docs: re-key architecture docs off the alknet mono-repo — speak as alkcall

The ported docs still framed alknet siblings (alknet-core/-call/-channels/
-http/-tls/-client) as live load-bearing context of this crate. With the
extraction complete and alknet headed for glue-level replacement, the docs
now speak as alkcall and cite the real sibling crates (alkhttp, alktls,
alktty, alktunnels, alktrader).

- ADR-054 (new): re-own the verifier-selection rule in-crate — three
  remote roles (public X.509 endpoint / transport relay / hub),
  ServerCertVerifier by PeerEntry presence, RemoteIdentity None
  load-bearing. Provenance: alknet ADR-034 (never ported), demoted to
  footnote. Resolves OQ-21's cross-repo authority gap.
- OQ-43 (new, deferred(scope)): composition-layer ownership and shape
  after the alknet replacement — the named receiver for the
  downstream-side deferrals (OQ-33 endpoint layer, OQ-41 QUIC-native
  substrate, OQ-42 hub broker, OQ-19 persistence adapters, ADR-045 dial
  seam). README layering diagram redrawn with the composition layer as
  TBD-ownership instead of "alknet / alknode" in concrete.
- Spec docs reframed: titles, self-references, dial/TLS/from_jsonschema
  homes, malformed legacy cite rows removed; dead relative research
  paths qualified as source-repo paths.
- ADR amendments (append-only): 027 (alknet-http -> alkhttp), 031 (post-
  extraction state), 044 (split landed as modules in alkcall), 045
  (name normalization; citation-space note).
- Citation hygiene: unprefixed/colliding source-repo cites prefixed
  ("alknet ADR-NNN (provenance)") across 009/011/022/034/035/038/040/
  043/044/045; stale OQ cites corrected (session registries OQ-04, batch
  semantics OQ-03, verifier rule ADR-054); stale anchors fixed.
- README provenance note consolidated; citation conventions documented.

Verification: markdown link check (all local links resolve, all in-crate
ADR cites point at existing decisions/ files); table integrity check
(uniform row widths across open-questions.md and edited tables); residual
alknet-mention sweep (only provenance/historical/intentional framing
remains); architecture review subagent pass with zero remaining criticals.
Docs-only change — no code paths touched.

docs/architecture/decisions/045-alknetclient-native-dial-seam.md

@@ -1,8 +1,18 @@
 # ADR-045: AlknetClient — the Native Client Dial Seam
 
+> **Citation-space note (2026-10-13).** This ADR was authored in the
+> alknet workspace before the extraction. Its `ADR-08x` references
+> (endpoint types, `TlsClientConfig`, accept-loop runner, crypto
+> provider) and its `OQ-55`/`OQ-58` references are **source-repo
+> (alknet) space, not this crate's `decisions/`** — provenance; those
+> ADRs were never ported. The verifier-selection rule formerly cited as
+> "alknet ADR-034" is re-owned in-crate by ADR-054. This crate's own
+> tracker/ADR numbers appear only where explicitly marked.
+
 ## Status
 
-Accepted (resolves OQ-55; §3 and §5 amended 2026-07-16 by ADR-012 —
+Accepted (resolves alknet OQ-55 — source-repo space, provenance;
+§3 and §5 amended 2026-07-16 by ADR-012 —
 the dial credential bundle is `ConnectionCredentials` (transport-level),
 not `CallCredentials` (call-protocol-level); all three dial signatures
 unify on `&ConnectionCredentials`; `dial_iroh`'s `node_id` parameter is
@@ -81,7 +91,7 @@ contributing to the confusion that made `AlknetClient` hard to spec:
    (client). *Server-side accept vs. client-side dial.* The endpoint
    accepts connections and resolves identity from the incoming
    connection; the client dials and presents identity (client cert)
-   while verifying the remote (ADR-034).
+   while verifying the remote (alknet ADR-034, provenance).
 3. **ALPN-level category** — endpoint ALPN / entry-point ALPN
    (ADR-086 §2). *Identity-gated vs. bootstrap, at the TLS layer.*
 
@@ -143,7 +153,7 @@ The symmetry:
 |---------|---------------------------|-------------------------|
 | Transports | `with_quinn` / `with_iroh` / `with_tcp_tls` — pre-built by the assembly layer | `with_quinn` / `with_iroh` / `with_tcp_tls` — pre-built by the assembly layer |
 | Per-connection work | Accept → extract ALPN + fingerprint → `Connection` → `dispatch` | Dial → TLS handshake → `Connection` (ALPN + fingerprint carried) |
-| Identity | Resolved *from* the incoming connection (fingerprint from client cert, or token on channel 0) | *Presented* (local `TlsIdentity` as client cert) + remote *verified* (ADR-034 — fingerprint pin or CA) |
+| Identity | Resolved *from* the incoming connection (fingerprint from client cert, or token on channel 0) | *Presented* (local `TlsIdentity` as client cert) + remote *verified* (alknet ADR-034, provenance — fingerprint pin or CA) |
 | What it does NOT do | Run protocols — handlers do | Run protocols — `CallClient` / `ChannelClient` do |
 | Config | `TlsServerConfig` (per endpoint type, built by assembly) | `TlsClientConfig` (per-dial, built from `CallCredentials`) |
 
@@ -168,7 +178,7 @@ pub struct AlknetClient {
 
 impl AlknetClient {
     /// QUIC dial. Builds a `TlsClientConfig` from `credentials`
-    /// (ADR-034 verifier selection + ADR-084 provider), dials `addr`
+    /// (alknet ADR-034 verifier selection, provenance + alknet ADR-084 provider), dials `addr`
     /// on `alpn`, returns a `Connection` via
     /// `Connection::from_quinn_with_alpn`. Feature-gated on `quinn`.
     #[cfg(feature = "quinn")]
@@ -215,7 +225,7 @@ identity + auth token bundle, from `Capabilities`). The two rustls dials
 (QUIC, TCP+TLS) build a `TlsClientConfig` from the credentials; the
 iroh dial uses the raw `Ed25519SecretKey` directly. This mirrors the
 server side's "iroh shares the key, not the config" (ADR-082, ADR-087
-§3) — the consistency is in the rule (ADR-034 verifier selection), not
+§3) — the consistency is in the rule (the verifier-selection rule — alknet ADR-034, provenance; re-owned in-crate as ADR-054), not
 in the type.
 
 > **Amendment 2026-07-16 (ADR-012):** The dial credential bundle is
@@ -238,7 +248,7 @@ in the type.
 > is derived from `creds.remote_identity.fingerprint`
 > (`ed25519:<hex>` → `NodeId::from_bytes`), the same extraction pattern
 > the rustls dials use for the verifier. The consistency is now in both
-> the rule (ADR-034) and the type. `CallCredentials` stays in
+> the rule (alknet ADR-034, provenance) and the type. `CallCredentials` stays in
 > `alknet-call` as the call-protocol credential bundle; the
 > `auth_token` is a per-request field on `call.requested` payloads
 > (set by the caller or the `from_call` forwarding handler, resolved by
@@ -492,7 +502,7 @@ several possible native clients sharing the same wire protocols.
   graph.
 - **The iroh dial is the exception.** It does not use
   `TlsClientConfig` — iroh has its own TLS. The dial helper applies
-  the same ADR-034 rule via iroh's API (NodeId match). The
+  the same verifier rule (alknet ADR-034, provenance) via iroh's API (NodeId match). The
   consistency is in the rule, not in the type. This is the same
   exception as the server side (ADR-082, ADR-087 §3) — unavoidable,
   and isolated to one dial method.
@@ -554,4 +564,23 @@ dedicated ADR lands.
 - OQ-58 — worker registration flow (the HTTP path; `alk/register`
   is the native analogue)
 - `docs/architecture/crates/channels/channel-client.md` §"Relationship
-  to `AlknetClient`" — the deferral this ADR resolves
+  to `AlknetClient`" — the deferral this ADR resolves
+
+## Amendment 2026-10-13: name normalization (`alknet-client` → the composition layer's dial helper)
+
+This ADR's decision text was authored when the dial helper lived in the
+mono-repo crate `alknet-client`. The decision itself is name-independent
+and unchanged: **the dial lives in the consumer/composition layer; the
+protocol crates take over pre-established `Connection`s (`spawn_dispatch`
+/ `from_connection`).** Current naming:
+
+- `AlknetClient` remains the dial helper's type name, but its host is
+  the **composition layer** (today the alknet glue, which is being
+  replaced). The post-replacement owner and shape of the composition
+  layer — including this dial seam — is tracked as OQ-43.
+- `ConnectionCredentials` / `RemoteIdentity` (ADR-012) live with the
+  vendored core types in alkcall.
+- The client-side verifier-selection rule this ADR's dial applies
+  (fingerprint pin vs CA vs fail-closed) is re-owned in-crate by
+  ADR-054; the alknet ADR-034 and ADR-084 references below are
+  provenance.