feat: close the R-006/R-007 spikes from the authoritative real-client runs (D-026)

[nzneit]

Closes the last two open v1 requirements, R-006 (WS-fidelity) and R-007 (capture the browser application's connect()), from the authoritative runs of the real browser application against offbook. Recorded as D-026. v1 lands at 40 of 40 tested.

The result

Go, on the broker's defaults, unchanged: MQTT 3.1.1 (protocol level 4) over ws, no auth, QoS 0/1 only (no QoS 2), keepalive 30 with a persistent session (clean: false), first-offered subprotocol echo sufficed. The ws listener config that build-plan §5 held provisional (subprotocol/path/auth) is final as-is — zero listener changes came back from the spike.

Sanitization

The deployment's ws URL, path, and clientId pattern are private and stay unpublished. This costs nothing technically: the listener never routes on path (it upgrades every request and records pathname purely as a fingerprint fact), so the real path needs no repo accommodation. The capture at fixtures/connect/real-client.json (demo-app.md §6 shape, §9 step-4 destination) nulls those fields and lists them under redacted; fields not recorded during the runs are nulled under notCaptured — a null never poses as a measurement. R-007's "broker ws port default" artifact is deliberately narrowed: the public default stays 9001, the real target being a local brokerWsPort override.

The pin

src/broker/connect-profile.test.ts (tagged to both requirements) derives its client options from the fixture at runtime and holds both sides: the fixture's internal consistency (redacted/not-captured stay null, no auth, no QoS 2) and the broker's live acceptance of the measured profile — connect at level 4 with no auth on a non-root stand-in path, a persistent session at keepalive 30, SUBACK, retained receipt, QoS 0/1 round-trips both ways, and the fingerprint's server-side view matching.

Honest bookkeeping

• Retained receipt is owner-affirmed via application behavior, not log-transcribed: the fingerprint surface records connects/subscribes/publishes, never deliveries to the client, so there is no server-side line to quote. D-026 says so.
• The D-006 DUP clause is narrowed, not discharged: the broker in the loop was offbook itself on Aedes' in-memory persistence, which cannot redeliver, so the spike could not exercise DUP. The clause now rests solely on D-006's persistence obligation; the tripwire stays.
• D-021 obligation (1) is unblocked: the aedes 1.x bump's precondition (spikes measured on 0.51.x defaults) is met. The bump remains its own future branch/PR/decision with an R-033 rehearsal re-run (D-024's probe already de-risked it).

Gates

check-docs (40 requirements, 26 decisions), lint, typecheck, demo-app:build and full bun test all exit 0.