HTTP capability gateway (Phase 11) + illustrated wiki & reference docs (Phase 12) (#63)

* feat(http): outbound HTTP capability gateway with enforced deadlines

Zig 0.15's std.http.Client.fetch has no timeout and owns its socket, so a
hung VeriSimDB/Steam/Groove endpoint blocked the calling thread forever and
the STEAM_API_TIMEOUT_MS / GROOVE_TIMEOUT_MS constants were inert.

Following the estate's http-capability-gateway direction ("HTTP verbs/routes
become declared capabilities, not accidents" — one policy-driven mediation
layer), this applies the same idea to GSA's OUTBOUND calls. New
src/interface/ffi/src/http_capability.zig is the ONLY caller of fetch in the
FFI layer; every call site declares an OutboundCapability (verb, host_allow,
deadline_ms, purpose/narrative, label, trust — names mirror the gateway DSL)
and call() enforces a host allow-list (default-deny) and a hard wall-clock
deadline.

Deadline mechanism (fetch cannot be cancelled): a worker thread runs the
opaque fetch; the caller waits on std.Thread.Semaphore.timedWait(deadline).
This bounds the caller uniformly for plain HTTP and TLS (Steam) alike, since
it sits above fetch. Ownership is a 2-count refcount on a shared RequestBox
backed by c_allocator (malloc — thread-safe, process-lifetime), so a worker
that outlives a timed-out caller never touches a transient allocator; the
last releaser frees, with no write-after-free and no leak. A bounded
MAX_OUTSTANDING worker cap fails fast (Backpressure) rather than piling up
blocked threads — the client-side echo of the gateway's circuit breaker.

- verisimdb/steam/groove clients: all four fetch sites collapse to one call();
  their http.Client fields are removed (the worker owns a fresh client). The
  three timeout constants (+ new VERISIMDB_TIMEOUT_MS) are now load-bearing.
  A deadline hit maps to probe_timeout; other failures keep their codes. No
  new GsaResult variant, so no Types.idr/ABI regen.
- MockHTTP added to the harness (respond_ok / never_respond / slow_respond);
  its teardown closes held sockets so abandoned workers unblock and drain
  (http_capability.waitQuiescent) before the leak check.
- 5 behavioral tests: hung endpoint returns within the deadline (not forever),
  happy-path body, slow-respond passes/fails by deadline, default-deny without
  a socket, host-allow matching. 167 tests green across six suites + 104 fuzz.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

* docs: illustrated wiki (Mermaid) + 5 reference docs (Phase 12)

Completes the remaining `planned` documentation. Two complementary layers:

Illustrated wiki (docs/wikis/, GitHub-native Mermaid diagrams):
  Home, 02-Architecture, 03-Installation, 04-Probing-and-Games,
  05-The-Proven-ABI, 06-HTTP-Capability-Gateway, 07-GUI-and-Nexus-Setup,
  08-Deployment-Topology, 09-Troubleshooting, 10-Contributing.
  Deliberately blunt about what works today vs. what needs the estate;
  09-Troubleshooting is the direct first-run "why isn't this working" guide.

Reference docs (AsciiDoc):
  developer/FFI-MODULE-REFERENCE, developer/PANEL-EXTENSION-GUIDE,
  developer/ARCHITECTURE-RATIONALE, maintainer/CI-CD-GUIDE,
  maintainer/SECURITY-SCANNING-RUNBOOK.

docs/INDEX.adoc: mark all of the above live; add the wiki map; note the
standards-estate reusable pin has moved past the historically-cited SHA
(NEUROSYM.a2ml still cites the stale value — flagged for follow-up).

All content verified against source; tri-license SPDX headers
(CC-BY-SA-4.0 on docs). No code changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

* docs: make GS007 branch-count note number-agnostic

The live Hypatia GS007 count drifts upward as each phase PR leaves a merged
branch behind; the runbook cited a stale fixed figure. State the mechanism,
not a snapshot number.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

docs/INDEX.adoc

@@ -21,9 +21,12 @@ _You run and administer game servers via the Gossamer GUI and the `gsa` CLI._
 | `README.adoc` | live | Overview, quick-start, `gsa` CLI reference, supported games
 | `USER-CONFIG.md` | live | Nickel config: defaults, favourites, troubleshooting
 | `docs/QUICKSTART.adoc` | thin | One-liner pointer — not a real getting-started
-| GUI panel guide | *planned* | One section per panel (8: server-browser, config-editor, server-actions, live-logs, health-dashboard, config-history, cross-search, nexus-setup). **`nexus-setup`, the 7-step provisioning wizard, is entirely undocumented.**
-| Game-profile selection | *planned* | Which game → which of the 18 profiles; port/protocol table
-| Admin workflows | *planned* | Add a server; manage config across servers; roll back via config history
+| `docs/wikis/Home.md` | live | **Illustrated wiki** — narrative tour with Mermaid diagrams; start here
+| `docs/wikis/03-Installation.md` | live | Honest install guide: what works today, exact prereqs, verify steps
+| `docs/wikis/07-GUI-and-Nexus-Setup.md` | live | All 8 panels + the 7-step `nexus-setup` provisioning wizard (was undocumented)
+| `docs/wikis/04-Probing-and-Games.md` | live | Probe pipeline + the 18-game profile/protocol/format table
+| `docs/wikis/09-Troubleshooting.md` | live | Symptom → cause → fix for the common first-run failures
+| Admin workflows | *thin* | Covered piecewise in the wiki (server-actions, config-history); a single end-to-end runbook is still a gap
 |===
 
 == Developers
@@ -37,11 +40,14 @@ _You build GSA, extend it, or contribute code across the Gossamer GUI → Zig FF
 | `docs/developer/ABI-FFI-README.adoc` | live | Idris2 ABI + Zig FFI standard; C/Idris2/Rust/Julia examples (strong)
 | `TOPOLOGY.md` | live | System architecture + data flow
 | `docs/decisions/` | live | Architecture decision records (RSR adoption)
-| FFI module reference | *planned* | Per-module docs for the 11 FFI modules (signatures, the 18 result codes, examples)
-| Panel extension guide | *planned* | The PanLL clade system; registering a new panel; inheriting base clades
-| Game-profile authoring | *thin* | Expand the README snippet: field types, validation, port/protocol, debugging
+| `docs/developer/FFI-MODULE-REFERENCE.adoc` | live | Per-module docs for the FFI modules (every `gossamer_gsa_*` symbol, the 18 result codes, the handle lifecycle)
+| `docs/developer/PANEL-EXTENSION-GUIDE.adoc` | live | Panel anatomy + the clade system; `nexus-setup` as the worked example; the `host.html` wiring points
+| `docs/wikis/05-The-Proven-ABI.md` | live | The machine-checked ABI contract (codegen pipeline, 18 codes, linear handles) — the differentiator, illustrated
+| `docs/wikis/06-HTTP-Capability-Gateway.md` | live | How outbound HTTP is a declared, deadline-bounded, default-deny capability
+| `docs/wikis/10-Contributing.md` | live | Build/test, the ABI regen rule, conventions, tri-license SPDX, branch/PR flow
+| Game-profile authoring | *thin* | See `docs/wikis/04-Probing-and-Games.md`; a deep field-type/validation/debugging guide is still a gap
 | `docs/developer/CONFIG-FORMATS.adoc` | live | The 8 formats, detection order, `addField` invariants, YAML scope, and how to add a parser
-| Architecture rationale | *planned* | Why Ephapax / Idris2 / Zig / VeriSimDB; when to touch each layer
+| `docs/developer/ARCHITECTURE-RATIONALE.adoc` | live | Why Ephapax / Idris2 / Zig / VeriSimDB; when to touch each layer
 |===
 
 == Maintainers
@@ -56,11 +62,18 @@ _You release, run CI/CD, operate containers, and manage governance + security sc
 | `docs/DEPLOYMENT-RUNBOOK.adoc` | live | Build, container, VeriSimDB main+backup, health, backup/restore
 | `SECURITY.md` | live | Vulnerability reporting
 | `docs/maintainer/RELEASE-CHECKLIST.adoc` | live | CI gates (6 suites + ABI contract), version/license/docs gates, manual gates, tag steps
-| CI/CD guide | *planned* | `.github/workflows/` structure, standards-estate reusables (pins `4ddc926`), staleness check, adding a check
-| Security-scanning runbook | *planned* | Running/interpreting Hypatia + panic-attack + Scorecard; the `.hypatia-ignore` suppression mechanism (NOT `.hypatia-baseline.json` — see `NEUROSYM.a2ml`)
-| Container/quadlet ops | *thin* | Expand the runbook: `.container` format, systemd user units, day-to-day ops
+| `docs/maintainer/CI-CD-GUIDE.adoc` | live | All 16 workflows, the ABI-contract + version-drift gates, standards-estate reusable pins, adding a check
+| `docs/maintainer/SECURITY-SCANNING-RUNBOOK.adoc` | live | Running/interpreting Hypatia + panic-attack + Scorecard; the `.hypatia-ignore` suppression mechanism (NOT `.hypatia-baseline.json` — see `NEUROSYM.a2ml`)
+| `docs/wikis/08-Deployment-Topology.md` | live | Podman quadlets, the two VeriSimDB instances (`:8090`/`:8091`), the `container/` map — the illustrated deployment view
+| Container/quadlet ops | *thin* | The wiki covers the topology; a day-to-day systemd-unit ops guide is still a gap
 |===
 
+NOTE: the standards-estate reusable-workflow pin cited historically as `4ddc926`
+has since been bumped (governance/scorecard and secret-scanner/mirror now pin
+newer SHAs — see `docs/maintainer/CI-CD-GUIDE.adoc` for the current values).
+`.machine_readable/6a2/NEUROSYM.a2ml` still cites the stale SHA and should be
+updated in a follow-up.
+
 == Machine-readable layer
 _For AI agents and tooling. Read `0-AI-MANIFEST.a2ml` FIRST._
 
@@ -70,14 +83,30 @@ _For AI agents and tooling. Read `0-AI-MANIFEST.a2ml` FIRST._
 * `.hypatia-ignore` — reviewed false-positive suppressions (the active mechanism).
 * `.claude/CLAUDE.md` — human-friendly codebase guide.
 
-== Wiki status
-`docs/wikis/` is a stub that declares an intent to sync to a forge-hosted wiki but
-is **unpopulated**. The `docs/` tree also carries several empty placeholder
-subtrees (`theory/`, `reports/`, parts of `practice/`).
+== The wiki
+`docs/wikis/` is now the **illustrated narrative tour** of GSA — a 10-page,
+Mermaid-diagrammed wiki that complements the audience-segmented reference docs
+above. Start at `docs/wikis/Home.md`; it links every page.
+
+[cols="2,4"]
+|===
+| Page | Covers
+
+| `Home.md` | Landing page + ecosystem diagram + navigation
+| `02-Architecture.md` | The four layers, data-flow sequence, graceful degradation
+| `03-Installation.md` | Honest install guide (what works today)
+| `04-Probing-and-Games.md` | Probe pipeline + the 18-game table
+| `05-The-Proven-ABI.md` | The machine-checked ABI contract (the differentiator)
+| `06-HTTP-Capability-Gateway.md` | Outbound HTTP as a declared, deadline-bounded capability
+| `07-GUI-and-Nexus-Setup.md` | The 8 panels + the 7-step provisioning wizard
+| `08-Deployment-Topology.md` | Podman quadlets + the two VeriSimDB instances
+| `09-Troubleshooting.md` | Symptom → cause → fix for common first-run failures
+| `10-Contributing.md` | Build/test, ABI regen, conventions, tri-license, PR flow
+|===
 
-*Decision pending:* either populate `docs/wikis/` and sync it, **or** (recommended)
-consolidate all narrative under `docs/` using the three audience paths above and
-prune the empty scaffolding. Until then, this index is the single navigation point.
+The wiki is written in GitHub-flavoured Markdown with native Mermaid diagrams, so
+it renders both in-repo and if synced to a forge-hosted wiki. The remaining `docs/`
+scaffolding decision (below) is unchanged.
 
 NOTE: a mechanical prune is **not** clean — `verification/`, `docs/theory/`,
 `docs/reports/`, and `docs/wikis/` are referenced by the governance layer