chore(deps): prune unused deps, tighten tokio features, align tungstenite (HY-01, HY-05, HY-07, HY-08, HY-12)

- HY-01: openapiv3 -> dev-dependencies (test-only usage)
- HY-05: drop bytes (src sites renamed to axum::body::Bytes re-export),
  keep parking_lot (genuinely used); tokio "full" -> the seven features
  actually used (macros, rt-multi-thread, io-util, net, fs, time, sync)
- HY-08: test-support extends wss; dev tokio-tungstenite matches the
  wss feature set
- HY-12: tokio-tungstenite 0.28 -> 0.29 to match axum's tungstenite;
  duplicate roots in cargo tree -d: 9 -> 6 (tungstenite, cpufeatures,
  rand dupes collapsed)
- HY-07 ride-along: READ_SLOTS privatized
- CON-10 residue: verified already fixed (full_surface required-features)

Verified: cargo test (300), --all-features (371+36), --features mcp
(355+9), --features wss (316), check --no-default-features, clippy
(all-targets and --all-features, -D warnings), fmt --check

tasks/infra/review-001-dependency-hygiene.md

@@ -1,7 +1,7 @@
 ---
 id: review-001-dependency-hygiene
 name: Dependency and feature hygiene (HY-01, HY-05, HY-08, HY-12, CON-10)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: trivial
@@ -41,11 +41,11 @@ tasks), HY-11 (`docs/` in the package — needs a publishing decision).
 
 ## Acceptance Criteria
 
-- [ ] `openapiv3` in dev-dependencies only
-- [ ] `cargo tree -d` duplicate roots reduced (getrandom/cpufeatures collapse)
-- [ ] Unused deps pruned; tokio features tightened (build passes in default, `mcp`-only, `wss`, `--all-features`, `--no-default-features`)
-- [ ] HY-07 resolved (privatized or documented)
-- [ ] Full feature matrix still green: default, `--all-features`, `mcp`-only, `wss`-only, `--no-default-features`
+- [x] `openapiv3` in dev-dependencies only
+- [x] `cargo tree -d` duplicate roots reduced (getrandom/cpufeatures collapse)
+- [x] Unused deps pruned; tokio features tightened (build passes in default, `mcp`-only, `wss`, `--all-features`, `--no-default-features`)
+- [x] HY-07 resolved (privatized or documented)
+- [x] Full feature matrix still green: default, `--all-features`, `mcp`-only, `wss`-only, `--no-default-features`
 
 ## References
 
@@ -53,9 +53,77 @@ tasks), HY-11 (`docs/` in the package — needs a publishing decision).
 
 ## Notes
 
-> Agent fills during implementation. Safe to land any time; keep it
-> separate from behavioral tasks so reverts are clean.
+> HY-05 nuance: `bytes` turned out to be load-bearing in src/ — five
+> `bytes::Bytes` sites (byte_adapter.rs, server/adapter.rs,
+> adapters/forward.rs) had been relying on the declared dependency
+> (axum's re-export satisfies the same items, so the mechanical fix was
+> to rename to `axum::body::Bytes`, which axum re-exports from bytes —
+> no behavior change). `parking_lot` is genuinely used (server/adapter.rs,
+> websocket/upgrade.rs `Mutex`) — kept.
+>
+> HY-12: aligning tokio-tungstenite to 0.29 (matching axum's
+> tungstenite 0.29) collapsed `tungstenite` 0.28/0.29, `cpufeatures`
+> 0.2/0.3, and `rand` 0.9/0.10 duplicate roots. `cargo tree -d`
+> root count went from 9 to 6 (getrandom 0.3/0.4 and hashbrown
+> 0.16/0.17 remain — both are required by unrelated crates: getrandom
+> 0.4 via alkcall/uuid/retry-policies, 0.3 via jsonschema/ahash;
+> hashbrown 0.17 via indexmap/h2, 0.16 via referencing). `syn` 2/3
+> also remains (thiserror 2 vs rmcp 1.8). `cargo update` was run;
+> `retry-policies` pinned to 0.5.1 (`--precise`) because its 0.5.2
+> bump pulled `rand` 0.10 back in (via getrandom-only rand_core 0.10).
+>
+> HY-08: `test-support` feature now extends `wss` (declared via
+> `["wss"]` equivalent — both activate the same optional
+> tokio-tungstenite dep); the wss-feature feature set already matched
+> the dev-deps set (`connect` + handshake-capable, default-features off),
+> so the dev-dependency declaration was aligned to that exact set.
+>
+> CON-10 residue: already fixed before this task landed —
+> `[[test]] full_surface` has `required-features = ["mcp",
+> "test-support"]`; verified by `cargo test --features mcp` passing.
+>
+> HY-07: `READ_SLOTS` privatized (`pub const` → `const`) in
+> src/websocket/byte_adapter.rs; it is internal plumbing (inbound
+> backpressure slot count), not part of the public API. No external
+> references existed (verified by grep over src/, tests/, docs/).
 
 ## Summary
 
-> Filled on completion.
+> Completed as specified. Changes:
+>
+> - HY-01: `openapiv3` moved from `[dependencies]` to
+>   `[dev-dependencies]` (both use sites are test-only: to_openapi.rs
+>   unit test, tests/full_surface.rs).
+> - HY-05: `bytes` removed after renaming the five `bytes::Bytes` sites
+>   to `axum::body::Bytes` (axum's re-export of the same type; no
+>   behavior change). `parking_lot` kept — genuinely used. tokio
+>   `features = ["full"]` tightened to
+>   `["macros", "rt-multi-thread", "io-util", "net", "fs", "time",
+>   "sync"]`, derived from actual usage (`tokio::test` → macros+rt,
+>   io/ duplex/split → io-util, TcpListener/TcpStream → net, tokio::fs →
+>   fs, time/sleep/timeout/interval → time, mpsc/oneshot/watch/Semaphore →
+>   sync; `select!`/`pin!`/`join!` are core, `process`/`signal` were
+>   pure slack from `full`).
+> - HY-08: `test-support` extends `wss`; dev-deps
+>   tokio-tungstenite pinned to the same feature set as the wss feature.
+> - HY-12: tokio-tungstenite/tungstenite 0.28 → 0.29 aligned with the
+>   version axum 0.8's `ws` feature uses. Duplicate roots: 9 → 6
+>   (tungstenite 0.28/0.29, tokio-tungstenite 0.28/0.29, cpufeatures
+>   0.2/0.3, rand 0.9/0.10 collapsed; remaining: getrandom 0.3/0.4,
+>   hashbrown 0.16/0.17, syn 2/3 — all required by distinct unrelated
+>   crates, not alignable from this crate).
+> - HY-07: `READ_SLOTS` privatized.
+> - CON-10: verified already fixed (`required-features = ["mcp",
+>   "test-support"]` on `full_surface`).
+>
+> Verification matrix (all green):
+>
+> - `cargo test` — 300 passed
+> - `cargo test --all-features` — 371 + 9 + 6 + 8 + 13 passed
+> - `cargo test --features mcp` — 355 + 9 passed
+> - `cargo test --features wss` — 316 passed
+> - `cargo check --no-default-features` — compiles
+> - `cargo clippy --all-targets -- -D warnings` — clean
+> - `cargo clippy --all-features --all-targets -- -D warnings` — clean
+> - `cargo fmt --check` — clean
+> - `cargo tree -d` — duplicate roots 9 → 6