docs(02-02): record plan progress in STATE and ROADMAP

Co-authored-by: Cursor <cursoragent@cursor.com>

.planning/REQUIREMENTS.md

@@ -116,9 +116,9 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
 
 ### Quality and cutover (QA)
 
-- [ ] **QA-01**: A fixture recorder captures requests and responses from the running PHP backend for every route plus the Nuxt app's and MCP server's real flows
-- [ ] **QA-02**: A replay-and-diff harness runs fixtures against the Go backend with a normalizer for nondeterministic fields and assertions for the parity classes (nil vs [], date formats, tri-state booleans, envelopes, conditional keys)
-- [ ] **QA-03**: go vet and go test ./... are green at every commit; each phase ends with a unit-test plan; integration tests use testcontainers Postgres
+- [x] **QA-01**: A fixture recorder captures requests and responses from the running PHP backend for every route plus the Nuxt app's and MCP server's real flows
+- [x] **QA-02**: A replay-and-diff harness runs fixtures against the Go backend with a normalizer for nondeterministic fields and assertions for the parity classes (nil vs [], date formats, tri-state booleans, envelopes, conditional keys)
+- [x] **QA-03**: go vet and go test ./... are green at every commit; each phase ends with a unit-test plan; integration tests use testcontainers Postgres
 - [ ] **QA-04**: The first vertical slice (GET /_fonoteka/api/v1/genres) passes the parity diff end to end before further kernel abstraction
 - [ ] **QA-05**: Cutover: the parity harness is green on all 154 routes and vue-fonoteka-app and fonoteka-mcp run unchanged against the Go backend
 
@@ -225,9 +225,9 @@ Which phases cover which requirements. Updated during roadmap creation.
 | ADMIN-04 | Phase 9 | Pending |
 | ADMIN-05 | Phase 9 | Pending |
 | ADMIN-06 | Phase 10 | Pending |
-| QA-01 | Phase 2 | Pending |
-| QA-02 | Phase 2 | Pending |
-| QA-03 | Phase 2 | Pending |
+| QA-01 | Phase 2 | Complete |
+| QA-02 | Phase 2 | Complete |
+| QA-03 | Phase 2 | Complete |
 | QA-04 | Phase 3 | Pending |
 | QA-05 | Phase 15 | Pending |
 

.planning/ROADMAP.md

@@ -88,7 +88,7 @@ Plans:
 
 **Wave 2** *(blocked on Wave 1 completion)*
 
-- [ ] 02-02-PLAN.md — Capture safe proxy sessions and manifest routes with strict diffs
+- [x] 02-02-PLAN.md — Capture safe proxy sessions and manifest routes with strict diffs
 
 **Wave 3** *(blocked on Wave 2 completion)*
 
@@ -329,7 +329,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | Phase | Plans Complete | Status | Completed |
 |-------|----------------|--------|-----------|
 | 1. Framework kernel foundation | 4/4 | Complete   | 2026-09-16 |
-| 2. API parity harness bootstrap | 1/5 | In Progress|  |
+| 2. API parity harness bootstrap | 2/5 | In Progress|  |
 | 3. First vertical slice — genres end to end | 0/TBD | Not started | - |
 | 4. CLI scaffolding, i18n and mail | 0/TBD | Not started | - |
 | 5. Data layer full fidelity | 0/TBD | Not started | - |

.planning/STATE.md

@@ -3,15 +3,15 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Completed 02-01-PLAN.md
-last_updated: "2026-09-17T10:22:53.392Z"
+stopped_at: Completed 02-02-PLAN.md
+last_updated: "2026-09-17T10:37:43.767Z"
 last_activity: 2026-09-17
 progress:
   total_phases: 15
   completed_phases: 1
   total_plans: 9
-  completed_plans: 5
-  percent: 56
+  completed_plans: 6
+  percent: 67
 ---
 
 # Project State
@@ -26,30 +26,30 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 02 (api-parity-harness-bootstrap) — EXECUTING
-Plan: 2 of 5
+Plan: 3 of 5
 Status: Ready to execute
 Last activity: 2026-09-17
 
-Progress: [██████░░░░] 56%
+Progress: [███████░░░] 67%
 
 ## Performance Metrics
 
 **Velocity:**
 
-- Total plans completed: 5
-- Average duration: 7 min
-- Total execution time: 7 min
+- Total plans completed: 6
+- Average duration: 10 min
+- Total execution time: 19 min
 
 **By Phase:**
 
 | Phase | Plans | Total | Avg/Plan |
 |-------|-------|-------|----------|
 | 01 | 4 | - | - |
-| 02 | 1 | 7 min | 7 min |
+| 02 | 2 | 19 min | 10 min |
 
 **Recent Trend:**
 
-- Last 5 plans: 02-01 7 min
+- Last 5 plans: 02-01 7 min, 02-02 12 min
 - Trend: -
 
 *Updated after each plan completion*
@@ -71,6 +71,10 @@ Recent decisions affecting current work:
 - [Phase 02]: tide is the framework-owned parity library and does not import Fonoteka — Phase 2 CONTEXT.md discretion; summercms.go must stay app-agnostic
 - [Phase 02]: goccy/go-yaml v1.19.2 decodes fixtures with DisallowUnknownField; SaveFlow uses a dedicated encoder so nested literal bodies keep indent — goccy BytesMarshaler re-emitted |- scalars without nested indent; decode still uses the verified library
 - [Phase 02]: JSON diffs ignore object key order and fail missing keys or token-type changes at $.path; non-JSON compares bytes at offset — D-13: structural JSON compare with UseNumber, exact bytes for non-JSON
+- [Phase 02]: Proxy bind and upstream must be loopback HTTP; incoming Host/URL never selects the origin — T-02-01: pin PHP upstream, ignore client destination, cap bodies
+- [Phase 02]: Capture rules and a private 0600 --vars store drive {{name}} substitution; unclassified credential shapes fail fixture writes — D-07 D-11 and T-02-02: never commit live JWT, inv_ tokens, OAuth codes or PKCE verifiers
+- [Phase 02]: Carbon *_at values must match +00:00 before masking; Z, string ids, null vs [] and missing keys fail at $.path — D-13 D-15: assert shape before mask so parity classes stay visible
+- [Phase 02]: 154 is the app manifest validated route count, not a framework constant; --next-batch above 15 is refused — D-16 and the 15-route resume workflow; keep tide generic
 
 ### Pending Todos
 
@@ -92,6 +96,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-17T10:22:35.430Z
-Stopped at: Completed 02-01-PLAN.md
+Last session: 2026-09-17T10:37:30.156Z
+Stopped at: Completed 02-02-PLAN.md
 Resume file: None