[ymote]

Components importing ordinary WASI TCP, UDP or DNS currently fail admission. Accept wasi:sockets and disclose its network reach, while requiring the importing app to declare host_api.required: {"wasm.sockets": 1} plus the existing host-api-v1 feature. This applies to bundled functions, catalog shared components and system-bundled components.

Use the existing extensible host API map instead of a new manifest feature: RC5's catalog reader rejects an entire catalog containing an unknown requires feature. Older hosts can read these entries and refuse the socket app before installation. Shared-component installation checks availability before download, validates the importing app's requirement even for cached components, and rechecks availability on launch. Missing net usage declarations warn and do not become execution gates.

For socket cancellation to remain valid when an app closes and reopens, host requests now carry a unique identity token. An old Replier cannot become pending again or consume a replacement request when both heap address and request number are reused. Completion/timeout queueing is synchronized with close, and response delivery rechecks its deadline after serialization.

Updated publishing/host API/shared-component documentation in English and Chinese. No contract version/schema change, catalog publication, release, or runtime-support claim for RC5. The OctoSense runtime and App Flow authoring changes are coordinated separately; the host must advertise wasm.sockets@1 only when its bounded WASI sockets implementation is available.

Validation on macOS Apple silicon:

• cargo test --locked -p octosense-app-contract -p octosense-app-policy -p octosense-app-hub: 335 passed across 27 suites, zero failures/skips.
• New coverage: TCP/UDP/DNS reach; absent, optional and wrong ABI declarations; shared/system component propagation; catalog read with unsupported socket API; refusal before fetch/install; supported-host install/launch; rejection after host availability changes; cached component requirement checks.
• hub component-info inspected the existing netprobe Wasm fixture and reported all seven standard socket interfaces.
• cargo test --locked -p octosense-appstore --no-default-features --lib services::tests: 18 passed, including reuse after close, timeout and prior completion.
• git diff --check passed.

Consumers: OctoSense #484 and App Flow #187 pin final head c317f787. The coordinated host passed its macOS runtime/shell checks and 11 standalone runtime tests on OnePlus 6; released RC5 remains unchanged.