51 lines
2.3 KiB
Markdown
51 lines
2.3 KiB
Markdown
# Phase 1.0AB timeout and cleanup contract
|
|
|
|
This is a design contract, not live network code.
|
|
|
|
## Future required algorithm
|
|
|
|
1. Rehash policy, Z batch and approval before any capability creation.
|
|
2. Exclusively create, flush, close and reopen the consumed receipt.
|
|
3. Acquire one absolute monotonic deadline.
|
|
4. Create at most one stream socket and immediately set it nonblocking.
|
|
5. Start one numeric-address connect; never perform DNS.
|
|
6. For pending connect, wait for write/exception readiness using only the
|
|
recomputed remaining budget, then require `SO_ERROR == 0`.
|
|
7. Send the exact batch with an offset loop. Each call requires prior write
|
|
readiness; zero progress, excess count or error fails the attempt.
|
|
8. Switch to read readiness. Each read is bounded by both remaining collector
|
|
capacity and a small fixed chunk size.
|
|
9. Treat empty receive as remote EOF and fail immediately.
|
|
10. After every wait or operation, read monotonic time again. At or beyond the
|
|
deadline perform no further send or receive.
|
|
11. Ask Z to seal only because the hard deadline was reached. Partial or
|
|
malformed data remains invalid.
|
|
12. In `finally`, unregister if registered, close the selector and close the
|
|
local socket exactly once. Never retry, reconnect, resume or delete the
|
|
consumed receipt.
|
|
13. Create sanitized output only after successful Z sealing and local cleanup.
|
|
|
|
## Conservative race rule
|
|
|
|
When readiness and deadline coincide, the deadline wins. No additional bytes
|
|
are read or sent at `now >= deadline`. This can reject data already queued by
|
|
the OS, but it cannot silently extend the approved window.
|
|
|
|
## Failure classifications
|
|
|
|
| Event | Required result |
|
|
|---|---|
|
|
| connect error or nonzero `SO_ERROR` | fail, local cleanup |
|
|
| selector interruption | recompute remaining budget; no retry counter |
|
|
| selector timeout before absolute deadline | recompute; never seal early |
|
|
| partial send | advance offset only by reported positive count |
|
|
| zero send | fail |
|
|
| receive over 65,536 bytes | fail |
|
|
| remote EOF | fail |
|
|
| deadline without complete Z result | fail |
|
|
| cleanup exception | fail and retain receipt |
|
|
| output collision or short host write | fail and retain existing evidence |
|
|
|
|
`close()` proves only local object closure. It does not prove TCP packet
|
|
delivery, remote shsrv exit, process cleanup or reboot recovery.
|