| Surface | Runtime contract | Compatibility / tradeoff | Plugin-managed production behavior |
| ----- | ----- | ----- | ----- |
| `JWTStrategy(allow_inmemory_denylist=True)` | `JWTStrategy.revocation_posture` | `JWTStrategy` requires an explicit `denylist_store`, or `allow_inmemory_denylist=True` for single-process in-memory revocation. | Plugin-managed production has no separate JWT revocation compatibility flag; startup warns when a strategy is explicitly wired to process-local in-memory revocation. |
| `user_manager_security.totp_secret_keyring` / `totp_secret_key` | `BaseUserManager.totp_secret_storage_posture` | `BaseUserManager.totp_secret_storage_posture` is the Fernet-encrypted at-rest contract; omitting both `totp_secret_keyring` and `totp_secret_key` means non-null persisted TOTP secrets cannot be stored or read. Pending-enrollment secrets are plaintext only under explicit `unsafe_testing=True`. | With `totp_config` enabled, plugin-managed production requires `user_manager_security.totp_secret_keyring` or the one-key `totp_secret_key` shortcut unless `unsafe_testing=True` or a custom `user_manager_factory` explicitly owns that wiring. `totp_enrollment_store` is also required unless `unsafe_testing=True`. |
