docs(08-02): complete persistence and registration plan

.planning/STATE.md

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Completed 08-01-PLAN.md
-last_updated: "2026-09-23T17:18:26.201Z"
+stopped_at: Completed 08-02-PLAN.md
+last_updated: "2026-09-23T17:54:25.008Z"
 last_activity: 2026-09-23
 progress:
   total_phases: 15
   completed_phases: 7
   total_plans: 55
-  completed_plans: 46
+  completed_plans: 47
   percent: 47
 ---
 
@@ -26,11 +26,11 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 08 (oauth2-1-authorization-server) — EXECUTING
-Plan: 2 of 10
+Plan: 3 of 10
 Status: Ready to execute
 Last activity: 2026-09-23
 
-Progress: [████████░░] 84%
+Progress: [█████████░] 85%
 
 ## Performance Metrics
 
@@ -92,6 +92,7 @@ Progress: [████████░░] 84%
 | Phase 07-user-plugin-and-authentication P07 | 3h 15m | 3 tasks | 28 files |
 | Phase 07-user-plugin-and-authentication P08 | 25min | 3 tasks | 6 files |
 | Phase 08 P01 | 25min | 2 tasks | 6 files |
+| Phase 08 P02 | 30min | 3 tasks | 14 files |
 
 ## Accumulated Context
 
@@ -211,6 +212,12 @@ Recent decisions affecting current work:
 - [Phase 08]: wristband.Options exposes only the four PHP-configurable metadata fields (service_documentation path, scopes_supported, token_endpoint_auth_methods_supported, authorization_response_iss_parameter_supported); response_types/grant_types/code_challenge_methods stay fixed protocol constants per D-06
 - [Phase 08]: Plugin.Boot always constructs wristband.Server even with an empty app.url rather than failing loud, to avoid breaking the many existing fonoteka tests that boot without app.url configured; production must set app.url
 - [Phase 08]: D-10 (oauth guard retirement) is recorded via TestOAuthMetadataRouteIsolation rather than editing Phase 6 historical docs, per 08-PATTERNS.md guidance to prefer a supersession note
+- [Phase ?]: [Phase 08 P02]: Corrective migration named 21_oauth_schema_correction.go (not 12_): Go init()-order/gormigrate slice position determines RollbackLast() target, not the migration's numeric ID, so the file must sort after 20_remaining.go
+- [Phase ?]: [Phase 08 P02]: Schema-correction rollback refuses (changes nothing) rather than deleting/coercing rows when any row depends on a nullable lifecycle column
+- [Phase ?]: [Phase 08 P02]: wristband.Tx ships the full ClientStore/AuthCodeStore/RefreshTokenStore/AccessTokenIssuer surface now so 08-03/08-04 reuse the same transaction seam without another interface change; expiry-sweep methods are deferred to 08-06
+- [Phase ?]: [Phase 08 P02]: Register strips C0/DEL control characters from client_name at DCR capture time (PHP only strips at ConnectedApp/Consent display time) per 08-CONTEXT.md discretion
+- [Phase ?]: [Phase 08 P02]: OAuth config keys live under golem15.fonoteka.oauth.* (bare plugin ID, matching compass.MergePlugin), not plugins.golem15.fonoteka.oauth.*
+- [Phase ?]: [Phase 08 P02]: AUTH-05/AUTH-06/AUTH-07 remain Pending in REQUIREMENTS.md: this plan ships DCR only, not the full authorize/token/consent surface
 
 ### Pending Todos
 
@@ -232,6 +239,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-23T17:18:26.184Z
-Stopped at: Completed 08-01-PLAN.md
+Last session: 2026-09-23T17:54:24.991Z
+Stopped at: Completed 08-02-PLAN.md
 Resume file: None