment (kind, width, height set) and compare keys and scalar fields to the golden. TestGoldenEvents (short or memory driver): MemoryDriver.Publications() for a SendMessage matches created_chat_message.json name, channels and payload; fail if any publication map contains key content (T-19-04).
+golden_test.go TestToAPIArray (short): build a message with one image attachment (kind, width, height set) and compare keys and scalar fields to the golden. TestGoldenEvents (short or memory driver): MemoryDriver.Publications() for a SendMessage matches created_chat_message.json name, channels and payload; fail if any publication map contains key content (T-19-13).
 
 queststream_trace_test.go TestNoQuestStreamTrace (short): walk production .go / .yaml / .md (exclude testdata, *_test.go, PHP_METHOD_MAP.md) and fail if any of the four D-02 tokens appear; also fail if acme.teams appears outside test files. Use grep -v '^#' style filters so comments in this plan are irrelevant.
 
@@ -229,7 +229,7 @@ Update 19-VALIDATION.md task IDs from 19-W0-* to 19-01 / 19-02 / 19-03 / 19-04 /
 
 | Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
 |-----------|----------|-----------|----------|-------------|-----------------|
-| T-19-04 | Information disclosure | TestGoldenEvents | high | mitigate | Fail if a MemoryDriver publication contains content (already required in Task 1) |
+| T-19-13 | Information disclosure | TestGoldenEvents | high | mitigate | Fail if a MemoryDriver publication contains content (already required in Task 1) |
 | T-19-SC | Tampering | scripts/check-phase19.sh | high | mitigate | No package installs; analog detectors; --self-test plants failures |
 
 </threat_model>