docs(review 006 Unit 4): spec reconciliation — OQ-05 resolved, WS data-channel docs to the landed state

- OQ-05: deferred → resolved (2026-09-04, review 006 Unit 2+3); the
  consumer-set reframe recorded (WS is also the native-client fallback
  behind hostile NAT/firewall; OQ-04 does not block the wiring).
- ADR-067: status amendment + the v1-cut blockquote gains the Wired
  (2026-09-04) note — per-session-fork shape, openable surface, gates.
- ADR-048: landed-state amendment — §4's hub→browser direction has its
  object (op/register → connection overlay, hub composes via the
  retained Arc<CallConnection>); the op/register ACL posture (UP-02,
  SRV-10 precedent) recorded.
- websocket.md: the step-7 deferral note and the §"Data channels for
  browsers" status block removed (the section now documents the landed
  surface: with_ws_openable_alpns, the OpenableAlpns fallback, cap
  policy, discovery, gates); idle-knob deployment note for silent data
  channels (semantics unchanged; the 60 s default bites more often —
  set None at assembly for long-lived interactive channels).
- Review 003 status → remediated (all findings closed; log in review
  006); its Unit-4 section marked landed.
- alknet-ADR-044 §5 pointer checked: not stale.

Verification: cargo test 454 / 0; --all-features 582 / 0; clippy
(both) clean; fmt clean; doc clean.

docs/architecture/decisions/048-websocket-native-session-not-gateway.md

@@ -36,6 +36,21 @@ Accepted
 > replace other peer-announced ops but never the serving side's own
 > registrations — the WS session's `op/register` handler gates on the
 > session fork.
+>
+> **Landed (2026-09-04, review 006 Unit 2+3):** the WS wiring this
+> note tracks is in — the hook forks the base registry per session,
+> registers the channel ops + openables + bootstrap discovery +
+> `op/register` on the fork, and dispatches over it; the session
+> retains its live `Arc<CallConnection>` in `WsSessions` (the hub's
+> reach-the-browser handle). §4's hub→browser call direction now has
+> its object: announced ops land in the connection overlay via
+> `op/register`, and the hub composes them through the connection
+> handle (gate:
+> `op_register_served_per_session_and_collision_is_already_exists`).
+> The `op/register` ACL posture on this surface: registered with
+> `AccessControl::default()` (the SRV-10 permissive-crate-default
+> precedent); deployments gate via a stricter `ChannelsPolicy`
+> passed through the hook (review 006 UP-02 decision).
 
 ## Status amendment (alkhttp port)