fix: settle a shared abort operation by observation, not by drain count

The primitive decided a raced outcome by draining a hard-coded four
microtasks and then asking whether the task had landed. That made the
answer depend on scheduling rather than on what was observed: a caller
abort could fix the terminal owner synchronously and a rejection later in
the same call stack still won the public result, so `race()` disagreed
with `terminal()` and the failure taxonomy a caller received depended on
microtask ordering.

Task settlement and the terminal event now share one settle-once state
machine. Whichever callback actually runs first owns the outcome; a value
that loses is compensated exactly once and a rejection that loses is
absorbed, so neither can surface late.

The three consumers that kept their own copies of these mechanics move
onto it. The Image probe and the Resumable fetch transport attached their
caller listener before installing the timer, so a scheduler that threw
rejected the public `probe()`/`execute()` promise natively and left the
listener on the caller's signal; both now close atomically inside their
own Result vocabulary and start no fetch. `snapshotAbortTimers` binds the
scheduler callables once at construction, so replacing a method after
composition can no longer change how work already in flight is bounded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/image-cdn-runtime.test.ts

@@ -1936,6 +1936,115 @@ describe("browser image probe", () => {
       expect(close).toHaveBeenCalledOnce();
     });
   });
+
+  /**
+   * X-AUDIT-02. `probe()` promises a `BrowserDataResult`. A scheduler that
+   * cannot install the probe deadline must close the probe inside that contract
+   * rather than rejecting it, and must not leave the caller's listener behind.
+   */
+  describe("scheduler boundary", () => {
+    const trackedSignal = () => {
+      const controller = new AbortController();
+      const added: string[] = [];
+      const removed: string[] = [];
+      const add = controller.signal.addEventListener.bind(controller.signal);
+      const remove = controller.signal.removeEventListener.bind(
+        controller.signal,
+      );
+      Object.defineProperty(controller.signal, "addEventListener", {
+        configurable: true,
+        value: (type: string, ...rest: readonly unknown[]) => {
+          added.push(type);
+          return (add as (...args: readonly unknown[]) => unknown)(
+            type,
+            ...rest,
+          );
+        },
+      });
+      Object.defineProperty(controller.signal, "removeEventListener", {
+        configurable: true,
+        value: (type: string, ...rest: readonly unknown[]) => {
+          removed.push(type);
+          return (remove as (...args: readonly unknown[]) => unknown)(
+            type,
+            ...rest,
+          );
+        },
+      });
+      return { controller, added, removed };
+    };
+
+    it("closes the probe when the scheduler cannot install the deadline", async () => {
+      const fetcher = vi.fn(async () => new Response(null, { status: 200 }));
+      const { controller, added, removed } = trackedSignal();
+      const probe = createBrowserImageProbe({
+        fetcher: fetcher as unknown as typeof fetch,
+        createBitmap: vi.fn(),
+        timeoutMs: 1_000,
+        scheduler: {
+          setTimeout: () => {
+            throw new TypeError("image scheduler install exploded");
+          },
+          clearTimeout: vi.fn(),
+        },
+      });
+
+      await expect(
+        probe.probe({ ...request(), signal: controller.signal }),
+      ).resolves.toMatchObject({
+        ok: false,
+        error: { code: "UNAVAILABLE", retryable: true, recovery: "RETRY" },
+      });
+      expect(fetcher).not.toHaveBeenCalled();
+      expect(added.filter((type) => type === "abort")).toHaveLength(1);
+      expect(removed.filter((type) => type === "abort")).toHaveLength(1);
+    });
+
+    it("starts no timer and no fetch for an already aborted caller", async () => {
+      const fetcher = vi.fn(async () => new Response(null, { status: 200 }));
+      const setTimeout_ = vi.fn(() => 1);
+      const controller = new AbortController();
+      controller.abort();
+      const probe = createBrowserImageProbe({
+        fetcher: fetcher as unknown as typeof fetch,
+        createBitmap: vi.fn(),
+        timeoutMs: 1_000,
+        scheduler: { setTimeout: setTimeout_, clearTimeout: vi.fn() },
+      });
+
+      await expect(
+        probe.probe({ ...request(), signal: controller.signal }),
+      ).resolves.toMatchObject({ ok: false, error: { code: "ABORTED" } });
+      expect(fetcher).not.toHaveBeenCalled();
+      expect(setTimeout_).not.toHaveBeenCalled();
+    });
+
+    it("keeps the classified outcome when clearing the deadline throws", async () => {
+      const png = pngBytes(640, 360);
+      const probe = createBrowserImageProbe({
+        fetcher: (async () =>
+          responseAt(imageUrl, png, {
+            status: 200,
+            headers: publicImageHeaders("image/png", png.byteLength),
+          })) as typeof fetch,
+        createBitmap: vi.fn(async () => ({
+          width: 640,
+          height: 360,
+          close: vi.fn(),
+        })),
+        timeoutMs: 1_000,
+        scheduler: {
+          setTimeout: (callback: () => void, milliseconds: number) =>
+            setTimeout(callback, milliseconds),
+          clearTimeout: () => {
+            throw new TypeError("image scheduler clear exploded");
+          },
+        },
+      });
+
+      await expect(probe.probe(request())).resolves.toMatchObject({ ok: true });
+    });
+  });
 });
 
 describe("P-256 image capability verifier", () => {