Board #812 / parent #729 — exact-pair npx resolution budget
Date: 2026-10-09 (Asia/Shanghai)
Base: 502390bfc79401935086f91455109fb6e96426ea
Scope: local test build only; no production change or npm publication.

Environment: official Node 22.23.0 bookworm image pinned in Dockerfile;
Bun 1.3.14 only for unit tests and building the test bundle.
The actual CLI and fake npx both execute under Node, not a Bun node alias.
Dependencies: npm ci from agent-network/package-lock.json, scripts disabled.

Commands (sg docker -c):
  docker build -f tests/test812-paired-resolve-timeout/Dockerfile -t anet-paired812:test .
  docker run --rm --cpus=2 --network none anet-paired812:test
Result: build rc=0; suite rc=0.
- 11 unit tests passed, 39 assertions (includes exact-package trust regressions).
- Real bundled CLI, isolated HOME/project, no Hub or host mounts:
  100ms budget interrupts delayed fake npx, exit 1, exact prefetch command shown.
  3000ms budget lets 800ms fake npx finish; original registry error retained.
  HTTPS_PROXY, HTTP_PROXY, NO_PROXY inherited in both cases.
- Mutation in disposable container only: replace CLI timeout wiring with 120000.
  Same real CLI test turns red rc=1: sees delayed registry failure instead of timeout.

Additional Docker checks (each independently executed, no output pipe):
- check-doc-symbol-pins.py: rc=0; 9 judged, 8 explicitly skipped, 0 unavailable refs.
- check-doc-source-pins.py: rc=0; 0 broken pins.
- check-test-suite-registration.py: rc=0; no new orphan suite.
git diff --check: rc=0.

Initial fixture corrections: standalone exact-pair unit run lacked agent-node/package.json;
added that package metadata to the Docker image, then the combined suite passed.
Documentation checker initially could not read git refs because container git safe.directory
was unset; supplied a container-only /repo setting with read-only git metadata mounts.
One real CLI line-number drift in docs/architecture.md was repinned to the unique branch.

Limitations: npx/network are simulated to make timeout behavior deterministic.
No real npm outage, credential, live node, restart, or full task exchange was exercised.
Existing exact-version/path validation is unchanged; other runtime resolver branches unchanged.
