diff --git a/.planning/phases/14-domain-jobs-and-external-integrations/14-REVIEW-FIX.md b/.planning/phases/14-domain-jobs-and-external-integrations/14-REVIEW-FIX.md
index d84d65f..f9ac6c8 100644
--- a/.planning/phases/14-domain-jobs-and-external-integrations/14-REVIEW-FIX.md
+++ b/.planning/phases/14-domain-jobs-and-external-integrations/14-REVIEW-FIX.md
@@ -32,7 +32,7 @@ All fixes landed in `fonoteka.go` and its plugin submodules `sm-feedback-plugin`
 
 ## Fixed Issues
 
-### CR-01: Album writes after slow Discogs I/O save every column from a stale struct
+### CR-01: Album writes after slow Discogs I/O save every column from a stale struct, silently reverting concurrent edits
 
 **Status:** fixed: requires human verification (write-shape and logic change)
 **Files modified:** `fonoteka.go/plugins/golem15/fonoteka/classes/album_write_service.go`, `fonoteka.go/plugins/golem15/fonoteka/classes/discogs/applicator.go`, `fonoteka.go/plugins/golem15/fonoteka/classes/discogs/cover_fetcher.go`, `fonoteka.go/plugins/golem15/fonoteka/classes/discogs/postgres_test.go`
@@ -45,7 +45,7 @@ All fixes landed in `fonoteka.go` and its plugin submodules `sm-feedback-plugin`
 - A new subtest edits name, notes and shelf after the album is loaded and checks that the apply keeps them.
 - One behaviour to check: an apply that changes no catalog field still issues an `updated_at`-only UPDATE and broadcast. The old full `Save` did the same. Eloquent would skip the write.
 
-### WR-01: A stale CSV match pass can cancel, advance or fork a remapped import
+### WR-01: A stale CSV match pass can cancel, advance or fork a remapped import (the race D-10 claims to close)
 
 **Status:** fixed: requires human verification (concurrency logic)
 **Files modified:** `fonoteka.go/plugins/golem15/fonoteka/csv_match_job.go`, `fonoteka.go/plugins/golem15/fonoteka/phase14_jobs_test.go`
@@ -65,7 +65,7 @@ All fixes landed in `fonoteka.go` and its plugin submodules `sm-feedback-plugin`
 - `file_name` is reduced to the client's base name, the same cleaning `attach.Store` does.
 - A new subtest checks `x.html`, `../../x.svg`, `noext` and `Shot.PNG`.
 
-### WR-03: Credential-test routes are unthrottled oracles for third-party keys
+### WR-03: Credential-test routes are unthrottled oracles for third-party keys (parity security hole)
 
 **Files modified:** `fonoteka.go/plugins/golem15/fonoteka/routes.go`, `fonoteka.go/plugins/golem15/fonoteka/routes_table_phase14_test.go`, `fonoteka.go/plugins/golem15/fonoteka/ai_routes_test.go`
 **Commit:** e3c8599 (fonoteka.go)