docs(roadmap): plan DTO-first binding and PATCH semantics - #25

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agentWork/milestones/phase-2-3-compound-serialization.md:
- Around line 47-49: Clarify the “no JPA initialization” boundary in the
serialization scope: explicitly state whether relationship/property access may
trigger lazy loading and database queries, or require an access-safe,
already-loaded graph. Update the “JPA initialization” and related ORM exclusions
so the permitted behavior is unambiguous.

In @.agentWork/milestones/phase-2-5-json-schema-cross-check.md:
- Line 50: Update the Phase 2.1 acceptance criterion to hyphenate
“usage-specific” before “draft schema,” leaving the rest of the criterion
unchanged.

In @.agentWork/milestones/phase-2-6-jackson2-document-writer.md:
- Line 37: Correct the package wildcard in the Jackson 2 production-import
statement from the invalid double-dot form to the valid single-asterisk form,
preserving the existing reference to the com.fasterxml.jackson package and
dependency context.
- Around line 14-16: In
.agentWork/milestones/phase-2-6-jackson2-document-writer.md lines 14-16 and
46-52, define the exact maintained Jackson 2 compatibility version/range and the
Gradle compatibility task, then use those named terms consistently in Phase 2.6.
In .agentWork/milestones/phase-2-7-jackson2-document-reader.md lines 44-46,
reference the same baseline and task rather than introducing separate
compatibility wording.

In @.agentWork/milestones/phase-3-2-spring-webmvc.md:
- Around line 70-74: Resolve the contradictory Sonar-token acceptance criteria
by choosing one shared CI policy and applying it consistently: either skip Sonar
analysis and mark the quality gate not applicable when SONAR_TOKEN is absent, or
fail validation until the token is available. Update the Sonar validation
sections in .agentWork/milestones/phase-3-2-spring-webmvc.md (lines 70-74),
.agentWork/milestones/phase-3-3-spring-webmvc-dto-binding.md (lines 81-85),
.agentWork/milestones/phase-4-1-conformance-and-hardening.md (lines 33-36), and
.agentWork/milestones/phase-4-2-stable-release.md (lines 32-34) to state the
same policy.

In @.agentWork/milestones/phase-3-3-spring-webmvc-dto-binding.md:
- Line 4: Add Phase 2.9 to the Dependencies list in the phase-3-3 milestone
document, preserving the existing dependency entries and ordering so the
milestone requires the Jackson 3 flat DTO reader before scheduling.

In @.agentWork/milestones/phase-4-1-conformance-and-hardening.md:
- Around line 29-30: Update the security-sensitive defaults criterion in the
milestone document to separate Jackson-major coverage from WebMVC coverage,
reflecting ADR-007: require testing across both Jackson majors independently,
and require WebMVC-specific testing only for its supported Jackson 3
integration.

In `@README.md`:
- Around line 5-9: Expand the root README to include a package/module registry
covering jsonapi-java-spring-webflux as a separately scoped future module, with
explicit status for every entry. Add the required usage guidance or explicit
no-entry-point statement, non-goals, and agent notes, while preserving the
existing JSON:API scope and compliance disclaimer.

---

Nitpick comments:
In @.agentWork/milestones/phase-2-5-json-schema-cross-check.md:
- Line 17: Update the dependency entry in the phase-2-5 schema cross-check
documentation to record the exact tested com.networknt:json-schema-validator
version instead of the broad 3.x range. Confirm that its transitive dependencies
remain test-scoped and regenerate the dependency-verification metadata for the
pinned version.