chore(tasks): mark final wave completed (prj16, gw16, cov-knobs, import-loudness, client-policy-wire-tests)

tasks/adapters/review-002-import-loudness-cluster.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-import-loudness-cluster
 name: Import loudness cluster — oneOf body, self-ref requestBody, siblings, collisions, header precedence, error truncation (OAI-10/14/15/17/19, JS-02/03)
-status: pending
+status: completed
 depends_on: [review-002-oai11-ref-memoization]
 scope: moderate
 risk: low
@@ -76,4 +76,8 @@ function for OAI-10/15 — or rebase-verify). Slice per finding, commit
 per finding. The OAI-19 import-time check may not see the assembly
 layer's `default_headers` (config lives elsewhere) — if the
 import-time surface cannot know, the loud point moves to
-first-call-time (warn-once) — implementer documents which.
+first-call-time (warn-once) — implementer documents which.
+
+## Summary
+
+JS-03 zip without assert; JS-02 validate_path_template hoisted to forward.rs (shared, import-fails on unterminated placeholders); OAI-15 requestBody $ref/content loud; OAI-10 ref-sibling warns at all consumption points; OAI-14 callbacks/security rejected at import (oneOf body refused); OAI-17 bounded_join (8/128, +N more) caps all location lists; OAI-19 Authorization/default-header collisions rejected. http-adapters.md successor matrix section.

tasks/client/review-002-client-policy-wire-tests.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-client-policy-wire-tests
 name: Wire tests — redirect policy, retry gate/budget, streaming terminal arms, TLS error arms (CLI-02/03, COV-10/11)
-status: pending
+status: completed
 depends_on: [review-002-fwd15-stream-timeout, review-002-cli01-retry-after-budget]
 scope: moderate
 risk: low
@@ -78,4 +78,8 @@ interim ones. Slice: (1) redirect tests, (2) retry tests, (3)
 streaming terminal arms, (4) TLS + config arms — independent commits.
 If `spawn_responder` needs a "count requests per host" surface, build
 it once and reuse — the cross-host zero-contact assertion is the
-load-bearing one.
+load-bearing one.
+
+## Summary
+
+CLI-02 redirect wire tests (same-host follows with credentials, cross-host surfaces + zero attacker hits, hop cap bounded); CLI-03 retry gate/budget counting-responder tests; COV-10 streaming terminal arms (oversized line, socket abort mid-frame, EOF flush, dead port); COV-11 TLS parse-failure arms incl. reqwest from_pem_bundle zero-section insight; COV-12 credential/header-param arms. Test-only.

tasks/gateway/review-002-gw16-status-drift.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-gw16-status-drift
 name: Unify INVALID_INPUT status on hand-rolled publish/batch paths + sink-deadline decision (GW-16, GW-17)
-status: pending
+status: completed
 depends_on: [review-002-gw15-publish-body-cap]
 scope: narrow
 risk: low
@@ -71,4 +71,8 @@ Do this after GW-15 so the line-cap path's final status is chosen once
 (avoid two commits churning the same lines). ADR-023 governs the
 error-code discipline — if (b) is chosen for GW-16, note the
 body-shape-vs-chunk-shape distinction there or in http-server.md so
-the next projection refresh captures it.
+the next projection refresh captures it.
+
+## Summary
+
+GW-16: all hand-rolled INVALID_INPUT sites unified to 422 via call_error_to_http_response_with_identity (incl. /batch over-cap). GW-17 choice (a): invoke_sink wrapped in the 30s timeout - hung sink = 504 TIMEOUT envelope. gateway-spec 1.3.0 -> 1.4.0 (minor per ADR-045). Wire-visible: /publish framing faults + /batch over-cap now 422.

tasks/gateway/review-002-prj16-schema-via-call.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-prj16-schema-via-call
 name: Block Internal-op schema disclosure via services/schema over /call (PRJ-16, cross-crate CF-004)
-status: pending
+status: completed
 depends_on: []
 scope: moderate
 risk: medium
@@ -73,4 +73,8 @@ found) covers all three + MCP; if the mechanism is route-local, mirror
 it in all three pre-check sites. Do not block on the alkcall fix —
 this task is shippable independently and the alkcall lead time is
 unknown. If CF-004 lands first, re-scope this task to defense-in-depth
-assertions only.
+assertions only.
+
+## Summary
+
+Dispatch-spine guard: invoke/invoke_streaming apply GET /schema's is-internal + ACL checks to the inner services/schema name (404/FORBIDDEN); shared check also used by the MCP schema tool (deduped). ADR-071 records CF-004 layering (complete fix alkcall-side; guard stays as defense-in-depth).

tasks/infra/review-002-cov-deployment-knobs.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-cov-deployment-knobs
 name: Coverage — with_ws_idle_timeout integration test, call_tool production dispatch, small dark arms (COV-11b/12)
-status: pending
+status: completed
 depends_on: [review-002-ws13-idle-progress]
 scope: moderate
 risk: low
@@ -66,4 +66,8 @@ Sequence after ws13 (the idle-knob assert must match final semantics).
 The array-`$ref` test is coverage-only insurance — if
 review-002-oai11-ref-memoization already added it, check the box and
 skip. The from_mcp/`{"value": …}` wrap test goes in
-from_mcp_integration.rs (real wire behavior).
+from_mcp_integration.rs (real wire behavior).
+
+## Summary
+
+COV-11b/12 closed: rmcp production call_tool round-trip for all 4 gateway tools, mcp schema/batch dark arms, /publish first-line JSON arm (updated to 422), decoy index.html, array-$ref + style:simple-import-arm pins. COV-11b idle-knob already covered by ws13's tests. Test-only.