docs: implementation plan (TTY precedents folded in); task decomposition (17 tasks)

Plan updated with the alknet-tty findings: the drainer pattern
(single ordered writer) makes outbound chunk-boundary parsing sound;
TestStdinSink's try_send→Full→Pending is the inbound backpressure
precedent; OQ-01(a) now cites the reference.

Task graph (taskgraph-validated, 17 tasks, 6 generations, no cycles):
- tasks/server/: core-types, auth, healthz-decoy, adapter
- tasks/gateway/: dispatch, routes, publish
- tasks/websocket/: byte-adapter (research POC), upgrade-session, overlay-ops
- tasks/adapters/: from-openapi, from-jsonschema, to-openapi, from-wss, mcp
- tasks/client/: http-host
- tasks/infra/: integration-suite (phase 4)

Critical path runs through server core → adapter → WS session →
overlay tests → integration suite. High-risk tasks are the three WS
tasks, de-risked by the ws-byte-adapter POC blocking upgrade-session.

tasks/websocket/overlay-ops.md

@@ -0,0 +1,44 @@
+---
+id: ws-overlay-ops
+name: Browser-registered ops — connection-local overlay tests
+status: pending
+depends_on: [ws-upgrade-session]
+scope: narrow
+risk: medium
+impact: component
+level: implementation
+tags: [websocket, phase-2]
+---
+
+## Description
+
+Port the connection-local Layer 2 overlay verification from
+`/workspace/@alkdev/alknet/crates/alknet-http/src/websocket/overlay.rs`
+to the channels-over-WS session: a WS client registers ops (via
+call-protocol registration on channel 0), the hub reaches them through
+the live connection handle's `overlay_env()` — not PeerRef. Tests:
+hub→browser call over the same session; overlay ops die on disconnect;
+AccessControl gating on browser ops; bidirectional concurrent calls
+(both sides initiating on channel 0).
+
+## Acceptance Criteria
+
+- [ ] Hub→browser call test passes (browser registered an op, hub invokes it)
+- [ ] Disconnect drops overlay; subsequent reach attempts fail cleanly
+- [ ] Concurrent bidirectional calls don't deadlock or cross-correlate
+- [ ] `cargo test` passes
+
+## References
+
+- docs/architecture/websocket.md (§Connection-local overlay, §Bidirectionality)
+- docs/architecture/decisions/034-outgoing-only-x509-and-three-peer-roles.md (§4)
+- alkcall ADR-019 (registry layering)
+- Old source: `/workspace/@alkdev/alknet/crates/alknet-http/src/websocket/overlay.rs`
+
+## Notes
+
+> Agent fills during implementation.
+
+## Summary
+
+> Agent fills on completion.