First review whose subject is the landed wiring itself (review 006
Units 2-4, 030c5ef/2053420/64fa10b), not the gap to it.
Findings:
- WS-28 [major] — the WS-26 ConnectionGuard is bound inside the
`if let` block and drops when it ends, not when the channel-0 task
ends: live_connections() is permanently empty for every session.
Reproduced empirically through the live WS path (scratch test,
run + removed). ADR-048's landed note and review-006's log record
behavior the code does not have.
- WS-29 [minor] — the op/register ACL override recorded as landed
(review-006 UP-02, ADR-048) is not implemented; the hook hardcodes
AccessControl::default() and ChannelsPolicy cannot express an op ACL.
- WS-30 [minor] — the bare-registry default session cap is built per
request (FromRef) and bounds nothing; corrects review-002 WS-17.
- WS-31 [minor] — install_bootstrap_discovery silently shadows a
deployment's own services/list on WS sessions (upstream-mandated,
unrecorded).
- WS-32 [minor] — the router-state openables threading
(with_ws_openable_alpns) has no gate; every Unit-3 gate rides the
extension fallback.
Plus non-findings bounding the re-review (UP-01 arm, policy threading,
from_wss exclusion set, extension precedence, gate fidelity) and a
sequenced remediation plan.
Baseline at 64fa10b: 454 / 582 tests, clippy both, fmt, doc — all clean.
