feat(cf-006/cf-007): per-call opener identity for open-op hooks; ADR-016 code-list sweep

Batch-fixes every remaining open alkcall-side finding from downstream
consumers so 0.7.0 is the only release they need to absorb.

- CF-006 (the CF-005 corollary): run_open_wrapper derives a per-call
  AuthContext — the opener's dispatch-resolved identity (the same
  identity the ACL gate and cap check saw) overlaid onto the
  install-time context — and passes it to both the establisher and
  the pump handler. Identity-less calls keep the install-time
  identity (no synthetic-anonymous rewrite); transport-truthful
  fields are never rewritten. Signatures unchanged — behavior-only;
  identical on per-connection registries, hub-forwarded opens now
  show the end client. Gates:
  open_wrapper_overlays_per_call_identity_on_install_time_auth +
  open_wrapper_keeps_install_time_identity_when_call_identityless.
- CF-007 (alkhttp review 006 Part C doc drift): ADR-016 amended to
  the eight-code list — ALREADY_EXISTS + CONNECTION_CLOSED in the
  Context, §3 table, and from_openapi collision rule; new §2a
  documents the undelivered-vs-ambiguous write-failure distinction.
- ChannelPlan type doc now states the Send + Sync payload constraint
  (alktunnels POC F-1 re-derived it by compiler error).
- Ledger: CF-006 and CF-007 filed + resolved; CF-005's corollary
  note points at CF-006; the Open section is empty. ADR-049 gains
  the per-call-identity note. Changelog 0.7.0 covers the batch.

Sweep result (all downstream reviews): no other open alkcall items —
alktunnels W3/F-2 are downstream-by-design, alktty R3/P14 are closed
constraints, alknet has none; OQ-24/37/39/40/41 stay
deferred-by-design (no consumer pull yet).

Verification: cargo test (631) + --all-features (648), clippy
(all-targets, all-features, -D warnings), fmt --check, doc
--no-deps, wasm32 check, semver-checks (no update required),
publish --dry-run.

docs/reviews/consumer-findings-ledger.md

@@ -78,11 +78,73 @@ Format: date | found-in (alkhttp context) | severity | status.
     consumer can `set_identity` before wrapping).
   - The corollary (`register_openable`'s closed-over
     establishment-time `AuthContext` vs the per-call opener identity)
-    remains open as a design follow-up — it affects the establisher /
-    pump handler seam, not the ACL gate; tracked separately.
+    was resolved in the same batch (2026-09-07, CF-006 below).
 - **Status:** resolved — 2026-09-07 (regression gates: `cf005_*`
   tests in `src/channels/client.rs`).
 
+### CF-006 — open-op establisher/pump handler receive the install-time `AuthContext`, never the per-call opener's identity (CF-005 corollary) (2026-09-07) — RESOLVED 2026-09-07
+
+- **Found in:** the CF-005 verification pass (same alktunnels
+  reverse-flow POC W1 material; the ledger's CF-005 entry named it as
+  a "design follow-up, tracked separately"). `run_open_wrapper`
+  (`src/channels/operations.rs`) closed over the
+  `install_channel_zero`-time `AuthContext` and passed `auth.clone()`
+  verbatim to both the establisher (ADR-049 §1) and the pump handler
+  (`OpenHandler`'s 4th parameter). The per-call opener's identity —
+  the same identity the ACL gate and the per-identity cap check saw —
+  reached neither hook. On a per-connection registry (ADR-047 §4)
+  install-time identity IS the caller's, so the gap was invisible
+  there; it shows on hub-forwarded opens (the establisher saw the
+  hub, not the end client) and on the connect-side serving path
+  (token- or `ServingConfig.identity`-resolved callers). alktty
+  review 002 R3 independently recorded the same seam (closed
+  per-connection by design, with the "registry must stay
+  per-connection" constraint).
+- **Impact:** an establisher doing per-principal authorization or
+  ownership checks on the backend could not see the actual opener;
+  the pump handler tagging sessions by principal saw the hub.
+- **Fix (2026-09-07):** `run_open_wrapper` derives a **per-call
+  `AuthContext`** — the opener's dispatch-resolved identity overlaid
+  onto the install-time context — and passes it to both the
+  establisher and the pump handler. When the call has no resolved
+  identity, the install-time identity is kept (anonymous-keep; no
+  synthetic-`anonymous` rewrite of a real install-time identity).
+  Transport-truthful fields (`alpn`, `remote_addr`,
+  `tls_client_fingerprint`) are never rewritten. Signatures are
+  unchanged (`OpenEstablisher`, `OpenHandler` still take
+  `AuthContext`) — behavior-only, additive; downstream code compiles
+  unchanged. Regression gates:
+  `open_wrapper_overlays_per_call_identity_on_install_time_auth` +
+  `open_wrapper_keeps_install_time_identity_when_call_identityless`
+  in `src/channels/operations.rs`.
+- **Also in this batch:** `ChannelPlan`'s type doc now spells out the
+  `Send + Sync` payload constraint (alktunnels POC F-1 re-derived it
+  by compiler error — a doc line prevents the next consumer repeating
+  that).
+- **Status:** resolved — 2026-09-07.
+
+### CF-007 — ADR-016's protocol-code list is stale: omits `ALREADY_EXISTS` and `CONNECTION_CLOSED` (2026-09-07) — RESOLVED 2026-09-07
+
+- **Found in:** alkhttp review 006, Part C
+  (`alkhttp/docs/reviews/006-alkcall-0.3.0-consequence-review.md`
+  L207–233, L319–324 — "upstream doc drift … flagged for the next
+  alkcall doc pass"). ADR-016 said "six codes" and its table listed
+  only the original six, while the wire vocabulary had grown:
+  `ALREADY_EXISTS` (ADR-022 collision sub-amendment, 0.3.0) and
+  `CONNECTION_CLOSED` (CF-001, 0.4.x, the retryable
+  provably-undelivered-call code). Downstream consumers already
+  handle both; the authoritative ADR was the thing that was wrong.
+- **Fix (2026-09-07):** ADR-016 amended — Status notes the 2026-09-07
+  extension to eight; the Context paragraph and the §3 table carry
+  both codes with their semantics (`ALREADY_EXISTS` non-retryable,
+  registration state; `CONNECTION_CLOSED` retryable — the only
+  protocol code a caller may auto-retry), a §2a subsection documents
+  the undelivered-vs-ambiguous write-failure distinction, the
+  `from_openapi` collision rule lists all eight, and the
+  cross-references cite the two amendments. Doc-only; the wire
+  surface is unchanged.
+- **Status:** resolved — 2026-09-07.
+
 ---
 ### CF-004 — `services_schema_handler` discloses Internal/ACL-restricted op specs — no visibility or AccessControl check (2026-08-30) — RESOLVED 2026-08-31