docs(14.2.1-04): complete translate tests, gate, and security review

Record the last-plan SUMMARY, closed high-threat review, validation sign-off, and 4/4 roadmap progress.

Co-authored-by: Cursor <cursoragent@cursor.com>

.planning/STATE.md

@@ -3,17 +3,17 @@ gsd_state_version: "1.0"
 milestone: v1.0
 current_phase: 14.2.1
 current_phase_name: Translate plugin
-status: executing
-stopped_at: Completed 14.2.1-03-PLAN.md
-last_updated: "2026-10-06T11:29:17Z"
+status: verifying
+stopped_at: Completed 14.2.1-04-PLAN.md
+last_updated: "2026-10-06T12:21:36Z"
 last_activity: 2026-10-06
-last_activity_desc: 14.2.1-03 cabana ML fields and proof host boot
-state_head: e3b3475
+last_activity_desc: 14.2.1-04 tests, phase gate, and security review
+state_head: ba6e436
 progress:
   total_phases: 26
   completed_phases: 12
   total_plans: 129
-  completed_plans: 128
+  completed_plans: 129
 milestone_name: milestone
 ---
 
@@ -28,12 +28,12 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 
 ## Current Position
 
-Phase: 14.2.1 (Translate plugin) — EXECUTING
-Plan: 3 of 4 complete; next 14.2.1-04
-Status: Ready for unit/integration tests
-Last activity: 2026-10-06 — Cabana markdown/ML fields, docs/dist, and proof host boot
+Phase: 14.2.1 (Translate plugin) — VERIFYING
+Plan: 4 of 4 complete
+Status: Ready for phase verification / UAT
+Last activity: 2026-10-06 — End-to-end tests, matrices, fail-closed gate, security review
 
-Progress: [████████░░] 75%
+Progress: [██████████] 100%
 
 ## Performance Metrics
 
@@ -183,6 +183,7 @@ Progress: [████████░░] 75%
 | Phase 14.2.1 P01 | 16 min | 3 tasks | 23 files |
 | Phase 14.2.1 P02 | 15 min | 3 tasks | 21 files |
 | Phase 14.2.1 P03 | 5 min | 3 tasks | 40 files |
+| Phase 14.2.1 P04 | 51 min | 3 tasks | 22 files |
 
 ## Accumulated Context
 
@@ -582,6 +583,7 @@ Recent decisions affecting current work:
 - [Phase 14.2.1]: MorphName is an import-stable string, never reflect.Type.String(); Translated applies D-11 fallback and TranslatedExact does not.
 - [Phase 14.2.1]: Locales is HasAdminControllers plus HasNavigation (not HasSettings); Fillable excludes is_default/sort_order; makeDefault uses GORM Updates maps.
 - [Phase 14.2.1]: Task 2 locked grzyby-submodules: proof host is sm-grzybyfunkcjonalne-app with plugins/golem15/user and plugins/golem15/translate; host go.work replace points at ../summercms.go.
+- [Phase 14.2.1]: 14.2.1-04 security review was executor-self-performed (no gsd-security-auditor in this Cursor session); every cited TestName was re-run. Full cabana `-race` needs `-timeout 30m`. WhereIndex falls back to the host column when no index row matches (PHP transWhere).
 
 ### Pending Todos
 
@@ -634,6 +636,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-06T11:29:17Z
-Stopped at: Completed 14.2.1-03-PLAN.md
+Last session: 2026-10-06T12:21:36Z
+Stopped at: Completed 14.2.1-04-PLAN.md
 Resume file: None