# Phase 1.0AB timeout and cleanup contract

This is a design contract, not live network code.

## Future required algorithm

1. Rehash policy, Z batch and approval before any capability creation.
2. Exclusively create, flush, close and reopen the consumed receipt.
3. Acquire one absolute monotonic deadline.
4. Create at most one stream socket and immediately set it nonblocking.
5. Start one numeric-address connect; never perform DNS.
6. For pending connect, wait for write/exception readiness using only the
   recomputed remaining budget, then require `SO_ERROR == 0`.
7. Send the exact batch with an offset loop. Each call requires prior write
   readiness; zero progress, excess count or error fails the attempt.
8. Switch to read readiness. Each read is bounded by both remaining collector
   capacity and a small fixed chunk size.
9. Treat empty receive as remote EOF and fail immediately.
10. After every wait or operation, read monotonic time again. At or beyond the
    deadline perform no further send or receive.
11. Ask Z to seal only because the hard deadline was reached. Partial or
    malformed data remains invalid.
12. In `finally`, unregister if registered, close the selector and close the
    local socket exactly once. Never retry, reconnect, resume or delete the
    consumed receipt.
13. Create sanitized output only after successful Z sealing and local cleanup.

## Conservative race rule

When readiness and deadline coincide, the deadline wins. No additional bytes
are read or sent at `now >= deadline`. This can reject data already queued by
the OS, but it cannot silently extend the approved window.

## Failure classifications

| Event | Required result |
|---|---|
| connect error or nonzero `SO_ERROR` | fail, local cleanup |
| selector interruption | recompute remaining budget; no retry counter |
| selector timeout before absolute deadline | recompute; never seal early |
| partial send | advance offset only by reported positive count |
| zero send | fail |
| receive over 65,536 bytes | fail |
| remote EOF | fail |
| deadline without complete Z result | fail |
| cleanup exception | fail and retain receipt |
| output collision or short host write | fail and retain existing evidence |

`close()` proves only local object closure. It does not prove TCP packet
delivery, remote shsrv exit, process cleanup or reboot recovery.