chimera-gfx-Public/docs/retroarch/phase-1.0ab-timeout-and-cleanup-contract.md

Phase 1.0AB timeout and cleanup contract

This is a design contract, not live network code.

Future required algorithm

1. Rehash policy, Z batch and approval before any capability creation.
2. Exclusively create, flush, close and reopen the consumed receipt.
3. Acquire one absolute monotonic deadline.
4. Create at most one stream socket and immediately set it nonblocking.
5. Start one numeric-address connect; never perform DNS.
6. For pending connect, wait for write/exception readiness using only the recomputed remaining budget, then require SO_ERROR == 0.
7. Send the exact batch with an offset loop. Each call requires prior write readiness; zero progress, excess count or error fails the attempt.
8. Switch to read readiness. Each read is bounded by both remaining collector capacity and a small fixed chunk size.
9. Treat empty receive as remote EOF and fail immediately.
10. After every wait or operation, read monotonic time again. At or beyond the deadline perform no further send or receive.
11. Ask Z to seal only because the hard deadline was reached. Partial or malformed data remains invalid.
12. In finally, unregister if registered, close the selector and close the local socket exactly once. Never retry, reconnect, resume or delete the consumed receipt.
13. Create sanitized output only after successful Z sealing and local cleanup.

Conservative race rule

When readiness and deadline coincide, the deadline wins. No additional bytes are read or sent at now >= deadline. This can reject data already queued by the OS, but it cannot silently extend the approved window.

Failure classifications

Event	Required result
connect error or nonzero SO_ERROR	fail, local cleanup
selector interruption	recompute remaining budget; no retry counter
selector timeout before absolute deadline	recompute; never seal early
partial send	advance offset only by reported positive count
zero send	fail
receive over 65,536 bytes	fail
remote EOF	fail
deadline without complete Z result	fail
cleanup exception	fail and retain receipt
output collision or short host write	fail and retain existing evidence

close() proves only local object closure. It does not prove TCP packet delivery, remote shsrv exit, process cleanup or reboot recovery.