---
id: review-002-bracketed-followup
name: Bracketed review-002 follow-up pass (post-bulk — stale-check, OAI-18 enforcement decision, CON-08/CON-09 close() lever, cross-crate re-check)
status: pending
depends_on: []
scope: narrow
risk: low
impact: project
level: planning
tags: [infra, review-002, follow-up, planning]
---

## Description

Tentatively planned follow-up pass (mirrors review-001's pattern: the
first four remediation tasks emerged from post-bulk drift). Do NOT
decompose until the review-002 bulk has landed — several items below
may go stale or change shape based on what the bulk decided. Scope
candidates, to be re-validated when picked up:

1. **OAI-18 enforcement decision** — `required`/`enum`/`pattern`/
   value-types are advertised via `/schema` but never enforced
   (key-allowlist only). The bulk tasks leave this as
   allowlist-plus-docs; the "compile-and-enforce the full input schema
   per op" option (jsonschema crate is already a dep via schema_cache)
   is the deferred alternative. Re-evaluate once
   review-002-yaml-normalization + review-002-oai13-path-item-wildcards
   land (both change the advertised-schema surface).
2. **CON-08 / review-001 CON-09 close() lever** — `from_mcp`'s
   documented session leak and `from_wss`'s no-teardown import are
   both accepted-for-v1 with documented contracts. If crates.io
   release timing or consumer feedback makes reconnect/teardown real,
   the `close()`-handle API is the v1.1 lever for both.
3. **Cross-crate re-check** — CF-001 (dead-mux write retryability),
   CF-002 (demux TooLarge allocation), CF-003 (wire publish_schema
   fail-open), CF-004 (services_schema_handler disclosure) in
   alkcall's ledger: re-check status when alkcall next gets attention;
   alkhttp-side assertions (ws-eof retryability tightening, PRJ-16
   defense-in-depth re-scope) may follow.
4. **Stale-comment sweep** — review-002 changes will touch hot docs
   (byte_adapter pump docs, adapter.rs router comments, forward.rs
   URL pipeline). A short sweep verifying module docs still match
   behavior after the bulk (the SRV-11 lesson: comments asserting
   axum semantics are exactly what went stale).
5. **ADR-045 version bump audit** — if projection-truthfulness and
   gateway-status tasks landed, verify `to_openapi`'s `info.version`
   reflects the accumulated contract changes per ADR-045.

## Acceptance Criteria

- [ ] Re-scoped into concrete tasks (or explicitly dismissed per item)
      once the review-002 bulk is complete
- [ ] Nothing acted on before the bulk lands (planning-level gate)

## References

- docs/reviews/002-post-remediation-review.md (Part E' OAI-18; Part A' CON-08 status; Unit 3-4 notes; ADR-045)
- docs/reviews/001-initial-implementation-review.md (the follow-up pattern this mirrors — 4 tasks emerged post-bulk)
- alkcall/docs/reviews/consumer-findings-ledger.md (CF-001..CF-004)
- tasks/infra/review-001-missing-docs-sweep.md (precedent: opportunistic follow-up closure)

## Notes

Left `depends_on: []` deliberately — taskgraph ordering for a
planning-level task should not serialize the bulk (it drains
independently and is picked up when the operator chooses). All four
precede-the-bulk items are marked in each task's Notes where relevant.