docs(13-01): reword Phase 13 and 14 criteria for the locked boundary

- Phase 13 repos name sm-user-plugin and summercms.go
- wishlist match/apply-release, the credential /test routes and the CSV
  Discogs pick move to Phase 14 (D-01, D-02); notifications drop prune,
  a Phase 14 console command (D-06); CSV and digest job bodies are Phase 14
- API-03, API-04, API-06, INTG-01 and INTG-02 follow; statuses untouched

.planning/REQUIREMENTS.md

@@ -75,10 +75,10 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
 
 - [x] **API-01**: Collections: CRUD, active-context switch (me/context flags plus the opaque channel name from realtime/channels), editor invitations and acceptance, owner-only share link show/update/regenerate
 - [x] **API-02**: Albums: CRUD, ratings, photo upload and manual cover URL, Discogs cover import (cover_urls), artists/genres/styles lookups, search that treats Typesense as a pre-filter with both the items and the total re-gated in SQL
-- [ ] **API-03**: Wishlist: items, subscriptions, public-wishlist/{token} views, album reservations (reserve/reveal), purchase and digest triggers
-- [ ] **API-04**: Notifications: list, mark read, prune; realtime token endpoint owned by the websockets plugin
+- [ ] **API-03**: Wishlist: items, subscriptions, public-wishlist/{token} views, album reservations (reserve/reveal), purchase and digest triggers (the wishlist Discogs match/apply-release routes are Phase 14, with INTG-01)
+- [ ] **API-04**: Notifications: list, unread count, mark read (one and all); pruning is the Phase 14 `fonoteka:prune-notifications` console command; realtime token endpoint owned by the websockets plugin
 - [ ] **API-05**: CSV import as a multi-step session (store, show/poll, mapping patch, per-row edit, commit, cancel) and CSV export on both authenticated groups
-- [ ] **API-06**: Per-user and per-org Discogs and AI credentials CRUD with encrypted storage, org-lock flag, and env-to-org-to-user resolution
+- [ ] **API-06**: Per-user and per-org Discogs and AI credentials CRUD with encrypted storage, org-lock flag, and env-to-org-to-user resolution (the live ai-credential/test and discogs-credential/test routes are Phase 14, with INTG-01 and INTG-02)
 - [ ] **API-07**: Onboarding, public and invitation inspection routes, including the anonymous collection public-token views (public/{token}, its albums and album detail), with their public rate-limit buckets
 - [ ] **API-08**: Feedback submissions and sitemap output from the stack plugins
 - [ ] **API-09**: All 154 routes are registered on the correct groups with identical paths, methods, status codes and bodies
@@ -102,8 +102,8 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
 
 ### Integrations (INTG)
 
-- [ ] **INTG-01**: Discogs client with proactive rate threshold, bounded in-request wait budget, retry-after fallback, and host-locked cover fetch, plus the albums/{id}/cover-price/discogs route
-- [ ] **INTG-02**: AI cover recognition through provider adapters (Anthropic Go SDK, OpenAI-compatible) with per-credential model and base URL overrides
+- [ ] **INTG-01**: Discogs client with proactive rate threshold, bounded in-request wait budget, retry-after fallback, and host-locked cover fetch, plus the albums/{id}/cover-price/discogs route, the wishlist/albums/{id}/match and apply-release routes, discogs-credential/test and the CSV row-edit Discogs pick (selected_discogs_id)
+- [ ] **INTG-02**: AI cover recognition through provider adapters (Anthropic Go SDK, OpenAI-compatible) with per-credential model and base URL overrides, plus the ai-credential/test route and the backend global vision model behind the AI resolver's admin tier
 
 ### Admin (ADMIN)
 

.planning/ROADMAP.md

@@ -699,14 +699,14 @@ Plans:
 **Goal**: The remaining core API surface — wishlist, notifications, CSV import/export, per-user/org credentials, and onboarding/public/invitation routes — is ported with byte-compatible shapes and their own public rate-limit buckets.
 **Mode:** mvp
 **Depends on**: Phase 11, Phase 12
-**Repos:** fonoteka.go
+**Repos:** fonoteka.go; sm-user-plugin (submodule at fonoteka.go/plugins/golem15/user, D-09/D-11 additive exports); summercms.go (13-01 framework gaps)
 **Requirements**: API-03, API-04, API-05, API-06, API-07
 **Success Criteria** (what must be TRUE):
 
-  1. Wishlist items, subscriptions, `public-wishlist/{token}` views, reservations (`wishlist/albums/{id}/reserve|reveal`) and purchase/digest triggers pass the parity diff.
-  2. Notifications list/mark-read/prune endpoints pass the parity diff (the realtime token endpoint itself is owned by the websockets plugin, ported in Phase 11).
-  3. CSV import runs as a multi-step session (store, show/poll, mapping patch, per-row edit, commit, cancel) and CSV export works on both authenticated groups, all passing the parity diff.
-  4. Per-user and per-org Discogs/AI credentials CRUD store encrypted values, honor the org-lock flag, and resolve env-to-org-to-user correctly.
+  1. Wishlist items, subscriptions, `public-wishlist/{token}` views, reservations (`wishlist/albums/{id}/reserve|reveal`) and purchase/digest triggers pass the parity diff. The wishlist Discogs `match`/`apply-release` routes move to Phase 14 (D-01), and the digest trigger queues its job here while the digest job body is Phase 14 (JOBS-03).
+  2. Notifications list, unread count and mark-read (one and all) pass the parity diff; pruning is the Phase 14 `fonoteka:prune-notifications` console command, not a route (D-06). The realtime token endpoint itself is owned by the websockets plugin, ported in Phase 11.
+  3. CSV import runs as a multi-step session (store, show/poll, mapping patch, per-row edit, commit, cancel) and CSV export works on both authenticated groups, all passing the parity diff. Commit and mapping enqueue the CSV import and match jobs, whose bodies are Phase 14 (JOBS-02).
+  4. Per-user and per-org Discogs/AI credentials CRUD store encrypted values, honor the org-lock flag, and resolve env-to-org-to-user correctly. The live `ai-credential/test` and `discogs-credential/test` routes move to Phase 14 (D-02).
   5. Onboarding, public and invitation-inspection routes, including the anonymous collection views `public/{token}`, `public/{token}/albums` and `public/{token}/albums/{id}`, are reachable without auth and enforce their own public rate-limit buckets.
 
 **Plans:** 6 plans
@@ -743,8 +743,8 @@ Plans:
   1. The CSV import write job and the self-redispatching Discogs match job (240s timeout, self-redispatching with a delay on a Discogs rate-limit error) both complete correctly.
   2. The wishlist digest job coalesces a 30-minute window and deletes its queue row on completion.
   3. The `reindex` command asserts zero `collection_id`-0 documents before and after and can drop the legacy index.
-  4. The Discogs client enforces its proactive rate threshold, bounded wait budget, retry-after fallback and host-locked cover fetch, and the `albums/{id}/cover-price/discogs` route passes the parity diff.
-  5. AI cover recognition works through both Anthropic and OpenAI-compatible adapters with per-credential model/base-URL overrides.
+  4. The Discogs client enforces its proactive rate threshold, bounded wait budget, retry-after fallback and host-locked cover fetch, and the `albums/{id}/cover-price/discogs` route, the wishlist `wishlist/albums/{id}/match` and `apply-release` routes, `discogs-credential/test` and the CSV row-edit Discogs pick (`selected_discogs_id`) pass the parity diff.
+  5. AI cover recognition works through both Anthropic and OpenAI-compatible adapters with per-credential model/base-URL overrides; `ai-credential/test` passes the parity diff, and the AI resolver's admin tier uses the backend global vision model.
   6. Feedback submissions and sitemap output work; the ported `oauth-client`/`prune-notifications`/`reindex` commands all run correctly.
 
 **Plans**: TBD