fix(14): cite CONTEXT.md decision IDs in plan must_haves.truths

The decision-coverage-plan gate only scans designated sections
(frontmatter must_haves/truths/objective, or body sections under
matching headings) — decisions cited only in task prose/threat-model
tables don't count. Add explicit D-NN citations to the truths arrays
in Plans 01-04 so all 10 CONTEXT.md decisions are gate-visible.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LHRgZqkzBHBbAbc3KHneuR

.planning/phases/14-pax8-ui-surface/14-01-PLAN.md

@@ -12,8 +12,8 @@ requirements: [PAX8-13]
 must_haves:
   truths:
     - "An authenticated user can GET /api/pax8/companies and receive a paginated list of PAX8 companies with their matched Autotask company name and active subscription count"
-    - "An authenticated user can GET /api/pax8/companies/[id] and receive that company's current subscriptions plus each subscription's latest actually-billed amount"
-    - "Both routes reject unauthenticated requests with 401"
+    - "An authenticated user can GET /api/pax8/companies/[id] and receive that company's current subscriptions plus each subscription's latest actually-billed amount, grouped by subscription/product per D-03"
+    - "Both routes reject unauthenticated requests with 401; both use requireAuth() only, never requirePermission, per D-07"
   artifacts:
     - path: "app/api/pax8/companies/route.ts"
       provides: "GET company list (paginated, sortable, searchable), requireAuth-gated"

.planning/phases/14-pax8-ui-surface/14-02-PLAN.md

@@ -13,10 +13,10 @@ autonomous: true
 requirements: [PAX8-12, PAX8-14]
 must_haves:
   truths:
-    - "An authenticated user can GET /api/pax8/company-matches and receive the unresolved review queue with each PAX8 company's stored top-3 candidate Autotask companies and their names"
-    - "An admin (and only an admin) can POST /api/pax8/company-matches/[id]/resolve to link a flagged PAX8 company to any existing active Autotask company"
-    - "Resolving writes BOTH pax8_companies.match_method='manual' and pax8_company_match_review.resolved_* in one transaction, so the resolution survives the next sync's re-matching pass"
-    - "The resolve action accepts a companyId outside candidate_company_ids (manual-search fallback / zero-candidate case) provided that company exists and is active"
+    - "An authenticated user can GET /api/pax8/company-matches and receive the unresolved review queue with each PAX8 company's stored top-3 candidate Autotask companies and their names; this GET uses requireAuth() only, not requirePermission, per D-07"
+    - "An admin (and only an admin) can POST /api/pax8/company-matches/[id]/resolve to link a flagged PAX8 company to any existing active Autotask company, gated by requirePermission('admin','access') per D-08"
+    - "Resolving writes BOTH pax8_companies.match_method='manual' and pax8_company_match_review.resolved_* in one transaction per D-06, so the resolution survives the next sync's re-matching pass"
+    - "The resolve action accepts a companyId outside candidate_company_ids (manual-search fallback / zero-candidate case per D-05) provided that company exists and is active"
   artifacts:
     - path: "app/api/pax8/company-matches/route.ts"
       provides: "GET unresolved review queue with bulk-fetched candidate names, requireAuth-gated"

.planning/phases/14-pax8-ui-surface/14-03-PLAN.md

@@ -10,8 +10,8 @@ autonomous: true
 requirements: [PAX8-13]
 must_haves:
   truths:
-    - "Passing kind='pax8_company' to DetailModal renders a PAX8 identity/system field layout instead of the flat unstyled key/value fallback"
-    - "When the data object carries a subscriptions array, the Formatted tab renders a subscriptions & cost-breakdown table (product, qty, billing term, amount) plus a summed total, above the field groups"
+    - "Passing kind='pax8_company' to DetailModal renders a PAX8 identity/system field layout instead of the flat unstyled key/value fallback, per D-02's formatted/raw drill-down pattern"
+    - "When the data object carries a subscriptions array, the Formatted tab renders a subscriptions & cost-breakdown table (product, qty, billing term, amount) plus a summed total, above the field groups, grouped by subscription/product per D-03"
     - "Every existing DetailModal caller (tickets, companies) renders exactly as before — the change is purely additive"
   artifacts:
     - path: "components/admin/DetailModal.tsx"

.planning/phases/14-pax8-ui-surface/14-04-PLAN.md

@@ -11,10 +11,11 @@ autonomous: true
 requirements: [PAX8-13]
 must_haves:
   truths:
-    - "Navigating to /pax8 renders a page with a PageHeader and a Companies / Needs Review Tabs bar"
-    - "The Companies tab shows a DataTable of PAX8 companies (name, matched Autotask company or Unmatched badge, active subscription count, city/country) with sort/search/pagination"
+    - "Navigating to /pax8 renders a page with a PageHeader and a Companies / Needs Review Tabs bar, keeping the review section embedded on the same page per D-04 rather than a separate route"
+    - "The Companies tab shows a DataTable of PAX8 companies (name, matched Autotask company or Unmatched badge, active subscription count, city/country) with sort/search/pagination, using components/admin/DataTable.tsx per D-01"
     - "Clicking a company row fetches its drill-down and opens the extended DetailModal showing the subscriptions & cost breakdown"
-    - "A top-level PAX8 nav entry appears for all authenticated users on desktop and mobile"
+    - "A top-level PAX8 nav entry appears for all authenticated users on desktop and mobile, per D-07's view-is-manager-visible framing"
+    - "Page headings and labels use the sitewide 3-weight IBM Plex Sans scale (300-700) approved in D-10, not a trimmed 2-weight variant"
   artifacts:
     - path: "app/pax8/page.tsx"
       provides: "Companies tab (DataTable + DetailModal drill-down) + tab shell with a Needs Review placeholder"