test(ui-server): measure native probe durations monotonically

[schlessera]

Closes #2180

Use performance.now() for the boot-probe test file’s eight elapsed observations and bounded polls. Preserve all thirteen original scenarios, native process/pipe/signal/warning/argv/liveness assertions and literal 4950/6500/1500 ms guarantees. Add forward/backward Date.now jumps around real five-second native probes, with direct-child cleanup/join and complete descriptor restoration even after failed assertions. Production clocks and timers remain unchanged.

Verification

Current candidate 7963e3d55bfd006508c52be672eb6350087f1810, integrated base 7cc86931e763f0eca636b89abd78b3b5371ec027. Only packages/ui-server/tests/boot-probe-deadline.test.ts differs from that base (63 additions / 8 deletions); its source SHA256 remains 363c847ea619052181bb2667eaa24fde4ce93139dd2a4b04503acd3549acc38e.

• Original failing-first controls with adjustable elapsed reads fail their intended assertions: forward 25005 ms exceeds the upper bound; backward -14998 ms violates the lower bound. Both native bodies take about five seconds, and cleanup/join/restoration assertions pass. Corrected controls pass 2 tests / 20 assertions. These earlier attributed receipts remain recorded in tests: boot-probe duration assertions depend on an adjustable wall clock #2180; no historical failed comparison was rerun unchanged for green.
• Current required preflight passes: lint/leakage and metadata gates, 53 fast tests / 1371 assertions, and the complete native file (15 tests / 109 assertions, 77.00 seconds). Execution uses the ordinary offline preload inside an explicit loopback-only unprivileged namespace with every capability set zero.
• Current focused delivered-prerequisite verification passes 19 tests / 126 assertions across document binding, native discovery process controls and real installed inventory.
• Current root strict TypeScript check passes.
• Original thirteen scenarios/assertions match the baseline after replacing only Date.now() with performance.now(); the two additional controls retain real native timer/process behavior.
• Confirmation 39032674383, attempt 1, passes all fourteen selected execution jobs: metadata/discovery, types, all four units, both browsers, both layouts, captures, endurance and both runtimes. Packaging intentionally skips. The aggregate fails solely on live-base advancement; the overall workflow remains failed. Every executed job (including aggregate) checked out ef5ba543ebb24238b18c96c0ddd50bc7280b8393, tree 9d6c84bfcef5f152a943da476087c8ad483363b8, parents the recorded base/head above; all thirteen artifact digests and checkout receipts verify. The two clock controls pass in unit 3 at 5003.80 / 5033.07 ms. Execution cost: 7168 summed job wall-seconds and 989 event seconds, not CPU time or additive elapsed.
• Incoming main 9c52e8c020aca6d8c4dcea0a2afd1640bc1bf60b contains only test(ui-server): amortize audited HTTP mount fixtures #1870 HTTP fixture pooling and fix(ui-sdk): validate restricted helper relay IPC #2335 restricted-relay validation beyond the hosted base. Neither changes this test, its production version-probe/exec-wrapper inputs, dependencies, preload or timing bounds. The prospective combined tree is 0515c4d6e20c7a35f82251611f5fce6ccf3f5239, locally recorded at 4dc10941121b3ec53fa4c07345a67a8221c72870, distinct from the hosted checkout. Relevant combined-tree preflight (53 / 1371 plus native 15 / 109), strict types and actual offline native identity/managed-checkpoint proof pass. Native proof retains restricted relay adverse cases, complete container/loop/worker/broker cleanup and unchanged namespace quota. Combined-tree HTTP mounts, launcher, runtime placement and sandbox focus passes 147 tests / 1310 assertions (one snapshot) across four files, 146.84 seconds.
• Merge qualification follows the explicit session selective-refresh instruction: retain the actual passing hosted executions and qualify affected newer inputs locally. This is not a green aggregate, a claim that the older hosted tree equals the combined tree, or a CI/protection override.

The previous full confirmation 39024472829 remains failed: 12 passing jobs, failed unit 4 (diagram binding #2314), failed runtime_host (Git ownership #2312), and stale-base aggregate. All fifteen actual checkouts were 30931b792cfe8c002d9ea77feb236b92c5f6dc33, parents dcc09e9c8601f6513eec907cfbf7d3ffbc01bf16 and 53474e42be9864fc00a6ec71621e781ae206720e, tree 90af48ae7ae902a6970760dc9343b2edbc151e19; all thirteen artifact digests verify. Its unit 3 passed this complete boot-probe file. #2326 and #2317 have since delivered the substantive corrections and are integrated here; the old failed workflow is not relabelled green. The native retained-namespace negative control was intentional and passed its verifier.

The maintainer’s session instruction permits retaining honestly attributed proof across unrelated main advances and refreshing affected proof when changes could sway results. This integration includes relevant discovery/native/build-harness changes, so current qualification is requested. No coordinated pause or reservation is asserted.

Checklist

• Scoped acceptance criteria, meaningful failing-first/native controls and current local preflight/types pass.
• All selected hosted execution jobs pass with actual identities verified; stale-base aggregate and selective-refresh merge basis are disclosed above.
• PR and issue have release milestone 0.44.0; recheck before merge.
• No changeset: tests only, no shipped behavior change.
• Leakage gate passes; no contract, provider-history or documented behavior change.

Anything left open

Merged normally with matching head as fac14b12e10f13e0c9553f1a5dbfd6f606a1c2e0, parent 9c52e8c020aca6d8c4dcea0a2afd1640bc1bf60b. Main ancestry and exact tree equality with the qualified combined tree 0515c4d6e20c7a35f82251611f5fce6ccf3f5239 are verified. #2180 is closed and both release 0.44.0 milestones are read back. Automatic main push 39033938992 is separately pending. #1939 is a separate saved implementation to refresh after this prerequisite lands; this PR does not close it or complete epic #1849.