feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

tasks/infra/integration-suite.md

@@ -1,7 +1,7 @@
 ---
 id: infra-integration-suite
 name: Full-surface integration suite + docs sync + publish prep
-status: pending
+status: completed
 depends_on: [gateway-publish, adapter-to-openapi, adapter-from-wss, adapter-mcp, ws-overlay-ops]
 scope: moderate
 risk: medium
@@ -24,11 +24,11 @@ Cargo.toml metadata polish.
 
 ## Acceptance Criteria
 
-- [ ] `cargo test --all-features` green; clippy `-D warnings` green; fmt green
-- [ ] Full-surface integration test passing (gateway + WS + one adapter each direction)
-- [ ] Port notes stripped; OQ statuses updated
-- [ ] `cargo publish --dry-run --allow-dirty` succeeds
-- [ ] taskgraph shows all tasks completed
+- [x] `cargo test --all-features` green; clippy `-D warnings` green; fmt green
+- [x] Full-surface integration test passing (gateway + WS + one adapter each direction)
+- [x] Port notes stripped; OQ statuses updated
+- [x] `cargo publish --dry-run --allow-dirty` succeeds
+- [x] taskgraph shows all tasks completed
 
 ## References
 
@@ -37,8 +37,49 @@ Cargo.toml metadata polish.
 
 ## Notes
 
-> Agent fills during implementation.
+The full-surface suite surfaced a real gap: the WS upgrade route was
+reserved but never wired into HttpAdapter's router (the ws-upgrade-session
+tests built their own axum server). Now wired in build_router with its
+own ws_bearer_auth layer (401 without a resolvable token — stricter than
+the shared bearer middleware, which permissively stashes Option<Identity>
+for the gateway endpoints).
 
 ## Summary
 
-> Agent fills on completion.
+Phase 4 hardening complete.
+
+**Integration suite** (tests/full_surface.rs, mcp feature, 7 tests over
+real TCP with each accepted connection driven through
+ProtocolHandler::handle — the production path):
+- gateway 6 endpoints over HTTP: search (ACL-filtered), schema (GET +
+  name query), call (round trip), batch, subscribe (SSE), publish
+  surface presence; /openapi.json 6-endpoint projection validating
+  against openapiv3; gateway error fidelity end-to-end (unknown op
+  404 NOT_FOUND); unauthenticated calls follow the ACL model
+  (unrestricted op → allowed, unknown op → NOT_FOUND)
+- WS session over the same HttpAdapter (upgrade → channels → echo
+  round-trip on channel 0) — required wiring the WS upgrade route into
+  HttpAdapter's router (it was reserved but only wired in tests):
+  WS_UPGRADE_PATH now serves ws_upgrade_handler under ws_bearer_auth
+  (401 without a resolvable token), while gateway endpoints keep the
+  permissive shared bearer middleware
+- from_openapi import → Internal-by-default (invisible from the wire,
+  ADR-015) → External facade composing it via env.invoke → the
+  upstream HTTP API called end-to-end
+- to_openapi projection over /openapi.json (6 paths, openapiv3-valid)
+  and to_mcp over /mcp: MCP client initialize + tools/list (4 gateway
+  tools) + search excluding Sub ops — the tool-gateway pattern
+
+**Docs sync**: all "## Port notes" sections stripped from the 28 ported
+ADRs/specs (inline port-note blockquotes rephrased as plain statements);
+OQ-01/OQ-02 statuses corrected to resolved across open-questions.md,
+overview.md, websocket.md, and the architecture README's OQ table.
+
+**Publish prep**: cargo publish --dry-run --allow-dirty succeeds (90
+files); cargo doc --no-deps warning-free (crate::docs link targets
+resolved); no alknet references remain in src/; Cargo.toml metadata
+already complete (license, repository, keywords, categories, rust-version).
+
+Verified: cargo test (182 lib default), --all-features (227 lib + 29
+integration across 4 suites), clippy -D warnings (default /
+test-support / all-features), fmt, doc, publish --dry-run.