docs: review 002 trivial batch — D-3 honest serde test name + D-4 CHANGELOG preamble trim

- D-3: inline the serde-layer check into the renamed
  serde_rejects_unknown_substrate_value; delete the overpromising
  jsonschema_valid helper (the registry's real schema gate stays
  pinned end-to-end by the integration probes)
- D-4: trim the stale Unreleased preamble to a one-liner (written
  before the six graduation implementation commits landed)

Verified: cargo fmt --check; cargo clippy --all-targets -D warnings;
cargo test (86 + 2 doc-tests) green

CHANGELOG.md

@@ -6,11 +6,8 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-Spec work for the graduation (ADRs 007/008 — the direct op, listen
-metadata + the forwarded op) is committed and pinned; implementation
-is decomposed in `tasks/tunnels/` and lands in the next release. The
-dependency bump below is the only behavior-affecting change so far
-(no wire or API change at this level yet).
+The graduation implementation (the direct op, listen metadata + the
+forwarded op — ADRs 007/008) landed — see Added below.
 
 ### Added
 

src/params.rs

@@ -599,12 +599,16 @@ mod tests {
     }
 
     #[test]
-    fn schema_rejects_unknown_substrate_value() {
-        let schema = tunnel_open_spec().input_schema;
+    fn serde_rejects_unknown_substrate_value() {
+        // The serde layer (the enum deserializer), not the JSON Schema —
+        // the registry's real schema gate is pinned end-to-end by the
+        // integration probes (`schema_rejects_unknown_substrate_loudly`,
+        // `malformed_target_is_schema_class_and_leaves_no_channel`, the
+        // forwarded `listen: 0` gate).
         let substrate_ok = json!({"resource": "r", "substrate": "udp"});
         let substrate_bad = json!({"resource": "r", "substrate": "sctp"});
-        assert!(jsonschema_valid(&schema, &substrate_ok));
-        assert!(!jsonschema_valid(&schema, &substrate_bad));
+        assert!(serde_json::from_value::<TunnelParams>(substrate_ok).is_ok());
+        assert!(serde_json::from_value::<TunnelParams>(substrate_bad).is_err());
     }
 
     #[test]
@@ -625,17 +629,6 @@ mod tests {
         assert_eq!(establishment_reason(&local_only), None);
     }
 
-    fn jsonschema_valid(_schema: &serde_json::Value, value: &serde_json::Value) -> bool {
-        let Ok(params) = serde_json::from_value::<TunnelParams>(value.clone()) else {
-            return false;
-        };
-        let allowed = ["tcp", "udp", "unix"];
-        matches!(
-            substrate_str(params.substrate),
-            "tcp" | "udp" | "unix" if allowed.contains(&substrate_str(params.substrate))
-        )
-    }
-
     // --- direct op (ADR-007) -------------------------------------------
 
     #[test]

tasks/tunnels/review-002-trivial-batch.md

@@ -1,7 +1,7 @@
 ---
 id: tunnels/review-002-trivial-batch
 name: "Trivial batch — D-3 (rename the overpromising schema test helper) + D-4 (trim the stale CHANGELOG preamble)"
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: trivial
@@ -67,4 +67,21 @@ wording agent's choice) or drop it.
 
 ## Notes
 
-> Agent fills during implementation.
+> Agent fills during implementation.
+
+## Implementation Notes (2026-09-20)
+
+- **D-3**: inlined the honest serde check directly into the renamed
+  test `serde_rejects_unknown_substrate_value` (the `jsonschema_valid`
+  helper deleted — it had exactly one call-site, and its
+  `matches!`-with-guard body was convoluted beyond its job). The doc
+  comment names the integration probes that pin the real registry-side
+  gate end-to-end. No `jsonschema` dev-dependency added (the
+  structural-assertion sibling `direct_target_schema_gates_shape_per_
+  substrate` is untouched and stays honest).
+- **D-4**: trimmed the preamble to the one-liner ("The graduation
+  implementation … landed — see Added below."); the stale
+  `tasks/tunnels/` sentence and the "only behavior-affecting change"
+  claim are gone.
+- Verification: `cargo fmt --check`, `cargo clippy --all-targets -D
+  warnings`, `cargo test` (86 default tests + 2 doc-tests) all green.