docs(code-reviews): close Driver.Mqtt-006/-007 and Driver.Mqtt.Transport-002

Records the disposition and rationale for each: the primary-host gate is no
longer disposed (matching MqttConnection's documented rule), a reconnect that
resolves zero filters for live topics now throws like the zero-granted case it
is indistinguishable from, and a password configured without a username is
warned about rather than silently dropped. Both module headers drop to 0 open.

code-reviews/Driver.Mqtt.Transport/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-08-10 |
 | Commit reviewed | `b990adae` |
 | Status | Reviewed |
-| Open findings | 1 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -110,7 +110,7 @@ existing assertion depends on the branch being silent (713 tests green).
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/MqttClientOptionsFactory.cs:97-100` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Credentials are attached only when `Username` is non-empty:
 `if (!string.IsNullOrEmpty(options.Username)) builder.WithCredentials(options.Username, options.Password ?? "")`.
@@ -129,4 +129,15 @@ credential is visible; optionally send password-only credentials under `V500`, w
 permits it. Do **not** log the password itself — nothing on this path formats it today, and the
 options record's `PrintMembers` override exists to keep it that way.
 
-**Resolution:** _(open)_
+**Resolution (2026-08-10):** Fixed `5d4dd17d` — the recommendation's first half only. A password
+configured with a blank username now logs a warning saying the connection is being made
+**anonymously** and naming the two ways to make that intentional; the credential is still not sent,
+and the secret is never formatted into the message. The optional half (a password-only CONNECT
+under `V500`) was deliberately **not** taken: 3.1.1 forbids it, so it cannot be the uniform
+behaviour of a factory that serves both versions, and adding it under `V500` alone would change the
+wire behaviour of deployments that connect happily today — the same "the explicit config stays
+authoritative, say so rather than second-guess it" line Driver.Mqtt.Transport-001 settled on.
+TDD: the warning assertion failed RED (`log.CountContaining("password") should be 1 but was 0`)
+before the change. Paired with a falsifying control — a config carrying **neither** credential must
+stay silent, or the fix would warn on every ordinary anonymous deployment and the first test would
+still pass. Suite green (734).