rfc1928: the keep-or-cut sweep + the honest refusal vocabulary (review-002 N-1, N-4)

- N-1 cut: auth_method_enums! (macro + generated StandardAuthentication/
  StandardAuthenticationStarted/allow_no_auth), skip_auth_this_is_not_
  rfc_compliant, CheckResult's Option/Result impls (bool stays) — the
  producer-replaced machinery; ADR-013's no-speculative-surface posture
- N-1 keep-notes made current: ConnectError (hand-port companion; the
  fired trigger + keep disposition recorded in stream.rs),
  transfer/wait_on_tcp (differential-suite-consumed), Bug (upstream-
  verbatim, display intact)
- N-4: new SocksServerError::Refused(&'static str) — the honest log
  vocabulary for the five in-stream policy refusal sites (the BIND
  command gate + dial/egress/bind-factory/bind-accept seams) and the
  harness's minimal producer; wire bytes untouched (Bug keeps its
  display; AuthenticationRejected stays the typestate's auth-reject)
- Provenance extended, not replaced (convention 17): server.rs module
  doc's owned-changes paragraph + rfc1928.md's owned-code post-fork
  changes list + last_updated
- Differential :103 comment reworded to the RFC's ordering rationale;
  AuthMethod doc updated for the macro cut
- Tests: refusal-site session-error asserts moved to Refused, the
  mapping-table loop grew the variant, a display/shape test pins it

Verified: cargo test (356 green incl. --all-features), clippy/fmt/doc
clean, both wasm checks clean.

docs/architecture/rfc1928.md

@@ -1,10 +1,12 @@
 ---
 status: draft
-last_updated: 2026-09-22 (the targeted fork — ADR-013 supersedes
-ADR-011's maintenance posture; the module is `src/rfc1928/`, the
-fork point is `5b18d4d`, the lint-allow posture dissolves;
-extraction review F-1: `ReplyError::from_u8`'s panic arm mapped to
-`GeneralFailure`; Phase 1 initial draft 2026-09-20)
+last_updated: 2026-09-24 (the keep-or-cut sweep + the refusal
+vocabulary variant — the fork's owned post-fork changes section;
+review 002 N-1/N-4; the targeted fork 2026-09-22 — ADR-013
+supersedes ADR-011's maintenance posture; the module is
+`src/rfc1928/`, the fork point is `5b18d4d`, the lint-allow posture
+dissolves; extraction review F-1: `ReplyError::from_u8`'s panic arm
+mapped to `GeneralFailure`; Phase 1 initial draft 2026-09-20)
 ---
 
 # alksocks — The RFC 1928 Core (the targeted fork)
@@ -113,6 +115,33 @@ four dissolve with the kernel-net region:
 Dissolved: the `net` feature gate (no net code in-tree) and the
 `run_udp_proxy_custom` bind seam (the handler isn't forked).
 
+Plus the **owned-code post-fork changes** (the fork is first-class
+code — extend this list, never replace it; convention 17):
+
+- **The keep-or-cut sweep** (review 002 N-1): the producer-replaced
+  machinery is cut from the typestate — the `auth_method_enums!`
+  macro (upstream's enum generator) with its generated
+  `StandardAuthentication` enum + `allow_no_auth`,
+  `skip_auth_this_is_not_rfc_compliant`, and `CheckResult`'s
+  `Option`/`Result` impls (`bool` stays; re-add with a
+  typed-rejection design if a door ever wants it). None had an
+  in-tree consumer once the producer drove `negotiate_auth` directly
+  (`&[NoAuthentication]`; per-door auth is ADR-005's, not the
+  typestate's). Kept with note (the hand-port map, ADR-013):
+  `ConnectError` (constructed nowhere in-tree; the dial-error →
+  reply-code mapping a future kernel-net port reuses) and
+  `transfer`/`wait_on_tcp` (differential-suite-consumed — their
+  semantics stay pinned there). The upstream `Bug` variant is
+  likewise kept, its display intact.
+- **The refusal vocabulary variant** (review 002 N-4):
+  `SocksServerError::Refused(&'static str)` — the honest
+  log/observability vocabulary for the producer's in-stream policy
+  refusals (the command gate + the four seam-refusal sites). Upstream
+  has no such variant; it is an owned addition, never reaching the
+  wire (the RFC reply goes out first; the variant's
+  `to_reply_error` mapping is the `GeneralFailure` fall-through,
+  pinned by the mapping-table test).
+
 Plus the provenance notes: the fork point (upstream v1.0.0,
 extraction `57b107b..5b18d4d`, fork at the review commit) and the
 license notice (MIT, extended — ADR-013's license mechanics).