docs(12-06): complete setup-route gap-closure plan (VAPID equality + DB name)

.planning/STATE.md

@@ -2,16 +2,16 @@
 gsd_state_version: 1.0
 milestone: v1.1
 milestone_name: Operability & Polish
-status: verifying
-stopped_at: Phase 12 Plan 04 Tasks 1-3 complete — paused at Task 4 human-verify checkpoint (Docker rebuild + fresh-DB e2e verification needed)
-last_updated: "2026-06-15T19:16:35.449Z"
-last_activity: 2026-06-15
+status: executing
+stopped_at: Completed 12-06-PLAN.md (UAT gaps 2+3 closed)
+last_updated: "2026-06-16T01:15:09.647Z"
+last_activity: 2026-06-16
 progress:
   total_phases: 24
-  completed_phases: 11
-  total_plans: 40
-  completed_plans: 40
-  percent: 46
+  completed_phases: 10
+  total_plans: 43
+  completed_plans: 41
+  percent: 42
 ---
 
 # Project State
@@ -26,9 +26,9 @@ See: .planning/PROJECT.md (updated 2026-06-10)
 ## Current Position
 
 Phase: 12 (initial-setup-wizard) — EXECUTING
-Plan: 4 of 4
-Status: Phase complete — ready for verification
-Last activity: 2026-06-15
+Plan: 2 of 7
+Status: Ready to execute
+Last activity: 2026-06-16
 
 ### ✅ Resolved Checkpoint — Phase 15 Plan 15-03 Task 2 (human-action)
 
@@ -114,6 +114,7 @@ _Updated after each plan completion_
 | Phase 12 P01 | 8 | 4 tasks | 10 files |
 | Phase 12 P02 | 15 | 3 tasks | 6 files |
 | Phase 12 P03 | 8 | 1 tasks | 2 files |
+| Phase 12 P06 | 8 | 2 tasks tasks | 3 files files |
 
 ## Accumulated Context
 
@@ -196,6 +197,8 @@ Recent decisions affecting current work:
 - [Phase ?]: D-NULL-FALLBACK: occurrence.reminderLeadMinutes===null mapped to None; occurrence cannot distinguish absolute/multi-VALARM from no-reminder; rely on server-side preserve (absent payload)
 - [Phase ?]: D-05/18-03: three all-day broker sites now route through getHouseholdTimezone(db)
 - [Phase ?]: D-12-03-EMAIL-GREP (2026-06-15, 12-03): claims.email in deriveDisplayName is display-name only; claim branch has zero email refs; D-10 upheld
+- [Phase 12-06]: D-12-06-VAPID-EQ: validate/vapid compares submitted PUBLIC key (app_config.vapid_public_key) to process.env.VAPID_PUBLIC_KEY; mismatched/absent 400s. Private key stays env-only, never compared/returned (T-12-06).
+- [Phase 12-06]: D-12-06-DBNAME: GET /api/setup/status returns non-secret dbName from process.env.DB_NAME only; no DB_HOST/DB_USER/DB_PASSWORD in any response.
 
 ### Roadmap Evolution
 
@@ -264,8 +267,8 @@ Recent decisions affecting current work:
 
 ## Session Continuity
 
-Last session: 2026-06-15T19:16:35.431Z
-Stopped at: Phase 12 Plan 04 Tasks 1-3 complete — paused at Task 4 human-verify checkpoint (Docker rebuild + fresh-DB e2e verification needed)
+Last session: 2026-06-16T01:15:09.630Z
+Stopped at: Completed 12-06-PLAN.md (UAT gaps 2+3 closed)
 Resume file: None
 
 ## Operator Next Steps