core: the cross-cutting integration suite + docs sync

The batch-1 closing task: nine cross-cutting integration tests
(tests/core-integration.rs) pinning the whole protocol core end to
end over the channels harness, plus the architecture-sync docs pass.

Tests:
- One registration, all three commands: CONNECT + ASSOCIATE + BIND
  interleaved live on the one channels/socks5/sub op; a teardown
  ends only its own session (mux/demux isolation) — the POC #2/#5
  regression guard, complete.
- Concurrency: nine concurrent mixed-command sessions (raw topology)
  and six through the typed consumer sessions (consumer-side
  topology) — the mux/demux pinned in both channel-id allocation
  directions; fresh round-trips after the burst; no channel leaks.
- Teardown matrix (wire.md §Sentinels and lifecycle): CONNECT
  half-close, ASSOCIATE EOF, BIND client-gone (a parked accept so
  the quiet-wait exit is deterministic) — each followed by fresh
  sessions of every command (no connection poisoning).
- Identity/scope matrix (ADR-006 end to end): open-only (CONNECT +
  ASSOCIATE serve, BIND refused 0x02 at the command gate), bind-only
  fail-closed at the open gate for all commands (the spec drift the
  task's phrasing carried, reconciled — ADR-006's open gate requires
  socks5:open unconditionally), both-scopes (everything, granted
  explicitly); the CF-006 witness asserted per row.
- The readiness contract re-pinned under concurrent load: a
  hot-Ok(None) egress across concurrent associations does not starve
  the datagram stage's channel branch.

Docs sync: README Current State ("the protocol core is implemented"
+ the landed inventory; the decomposition residue gone); consumer.md
§Wiring reconciled to the landed session signatures; ADR-006
§Consequences states the grant asymmetry explicitly; lib.rs crate
docs describe the landed surface.

Verification: cargo test 302 green; --all-features green; clippy
--all-targets -D warnings clean; fmt --check clean; both wasm checks
clean; cargo doc --no-deps clean. Batch boundary holds: no
local/composed code, the default crate is protocol-only.

src/lib.rs

@@ -9,14 +9,49 @@
 //! binds a port — kernel binds exist only as explicit, feature-gated
 //! assembly shapes (`local`), never in the protocol layer.
 //!
-//! The RFC wire vocabulary and the explicit typestate live in
-//! [`rfc1928`]: a targeted fork of fast-socks5 v1.0.0's `T`-generic
-//! subset (MIT, third-party upstream) carrying two deliberate changes
-//! (BIND support, `new_reply` publication) — see
-//! `docs/architecture/rfc1928.md`, ADR-013, and ADR-011.
+//! ## The landed surface (the protocol core)
+//!
+//! - **The wire vocabulary and the explicit typestate** live in
+//!   [`rfc1928`]: a targeted fork of fast-socks5 v1.0.0's `T`-generic
+//!   subset (MIT, third-party upstream) carrying two deliberate
+//!   changes (BIND support, `new_reply` publication) — see
+//!   `docs/architecture/rfc1928.md`, ADR-013, and ADR-011.
+//! - **The wire codec** ([`wire`]): the ASSOCIATE datagram frame
+//!   (`[len: u16 BE][addr + data]`, ADR-003) — framing is applied
+//!   exactly once, by this layer; the egress speaks inner bytes.
+//! - **The wire-stable open-op surface** ([`params`]): the
+//!   `channels/socks5/sub` op id, the `alk/socks5` ALPN, the
+//!   trivial `{}` params (ADR-001), and the two scope constants
+//!   (`socks5:open`, `socks5:bind` — two grants, never implied,
+//!   ADR-006). The typed open-error vocabulary lives in [`error`].
+//! - **The three seams** ([`egress`]): `DialFn` / `EgressFactory` /
+//!   `BindAcceptFactory` (ADR-004) — functions, not traits, at the
+//!   three I/O planes; ownership rides the handle structurally; the
+//!   egress readiness contract (`next_reply` `Pending` when nothing
+//!   is ready) is load-bearing API.
+//! - **The producer half** ([`producer`]): the session-gate
+//!   establisher, the command-dispatch pump (CONNECT pass-through /
+//!   ASSOCIATE datagram stage / BIND phase model), the scope gates
+//!   (the open gate `socks5:open` at the registry; the command gate
+//!   `socks5:bind` at BIND dispatch), and
+//!   [`register_socks5_openable`] — substrate-agnostic over the
+//!   seams; never a bind in the protocol layer.
+//! - **The consumer half** ([`consumer`]): the typed channels-native
+//!   sessions — [`Socks5ChannelSession`] (CONNECT),
+//!   [`AssociateSession`] (the framed datagram stage),
+//!   [`BindSession`] (the reply#1/reply#2 reader) — each owning its
+//!   channel's teardown; no `Clone`.
+//!
+//! `local` and `composed` (the feature-gated assembly-layer
+//! providers: the front doors, the socket-backed/composed seams) are
+//! not yet present — the default crate is protocol-only and
+//! wasm-clean by construction (ADR-009).
 //!
 //! Architecture: `docs/architecture/overview.md` (spec set:
-//! wire.md, producer.md, consumer.md, rfc1928.md).
+//! wire.md, producer.md, consumer.md, rfc1928.md); the cross-cutting
+//! behavior is pinned end to end by `tests/core-integration.rs`
+//! (one registration, all three commands; concurrency; the teardown
+//! matrix; the identity/scope matrix; the readiness contract).
 
 #![forbid(unsafe_code)]