docs(06-10): update plan tracking

.planning/STATE.md

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Completed 06-09-PLAN.md
-last_updated: "2026-09-20T19:08:04.262Z"
+stopped_at: Completed 06-10-PLAN.md
+last_updated: "2026-09-20T22:28:10.242Z"
 last_activity: 2026-09-20
 progress:
   total_phases: 15
   completed_phases: 5
   total_plans: 34
-  completed_plans: 32
+  completed_plans: 33
   percent: 33
 ---
 
@@ -26,11 +26,11 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 06 (http-routing-auth-groups-and-rate-limiting) — EXECUTING
-Plan: 4 of 11
+Plan: 5 of 11
 Status: Ready to execute
 Last activity: 2026-09-20
 
-Progress: [█████████░] 94%
+Progress: [██████████] 97%
 
 ## Performance Metrics
 
@@ -78,6 +78,7 @@ Progress: [█████████░] 94%
 | Phase 06 P07 | 12 min | 1 tasks | 4 files |
 | Phase 06 P08 | 1h 20m | 1 tasks | 3 files |
 | Phase 06 P09 | 4 min | 1 tasks | 2 files |
+| Phase 06 P10 | 3h 15m | 1 tasks | 2 files |
 
 ## Accumulated Context
 
@@ -184,6 +185,8 @@ Recent decisions affecting current work:
 - [Phase 06]: Use one unexported bufferedResponse for house and raw recovery — A shared transactional writer keeps panic-before-write and panic-after-write behavior identical while preserving raw versus house fallback bodies.
 - [Phase 06]: Keep bufferedResponse Flush as a no-op — Recovery must never unwrap, hijack, flush, or otherwise expose the destination writer before handler success.
 - [Phase 06]: Success commit replaces only route-owned header keys — Unrelated headers already placed on the destination by outer wrappers such as path-scoped CORS must survive.
+- [Phase 06]: Use wire.WriteJSON for both InvScope denial branches — The shared writer is the established PHP-compatible no-newline serialization path.
+- [Phase 06]: Assert exact denial bytes before JSON shape checks — Whitespace normalization would hide response-contract regressions.
 
 ### Pending Todos
 
@@ -205,6 +208,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-20T19:07:03.593Z
-Stopped at: Completed 06-09-PLAN.md
+Last session: 2026-09-20T22:27:07.576Z
+Stopped at: Completed 06-10-PLAN.md
 Resume file: None