docs(12.1-04): complete groups field, User Groups and Organisations plan

.planning/phases/12.1-user-plugin-admin-screens/deferred-items.md

@@ -3,7 +3,8 @@
 ## Deferred Items
 
 - Two inventory tests of the application's fonoteka plugin module fail against the framework at v0.1.3
-  status: open
+  status: resolved
+  **Resolved:** plan 12.1-04, 2026-10-05, fonoteka.go commit `ca746fc` (`phase09AdminRoutes` names the bulk action and record action routes; `phase10ListMessageKeys` names the three row-state messages). The form half of `TestPhase10ControllerCopy` reads named keys only and needed no change.
   **Found:** plan 12.1-02 Task 6, 2026-10-05, by running `go -C ../fonoteka.go/plugins/golem15/fonoteka test ./... -count=1` in addition to the plan's gate.
   **What:** `TestPhase09SecurityRoutes` (`admin_phase09_security_test.go`) reports the two plan 01 routes `POST .../{controller}/bulk/{action}` and `POST .../{controller}/{id}/actions/{action}` as unexpected, because the fixed list `phase09AdminRoutes` does not name them. `TestPhase10ControllerCopy` (`admin_phase10_copy_test.go`) compares the list messages with the fixed list `phase10ListMessageKeys`, which lacks `rowStateDeleted`, `rowStateNegative` and `rowStateDisabled`; its form half was not reached and may need `preview` and `edit` the same way.
   **Why not fixed here:** the fix is two fixed lists in the application repository (fonoteka.go); plan 12.1-02 writes to summercms.go only. No framework change is needed, so the tagged commit is not affected. The same catch-up was done once before (`549840d test(13-06): list the Phase 12.2 cabana admin routes in the Phase 9 route inventory`).
@@ -11,7 +12,8 @@
   **Suggested owner:** plan 12.1-04 (it already writes the application's parity allow-list entry and submodule pointer) or plan 12.1-05's gate script, which should run every workspace module.
 
 - Four more application tests fail once the user plugin registers its admin screen, its three migrations and the FrontendPermission model
-  status: open
+  status: resolved
+  **Resolved:** plan 12.1-04, 2026-10-05, fonoteka.go commit `b35442a` (developer navigation `[fonoteka user]`, with the publisher still seeing neither; `expectedUserModels = 7`, because plan 04 also registers the `UsersGroup` pivot; the user plugin's history has ten migrations) and `35a727f` (the `golem15_user_frontend_permissions` allow-list entry). Each failure was checked to be the fixed list and not a defect before the list changed.
   **Found:** plan 12.1-03 Tasks 1 and 3, 2026-10-05. The application's go.work uses the plugin's working tree, so these fail as soon as the plugin commits exist, before any submodule pointer bump.
   **What:** (1) `TestAdminMetadataFiltering` (`plugins/golem15/fonoteka/admin_metadata_test.go`) expects the developer role's navigation to be exactly `[fonoteka]`; it is now `[fonoteka user]`, because the four Winter permission codes of the user plugin default to the developer role (D-02, D-04). (2) `TestMigrateSeedsCanonicalGenres` and `TestRollbackLastIsolatesFonoteka` (`parity/migrate_test.go`) compare the user plugin's migration history with a fixed id list, which lacks `202610040001_add_users_permissions`, `202610040002_add_users_last_seen` and `202610040003_create_frontend_permissions`. In history order (by id) the first of them sorts before the shipped `202610040001_create_user_api_tokens`. (3) `TestHiddenNeverMarshals` (`plugins/golem15/fonoteka/classes/hidden_marshal_test.go`) pins `expectedUserModels = 5`; the user plugin now registers six models (`FrontendPermission` is new). With the constant at 6 (checked through a `go test -overlay` copy, nothing written to the repository) the test passes, so the marshalling checks themselves hold for the new model and the new `User` fields.
   **Already known, same run:** `TestSchemaMatchesPHPSnapshot` reports the new table `golem15_user_frontend_permissions` until plan 04 adds its allow-list entry (stated in the 12.1-03 plan).