docs(06-02): complete fixed-window limiter and five-bucket plan

.planning/STATE.md

@@ -4,13 +4,13 @@ milestone: v1.0
 milestone_name: milestone
 status: executing
 stopped_at: Phase 6 context gathered
-last_updated: "2026-09-19T17:23:58.639Z"
+last_updated: "2026-09-19T17:46:28.583Z"
 last_activity: 2026-09-19
 progress:
   total_phases: 15
   completed_phases: 5
   total_plans: 28
-  completed_plans: 24
+  completed_plans: 26
   percent: 33
 ---
 
@@ -26,11 +26,11 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 06 (http-routing-auth-groups-and-rate-limiting) — EXECUTING
-Plan: 2 of 5
+Plan: 3 of 5
 Status: Ready to execute
 Last activity: 2026-09-19
 
-Progress: [█████████░] 86%
+Progress: [█████████░] 93%
 
 ## Performance Metrics
 
@@ -71,6 +71,7 @@ Progress: [█████████░] 86%
 | Phase 05 P05 | 18 min | 3 tasks | 18 files |
 | Phase 05 P06 | 23 min | 3 tasks | 12 files |
 | Phase 06 P01 | 25 min | 3 tasks | 26 files |
+| Phase 06 P02 | 14 min | 3 tasks | 16 files |
 
 ## Accumulated Context
 
@@ -156,6 +157,11 @@ Recent decisions affecting current work:
 - [Phase 06]: NewJWTGuard reuses bearerToken/Verify/write401 so Registry.Middleware(jwt) is byte-identical to bouncer.Middleware (D-10)
 - [Phase 06]: oauth is not registered this plan; only jwt and inv_token (D-09)
 - [Phase 06]: Personal-token genres fixture body matches isolated seedGenres; CORS * deferred to D-18
+- [Phase 06]: Concrete limiter is FixedWindowLimiter; surf.Limiter interface remains the unused Phase 3 seam — D-03 D-05 naming collision with pre-existing Limiter interface
+- [Phase 06]: Trusted-proxy list is a NewFixedWindowLimiter constructor argument, never a setter — Named-bucket Key closures and inline N,M must share one trusted list
+- [Phase 06]: fonoteka-* buckets live on the app plugin via surf.BucketProvider, not hardcoded in surf — summercms.go must stay Płytarium-agnostic
+- [Phase 06]: Empty PHP group builders plus test-only boot-probe routes prove middleware strings resolve without 501 shells — D-15: no 501 shells; wrap() only sees routes
+- [Phase 06]: php_parity.sh pins APP_DEBUG=false; three existing HTML exception fixtures need re-recording — T-06-09 production-shaped error bodies
 
 ### Pending Todos
 
@@ -177,6 +183,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-19T17:19:44.685Z
+Last session: 2026-09-19T17:45:48.542Z
 Stopped at: Phase 6 context gathered
 Resume file: None