glm-5.3-flash
903a91f1d2
build_request inserts header params first, then default_headers, then credential headers — HeaderMap::insert replaces, so a declared in: header parameter whose name matched a default or credential header silently never delivered the peer's value upstream. check_header_param_collisions runs at import (the assembly's HttpServiceConfig is visible there): Authorization on an authed namespace is rejected outright, a default_headers name match (compared case-insensitively) fails import naming both keys, and an ApiKey header_name match fails naming the credential header. Per the task's decision note: the import-time surface does see the adapter's config, so the loud point stays at import rather than first-call warn-once. Tests: Authorization+Bearer, X-Tenant/x-tenant case-insensitive default_headers, x-api-key/X-API-Key, and the no-collision clean path.