@@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
 import { AppError } from '@agent-device/kernel/errors';
 import { IOS_DEVICE, IOS_SIMULATOR, MACOS_DEVICE } from './device-fixtures.ts';
 import {
+  COLD_TOOLCHAIN_PROBE_TIMEOUT_MS,
   diffComparableRunnerCacheMetadata,
   resolveRunnerBundleBuildSettings,
   resolveRunnerMaxConcurrentDestinationsFlag,
@@ -11,10 +12,20 @@ import {
   resolveRunnerSandboxBuildArgs,
   resolveExpectedRunnerCacheMetadata,
 } from '../runner-cache-metadata.ts';
+import { COLD_TOOLCHAIN_PROBE_TIMEOUT_MS as SNAPSHOT_SOURCE_COLD_TOOLCHAIN_PROBE_TIMEOUT_MS } from '../../snapshot-source/cache-identity.ts';
 import { appleToolchainProbeResult, stubAppleToolchainProbes } from './apple-toolchain-fixtures.ts';
 
 const runCmdSync = stubAppleToolchainProbes();
 
+// This file's COLD_TOOLCHAIN_PROBE_TIMEOUT_MS is a deliberate local copy of
+// snapshot-source/cache-identity.ts's constant of the same name, not an
+// import of it -- see the doc comment on the export in
+// runner-cache-metadata.ts for why. This test is what keeps the two values
+// from drifting apart (#2422).
+test('COLD_TOOLCHAIN_PROBE_TIMEOUT_MS matches the copy in snapshot-source/cache-identity.ts', () => {
+  assert.equal(COLD_TOOLCHAIN_PROBE_TIMEOUT_MS, SNAPSHOT_SOURCE_COLD_TOOLCHAIN_PROBE_TIMEOUT_MS);
+});
+
 test('resolveRunnerMaxConcurrentDestinationsFlag uses simulator flag for simulators', () => {
   assert.equal(
     resolveRunnerMaxConcurrentDestinationsFlag(IOS_SIMULATOR),
 
@@ -18,13 +18,27 @@ import {
   resolveRunnerSdkName,
 } from './apple-runner-platform.ts';
 import { computeRunnerSourceFingerprint } from './runner-source.ts';
-import { COLD_TOOLCHAIN_PROBE_TIMEOUT_MS } from '../toolchain-probe-budget.ts';
 
 const DEFAULT_IOS_RUNNER_APP_BUNDLE_ID = 'com.callstack.agentdevice.runner';
 const RUNNER_DERIVED_ROOT = path.join(os.homedir(), '.agent-device', 'apple-runner');
 export const RUNNER_CACHE_METADATA_FILE = '.agent-device-runner-cache.json';
 const RUNNER_CACHE_SCHEMA_VERSION = 2;
 const RUNNER_CACHE_METADATA_VALUE_MAX_LENGTH = 300;
+
+/**
+ * Per-call timeout for a toolchain identity probe (`xcodebuild -version`,
+ * `xcrun --show-sdk-version`, …). Must equal `COLD_TOOLCHAIN_PROBE_TIMEOUT_MS`
+ * in `../snapshot-source/cache-identity.ts` -- both absorb the same ~18 to
+ * 19 second syspolicyd signature-scan stall on the first `xcodebuild`/
+ * `xcrun` exec after a fresh macOS host boots (#2422). It is declared here
+ * rather than imported from that module because this file sits in every
+ * platform-apple façade's eager closure and `snapshot-source/*` does not
+ * (`scripts/__tests__/eager-closure-budgets.ts`); a unit test
+ * (`__tests__/runner-cache-metadata.test.ts`) asserts the two constants stay
+ * equal so they cannot drift apart.
+ */
+export const COLD_TOOLCHAIN_PROBE_TIMEOUT_MS = 30_000;
+
 const TOOLCHAIN_PROBE_MAX_BUFFER = 128 * 1024;
 const TOOLCHAIN_PROBE_DETAIL_MAX_LENGTH = 200;
 const TOOLCHAIN_PROBE_HINT =
 
@@ -4,7 +4,27 @@ import type { ExecResult } from '@agent-device/host-kit/command';
 import { snapshotSourceError } from './errors.ts';
 import { remainingSnapshotSourceMs, type SnapshotSourceDeadline } from './deadline.ts';
 import type { SnapshotSourceHost } from './types.ts';
-import { COLD_TOOLCHAIN_PROBE_TIMEOUT_MS } from '../toolchain-probe-budget.ts';
+
+/**
+ * Per-call timeout for a toolchain identity probe (`xcodebuild -version`,
+ * `xcrun --show-sdk-version`, `sw_vers`, `uname`, …). On a fresh macOS host,
+ * Apple's syspolicyd signature scan blocks the very first `xcodebuild`/
+ * `xcrun`/large-binary exec after boot for roughly 18 to 19 seconds at 0%
+ * CPU; the second exec of the same tool is instant. A budget sized for a
+ * warm toolchain (the old 10 s / 5 s split) trips on that cold-start stall
+ * and reports a bogus toolchain-probe timeout unrelated to the change under
+ * test (#2422).
+ *
+ * `runner/runner-cache-metadata.ts` needs this same budget but cannot import
+ * it from here: this module is outside every platform-apple façade's eager
+ * closure today, and importing it from `runner-cache-metadata.ts` would pull
+ * `snapshot-source/*` into all of them (`scripts/__tests__/eager-closure-
+ * budgets.ts`). It instead declares its own copy of this constant, checked
+ * against this one for equality by a unit test
+ * (`runner/__tests__/runner-cache-metadata.test.ts`) so the two cannot drift
+ * apart.
+ */
+export const COLD_TOOLCHAIN_PROBE_TIMEOUT_MS = 30_000;
 
 export type SnapshotSourceToolchainIdentity = Readonly<{
   xcode: string;