review: the batch-2 gate closed — the assembly layer verified, R-1/R-2 fixed

Review checkpoint closing batch 2 (the assembly layer). The gate
opens: the never-binds posture, seam contracts, door fidelity, the
bind-first graduation, feature-gate hygiene, and POC fidelity all
verify clean; two findings were corrected in the review change.

Findings corrected:

- R-1 (major): the UDP front door's in-band decode created a fresh
  DatagramReader per call and kept only the first frame of a batch —
  POC #2's first-cut bug (reader state must persist across calls;
  batched datagrams were silently dropped, mid-frame EOF was silent).
  Fix: an owning InbandBridge (persistent reader + pending queue +
  fail-loud mid-frame EOF, the AssociateSession shape) threaded
  through the channel->socket pump; pinned by three bridge unit
  tests (which fail against the per-call reader) and an end-to-end
  doubled-echo door-udp test.
- R-2 (convention 2): seven non-test expects -> typed errors —
  DoorBuildError (both door builders' .build() is now Result),
  ProducerDoorBuildError/ProducerDoorError (the bind decision is
  serve's typed error), the composed table invariant as an egress
  error, register_forwarded_serving -> Result (the alkcall
  diagnostic surfaced), TokenClientError (wrap on a spent client).
  New error types re-exported; test call sites updated.
- R-3/R-4 (doc residues): producer.md's local-backend section
  described a channel pipe — the landed ProducerDoor serves
  serve_socks5_over on the accepted socket directly;
  associate_with_token's doc (the TCP door refuses ASSOCIATE, never
  calls it); SessionOwner's doc (the accept uses SyncHalves/
  OwnedWrite).

Verification: cargo test (default) green; cargo test --all-features
green; cargo clippy --all-targets [--all-features] -- -D warnings
clean; cargo fmt --check clean; both wasm checks clean (default +
composed); local-on-wasm fails at mio as designed; cargo doc
--no-deps clean.

Task: tasks/implementation/review-assembly-layer.md (status:
completed; the batch-2 gate opens release polish).

docs/architecture/producer.md

@@ -130,24 +130,31 @@ Contracts (POC-pinned, load-bearing):
 
 The optional shape where the producer serves from a real listener:
 a feature-gated backend binds `socks5://127.0.0.1:port` (or any
-address) and pipes each accepted TCP connection raw onto a channels
-`BiStream` (`copy_bidirectional`, zero protocol translation — POC
-#1's curl front door validated the pipe shape). The same door shape
-in reverse: this is a *front door for the producer side* — vanilla
-clients reach a locally-served SOCKS5 resource through it. The door
-surface (NoAuth raw pipe vs RFC 1929 cred-bearing, ADR-005) is the
-consumer door's code shape (see [consumer.md](consumer.md)).
+address) and hands each accepted TCP connection to the landed
+substrate-free entry `Socks5Producer::serve_socks5_over` directly —
+the RFC conversation runs on the accepted socket (the NoAuth
+in-stream shape: greeting, command, reply, data plane, all on the
+accepted socket), and the seams dial/egress/accept locally. The same
+door shape in reverse: this is a *front door for the producer side*
+— vanilla clients reach a locally-served SOCKS5 resource through it
+(`src/local/producer_door.rs`, the `ProducerDoor`/builder/guard
+surface). A cred-bearing variant (RFC 1929) would wrap
+`accept_password_auth` before `serve_socks5_over` — a documented
+follow-up, not landed.
 
 The door's accept path owns the idle defense the protocol layer does
-not provide (ADR-014): an accepted connection that sends no first
-byte within a configured window is closed door-side (an accepted
-socket is not a channel — the cap regime does not bound it), plus
-per-credential/per-peer session caps and accept-queue bounds as the
-deployment's policy.
+not provide (ADR-014): an accepted connection that sends no first byte
+within a configured window is closed door-side (an accepted socket is
+not a channel — the cap regime does not bound it), plus the
+max-concurrent-sessions cap (an accept beyond the bound is refused
+door-side, no session spawned) — the two constructor knobs.
 
 The producer-side local *backend* for the I/O planes (the
 local-socket providers — TCP dial, UDP egress, BIND listener) is
-ADR-008's variant set, also feature `local`.
+ADR-008's variant set, also feature `local`. The BIND command gate
+on this path is the builder's `bind_policy` (there is no open-op
+identity on an accepted socket — the accepted socket is the whole
+caller; the pump handler's identity-derived gate does not apply).
 
 ## Wiring (Assembly Layer)