docs(architecture): dissolve OQ-09's self-referential deferral

- OQ-09 resolved closed-by-default (deny-unlisted), decided on risk
  asymmetry in hand, not on a first deployment the crate itself must
  create; named reopen condition instead of a parked wait
- delete oq-09-ops-visibility-tracker.md (watch-task for an event the
  crate itself gates — never collapses)
- fix doc-lifecycle circularity: externally-owned OQs no longer block
  a spec's `reviewed` promotion
- gc-and-namespaces: "until a consumer names a requirement" reframed
  as re-entry via a new ADR, not a parked question
- README: state the corollary explicitly — facts this crate must
  create (its own first deployment/consumer) are never deciding inputs

Verified: full-text sweep for stale OQ-09 deferral/tracker references
comes up clean across docs/ and tasks/.

docs/architecture/ops-surface.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-10-01
+last_updated: 2026-10-02
 ---
 
 # Ops surface (alkcall-backed network operations)
@@ -127,8 +127,9 @@ at op entry — this module never re-implements an authorization check
   `resource_id_path` selecting the payload's `namespace` field;
   actions map onto read/put/manage:
   - `blobs/fetch`, `blobs/stat`, `blobs/have` — the **read** action;
-    unlisted namespaces (no ACL entries) deny by default (closed
-    posture until OQ-09 decides a different default)
+    unlisted namespaces (no ACL entries) deny by default
+    (OQ-09's resolution; a grant per namespace is the deferred cost,
+    deliberately paid over accidental exposure)
   - `blobs/put` — the **write** action
   - `blobs/delete` — not namespace-gated at all; internal authority
     context only (alkcall ADR-017: internal switches context, never
@@ -152,9 +153,11 @@ true).
 
 ## Open Questions
 
-- **OQ-09**: default visibility of namespaces in network ops
-  (open-by-default vs closed-by-default) — deferred(scope), decided at
-  the first embedded ops deployment; ships closed-by-default meanwhile.
+None owned by this document. OQ-09 (default namespace visibility)
+resolved closed-by-default — recorded in
+[open-questions.md](open-questions.md) with its reopen condition (a
+named requirement for open-read-by-default, never mere existence of a
+deployment).
 
 ## References