docs(15-02): complete Gruppenverwaltung & Standardgruppen-Mitgliedschaft plan

.planning/STATE.md

@@ -5,15 +5,15 @@ milestone_name: Ausschreibungs-Radar
 current_phase: 15
 current_phase_name: modul-berechtigungen-gruppen-user-grants
 status: executing
-stopped_at: Completed 15-01-PLAN.md
-last_updated: "2026-08-04T13:14:07.699Z"
+stopped_at: Completed 15-02-PLAN.md
+last_updated: "2026-08-04T13:27:34.942Z"
 last_activity: 2026-08-04
 last_activity_desc: Phase 15 execution started
 progress:
   total_phases: 15
   completed_phases: 13
   total_plans: 75
-  completed_plans: 67
+  completed_plans: 68
 ---
 
 # Project State
@@ -28,11 +28,11 @@ See: .planning/PROJECT.md (updated 2026-07-17)
 ## Current Position
 
 Phase: 15 (modul-berechtigungen-gruppen-user-grants) — EXECUTING
-Plan: 2 of 8
+Plan: 3 of 8
 Status: Ready to execute
 Last activity: 2026-08-04 — Phase 15 execution started
 
-Progress: [█████████░] 89%
+Progress: [█████████░] 91%
 
 ## Performance Metrics
 
@@ -101,6 +101,7 @@ Progress: [█████████░] 89%
 | Phase 14 P04 | 25min | 2 tasks | 6 files |
 | Phase 14 P05 | 50min | 3 tasks | 19 files |
 | Phase 15 P01 | 24min | 3 tasks | 10 files |
+| Phase 15-modul-berechtigungen-gruppen-user-grants P02 | 11min | 2 tasks | 11 files |
 
 ## Accumulated Context
 
@@ -232,6 +233,9 @@ Recent decisions affecting current work:
 - [Phase ?]: [260729-d3k]: syncUsersForTenant no-op guard re-keyed from empty groupFilterDns to empty parsed base-DN list — Base-DN(s) are now the sync scope, groupFilterDns is an optional extra restriction (ou= = extra bases, group DN = memberOf constraint)
 - [Phase ?]: [15-01]: D-01/D-05/D-06/D-02 wie in 15-CONTEXT.md gesperrt umgesetzt (Nutzer-Checkpoint mit 'proceed' bestaetigt)
 - [Phase ?]: [15-01]: RLS fuer Group/GroupMembership/ModuleGrant aktiviert (T-15-11) statt sie wie Tender* RLS-frei zu lassen
+- [Phase ?]: [15-02]: isDefault:true läuft in this.prisma.$transaction([updateMany, update]); partieller Unique-Index aus 15-01 bleibt Sicherheitsnetz
+- [Phase ?]: [15-02]: remove() fängt zusätzlich P2025 ab (NotFoundException statt unbehandeltem 500) — Rule 2, für Concurrency-Anforderung aus must_haves
+- [Phase ?]: [15-02]: UserService.create ist die einzige Codestelle für D-11/D-12 — LdapService erbt die Regel ohne eigene Kopie (ldap.service.ts unverändert)
 
 ### Pending Todos
 
@@ -273,7 +277,7 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-08-04T13:14:07.663Z
-Stopped at: Completed 15-01-PLAN.md
+Last session: 2026-08-04T13:27:34.911Z
+Stopped at: Completed 15-02-PLAN.md
 Resume file: None
 Last activity: 2026-07-14 - Built LDAP per-user exclude/denylist filter (9d1323f), migration applied on live DB, verified via Playwright: sync deactivated 4 excluded service accounts (administrator/krbtgt/guest/dns-ldap), 2 real LDAP users stay active, 0 wrongly created