assembly: the cross-cutting integration suite + docs sync (batch 2 closes)

- tests/assembly-integration.rs (7 tests, local + composed): the full
  -D story (vanilla cred-bearing client -> TCP door + UDP door ->
  producer w/ local providers -> real echo targets; CONNECT + BIND +
  ASSOCIATE live, one-command-per-connection, teardown + fresh
  sessions), the composed story (direct_egress + bindfirst_accept +
  real TCP dial; all three commands; the lazy-table dial-count
  witness), mixed assembly (channels-native + door clients on one
  registration; composed seams beside native sessions), the assembly
  teardown matrix (UDP-door idle bound; channel reaped; fresh
  association after), the producer door driving all three commands,
  and the -D domain-target pin (resolution at the producer's seam,
  ADR-012).
- Fix the drift the suite surfaced: ComposedEgress::next_reply ended
  fresh (never-opened-table) associations at birth — the ended-relay
  Err now fires only once a tunnel existed and every relay ended; the
  fresh table parks (the readiness contract). Regression-pinned in
  tests/composed-egress.rs (fresh_association_parks_before_any_
  tunnel_is_opened).
- Harness: the composed-accept machinery single-sourced into
  tests/harness.rs (the composed suites' shapes + the five-gate
  composed identity); composed-accept.rs consumes the shared shapes.
- Docs sync: README Current State (the assembly layer landed; both
  suites named), lib.rs crate docs (the assembly-layer paragraph),
  consumer.md (the TokenClient door-only contract + the
  one-command-per-connection posture reconciled).
- Task assembly-integration-suite: completed; Notes + Summary filled
  (the local-on-wasm failure observed: mio's unsupported-wasm error).

Verification: cargo test (375), cargo test --all-features (615),
clippy --all-targets -D warnings (default + all-features), fmt --check,
doc --no-deps (0 warnings), both wasm checks (default + composed),
local-on-wasm fails as designed.

docs/architecture/README.md

@@ -1,7 +1,8 @@
 ---
 status: draft
-last_updated: 2026-09-24 (the protocol core landed + the cross-cutting
-integration suite; the rfc1928 doc's targeted fork 2026-09-22; the
+last_updated: 2026-09-25 (the assembly layer landed + the cross-cutting
+assembly integration suite; the protocol core landed + the cross-cutting
+integration suite 2026-09-24; the rfc1928 doc's targeted fork 2026-09-22; the
 vendor extraction amendment ADR-011 §Amendment 2026-09-21; Phase 1
 initial draft 2026-09-20 — the OQ-SK ledger promoted into ADRs
 001-012 and open-questions.md)
@@ -20,17 +21,17 @@ architecture spec docs and the ADRs.
 
 ## Current State
 
-Phase 1 (Architecture) — the **protocol core is implemented**. Phase
+Phase 1 (Architecture) — the **protocol core and the assembly layer
+are implemented**. Phase
 0 (`docs/research/phase-0.md`) is converged (2026-09-14) and
 POC-complete (all numbered POCs passed or were dropped with the scope
 decision); the OQ-SK ledger's Phase 1 inputs are collected and
-promoted into ADRs 001–013. All docs are `draft` — they transition
+promoted into ADRs 001–014. All docs are `draft` — they transition
 to `reviewed` when their open questions resolve and the architecture
 review passes.
 
-The landed core (the protocol-only batch; no `local`/`composed` code
-exists yet): the RFC 1928 core in `src/rfc1928/` (the targeted fork,
-ADR-013 — the vendor group's six tasks landed and passed the
+The landed surface: the RFC 1928 core in `src/rfc1928/` (the targeted
+fork, ADR-013 — the vendor group's six tasks landed and passed the
 extraction review), the ASSOCIATE datagram frame codec (`src/wire.rs`,
 ADR-003), the open-op params + typed error surface (`src/params.rs` /
 `src/error.rs`, ADR-001), the three seam types (`src/egress.rs`,
@@ -38,9 +39,17 @@ ADR-004), the producer half (`src/producer.rs` — the session-gate
 establisher, the command-dispatch pump, the three commands, the scope
 gates), and the consumer half (`src/consumer.rs` — the
 connect/associate/bind session types with teardown ownership). The
-batch-1 cross-cutting integration suite (`tests/core-integration.rs`)
-pins the core's whole behavior end to end; the `local` and
-`composed` provider groups follow (batch 2).
+assembly layer (batch 2) landed with it: the `local` providers
+(`src/local/` — tcp_dial / udp_egress / bind_accept, the producer-side
+`ProducerDoor`, ADR-008/009), the front doors (`src/door.rs` — the
+NoAuth raw-pipe + RFC 1929 cred-bearing TCP door, the BIND door, the
+UDP door, ADR-005/003/014), and the composed providers
+(`src/composed/` — the direct-op egress + the bind-first accept over
+alktunnels 0.2.0, ADR-007/008). Both cross-cutting integration suites
+pin the behavior end to end: `tests/core-integration.rs` (the
+protocol core) and `tests/assembly-integration.rs` (the assembly
+layer — the full `-D` story through the doors, the composed variant
+set, mixed assembly, the assembly teardown matrix).
 
 ## Documents