Remediate the 2026-09-03 feature-test findings

shopdb/config.py

@@ -38,7 +38,26 @@ class Config:
         # Pin the client connection to utf8mb4 so reads/writes match the
         # utf8mb4 schema regardless of the server default charset. TestingConfig
         # (SQLite) replaces this whole dict, so the charset arg never reaches it.
-        'connect_args': {'charset': 'utf8mb4'},
+        #
+        # STRICT_TRANS_TABLES is the other half, and it is a correctness
+        # setting rather than a preference. Without it MySQL accepts a write it
+        # cannot store and adjusts it: a 257-character username becomes the
+        # first 100 characters, a malformed date becomes '0000-00-00', an
+        # over-long asset number is cut at 50 and then collides with a
+        # different one. Every one of those was found in the product answering
+        # 200 or 201, because nothing in the stack knew the value had changed.
+        #
+        # Set on the CONNECTION rather than left to the server, so a site whose
+        # my.cnf says otherwise still gets it - the sql_mode seen on the 5.6
+        # dev server was NO_ENGINE_SUBSTITUTION alone. NO_ENGINE_SUBSTITUTION is
+        # kept alongside it, since dropping it would change how a CREATE TABLE
+        # naming an unavailable engine behaves.
+        'connect_args': {
+            'charset': 'utf8mb4',
+            'init_command':
+                "SET SESSION sql_mode='STRICT_TRANS_TABLES,"
+                "NO_ENGINE_SUBSTITUTION'",
+        },
     }
 
     JWT_SECRET_KEY = os.environ.get('JWT_SECRET_KEY', 'jwt-secret-key-change-in-production')