Publish Chimera GFX source

docs/retroarch/phase-1.0ab-timeout-and-cleanup-contract.md

@@ -0,0 +1,50 @@
+# Phase 1.0AB timeout and cleanup contract
+
+This is a design contract, not live network code.
+
+## Future required algorithm
+
+1. Rehash policy, Z batch and approval before any capability creation.
+2. Exclusively create, flush, close and reopen the consumed receipt.
+3. Acquire one absolute monotonic deadline.
+4. Create at most one stream socket and immediately set it nonblocking.
+5. Start one numeric-address connect; never perform DNS.
+6. For pending connect, wait for write/exception readiness using only the
+   recomputed remaining budget, then require `SO_ERROR == 0`.
+7. Send the exact batch with an offset loop. Each call requires prior write
+   readiness; zero progress, excess count or error fails the attempt.
+8. Switch to read readiness. Each read is bounded by both remaining collector
+   capacity and a small fixed chunk size.
+9. Treat empty receive as remote EOF and fail immediately.
+10. After every wait or operation, read monotonic time again. At or beyond the
+    deadline perform no further send or receive.
+11. Ask Z to seal only because the hard deadline was reached. Partial or
+    malformed data remains invalid.
+12. In `finally`, unregister if registered, close the selector and close the
+    local socket exactly once. Never retry, reconnect, resume or delete the
+    consumed receipt.
+13. Create sanitized output only after successful Z sealing and local cleanup.
+
+## Conservative race rule
+
+When readiness and deadline coincide, the deadline wins. No additional bytes
+are read or sent at `now >= deadline`. This can reject data already queued by
+the OS, but it cannot silently extend the approved window.
+
+## Failure classifications
+
+| Event | Required result |
+|---|---|
+| connect error or nonzero `SO_ERROR` | fail, local cleanup |
+| selector interruption | recompute remaining budget; no retry counter |
+| selector timeout before absolute deadline | recompute; never seal early |
+| partial send | advance offset only by reported positive count |
+| zero send | fail |
+| receive over 65,536 bytes | fail |
+| remote EOF | fail |
+| deadline without complete Z result | fail |
+| cleanup exception | fail and retain receipt |
+| output collision or short host write | fail and retain existing evidence |
+
+`close()` proves only local object closure. It does not prove TCP packet
+delivery, remote shsrv exit, process cleanup or reboot recovery.