docs: OQ-SK-03 handle swap — the relay handle is the channel itself

- the ASSOCIATE reply's BND.ADDR/BND.PORT is a relay handle, not a
  destination (per-datagram destinations ride the datagram header);
  swapping "tell the client about a UDP port" for "tell the client
  about the UDP tunnel" preserves every RFC property: one channel per
  association, {addr, data} frames in-band, channel EOF = association
  lifetime, optional front-door binds on either side
- sentinel-address hunch superseded: no virtualized relay address is
  ever needed on the in-band path; BND.ADDR there is pure
  RFC-compatibility surface
- producer egress has two variants, both dial-callback policy (OQ-SK-01
  shape): local UdpSocket (no flow table, native-only) or composed
  per-target alktunnels udp-tunnels (lazy destination->tunnel table;
  flow table reborn as channel handles; per-target ACL for free —
  dissolves most of OQ-SK-05 for the composed path)
- no upstream ask: alktunnels' connected-udp substrate is correct as-is
  for per-target composition; an unconnected-egress resource would be
  SOCKS5 again (circular)
- POC #2 baseline settled: sketch both egress variants behind the dial
  callback, measure per-destination open cost of the composed variant

docs/research/iroh-socks5-eval.md

@@ -243,7 +243,11 @@ stand); **adopt iroh-socks5's UDP design as prior art for OQ-SK-03**:
    phase model — the RFC UDP header becomes a front-door codec concern,
    not a channels-wire concern.
 2. Per-datagram addressing with no producer-side flow table suffices
-   (revisit alknet's flow-table posture in light of this).
+   for the *local egress* variant (revisit alknet's flow-table posture
+   in light of this). Caveat added 2026-09-13: under *composed* egress
+   (per-target alktunnels udp-tunnels, the OQ-SK-03 handle-swap
+   discussion) the flow table returns as a destination→tunnel-channel
+   table — a dial-callback policy, not a protocol-layer concern.
 3. Control-stream EOF ends the association (`wait_until_closed` shape —
    on channels, the channel's EOF is the same signal; no extra control
    vocabulary needed).