docs(review 006 Unit 4): spec reconciliation — OQ-05 resolved, WS data-channel docs to the landed state

- OQ-05: deferred → resolved (2026-09-04, review 006 Unit 2+3); the
  consumer-set reframe recorded (WS is also the native-client fallback
  behind hostile NAT/firewall; OQ-04 does not block the wiring).
- ADR-067: status amendment + the v1-cut blockquote gains the Wired
  (2026-09-04) note — per-session-fork shape, openable surface, gates.
- ADR-048: landed-state amendment — §4's hub→browser direction has its
  object (op/register → connection overlay, hub composes via the
  retained Arc<CallConnection>); the op/register ACL posture (UP-02,
  SRV-10 precedent) recorded.
- websocket.md: the step-7 deferral note and the §"Data channels for
  browsers" status block removed (the section now documents the landed
  surface: with_ws_openable_alpns, the OpenableAlpns fallback, cap
  policy, discovery, gates); idle-knob deployment note for silent data
  channels (semantics unchanged; the 60 s default bites more often —
  set None at assembly for long-lived interactive channels).
- Review 003 status → remediated (all findings closed; log in review
  006); its Unit-4 section marked landed.
- alknet-ADR-044 §5 pointer checked: not stale.

Verification: cargo test 454 / 0; --all-features 582 / 0; clippy
(both) clean; fmt clean; doc clean.

docs/architecture/open-questions.md

@@ -80,8 +80,8 @@ with their resolutions; new alkhttp OQs start at OQ-01.
 - **Origin**: review-001 finding WS-03 (`docs/reviews/001-initial-implementation-review.md`),
   [ADR-067](decisions/067-websocket-carries-channels.md),
   [ADR-048](decisions/048-websocket-native-session-not-gateway.md)
-- **Status**: deferred(scope: v1 cut — no browser consumer yet; reopened
-  when one lands)
+- **Status**: resolved (2026-09-04 — review 006 Unit 2+3, `030c5ef`;
+  upstream mechanisms in alkcall 0.3.0)
 - **Priority**: medium
 - **Question**: ADR-067 §"Data channels for browsers" promises
   browser-opened data channels (open ops on channel 0 → chunk
@@ -96,25 +96,37 @@ with their resolutions; new alkhttp OQs start at OQ-01.
   deferred is the *wiring*: passing the deployment's openable-ALPN
   registrations and `ChannelLifecyclePolicy` through the WS upgrade
   path, plus a browser-opened-channel end-to-end test.
-- **Resolution**: (pending — v1 cut recorded 2026-08-29 in ADR-067 and
-  ADR-048; the recently landed WS robustness work — idle-read timeout,
-  session caps/eviction, pump consolidation — is the foundation the
-  deferred work builds on. **2026-09-03**: the alkcall mechanisms this
-  wiring composes on landed — alkcall review 004 Units 1–3: the
-  per-session fork as dispatch registry (alkcall ADR-047 §4 amendment
-  #2), the opt-in connect-side serving loop
-  (`Dispatcher::serve_single_stream`), and the `op/register` bootstrap
-  op (alkcall ADR-022 amendment 2026-09-03). **2026-09-04**: alkcall
-  review 005 remediated the landed mechanisms (serving-loop
-  concurrency, `op/register` collision policy, spec round-trip
-  completeness) and alkcall 0.3.0 shipped them; alkhttp now consumes
-  0.3. What remains here is alkhttp-side wiring only — alkhttp review
-  003 Unit 2.)
+- **Resolution**: The wiring landed (2026-09-04, alkhttp review 006
+  Unit 2+3): the `install_channel_zero` hook forks the deployment's
+  base registry per session, registers the generic channel ops, the
+  deployment's openable ALPNs (`HttpAdapter::with_ws_openable_alpns`,
+  request-extension fallback), the bootstrap discovery set, and
+  `op/register` (alkcall ADR-022 amendment), then dispatches over the
+  fork — alkcall ADR-047 §4 amendment #2's per-session-fork shape.
+  The session retains its live `Arc<CallConnection>` in `WsSessions`
+  (evicted with the session). One premise of the original deferral
+  was corrected along the way (review-003 WS-23): "reopened when a
+  browser consumer lands" underestimated the consumer set — WS is
+  also the native-client fallback behind hostile NAT/firewall, and a
+  Rust WS consumer (the `test_support` client shape) is a legitimate
+  first consumer. **OQ-04 does not block this wiring**; a browser
+  consumer needs only binary-frame parsing + byte reassembly ahead of
+  wasm-targeted alkcall. What the deferral rationale got right: the
+  alkcall-side machinery was indeed complete — but two wiring
+  blockers turned out to be design gaps (review-003 WS-24/WS-25),
+  resolved upstream in alkcall 0.3.0 before the wiring could land.
+  Gate coverage: the six e2e gates in `tests/ws_upgrade_session.rs`
+  (open/discoverable/bytes round-trip, close + ledger decrement, cap
+  denial, mid-open disconnect teardown, `TooLarge` demux resync,
+  `op/register` + collision), plus the `services/list-peers`
+  announced-op discovery gate (alkcall 0.3.1).
 - **Cross-references**: [ADR-067](decisions/067-websocket-carries-channels.md),
   [ADR-048](decisions/048-websocket-native-session-not-gateway.md),
   [websocket.md](websocket.md), tasks/websocket/review-001-ws-data-channel-decision.md,
   alkcall reviews 004–005 (`alkcall/docs/reviews/004-per-connection-dispatch-and-client-serving-review.md`,
-  `alkcall/docs/reviews/005-serving-loop-concurrency-and-op-register-review.md`)
+  `alkcall/docs/reviews/005-serving-loop-concurrency-and-op-register-review.md`),
+  alkhttp review 003 (the drill-down), review 006 (the consequence
+  review + remediation log)
 
 ## Resolved (ported)