fix: resolve third native check review follow-ups

Author: sunnylqm

NATIVE_CHECK_FOLLOWUPS.md

@@ -25,9 +25,9 @@
 | P4 endpoint 斜杠重复 | 已修复 | 三端首轮请求也先查规范化后的 `tried` 集合，重复项不计入 8 次上限 |
 | P4 Harmony 整请求超时 | 已修复 | check HTTP 增加 15s whole-call cap；更新下载增加绝对 deadline 并在超时后销毁请求 |
 
-代码验证基线：JS 完整回归 172 项、Biome/TypeScript/Harmony strict 类型检查、
-77 项 flow core ASan/UBSan、29 项 patch core、Android Release Java 编译、
-iOS Release simulator 构建均通过。
+代码验证基线：JS 完整回归 173 项、Biome/TypeScript/Harmony strict 类型检查、
+77 项 flow core ASan/UBSan、29 项 patch core、Harmony debug HAR、Android
+Release Java 编译、iOS Release simulator 静态库构建均通过。
 
 ---
 
@@ -36,6 +36,20 @@ iOS Release simulator 构建均通过。
 上表 13 项的修复经复评确认全部属实;以下为修复自身引入/暴露的新开放项
 (详情与逐条修法见评审面板)。
 
+复核后处理结论：
+
+| 项 | 结论 | 落地方式 |
+|---|---|---|
+| 1 iOS joiner 预算 | 已修复 | 注册表记录 owner 的单调时钟 deadline；预算更长的 waiter 观察当前进度但 deferred，owner 成功时由完成标记立即命中，失败时以自己的完整预算重启 |
+| 2 Harmony 外层时限 | 已修复 | `performAttempts` 用绝对单调 deadline 包住排队、HTTP、解压和 hpatch 的完整 Promise；底层串行任务即使晚结束也不再阻止编排器落响应缓存 |
+| 3 壁钟 deadline | 已修复并修正文档结论 | iOS 改用 `systemUptime`，Harmony 改用 `systemDateTime.getUptime`；full 预算进入 full 阶段才创建，因此原文“增量阶段校时会同时耗尽尚未创建的 full 预算”不成立 |
+| 4 Android full 判定 | 已修复 | 与分发逻辑及 iOS/Harmony 一致，非 diff/pdiff 统一视为 full；上游当前只生成三种合法类型，此项属于防御性收口 |
+| 5 坏发布遥测膨胀 | 已修复 | 缺 hash 与 noArtifact 共用按 appKey/reason/hash 的进程内去重，保留一次服务端可见的坏发布信号 |
+| 6 有 hash 无产物弹窗 | 已修复 | Provider 在展示/静默下载前复用 `decideDownload`，noArtifact 降级为 `upToDate` 与一次开发者遥测 |
+| 7 deferred UX/deadline | 已修复 | deferred waiter 订阅当前同 hash 进度；旧 deadline 在重新注册前校验，过期的编排器请求不会成为 owner 或结算后来的 JS 请求 |
+| 8 owner-only 进度事件 | 不采纳 | 支持路径在 JS 已按 hash 维持单一原生监听；常见 join 是无监听器的冷启动 engine + JS bridge。限制为 owner 发事件会在 engine 先成为 owner 时丢失 JS 进度 |
+| 9 iOS 完成判定重复 | 已修复 | 抽取 `PushyHasCompletedVersionAtPath`，预检与冷启动编排器共用同一 bundle+marker 判定 |
+
 **P2(三端时限模型的二阶问题,建议一并收口)**
 1. **iOS 合流者继承 owner 剩余预算**:JS 同 hash 同类型合流到编排器下载时,
    共享会话带的是编排器所剩阶段预算(可能只剩几十秒),其超时会结算全部

android/src/main/java/cn/reactnative/modules/update/NativeCheckOrchestrator.java

@@ -366,7 +366,7 @@ private static boolean performAttempts(
                 // diff patches from the running version; none is running.
                 continue;
             }
-            final boolean isFullAttempt = "full".equals(type);
+            final boolean isFullAttempt = !"diff".equals(type) && !"pdiff".equals(type);
             if (isFullAttempt && fullDeadlineNanos == 0) {
                 // Incremental failures must not consume the last-resort full
                 // download's budget. Each phase gets one bounded 10min window.

harmony/pushy/src/main/ets/DownloadTask.ts

@@ -11,6 +11,7 @@ import NativePatchCore, {
   ARCHIVE_PATCH_TYPE_FROM_PPK,
   CopyGroupResult,
 } from './NativePatchCore';
+import { monotonicNowMs } from './MonotonicClock';
 
 export const VERSION_COMPLETE_FILE_NAME = '.pushy-complete';
 
@@ -346,10 +347,10 @@ export class DownloadTask {
     let writeQueue = Promise.resolve();
     let lastReportedPercentage = -1;
     let lastReportedBytes = 0;
-    const deadlineAtMs = params.deadlineAtMs > 0
-      ? params.deadlineAtMs
-      : Date.now() + DOWNLOAD_CALL_TIMEOUT_MS;
-    if (deadlineAtMs <= Date.now()) {
+    const deadlineUptimeMs = params.deadlineUptimeMs > 0
+      ? params.deadlineUptimeMs
+      : monotonicNowMs() + DOWNLOAD_CALL_TIMEOUT_MS;
+    if (deadlineUptimeMs <= monotonicNowMs()) {
       throw Error('Download deadline expired before start');
     }
 
@@ -495,7 +496,7 @@ export class DownloadTask {
       const deadlinePromise = new Promise<never>((_, reject) => {
         deadlineTimer = setTimeout(() => {
           reject(Error('Download exceeded its whole-call deadline'));
-        }, Math.max(1, deadlineAtMs - Date.now()));
+        }, Math.max(1, deadlineUptimeMs - monotonicNowMs()));
       });
       const responseCode = await Promise.race([
         httpRequest.requestInStream(params.url, {

harmony/pushy/src/main/ets/DownloadTaskParams.ts

@@ -16,7 +16,7 @@ export class DownloadTaskParams {
   targetFile: string = ''; // 目标文件路径
   unzipDirectory: string = ''; // 解压目录路径
   originDirectory: string = ''; // 原始文件目录路径
-  // Native cold-start orchestrator's absolute wall-clock deadline. Zero uses
-  // the normal public download API's 10-minute whole-call cap.
-  deadlineAtMs: number = 0;
+  // Native cold-start orchestrator's absolute monotonic-uptime deadline. Zero
+  // uses the normal public download API's 10-minute whole-call cap.
+  deadlineUptimeMs: number = 0;
 }

harmony/pushy/src/main/ets/MonotonicClock.ts

@@ -0,0 +1,7 @@
+import { systemDateTime } from '@kit.BasicServicesKit';
+
+// Absolute deadlines must not use Date.now(): automatic time synchronization
+// can move the wall clock while the cold-start rescue round is running.
+export function monotonicNowMs(): number {
+  return systemDateTime.getUptime(systemDateTime.TimeType.STARTUP);
+}

harmony/pushy/src/main/ets/NativeCheckOrchestrator.ts

@@ -4,6 +4,7 @@ import logger from './Logger';
 import NativePatchCore from './NativePatchCore';
 import type { UpdateContext } from './UpdateContext';
 import { isSafePathComponent } from './PathUtils';
+import { monotonicNowMs } from './MonotonicClock';
 
 // 原生冷启动检测(NATIVE_CHECKUPDATE_DESIGN §10):每进程一次,getBundleUrl
 // 后延迟数秒运行,完全不依赖 app bundle——坏热更把 JS 砸挂后,下次启动仍能
@@ -409,13 +410,37 @@ function normalizeEndpointBase(base: string): string {
   return base.replace(/\/+$/, '');
 }
 
+async function runWithinDeadline(
+  start: () => Promise<void>,
+  deadlineUptimeMs: number,
+): Promise<void> {
+  const remainingMs = deadlineUptimeMs - monotonicNowMs();
+  if (remainingMs <= 0) {
+    throw Error('Download phase deadline expired before start');
+  }
+  let deadlineTimer = 0;
+  const deadlinePromise = new Promise<void>((_, reject) => {
+    deadlineTimer = setTimeout(() => {
+      reject(Error('Download phase deadline exceeded'));
+    }, remainingMs);
+  });
+  try {
+    // This bounds queueing, HTTP, decompression and native hpatch work from
+    // the orchestrator's perspective. The serialized task may still finish
+    // later, but it can no longer prevent the response cache from settling.
+    await Promise.race([start(), deadlinePromise]);
+  } finally {
+    clearTimeout(deadlineTimer);
+  }
+}
+
 async function performAttempts(
   context: UpdateContext,
   attempts: DecisionAttempt[],
   hash: string,
   originHash: string,
 ): Promise<boolean> {
-  const incrementalDeadline = Date.now() + DOWNLOAD_PHASE_TIMEOUT_MS;
+  const incrementalDeadline = monotonicNowMs() + DOWNLOAD_PHASE_TIMEOUT_MS;
   let fullDeadline = 0;
   for (const attempt of attempts) {
     const type = attempt.type ?? '';
@@ -428,26 +453,35 @@ async function performAttempts(
     if (isFullAttempt && fullDeadline === 0) {
       // Preserve a full 10min rescue budget even when diff/pdiff exhausted
       // their own phase window.
-      fullDeadline = Date.now() + DOWNLOAD_PHASE_TIMEOUT_MS;
+      fullDeadline = monotonicNowMs() + DOWNLOAD_PHASE_TIMEOUT_MS;
     }
     const deadline = isFullAttempt ? fullDeadline : incrementalDeadline;
     for (const url of attempt.urls ?? []) {
       if (!url) {
         continue;
       }
-      if (Date.now() >= deadline) {
+      if (monotonicNowMs() >= deadline) {
         if (isFullAttempt) {
           return false;
         }
         break;
       }
       try {
         if (type === DOWNLOAD_TYPE_DIFF) {
-          await context.downloadPatchFromPpk(url, hash, originHash, deadline);
+          await runWithinDeadline(
+            () => context.downloadPatchFromPpk(url, hash, originHash, deadline),
+            deadline,
+          );
         } else if (type === DOWNLOAD_TYPE_PDIFF) {
-          await context.downloadPatchFromPackage(url, hash, deadline);
+          await runWithinDeadline(
+            () => context.downloadPatchFromPackage(url, hash, deadline),
+            deadline,
+          );
         } else {
-          await context.downloadFullUpdate(url, hash, deadline);
+          await runWithinDeadline(
+            () => context.downloadFullUpdate(url, hash, deadline),
+            deadline,
+          );
         }
         return true;
       } catch (e) {

harmony/pushy/src/main/ets/UpdateContext.ts

@@ -467,7 +467,7 @@ export class UpdateContext {
   public async downloadFullUpdate(
     url: string,
     hash: string,
-    deadlineAtMs: number = 0,
+    deadlineUptimeMs: number = 0,
   ): Promise<void> {
     try {
       const params = this.createTaskParams(
@@ -477,7 +477,7 @@ export class UpdateContext {
       );
       params.targetFile = `${this.rootDir}/${hash}.ppk`;
       params.unzipDirectory = `${this.rootDir}/${hash}`;
-      params.deadlineAtMs = deadlineAtMs;
+      params.deadlineUptimeMs = deadlineUptimeMs;
       await this.executeTask(params);
     } catch (e) {
       console.error('Failed to download full update:', e);
@@ -503,7 +503,7 @@ export class UpdateContext {
     url: string,
     hash: string,
     originHash: string,
-    deadlineAtMs: number = 0,
+    deadlineUptimeMs: number = 0,
   ): Promise<void> {
     const params = this.createTaskParams(
       DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK,
@@ -514,14 +514,14 @@ export class UpdateContext {
     params.targetFile = `${this.rootDir}/${originHash}_${hash}.ppk.patch`;
     params.unzipDirectory = `${this.rootDir}/${hash}`;
     params.originDirectory = `${this.rootDir}/${params.originHash}`;
-    params.deadlineAtMs = deadlineAtMs;
+    params.deadlineUptimeMs = deadlineUptimeMs;
     await this.executeTask(params);
   }
 
   public async downloadPatchFromPackage(
     url: string,
     hash: string,
-    deadlineAtMs: number = 0,
+    deadlineUptimeMs: number = 0,
   ): Promise<void> {
     try {
       const params = this.createTaskParams(
@@ -531,7 +531,7 @@ export class UpdateContext {
       );
       params.targetFile = `${this.rootDir}/${hash}.app.patch`;
       params.unzipDirectory = `${this.rootDir}/${hash}`;
-      params.deadlineAtMs = deadlineAtMs;
+      params.deadlineUptimeMs = deadlineUptimeMs;
       return await this.executeTask(params);
     } catch (e) {
       console.error('Failed to download package patch:', e);