docs(review 007 Unit 2): WS-31 discovery-shadowing note + record corrections

- WS-31: websocket.md §"Data channels for browsers" + ADR-067's landed
  note record that WS-session discovery is the bootstrap set — the
  hook's bootstrap `services/*` registrations overwrite a
  base-registry `services/*` registration on the WS path by design
  (a deployment's custom `services/list` is shadowed on WS sessions
  only).
- ADR-048's landed note: correction + completion — the WS-26
  retention sentence was aspirational at the landed commit (WS-28) and
  is now real; the UP-02 posture's override half is now an explicit
  surface (`with_ws_op_register_acl` / `OpRegisterAcl`), with the
  note that `ChannelsPolicy` could not carry an op ACL.
- ADR-067's landed note: review-007 notes (WS-28 fix + gate, WS-29
  surface, WS-31 record).
- OQ-05 resolution: the retention claim carries the WS-28 correction.
- review-006 UP-02 log + WS-26 paragraph: corrections marking what the
  pre-fix tree did not have, with the landed remediation named.
- review-002 WS-17: the "bounded at 64 sessions" claim corrected —
  the bare-registry semaphore was per-request and bounded nothing;
  `SessionSlots` is the shared-cap surface.
- review-007 status: open for remediation → remediated, with the
  decisions taken (both "implement" options) and the gate names.

Verification: cargo test 454 passed / 0 failed; cargo doc --no-deps
clean (6 pre-existing warnings, identical at baseline).

Review: docs/reviews/007-ws-data-channel-surface-review.md

docs/reviews/006-alkcall-0.3.0-consequence-review.md

@@ -355,7 +355,14 @@ precedent: permissive crate default), and an assembly layer overrides
 via a stricter policy passed through the hook — the posture mirrors
 `ChannelsPolicy`. The override surface rides the existing `policy`
 parameter; the assembly layer's `ChannelsPolicy` value is the same
-object the open wrappers consult.
+object the open wrappers consult. *(Review 007 WS-29 correction: the
+`ChannelsPolicy` object is an `Arc<dyn ChannelLifecyclePolicy>` — the
+channel-cap policy — and cannot carry an operation `AccessControl`; at
+this commit the hook hardcoded the permissive default and no override
+surface existed. Remediation implemented the surface as decided:
+`HttpAdapter::with_ws_op_register_acl` + the `OpRegisterAcl` request
+extension, review 007 Unit 2. The posture above stands as recorded;
+only the "rides the existing `policy` parameter" mechanism was wrong.)*
 
 **Openable-ALPN surface (WS-22).** `OpenableAlpn { spec,
 open_handler }` + `HttpAdapter::with_ws_openable_alpns(Vec<..>)`,
@@ -369,7 +376,14 @@ no openables (channel 0 only).
 the channel-0 `Arc<CallConnection>` under a self-removing
 `ConnectionGuard` (dropped when the channel-0 task ends — any
 teardown path). Shared only when a shared `WsSessions` instance is in
-play (the bare-registry/test-server path passes `None`).
+play (the bare-registry/test-server path passes `None`). *(Review 007
+WS-28 correction: at this commit the guard was bound inside the `if
+let` block and dropped microseconds after insertion — the retention
+sentence above described the intended scope, not the landed one.
+Remediation bound the guard as an `Option<ConnectionGuard>` in the
+channel-0 task's frame; the gate
+`live_connections_visible_mid_session_and_drain_after_teardown` pins
+it.)*
 
 **Policy threading.** The hook takes the session's resolved
 `ChannelsPolicy` (the extension resolution, `NoCap` default) and