docs(01-01): clear Task 3 checkpoint, mark plan complete

Stack verified live (/health green, 4 tables pushed). Record Docker deviation in
SUMMARY, mark 01-01 complete in ROADMAP, clean up paused-setup handoff files.

.planning/phases/01-foundation-broker-spike/01-01-SUMMARY.md

@@ -96,7 +96,7 @@ completed: "2026-06-04"
 
 # Phase 01 Plan 01: Walking Skeleton — Summary
 
-**pnpm monorepo with Hono API, Drizzle/MariaDB schema (4 tables), Docker Compose stack, and /health route with real DB round-trip — Tasks 1-2 complete; stopped at checkpoint Task 3 (drizzle-kit push requires running Docker stack)**
+**pnpm monorepo with Hono API, Drizzle/MariaDB schema (4 tables), Docker Compose stack, and /health route with real DB round-trip — ALL 3 tasks complete. Task 3 checkpoint cleared by orchestrator: stack brought up, `drizzle-kit push` applied the 4 tables to live MariaDB, and `/health` returned `{"ok":true,"db":"up"}` end-to-end. Required fixing 3 Docker build defects (see Deviations).**
 
 ## Performance
 
@@ -163,10 +163,21 @@ None — plan executed exactly as specified. One minor pnpm API difference (allo
 - **Verification:** Both health tests pass; no hoisting warnings
 - **Committed in:** `96cda58` (Task 2 feat commit)
 
+**3. [Checkpoint clearing - Blocking] Docker image build broken for pnpm workspace**
+- **Found during:** Task 3 (orchestrator bringing up the stack to clear the checkpoint)
+- **Issue:** The original `apps/api/Dockerfile` built from a `./apps/api` context and could not work in a pnpm workspace:
+  1. `COPY package.json pnpm-lock.yaml* ./` + `pnpm install --frozen-lockfile` failed (`ERR_PNPM_NO_LOCKFILE`) — the lockfile lives at the repo root, not in `apps/api/`.
+  2. pnpm 11 refused to run `esbuild`'s build script (`ERR_PNPM_IGNORED_BUILDS`) because the root `pnpm-workspace.yaml` (which carries `allowBuilds.esbuild`) was outside the build context. Neither package.json `pnpm.onlyBuiltDependencies` nor `.npmrc dangerously-allow-all-builds` resolved it in the isolated context.
+  3. `dev` stage ran `node --watch dist/index.js` but never compiled `src`→`dist`; production stage had invalid Dockerfile syntax (`COPY apps/pwa/dist/ ./public/ 2>/dev/null || true`) referencing a path outside its context.
+- **Fix:** Switched to the correct monorepo pattern — build from the **repo-root context** (`docker-compose.yml` `build.context: .`, `dockerfile: apps/api/Dockerfile`), copy the root `pnpm-workspace.yaml` + `pnpm-lock.yaml` + both workspace `package.json`s, and `pnpm install --frozen-lockfile --filter @familysync/api...`. Reordered stages so `production` is the default; `dev` now reuses the builder output; dropped the invalid PWA COPY. Updated `docker-compose.dev.yml` volume mount to `./apps/api/src:/app/apps/api/src`.
+- **Files modified:** apps/api/Dockerfile, docker-compose.yml, docker-compose.dev.yml
+- **Verification:** `docker compose up -d --build` succeeds; `drizzle-kit push` applied 4 tables; `curl /health` → `{"ok":true,"db":"up"}`; `pnpm test` → 2 passed / 21 todo.
+- **Committed in:** `fix(01-01): build Docker image from repo-root pnpm workspace context`
+
 ---
 
-**Total deviations:** 2 auto-fixed (1 blocking, 1 bug)
-**Impact on plan:** Both fixes necessary for install/tests to work. No scope creep.
+**Total deviations:** 3 (2 auto-fixed during execution, 1 Docker-build fix while clearing the Task 3 checkpoint)
+**Impact on plan:** All fixes necessary for install/tests/stack to work. No scope creep — same walking-skeleton capability, corrected build topology.
 
 ## Issues Encountered
 
@@ -195,9 +206,9 @@ No new threat surface beyond what was planned in the threat model:
 
 ## Next Phase Readiness
 
-- Task 3 checkpoint must be cleared first (drizzle-kit push + Docker stack verification)
-- After Task 3: Plan 02 (OIDC auth) can proceed — imports `db`, `users` schema
-- Plan 03 (broker) depends on Plan 02 identity layer + this schema
+- Task 3 checkpoint CLEARED — schema pushed, stack verified, `/health` green
+- Plan 02 (OIDC auth) can proceed — imports `db`, `users` schema
+- Plan 03 (broker) depends on this schema + crypto pattern
 
 ## Self-Check: PASSED