docs(05-06): record plan close-out in STATE and ROADMAP

- Phase 5 plan 6 of 6 complete and ready for verification
- Record 23 min / 3 tasks / 12 files and the fill-boundary test decisions

.planning/STATE.md

@@ -2,16 +2,16 @@
 gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
-status: executing
-stopped_at: Completed 05-05-PLAN.md
-last_updated: "2026-09-18T18:27:42.970Z"
+status: verifying
+stopped_at: Completed 05-06-PLAN.md
+last_updated: "2026-09-18T18:55:34.419Z"
 last_activity: 2026-09-18
 progress:
   total_phases: 15
-  completed_phases: 4
+  completed_phases: 5
   total_plans: 23
-  completed_plans: 22
-  percent: 27
+  completed_plans: 23
+  percent: 33
 ---
 
 # Project State
@@ -27,10 +27,10 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 
 Phase: 05 (data-layer-full-fidelity) — EXECUTING
 Plan: 6 of 6
-Status: Ready to execute
+Status: Phase complete — ready for verification
 Last activity: 2026-09-18
 
-Progress: [██████████] 96%
+Progress: [██████████] 100%
 
 ## Performance Metrics
 
@@ -68,6 +68,7 @@ Progress: [██████████] 96%
 | Phase 05-data-layer-full-fidelity P03 | 15 min | 3 tasks | 28 files |
 | Phase 05 P04 | 18 min | 3 tasks | 18 files |
 | Phase 05 P05 | 18 min | 3 tasks | 18 files |
+| Phase 05 P06 | 23 min | 3 tasks | 12 files |
 
 ## Accumulated Context
 
@@ -145,6 +146,9 @@ Recent decisions affecting current work:
 - [Phase 05]: notifications/wishlist_subscriptions/wishlist_digest_queue have no FK on user_id/collection_id, matching PHP (Open Question 3 / T-05-18) — PHP migrations omit ->foreign() on these tables; D-02 matches actual constraints rather than fixing them
 - [Phase 05]: D-02 allow-list is settings table, users column-count (no widen_users), and the shipped extra oauth_refresh_tokens.user_id FK — Intended gaps only: Open Question 2, D-03/AUTH-02, and P3 D-17 freeze of 05-03 extra FK
 - [Phase 05]: DATA-11 fixture plugin is test-only: no process-wide Register, not in app.PluginIDs or plugins.gen.go — CONTEXT.md discretion: fixture plugin in tests is acceptable; production binary must not load it
+- [Phase 05]: Hidden-marshal registry walk lives in fonoteka.go/classes because summercms.go must not import the app — CLAUDE.md two-repo rule; plan allowed the parity/classes fallback
+- [Phase 05]: Credential fuzz excludes owner FKs from the working allow-list, matching D-05 two-layer even without a write-service file — Fillable() includes user_id/organisation_id; acceptance requires the owner FK never change
+- [Phase 05]: classes TestMain is the real-Postgres harness; parity activateAppPlugins/parityDB cannot be imported from package main — Same ICU pl-PL migrate-both-plugins shape without crossing the app/framework test boundary
 
 ### Pending Todos
 
@@ -166,6 +170,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-18T18:27:05.252Z
-Stopped at: Completed 05-05-PLAN.md
+Last session: 2026-09-18T18:55:33.389Z
+Stopped at: Completed 05-06-PLAN.md
 Resume file: None