An audit against the specification, and the breaking change it forced.
- Every error code fold mints has changed, because the protocol reserved the range they were in.
- The gateway can keep its own streams alive.
- A routing header the caller sent stopped at the gateway.
- The protocol-era transition is now instrumented and written down rather than assumed.
- A retry that answered an upstream's question arrived looking like a first attempt.
- A client had to be refused before it could learn which scopes it needed.
- Every federated list went out with an invalid cache scope.
- Policy and tenant selectors match on OAuth scopes, and a scope denial says what would fix it.
- A caller could tell an upstream what protocol version, client identity, and capabilities it was talking to.
- EMA advertised an authorization server that answered 404.
- Nothing bounded what an upstream could return.