feat(net): network modules — HTTP client/server + WebSocket client, C/Rust cores, ESP-IDF host, TLS

[HalfSweet]

Summary

Adds network support to PocketJS as a working stack: three spec-pinned guest modules, a portable C reference core, the Rust reference client core, deterministic + browser + ESP-IDF hosts, and TLS. First target is ESP-IDF; the design keeps other platforms in view. The in-repo documentation is docs/NET.md and site/content/docs/net.md; the pinned boundary is contracts/spec/{net,ws,httpd}.ts.

This replaces the NET v1 SDK surface with the v2 modules. globalThis.net and op codes 1–5 are preserved and evolved in place; the old @pocketjs/framework/net value exports and net.http are removed (no in-repo consumers).

What's here

• Contracts — contracts/spec/net.ts evolved to v2 (ops 6–9 readInto/limits/write/endBody, op 2 retired, streaming headers/readable/end/error events, the shared error vocabulary with the four tls_* codes); new ws.ts and httpd.ts. gen-rust.ts emits net/ws/httpd; new gen-c.ts emits engine/net/include/pocketjs/net/spec.h. Both mirrors are under the tests/contract.ts drift guard.
• SDK — @pocketjs/framework/net (support module: NetworkError, AbortController/AbortSignal, URL, getNetworkLimits, shared types), net/http (fetch, Headers, Request, Response, BodyStream, serve), net/websocket (connect). A per-module Guest Binding drains one poll per tick from the framework service pump, settles Promises and calls handlers inside that pump, and copies bodies through readInto. New @pocketjs/framework/headless runs the frame transaction without a UI.
• Portable C core — engine/net: HTTP/1.1 client + server, RFC 6455 client, strict framing profile, bounded receive/send queues with backpressure, the immutable policy, tick queues with a per-tick budget and readable-before-terminal ordering, and the TLS handshake state machine. The only host interfaces are pnet_driver_ops (a BSD/lwIP driver under drivers/posix) and an optional pnet_tls_ops TLS provider.
• Rust core — engine/crates/pocket-net rewritten to the v2 boundary over an HttpClientBackend; mount installs the six ops via rquickjs.
• Hosts — deterministic hosts/sim/{net,httpd,ws}.ts; hosts/web/net.js moved to the streaming v2 contract; hosts/esp-idf with a QuickJS-ng owner task, a network task under one runtime lock, the net/ws/httpd bindings, AtomS3R + Tab5 bring-up, and the smoke firmware.
• TLS — pnet_tls_ops + pnet_runtime_create_tls: https:/wss: and the "tls" feature are enabled only when a provider is present; the core owns the deadline/cancel/policy and fails closed with tls_clock_untrusted before I/O when the wall clock is untrusted; no plaintext fallback. Reference NativeTlsProvider over OpenSSL (engine/net/drivers/openssl) and an ESP-TLS provider (hosts/esp-idf/components/pocketjs_net_esptls, IDF certificate bundle).
• Capabilities — contracts/spec/platforms.ts replaces net.http with the role-split network.http.client(.tls) / network.http.server(.tls) / network.websocket.client(.tls) ids. No stock target advertises them yet: a target appends an id only when its native host ships and tests the module.

Execution model (unchanged)

Network facts enter the guest only at frame boundaries: the host runs begin_tick before each frame(), the service pump polls each module once inside frame(), and Promise reactions run in that tick's job drain. No independent network turn, no wake, no ref()/unref(); docs/RUNTIMES.md Law 3 is untouched.

Validation

• Software — bunx tsc --noEmit, the contracts drift guard, and the full bun tools/test.ts suite (unit, wasm-host unit, vue-sfc, octane, and the sim determinism stages) are green. Net SDK coverage: tests/net.test.ts, tests/net-httpd.test.ts, tests/net-websocket.test.ts, tests/net-web.test.js.
• C core — ctest --test-dir engine/net/build under ASan/UBSan: unit (154 checks: HTTP/1.1 head/body strict framing, URL, policy, JSON, UTF-8, base64/SHA-1, tick queue), host (163 checks: both cores over real loopback sockets against scripted peers), tls (16 checks: an in-process OpenSSL PKI + HTTPS/WSS peers — valid chain, unknown CA, expired, hostname mismatch, untrusted clock, development-insecure refusal, no plaintext fallback, WSS echo).
• Rust core — cargo test -p pocket-net (7 tests: ordering, budget truncation, cancel/late completions, refusals, mount).
• Hardware — ESP-IDF v6.0.2 (7101770dc6db), AtomS3R (ESP32-S3-PICO-1-N8R8) and Tab5 (ESP32-P4 rev 1.3 + ESP32-C6 over SDIO). Each passes 26/26: the plaintext suite (GET/POST/JSON/chunked/404, redirect follow+manual, a 200 KB body through an 8 KiB queue at ~350–370 KiB/s, aggregate limit, headers timeout, permission_denied, connect refused, WebSocket echo, board-to-board GET/POST/JSON/stream/404, continuous pings) against an independent workstation peer (tools/net-peer.ts) and each other, plus a TLS suite: HTTPS/1.1 to a public host with a valid chain from the IDF certificate bundle (SNTP-synced clock) and badssl.com's expired / wrong-host / self-signed / untrusted-root endpoints, all failing closed. A 12-minute board-to-board soak (43,200 frames, ~330 round trips each way) ended with zero failures and flat heap (guest ≈357 KB, core ≈4 KB).

Tab5 notes captured in hosts/esp-idf/README.md: rev 1.3 silicon (CONFIG_ESP32P4_SELECTS_REV_LESS_V3 + REV_MIN_100), the C6 SDIO preset with active-high reset on GPIO15, the WLAN rail on the PI4IOE5V6408 IO expander, and FREERTOS_HZ=1000.

Out of scope (staged / future)

manifest format 3 + requiresOneOf, the compiler surface-demand derivation and the globalThis.net/ws/httpd direct-reference rejection, advertising a network capability from a stock target, record/replay tooling, the PSP network substrate, HTTP Server / WebSocket Server admission on hardware, and the TLS extensions (custom CA, client auth, ALPN, TLS 1.3 requirement, revocation). The ESP-TLS async path exposes the Mbed TLS verify flags inconsistently, so on hardware a hostname mismatch is reported precisely while other certificate faults collapse to tls_handshake_failed (always fail-closed); the precise per-fault codes are proven in the desktop OpenSSL conformance suite.

Notes for reviewers

This supersedes the experimental stack in #282: the boundary is frame-bounded (no dispatcher/turn ABI), delivery is a bounded poll inside frame(), and the native cores never call QuickJS.