review: the fix-round gate closed — every review-002 finding verified, batch 2 opens

The closing checkpoint (tasks/implementation/review-fix-round-002.md):
each review-002 finding verified closed against the landed tree, the
full verification sweep green, conventions re-swept, and the gate
condition (ADR-014 accepted, no major finding) holds.

Per-finding verification (all nine checklist points):
- C-1: the take-guard verified — a second await_inbound returns the
  spent shape Ok(None), the re-read structurally impossible (the plane
  owns the stream); pinned by the double-read + reply1-twice tests.
  D-1's one-reader decision recorded (option (a), BindReply1 cut).
- C-3 closed: the builder's explicit bind_policy is the substrate-free
  gate; the presence reading is only the backward-compat default; the
  pump handler's identity-derived gate byte-identical.
- D-2 closed: the full builder chain through .register(...) serves all
  three commands end to end (RegisterMode::ProducerBuilder + the
  integration test, identity witness asserted).
- N-1/N-4 coherent: the cut list gone (zero references), keep-notes
  current, the Refused vocabulary honest at all five sites + the
  harness's minimal producer, wire untouched, provenance extended.
- D-3 resolved (declare side): the channel:open_failed ErrorDefinition
  declared, schema pinned drift-free against the typed parse table.
- N-8 re-run: 96.30% regions / 97.28% lines; every named line covered;
  the residual attributed (accept_bi log arm, fork accepted-uncovered,
  test panic-guards) — no new load-bearing gaps.
- N-5/N-6 verified: the shared module compiles into both crates via
  the crate-root mount + extern-crate-self alias; open_and_negotiate
  single-sources the teardown-at-birth prologue.
- C-2 decided: ADR-014 accepted (option 1 — teardown-governed phases),
  the spec lines carry the posture.
- Cross-cutting sweep green: test 375 green (+ all-features, local,
  composed), clippy -D warnings clean, fmt clean, doc clean, both wasm
  checks clean, publish dry-run completes; no unwrap/expect/panic in
  non-test code (mechanically attributed across src/); no local/
  composed code exists (the batch boundary holds).

One gate-round finding, F-1 (minor), fixed in this change: the
review-numbering collision — "review 002 R-1/R-2/R-4" cited the
batch-1 gate review's findings (tasks/implementation/
review-protocol-core.md) under a name that now means the general
review; reworded to "the gate review's R-N" at all six sites
(producer.rs, consumer.rs, egress.rs, the review doc). Review 002
marked resolved; the next general review doc is 003-*.

Verification: cargo test (375 green), --all-features + --features
local/composed green, clippy --all-targets -D warnings clean, fmt
--check clean, doc clean, both wasm checks clean, publish dry-run
completes, llvm-cov 96.30% regions / 97.28% lines attributed.

docs/reviews/002-protocol-core-implementation-review.md

@@ -1,6 +1,8 @@
 ---
-status: open
-last_updated: 2026-09-24
+status: resolved
+last_updated: 2026-09-25 (the fix round verified closed — the
+  review-fix-round-002 gate; every finding closed or
+  re-dispositioned, F-1 fixed in the gate change)
 reviewed_artifacts:
   - src/lib.rs
   - src/wire.rs
@@ -152,7 +154,8 @@ what makes this one inconsistent rather than a design choice:
 
 - `Socks5ChannelSession`: the full conversation is consumed by the
   constructor; `into_inner` is the only taking method and carries
-  the `SpentSessionError` guard (review 002 R-2's shape).
+  the `SpentSessionError` guard (the gate review's R-2 shape —
+  `tasks/implementation/review-protocol-core.md`).
 - `AssociateSession`: `send_datagram`/`recv_datagram` are a proper
   state machine (reader state, spent-stream `Io`/`None` shapes);
   no re-entry ambiguity.
@@ -393,7 +396,7 @@ setters — only `.dial` rides `builder_shape_round_trips`), harness:
 **Problem**: `producer.md` §Wiring presents
 `producer.register(&core, &registry, auth, None)?` as *the* assembly
 shape — the spec'd entry point — and the landed doc (producer.md
-`Wiring`, reconciled by review 002 R-4) names exactly this
+`Wiring`, reconciled by the gate review's R-4) names exactly this
 signature. No test exercises it: the harness re-implements the
 registration via `register_socks5_openable` directly (same
 delegation, different call path), and the builder test drives only
@@ -731,7 +734,7 @@ without this note.
 # Part B — Non-findings (verified correct, recorded to bound the re-review)
 
 - **The seam contracts hold under adversarial reading.** Re-derived
-  independently of review 002: the readiness contract's R-1
+  independently: the readiness contract's R-1
   yield-guard is correct and necessary (the zero-yield unit test
   reproduces the hazard without it); ownership-rides-the-handle has
   no `_` bindings anywhere in non-test code (swept); the accept
@@ -858,6 +861,13 @@ N-7 is recorded-only (no action — the review's own
 recommendation); its bound-re-litigation note lives in the review
 itself.
 
+**Resolved 2026-09-25** (`tasks/implementation/
+review-fix-round-002.md` — the closing gate): every finding closed
+or re-dispositioned; the one gate-round finding (F-1, the
+review-numbering collision on the R-citations — the R-findings
+belong to the batch-1 gate review) fixed in the gate change. The
+batch-2 gate is open (ADR-014 accepted; no major finding remains).
+
 ## References
 
 - `docs/reviews/001-rfc1928-full-review.md` (the fork review — the