- WS-31: websocket.md §"Data channels for browsers" + ADR-067's landed
note record that WS-session discovery is the bootstrap set — the
hook's bootstrap `services/*` registrations overwrite a
base-registry `services/*` registration on the WS path by design
(a deployment's custom `services/list` is shadowed on WS sessions
only).
- ADR-048's landed note: correction + completion — the WS-26
retention sentence was aspirational at the landed commit (WS-28) and
is now real; the UP-02 posture's override half is now an explicit
surface (`with_ws_op_register_acl` / `OpRegisterAcl`), with the
note that `ChannelsPolicy` could not carry an op ACL.
- ADR-067's landed note: review-007 notes (WS-28 fix + gate, WS-29
surface, WS-31 record).
- OQ-05 resolution: the retention claim carries the WS-28 correction.
- review-006 UP-02 log + WS-26 paragraph: corrections marking what the
pre-fix tree did not have, with the landed remediation named.
- review-002 WS-17: the "bounded at 64 sessions" claim corrected —
the bare-registry semaphore was per-request and bounded nothing;
`SessionSlots` is the shared-cap surface.
- review-007 status: open for remediation → remediated, with the
decisions taken (both "implement" options) and the gate names.
Verification: cargo test 454 passed / 0 failed; cargo doc --no-deps
clean (6 pre-existing warnings, identical at baseline).
Review: docs/reviews/007-ws-data-channel-surface-review.md
First review whose subject is the landed wiring itself (review 006
Units 2-4, 030c5ef/2053420/64fa10b), not the gap to it.
Findings:
- WS-28 [major] — the WS-26 ConnectionGuard is bound inside the
`if let` block and drops when it ends, not when the channel-0 task
ends: live_connections() is permanently empty for every session.
Reproduced empirically through the live WS path (scratch test,
run + removed). ADR-048's landed note and review-006's log record
behavior the code does not have.
- WS-29 [minor] — the op/register ACL override recorded as landed
(review-006 UP-02, ADR-048) is not implemented; the hook hardcodes
AccessControl::default() and ChannelsPolicy cannot express an op ACL.
- WS-30 [minor] — the bare-registry default session cap is built per
request (FromRef) and bounds nothing; corrects review-002 WS-17.
- WS-31 [minor] — install_bootstrap_discovery silently shadows a
deployment's own services/list on WS sessions (upstream-mandated,
unrecorded).
- WS-32 [minor] — the router-state openables threading
(with_ws_openable_alpns) has no gate; every Unit-3 gate rides the
extension fallback.
Plus non-findings bounding the re-review (UP-01 arm, policy threading,
from_wss exclusion set, extension precedence, gate fidelity) and a
sequenced remediation plan.
Baseline at 64fa10b: 454 / 582 tests, clippy both, fmt, doc — all clean.
glm-5.3-flash