Bound authentication response recognition

docs/roadmap/implementation.md

@@ -224,6 +224,10 @@ limit plus one, missing/inaccurate lengths, malformed bounded bodies, closure,
 401 without reading, cancellation, and redacted explicit overflow. Keep this
 fix independent of the later protocol relocation.
 
+Completion: authentication recognition reads at most 1 MiB plus one byte and
+reports a distinct overflow reason without asserting credential rejection.
+Focused authentication and public smoke tests pass on Go 1.27.3.
+
 ## Stage 8: Correct Artifact Result Ownership
 
 **Catalog:** 4. **Files:** public ArtifactReader GoDoc, adapter and ownership tests.