chore(tasks): summaries + oai11 completion for wave-1 merges

tasks/adapters/review-002-con17-mcp-pagination.md

@@ -53,4 +53,8 @@ terminates after 3 pages — the cycling shape is untested.
 Small, self-contained, feature-gated (`mcp`). Consider (optional) a
 `max_tools` sanity cap as well — same budget family, one more guard
 against a hostile server — but do not let scope creep: the page cap +
-deadline closes the hang, which is the finding.
+deadline closes the hang, which is the finding.
+
+## Summary
+
+list_all_tools_bounded replaces rmcp's unbounded list_all_tools: 100-page cap + 60s deadline (per-page timeout sized to remaining budget), loud DiscoveryFailed naming both budgets on trip, fail-closed import. Cycling-cursor integration test (previously hung forever).

tasks/adapters/review-002-oai11-ref-memoization.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-oai11-ref-memoization
 name: Memoize $ref expansion to bound resolver work (OAI-11)
-status: pending
+status: completed
 depends_on: []
 scope: moderate
 risk: medium
@@ -67,4 +67,8 @@ exponential re-resolution, not allocation). If memoizing, note the
 active cycle attempt must never be cached (write-on-success at the
 top of the recursion return path, or post-order). This is the one
 subtle part; the existing cycle tests + the four new shape tests are
-the safety net.
+the safety net.
+
+## Summary
+
+Memoized $ref expansion (write-on-success cache) + node-budget accounting on memo hits + separate MAX_REF_HOP_DEPTH (64) from structural depth (128). Exponential diamond chains now fail with a clean budget error (<1s) instead of OOM. Note: the original WIP's unbounded memo-hit clone OOM-killed the dev server twice during implementation; verified under a 2G systemd scope.

tasks/client/review-002-fwd15-stream-timeout.md

@@ -70,4 +70,8 @@ already correctly describes read-timeout as the stall guard (the total
 timeout's "stalled upstream" claim there is the thing being fixed).
 Coordinate with review-002-cli01-retry-after-budget (same file) and
 review-002-client-policy-wire-tests (which should follow this to test
-the new behavior) — sequence those.
+the new behavior) — sequence those.
+
+## Summary
+
+Derived timeout-less stream client (reqwest 0.13 cannot clear a client total timeout per-request, verified against source) + 1GiB total-bytes cap with pre-extend buffer check; over-cap streams end with one HTTP_413 terminal envelope. Wire tests for both arms.

tasks/server/review-002-srv11-srv12-router-ordering.md

@@ -64,4 +64,8 @@ add the counting test + the extra-route 405 test so the invariants are
 pinned, not just commented. The SRV-01 opt-out shape (inner layers
 win) must remain exactly as tested. Keep the SRV-10 fold-in fix
 (historical) intact — this task is about the *comment* being false and
-the double-resolve being real.
+the double-resolve being real.
+
+## Summary
+
+WS upgrade route + /mcp nest moved after the router-wide bearer route_layer (single token resolution each; WS MethodRouter fallback carries the decoy 405); method_not_allowed_fallback re-applied after the extras merge (SRV-12). 6 counting/shape tests pin the ordering invariants.

tasks/websocket/review-002-ws13-idle-progress.md

@@ -71,4 +71,8 @@ tracking + tests on the tungstenite path, (2) doc/keepalive decision,
 review-002-con18b-ws-polish (same file) — sequence, don't parallelize.
 If (a)-keepalive is chosen, note it interacts with FWD-15's
 server-side keep-alives on the *HTTP* SSE path — different layers, but
-document both in the same doc pass.
+document both in the same doc pass.
+
+## Summary
+
+Idle deadline resets on completed inbound chunks (InboundChunkProgress observer), not message arrival; decision (b) documented - no WS keepalive, 60s no-progress eviction is intentional (pong is attacker-equivalent traffic). Tungstenite unit + axum integration tests; knob surface unchanged.