docs(tasks): post-remediation sweep — 4 follow-up tasks

Found in the sweep of completed review-001 remediation:
- /publish schema validation fails open on compile error + recompiles
  per request (remediation-introduced, routes.rs:254-268)
- OAI-06 loud-degradation unblocked and still open (HTTP_0 marker)
- HY-06 ExponentialBackoff in public API + COV-02 mTLS success path
  both unblocked post client-config rework
- HY-02/04/11 publish-prep docs gate (104 missing-docs warnings
  re-measured)

Also flagged, not tasked here: WS-12 (alkcall demux 4 GiB discard
alloc) was never actually filed in alkcall's consumer-findings-ledger —
only CF-001 is there. File it when next touching alkcall.

taskgraph: validate clean (42), no cycles

tasks/adapters/review-001-openapi-loud-degradation.md

@@ -0,0 +1,65 @@
+---
+id: review-001-openapi-loud-degradation
+name: Loud unsupported-OpenAPI-feature handling (OAI-06)
+status: pending
+depends_on: []
+scope: narrow
+risk: low
+impact: component
+level: implementation
+tags: [adapters, review-001, from-openapi, follow-up]
+---
+
+## Description
+
+Review 001 finding OAI-06 — deliberately deferred during decomposition
+("revisit after the input-schema work"): unsupported OpenAPI features
+still degrade **silently**, each producing an op that misbehaves only at
+call time (verified still true post-remediation):
+
+- `default`/wildcard response keys become
+  `ErrorDefinition { code: "HTTP_0", http_status: None }`
+  (`from_openapi.rs:build_error_schemas`, ~:238-243) — entries that never
+  match a real status.
+- `trace` ops silently skipped (`openapi_spec.rs`); `servers` overrides
+  ignored; parameter `style`/`explode` unsupported and silent (arrays
+  serialize `"[1,2]"`); a `default`-declared SSE stream is missed by
+  `detect_op_type` and would return one giant text string.
+
+Since OAI-03's fix, the codebase already has the right pattern —
+`in: cookie` fails import with a clear `SchemaParse` naming the feature
+and the remediation. Extend that posture: unsupported features that
+would produce a wrong-behaving op **fail import loudly** (or degrade in
+a way that is documented, tested, and visibly warned), never silently.
+
+Per-feature decision, implementer's judgment with the review's map:
+reject at import (cookie-style, preferred for anything that changes
+wire semantics: `style`/`explode` non-default forms, `servers` override
+on a non-matching base), or support (HTTP_0's real fix is mapping
+`default` → a documented catch-all code or dropping it with a warning
+— pick one and test it), or document-as-inert (`trace` skip is
+defensible if logged).
+
+## Acceptance Criteria
+
+- [ ] A spec using each unsupported feature either imports with a documented, warned, tested behavior or fails import with a feature-naming error (tests per feature)
+- [ ] `HTTP_0` no longer emitted (default responses mapped or dropped loudly) — `/search` never advertises a code that can't match
+- [ ] `style`/`explode` non-default forms do not silently mis-serialize arrays
+- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
+
+## References
+
+- docs/reviews/001-initial-implementation-review.md (Part E, OAI-06)
+- tasks/adapters/review-001-input-schema-enforcement.md (the loud-unsupported pattern to extend)
+
+## Notes
+
+> Agent fills during implementation. Deferred from the original
+> decomposition for staleness reasons; unblocked once OAI-02/03/07/09
+> landed (they did). Scope guard: this is import-time fidelity, not
+> new feature support — do not implement `servers` overrides or style
+> serialization here.
+
+## Summary
+
+> Filled on completion.