docs(review 006 Unit 4): spec reconciliation — OQ-05 resolved, WS data-channel docs to the landed state

- OQ-05: deferred → resolved (2026-09-04, review 006 Unit 2+3); the
  consumer-set reframe recorded (WS is also the native-client fallback
  behind hostile NAT/firewall; OQ-04 does not block the wiring).
- ADR-067: status amendment + the v1-cut blockquote gains the Wired
  (2026-09-04) note — per-session-fork shape, openable surface, gates.
- ADR-048: landed-state amendment — §4's hub→browser direction has its
  object (op/register → connection overlay, hub composes via the
  retained Arc<CallConnection>); the op/register ACL posture (UP-02,
  SRV-10 precedent) recorded.
- websocket.md: the step-7 deferral note and the §"Data channels for
  browsers" status block removed (the section now documents the landed
  surface: with_ws_openable_alpns, the OpenableAlpns fallback, cap
  policy, discovery, gates); idle-knob deployment note for silent data
  channels (semantics unchanged; the 60 s default bites more often —
  set None at assembly for long-lived interactive channels).
- Review 003 status → remediated (all findings closed; log in review
  006); its Unit-4 section marked landed.
- alknet-ADR-044 §5 pointer checked: not stale.

Verification: cargo test 454 / 0; --all-features 582 / 0; clippy
(both) clean; fmt clean; doc clean.

docs/architecture/decisions/048-websocket-native-session-not-gateway.md

@@ -36,6 +36,21 @@ Accepted
 > replace other peer-announced ops but never the serving side's own
 > registrations — the WS session's `op/register` handler gates on the
 > session fork.
+>
+> **Landed (2026-09-04, review 006 Unit 2+3):** the WS wiring this
+> note tracks is in — the hook forks the base registry per session,
+> registers the channel ops + openables + bootstrap discovery +
+> `op/register` on the fork, and dispatches over it; the session
+> retains its live `Arc<CallConnection>` in `WsSessions` (the hub's
+> reach-the-browser handle). §4's hub→browser call direction now has
+> its object: announced ops land in the connection overlay via
+> `op/register`, and the hub composes them through the connection
+> handle (gate:
+> `op_register_served_per_session_and_collision_is_already_exists`).
+> The `op/register` ACL posture on this surface: registered with
+> `AccessControl::default()` (the SRV-10 permissive-crate-default
+> precedent); deployments gate via a stricter `ChannelsPolicy`
+> passed through the hook (review 006 UP-02 decision).
 
 ## Status amendment (alkhttp port)
 

docs/architecture/decisions/067-websocket-carries-channels.md

@@ -3,7 +3,8 @@
 ## Status
 
 Accepted (amended 2026-08-29 — the data-channel half of the WS path is
-deferred, not yet wired; see [OQ-05](../open-questions.md))
+deferred, not yet wired; see [OQ-05](../open-questions.md); amended
+2026-09-04 — the deferred wiring landed, review 006 Units 2–3)
 
 ## Context
 
@@ -106,6 +107,18 @@ On upgrade, the handler:
 > sessions (review-001, WS-03). The deferral and its rationale are
 > recorded in [OQ-05](../open-questions.md); the design above is the
 > contract the deferred wiring implements.
+>
+> **Wired (2026-09-04):** step 4 landed (review 006 Unit 2+3) in the
+> per-session-fork shape alkcall ADR-047 §4 amendment #2 decided: the
+> `install_channel_zero` hook forks the deployment's base registry,
+> registers the generic channel ops + the deployment's openables
+> (`HttpAdapter::with_ws_openable_alpns`, request-extension fallback)
+> + the bootstrap discovery set + `op/register` on the fork, and
+> dispatches over it. Openable set default: none (channel 0 only).
+> The session retains its live `Arc<CallConnection>` in `WsSessions`
+> (WS-26). Gates: the six e2e scenarios in
+> `tests/ws_upgrade_session.rs` + the `services/list-peers` announced-op
+> discovery gate (alkcall 0.3.1).
 
 Everything ADR-048 says about dispatch — `call.requested` →
 `Dispatcher::dispatch_requested` with `AccessControl::check` gating,
@@ -169,7 +182,7 @@ in-line channels session:
 - [websocket.md](../websocket.md) — the full WS session spec (its
   §"Data channels for browsers" carries the same v1-cut note)
 - [OQ-05](../open-questions.md) — the data-channel v1 cut deferral
-  (status `deferred(scope)`; reopened when a browser consumer lands)
+  (resolved 2026-09-04: the wiring landed, review 006 Units 2–3)
 - [ADR-048](048-websocket-native-session-not-gateway.md) — the native
   session (not gateway shape) decision this ADR amends (channel 0
   framing; upgrade path)