Severity: HIGH (from external code review)
ObserverRegistry.notify() encodes template with token = &.{0} (observe.zig:245). drainNotifications sends this template unchanged to every observer with a TODO for per-observer token patching.
RFC 7641 requires notifications include the client's registration token. Without it, clients cannot associate notifications with their observation.
Fix: Encode per-observer notifications with correct token, or patch the template per-observer before sending.
Severity: HIGH (from external code review)
ObserverRegistry.notify()encodes template withtoken = &.{0}(observe.zig:245).drainNotificationssends this template unchanged to every observer with a TODO for per-observer token patching.RFC 7641 requires notifications include the client's registration token. Without it, clients cannot associate notifications with their observation.
Fix: Encode per-observer notifications with correct token, or patch the template per-observer before sending.