Reconcile docs to code — name module ownership in CONTEXT.md, fix 12+ divergences

[stanvx]

Parent

Architecture review (2026-06-21) — report at /var/folders/kl/cxpcwl9j0yd22tzsgxzyv0qm0000gn/T/architecture-review-1782017816.html. Top recommendation from the cross-repo comparison (Satellite, Dish-Android). This issue is the parent of the next five ("VhciBackend pub", "HotplugMonitor wire/delete", "Discovery TXT seam", "Ownership discipline", "Android base classes") — those cannot land coherently until the source of truth is fixed.

What to build

Adopt CONTEXT.md as the single owner of module-ownership claims and module-responsibility boundaries. Every other doc (CLAUDE.md, ARCHITECTURE.md, PROTOCOL.md, ROADMAP.md, docs/PERFORMANCE.md, docs/SETUP.md) is verified against it, not the other way around. Walk the 12+ known divergences and for each pick: (a) build the code to match the doc, or (b) rewrite the doc to match the code. Either direction is correct — the agent chooses per case.

Add a "module ownership" section to CONTEXT.md that names one owner per concern:

• ConfigOwner: Server::app_state (the one place that reads and writes the merged config)
• MetricsOwner: Server::app_state (the one place that increments; do not delete dead statics until this lands)
• VhciBackendOwner: Client (the one place that constructs a VhciBackend)
• HotplugOwner: Server (the one place that constructs a HotplugMonitor) — or "deleted as fiction" if wire/delete goes the other way
• DiscoveryTxtOwner: usbip-core::discovery_txt (the one place that encodes and decodes)
• AndroidStateOwner, AndroidComposerOwner, AndroidControllerOwner: each names a single Kotlin class once Slice 6 lands

Acceptance criteria

• CONTEXT.md has a "module ownership" section naming one owner per concern listed above
• Every divergence in the architecture review's 12+ list is resolved (build code or rewrite doc) with a commit per resolution
• CLAUDE.md "no platform deps" claim is either removed (usbip-core's rusb dep) or rusb is moved to a feature-gated path
• CLAUDE.md test count ("only 2 files have tests") matches reality (find . -name '*.rs' -path '*/tests/*' | wc -l)
• ARCHITECTURE.md thread model matches the code (no libusb hotplug monitor unless Slice 3 wires it in)
• docs/PERFORMANCE.md latency budget table aligns with the actual handle_urb_loop measurements
• A "What NOT to borrow" reference section is added to docs/adr/ capturing the anti-patterns from the architecture review (UDP-only, REST-only topology, MSG_RUMBLE opcodes, Cemuhook DSU axis layout)
• cargo test --workspace --release and cargo clippy --workspace -- -D warnings pass after every divergence fix
• No doc-vs-code lie remains for any feature tagged "v1.0" in CONTEXT.md

Blocked by

None — can start immediately. Blocks the next five slices.