docs(07-06): complete the unit coverage plan

The validation contract is signed off and the phase plan count is 6/6. Requirement checkboxes stay open while the user-api routes are still pending.

Co-authored-by: Cursor <cursoragent@cursor.com>

.planning/STATE.md

@@ -2,16 +2,16 @@
 gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
-status: executing
-stopped_at: Completed 07-05-PLAN.md
-last_updated: "2026-09-22T16:43:55.719Z"
+status: verifying
+stopped_at: Completed 07-06-PLAN.md
+last_updated: "2026-09-22T17:21:05.500Z"
 last_activity: 2026-09-22
 progress:
   total_phases: 15
-  completed_phases: 6
+  completed_phases: 7
   total_plans: 43
-  completed_plans: 42
-  percent: 40
+  completed_plans: 43
+  percent: 47
 ---
 
 # Project State
@@ -27,10 +27,10 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 
 Phase: 07 (user-plugin-and-authentication) — EXECUTING
 Plan: 6 of 6
-Status: Ready to execute
+Status: Phase complete — ready for verification
 Last activity: 2026-09-22
 
-Progress: [██████████] 98%
+Progress: [██████████] 100%
 
 ## Performance Metrics
 
@@ -86,6 +86,7 @@ Progress: [██████████] 98%
 | Phase 07 P03 | 95m | 3 tasks | 28 files |
 | Phase 07 P04 | 75m | 3 tasks | 16 files |
 | Phase 07 P05 | 45 | 3 tasks | 45 files |
+| Phase 07 P06 | 40 min | 3 tasks | 8 files |
 
 ## Accumulated Context
 
@@ -197,6 +198,7 @@ Recent decisions affecting current work:
 - [Phase 06]: Retain all four earlier accepted risks unchanged; T-06-23 through T-06-27 are mitigated, not accepted or deferred. — Both repositories' authoritative race and vet gates passed, and each new threat has concrete source and named regression evidence.
 - [Phase 06]: Anonymous inline limiter identity is documented only as inline:domainless|<ClientIP>, excluding policy text and request or forwarded Host inputs. — The production resolver and three executed regressions prove Host rotation and inline-parameter changes cannot create fresh anonymous budgets while authenticated principals keep isolated u:<id> keys.
 - [Phase 07]: Blacklist storage expiry follows PHP jwt-auth (later of exp and iat+refreshTTL, plus one minute). — Using the raw access exp would drop a logged-out token that is still inside the refresh window.
+- [Phase 07]: user_throttle and jwt_blacklist are allowed schema diffs — The frozen PHP snapshot predates the user plugin. jwt_blacklist is Go-only because PHP logout does not blacklist.
 
 ### Pending Todos
 
@@ -218,6 +220,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-22T16:43:55.704Z
-Stopped at: Completed 07-05-PLAN.md
+Last session: 2026-09-22T17:21:05.484Z
+Stopped at: Completed 07-06-PLAN.md
 Resume file: None