docs(06-12): complete surf/bouncer gap-closure plan

.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-12-SUMMARY.md

@@ -0,0 +1,28 @@
+---
+phase: 06-http-routing-auth-groups-and-rate-limiting
+plan: 12
+subsystem: surf, bouncer
+tags: [gap-closure, body-limit, rate-limit, jwt, fail-closed]
+requirements: [HTTP-04, HTTP-09, HTTP-05, HTTP-06]
+key-files:
+  modified: [surf/router.go, surf/limiter.go, bouncer/registry.go, bouncer/jwt.go, surf/bodylimit_test.go, surf/limiter_test.go, surf/cors_test.go, bouncer/registry_test.go, bouncer/jwt_test.go]
+metrics:
+  tasks: 3
+  completed: 2026-09-21
+---
+
+# Phase 6 Plan 12: surf/bouncer fail-closed gap closure Summary
+
+Body cap now bounds every named middleware (inside recovery), limiter definitions and body config fail boot instead of failing open, mux conflicts return errors, and bouncer rejects typed-nil guards and fractional JWT subjects.
+
+## Commits
+- a50e09b: router ordering, factory cache, body-config validation, mux conflict error
+- 4ad2ad2: fail-closed limiter definitions
+- 8a9449d: typed-nil guard and integer-only JWT subject
+
+## Deviations from Plan
+- [Rule 3] surf/cors_test.go TestCORSAssembleUsesConfig lacked body_limits keys; added them (stricter validation legitimately requires them).
+- Plan verification said fonoteka.go buckets must satisfy validation: `go test ./... -short` there is green.
+
+## Self-Check: PASSED
+go vet and go test ./... -race -short green in summercms.go; fonoteka.go tests green.