Document mcr migration in PROGRESS.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

PROGRESS.md

@@ -128,8 +128,32 @@ Behavioral change: invalid duration env overrides are now silently ignored
 
 Result: all tests pass, builds clean. Net -129 lines.
 
+### Phase 11b: mcr Migration (2026-03-25)
+
+MCR migrated db, auth, and config to mcdsl. Exercises the full stack.
+
+| Changed | How |
+|---------|-----|
+| `internal/db/db.go` Open | Delegates to `mcdsl/db.Open` |
+| `internal/db/migrate.go` | SQL strings → `mcdsl/db.Migration`, delegate to `mcdsl/db.Migrate` |
+| `internal/db/migrate.go` SchemaVersion | Delegates to `mcdsl/db.SchemaVersion` |
+| `internal/auth/` | Thin shim wrapping `mcdsl/auth.Authenticator`; keeps `Claims` type with `AccountType` for policy engine compatibility |
+| `internal/auth/cache.go` | Deleted (caching handled by mcdsl/auth) |
+| `internal/config/config.go` | Embeds `mcdsl/config.Base`; Storage and Web remain MCR-specific; uses `mcdsl/config.Load[T]` + Validator |
+
+Auth shim approach: MCR's policy engine depends on `Claims.AccountType`
+which mcdsl's `TokenInfo` doesn't carry. Rather than changing every
+consumer, `internal/auth` wraps `mcdsl/auth.Authenticator` and adapts
+results to the MCR `Claims` type. All server/grpcserver/webserver code
+is unchanged.
+
+Behavioral changes:
+- WriteTimeout now defaults to 30s (was 0/disabled)
+- Auth cache expiry test removed (caching tested in mcdsl)
+
+Result: all tests pass, builds clean. Net -464 lines.
+
 ## Next Steps
 
-- Phase 11b: mcr migration
 - Phase 11c: metacrypt migration
 - Phase 11d: mcias migration