docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

tasks/websocket/review-001-ws-session-limits.md

@@ -0,0 +1,64 @@
+---
+id: review-001-ws-session-limits
+name: WS session lifecycle — idle timeout, shutdown, teardown, caps (WS-01, WS-07..WS-10)
+status: pending
+depends_on: [review-001-ws-eof-signal]
+scope: narrow
+risk: medium
+impact: component
+level: implementation
+tags: [websocket, review-001]
+---
+
+## Description
+
+Review 001 WS subsystem lifecycle/staleness findings over
+`src/websocket/upgrade.rs` and `byte_adapter.rs`:
+
+- **WS-01 (major)**: the single demux loop means one dribbled chunk
+  stalls all channels indefinitely — alkcall's demux has no read timeout
+  and a peer header `[ch=0][len=16 MiB]` + one byte/ minute parks the
+  allocation and hangs every outstanding channel-0 call (Sub/Pub pendings
+  until the socket dies). Add a configurable idle timeout on the WS read
+  that closes with 1001 on staleness (deployment knob; default bounds the
+  stall).
+- **WS-07**: `poll_shutdown` drops a *fresh clone* of `write_tx`
+  (`byte_adapter.rs:269-276`) so the channel never closes and the
+  documented `ws_sink.close()` never runs at shutdown — the `from_wss`
+  path never emits a WS Close frame at all. Drop the held sender.
+- **WS-08**: `_pumps` is dropped immediately (`upgrade.rs:36`); the
+  documented forced-teardown lever `WsPumps::abort()` is never callable
+  on the server path. Retain the handle so a stuck session is evictable
+  in-crate.
+- **WS-09**: no cap on WS sessions (post-auth DoS); the assembly layer
+  cannot add one because the route is built inside `HttpAdapter`. Add a
+  semaphore in `ws_upgrade_handler` (configurable; document the default).
+- **WS-10**: dispatcher/mux tasks outlive a failed session task
+  (`upgrade.rs:65-97`) — self-healing but a peer-behavior-tied leak
+  window. Document the semantics (the cheap fix) or tie task lifetimes
+  to the session.
+- Fold-in from review-001-hyper-server-knobs: SRV-10's policy-injection
+  point (channel cap) belongs here if that task doesn't land it.
+
+## Acceptance Criteria
+
+- [ ] Idle timeout bounds a dribble stall (test: dribbling peer's channels fail/bound rather than hang forever)
+- [ ] `shutdown()` causes a WS Close frame to the peer (test)
+- [ ] `_pumps` retained; `abort()` reachable on the server path
+- [ ] Session concurrency cap configurable in `HttpAdapter`; enforced (test)
+- [ ] Detached-task lifetime semantics documented (WS-10)
+- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
+
+## References
+
+- docs/reviews/001-initial-implementation-review.md (Part B, WS-01, WS-07..WS-10)
+- docs/architecture/decisions/048-websocket-native-session-not-gateway.md
+
+## Notes
+
+> Agent fills during implementation. Takes the EOF-signal task first
+> (same files, and the lifecycle knobs build on the lossless signal).
+
+## Summary
+
+> Filled on completion.