docs: fix the sweep's own stale claims - cowprotocol override, production.md 3.1

Review catches on the stale-reference sweep itself:

- ADR-0007 errata and sdk.md Versioning both claimed cowprotocol is a
  clean 0.1.0 registry dependency "with no git override". The branch's
  own Cargo.toml pins 0.2.0 WITH an active [patch.crates-io] override
  to nullislabs/cow-rs (pending the hash-only OrderCreationAppData
  constructor release). Both now describe that state and point at the
  patch-block comment as the source of truth.
- production.md 3.1 still shipped the "interim" hand-rolled Dockerfile
  recipe issue #123 flagged; replaced with a pointer to the real root
  Dockerfile and docs/deployment/docker.md.
- 02-modules-events-packaging.md: un-garble the parenthetical the
  earlier rename made self-contradictory ("was module.toml in earlier
  drafts" -> "was nexum.toml").

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfSsJPYDQ1GQGbnSVFxATx

Author: 2 people

docs/02-modules-events-packaging.md

@@ -6,7 +6,7 @@ A module is distributed as a **bundle** - a WASM component plus a manifest that
 
 ### Manifest (`module.toml`)
 
-Every module ships with a manifest. The file is named `module.toml` in 0.2 (was `module.toml` in earlier drafts; per [ADR-0001](adr/0001-engine-toml-separate-from-nexum-toml.md) the operator/module split is now explicit).
+Every module ships with a manifest. The file is named `module.toml` in 0.2 (was `nexum.toml` in earlier drafts; per [ADR-0001](adr/0001-engine-toml-separate-from-nexum-toml.md) the operator/module split is now explicit).
 
 ```toml
 [module]

docs/adr/0007-upstream-protocol-logic-to-cow-rs.md

@@ -45,4 +45,4 @@ Lower-priority follow-ons (`OrderUid::from_slice`, retry middleware on `OrderBoo
 - A follow-on Bleu module - the Rust-side equivalent of `cowprotocol/refunder` (permissionless `invalidateOrder` triggering for expired EthFlow orders) - becomes natural to ship once an ethflow-watcher module lands. Out of scope for M2 but explicitly enabled by the same primitives.
 - TWAP polling logic (decode `ConditionalOrderCreated`, eth_call `getTradeableOrderWithSignature`, decode return, build `OrderCreation`) and EthFlow event decoding stay entirely in guest module code. The `cowprotocol` crate provides only the types and the orderbook client; the strategy is the module's.
 
-_Errata: `crates/nexum-engine` was renamed to `crates/nexum-runtime` + `crates/nexum-cli` in the 0.2 refactor. The `[patch.crates-io]` rev-bump mechanism was retired once `cowprotocol 0.1.0` published to crates.io; the workspace now pins it as a normal registry dependency with no git override._
+_Errata: `crates/nexum-engine` was renamed to `crates/nexum-runtime` + `crates/nexum-cli` in the 0.2 refactor. The `cowprotocol` crate now publishes to crates.io (the workspace pins `0.2.0`), so the PR-#5-head consumption model above is historical; a `[patch.crates-io]` git override to `nullislabs/cow-rs` remains active pending a release with the hash-only `OrderCreationAppData` constructor - see the comment above the patch block in the root `Cargo.toml` for the current state._

docs/production.md

@@ -140,45 +140,14 @@ journalctl -u shepherd -f --output=json | jq '.MESSAGE | fromjson?'
 
 ## 3. Container deploy: Docker Compose
 
-> **Status note:** the official Dockerfile is tracked as a
-> separate issue. Until it lands, build the image locally with
-> the multi-stage recipe below; the Compose file is forward-
-> compatible with the eventual published image.
-
-### 3.1 Dockerfile (interim)
-
-```dockerfile
-# syntax=docker/dockerfile:1.6
-FROM rust:1.86-slim-bookworm AS build
-WORKDIR /src
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        pkg-config libssl-dev cmake clang \
-    && rm -rf /var/lib/apt/lists/*
-RUN rustup target add wasm32-wasip2
-COPY . .
-RUN cargo build -p nexum-cli --release
-# Build all 5 modules. Add yours here.
-RUN cargo build -p twap-monitor     --target wasm32-wasip2 --release \
- && cargo build -p ethflow-watcher  --target wasm32-wasip2 --release \
- && cargo build -p price-alert      --target wasm32-wasip2 --release \
- && cargo build -p balance-tracker  --target wasm32-wasip2 --release \
- && cargo build -p stop-loss        --target wasm32-wasip2 --release
-
-FROM debian:bookworm-slim AS runtime
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates tini \
-    && rm -rf /var/lib/apt/lists/* \
-    && useradd -r -s /usr/sbin/nologin -d /var/lib/shepherd shepherd \
-    && install -d -o shepherd -g shepherd /var/lib/shepherd
-COPY --from=build /src/target/release/nexum /usr/local/bin/
-COPY --from=build /src/target/wasm32-wasip2/release/*.wasm /opt/shepherd/modules/
-COPY --from=build /src/modules /opt/shepherd/manifests
-USER shepherd
-WORKDIR /var/lib/shepherd
-EXPOSE 9100
-ENTRYPOINT ["/usr/bin/tini", "--", "nexum"]
-CMD ["--engine-config", "/etc/shepherd/engine.toml"]
-```
+### 3.1 Dockerfile
+
+The official multi-stage `Dockerfile` ships at the repo root - it
+builds the `nexum` binary, compiles all five module wasms, and runs as
+a non-root user under `tini`. Build it with `docker build -t shepherd .`
+or let the root `docker-compose.yml` build it for you. The full image
+reference (published tags, pinning, .env wiring) is in
+[`docs/deployment/docker.md`](deployment/docker.md).
 
 ### 3.2 docker-compose.yml
 

docs/sdk.md

@@ -109,7 +109,10 @@ The SDK crates are currently `0.1.0` and live at `crates/nexum-sdk/`
 and `crates/shepherd-sdk/` in the shepherd monorepo. They are not yet
 published to crates.io; modules depend on them via workspace paths.
 
-The `cowprotocol` crate is published to crates.io at `0.1.0`; the
-workspace declares `cowprotocol = "0.1.0"` in `[workspace.dependencies]`
-with no `[patch.crates-io]` or git overrides. Module Cargo.toml files
-that inherit from the workspace pick it up automatically.
+The `cowprotocol` crate is published to crates.io; the workspace
+declares `cowprotocol = "0.2.0"` in `[workspace.dependencies]`, with a
+temporary `[patch.crates-io]` git override to `nullislabs/cow-rs`
+pending a release that ships the hash-only `OrderCreationAppData`
+constructor (see the comment above the patch block in the root
+`Cargo.toml`). Module Cargo.toml files that inherit from the workspace
+pick it up automatically.