docs(tasks): decompose wave 3 — the server mappings

Six implementation tasks + the gate under tasks/implementation/,
chained sequentially (the mappings replace stubs in the same Handler
impl and share the decline-matrix test binaries):

- w3-seam-config: the serve-config's per-feature seam handles
  (alktty backends/ownership/selector; the alkgit quartet/pipeline/
  push-options flag) + the optional sibling deps — wave 3's first
  course correction to the wave-1 config surface
- w3-decline-tracing: the wave-2 gate's booked finding — the
  decline/serve-path tracing vocabulary, landed before the mappings
- w3-git-mapping: the full exec grammar replaces the wave-2 probe +
  the serve_duplex_resolved dispatch + the store-and-take handoff
- w3-tty-session: the translation bridge + the exit-derivation
  contract (rules 1-6, the signum table)
- w3-tunnel-direct: the route-1 bridge (accept only after the fabric
  open succeeds) + set_identity propagation + the capacity-across-
  fabric-window mechanics
- w3-tunnel-listen: the -R listen flow + the forwarded-tcpip data
  leg (the POC-untested leg; the stop-and-book provision)
- review-wave-3: the gate

The plan carries the wave-3 decomposition record with four
interpretations flagged for the gate (the serve-config course
correction, the already-discharged server-side sftp bullet, the
w3-tunnel-listen open mechanics, the booked-items' wave-3 homes).
taskgraph validate: 26 tasks, clean.

Sibling pins verified against crates.io at decomposition time:
alktty 0.8.1 / alkgit 0.1.0 / alktunnels 0.4.1 / alkcall 0.10.1.

docs/plans/implementation.md

@@ -45,7 +45,7 @@ mappings ∥ client direction) → validation & release.
 |---|---|---|---|
 | [1](#wave-1--foundations) | Manifest landing (russh pin, feature graph); error model; config surface (serve-config + dial-config + `Limits`); vault-backed key sources; host-key policy seam; fingerprint; test doubles | — | decomposed |
 | [2](#wave-2--the-server-stack) | `SshAdapter::handle` mount + `Config` construction; the auth bridge; parse-only dispatch + fail-closed decline core; spawn-and-return plumbing; bounded resources; loopback harness | wave 1 | decomposed |
-| [3](#wave-3--server-mappings) | session → alktty (translation bridge + exit derivation); git → alkgit (exec grammar + dispatch); tunnel → alktunnels route 1; sftp placeholder declines | wave 2 | pending |
+| [3](#wave-3--server-mappings) | session → alktty (translation bridge + exit derivation); git → alkgit (exec grammar + dispatch); tunnel → alktunnels route 1; sftp placeholder declines | wave 2 | decomposed |
 | [4](#wave-4--client-direction) | Dial surface; op rows (exec/pty, direct-tcpip, git exec); the `-R` leg (listen + acceptor registry); lifecycle primitives | wave 1 | pending |
 | [5](#wave-5--validation--release) | Decline-matrix contract suite; real-tool e2e; fuzzing; docs; **the publish** | waves 3 + 4 | pending |
 
@@ -288,6 +288,66 @@ wave 5's:
 Wave 3 decomposes after the wave-2 gate, absorbing whatever it
 corrects.
 
+**Decomposition record** (2026-10-28, after the wave-2 gate closed
+green): wave 3 decomposed into six task files under
+`tasks/implementation/` plus the gate. Shape: `w3-seam-config` first
+(the serve-config's per-feature seam handles + the optional
+`alktty`/`alkgit` deps — see the interpretations — the mappings
+dispatch against them, so it lands before the mappings); then
+`w3-decline-tracing` (the wave-2 gate's booked finding: the decline/
+serve-path event vocabulary, landed **before** the mappings so they
+inherit a uniform shape); then the three mapping branches
+deliberately sequential — `w3-git-mapping` (the full grammar replaces
+the wave-2 probe + the `serve_duplex_resolved` dispatch + the
+store-and-take handoff it lands first for the session task to reuse),
+`w3-tty-session` (the translation bridge + the exit-derivation
+contract — the biggest single-row surface), `w3-tunnel-direct` (the
+POC-proven route-1 bridge leg + identity `set_identity` propagation),
+and `w3-tunnel-listen` (the `-R` listen flow + `forwarded-tcpip`
+data leg — the POC-untested leg, sized with the stop-and-book
+provision); and `review-wave-3` (the gate) depending on all six. As
+with wave 2, the branch DAG is sequential: the three mappings replace
+stubs in the same `Handler` impl and share the decline-matrix test
+binaries, so no two tasks hold them in parallel — the branches are
+parallel *conceptually* (independent seams), sequential
+*logistically*.
+
+Interpretations recorded (flagged for the wave-3 gate):
+
+- **The serve-config extension is wave 3's first course correction to
+  the wave-1 config surface** — the assembly-supplied alktty/alkgit
+  seam handles the mappings' seam signatures take (the tty backends
+  map + selector + ownership provider; the alkgit backend quartet +
+  pipeline semaphore + push-options flag) were never carried by the
+  wave-1 config bullet, and `w3-seam-config` lands them feature-gated
+  with the optional sibling deps (`alktty = "0.8.1"`, `alkgit =
+  "0.1.0"` — crates.io-verified at decomposition) before the
+  mappings; `alktunnels = "0.4.1"` still lands with its first
+  consuming code (`w3-tunnel-direct`) to avoid a dead entry. The
+  unset-declines posture extends to the new handles (unset → the
+  owned rows decline even with the feature on).
+- **The server-side sftp bullet is already discharged** — the OQ-13
+  decline rows landed with `w2-dispatch-decline-core` (every subsystem
+  name declines in every build) and are already contract-tested per
+  build in `tests/dispatch_core.rs`; no wave-3 task exists for it —
+  the client-side placeholder folds into wave 4's acceptor/op-row
+  work and the wave-5 matrix covers both rows explicitly.
+- **The `-R` listen flow carries the wave-3 gate's biggest open** —
+  the fabric-side inbound-forwarded mechanics (who dials the
+  forwarded op at the door, whether the assembly-supplied
+  `Arc<ChannelClient>` composition can carry the door-side accept or
+  the serve-config's tunnel handle must grow) is decided in
+  `w3-tunnel-listen` against alkcall 0.10.1 / alktunnels 0.4.1's
+  published surfaces; if the topology does not close, the task stops
+  and books it for the gate — nothing is silently forked or absorbed.
+- **The wave-2 gate's three booked items all have wave-3 homes** — the
+  decline-path tracing task (`w3-decline-tracing`), the forwarded-
+  tcpip acceptor vocabulary (`w3-tunnel-listen`, with the client-side
+  accept hook landing in the harness), and the deferred identity-
+  landing assertion (each mapping asserts the resolved identity
+  reaches its seam; the tunnel branch additionally propagates it via
+  `set_identity` — auth.md §Server direction step 4).
+
 ## Wave 4 — Client direction
 
 The door outward (independent of wave 3 — shares only wave 1's