docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up)

Decomposition of docs/reviews/002-post-remediation-review.md per its
5-unit remediation plan:

- Unit 1 (security-critical): gw15-publish-body-cap,
  prj16-schema-via-call (CF-004 filed alkcall-side), fwd13-dot-segments,
  fwd16-missing-capability, oai11-ref-memoization
- Unit 2 (timeout/terminality): ws13-idle-progress,
  fwd15-stream-timeout, cli01-retry-after-budget, con17-mcp-pagination,
  con18-wss-sweep-exit
- Unit 3 (projection/docs): projection-truthfulness, mcp-batch-cap,
  gw16-status-drift
- Unit 4 (spec-import): yaml-normalization, oai13-path-item-wildcards,
  import-loudness-cluster, js01-placeholder-check,
  fwd17-19-contract-decisions
- Unit 5 (WS polish + tests): con18b-ws-polish,
  client-policy-wire-tests, cov-deployment-knobs, cov13-dead-code,
  srv11-srv12-router-ordering
- review-002-bracketed-followup: tentatively planned post-bulk pass
  (stale-check, OQA-18 enforcement decision, CON-08/09 close() lever,
  cross-crate re-checks) — deliberately not serialized against the
  bulk

Also: review-002 numbering repair (CON-14 was double-booked; MCP
pagination now CON-14, from_wss monitor renumbered CON-18, missing
CON-14 section added).

taskgraph: 66 valid, no cycles; 24 pending (all review-002);
gen-1/gen-2 parallel waves identified; workflow-cost hotspots are
prj16 (12.8) and ws13 (11.1), both carrying the reviewed slicing
guidance in their Notes.

tasks/infra/review-002-bracketed-followup.md

@@ -0,0 +1,67 @@
+---
+id: review-002-bracketed-followup
+name: Bracketed review-002 follow-up pass (post-bulk — stale-check, OAI-18 enforcement decision, CON-08/CON-09 close() lever, cross-crate re-check)
+status: pending
+depends_on: []
+scope: narrow
+risk: low
+impact: project
+level: planning
+tags: [infra, review-002, follow-up, planning]
+---
+
+## Description
+
+Tentatively planned follow-up pass (mirrors review-001's pattern: the
+first four remediation tasks emerged from post-bulk drift). Do NOT
+decompose until the review-002 bulk has landed — several items below
+may go stale or change shape based on what the bulk decided. Scope
+candidates, to be re-validated when picked up:
+
+1. **OAI-18 enforcement decision** — `required`/`enum`/`pattern`/
+   value-types are advertised via `/schema` but never enforced
+   (key-allowlist only). The bulk tasks leave this as
+   allowlist-plus-docs; the "compile-and-enforce the full input schema
+   per op" option (jsonschema crate is already a dep via schema_cache)
+   is the deferred alternative. Re-evaluate once
+   review-002-yaml-normalization + review-002-oai13-path-item-wildcards
+   land (both change the advertised-schema surface).
+2. **CON-08 / review-001 CON-09 close() lever** — `from_mcp`'s
+   documented session leak and `from_wss`'s no-teardown import are
+   both accepted-for-v1 with documented contracts. If crates.io
+   release timing or consumer feedback makes reconnect/teardown real,
+   the `close()`-handle API is the v1.1 lever for both.
+3. **Cross-crate re-check** — CF-001 (dead-mux write retryability),
+   CF-002 (demux TooLarge allocation), CF-003 (wire publish_schema
+   fail-open), CF-004 (services_schema_handler disclosure) in
+   alkcall's ledger: re-check status when alkcall next gets attention;
+   alkhttp-side assertions (ws-eof retryability tightening, PRJ-16
+   defense-in-depth re-scope) may follow.
+4. **Stale-comment sweep** — review-002 changes will touch hot docs
+   (byte_adapter pump docs, adapter.rs router comments, forward.rs
+   URL pipeline). A short sweep verifying module docs still match
+   behavior after the bulk (the SRV-11 lesson: comments asserting
+   axum semantics are exactly what went stale).
+5. **ADR-045 version bump audit** — if projection-truthfulness and
+   gateway-status tasks landed, verify `to_openapi`'s `info.version`
+   reflects the accumulated contract changes per ADR-045.
+
+## Acceptance Criteria
+
+- [ ] Re-scoped into concrete tasks (or explicitly dismissed per item)
+      once the review-002 bulk is complete
+- [ ] Nothing acted on before the bulk lands (planning-level gate)
+
+## References
+
+- docs/reviews/002-post-remediation-review.md (Part E' OAI-18; Part A' CON-08 status; Unit 3-4 notes; ADR-045)
+- docs/reviews/001-initial-implementation-review.md (the follow-up pattern this mirrors — 4 tasks emerged post-bulk)
+- alkcall/docs/reviews/consumer-findings-ledger.md (CF-001..CF-004)
+- tasks/infra/review-001-missing-docs-sweep.md (precedent: opportunistic follow-up closure)
+
+## Notes
+
+Left `depends_on: []` deliberately — taskgraph ordering for a
+planning-level task should not serialize the bulk (it drains
+independently and is picked up when the operator chooses). All four
+precede-the-bulk items are marked in each task's Notes where relevant.