Documentation

The start of a wait on the monotonic clock. The public call that waits takes it at its entry and hands it to every bound it runs under, so the elapsed time a failure reports covers the whole call — reads made before the wait proper included — and never less than the time actually spent.

Start a wait's clock.

Run an action as one wait on a transaction: the whole action, from its first step to its last, obeys the bound. When it has not returned after bound seconds the waiting thread is cancelled and the wait failure is raised. A prompt return passes through unchanged, and the action's own asynchronous exceptions reach it exactly as without the wrap: nothing here masks them. The elapsed time the failure reports is measured from this call.

boundWait with the elapsed time measured from an earlier clock: the bound applies to this action, the reported time to the whole call that started the clock.

boundWaitSince for a wait that can also give up on its own: an action that finds the confirmation window closed returns Left the POSIX deadline in milliseconds, and the wait ends at once with the same failure, carrying that POSIX deadline. The failure a closed window raises is the one a bound raises, so no caller can read it as a refusal.

Preserve the existing five-minute infrastructure bound.

A timeout remains a named infrastructure exception, never a submit verdict.

Run an action and classify what it throws: any synchronous exception is returned as Left, except the wait failure, which is rethrown, and asynchronous exceptions, which propagate. Every site that turns a failure into a refusal, a control outcome or a reason to retry catches through this, so a wait that gave up on a stalled node is never published as a ledger refusal nor retried as one.