docs(06-08): update plan tracking

- Advance phase progress to 8 of 11 plans
- Record transition-address security decisions and execution metrics
- Mark HTTP-07 complete in requirements tracking

.planning/STATE.md

@@ -3,15 +3,15 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Completed 06-07-PLAN.md
-last_updated: "2026-09-20T15:11:34.217Z"
+stopped_at: Completed 06-08-PLAN.md
+last_updated: "2026-09-20T18:59:52.988Z"
 last_activity: 2026-09-20
 progress:
   total_phases: 15
   completed_phases: 5
   total_plans: 34
-  completed_plans: 30
-  percent: 88
+  completed_plans: 31
+  percent: 91
 ---
 
 # Project State
@@ -26,17 +26,17 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 06 (http-routing-auth-groups-and-rate-limiting) — EXECUTING
-Plan: 2 of 11
+Plan: 3 of 11
 Status: Ready to execute
 Last activity: 2026-09-20
 
-Progress: [█████████░] 88%
+Progress: [█████████░] 91%
 
 ## Performance Metrics
 
 **Velocity:**
 
-- Total plans completed: 30
+- Total plans completed: 31
 - Average duration: 21 min
 - Total execution time: 104 min
 
@@ -76,6 +76,7 @@ Progress: [█████████░] 88%
 | Phase 06 P05 | 13 min | 3 tasks | 13 files |
 | Phase 06 P06 | 1h 29m | 2 tasks | 3 files |
 | Phase 06 P07 | 12 min | 1 tasks | 4 files |
+| Phase 06 P08 | 1h 20m | 1 tasks | 3 files |
 
 ## Accumulated Context
 
@@ -177,6 +178,8 @@ Recent decisions affecting current work:
 - [Phase 06]: Place throttle:fonoteka-api-token before inv.scope:read in the personal-token middleware declaration. — Missing and invalid credentials must consume the 60/minute per-IP deny-path budget before InvScope returns its PHP-compatible 401 response.
 - [Phase 06]: Replace the split limiter store protocol with one atomic Attempt operation. — Expiry, threshold comparison, admitted increment, and retry duration must share one mutex critical section so concurrent callers cannot bypass Max.
 - [Phase 06]: Use one inline:domainless namespace plus trusted-proxy ClientIP for every anonymous inline throttle. — Host and inline throttle text must not let anonymous callers rotate rate-limit buckets; authenticated requests retain u:<principal id> isolation.
+- [Phase 06]: isReservedOrPrivate owns Addr.Unmap and recursively applies the ordinary IPv4 table to supported transition embeddings — Direct helper callers and the production dial hook must share one normalization and private/reserved policy.
+- [Phase 06]: A 64:ff9b:1::/48 address with a non-zero RFC 6052 u octet fails closed — Malformed local-use NAT64 must not fall through as apparently public native IPv6.
 
 ### Pending Todos
 
@@ -198,6 +201,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-20T15:11:34.184Z
-Stopped at: Completed 06-07-PLAN.md
+Last session: 2026-09-20T18:59:30.178Z
+Stopped at: Completed 06-08-PLAN.md
 Resume file: None