[mirkobrombin]

Stabilize browser and embedded-host adoption: preserve literal event-shaped text, complete cancellable HTTP requests, pin scaffolds to the installed CLI and align embedded compression/cache/StreamBus behavior. Include CRUD, deployment/migration guides and stock-example CI checks.

Browser StreamBus now supports explicit cookie authentication through a same-origin HTTP bootstrap and single-use first-frame credential. Bound origin, expiry, retained headers and handshake time; recheck authentication at consumption and require a resume authorizer. Legacy consumers keep the original guard unless they opt in. Keep ordered bounded sends outside DOM callbacks and preserve setup-error WebSocket fallback. Refuse typed calls cancelled or expired before admission, including cancellation while waiting for session reset.

Full native tests, native/WASM builds, relevant vets, full browser hostclient tests and 16 focused contracts across Chromium/Firefox/WebKit pass. Native HTTP3 covers restored identity, credential reuse and unknown-credential refusal. Two real authenticated users complete typed-action input/authorization checks, writes and transport loss/resumption in C/F desktop/mobile with WebSocket disabled, plus WebKit desktop fallback. Those five candidate cases pass; WebKit mobile crashes during initial navigation, also observed before these changes. The published no-replace consumer subsequently passes all six cases with zero page errors; earlier WebKit mobile crashes remain recorded. CI initially rejected synthetic cookie attributes; a test-only follow-up declares Secure/HttpOnly/SameSite, and its exact-head CI passes, including native/WASM/iOS tests, both lints and scans; Release skipped. Active-session revocation, complete identity-transition/replay policy, overload, public deployment and stable release approval remain open. Three action-context contracts pass in all engines; parent and entry-only negative controls expose the missing checks. Six actual desktop transport cases preserve server state after a pre-cancelled command and keep subsequent calls working. The exact published no-replace consumer passes all six cancellation cases with zero page errors; exact-head CI passes, including native/WASM/iOS tests, both lints and scans; Release skipped.