feat(browser): retain MV3 failure profile cleanup evidence

[seonghobae]

Partial implementation of #27 and #28. Current exact head fbdf64f5818ce0c53b475196d5bcfa2ac9900846 is based on #139 b7ea5bfe336456fb263dd479a60b1cd0193d8a47.

Buyer/reliability boundary

The Manifest V3 repeatability lane retains cleanup evidence even when the initial or restarted browser pass fails. The owning trial catches only reviewed browser/process-teardown failure classes, retains a bounded failure type and verifies temporary-profile removal before returning cleanup evidence. Surface failures preserve their failing surface map and are not mislabeled as cleanup failure. Unexpected programming errors remain unnormalized; every trial must supply cleanup proof before the aggregate gate passes.

This is credential-free evidence for a controlled temporary profile, not proof of browser-process termination, adversarial filesystem erasure, unrelated extension cleanup, browser/adapter authenticity, durable recovery or completion of #27/#28.

TDD and historical evidence

Original test-only head 7df005847ffc45526de42bf6bf7a8ec6c959cbe0 exposed missing failure-path cleanup evidence. Surface-regression test-only head 645a71017c4603884da4cc6866e4e2a79c72e313 failed before repair 4fc623effbeaaa50963fec7c370671ca12bceee9. Existing regressions cover browser failure, compatibility-surface failure, aggregate cleanup admission and process-teardown timeout.

Earlier success for CI 32540508018 and pinned MV3 32540508974 belongs to predecessor bc9b265f31f2c4c7ddb700e865ec1f7b3daa6b01; neither it nor the later historical repair GREEN transfers to the current head.

Current exact-head verification

On 5 September 2026, all 183 repository Python contracts passed on unchanged current head fbdf64f5818ce0c53b475196d5bcfa2ac9900846. Controlled probes confirmed that an unexpected exception propagates after real temporary-profile cleanup, and that a cleanup-exit failure cannot return false success evidence. No source changes were needed for the remaining two informational findings; all four review threads are now resolved.

Exact-head review evidence records the scope and limits. Current hosted CI 33916583623 and pinned-Chromium compatibility 33916583506 are cancelled. Current full Rust, coverage, hosted or real-browser GREEN is not claimed. Thread resolution is not counted approval.

Stack / authority

Draft while #139/#136 and the prerequisite stack remain active. Exact-current hosted verification, parent-first integration and live policy requirements remain mandatory. No workflow, secret, ruleset, release, tag, publication or approval mutation is included.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

Devin Review found 2 new potential issues.

[seonghobae]

Exact-head review on fbdf64f5818ce0c53b475196d5bcfa2ac9900846, base #139 b7ea5bfe336456fb263dd479a60b1cd0193d8a47 (5 September 2026).

No new production change is warranted for the two informational threads:

• PRRT_kwDOTulPlM6cqoN-: an unexpected exception still exits the standard temporary-directory context before propagating. A controlled KeyError probe confirmed real profile removal and propagation without fabricated success/cleanup evidence. Known browser/teardown failures are already normalized by the owning trial boundary; widening to a catch-all would hide programming errors.
• PRRT_kwDOTulPlM6cqoO3: the explicit post-context existence assertion is a narrow evidence postcondition, not a claim of adversarial erasure. A controlled cleanup-exit PermissionError probe propagated without returning false profile_cleaned: true. The existing guard is consistent with the sibling forced-close trial and does not need an additional cleanup wrapper.

All 183 repository Python contracts pass on the unchanged current head, including browser-failure, surface-failure and teardown-timeout regressions. The temporary-profile probes are diagnostics, not real pinned-browser compatibility evidence. The worktree is unchanged.

Current hosted runs 33916583623 (Rust and coverage) and 33916583506 (pinned Chromium compatibility) are cancelled; historical GREEN on 4fc623effbeaaa50963fec7c370671ca12bceee9 or bc9b265f31f2c4c7ddb700e865ec1f7b3daa6b01 does not transfer. Resolving informational threads is neither formal approval nor permission to merge the Draft dependency stack.