docs: reverse-flow POC summary — -R shape validated end-to-end

POC at /workspace/alktunnels-reverse-poc (14 tests, clippy/fmt clean,
repeat-run stable) over alkcall 0.6.0:

- The review 007 non-finding trace confirmed by execution: the hub
  (accept side) opens tunnel channels toward a connect-side worker
  serving its own open op (from_connection_with_serving +
  ChannelOperations::register_on + post-hoc openable registration)
- ADR-047 §5 exercised in the Pub-like orientation: the worker
  (connect side) allocates odd IDs; the hub adopts
- R-01 plan flow under concurrency: two same-resource opens, distinct
  channels, distinct dialed handles — the forward POC's handoff race
  is structurally gone
- OQ-TN-03's last open thread closed: no advertisement op needed —
  the listener is the initiator's own local resource; a far-side
  listener is a producer-side listen establisher over the same open op
- W4 EOF sentinel propagation validated (half-close semantics);
  W3 adopter self-reaping pinned as a TunnelSession spec requirement;
  W2 post-hoc registration viable

Findings:
- F-1: ChannelPlan's Send+Sync bound constrains plan payloads
  (socket halves carry + Sync; spec should pin the constraint)
- F-2: empty UDP datagrams collide with the EOF sentinel in raw
  pass-through (pinned by an executable test) — the length-framed
  codec is mandatory for UDP; raw pass-through stays
  stream-substrate-only. Second validation of the codec decision;
  OQ-TN-02 mandate strengthened

W1 (connect-side serving path resolves caller identity only via
payload auth_token) filed upstream as alkcall consumer-findings
ledger CF-005 (alkcall 0d287a9).

Verification: cargo test 14/14, clippy --all-targets -D warnings,
fmt --check — all clean, repeat-run stable

docs/research/poc-summary.md

@@ -179,6 +179,9 @@ shape. Filed as a follow-up for the alkcall ledger.
   EOF is the channels-level `length=0` chunk on the `BiStream`. The
   two coexist without ambiguity — the consumer's `recv_datagram`
   returns `None` only on stream EOF, never on an empty datagram.
+  **Mandate strengthened 2026-09-07** (reverse POC F-2): without the
+  codec (raw pass-through), an empty datagram IS a zero-byte read —
+  colliding with EOF at the pump level. UDP must ride the codec.
 - **MTU discipline:** the codec rejects >65535 at frame time; the
   1400-byte (max ethernet MTU payload) datagram round-trips through
   the bounded-buffer path. The E-04 64-parked-chunks bound was noted
@@ -270,7 +273,12 @@ review and ADRs:
    JSON representation. The `OpenHandler` gains a `plan` parameter and
    the wrapper threads it. The POC's `HandleHandoff` side-channel and
    its same-resource race are dead: the establisher returns the dialed
-   handle directly (`Ok(Establishment::new(dialed))`).
+   handle directly (`Ok(Establishment::new(dialed))`). **Confirmed
+   under concurrency 2026-09-07** by the reverse-flow POC
+   (`reverse-poc-summary.md`): two concurrent opens of the same
+   resource, distinct channels, distinct dialed handles — the race
+   this handoff had is structurally gone. (F-1 there: plan payloads
+   must be `Send + Sync`.)
 3. **Two-pump helper (→ R-03, bonus)** — `alkcall::channels::pump_bidi`
    pinned upstream (ADR-050), with `(u64, u64)` copy counts (no
    `io::Result` — errors are EOF-shaped per the ADR-078 contract). The