docs: add ADR-009 (open op's input is the negotiation); fix stale doc refs

Review of the 2026-09-05 session commits:

- the ADR-009 decision cited by 96692d3 and docs/reviews/001 was never
  written — added decisions/009-channels-open-op-is-the-negotiation.md
  (context: the L1 two-gate disagreement, alkcall 0.4.0/0.4.1
  prerequisites, producer/consumer design, consequences, door type)
- channels.rs module doc + register_openable doc still described the
  old wire-frame negotiation read (drive_session) — aligned with
  drive_session_pre_negotiated and the enforced input schema
- tty-adapter.md: session-driver section + ADR tables now reference
  ADR-009 and the pre-negotiated driver; overview.md ADR index row

Verification: cargo test 93 lib (default) / 136 (--all-features);
clippy -D warnings native + wasm clean; fmt clean; doc 0 warnings.

docs/architecture/tty-adapter.md

@@ -62,9 +62,14 @@ The `drive_session` function is the per-stream session driver — the
 counterpart to the POC's `session::drive_session`, generalized from the
 local PTY backend to the `TtyBackend` trait. It is also the function the
 channels path reuses — per [ADR-008](decisions/008-channels-pure-channel-multiplexing.md),
-TTY always uses its 5-byte format, so the same `drive_session` runs in
+TTY always uses its 5-byte format, so the same driver runs in
 both direct `alk/tty` and channels `alk/channels` modes; only the
-`BiStream` source differs.
+`BiStream` source differs. The two paths differ in where the
+`NegotiateRequest` comes from: the direct path reads the wire-frame
+negotiation (ADR-001 §"Negotiation Frame"); the channels path parses
+the open op's registry-validated `input` and runs
+`drive_session_pre_negotiated` (ADR-009 — the channels path carries no
+second negotiation frame on the channel's data stream).
 
 ## Why
 
@@ -351,7 +356,8 @@ architectural commitment.
 | `TtyBackend` trait and `TtyHandle` | [ADR-002](decisions/002-ttybackend-trait-and-ttyhandle.md) | The backend the adapter dispatches to; the handles the adapter pumps |
 | Exit code on a control chunk | [ADR-004](decisions/004-exit-code-on-control-chunk.md) | The "exit chunk is last" invariant the adapter enforces |
 | Backend cleanup on session cancel | [ADR-005](decisions/005-backend-cleanup-on-session-cancel.md) | Dropping `exit_code` future kills the session target; the adapter triggers it by dropping the `TtyHandle` on cancel |
-| Channels pure channel multiplexing | [ADR-008](decisions/008-channels-pure-channel-multiplexing.md) | `drive_session` runs unchanged in both direct and channels modes; only the `BiStream` source differs |
+| Channels pure channel multiplexing | [ADR-008](decisions/008-channels-pure-channel-multiplexing.md) | The same session driver runs in both direct and channels modes; only the `BiStream` source differs |
+| Negotiation carried in the open op | [ADR-009](decisions/009-channels-open-op-is-the-negotiation.md) | The channels path carries no second negotiation frame; the open op's registry-validated `input` is the negotiation (`drive_session_pre_negotiated`) |
 | Dynamic resource ownership | alknet ADR-050 | Terminal sessions as runtime-spawned resources; the adapter's access-control shape |
 
 ## Open Questions
@@ -370,7 +376,10 @@ architectural commitment.
   cancel-cleanup contract the adapter triggers by dropping the
   `TtyHandle` on session cancel
 - [ADR-008](decisions/008-channels-pure-channel-multiplexing.md) — why
-  `drive_session` runs unchanged in channels mode
+  the same session driver runs in channels mode
+- [ADR-009](decisions/009-channels-open-op-is-the-negotiation.md) — the
+  channels path carries no second negotiation frame (the open op's
+  `input` is the negotiation)
 - alknet ADR-050 — the ownership model the adapter's access control
   declares against
 - alknet ADR-007 — `Connection`, `accept_bi`, the handler-receives-