- C-2: new_acme dedups the acme-tls/1 ALPN append (idempotent
construction); ACME/non-ACME ALPN asymmetry documented on
TlsServerConfig::new; pinned by
new_acme_caller_supplied_acme_tls_alpn_is_not_duplicated
- C-3: new_acme rejects an empty domains list with
TlsError::AcmeConfig before spawning the order loop; contact stays
unvalidated (RFC 8555 7.3 zero-contact accounts are legal); pinned
by new_acme_empty_domains_returns_config_error (acme-gated)
- N-6: Cargo.toml exclude gains tasks/ and docs/architecture/
- N-7: AcmeDirectory::Custom documents the https-only caller contract
(no runtime validation, per finding)
Verification: cargo test (default) and --all-features (77 lib tests,
2 new), clippy -D warnings, fmt --check, doc, package --list (no
tasks/ or docs/architecture/), publish --dry-run — all green