Record upstream filings: the five bugs are now core issues #596-#600

Filed at the maintainer's request. The four seam proposals remain
unfiled; REPORT.md stays the draft.

Author: melvincarvalho

NEXT.md

@@ -140,4 +140,7 @@ empirically in NOTES: **route-owning → plugin, pipeline-modifying → core**.
 
 - The repo exists and is public; keep pushing to it.
 - Core PRs #590 / #591 are unmerged — the maintainer's call.
-- Whether to ever file the seam issues upstream — ask first.
+- **The five bugs are FILED** (core issues #596–#600, 2026-07-11, at the
+  maintainer's request). The four *seam* proposals (authorize, events,
+  reservePath, serverInfo) are still unfiled — ask before filing;
+  REPORT.md is the draft.

REPORT.md

@@ -7,9 +7,9 @@ repo; nothing is speculative. Detail lives in [NOTES.md](./NOTES.md)
 (findings), [ISSUES.md](./ISSUES.md) (per-issue disposition), and each
 plugin's `README.md ## Findings`.
 
-**Nothing has been filed upstream from this work** (per your rule); each
-proposal below is drafted so it *could* be filed nearly verbatim if you
-want it.
+**The five bugs below are now filed upstream** (#596–#600, 2026-07-11, at
+the maintainer's request). The four *seams* remain unfiled; each is
+drafted so it could be filed nearly verbatim if wanted.
 
 ## Executive summary
 
@@ -209,6 +209,13 @@ probe-port-then-boot dance for the same reason.
 
 ## Five loader/core bugs worth fixing regardless
 
+All five filed 2026-07-11: [#596](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/issues/596)
+(id derivation), [#597](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/issues/597)
+(dotted-prefix WS), [#598](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/issues/598)
+(`logger: false` vs onResponse), [#599](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/issues/599)
+(error wrap drops `err.code`), [#600](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/issues/600)
+(non-atomic conditional write).
+
 1. **Generic-basename id derivation.** Every plugin follows
    `<name>/plugin.js`, so every derived id is `plugin` and the (correct)
    duplicate-id guard refuses to boot until each entry carries an explicit