diff --git a/docs/tasks/lethe-oidc-stub.md b/docs/tasks/lethe-oidc-stub.md
index 4a467d8c788092b8b7dc6a37b3e2b3aecf36e879..73e7364142291c8d62a9f8c35181923fb1faa72e 100644
--- a/docs/tasks/lethe-oidc-stub.md
+++ b/docs/tasks/lethe-oidc-stub.md
@@ -255,3 +255,10 @@ - PH1                     -> IF1, IF2, IF3   @ internal/testutil/oidcstub/, internal/server/auth/middleware_test.go, internal/server/auth/oidctestserver_test.go
 - PH2                     -> IF4              @ internal/config/config.go, internal/config/config_test.go, config.example.yaml
 - PH3  IF1, IF2, IF3, IF4 ->                  @ internal/server/auth/devstub.go, internal/server/auth/devstub_test.go, cmd/lethe/main.go
 
+## Conclusion
+
+### Deviations from plan
+
+- PH1 — added `Stub.Issuer() string` getter beyond the planned `SetIssuer`. **Why:** `middleware_test.go` builds `config.OIDCConfig{Issuer: ...}` after `httptest.NewServer` returns, and needs to read the value back from the stub. Read-only; no mutable-state concern.
+- PH1 — local helper renamed from `newVerifier` (plan) to `newOIDCVerifier`. **Why:** symbol clarity in a test file that already has `newAuthenticator`, `newStub`; one verifier/authenticator name pair reads better. Test-file only.
+