docs(architecture): resolve review #002 Tiers 1-3 — mechanical and consistency fixes

Governance (Tier 2):
- Advance ADR-022 and ADR-023 from Proposed to Accepted (specs already
  depend on their types as source of truth)
- Amend ADR-015: mark Decision 3 and Assumption 6 as superseded by ADR-022;
  update handler_identity type to CompositionAuthority
- Amend ADR-002: note handle() signature revised by ADR-007 (BiStream → Connection)
- Amend ADR-004: note 'enrich/replace' AuthContext language superseded by
  ADR-011's immutability model; update to describe set_identity on Connection
- Update main README ADR table to show ADR-022/023 as Accepted

Spec-ADR consistency (Tier 3):
- Add abort_policy: AbortPolicy field to OperationContext struct (ADR-016
  Decision 6 mandated this but the spec omitted it)
- Define AbortPolicy enum (AbortDependents | ContinueRunning) with Default impl
- Add abort_policy to build_root_context and LocalOperationEnv::invoke()
- Define the OperationEnv trait explicitly with invoke() and
  invoke_with_policy() methods (was referenced as 'must remain a trait'
  but never defined)
- Specify From<StreamError> for HandlerError impl with exact variant mapping
- Add Connection::from_quinn() / from_iroh() constructors (was referenced
  as Connection::new() but never defined)
- Remove undefined CertAuthorityEntry placeholder from AuthPolicy v1 (will
  be added additively when alknet-ssh lands)
- Fix config.md key-differences table: rate limits are in DynamicConfig,
  not StaticConfig

Mechanical fixes (Tier 1):
- overview.md: 'closes the QUIC stream' → 'closes the connection' (stale
  from pre-ADR-007 model)
- overview.md: OQ-04 entry updated from stale 'defer to implementation'
  to 'resolved: static at startup'
- mnemonic-derivation.md: remove duplicate helper functions block (incomplete
  first copy, complete second copy)
- ADR-003: add iroh (feature-gated) to alknet-core dependency list, added
  by ADR-010
- ADR-021: fix ambiguous 'W1 drift issue from the vault review' cross-reference
- ADR-022: rephrase FromCall 'leaf locally' to 'leaf in the local registry'
- ADR-017: add error_schemas to from_call mirror list and services/schema
  step (inconsistency with ADR-023)
- ADR-016: fix self-referential citation ('ADR-016 Assumption 5' → 'Assumption 5')
- Add ScopedOperationEnv::empty(), allows(), new() and
  CompositionAuthority::none(), new() impl blocks (referenced but undefined)
- Add call.completed clarification for non-subscription calls
- Add services/schema leading-slash normalization note
- Crate README ADR tables: add missing ADR-013 (call), ADR-015 (core),
  ADR-006 + ADR-010 (vault)
- Vault README: add consolidated 'Known Source Drift' table tracking all
  four drift items (OsRng, unwrap, CURRENT_KEY_VERSION, spawn bug) in one
  place, including the two previously missing from README

docs/architecture/crates/call/README.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-06-22
+last_updated: 2026-06-22-22
 ---
 
 # alknet-call
@@ -21,6 +21,7 @@ Structured RPC over QUIC: operations, request/response, streaming subscriptions,
 | [001](../../decisions/001-alpn-protocol-dispatch.md) | ALPN-Based Protocol Dispatch | CallAdapter registers on ALPN `alknet/call` |
 | [002](../../decisions/002-protocol-handler-trait.md) | ProtocolHandler Trait | CallAdapter implements ProtocolHandler |
 | [003](../../decisions/003-crate-decomposition.md) | Crate Decomposition | alknet-call depends on alknet-core and irpc |
+| [013](../../decisions/013-rust-canonical-implementation.md) | Rust as Canonical Implementation Language | Adapter traits defined in Rust; TS is reference/browser adaptation |
 | [004](../../decisions/004-auth-as-shared-core.md) | Auth as Shared Core | AuthContext passed to call handlers |
 | [005](../../decisions/005-irpc-as-call-protocol-foundation.md) | irpc as Call Protocol Foundation | irpc provides framing and service dispatch |
 | [006](../../decisions/006-alpn-convention-and-connection-model.md) | ALPN String Convention | `alknet/call` ALPN, one ALPN per connection |

docs/architecture/crates/call/call-protocol.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-06-22
+last_updated: 2026-06-22-22
 ---
 
 # Call Protocol
@@ -105,6 +105,10 @@ Five event types carry request/response and subscription semantics:
 
 The `id` field carries the `requestId` for correlation.
 
+`call.completed` is sent only for subscriptions. A plain `call()` (request/response)
+is complete after its single `call.responded`; no `call.completed` follows. The
+`PendingRequestMap` entry for a `Call` is deleted on the first `call.responded`.
+
 ### `call.requested` Payload
 
 The `payload` of a `call.requested` event has this shape:
@@ -297,6 +301,7 @@ fn build_root_context(
         metadata: HashMap::new(),        // fresh per request
         env: registration.scoped_env.clone()
             .unwrap_or_else(ScopedOperationEnv::empty),  // from the bundle, empty for leaves
+        abort_policy: AbortPolicy::default(),  // abort-dependents (ADR-016 Decision 6)
         internal: false,                 // external call — ACL against caller identity
     }
 }

docs/architecture/crates/call/operation-registry.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-06-22
+last_updated: 2026-06-22-22
 ---
 
 # Operation Registry
@@ -116,12 +116,36 @@ pub struct OperationContext {
     pub capabilities: Capabilities,
     pub metadata: HashMap<String, Value>,
     pub env: OperationEnv,
+    /// Abort policy for this call's descendants (ADR-016 Decision 6).
+    /// Default `AbortDependents` — aborting this request aborts all
+    /// non-terminal descendants. `ContinueRunning` is an opt-in for
+    /// long-running work that should survive a parent's abort. Set by the
+    /// composing handler via `OperationEnv::invoke()` (or
+    /// `invoke_with_policy()`), not by the wire caller.
+    pub abort_policy: AbortPolicy,
     /// Composition-origin flag. Set by `OperationEnv::invoke()` (true) or the
     /// `CallAdapter` dispatch path (false) — never by handlers. Module-private
     /// for writes; read via `is_internal()`. See ADR-015.
     pub(crate) internal: bool,
 }
 
+/// Abort cascade policy for a call's descendants (ADR-016).
+///
+/// `AbortDependents` (default): aborting this call cascades to all
+/// non-terminal descendants.
+///
+/// `ContinueRunning` (opt-in): descendants that have already started
+/// continue to completion; descendants that haven't started are aborted;
+/// no new descendants start.
+pub enum AbortPolicy {
+    AbortDependents,
+    ContinueRunning,
+}
+
+impl Default for AbortPolicy {
+    fn default() -> Self { Self::AbortDependents }
+}
+
 impl OperationContext {
     pub fn is_internal(&self) -> bool { self.internal }
 }
@@ -195,7 +219,45 @@ The CLI binary (or assembly layer) constructs the registry and passes it to the
 
 ### OperationEnv
 
-`OperationEnv` is the universal composition mechanism. A handler calls `context.env.invoke("fs", "readFile", input, &context)` and gets a `ResponseEnvelope` back — regardless of whether the operation runs locally, via an irpc service, or on a remote node.
+The `OperationEnv` trait is the universal composition mechanism. A handler calls `context.env.invoke("fs", "readFile", input, &context)` and gets a `ResponseEnvelope` back — regardless of whether the operation runs locally, via an irpc service, or on a remote node.
+
+```rust
+/// The composition dispatch trait. A handler composes child operations
+/// through its `OperationContext.env` (which implements this trait).
+///
+/// This must remain a trait, not a concrete type — session-scoped
+/// registries (OQ-19) depend on wrapping the global env via trait
+/// layering. Making `OperationEnv` concrete or hardcoding the global
+/// registry into the dispatch path would close the session-overlay
+/// pattern.
+#[async_trait]
+pub trait OperationEnv: Send + Sync {
+    /// Compose a child operation. The child's `OperationContext` is
+    /// constructed with `internal: true`, inheriting the parent's
+    /// composition authority as the child's caller identity. The abort
+    /// policy defaults to the parent's (ADR-016 Decision 6).
+    async fn invoke(
+        &self,
+        namespace: &str,
+        operation: &str,
+        input: Value,
+        parent: &OperationContext,
+    ) -> ResponseEnvelope;
+
+    /// Compose a child with an explicit abort policy (ADR-016 Decision 6).
+    /// Use `AbortPolicy::ContinueRunning` for long-running work that
+    /// should survive a parent's abort. The default `invoke()` inherits
+    /// the parent's policy; this method overrides it for this child.
+    async fn invoke_with_policy(
+        &self,
+        namespace: &str,
+        operation: &str,
+        input: Value,
+        parent: &OperationContext,
+        policy: AbortPolicy,
+    ) -> ResponseEnvelope;
+}
+```
 
 The `parent` parameter propagates the calling context: the nested call gets `parent_request_id: Some(parent.request_id)`, inherits `parent.handler_identity` as the caller identity, and is marked `internal: true`.
 
@@ -242,6 +304,9 @@ impl OperationEnv for LocalOperationEnv {
             metadata: HashMap::new(),                         // Fresh — does NOT propagate parent metadata (ADR-014)
             env: registration.scoped_env.clone()
                 .unwrap_or_else(ScopedOperationEnv::empty),  // Child's own scoped env (empty for leaves)
+            // Abort policy: inherit the parent's policy by default (ADR-016).
+            // The parent handler can override via `invoke_with_policy()`.
+            abort_policy: parent.abort_policy.clone(),
             internal: true,                                   // Nested calls use handler authority
         };
         self.registry.invoke(&name, input, context).await
@@ -283,7 +348,14 @@ These are read-only — no admin operations are exposed through the call protoco
 }
 ```
 
-`services/schema` accepts `{ "name": "fs/readFile" }` and returns the full `OperationSpec` including input/output JSON Schemas and declared `error_schemas` (ADR-023). This enables client code generation: a client reading the schema can produce typed error enums instead of generic error handling.
+`services/schema` accepts `{ "name": "fs/readFile" }` (no leading slash —
+registry form, same as `OperationSpec.name`) and returns the full
+`OperationSpec` including input/output JSON Schemas and declared
+`error_schemas` (ADR-023). The `CallAdapter` normalizes the leading slash
+from wire `operationId`s before lookup, so `services/schema` accepts both
+`fs/readFile` and `/fs/readFile`. This enables client code generation: a
+client reading the schema can produce typed error enums instead of generic
+error handling.
 
 ### irpc Integration