Three inline findings from the session review of ADR-072/ADR-073:
- fix(auth): Basic door parsing no longer requires UTF-8 — the decoded
password bytes pass through to resolve_from_token byte-faithfully, so
RFC 7617 legacy ISO-8859-1 credentials resolve instead of parsing to
None. ADR-073 already specced raw-bytes passthrough ("decoded and fed
as the AuthToken raw bytes"); the String::from_utf8 round-trip
contradicted it.
- test: pin the with_ws_max_sessions fix against the shape it fixed —
a builder call after with_ws_max_sessions (the pre-router_state()
builder silently reverted the cap).
- test: pin that ownership wiring survives a later HttpAdapter builder
rebuild at the HTTP surface.
Verified: cargo test (451), --all-features (530), clippy --all-targets
-D warnings, fmt --check, fuzz corpus replay 21/21, cargo doc.
glm-5.3-flash
dfa0216186