docs(05-04): record plan close-out in STATE and ROADMAP

- Advance to plan 5 of 6; DATA-08 marked complete

.planning/REQUIREMENTS.md

@@ -43,7 +43,7 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
 - [x] **DATA-05**: Model rule strings (required, between, unique:table, nullable, integer, in) are validated on save via go-playground/validator with translated messages and a 422 error map shaped like Laravel's
 - [x] **DATA-06**: Mass assignment goes through per-endpoint request DTOs honoring each model's fillable allow-list; serialization honors a hidden deny-list with an explicit per-call override
 - [x] **DATA-07**: Custom casts exist for jsonable columns, money as a fixed four-decimal string, and encrypted-at-rest secrets (AES-GCM, app-key derived) that are also hidden from serialization
-- [ ] **DATA-08**: A polymorphic file attachment table (owner type, owner id, field, disk path, sort order, public/private) backs attachOne and attachMany, stored via gocloud.dev/blob with the same public URL shape
+- [x] **DATA-08**: A polymorphic file attachment table (owner type, owner id, field, disk path, sort order, public/private) backs attachOne and attachMany, stored via gocloud.dev/blob with the same public URL shape
 - [x] **DATA-09**: All 25 Płytarium models and their squashed migration set are ported with matching table names, columns, indexes and defaults (migration count is not itself an acceptance number — squashed per plan-time decision D-01 in 05-CONTEXT.md)
 - [x] **DATA-10**: Paginated responses use the exact `{data, meta{current_page, last_page, per_page, total}}` envelope without a links key
 - [ ] **DATA-11**: Other plugins can hook a model's lifecycle through the GORM callback registry and extend its schema with a companion migration
@@ -179,7 +179,7 @@ Which phases cover which requirements. Updated during roadmap creation.
 | DATA-05 | Phase 5 | Complete |
 | DATA-06 | Phase 5 | Complete |
 | DATA-07 | Phase 5 | Complete |
-| DATA-08 | Phase 5 | Pending |
+| DATA-08 | Phase 5 | Complete |
 | DATA-09 | Phase 5 | Complete |
 | DATA-10 | Phase 5 | Complete |
 | DATA-11 | Phase 5 | Pending |

.planning/ROADMAP.md

@@ -198,7 +198,7 @@ Plans:
 **Wave 3** *(blocked on Wave 2 completion)*
 
 - [x] 05-03-PLAN.md — Secrets slice: encrypted cast, key management, organisations, credentials/OAuth tables
-- [ ] 05-04-PLAN.md — Attachments: system_files, blob storage, thumbnails, delete lifecycle
+- [x] 05-04-PLAN.md — Attachments: system_files, blob storage, thumbnails, delete lifecycle
 
 **Wave 4** *(blocked on Wave 3 completion)*
 
@@ -391,7 +391,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 2. API parity harness bootstrap | 5/5 | Complete   | 2026-09-17 |
 | 3. First vertical slice — genres end to end | 4/4 | Complete   | 2026-09-17 |
 | 4. CLI scaffolding, i18n and mail | 4/4 | Complete   | 2026-09-18 |
-| 5. Data layer full fidelity | 3/6 | In Progress|  |
+| 5. Data layer full fidelity | 4/6 | In Progress|  |
 | 6. HTTP routing, auth groups and rate limiting | 0/TBD | Not started | - |
 | 7. User plugin and authentication | 0/TBD | Not started | - |
 | 8. OAuth2.1 authorization server | 0/TBD | Not started | - |

.planning/STATE.md

@@ -3,15 +3,15 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Completed 05-03-PLAN.md
-last_updated: "2026-09-18T17:44:19.083Z"
+stopped_at: Completed 05-04-PLAN.md
+last_updated: "2026-09-18T18:05:28.925Z"
 last_activity: 2026-09-18
 progress:
   total_phases: 15
   completed_phases: 4
   total_plans: 23
-  completed_plans: 20
-  percent: 87
+  completed_plans: 21
+  percent: 27
 ---
 
 # Project State
@@ -26,11 +26,11 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 05 (data-layer-full-fidelity) — EXECUTING
-Plan: 4 of 6
+Plan: 5 of 6
 Status: Ready to execute
 Last activity: 2026-09-18
 
-Progress: [█████████░] 87%
+Progress: [█████████░] 91%
 
 ## Performance Metrics
 
@@ -66,6 +66,7 @@ Progress: [█████████░] 87%
 | Phase 05 P01 | 16 min | 4 tasks | 37 files |
 | Phase 05 P02 | 27 min | 3 tasks | 32 files |
 | Phase 05-data-layer-full-fidelity P03 | 15 min | 3 tasks | 28 files |
+| Phase 05 P04 | 18 min | 3 tasks | 18 files |
 
 ## Accumulated Context
 
@@ -136,6 +137,9 @@ Recent decisions affecting current work:
 - [Phase 05]: OpenFromApp calls LoadAppKey+PublishEncryptionKeys once per boot; empty/short/undecodable app.key fails with SUMMER_APP__KEY — D-11 fail-loud, no default key; Scan/Value must not re-read config per row
 - [Phase 05]: golem15_user_organisations is owned by the user plugin; Phase 5 ships no users-table ALTER (D-03 deviation, Phase 7 AUTH-02) — User-confirmed at plan time: organisations are an FK target only this phase
 - [Phase 05]: DecryptLaravelPayload is cutover-import-only and is never called from Encrypted Scan/Value — D-10 live path is AES-256-GCM only; Laravel CBC is Phase 15 import
+- [Phase 05]: Blob keys are partition+disk_name (no public/protected prefix); fileblob roots at storage/app/uploads — StaticHandler reconstructs keys from PartitionDirectory+disk_name; cutover can point bucket_url at uploads/public
+- [Phase 05]: DeleteForOwner afterCommit is an in-tx key collector; DeleteKeys removes originals and thumb_<id>_ prefixes after commit — GORM has no post-commit hook; a rollback must not have already deleted bytes
+- [Phase 05]: Album/Collection MorphName returns the PHP class string and does not import attach (models stay a leaf) — models-leaf rule; interface satisfaction is implicit
 
 ### Pending Todos
 
@@ -157,6 +161,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-18T17:43:22.041Z
-Stopped at: Completed 05-03-PLAN.md
+Last session: 2026-09-18T18:05:28.907Z
+Stopped at: Completed 05-04-PLAN.md
 Resume file: None