docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up)

Decomposition of docs/reviews/002-post-remediation-review.md per its
5-unit remediation plan:

- Unit 1 (security-critical): gw15-publish-body-cap,
  prj16-schema-via-call (CF-004 filed alkcall-side), fwd13-dot-segments,
  fwd16-missing-capability, oai11-ref-memoization
- Unit 2 (timeout/terminality): ws13-idle-progress,
  fwd15-stream-timeout, cli01-retry-after-budget, con17-mcp-pagination,
  con18-wss-sweep-exit
- Unit 3 (projection/docs): projection-truthfulness, mcp-batch-cap,
  gw16-status-drift
- Unit 4 (spec-import): yaml-normalization, oai13-path-item-wildcards,
  import-loudness-cluster, js01-placeholder-check,
  fwd17-19-contract-decisions
- Unit 5 (WS polish + tests): con18b-ws-polish,
  client-policy-wire-tests, cov-deployment-knobs, cov13-dead-code,
  srv11-srv12-router-ordering
- review-002-bracketed-followup: tentatively planned post-bulk pass
  (stale-check, OQA-18 enforcement decision, CON-08/09 close() lever,
  cross-crate re-checks) — deliberately not serialized against the
  bulk

Also: review-002 numbering repair (CON-14 was double-booked; MCP
pagination now CON-14, from_wss monitor renumbered CON-18, missing
CON-14 section added).

taskgraph: 66 valid, no cycles; 24 pending (all review-002);
gen-1/gen-2 parallel waves identified; workflow-cost hotspots are
prj16 (12.8) and ws13 (11.1), both carrying the reviewed slicing
guidance in their Notes.

docs/reviews/002-post-remediation-review.md

@@ -50,8 +50,8 @@ return of review-001's classes.
 
 - **The remediation held.** Every review-001 finding was re-verified
   against its fix; 76 of 82 land FIXED-VERIFIED. The residuals are
-  tracked below as new findings (SRV-12, WS-13, CON-14, OAI-11/12/13,
-  JS-01, PRJ-16..17, CLI-01..03, FWD-13..14, GW-15..17, WS-14..19) —
+  tracked below as new findings (SRV-11/12, WS-13..19, CON-14..18,
+  OAI-10..19, JS-01..03, PRJ-16..24, CLI-01..03, FWD-13..19, GW-15..17) —
   none is a reversion of the original defect; each is a gap one layer
   short of the fix's goal, or a new-mechanism bug.
 - **The one critical-class regression-adjacent defect:** GW-15 —
@@ -72,9 +72,9 @@ return of review-001's classes.
   arrival (so the dribble stall it was built for defeats it — WS-13);
   the SSE subscription path inherits a 30 s total-request timeout that
   kills healthy long-lived subscriptions (FWD-15) while its terminal
-  arms are untested; `from_wss`'s new pending-sweep never exits (CON-14,
+  arms are untested; `from_wss`'s new pending-sweep never exits (CON-18,
   a leak per dead session); and the MCP pagination loop trusts the
-  remote to eventually stop (CON-14).
+  remote to eventually stop (CON-17).
 - **Projection fidelity is much improved** (runtime-truthful `/call`,
   `/publish`, `/batch` verified against the wire) but two disclosure
    bugs remain: Internal op specs are readable through the
@@ -137,7 +137,7 @@ fixed there, `adapter.rs:1184-1215` test). **Fix:** re-apply
 # Part B' — WebSocket subsystem + from_wss
 
 **Regression check: WS-02/04/05/06/07/08/09/10/11 FIXED-VERIFIED.**
-WS-01 and the CON-02 sweep are the two residuals (WS-13, CON-14). The
+WS-01 and the CON-02 sweep are the two residuals (WS-13, CON-18). The
 pump consolidation preserved behavior parity (diff-verified
 `4a825d3..HEAD`) and the inbound memory bound dropped from ~4 GiB to
 64 MiB/conn. No reversion found.
@@ -177,7 +177,7 @@ cap (1011), and text rejection (1002); the reason string lies in two of
 three cases. Numeric codes (what clients key on) are correct. **Fix:**
 carry the reason in the enum variant.
 
-## WS-16 [minor] — Withdrawn during verification (merged into CON-14)
+## WS-16 [minor] — Withdrawn during verification (merged into CON-18)
 
 ## WS-17 [minor] — Bare-registry/custom WS routes get no idle-timeout knob surface
 
@@ -212,7 +212,7 @@ only. The shared pump makes regression risk low; the flavor adapters are
 the untested seam. **Fix:** mirror one text-rejection and one cap-trip
 test over `AxumFraming`.
 
-## CON-14 [minor] — `from_wss` drop monitor loops forever after EOF: one 1 Hz task per dead session, permanently
+## CON-18 [minor] — `from_wss` drop monitor loops forever after EOF: one 1 Hz task per dead session, permanently
 
 **Verified:** YES. `src/adapters/from_wss.rs:254-272` — once
 `eof_observed` holds, the sweep branch runs `fail_all` every second
@@ -586,6 +586,20 @@ the shared response (oneOf append) instead of overwriting.
 to the 30 s deadline each) while `/batch` rejects at 101. **Fix:**
 enforce `MAX_BATCH_OPERATIONS` in the MCP `batch` tool.
 
+## CON-14 [major] — `from_mcp` import hangs forever (and grows memory unboundedly) on a malicious or buggy server that never clears `next_cursor`
+
+**Verified:** YES (against rmcp 1.8.0 source). `from_mcp/mod.rs:114-119`
+delegates to rmcp's `Peer::list_all_tools`, which loops
+`while cursor.is_some()` with **no page cap and no timeout**. A server
+that always returns `next_cursor: Some(...)` (cycling or ignoring the
+cursor) hangs `import()` indefinitely while appending every page's
+tools → unbounded memory growth alongside the hang. Tools from
+completed pages are not lost (extend per page), but nothing in alkhttp
+bounds the loop. **Fix:** replace `list_all_tools` with a bounded loop
+(max pages + overall deadline), surfacing `AdapterError::DiscoveryFailed`
+when the budget trips. Acceptance gate: a cycling-cursor paging server
+test terminates with a clean error.
+
 ## CON-15 [minor] — `from_mcp` tool-name sanitization is not injective; collisions resolve by silent last-write
 
 **Verified:** YES. `from_mcp/mod.rs:231-252` + alkcall
@@ -794,7 +808,7 @@ The five findings with real attack or availability impact.
 - OAI-11: memoize cycle-free `$ref` expansions (or node-count budget).
   Gate: 30-level chain imports in bounded time.
 
-## Unit 2 — Timeout/terminality coherence (WS-13, FWD-14, FWD-15, CLI-01, GW-17, CON-14)
+## Unit 2 — Timeout/terminality coherence (WS-13, FWD-14, FWD-15, CLI-01, GW-17, CON-17, CON-18)
 
 One coherent theme: the new policy knobs (idle, budget, ceiling,
 timeout) interact with progress and terminality incorrectly.
@@ -804,7 +818,8 @@ timeout) interact with progress and terminality incorrectly.
   `request_timeout: None`.
 - CLI-01: budget-aware Retry-After sleep.
 - GW-17: wrap sink completion in the 30 s deadline (or fix the doc).
-- CON-14: dead-connection fast-fail + bounded sweep exit.
+- CON-17: bounded MCP pagination loop (max pages + deadline).
+- CON-18: dead-connection fast-fail + bounded sweep exit.
 
 ## Unit 3 — Projection + doc truthfulness (PRJ-16b, PRJ-17..24, WS-15) + gateway status drift (GW-16)
 
@@ -846,5 +861,5 @@ Also delete the COV-13 dead code.
 - Six subsystem passes ran in parallel over disjoint file sets; two
   agent findings were rejected at consolidation (coverage-overreported
   dark array-`$ref` arm — code verified correct; WS-16 — duplicate of
-  CON-14) and several "uncovered" flags were reclassified as
+  CON-18) and several "uncovered" flags were reclassified as
   cross-binary artifacts after HTML-line verification.