docs(01-03): complete SQLAlchemy ORM + Alembic plan — SUMMARY, STATE, ROADMAP

- SUMMARY.md: all 11 tables documented, privilege grants, verification results, deviations
- STATE.md: plan counter advanced to 3/5, decisions added, session continuity updated
- ROADMAP.md: 01-03-PLAN.md marked complete, progress table updated to 3/5

.planning/STATE.md

@@ -4,13 +4,13 @@ milestone: v1.0
 milestone_name: milestone
 current_phase: 1
 status: executing
-last_updated: "2026-05-22T07:10:00Z"
+last_updated: "2026-05-22T08:30:00Z"
 progress:
   total_phases: 5
   completed_phases: 0
   total_plans: 5
-  completed_plans: 2
-  percent: 40
+  completed_plans: 3
+  percent: 60
 ---
 
 # Project State
@@ -24,7 +24,7 @@ progress:
 
 | Phase | Name | Status |
 |---|---|---|
-| 1 | Infrastructure Foundation | In Progress (2/5 plans) |
+| 1 | Infrastructure Foundation | In Progress (3/5 plans) |
 | 2 | Users & Authentication | Not Started |
 | 3 | Document Migration & Multi-User Isolation | Not Started |
 | 4 | Folders, Sharing, Quotas & Document UX | Not Started |
@@ -33,10 +33,10 @@ progress:
 ## Current Position
 
 Phase: 1 (Infrastructure Foundation) — EXECUTING
-Plan: 3 of 5
+Plan: 4 of 5
 **Phase:** 01-infrastructure-foundation
-**Plan:** 01-02 COMPLETE → advancing to 01-03
-**Progress:** ████░░░░░░ 40%
+**Plan:** 01-03 COMPLETE → advancing to 01-04
+**Progress:** ██████░░░░ 60%
 
 ## Performance Metrics
 
@@ -45,7 +45,7 @@ Plan: 3 of 5
 | Phases complete | 0 / 5 |
 | Requirements mapped | 54 / 54 |
 | Plans written | 5 (Phase 1) |
-| Plans complete | 2 |
+| Plans complete | 3 |
 
 ## Accumulated Context
 
@@ -60,6 +60,10 @@ Plan: 3 of 5
 | JWT in httpOnly cookie | Refresh token in httpOnly cookie; access token in Pinia memory only — never localStorage |
 | Refresh token family revocation | RFC 9700 — reuse of a rotated token revokes entire family and alerts user |
 | BackgroundTasks replacement | FastAPI BackgroundTasks is per-instance; replace with Celery+Redis or pgqueuer before horizontal scale |
+| AuditLog metadata_ ORM attribute | `metadata` is reserved on DeclarativeBase; ORM attribute is `metadata_` with `name="metadata"` kwarg to avoid silent collision |
+| documents.user_id nullable Phase 1 | D-03 — no auth in Phase 1; Phase 2 migration adds NOT NULL after auth lands |
+| groups stub table Phase 1 | D-02 — groups is a v2 feature; table created now for schema completeness, no rows until Phase 2+ |
+| SEQUENCES grants in migration | GRANT USAGE/SELECT on sequences required for audit_log.id autoincrement nextval() by docuvault_app |
 | Admin impersonation excluded | Explicit architectural exclusion — no endpoint or UI pathway; violates privacy-first core value |
 | Two-DSN PostgreSQL strategy | DATABASE_URL (docuvault_app, DML only) + DATABASE_MIGRATE_URL (docuvault_migrate, DDL only); celery-worker gets only DATABASE_URL |
 | MinIO healthcheck via mc ready local | curl removed from MinIO Docker image since Oct 2023; mc is the correct in-container healthcheck tool |
@@ -84,6 +88,6 @@ _Updated at each phase transition._
 
 | Field | Value |
 |---|---|
-| Last session | 2026-05-22 — Executed 01-02-PLAN.md (Wave 0 test scaffolds + async fixtures) |
-| Next action | Execute 01-03-PLAN.md (SQLAlchemy ORM models + Alembic async migration) |
+| Last session | 2026-05-22 — Executed 01-03-PLAN.md (SQLAlchemy ORM + Alembic migration; alembic upgrade head verified) |
+| Next action | Execute 01-04-PLAN.md (StorageBackend ABC + MinIO backend + async services/storage.py) |
 | Pending decisions | See Open Questions above |