review-003: the assembly-layer full review — F-1/F-2 fixed, the residue dispositioned

- Review 003 written (docs/reviews/003-assembly-layer-implementation-
  review.md): the batch-2 assembly layer post-landing, the review-002
  template — correctness/security/smells/coverage over the five
  batch-2 modules + the batch-2 consumer/producer diff surface.
  Baseline: 375 default / 620 all-features green, clippy/fmt/doc
  clean, both wasm checks clean, publish dry-run completes,
  llvm-cov 93.68% lines / 91.01% functions.

- F-1 (major, fixed): the cred-bearing door swallowed every in-band
  refusal's mapped reply code (the CONNECT/BIND session-open errors
  and the accept-stage Err were bare closes) — a vanilla client got
  no reply where ADR-007 pins a reply-code-shaped refusal. Fixed with
  a write_refusal_reply helper (the door's boundary codec, RFC
  placeholder BND.ADDR) at all three sites, pinned by
  cred_door_in_band_refusal_surfaces_the_reply_code.

- F-2 (major, fixed): UdpFrontDoor::serve_on returned Ok(()) on a
  fatal relay-socket I/O failure against its own doc contract —
  the Io exit now surfaces as Err; the idle/association/session
  exits stay clean.

- Findings recorded, not fixed (the release-polish round's residue):
  D-1 (associate_with_token 0% covered), D-2 (the composed-egress
  failure matrix), D-3 (the io-kind refusal-table arms), S-1 (the
  UDP door's learned client address), N-1..N-8 (doc lines, posture
  notes, coverage residue).

Verification: cargo test (375) + --all-features (620) green,
clippy --all-targets --all-features -D warnings clean, fmt --check
clean, doc --no-deps clean, both wasm checks clean, publish
dry-run completes.

tests/door-tcp.rs

@@ -607,6 +607,79 @@ async fn bind_door_vanilla_conversation_reply_fidelity() {
     drop(app);
 }
 
+/// The in-band refusal's reply code is re-encoded to the vanilla
+/// client (the RFC codec at the door boundary): an identity carrying
+/// `socks5:open` only issues BIND through the cred-bearing door —
+/// the in-band command gate refuses 0x02, and the door re-encodes
+/// that code as reply#1 (never a bare EOF; the refused reply carries
+/// the placeholder zero address).
+#[tokio::test]
+async fn cred_door_in_band_refusal_surfaces_the_reply_code() {
+    let dial = alksocks::tcp_dial();
+    let table = alksocks::CredentialTable::new(vec![alksocks::DoorCredential {
+        username: "open-only".to_string(),
+        password: "pw".to_string(),
+        identity: Identity {
+            id: "door-open-only".to_string(),
+            scopes: vec![alksocks::SOCKS5_OPEN_SCOPE.to_string()],
+            resources: Default::default(),
+        },
+    }]);
+
+    let topo = harness::wire_consumer_side_with_provider(
+        dial,
+        None,
+        None,
+        Some(consumer_identity()),
+        Arc::new(DoorTokenProvider {
+            bind_scoped: vec![],
+        }),
+    )
+    .await;
+
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+    let addr = listener.local_addr().expect("door addr");
+    let door = FrontDoor::builder()
+        .credentials(table)
+        .bind(addr)
+        .build()
+        .expect("the door builds");
+    let _serve = tokio::spawn({
+        let client = Arc::clone(&topo.consumer);
+        async move {
+            door.serve_on(listener, client)
+                .await
+                .expect("the door serves")
+        }
+    });
+
+    let mut vanilla = VanillaClient::dial(addr).await;
+    let method = timeout(BOUND, vanilla.greet_password())
+        .await
+        .expect("greeting");
+    assert_eq!(method, consts::SOCKS5_AUTH_METHOD_PASSWORD);
+    let status = timeout(BOUND, vanilla.send_credentials("open-only", "pw"))
+        .await
+        .expect("credential exchange");
+    assert_eq!(status, 0x00, "accepted");
+
+    // BIND through the open-only identity: the in-band command gate's
+    // 0x02 rides the door's re-encoded reply (the placeholder BND.ADDR
+    // — a refused reply carries a zero address).
+    let (code, advertised) = timeout(BOUND, vanilla.bind_v4([127, 0, 0, 1], 0))
+        .await
+        .expect("the refusal reply arrives (never a bare EOF)");
+    assert_eq!(
+        code,
+        consts::SOCKS5_REPLY_CONNECTION_NOT_ALLOWED,
+        "the in-band gate's 0x02 is re-encoded door-side"
+    );
+    assert!(
+        matches!(advertised, TargetAddr::Ip(sa) if sa.port() == 0 && sa.ip().is_unspecified()),
+        "a refused reply carries the placeholder BND.ADDR: {advertised:?}"
+    );
+}
+
 /// The idle-first-byte timeout (ADR-014 knob 1): an accepted
 /// connection that sends no first byte within the window is closed
 /// door-side.