flow: timeout combinator — cooperative step budget + 7 tests (Phase 2 complete)

(timeout budget node) bounds a node deterministically: nodes opt in via (tick),
budget ticks are allowed, the next raises flow-timeout. No scheduler/clock in pure
SX so the budget is a step count, not wall-clock. Budgets nest and are per-run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/flow-on-sx.md

@@ -16,7 +16,7 @@ federation extension via fed-sx for remote-node execution.
 
 ## Status (rolling)
 
-`bash lib/flow/conformance.sh` → **42/42** (Phase 1 done; Phase 2 in progress)
+`bash lib/flow/conformance.sh` → **49/49** (Phases 1-2 done; Phase 3 next)
 
 ## Ground rules
 
@@ -80,13 +80,17 @@ lib/flow/spec.sx           lib/flow/runtime.sx          lib/flow/store.sx
 - [x] `retry n` — re-runs node up to n attempts on a raised exception; last
   exception propagates. Only raised exceptions are retried — `(fail ...)` values
   pass through. 6 tests. (Backoff deferred: no wall clock in pure SX.)
-- [ ] `timeout ms` — bounds node execution
+- [x] `timeout budget` — bounds node execution via a **cooperative step budget**
+  (deterministic; no scheduler/clock in pure SX). Nodes opt in via `(tick)`;
+  `budget` ticks allowed, the next raises `flow-timeout`. Non-ticking nodes are
+  unbounded; budgets nest. 7 tests.
 - [x] `try-catch` — exception handler with reified error: `(try-catch node handler)`
   runs node; on raise, calls `(handler error)` and returns its value. 6 tests.
 - [x] error model — exceptions vs explicit `(fail reason)` results: `fail`/`failed?`/
   `fail-reason` produce/inspect failure values that flow downstream as data
   (distinct from raised exceptions caught by retry/try-catch). 6 tests.
-- [ ] `lib/flow/tests/control.sx` — 25+ cases: each combinator + composition
+- [x] `lib/flow/tests/control.sx` — 31 cases: branch, error model, try-catch,
+  retry, timeout + compositions
 
 ## Phase 3 — Suspend / resume (the showcase)