Claim and cancel could complete before reading valid JSON, causing Jetty to close the persistent connection before a subsequent status event. Consume the bounded body after authentication. A split-body HTTP regression fails before this change; full isolated UI-profile verification passes 66 tests and Checkstyle. Co-authored-by: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>