docs(phase-03): evolve PROJECT.md after phase completion

.planning/PROJECT.md

@@ -27,6 +27,12 @@ Validated in Phase 2: API parity harness bootstrap
 - [x] Replay-and-diff against an arbitrary HTTP backend reports JSON-path and byte-offset mismatches; the normalizer fails the named parity classes (nil vs `[]`, Carbon `Z` vs `+00:00`, tri-state booleans, envelopes, money string vs number)
 - [x] App `go test ./parity` starts testcontainers Postgres; unported PHP routes stay pending and never count as a Go pass; `scripts/check-phase2.sh --fresh-php` is the sign-off gate
 
+Validated in Phase 3: First vertical slice — genres end to end
+
+- [x] GORM on Postgres through one shared pgx-stdlib `*sql.DB`; per-plugin gormigrate sets run up and down in `Requires` order with per-plugin history tables; AutoMigrate is not the schema source (River's LISTEN/NOTIFY pool remains a Phase 11 seam)
+- [x] Plugins register named middleware and `net/http` ServeMux route groups with typed integer params; JWT-guarded `GET /_fonoteka/api/v1/genres` returns seeded Genre rows from Postgres
+- [x] That genres route passes the Phase 2 PHP fixture replay: corpus 154 recorded, 1 passing, 153 pending (pending never counts as a Go pass); `scripts/check-phase3.sh` is the sign-off gate
+
 ### Active
 
 Framework kernel
@@ -38,14 +44,12 @@ Framework kernel
 
 Data layer
 
-- [ ] GORM models with Eloquent-like flows on Postgres; per-plugin gormigrate migration sets runnable up and down, with a "roll back this plugin's last migration and fix it" workflow
-- [ ] All 25 Płytarium models ported (Album, Artist, Collection, Genre, Style, AlbumRating, AlbumReservation, ApiToken, CollectionEditor, CollectionInvitation, CsvImport, CsvImportRow, Notification, OAuthAuthCode, OAuthClient, OAuthRefreshToken, OrgAiCredential, OrgDiscogsCredential, PendingInvitationRegistration, Settings, UserAiCredential, UserCollectionContext, UserDiscogsCredential, WishlistDigestQueue, WishlistSubscription) and its 27 migrations
+- [ ] Remaining Płytarium GORM models beyond the Genre and user-plugin tables needed for the first JWT route (Album, Artist, Collection, Style, AlbumRating, AlbumReservation, ApiToken, CollectionEditor, CollectionInvitation, CsvImport, CsvImportRow, Notification, OAuthAuthCode, OAuthClient, OAuthRefreshToken, OrgAiCredential, OrgDiscogsCredential, PendingInvitationRegistration, Settings, UserAiCredential, UserCollectionContext, UserDiscogsCredential, WishlistDigestQueue, WishlistSubscription) and the rest of the 27 migrations
 - [ ] Pagination, soft deletes, timestamps, relations (has-many, belongs-to, many-to-many) and JSON columns behave like the PHP originals for the API responses
 
 HTTP and auth
 
-- [ ] net/http ServeMux routing with middleware for auth, org context, locale and CORS; plugins register their routes
-- [ ] User plugin port: accounts, registration, login, password reset, JWT for the SPA, organizations and org-scoped permissions
+- [ ] User plugin port beyond the throwaway HS256 verifier: accounts, registration, login, password reset, JWT issuing for the SPA, organizations and org-scoped permissions
 - [ ] OAuth2/OIDC provider (zitadel/oidc) that the MCP server and the ChatGPT connector use with the same flows as today (auth code + PKCE, refresh tokens, client management, `IssueOAuthClient` command)
 - [ ] All 154 Płytarium API routes ported with byte-compatible request and response shapes (collections, albums, artists, genres, styles, ratings, reservations, wishlist, sharing and invitations, notifications, realtime channel auth, CSV import/export, locale, user context, credentials)
 
@@ -131,12 +135,12 @@ Quality
 | Reuse IDEA_LIB_NAMES module names as Go packages | Continuity with the Scala work and its docs | — Pending |
 | WASM extension API deferred | Plugin surface too wide to marshal until the compiled API settles | — Pending (seed) |
 | Themes and payments deferred to keios.eu port | Smallest Golem15 project with both a Twig theme and a payment flow | — Pending (seed) |
-| gormigrate over goose for migrations | Plain `[]*gormigrate.Migration` slices compose per plugin at boot and give `RollbackLast()`/`RollbackTo()` on a `*gorm.DB`; goose's provider/FS model fits worse (research STACK.md, 2026-09-16) | — Pending |
+| gormigrate over goose for migrations | Plain `[]*gormigrate.Migration` slices compose per plugin at boot and give `RollbackLast()`/`RollbackTo()` on a `*gorm.DB`; goose's provider/FS model fits worse (research STACK.md, 2026-09-16) | ✓ Good (Phase 3: user + fonoteka sets, isolated `migrate:rollback --plugin`) |
 | koanf + YAML config, goccy/go-yaml everywhere | No maintained Go HOCON parser; `gopkg.in/yaml.v3` upstream archived April 2025; one YAML library for config and admin schemas | — Pending |
 | swaggo/swag for OpenAPI, not Huma | Comment annotations on plain net/http handlers keep 154 ported routes byte-compatible; Huma would reshape every handler | — Pending |
-| GORM + River share one `*sql.DB` (pgx stdlib) with a separate pgx pool for LISTEN/NOTIFY | River's documented GORM integration; transactional enqueue inside GORM transactions | — Pending |
+| GORM + River share one `*sql.DB` (pgx stdlib) with a separate pgx pool for LISTEN/NOTIFY | River's documented GORM integration; transactional enqueue inside GORM transactions | ✓ Good for the shared `*sql.DB` seam (Phase 3); River listener pool still Phase 11 |
 | Parity harness is a day-one workstream | Fixture recording needs only the running PHP backend; it is the acceptance mechanism for every port phase | ✓ Good (Phase 2, 2026-09-17: 154/154 PHP self-replay, Nuxt/MCP fixtures, testcontainers Go runner) |
-| Framework and application in two repos from day one (`summercms.go`, `fonoteka.go`) | Retrofitting the split later is more disruptive; shared stack plugins can be extracted for keios.eu without touching the framework; the framework never imports an app | — Pending (chosen 2026-09-16) |
+| Framework and application in two repos from day one (`summercms.go`, `fonoteka.go`) | Retrofitting the split later is more disruptive; shared stack plugins can be extracted for keios.eu without touching the framework; the framework never imports an app | ✓ Good (Phase 3: fonoteka.go workspace, user + fonoteka plugins, app.Handler test seam) |
 
 ## Evolution
 
@@ -156,4 +160,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-09-17 after Phase 2 completion*
+*Last updated: 2026-09-17 after Phase 3 completion*