docs: implementation plan (TTY precedents folded in); task decomposition (17 tasks)

Plan updated with the alknet-tty findings: the drainer pattern
(single ordered writer) makes outbound chunk-boundary parsing sound;
TestStdinSink's try_send→Full→Pending is the inbound backpressure
precedent; OQ-01(a) now cites the reference.

Task graph (taskgraph-validated, 17 tasks, 6 generations, no cycles):
- tasks/server/: core-types, auth, healthz-decoy, adapter
- tasks/gateway/: dispatch, routes, publish
- tasks/websocket/: byte-adapter (research POC), upgrade-session, overlay-ops
- tasks/adapters/: from-openapi, from-jsonschema, to-openapi, from-wss, mcp
- tasks/client/: http-host
- tasks/infra/: integration-suite (phase 4)

Critical path runs through server core → adapter → WS session →
overlay tests → integration suite. High-risk tasks are the three WS
tasks, de-risked by the ws-byte-adapter POC blocking upgrade-session.

tasks/websocket/upgrade-session.md

@@ -0,0 +1,48 @@
+---
+id: ws-upgrade-session
+name: WS upgrade route + channels session (server producer half)
+status: pending
+depends_on: [ws-byte-adapter, server-adapter]
+scope: broad
+risk: high
+impact: phase
+level: implementation
+tags: [websocket, phase-2]
+---
+
+## Description
+
+Implement the WS upgrade handler per ADR-067/websocket.md, production
+shape: axum route at `/alk/channels`; bearer auth on the upgrade
+request (401 without token); upgrade → adapt the WS stream with the
+byte-adapter (ws-byte-adapter) → `Connection::from_bidi(ws_stream,
+b"alk/channels")` → run the channels accept path: alkcall
+`ChannelsAdapter` in-line demux with the `install_channel_zero` hook
+constructing channel 0's `CallConnection` (identity attached) and
+running `Dispatcher::run_loop_single_stream`. Text messages rejected
+(WS close 1002). Overlay-only session construction mirrors the alknet
+`upgrade.rs::run_ws_session` shape but through the channels machinery.
+
+## Acceptance Criteria
+
+- [ ] Upgrade route wired into HttpAdapter's router (reserved-path collision rule respected)
+- [ ] End-to-end test: WS client (tokio-tungstenite or axum test client) → upgrade → chunk-framed call.requested on channel 0 → response received
+- [ ] Browser-style test: services/list via channel 0, AccessControl-filtered
+- [ ] Disconnect mid-call: pending requests failed, overlay dropped, no hang
+- [ ] 16 MiB chunk split/reassembly test carried over from the POC
+- [ ] `cargo test` passes
+
+## References
+
+- docs/architecture/websocket.md (full spec)
+- docs/architecture/decisions/067-websocket-carries-channels.md
+- alkcall `channels/client.rs` tests (make_install_channel_zero wiring pattern)
+- Old source: `/workspace/@alkdev/alknet/crates/alknet-http/src/websocket/upgrade.rs` (session lifecycle; framing superseded)
+
+## Notes
+
+> Agent fills during implementation.
+
+## Summary
+
+> Agent fills on completion.