ROADMAP: mark M10.1-M10.5 (P0) shipped

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

ROADMAP.md

@@ -541,11 +541,11 @@ D9 / D10 / D11                   (resolved through M9 sub-tasks above)
 
 ### M10 P0 — Blockers (must-have for any paying customer)
 
-- [ ] **M10.1 — Audit / Activity auto-writers.** `plugin-audit` registers `sys_audit_log` but never writes; `sys_activity` and `sys_comment` likewise empty after CRUD. Subscribe to ObjectQL `data:*` events from `EventBus` and emit immutable audit rows + human-readable activity entries with field-level diffs. Anchor: [packages/plugins/plugin-audit/src/audit-plugin.ts](packages/plugins/plugin-audit/src/audit-plugin.ts).
-- [ ] **M10.2 — User invite + default roles.** No `/api/v1/admin/users/invite` endpoint exists. Wrap better-auth `organization.inviteMember` as a first-class REST route. Seed three default roles into `sys_role` (`admin`, `sales_manager`, `sales_rep`). Anchor: [packages/plugins/plugin-auth/](packages/plugins/plugin-auth/).
-- [ ] **M10.3 — Attachments.** No `sys_attachment` object, no upload component. Register the schema in `packages/spec/src/system/`, wire it to `service-storage`, add an `AttachmentList` view widget. P0 because every CRM contract/quote/PDF is currently un-storable.
-- [ ] **M10.4 — Validation envelope + Zod-at-rest.** Currently a malformed POST returns raw SQL text. Wrap REST handlers with a structured error envelope (`{code,message,fields[]}`) and run the canonical Zod schema inside ObjectQL `insert/update` before touching the driver. Anchors: [packages/rest/src/rest-server.ts](packages/rest/src/rest-server.ts), [packages/objectql/](packages/objectql/).
-- [ ] **M10.5 — Global search.** Header already shows `⌘K` but it is inert. Add `GET /api/v1/search?q=` (driver-side `LIKE` across registered searchable fields; FTS later) and wire the Studio command palette to it.
+- [x] **M10.1 — Audit / Activity auto-writers.** `plugin-audit` registers `sys_audit_log` but never writes; `sys_activity` and `sys_comment` likewise empty after CRUD. Subscribe to ObjectQL `data:*` events from `EventBus` and emit immutable audit rows + human-readable activity entries with field-level diffs. Anchor: [packages/plugins/plugin-audit/src/audit-plugin.ts](packages/plugins/plugin-audit/src/audit-plugin.ts).
+- [x] **M10.2 — User invite + default roles.** No `/api/v1/admin/users/invite` endpoint exists. Wrap better-auth `organization.inviteMember` as a first-class REST route. Seed three default roles into `sys_role` (`admin`, `sales_manager`, `sales_rep`). Anchor: [packages/plugins/plugin-auth/](packages/plugins/plugin-auth/).
+- [x] **M10.3 — Attachments.** No `sys_attachment` object, no upload component. Register the schema in `packages/spec/src/system/`, wire it to `service-storage`, add an `AttachmentList` view widget. P0 because every CRM contract/quote/PDF is currently un-storable.
+- [x] **M10.4 — Validation envelope + Zod-at-rest.** Currently a malformed POST returns raw SQL text. Wrap REST handlers with a structured error envelope (`{code,message,fields[]}`) and run the canonical Zod schema inside ObjectQL `insert/update` before touching the driver. Anchors: [packages/rest/src/rest-server.ts](packages/rest/src/rest-server.ts), [packages/objectql/](packages/objectql/).
+- [x] **M10.5 — Global search.** Header already shows `⌘K` but it is inert. Add `GET /api/v1/search?q=` (driver-side `LIKE` across registered searchable fields; FTS later) and wire the Studio command palette to it.
 
 ### M10 P1 — Critical (80%+ of customers need these)