docs(08-03): complete authorize plan

.planning/phases/08-oauth2-1-authorization-server/deferred-items.md

@@ -0,0 +1,43 @@
+# Phase 08 Deferred Items
+
+Out-of-scope discoveries logged during plan execution, per the executor's
+scope-boundary rule (fix only what the current task's changes directly
+caused).
+
+## 08-03: pre-existing full-schema rollback test failures (not caused by this plan)
+
+**Found during:** 08-03 Task 2 full-suite verification (`go test ./...` in `fonoteka.go`).
+
+**Failing tests:** `TestRemainingMigrationsUpDown` (`parity/remaining_models_test.go`),
+`TestRollbackIsolatesFonotekaFullSchema` (`parity/rollback_isolation_full_test.go`).
+
+**Symptom:** both tests assert the *last* fonoteka migration is
+`create_fonoteka_settings` (a Phase 5 migration) and/or that a full
+up/down/up cycle leaves no tables behind. Since 08-02 added
+`202609230019_oauth_schema_correction.go` (the corrective OAuth
+nullability/index migration, 08-02-SUMMARY.md), that migration is now the
+last one in the registered slice, so the hardcoded "last migration" name
+assertion is stale, and rollback of the corrected schema leaves
+`golem15_fonoteka_settings` behind.
+
+**Scope:** neither test file, nor `plugins/golem15/fonoteka/updates/`, nor
+any model file is in 08-03's `files_modified` list; this plan (authorize)
+touches `wristband/authorize.go`, `wristband/server.go` (Options
+extension), `plugin.go`, and `routes.go` only. Confirmed pre-existing via
+`git log` on the failing test files: both were last touched by Phase 5
+(`6c9695f`), and 08-02's migration-correction commit (`4536b3e`) is what
+shifted the "last migration" identity without updating these two tests.
+
+**Disposition:** deferred to whichever later Phase 8 plan owns migration/
+schema test maintenance (or the phase-closing unit-test plan). Not fixed
+here per the executor's scope-boundary rule.
+
+## 08-03: pre-existing flaky test in an unrelated package (summercms.go)
+
+**Found during:** 08-03 Task 2 full-suite verification (`go test ./...` in `summercms.go`).
+
+**Failing test:** `TestFetchTooLargeIsStreaming` (`fetchguard/fetch_test.go`),
+intermittently fails with "server wrote 71680 bytes, client appears to have
+buffered unbounded body" under `go test ./...` but passes reliably when run
+in isolation (`go test ./fetchguard -run TestFetchTooLargeIsStreaming
+-count=3`). `fetchguard` is untouched by this plan. Not fixed here.