chore(tasks): mark final wave completed (prj16, gw16, cov-knobs, import-loudness, client-policy-wire-tests)

tasks/gateway/review-002-gw16-status-drift.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-gw16-status-drift
 name: Unify INVALID_INPUT status on hand-rolled publish/batch paths + sink-deadline decision (GW-16, GW-17)
-status: pending
+status: completed
 depends_on: [review-002-gw15-publish-body-cap]
 scope: narrow
 risk: low
@@ -71,4 +71,8 @@ Do this after GW-15 so the line-cap path's final status is chosen once
 (avoid two commits churning the same lines). ADR-023 governs the
 error-code discipline — if (b) is chosen for GW-16, note the
 body-shape-vs-chunk-shape distinction there or in http-server.md so
-the next projection refresh captures it.
+the next projection refresh captures it.
+
+## Summary
+
+GW-16: all hand-rolled INVALID_INPUT sites unified to 422 via call_error_to_http_response_with_identity (incl. /batch over-cap). GW-17 choice (a): invoke_sink wrapped in the 30s timeout - hung sink = 504 TIMEOUT envelope. gateway-spec 1.3.0 -> 1.4.0 (minor per ADR-045). Wire-visible: /publish framing faults + /batch over-cap now 422.

tasks/gateway/review-002-prj16-schema-via-call.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-prj16-schema-via-call
 name: Block Internal-op schema disclosure via services/schema over /call (PRJ-16, cross-crate CF-004)
-status: pending
+status: completed
 depends_on: []
 scope: moderate
 risk: medium
@@ -73,4 +73,8 @@ found) covers all three + MCP; if the mechanism is route-local, mirror
 it in all three pre-check sites. Do not block on the alkcall fix —
 this task is shippable independently and the alkcall lead time is
 unknown. If CF-004 lands first, re-scope this task to defense-in-depth
-assertions only.
+assertions only.
+
+## Summary
+
+Dispatch-spine guard: invoke/invoke_streaming apply GET /schema's is-internal + ACL checks to the inner services/schema name (404/FORBIDDEN); shared check also used by the MCP schema tool (deduped). ADR-071 records CF-004 layering (complete fix alkcall-side; guard stays as defense-in-depth).