docs(05-01): record plan close-out in STATE and ROADMAP

- Advance to plan 2 of 6; 05-01 marked complete
- DATA-03, DATA-06, DATA-10 checked in REQUIREMENTS.md

.planning/STATE.md

@@ -3,15 +3,15 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Phase 5 context gathered
-last_updated: "2026-09-18T16:06:30.536Z"
-last_activity: 2026-09-18 -- Phase 05 planning complete
+stopped_at: Completed 05-01-PLAN.md
+last_updated: "2026-09-18T16:50:24.472Z"
+last_activity: 2026-09-18
 progress:
   total_phases: 15
   completed_phases: 4
   total_plans: 23
-  completed_plans: 17
-  percent: 27
+  completed_plans: 18
+  percent: 78
 ---
 
 # Project State
@@ -21,16 +21,16 @@ progress:
 See: .planning/PROJECT.md (updated 2026-09-16)
 
 **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
-**Current focus:** Phase 5 — data layer full fidelity
+**Current focus:** Phase 05 — data-layer-full-fidelity
 
 ## Current Position
 
-Phase: 5
-Plan: Not started
+Phase: 05 (data-layer-full-fidelity) — EXECUTING
+Plan: 2 of 6
 Status: Ready to execute
-Last activity: 2026-09-18 -- Phase 05 planning complete
+Last activity: 2026-09-18
 
-Progress: [██████████] 100%
+Progress: [████████░░] 78%
 
 ## Performance Metrics
 
@@ -63,6 +63,7 @@ Progress: [██████████] 100%
 | Phase 04 P04-02 | 10 min | 3 tasks | 11 files |
 | Phase 04 P04-03 | 6 min | 3 tasks | 15 files |
 | Phase 04 P04-04 | 8 min | 3 tasks | 9 files |
+| Phase 05 P01 | 16 min | 4 tasks | 37 files |
 
 ## Accumulated Context
 
@@ -117,6 +118,12 @@ Recent decisions affecting current work:
 - [Phase 04]: mail.smtp.tls defaults to mandatory STARTTLS; none/notls is opt-in for Mailpit and is never inferred — D-18 T-04-10: no silent production TLS downgrade; Mailpit needs explicit NoTLS
 - [Phase 04]: Mailpit image is axllent/mailpit:v1.31.1; receipt is polled from /api/v1/messages then /api/v1/message/{ID} — D-19: a successful Send claim requires observed receipt through a separate HTTP API; pin a released Mailpit tag
 - [Phase 04]: fstest.MapFS WalkDir cannot host '..' keys; malformed lang paths are extra-segment and wrong-suffix files — MapFS Open/WalkDir follows .. into an infinite directory loop; parseLangPath still rejects cleaned traversal
+- [Phase 05]: Models-leaf rule holds on keios.eu user, jz chat, and pxpx checkout; contracts/VOs/jobs/broadcasting stay inside the cast-or-hook conversion treatments
+- [Phase 05]: plugin.go Models()/Migrations() return registry All(); Boot calls classes.RegisterHooks when *gorm.DB is published — later Phase 5 plans add files, not edit plugin.go
+- [Phase 05]: lagoon.Fill matches gorm column tags against the caller allow-list and logs dropped keys once per type+key in non-production — D-05 D-06
+- [Phase 05]: Lifecycle Has* interfaces use GORM-native signatures; WithSoftDeleteCascade does not open a new transaction — DATA-03 primitive
+- [Phase 05]: Paginate coerces nil data to []; RegisterJoinTable fails loud on nil db — DATA-10 and pivot-write contract
+- [Phase 05]: DATA-09 migration count is not an acceptance number (D-01); HTTP DTO fuzz moves to Phase 12 (D-07)
 
 ### Pending Todos
 
@@ -138,6 +145,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-18T13:23:21.535Z
-Stopped at: Phase 5 context gathered
-Resume file: .planning/phases/05-data-layer-full-fidelity/05-CONTEXT.md
+Last session: 2026-09-18T16:50:24.446Z
+Stopped at: Completed 05-01-PLAN.md
+Resume file: None