rea-agents 6.4.0 → 6.5.0

package/dist/process/OwnedCommand.js

@@ -1,5 +1,5 @@
 import { ProviderProcessSupervisor, spawnOwnedProviderProcess, } from "./ProviderProcess.js";
-import { cleanupOwnedProcessGroup } from "./ProcessOwnership.js";
+import { cleanupOwnedProcessGroup, } from "./ProcessOwnership.js";
 import { ProviderStartupDeadline, waitForAbortableDelay, } from "./ProviderDeadline.js";
 /** A short-lived command failed its lifecycle or complete-output contract. */
 export class OwnedCommandFailure extends Error {
@@ -8,6 +8,8 @@ export class OwnedCommandFailure extends Error {
     cleanupFailure;
     resources;
     cleanupOwner;
+    cleanupResult;
+    collectionFailure;
     constructor(reason, message, snapshot = null, cleanupFailure = null, options, resources = [], cleanupOwner) {
         super(message, options);
         this.reason = reason;
@@ -15,8 +17,17 @@ export class OwnedCommandFailure extends Error {
         this.cleanupFailure = cleanupFailure;
         this.resources = resources;
         this.cleanupOwner = cleanupOwner;
+        this.cleanupResult = options?.cleanupResult;
+        this.collectionFailure = options?.collectionFailure ?? false;
     }
 }
+/** Report recorded launch identities; these labels do not authorize signaling. */
+export const ownedCommandResources = (ownership, directory) => [
+    ownership.runId,
+    ...(directory === undefined ? [] : [directory]),
+    `pid:${ownership.leaderPid}`,
+    `process-group:${ownership.processGroupId}`,
+];
 /** Execute a single owned process with independent cleanup and bounded diagnostic retention. */
 export const runOwnedCommand = async (spawn, limits, options = {}) => {
     const callerSignal = options.signal ?? spawn.signal;
@@ -24,13 +35,13 @@ export const runOwnedCommand = async (spawn, limits, options = {}) => {
         throw new OwnedCommandFailure("cancelled", "Command cancelled before launch.");
     const deadline = new ProviderStartupDeadline(limits.timeoutMs, callerSignal);
     try {
-        return await collectOwnedCommand(spawn, limits, options.launcher ?? spawnOwnedProviderProcess, deadline, callerSignal);
+        return await collectOwnedCommand(spawn, limits, options.launcher ?? spawnOwnedProviderProcess, deadline, callerSignal, options.retainCleanup);
     }
     finally {
         deadline.dispose();
     }
 };
-const collectOwnedCommand = async (spawn, limits, launcher, deadline, callerSignal) => {
+const collectOwnedCommand = async (spawn, limits, launcher, deadline, callerSignal, retainCleanup) => {
     const signal = deadline.signal;
     let launched;
     try {
@@ -74,7 +85,9 @@ const collectOwnedCommand = async (spawn, limits, launcher, deadline, callerSign
             if (exceeded)
                 throw new OwnedCommandFailure("output-limit", "Command diagnostic output exceeded its complete-output budget.");
             if (processFailure !== undefined)
-                throw new OwnedCommandFailure("process", processFailure);
+                throw new OwnedCommandFailure("process", processFailure, null, null, {
+                    collectionFailure: true,
+                });
             await waitForAbortableDelay(25, signal);
         }
         const snapshot = supervisor.snapshot();
@@ -94,7 +107,7 @@ const collectOwnedCommand = async (spawn, limits, launcher, deadline, callerSign
             ((snapshot.exitCode !== 0 || snapshot.signal !== null) &&
                 !acceptedNonzeroExit))
             throw new OwnedCommandFailure("process", processFailure ??
-                "Command failed; inspect its exit status and diagnostics.", snapshot);
+                "Command failed; inspect its exit status and diagnostics.", snapshot, null, { collectionFailure: processFailure !== undefined });
     }
     catch (cause) {
         failure =
@@ -104,15 +117,26 @@ const collectOwnedCommand = async (spawn, limits, launcher, deadline, callerSign
     }
     const stopped = await supervisor.stop();
     const snapshot = supervisor.snapshot();
-    if (stopped.status === "incomplete")
-        throw new OwnedCommandFailure(failure?.reason ?? "process", failure?.message ?? "Command cleanup failed.", snapshot, stopped.reason, failure === undefined ? undefined : { cause: failure }, [
-            spawn.runId,
-            ...(spawn.cwd === undefined ? [] : [spawn.cwd]),
-            `pid:${launched.ownership.leaderPid}`,
-            `process-group:${launched.ownership.processGroupId}`,
-        ], supervisor);
+    if (stopped.status === "incomplete" && retainCleanup !== undefined)
+        retainCleanup(supervisor, stopped);
+    else if (stopped.status === "incomplete")
+        throw new OwnedCommandFailure(failure?.reason ?? "process", failure?.message ?? "Command cleanup failed.", snapshot, stopped.reason, {
+            ...(failure === undefined ? {} : { cause: failure }),
+            ...(stopped.cleanupResult === undefined
+                ? {}
+                : { cleanupResult: stopped.cleanupResult }),
+            ...(failure?.collectionFailure === true
+                ? { collectionFailure: true }
+                : {}),
+        }, ownedCommandResources(launched.ownership, spawn.cwd), supervisor);
     if (failure !== undefined)
-        throw new OwnedCommandFailure(failure.reason, failure.message, snapshot, failure.cleanupFailure, { cause: failure }, failure.resources);
+        throw new OwnedCommandFailure(failure.reason, failure.message, snapshot, failure.cleanupFailure, {
+            cause: failure,
+            ...(failure.cleanupResult === undefined
+                ? {}
+                : { cleanupResult: failure.cleanupResult }),
+            ...(failure.collectionFailure ? { collectionFailure: true } : {}),
+        }, failure.resources);
     if (callerSignal?.aborted)
         throw new OwnedCommandFailure("cancelled", "Command cancelled.", snapshot);
     return snapshot;

package/dist/process/PrivateRuntimeRoot.js

@@ -1,20 +1,13 @@
-import { chmod, mkdtemp, rm } from "node:fs/promises";
+import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { WindowsPrivateRuntime } from "../windows/WindowsPrivateRuntime.js";
+import { PrivateRuntimeRootUnavailableError } from "./PrivateRuntimeRootUnavailableError.js";
 import { windowsNativeCapabilities, } from "./WindowsAuthority.js";
 /** Report whether this process can establish a private runtime root. */
 export const privateRuntimeRootCapability = (platform = process.platform) => platform === "win32"
     ? windowsNativeCapabilities(platform).private_runtime_dacl
-    : { available: true, reason: null, proof: "posix-mode-0700" };
-/** Expected failure when a runtime root's privacy boundary is unavailable. */
-export class PrivateRuntimeRootUnavailableError extends Error {
-    code = "private-runtime-root-authority-unavailable";
-    constructor(message) {
-        super(message);
-        this.name = "PrivateRuntimeRootUnavailableError";
-    }
-}
+    : { available: true, reason: null, proof: "posix-mkdtemp-owner-only" };
 /**
  * Owns a private temporary runtime root and removes it idempotently.
  *
@@ -35,20 +28,17 @@ export class PrivateRuntimeRoot {
         const platform = options.platform ?? process.platform;
         const capability = privateRuntimeRootCapability(platform);
         if (!capability.available)
-            throw new PrivateRuntimeRootUnavailableError(capability.reason);
+            throw new PrivateRuntimeRootUnavailableError(capability.reason, {
+                retryable: capability.retryable === true,
+            });
         if (platform === "win32") {
             const runtime = WindowsPrivateRuntime.create(options.parent ?? tmpdir(), options.prefix ?? "rea-provider-");
             return new PrivateRuntimeRoot(runtime.observation.path, runtime);
         }
         const path = await mkdtemp(join(options.parent ?? tmpdir(), options.prefix ?? "rea-provider-"));
-        try {
-            await chmod(path, 0o700);
-            return new PrivateRuntimeRoot(path);
-        }
-        catch (cause) {
-            await rm(path, { recursive: true, force: true });
-            throw cause;
-        }
+        // POSIX mkdtemp establishes owner-only access atomically. Return its owner
+        // without a fallible permission rewrite and rollback after allocation.
+        return new PrivateRuntimeRoot(path);
     }
     /**
      * Remove the runtime root; concurrent callers share one attempt. A failed

package/dist/process/PrivateRuntimeRootUnavailableError.js

@@ -0,0 +1,10 @@
+/** Expected failure when a runtime root's privacy boundary is unavailable. */
+export class PrivateRuntimeRootUnavailableError extends Error {
+    code = "private-runtime-root-authority-unavailable";
+    retryable;
+    constructor(message, options) {
+        super(message, options);
+        this.name = "PrivateRuntimeRootUnavailableError";
+        this.retryable = options?.retryable ?? false;
+    }
+}

package/dist/process/ProcessOwnership.js

@@ -4,6 +4,7 @@ import { errorMessage, systemProcessOwnershipHost as systemHost, } from "./Proce
 import { launcherIdentityFailure } from "./ProcessOwnershipIdentity.js";
 import { descendantsOf, liveProcesses } from "./ProcessOwnershipProcessTree.js";
 import { readProcessRunTokens } from "./ProcessRunTokenObservations.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
 const execFileAsync = promisify(execFile);
 /**
  * Terminate one Windows process tree through the platform utility.
@@ -42,7 +43,11 @@ const systemWindowsProcessTreeHost = {
     },
 };
 /** Read the capture run token currently exposed by one live process. */
-export const readProcessRunId = async (pid, host = systemHost) => (await host.environment(pid)).REA_PROCESS_RUN_ID;
+export const readProcessRunId = async (pid, host = systemHost, signal) => (await host.environment(pid, signal)).REA_PROCESS_RUN_ID;
+/** Keep unrelated-process uncertainty attached to every outcome of this cleanup attempt. */
+const withUnverifiedObservations = (result, unverified) => unverified.length === 0 || (result.unverified?.length ?? 0) > 0
+    ? result
+    : { ...result, unverified };
 /** Token-validate every rooted POSIX process group before signaling any. */
 export const cleanupOwnedProcessGroup = async (ownership, host = systemHost) => {
     const processTable = await readLiveProcessTable(host);
@@ -57,8 +62,16 @@ export const cleanupOwnedProcessGroup = async (ownership, host = systemHost) =>
     let signaled = false;
     for (const processGroupId of plan.signalOrder) {
         const revalidation = await revalidateOwnedProcessGroup(processGroupId, ownership, host, plan.tokenOwnedIdentities);
-        if ("cleaned" in revalidation)
-            return revalidation;
+        if ("cleaned" in revalidation) {
+            if (!revalidation.cleaned)
+                return withUnverifiedObservations(revalidation, plan.unverified);
+            return {
+                ...revalidation,
+                ...(revalidation.unverified?.length || plan.unverified.length === 0
+                    ? {}
+                    : { unverified: plan.unverified }),
+            };
+        }
         if (revalidation.empty)
             continue;
         try {
@@ -68,10 +81,10 @@ export const cleanupOwnedProcessGroup = async (ownership, host = systemHost) =>
         catch (cause) {
             const code = cause instanceof Error && "code" in cause ? cause.code : undefined;
             if (code !== "ESRCH")
-                return {
+                return withUnverifiedObservations({
                     cleaned: false,
                     reason: `owned process group signal failed: ${errorMessage(cause)}`,
-                };
+                }, plan.unverified);
         }
     }
     if (plan.unresolved.length > 0)
@@ -222,8 +235,8 @@ const createOwnedCleanupPlan = async (ownership, initialProcesses, host) => {
                 diagnostic: "sampled process-group leader identity could not be verified",
             })));
         const scanFailures = tokenOwned.failures.filter(({ pid }) => members.some((member) => member.pid === pid));
-        if (failures.length > 0)
-            unresolved.push(...failures);
+        for (const failure of failures)
+            mergeProcessOwnershipFailure(unresolved, failure);
         if (failures.length === 0 &&
             scanFailures.length === 0 &&
             !unverifiableSampledGroups.has(processGroupId))
@@ -244,6 +257,26 @@ const createOwnedCleanupPlan = async (ownership, initialProcesses, host) => {
         unverified: tokenOwned.unverified,
     };
 };
+/** Keep one current, most useful ownership diagnosis for each live PID. */
+const mergeProcessOwnershipFailure = (failures, next) => {
+    const index = failures.findIndex(({ pid }) => pid === next.pid);
+    if (index < 0) {
+        failures.push(next);
+        return;
+    }
+    const previous = failures[index];
+    if (previous !== undefined &&
+        ownershipFailurePriority(next.reason) >=
+            ownershipFailurePriority(previous.reason))
+        failures[index] = next;
+};
+const ownershipFailurePriority = (reason) => reason === "run-token-mismatch"
+    ? 3
+    : reason === "process-identity-unavailable"
+        ? 2
+        : reason === "environment-unreadable"
+            ? 1
+            : 0;
 const revalidateOwnedProcessGroup = async (processGroupId, ownership, host, expectedIdentities) => {
     let members;
     try {
@@ -277,7 +310,13 @@ const cleanupValidationFailure = (failures, unverified = []) => {
     if (failures.some(({ reason }) => reason === "run-token-mismatch"))
         return {
             cleaned: false,
-            reason: "process tree contains an unowned or PID-reused process",
+            reason: `process ownership token mismatch for PID(s): ${[
+                ...new Set(failures
+                    .filter(({ reason }) => reason === "run-token-mismatch")
+                    .map(({ pid }) => pid)),
+            ]
+                .sort((left, right) => left - right)
+                .join(", ")}`,
             failures,
             ...unverifiedEntry,
         };
@@ -295,12 +334,12 @@ const cleanupValidationFailure = (failures, unverified = []) => {
             counts.set(category, (counts.get(category) ?? 0) + 1);
         }
         const breakdown = [...counts]
-            .sort(([left], [right]) => left.localeCompare(right))
+            .sort(([left], [right]) => compareUnicodeCodePoints(left, right))
             .map(([category, count]) => `${category}=${String(count)}`)
             .join(", ");
         const candidates = unreadable
             .map(({ pid, diagnostic }) => `${String(pid)}=${sanitizedTokenReadFailure(diagnostic)}`)
-            .sort((left, right) => left.localeCompare(right));
+            .sort((left, right) => compareUnicodeCodePoints(left, right));
         return {
             cleaned: false,
             reason: `process ownership token could not be read for ${String(unreadable.length)} live process(es): ${breakdown}; live candidates ${candidates.join(", ")}`,
@@ -320,6 +359,8 @@ const sanitizedTokenReadFailure = (diagnostic) => {
         return diagnostic;
     if (diagnostic === "platform_binary_environment_withheld")
         return diagnostic;
+    if (diagnostic === "restricted_process_environment_withheld")
+        return diagnostic;
     const environmentErrno = /^(EACCES|EPERM|ENOENT|ESRCH):/u.exec(diagnostic ?? "");
     if (environmentErrno?.[1] !== undefined)
         return `environment_errno_${environmentErrno[1]}`;
@@ -417,7 +458,15 @@ const recheckOwnershipFailures = async (failures, host) => {
     if (!failures.some(({ reason }) => reason !== "run-token-mismatch"))
         return failures;
     try {
-        const live = new Set(liveProcesses(await host.listProcesses()).map(({ pid }) => pid));
+        let processes = await host.listProcesses();
+        const isDarwin = (host.platform ?? process.platform) === "darwin";
+        for (let attempt = 0; isDarwin &&
+            attempt < TOKEN_READ_RETRY_ATTEMPTS &&
+            processes.some(({ pid, state }) => failures.some((failure) => failure.pid === pid && failure.reason !== "run-token-mismatch") && state.slice(1).includes("E")); attempt += 1) {
+            await new Promise((resolve) => setTimeout(resolve, TOKEN_READ_RETRY_DELAY_MS));
+            processes = await host.listProcesses();
+        }
+        const live = new Set(liveProcesses(processes).map(({ pid }) => pid));
         return failures.filter(({ pid, reason }) => reason === "run-token-mismatch" || live.has(pid));
     }
     catch (cause) {
@@ -433,20 +482,24 @@ const TOKEN_READ_RETRY_ATTEMPTS = 3;
 const TOKEN_READ_RETRY_DELAY_MS = 40;
 /** Darwin reports this when the kernel withholds a platform binary's environment. */
 const PLATFORM_BINARY_ENVIRONMENT_WITHHELD = "platform_binary_environment_withheld";
+/** Darwin reports this when the kernel withholds a restricted process environment. */
+const RESTRICTED_PROCESS_ENVIRONMENT_WITHHELD = "restricted_process_environment_withheld";
 const currentProcessUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 /**
  * Whether the operating system provably withheld this candidate's run token:
- * current macOS omits the environment of Apple platform binaries from
- * KERN_PROCARGS2 and fails with EINVAL for processes owned by another
- * account, and neither class can be token-verified by any caller. Such a
- * candidate is recorded as unverified instead of failing an otherwise clean
- * capture; every other unreadable candidate stays fail-closed.
+ * current macOS omits the environment of Apple platform binaries and
+ * CS_RESTRICT processes from KERN_PROCARGS2, and fails with EINVAL for
+ * processes owned by another account. These classes cannot be token-verified
+ * by this caller. An unrelated candidate is recorded as unverified instead
+ * of failing an otherwise clean capture; every related or otherwise
+ * unreadable candidate stays fail-closed.
  */
 const environmentWithheldFromInspection = (entry, diagnostic) => {
     const uid = currentProcessUid();
     if (uid !== undefined && entry.uid !== undefined && entry.uid !== uid)
         return true;
-    return diagnostic === PLATFORM_BINARY_ENVIRONMENT_WITHHELD;
+    return (diagnostic === PLATFORM_BINARY_ENVIRONMENT_WITHHELD ||
+        diagnostic === RESTRICTED_PROCESS_ENVIRONMENT_WITHHELD);
 };
 const scanTokenOwnedProcesses = async (processes, runId, host, captureBaseline, relation) => {
     let candidates = processes;

package/dist/process/ProcessOwnershipObservation.js

@@ -3,7 +3,7 @@ import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.
 import { launcherIdentityFailure } from "./ProcessOwnershipIdentity.js";
 import { descendantsOf, liveProcesses } from "./ProcessOwnershipProcessTree.js";
 import { execFileOutput } from "./ExecFileOutput.js";
-import { createDarwinProcessRunTokenReader } from "./DarwinProcessRunTokenReader.js";
+import { createDarwinProcessRunTokenReader, } from "./DarwinProcessRunTokenReader.js";
 import { readProcessRunTokens } from "./ProcessRunTokenObservations.js";
 /** Observe multiple groups from one process snapshot and one token batch. */
 export const observeOwnedProcessGroups = async (runId, processGroupIds, host = systemProcessOwnershipHost, signal) => {
@@ -156,10 +156,27 @@ const isExpectedAbort = (cause, signal) => signal?.aborted === true &&
         (cause instanceof Error && cause.name === "AbortError"));
 /** Create the operating-system process inspector for an explicit host context. */
 export const createSystemProcessOwnershipHost = (platform = process.platform, hostEnvironment = process.env, options = {}) => {
+    const darwinModuleCachePath = options.darwinModuleCachePath ??
+        hostEnvironment.REA_DARWIN_MODULE_CACHE_PATH;
+    const swiftcPath = hostEnvironment.REA_DARWIN_SWIFTC_PATH;
+    const darwinCompiler = options.darwinCompiler ??
+        (swiftcPath === undefined || swiftcPath === ""
+            ? undefined
+            : {
+                kind: "swiftc",
+                executable: swiftcPath,
+                sdkRoot: hostEnvironment.SDKROOT ?? "",
+            });
     const darwinTokens = platform === "darwin"
-        ? createDarwinProcessRunTokenReader(options.darwinXcrun === undefined
-            ? {}
-            : { xcrun: options.darwinXcrun })
+        ? createDarwinProcessRunTokenReader({
+            ...(darwinCompiler === undefined ? {} : { compiler: darwinCompiler }),
+            ...(darwinModuleCachePath === undefined
+                ? {}
+                : { moduleCachePath: darwinModuleCachePath }),
+            ...(options.compileTimeoutMs === undefined
+                ? { environment: hostEnvironment }
+                : { compileTimeoutMs: options.compileTimeoutMs }),
+        })
         : undefined;
     const listProcesses = async (signal) => {
         if (platform === "win32")
@@ -372,6 +389,20 @@ export const observeProcessStartIdentity = async (pid, host = systemProcessOwner
             reason: `process identity changed while validating the captured run token for PID ${String(pid)}`,
         };
 };
+/** Confirm whether the process that held an authenticated bridge has exited. */
+export const observeProcessStartIdentityExit = async (pid, expectedIdentity, host = systemProcessOwnershipHost) => {
+    try {
+        const observed = await observeProcessStartIdentity(pid, host);
+        if (observed === undefined)
+            return "exited";
+        if (observed.state !== "readable")
+            return "unverified";
+        return observed.identity === expectedIdentity ? "present" : "exited";
+    }
+    catch {
+        return "unverified";
+    }
+};
 /** Revalidate a launch-time start identity immediately before signaling a PID. */
 export const signalProcessWithStartIdentity = async (pid, expectedIdentity, signal, options = {}) => {
     const host = options.host ?? systemProcessOwnershipHost;

package/dist/process/ProviderDeadline.js

@@ -31,12 +31,12 @@ export class ProviderStartupDeadline {
         this.timeoutMs = timeoutMs;
         if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
             throw new RangeError("Provider startup timeout must be positive");
-        this.#deadlineAt = Date.now() + timeoutMs;
+        this.#deadlineAt = performance.now() + timeoutMs;
         this.#externalSignal = signal;
         this.#onExternalAbort = () => {
             if (this.#controller.signal.aborted)
                 return;
-            if (Date.now() >= this.#deadlineAt) {
+            if (performance.now() >= this.#deadlineAt) {
                 this.#interruption = "timeout";
                 this.#abort(new DOMException("Provider startup deadline elapsed", "TimeoutError"));
                 return;
@@ -49,12 +49,7 @@ export class ProviderStartupDeadline {
             return;
         }
         signal?.addEventListener("abort", this.#onExternalAbort, { once: true });
-        this.#timer = setTimeout(() => {
-            if (this.#controller.signal.aborted)
-                return;
-            this.#interruption = "timeout";
-            this.#abort(new DOMException("Provider startup deadline elapsed", "TimeoutError"));
-        }, timeoutMs);
+        this.#armDeadlineTimer(timeoutMs);
     }
     /** Composite signal aborted by either the caller or the absolute deadline. */
     get signal() {
@@ -63,15 +58,47 @@ export class ProviderStartupDeadline {
     /** First control path that interrupted startup, if any. */
     get interruption() {
         return (this.#interruption ??
-            (Date.now() >= this.#deadlineAt ? "timeout" : undefined));
+            (performance.now() >= this.#deadlineAt ? "timeout" : undefined));
     }
     /** Milliseconds still available to the next startup phase. */
     remainingMs() {
-        return Math.max(0, this.#deadlineAt - Date.now());
+        // Node timers can fire a fraction of a millisecond before the monotonic
+        // deadline, so an elapsed timer must not report time left to spend. A
+        // terminal timeout also cannot regain budget after later clock queries.
+        if (this.#interruption === "timeout")
+            return 0;
+        return Math.max(0, Math.ceil(this.#deadlineAt - performance.now()));
     }
-    /** Wait for at most one polling interval under the shared deadline signal. */
+    /**
+     * Wait for at most one polling interval under the shared deadline signal.
+     *
+     * Both timers may fire before their monotonic targets. Retain the earlier
+     * of the polling target and deadline, and wait again for any residual time.
+     */
     wait(milliseconds) {
-        return waitForAbortableDelay(Math.min(milliseconds, this.remainingMs()), this.signal);
+        const startedAt = performance.now();
+        // Absolute target: the earlier of the requested polling interval and the
+        // absolute monotonic deadline.
+        const targetAt = Math.min(startedAt + milliseconds, this.#deadlineAt);
+        const poll = () => {
+            const budget = this.remainingMs();
+            const residual = Math.max(0, targetAt - performance.now());
+            return waitForAbortableDelay(Math.min(residual, budget), this.signal).then((result) => {
+                if (result === "aborted")
+                    return "aborted";
+                const now = performance.now();
+                // The monotonic deadline expired: a full-budget wait resolves as an
+                // abort so polling stops at the boundary.
+                if (now >= this.#deadlineAt)
+                    return "aborted";
+                // The polling interval elapsed without expiring the deadline.
+                if (now >= targetAt)
+                    return "elapsed";
+                // A timer fired before the absolute target; keep waiting.
+                return poll();
+            });
+        };
+        return poll();
     }
     /** Release the deadline timer and external abort listener. */
     dispose() {
@@ -88,4 +115,23 @@ export class ProviderStartupDeadline {
             clearTimeout(this.#timer);
         this.#timer = undefined;
     }
+    /**
+     * Arm (or re-arm) the timer that expires the absolute monotonic deadline.
+     *
+     * Re-check the clock before classifying expiry, and retain the residual
+     * budget when the timer arrives early.
+     */
+    #armDeadlineTimer(milliseconds) {
+        this.#timer = setTimeout(() => {
+            this.#timer = undefined;
+            if (this.#controller.signal.aborted)
+                return;
+            if (performance.now() >= this.#deadlineAt) {
+                this.#interruption = "timeout";
+                this.#abort(new DOMException("Provider startup deadline elapsed", "TimeoutError"));
+                return;
+            }
+            this.#armDeadlineTimer(this.remainingMs());
+        }, milliseconds);
+    }
 }