feat(review 008 Unit 3c): the gate-2 e2e harness; 0.8.0 release bookkeeping

- src/channels/gate2_tests.rs (ADR-051 gates 6/7, review 008 gate 2):
  the full consumer -> hub (HubLegTemplate) -> spoke relay e2e —
  the open resolves with the hub-allocated channel_id, `bound`
  survives the relay, data flows both directions with a fake 8-byte
  chunk header riding verbatim (the hub never parses the data plane,
  ADR-034/035), spoke-side close cascades to clean reclaim on both
  legs; hub-side disconnect (the consumer's duplex end dropped via a
  killable transport proxy) tears down both legs with the ledger
  decremented; the mid-establishment window (ADR-051 §6) pinned with
  its two reclaim signals — the consumer leg reclaims at its own
  transport EOF, the spoke channel (allocated before the establisher
  replied) is the honest residual, reclaimed when the spoke-leg
  transport ends; the channels/tty/sub standard-shape companion pins
  no derivation regression.
- src/channels/relay.rs: the relay's adopted producer-leg channel
  entry now reclaims when the relayed pump completes (teardown after
  pump_bidi) — the consumer-leg wrapper's teardown cannot see the
  producer leg's manager; the RelayPlan carries the spoke id for the
  reclaim.
- Release bookkeeping: 0.7.1 -> 0.8.0, the CHANGELOG entry covering
  Units 1-3 (Establishment reply projection, open_channel_with_reply,
  flavor-form discovery derivation, ChannelRelay, HubLegTemplate,
  gate-2 harness); review 008 Status -> Resolved with the U-1/U-2
  commit refs and the 955->945 errata note; ADR-051 Status ->
  all units landed + the §6 mid-establishment residual expanded to
  the two-reclaim-signal shape the gate pins; the stale "0.7.2"
  version mentions in ADR-047/049 corrected to 0.8.0 (the units land
  unreleased).

Verification: cargo test 669 passed / 0 failed; clippy --all-targets
-- -D warnings clean; fmt --check clean; cargo doc --no-deps clean;
cargo check + clippy on wasm32-unknown-unknown clean;
cargo publish --dry-run --allow-dirty passed.

docs/architecture/decisions/047-openable-alpns-are-operations.md

@@ -86,7 +86,7 @@ pinned by test). The `op_name_is_standard_channel_open_shape` helper
 and the strip-last derivation are two-way-door implementation details
 within the one-way wire shape.
 
-Implemented surface (alkcall 0.7.2): the generalized
+Implemented surface (alkcall 0.8.0): the generalized
 `derive_alpn_from_op_name` (strip-last), the explicit-field emission
 (`spec_to_json_pub` + the advertised schema property), and the
 preference order in `rebuild_spec_for`. Verification gates landed as

docs/architecture/decisions/049-channel-open-establishment-phase.md

@@ -468,7 +468,7 @@ unknown fields by the envelope's own parse posture); the field set an
 op may contribute is the producing crate's schema concern, not a
 protocol vocabulary. No data-plane change.
 
-Implemented surface (alkcall 0.7.2): `Establishment::with_reply_field`
+Implemented surface (alkcall 0.8.0): `Establishment::with_reply_field`
 / `with_reply_fields` / `reply_fields`, the wrapper's
 reservation check (`RESERVED_REPLY_KEY` = `channel_id`) +
 `merge_reply_fields`, `ChannelClient::open_channel_with_reply`.

docs/architecture/decisions/051-channel-relay-and-hub-leg.md

@@ -5,14 +5,15 @@
 Accepted (2026-09-17) — amends ADR-042 (the relay contract's
 implementation home moves into alkcall; the translate-not-forward
 contract is unchanged). Sequenced after review 008 remediation Units 1
-and 2 (both landed, alkcall 0.7.2): the relay's establisher projects
+and 2 (both landed, alkcall 0.8.0): the relay's establisher projects
 the spoke reply's extra fields via `Establishment` reply fields
 (ADR-049 amendment 3), and the spoke's flavor-form open ops arrive
 reconstructed WITH the `channel_open` marker through discovery
-(ADR-047 amendment 3). Unit 3a (the `ChannelRelay` component, §1–§4,
-§6) and Unit 3b (the hub-leg install template, §5) are implemented —
-`src/channels/relay.rs` and `src/channels/hub_leg.rs`; Unit 3c (the
-review's gate-2 e2e harness) remains.
+(ADR-047 amendment 3). All three implementation units are landed:
+Unit 3a (the `ChannelRelay` component, §1–§4, §6) in
+`src/channels/relay.rs`, Unit 3b (the hub-leg install template, §5) in
+`src/channels/hub_leg.rs`, and Unit 3c (the review's gate-2 e2e
+harness, gates 6/7) in `src/channels/gate2_tests.rs` — alkcall 0.8.0.
 
 ## Context
 
@@ -201,11 +202,18 @@ relays. The end consumer never authenticates to the spoke directly.
   bounds each hop, not the chain. No fix — noted for capacity
   planning.
 - **Mid-establishment consumer disconnect** — the one teardown window
-  with a delay: the spoke channel can exist briefly after the consumer
-  leg dies. Not a leak: once the wrapper spawns the pump, hub-leg
-  `clear_all` (transport EOF) EOFs the consumer recv, the pump exits,
-  the spoke leg EOFs, and both wrappers decrement their ledgers. The
-  e2e gate asserts this window explicitly.
+  with a delay, with two reclaim signals pinned by the Unit 3c gate
+  (`gate2_mid_establishment_disconnect_reclaims_without_leak`): (a)
+  the consumer leg's just-allocated channel reclaims at the leg's own
+  transport EOF (`clear_all` + ledger decrement) — the hub has not
+  adopted, so the producer leg stays clean; (b) the spoke's channel —
+  the spoke allocates before its establisher replies — is the honest
+  residual: it cannot be reclaimed by the hub (no adoption exists),
+  so it lingers until a spoke-side teardown signal (the spoke↔hub leg
+  ending, or the spoke's own establishment bound). The gate bounds
+  the window deterministically by severing the spoke leg and asserts
+  the spoke-side reclaim + ledger decrement. A channel never outlives
+  its leg lifetimes; never a leak past the connection's lifetime.
 - **Multi-hop relays** — a chain of relays composes (each hop is a
   hub leg pair), with the compounding-bound note above. No special
   machinery.