docs: add third_party/README with vendoring instructions; augment root README with crate vendoring guidance

README.md

@@ -24,3 +24,20 @@ Overte connectivity is optional; if unreachable, the client runs in offline mode
 - `--abstract=name` (legacy abstract socket attempt)
 
 Prefer using the Rust bridge.
+
+## Vendoring StardustXR crates (recommended for deep integration)
+For fuller control and inspection of the StardustXR client pipeline, clone the `asteroids` and `core` (fusion) repositories into `third_party/` and switch the bridge's `Cargo.toml` to `path` dependencies. See `third_party/README.md` for details.
+
+Benefits:
+- Deterministic builds (no moving `dev` branch)
+- Ability to patch or instrument crate internals without forking remote
+- Easier to expose new C ABI functions (input, health queries, node data extraction)
+
+After vendoring:
+```bash
+sed -i 's/git = .*/path = "..\/third_party\/asteroids"/' bridge/Cargo.toml
+sed -i 's/git = .*/path = "..\/third_party\/core"/' bridge/Cargo.toml
+cargo build -p stardust_bridge
+```
+
+If you do not vendor, please provide commit SHAs to pin; I can update `Cargo.toml` accordingly.

third_party/README.md

@@ -0,0 +1,35 @@
+# Third-Party Crates
+
+To enable deeper integration and inspection of StardustXR client behavior, place local clones of the following repositories here:
+
+- `asteroids/` (https://github.com/StardustXR/asteroids)
+- `core/` (https://github.com/StardustXR/core) — provides fusion client elements
+
+Recommended structure:
+```
+third_party/
+  asteroids/
+  core/
+```
+After cloning, you can update `bridge/Cargo.toml` to use `path` dependencies instead of `git` to ensure reproducible builds and easier iteration:
+
+```
+[dependencies.stardust-xr-asteroids]
+path = "../third_party/asteroids"
+
+[dependencies.stardust-xr-fusion]
+path = "../third_party/core"
+```
+Then run:
+
+```bash
+cargo update
+cargo build -p stardust_bridge
+```
+
+This lets us:
+- Inspect and modify client crate code during debugging
+- Pin exact revisions without relying on remote branches
+- Potentially implement custom elements or expose more C ABI hooks
+
+If you prefer not to vendor the crates, please confirm the exact commit SHAs you want pinned and we can lock them in `Cargo.toml` instead of the moving `dev` branch.