docs(06-01): complete guard registry and dual-group genres plan

.planning/STATE.md

@@ -4,13 +4,13 @@ milestone: v1.0
 milestone_name: milestone
 status: executing
 stopped_at: Phase 6 context gathered
-last_updated: "2026-09-19T15:16:57.658Z"
-last_activity: 2026-09-19 -- Phase 06 planning complete
+last_updated: "2026-09-19T17:23:58.639Z"
+last_activity: 2026-09-19
 progress:
   total_phases: 15
   completed_phases: 5
   total_plans: 28
-  completed_plans: 23
+  completed_plans: 24
   percent: 33
 ---
 
@@ -21,16 +21,16 @@ progress:
 See: .planning/PROJECT.md (updated 2026-09-16)
 
 **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
-**Current focus:** Phase 6 — http routing, auth groups and rate limiting
+**Current focus:** Phase 06 — http-routing-auth-groups-and-rate-limiting
 
 ## Current Position
 
-Phase: 6
-Plan: Not started
+Phase: 06 (http-routing-auth-groups-and-rate-limiting) — EXECUTING
+Plan: 2 of 5
 Status: Ready to execute
-Last activity: 2026-09-19 -- Phase 06 planning complete
+Last activity: 2026-09-19
 
-Progress: [██████████] 100%
+Progress: [█████████░] 86%
 
 ## Performance Metrics
 
@@ -70,6 +70,7 @@ Progress: [██████████] 100%
 | Phase 05 P04 | 18 min | 3 tasks | 18 files |
 | Phase 05 P05 | 18 min | 3 tasks | 18 files |
 | Phase 05 P06 | 23 min | 3 tasks | 12 files |
+| Phase 06 P01 | 25 min | 3 tasks | 26 files |
 
 ## Accumulated Context
 
@@ -150,6 +151,11 @@ Recent decisions affecting current work:
 - [Phase 05]: Hidden-marshal registry walk lives in fonoteka.go/classes because summercms.go must not import the app — CLAUDE.md two-repo rule; plan allowed the parity/classes fallback
 - [Phase 05]: Credential fuzz excludes owner FKs from the working allow-list, matching D-05 two-layer even without a write-service file — Fillable() includes user_id/organisation_id; acceptance requires the owner FK never change
 - [Phase 05]: classes TestMain is the real-Postgres harness; parity activateAppPlugins/parityDB cannot be imported from package main — Same ICU pl-PL migrate-both-plugins shape without crossing the app/framework test boundary
+- [Phase 06]: Parameterized middleware is a surf factory (strings.Cut on first ':'), not a fixed name table (D-05)
+- [Phase 06]: TokenGuard implements CredentialGuard only; InvScope owns PHP TokenScope 401/403 bodies (D-08)
+- [Phase 06]: NewJWTGuard reuses bearerToken/Verify/write401 so Registry.Middleware(jwt) is byte-identical to bouncer.Middleware (D-10)
+- [Phase 06]: oauth is not registered this plan; only jwt and inv_token (D-09)
+- [Phase 06]: Personal-token genres fixture body matches isolated seedGenres; CORS * deferred to D-18
 
 ### Pending Todos
 
@@ -171,6 +177,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-19T12:04:36.542Z
+Last session: 2026-09-19T17:19:44.685Z
 Stopped at: Phase 6 context gathered
-Resume file: .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-CONTEXT.md
+Resume file: None