generation 5: review-impl — spec-conformance gate passed, API frozen

Checklist (all six PASS):
1. API surface == ADR-004 — every accessor signature verified verbatim
2. TlsError == ADR-002 — six variants, #[non_exhaustive], typed sources,
   AcmeConfig holds exactly the two config-mismatch cases
3. Invariants: all five server invariants + client 0-RTT half +
   fail-closed structure, each with a passing behavioral test at unit
   and integration level
4. Deltas vs extraction: all ADR-pinned; two surfaced divergences
   recorded as ADR amendments — zero un-pinned divergences remain
5. Feature hygiene: default = [] lean, tokio subset (no full),
   doc comments on public API, no inline // comments, no panics
6. Docs sync: ADR-002 + ADR-003 amendment notes; overview/server/client
   Draft → Reviewed; README carries the API-freeze lifecycle note

5 findings, all low severity, all resolved forward (table in task Notes)

Verification: cargo test (81), cargo test --all-features (92),
clippy -D warnings, fmt --check, doc --no-deps,
publish --dry-run — all green. API FROZEN for the alknet rewrite.

docs/architecture/decisions/003-noq-replaces-quinn.md

@@ -109,6 +109,22 @@ consumes that provider from the config.
   both noq and iroh, and the rewrite rides their stack; pin `noq =
   "1.2"` and bump deliberately).
 
+**Amendment (2026-09-10, from the Phase 2 implementation):** the
+pinned TOML block's `features = ["rustls"]` was written against the
+noq 1.2 API; the lockfile resolves `noq-proto 1.3.0`, where
+`ServerConfig::with_crypto(crypto)` — the single-arg constructor the
+`for_noq` accessor calls — is `#[cfg(any(feature = "aws-lc-rs",
+feature = "ring"))]` (the retry-token key lives in noq's
+`ring_like` module, which needs one of the two provider features).
+The `noq` dependency therefore ships with
+`default-features = false, features = ["rustls", "aws-lc-rs"]`.
+This does not reopen the provider decision: the config's internal
+provider is still the crate's explicit
+`rustls::crypto::aws_lc_rs::default_provider()` on every path (ADR-084
+via ADR-003's provider paragraph — noq consumes the provider from the
+config), and `aws-lc-rs` (not `ring`) is the feature matching that
+posture.
+
 ## References
 
 - `docs/research/phase-0.md` §Prior art: noq — the verified seam facts