summercms/.planning/phases/08-oauth2-1-authorization-server/deferred-items.md

Phase 08 Deferred Items

Out-of-scope discoveries logged during plan execution, per the executor's scope-boundary rule (fix only what the current task's changes directly caused).

08-03: pre-existing full-schema rollback test failures (not caused by this plan)

Found during: 08-03 Task 2 full-suite verification (go test ./... in fonoteka.go).

Failing tests: TestRemainingMigrationsUpDown (parity/remaining_models_test.go), TestRollbackIsolatesFonotekaFullSchema (parity/rollback_isolation_full_test.go).

Symptom: both tests assert the last fonoteka migration is create_fonoteka_settings (a Phase 5 migration) and/or that a full up/down/up cycle leaves no tables behind. Since 08-02 added 202609230019_oauth_schema_correction.go (the corrective OAuth nullability/index migration, 08-02-SUMMARY.md), that migration is now the last one in the registered slice, so the hardcoded "last migration" name assertion is stale, and rollback of the corrected schema leaves golem15_fonoteka_settings behind.

Scope: neither test file, nor plugins/golem15/fonoteka/updates/, nor any model file is in 08-03's files_modified list; this plan (authorize) touches wristband/authorize.go, wristband/server.go (Options extension), plugin.go, and routes.go only. Confirmed pre-existing via git log on the failing test files: both were last touched by Phase 5 (6c9695f), and 08-02's migration-correction commit (4536b3e) is what shifted the "last migration" identity without updating these two tests.

Disposition: deferred to whichever later Phase 8 plan owns migration/ schema test maintenance (or the phase-closing unit-test plan). Not fixed here per the executor's scope-boundary rule.

08-03: pre-existing flaky test in an unrelated package (summercms.go)

Found during: 08-03 Task 2 full-suite verification (go test ./... in summercms.go).

Failing test: TestFetchTooLargeIsStreaming (fetchguard/fetch_test.go), intermittently fails with "server wrote 71680 bytes, client appears to have buffered unbounded body" under go test ./... but passes reliably when run in isolation (go test ./fetchguard -run TestFetchTooLargeIsStreaming -count=3). fetchguard is untouched by this plan. Not fixed here.