review-001 decomposition: 6 remediation tasks from verified findings

Verify every review-001 finding before decomposition:
- S-1 re-confirmed by fresh executable probe (X.509 + raw-key
  impersonation both complete the handshake with the victim's
  fingerprint extracted server-side)
- U-2/U-3 uncovered-line inventory re-derived from cargo llvm-cov
  (--all-features); matches Part C exactly
- rcgen 1975/4096 defaults, rustls cert-type negotiation arm,
  packaging list, doc texts: all verified against sources

Tasks (all verified, none speculative):
- fix-accept-any-cert-verifier-posture (S-1 + N-1 + OQ-TLS-09 + probe)
- handshake-tests (U-3 suites 1-3; suite 4 lives in the S-1 task)
- coverage-cheap-closes (U-2's seven groups)
- acme-event-loop-test (U-1; depends on coverage-cheap-closes for the
  tracing-capture pattern)
- config-validation-and-trivia (C-2 ALPN dedup, C-3 empty-domains,
  N-6 excludes, N-7 https doc line)
- docs-pin-c1-c4-n3-n4 (C-1, C-4, N-3 decision note, N-4 negotiation
  note)

Graph: acme-event-loop-test is generation 2; the rest run in
generation 1. taskgraph validate: 14 tasks, no cycles.

Verification: cargo test (default + --all-features) green before and
after; probe file deleted after its run.

tasks/acme-event-loop-test.md

@@ -0,0 +1,81 @@
+---
+id: acme-event-loop-test
+name: ACME event-loop coverage — fake-directory integration test (U-1)
+status: pending
+depends_on: [coverage-cheap-closes]
+scope: moderate
+risk: medium
+impact: component
+level: implementation
+tags: [tests, acme, review-001, u1]
+---
+
+## Description
+
+The ACME event-loop body (src/server.rs:94-133) is unreachable by
+tests: 23 uncovered lines — every `EventOk`/`EventError` arm, the
+`debug`/`warn`/`error` mapping, and the "state machine ended" log are
+dead code as far as the suite can prove. The `acme_lifecycle` tests
+construct the config and assert spawn + ALPN + resolver wiring; the
+spawned task runs against a blackhole URL and its events are never
+observed. A refactor that drops or mislevels an arm (e.g.
+`EventError::Order` warn → error) lands green; the loop's exit
+condition (`state.next() == None` → "ACME: state machine ended") is
+untested — if upstream changes the stream's termination semantics,
+nothing notices.
+
+The acme feature's only runtime surface is this loop; it deserves one
+real integration test.
+
+## Work
+
+1. Drive a `DirCache`-backed `AcmeState` against a local fake
+   directory: a stub HTTP server (tokio, `std::net::TcpListener` on an
+   ephemeral port — no new deps) that serves a directory JSON with no
+   usable endpoints, forcing the error path through the *real* event
+   stream.
+2. Assert the log events fire. Two shapes, pick one (or both):
+   - `tracing` test subscriber capturing the `warn!`/`error!` events
+     (tracing-subscriber with a test layer — add as dev-dependency
+     only), or
+   - extract the event-mapping match into a helper fn taking the
+     event, returning (level, message-class), and test the helper
+     directly (no subscriber needed; cheaper, but the loop body
+     itself stays uncovered — prefer the subscriber shape if the dev
+     dep is acceptable).
+3. Assert termination: with the fake directory erroring out, the
+   spawned task's `JoinHandle` resolves (the loop ends when the
+   stream ends) — pins the exit condition.
+4. Keep `TlsError` out of it: per ADR-002/ADR-006, ACME runtime errors
+   are stream events, not error variants — the test asserts events,
+   never a `TlsError`.
+
+## Verification
+
+- [ ] server.rs 94-133 covered under `cargo llvm-cov --all-features`
+- [ ] The test performs no real network I/O (binds localhost only)
+- [ ] `cargo test --features acme`, `--all-features` green; default
+      build unaffected
+- [ ] clippy/fmt/doc green
+
+## Acceptance Criteria
+
+- [ ] Every `EventOk`/`EventError` arm is executed by a test
+- [ ] The "state machine ended" termination path is asserted
+- [ ] The ACME feature's runtime surface is no longer
+      refactor-fragile
+
+## References
+
+- docs/reviews/001-implementation-review.md §U-1, Part C
+- src/server.rs:61-139 (`new_acme` + the spawned loop)
+- tests/acme_lifecycle.rs (the existing construction-level tests)
+- ADR-006 (acme feature layout), ADR-002 (`TlsError` scope boundary)
+
+## Notes
+
+> Agent fills this during implementation.
+
+## Summary
+
+> Agent fills this on completion.