docs: missing_docs sweep — 0 warnings + deny gate + publish-prep decisions (HY-02, HY-04, HY-11)

- document every public-API item across 18 files (openapi_spec model,
  HttpAuthScheme/HttpServiceConfig, HttpClientBuildError + SharedHttpClient
  accessors, RetryAfterMiddleware, GatewayDispatch, gateway error
  mapping, CallRequest/SchemaQuery/SubscribeStream, HttpAdapter +
  ALPNs + builders, decoy/healthz/state, WsSessions/WsPumps,
  from_openapi/from_jsonschema/from_mcp/from_wss/to_mcp, lib.rs module
  docs)
- enforcement: #![deny(missing_docs)] at crate root — stronger than CI
  rustdocflags (every build incl. cfg(test), where rustdoc misses the
  test-support module docs)
- HY-10 (opportunistic): all 8 docs.rs/alkhttp placeholder ADR links +
  the one relative ../docs link converted to plain text; the 10
  pre-existing private/redundant intra-doc-link warnings fixed —
  RUSTDOCFLAGS="-D warnings" cargo doc is fully clean
- HY-11 decision: docs/ + tasks/ excluded from the published package
  (contributor-facing design/process material; ADR references degrade
  to plain text uniformly). cargo publish --dry-run: 38 files, ~889 KiB,
  zero docs/ or tasks/ entries
- HY-04 decision: keep + document — frame_channel0_chunk's unwrap is
  on serializing the acyclic EventEnvelope (unreachable failure);
  # Panics on it and the adjacent WsClient senders state the contract

Verified: cargo test (299 + 5 TLS), --all-features (370 + suites),
--no-default-features (299), clippy --all-targets -D warnings
(default + all-features), fmt --check, cargo doc -D warnings clean,
cargo publish --dry-run --allow-dirty clean.

Tasks: review-001-missing-docs-sweep (final pending task; 42/42)

src/gateway/dispatch.rs

@@ -44,12 +44,17 @@ use serde_json::Value;
 
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(30);
 
+/// The shared dispatch spine: registry + identity provider, wired for
+/// the neutral `ResponseEnvelope` result shape both gateway projections
+/// map to their wire formats.
 pub struct GatewayDispatch {
     registry: Arc<OperationRegistry>,
     identity_provider: Arc<dyn IdentityProvider>,
 }
 
 impl GatewayDispatch {
+    /// Assemble a dispatch spine over a registry and an identity
+    /// provider.
     pub fn new(
         registry: Arc<OperationRegistry>,
         identity_provider: Arc<dyn IdentityProvider>,
@@ -60,18 +65,23 @@ impl GatewayDispatch {
         }
     }
 
+    /// The registry operations resolve against.
     pub fn registry(&self) -> &Arc<OperationRegistry> {
         &self.registry
     }
 
+    /// The identity provider bearer tokens resolve against.
     pub fn identity_provider(&self) -> &Arc<dyn IdentityProvider> {
         &self.identity_provider
     }
 
+    /// Resolve a bearer token to an identity (the auth-middleware hook).
     pub fn resolve_bearer(&self, token: &AuthToken) -> Option<Identity> {
         self.identity_provider.resolve_from_token(token)
     }
 
+    /// Invoke a Query/Mutation op under the 30 s gateway deadline; a
+    /// hung handler surfaces as a `TIMEOUT` error envelope (504).
     pub async fn invoke(
         &self,
         identity: Option<Identity>,
@@ -97,6 +107,9 @@ impl GatewayDispatch {
         }
     }
 
+    /// Dispatch a Sub op: the returned stream of envelopes is unbounded
+    /// by the deadline (subscriptions are long-lived per alkcall
+    /// ADR-021); pre-handler failures surface as one error envelope.
     pub fn invoke_streaming(
         &self,
         identity: Option<Identity>,

src/gateway/error.rs

@@ -40,10 +40,16 @@ const STATUS_INTERNAL: u16 = 500;
 
 const RETRY_AFTER_STATUSES: &[u16] = &[429, 503];
 
+/// Map a `CallError` to its HTTP status code (identity-blind variant:
+/// ambiguous codes resolve as if no identity were present).
 pub fn call_error_to_http_status(error: &CallError) -> u16 {
     call_error_to_http_status_with_identity(error, None)
 }
 
+/// Identity-aware status mapping: ambiguous protocol codes
+/// (`FORBIDDEN`, `INVALID_OPERATION_TYPE`) map 401 without an identity
+/// (you are not authenticated) and 403/422 with one (you are, but
+/// lack the authority).
 pub fn call_error_to_http_status_with_identity(
     error: &CallError,
     identity: Option<&Identity>,
@@ -74,6 +80,9 @@ pub fn call_error_to_http_status_with_identity(
     }
 }
 
+/// Map a `CallError` to a full HTTP response — status from
+/// [`call_error_to_http_status`], the serialized `CallError` as the
+/// JSON body.
 pub fn call_error_to_http_response(error: &CallError) -> Response {
     call_error_to_http_response_with_identity(error, None)
 }

src/gateway/routes.rs

@@ -98,15 +98,22 @@ pub(crate) fn gateway_router() -> Router<RouterState> {
         .route("/publish", post(publish_handler))
 }
 
+/// The `/call` and `/subscribe` request body: the target operation
+/// (with or without a leading `/`) and its input object.
 #[derive(Debug, Deserialize)]
 pub struct CallRequest {
+    /// The operation name, qualified (`namespace/op`); a leading slash
+    /// is tolerated.
     pub operation: String,
+    /// The operation input; defaults to null when the line omits it.
     #[serde(default = "Value::default")]
     pub input: Value,
 }
 
+/// The `GET /schema?name=<operation>` query parameters.
 #[derive(Debug, Deserialize)]
 pub struct SchemaQuery {
+    /// The operation name to project, qualified (`namespace/op`).
     pub name: String,
 }
 
@@ -212,6 +219,10 @@ pub(crate) async fn subscribe_handler(
         .into_response()
 }
 
+/// The SSE projection stream of `POST /subscribe`: each item is one
+/// wire-ready frame (a `data:` event or a keep-alive comment); the
+/// stream is infallible — errors arrive as in-band `event: error`
+/// frames (GW-04).
 pub type SubscribeStream = BoxStream<'static, Result<Event, Infallible>>;
 
 /// `POST /publish` (ADR-068): the body is NDJSON — one published chunk