diff --git a/docs/superpowers/plans/2026-09-15-m1-data-collection-foundation.md b/docs/superpowers/plans/2026-09-15-m1-data-collection-foundation.md
index df600ba..613ee23 100644
--- a/docs/superpowers/plans/2026-09-15-m1-data-collection-foundation.md
+++ b/docs/superpowers/plans/2026-09-15-m1-data-collection-foundation.md
@@ -1120,6 +1120,8 @@ def refresh_daily(site, date) -> DailyStat:
 
 ### Task 10: 站点管理 API
 
+**开工首件事（Task 9 审查结论）**：把 `tracker/api/auth.py` 的 `_EnvelopeMixin` 与 `_ok` 提取到 `tracker/api/envelope.py` 共享模块（auth 与 collect 的 finalize_response 是两处相似实现，Task 10-12 的 admin 视图都要用；collect 版含 ACAO 保留在自己视图内，仅信封逻辑共享）。
+
 **Files:**
 - Create: `server/tracker/api/sites.py`, `server/tracker/tests/test_sites.py`, Modify: `config/urls.py`