Tighten remaining docs readability

Author: RamazanKara

docs/ARCHITECTURE.md

@@ -162,7 +162,8 @@ Proxy-Wasm HTTP callouts (`proxy_http_call`) reuse connections via an internal p
 - Blocking TCP sockets from the Varnish worker thread executing the filter
 - Default pool size: 16 persistent connections; configurable with `wasm.set_http_pool_size(size)`
 - Circuit breaker: after N consecutive failures, short-circuit for cooldown period
-- SSRF prevention: upstream allowlist plus private/internal IP checks for non-allowlisted destinations after DNS resolution
+- SSRF prevention: upstream allowlist plus private/internal IP checks for
+  non-allowlisted destinations after DNS resolution
 
 ### Deferred HTTP Callout Callback
 

docs/PRODUCTION.md

@@ -44,6 +44,7 @@ path:
 
 ```vcl
 import wasm;
+import std;
 
 sub vcl_init {
     wasm.load("edge", "/etc/varnish/wasm/edge_security_filter.wasm");
@@ -61,7 +62,7 @@ sub vcl_recv {
 
     set req.http.X-Wasm-Action = wasm.proxy_wasm_on_request("edge");
     if (req.http.X-Wasm-Action != "0") {
-        return (synth(403, "Blocked"));
+        return (synth(std.integer(req.http.X-Wasm-Action, 403), "Blocked"));
     }
 }
 ```

docs/SECURITY.md

@@ -67,7 +67,8 @@ following security considerations:
 
 ### Body Access
 - `proxy_get_buffer_bytes`: Read-only access to request/response body
-- `proxy_set_buffer_bytes`: Can rewrite response body chunks in the VDP; request-body replacements are visible to later module reads
+- `proxy_set_buffer_bytes`: Can rewrite response body chunks in the VDP;
+  request-body replacements are visible to later module reads
 - Body modification is per-request, not persistent
 
 ### Property Access
@@ -177,5 +178,5 @@ untrusted input:
 | Rate limit bypass (IP spoofing) | Relies on trusted `X-Forwarded-For` from upstream load balancer |
 | Shared data exhaustion | Time-bucketed keys; old buckets naturally expire |
 | Auth service DoS | HTTP call limit + timeout; circuit breaker in http_pool |
-| Config injection | The product validates and rejects unknown fields; the fixture falls back to defaults on malformed JSON |
+| Config injection | Product config rejects unknown fields; the fixture falls back to defaults on malformed JSON |
 | Integer overflow in counters | u64 counters; overflow at 2^64 is not reachable |

examples/README.md

@@ -7,13 +7,17 @@ at once.
 
 ## Module Map
 
-| Module | ABI style | What it is good for |
-|--------|-----------|---------------------|
-| [`rust/`](rust/) | Native vmod-wasm host functions plus raw Proxy-Wasm ABI | Learning the low-level imports exposed by vmod-wasm and testing execution limits |
-| [`proxy-wasm-filter/`](proxy-wasm-filter/) | Rust `proxy-wasm` SDK | A readable starter filter with request, response, local response, and body callbacks |
-| [`passthrough/`](passthrough/) | Raw Proxy-Wasm ABI | Baseline lifecycle module for smoke tests and overhead checks |
-| [`transform/`](transform/) | Raw Proxy-Wasm ABI | Minimal response-header mutation without the SDK |
-| [`edge-security-filter/`](edge-security-filter/) | Rust `proxy-wasm` SDK | Integration-test fixture covering config, metrics, shared data, callouts, body callbacks, and local responses |
+- [`rust/`](rust/) uses native vmod-wasm host functions plus a small raw
+  Proxy-Wasm ABI filter. Read it when you want low-level imports or execution
+  limit tests.
+- [`proxy-wasm-filter/`](proxy-wasm-filter/) uses the Rust `proxy-wasm` SDK.
+  Read it first if you want the normal SDK shape.
+- [`passthrough/`](passthrough/) is a no-op raw Proxy-Wasm ABI module for
+  lifecycle smoke tests and overhead checks.
+- [`transform/`](transform/) is a minimal response-header mutation using direct
+  Proxy-Wasm ABI imports.
+- [`edge-security-filter/`](edge-security-filter/) is the realistic fixture:
+  config, metrics, shared data, callouts, body callbacks, and local responses.
 
 For production edge security deployments, use the standalone
 [vmod-wasm Edge Security Filter](https://github.com/RamazanKara/vmod-wasm-edge-security-filter)